24-000103 Arbor DDOS mititgation LSJ.pdf

“Source Selection Information – see FAR 2.101 and 3.104” TIC Arbor DDoS Software and Hardware

1. Identification of the agency and contracting activity:

a. Federal agency and contracting activity. HHS.

Department of Health and Human Services (HHS) National Institutes of Health (NIH)

b. Sponsoring organization.

National Institutes of Health Center for Information Technology (CIT)

c. Project Officer information.

Stacy Knott, Network Services Center for Information Technology (CIT)National Institutes of Health (NIH) 6555 Rock Spring Drive, Room 3D19Bethesda, MD 20852 301-402-8450 Stacy.knott@nih.gov

2. Nature and/or description of the action being approved.

a. Acquisition purpose and objectives. This procurement is to acquire Distributed Denial of Service (DDoS) software, hardware and mitigation services for the HHS Trusted Internet Connection (TIC) software and hardware for Bethesda, Maryland to Atlanta, Georgia and Ashburn, Virginia sites to protect against DDoS attacks that aim to disrupt or disable critical network services. This protective service will be provided on the existing Lumen equipment and circuits.

b. Project background. CIT Network Services needs to acquire Arbor hardware to perform DDoS mitigation services in support of the HHS Trusted Internet Connection (TIC) that supports all HHS Operating Divisions (OpDivs). The purpose of this hardware acquisition is to upgrade the existing equipment and service required to maintain system operation to protect against Distributed Denial-of-Service (DDoS) attacks. A distributed denial-of-service (DDoS) attack is a malicious attempt to disrupt the normal traffic of a targeted server, service or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic. These attacks aim to disrupt or disable critical HHS programs and services. This protective service will be added to existing proprietary Lumen equipment and circuits. The current DDoS solution is a service model only without a hardware component. The current solution has been found to be inadequate to support the upcoming HHS Trusted Internet Connection (TIC) upgrade to 100 Gbps from 40 Gbps.

Limited Source Justification

3. Description of the supplies or services required to meet the agency’s needs (including the estimated value).

a. Project title. TIC Arbor DDoS Software and Hardware

b. Project description.

This procurement is to provide Distributed Denial of Service (DDoS) Software, Hardware upgrades and DDoS mitigation services for the HHS Trusted Internet Connection (TIC) to protect against DDoS attacks that aim to disrupt or disable critical network services. The software and hardware will update the existing proprietary Lumen equipment and circuits. The period of performance is for one (1) base period and two (2) option years.

Base Period 12 months 7/1/2024 - 6/30/2025

Option year 1 7/1/2025 - 6/30/2026

Option year 2 7/1/2026 - 6/30/2027

Requirement type:

Support services (non-research & development) Supplies/equipment Information technology (IT) Other (specify):

Type of action:

New requirement Follow-on Other (specify):

Proposed contract/order type:

Firm-fixed-price Time and materials Indefinite delivery (specify whether indefinite quantity, definite quantity, or requirements):

Other (specify):

iii. Acquisition identification number:

GSA RFQ number will be identified when solicitation is issued.

c. Total estimated dollar value and performance/delivery period.

Base Year: 7/1/2024 - 6/30/2025 Option Year: 7/1/2025 - 6/30/2026 Option Year: 7/1/2026 - 6/30/2027 Total:

4. Identification of the justification rationale [see 8.405-6(a) and (b)] and, if applicable, a demonstration of the proposed contractor’s unique qualifications to provide the required supply or service.

a. Acquisition authority.

This acquisition is conducted under the authority of the Multiple Award Schedule Program. Consideration of schedule contractors= will be restricted to fewer than the number required by Federal= Acquisition Regulation (FAR) 8.405-6(a)(1) [see FAR 8.401, 8.405-1, 8.405-2, 8.405-6(b), and 8.405-6(g)(1)] (i.e., fewer than three FSS= contractors).

This acquisition is conducted under the authority of the Multiple

Award Schedule Program. Consideration of schedule contractors will be restricted only to the item peculiar to one manufacturer as provided in FAR 8.405-6(a)(2) [see FAR 8.401 and 8.405-6(g)(1)].

b. Demonstration of the proposed contractor(s) unique qualifications to provide the required supply or service.

Name and address of the proposed contractor(s).

Lumen Technologies Government Solutions, Inc.

4250 N. Fairfax Drive Arlington, VA 22203-1665 Atten: Lori Ivy Phone: 720-578-6864 Email: Lori.Ivy@Lumen.com

Nature of the acquisition and proposed contractor(s) unique qualifications.

This procurement is to acquire Distributed Denial of Service (DDoS) Software and Hardware for the HHS Trusted Internet Connection (TIC) software and hardware to protect against DDoS attacks that aim to disrupt or disable critical network functionality. This protective service will be provided on the existing Lumen equipment, circuits, and proprietary infrastructure.

Lumen Technologies Government Solutions Corporation is the owner of these circuits, equipment, and infrastructure. Therefore, Lumen is the only vendor authorized to provide the mitigation and monitoring for the specified circuits that include the Trusted Internet Connection (TIC) at NIH. Hence, the DDoS Software and Hardware and mitigation services must be provided by Lumen Technologies Government Solutions Corporation. The TIC routers at Atlanta, Bethesda and Ashburn are directly connected to Lumen Technologies Government Solutions; and only Lumen Technologies Government Solutions Corporation can provide this service to NIH/CIT.

5. Determination by the ordering activity Contracting Officer that the order represents the best value consistent with FAR 8.404(d).

Since (a) GSA has already determined the prices of the supplies and services under FSS contracts, including rates for services offered at fixed hourly rates, to be fair and reasonable; and (b) by placing an order against a schedule contract using the procedures in FAR 8.405, the ordering activity CO has concluded that the order represents the best value (see FAR 2.101) and results in the lowest overall cost alternative, the determination shall cite:

The Contracting Officer anticipates the cost to the Government will be fair and reasonable based on historical pricing data. The Contracting Officer will make these determinations by reviewing the independent government cost estimate, quoted price, and review of the historical pricing.

(i) whether any additional discounts will be sought before placing an order (see FAR 8.405-4).

(ii) the type of pricing information, if any, that will be obtained from the schedule contractor(s) in relation to seeking additional discounts; and

(iii) the extent of the price evaluation anticipated in order to determine that the total price is reasonable – see FAR 8.405-2(d).

The Contracting Officer will negotiate a fair and reasonable price for the procurement of the circuits.

6. Description of the market research conducted among schedule holders and the results, or a statement of the reasons market research was not conducted.

Market research was conducted in accordance with FAR Part 10 by the Service Area and is based on reviewing pricing on the desired products/services from Lumen Technology Government Solutions Corporation, historical data and contacting knowledgeable acquisition and program officials in Government and industry regarding market capabilities.

In previous iterations of procuring DDoS Mitigation Services, the mandatory priorities, in accordance with FAR Subpart 8.002(a)(1) Priorities for Use of Government Supply Sources were also reviewed, and determination was made that one of the mandatory Government sources could satisfy this requirement.

GSA Multiple Award Schedule (MAS) was reviewed. Lumen Technologies was found on the GSA/MAS Schedule and is awarded under Category 54151ECOM Electronic Commerce and Subscription Services which would cover DDOS Mitigation services. The manufacturer has confirmed that these services were not available under SEWP or NITAAC.

Based upon the market research noted and the outcome of the information obtained, there is evidence to support issuing the sole source solicitation directly to Lumen Technologies Government Solutions Corporation.

7. Any other facts supporting the justification.

This justification is based on only one vendor being capable of providing the TIC support. If this acquisition is not completed the TIC will continue to be exposed to malicious actors that seek to disrupt HHS daily operations by bringing down internet connectivity. This will directly impact the execution of the HHS mission until restored. It is impossible to calculate the monetary damages that would be incurred. Networks Services is seeking an award of a base plus 2 option years to ensure continuity of service and keep costs stable.

8. Statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the restricted consideration before any subsequent acquisition for the supplies or services is made.

a. Removal of barriers to competition. For the reasons stated above, currently, only

Lumen Technologies Government Solutions Corporation will satisfy agency requirements for commonality, interchangeability, and interoperability. The Government is unable to remove or overcome those barriers that preclude consideration of other sources until it is fiscally justified to change the entire NIH infrastructure. Additionally, after discussions with the HHS EIS (Enterprise Infrastructure Solutions) Contracting Officer, Cristy Scott, it has been determined that the circuits are not currently available on the HHS EIS Contract award. Verizon does not have an anticipated timeline for the circuits to be available or transitioned. Verizon would be required to negotiate with Lumen to obtain access to their infrastructure and install new cabling. This effort would take years and millions of dollars to complete. The LSJ will be posted in accordance with FAR 8.405-6(a)(2).

b. Listing of sources, if any, that expressed an interest, in writing, in the acquisition.

N/A