2275690 JA for HydrantID software.pdf

Justification for Other than Full and Open Competition:

Brand-Name at or Below the Simplified Acquisition Threshold

Project Title: Brand Name – HydrantID Trusted TLS/SSL Service FY26

I . Identification of the agency and contracting activity

DHHS, NIH, NIAID/OD/OSMO/OCICB/OEB

Address of the requesting lab/office: Rockville, MD

II. Description of the project, and supplies or services required to meet the agency’s needs (including the estimated

D. Period of performance, inclusive of options: 12/15/2025-12/14/2026 E. Project Background

The National Institute of Allergy and Infectious Diseases' (NIAID) Operations and Engineering Branch (OEB) of the Office of Cyber Infrastructure and Computational Biology (OCICB) manages and develops the technology infrastructure that supports Intramural research, Extramural investments and Administrative management. OEB provides Enterprise Application Hosting services for over 200 Enterprise Applications. Enterprise Application Hosting services provided by OEB are maintained and used 24 hours a day, 7 days a week. To secure these Enterprise applications, OEB uses TLS/SSL certificates which are provided by a Trusted SSL Service provider like HydrantID.

F. Description of the supplies/services to be purchased Complete common generic identification of the item required. Trusted SSL Service to provide TLS/SSL certificates Applicable model, make, or catalog number for each brand name product referenced and identity of the commercial catalog in which it appears:

(1) Single Legal Organizational Entity

(2) Up to 10 System Administrators

(3) Up to 15 internet domains* – no limit on sub-domains

(4) Up to 500 active SSL Certificates* Includes 5 EV Code Signing Certificates (hardware or HSM) issued via IdenTrust

(5) Up to 99 SANs per Certificate

(6) Included Certificate types: Organizational Validated Certificates (OV) Wildcard Validated Certificates (WC) Multi-Subject Alternative Naming Certificates (SANS)

Name of manufacturer, producer, or distributor of each brand name product referenced (and address if not well known).

HydrantID

III. Identification of the statutory authority permitting other than full and open competition (SELECT ONE)

41 USC 3304(a)(1) a n d F A R P a r t 6 . 3 0 2 - 1 : Only one responsible source / Brand Name F A R P a r t 8 . 4 0 5 - 6 : Federal Supply Schedule (FSS), limited competition / Brand Name

Important Note: The statutory authority listed below will rarely ever be used in NIH. Before selecting this authority, please ensure that you have read and understood the citation and discussed it with the cognizant Contracting Officer.

41 USC 3304(a)(5) a n d F A R P a r t 6 . 3 0 2 - 5 : Authorized or required by statute / Brand Name

IV. Demonstration that the proposed brand name product’s salient charictoristics (specific features, qualities and/or the nature of the acquisition) requires use of the authority cited.

This request is for a full year of HydrantID TLS Certificates to secure applications we host/support. This will help to ensure that the Applications Hosting team will have certificates available on an ongoing basis through the FY26 year. The certificates are good for a 12 month period of time. (This does not include certificates purchased for special service such as Lync and the Monarch Platform). These certificate renewals provided by HydrandID will be used to install new SSL certificates on a web servers or to renew an expiring certificates. HydrandID is the HHS/NIH standard security technology for web and cloud based services and is required to be used for these IT applications. These certificates are embedded within IT security software and systems; at this time, NIAID would be unable to implement an alternative without massive disruptions and, most importantly, putting numerous experiments at risk of failure. Without these certificates numerous IT systems would have to be taken offline to ensure data security, basically bringing the flow of information to a standstill. These digital signatures are critical to NIAID IT infrastructure ensuring that all data passed between the web server and browser remains private and secure.