26-SIMACQ-D40-0003_Splunk JA-Redacted.pdf

Brand Name Justification under $350K

PID Number: 26-SIMACQ-D40-0003

Department: D42

Company Name/Brand: Splunk Enterprise

Description of Product, Supplies or Services required to meet the agency’s needs:

Naval Surface Warfare Center Port Hueneme Division (NSWC PHD) requires the renewal of Splunk software licenses for a continuous data ingestion rate of 165 GB per day. This software provides critical Security Information and Event Management (SIEM) and continuous monitoring capabilities deployed across shipboard and shore-based Impact Level 5 (IL5) environments. The software is used to support the Zumwalt Total Shipboard Computing Environment (TSCE), increasing the security posture of the shipboard system.

Splunk software is available under the Department of Defense (DOD) Blanket Purchase Agreement (BPA) Core Enterprise Technology Agreement (CETA) # N66001-20-A-0022 / Multi-Agency Contract (MAC) number GS-35F-0119Y with vendor Carahsoft Technologies Corporation. Under this BPA, Carahsoft Technologies Corporation has authorized dealers in the Ordering Guide that can provide Splunk software.

Requirement Description:

-Splunk Enterprise - Term License with Standard Success Plan 1 Year (5 support contacts) - 100 GB/day 100 of 165GB (Renewal) Entitlement = E-0009038.

Splunk, LLC - SE-T-LIC-ST-100GB

-Splunk Enterprise - Term License with Standard Success Plan 1 Year (3 support contacts) - 50 GB/day 50 of 165GB (Renewal) Entitlement = E-0009038 Splunk, LLC - SE-T-LIC-ST-50GB

-Splunk Enterprise - Term License with Standard Success Plan 1 Year (3 support contacts) - 10 GB/day 10 of 165GB (Renewal) Entitlement = E-0009038 Splunk, LLC - SE-T-LIC-ST-10GB

-Splunk Enterprise - Term License with Standard Success Plan 1 Year (2 support contacts) - 5 GB/day 5 of 165GB (Renewal) Entitlement = E-0009038 Splunk, LLC - SE-T-LIC-ST-5GB

Splunk Enterprise Security Essentials - Term License with Standard Success Plan - 100 GB/day-1 YR 100 of 165GB (Renewal) Splunk, LLC - ES-T-LIC-ST-100GB

-Splunk Enterprise Security Essentials - Term License with Standard Success Plan - 50 GB/day-1 YR 50 of 165GB (Renewal) Splunk, LLC - ES-T-LIC-ST-50GB

Standard Success Plan - 10 GB/day-1 YR 10 of 165GB (Renewal) Splunk, LLC - ES-T-LIC-ST-10GB

Standard Success Plan - 5 GB/day-1 YR 5 of 165GB (Renewal) Splunk, LLC - ES-T-LIC-ST-5GB

Identification of Justification Rationale:

☒ The Material or service must be compatible with aspects (Form, Fit, and Function) with existing systems presently installed.

☒ A patent, copyright, proprietary data, or licensing agreement limits competition.

☒ These are “direct replacement(s)” parts/components for existing equipment.

☐ Urgency.

Statutory Authority Permitting Other Than Full and Open Competition

10 U.S.C. 3204(a)(1). The property or services needed by the agency are available from only one responsible source or only from a limited number of responsible sources and no other type of property or services will satisfy the needs of the agency: IAW 6.103-1 Only one responsible source and no other supplies or services will satisfy agency requirements.

Identification of the Justification Rationale Explained:

NSWC PHD has been tasked to support the Zumwalt program. Software licenses for Splunk Enterprise Support are being procured to maintain software currently in use. SECNAVINST 5230.15 ref (d) states that any software being fielded must maintain vendor support. NSWC PHD has the Splunk software currently installed and configured on our network. This software is required to provide a consolidated and centralized network Security Information and Event Management (SIEM) solution to ensure the security and integrity of data while enabling the ability to capture, index, and correlate real-time data in a searchable repository. It uses machine data to identify data patterns which are used for application management, security, and compliance, increasing the security posture of Zumwalt TSCE.

Specific Characteristics of the Item or Service required that Limit the Availability to a Sole Source or Brand Name:

The Government has heavily invested in the engineering, integration, and certification of the current Splunk SIEM architecture. Selecting an alternate SIEM/SOAR product would introduce an unacceptable expense and operational risk due to the immediate requirement to overhaul the established shipboard baselines and security authorizations.

Transitioning away from the incumbent architecture to a competing product would result in a substantial duplication of cost to the Government of over $500,000 that is not expected to be recovered through competition, and would cause unacceptable delay of approximately two (2) years that would impact mission needs.

Specifically, any transition to a new brand of SIEM would result in a Cybersecurity Risk Management Construct (CSRMC) Re-Authorization voiding the current continuous monitoring authorizations mandating a ground-up re-engineering of the systems automated data feeds, API integrations, and threat-informed testing to meet the DoW’s required “Constant ATO” posture. Additionally, since shipboard systems adhere to strict Navy Modernization Process (NMP) wherein a SIEM must effectively integrate and interact, a different brand of SIEM would need to undergo testing and verification through on-site shipboard engineering surveys requiring the purchase of additional cabling and power/cooling load analysis. Finally, the Government would need to incur costs and time to update Configuration Data Managers Database (CDMD-OA), Planned Maintenance System (PMS) cards, and technical manuals to account for the new brand of SIEM. Thus, since, as stated, this substantial duplication of cost is not expected to be recovered through competition and since the unacceptable delay of two (2) years would result in three (3) vessels not being mission ready due to not having the required Splunk Software installed, which provides critical SIEM and continuous monitoring capabilities deployed across shipboard and shore-based Impact Level 5 (IL5) environments, no other brand of SIEM other than Splunk can meet the Government’s needs.

Market Research Conducted:

As stated above, no other brand can meet NSWC PHD’s needs since Splunk is the only brand of software that can meet our requirements. Splunk is available through the mandatory source Carahsoft Technology Corporation and its authorized dealers. Splunk software is available under the DON BPA CETA # N66001-20-A-0022 / MAC # GS-35F-0119Y as posted on DOD Enterprise Software Initiative (ESI), which is a mandatory source for the Navy as referenced in “DON CIO-ASN FMC-ASN RDA Joint Memo - 22 Feb 2012 - Mandatory Use of DON Enterprise Licensing Agreements”. Carahsoft Technology Corporation is the only vendor available under this BPA; however, Carahsoft Technology Corporation lists seven (7) authorized dealers in the Ordering Guide that can provide Splunk software under the BPA.

Software Publisher

Authorized Dealer

Dealer POC Phone Number

Email Address Cage Code

Splunk August Schell Ben Tacheny 301-838-9470 ben.tacheny@augustschell.com 1W5J9

Splunk Blackwood Chris Ebley 410-267-1904 DOD@blackwood.ai 7P918

Splunk Optiv+ Clearshark

Jason Erickson 410-536-3776 splunkdodesi@optivclearshar k.com

4L5U9

Splunk Red River Kush Kumar 603-448-8880 AP-Invoices@redriver.com 04MB1

Splunk WWT Missy Nieters N/A Missy.nieters@wwt.com 0MNV1

Splunk Iron Bow Iron Bow Sales Distribution

703-279-3000 GSASales@ironbow.com 55RC1

Splunk Thundercat Dan Little 202-701-4009 dlittle@thundercattech.com 50WM7

Statement of Actions, if any to Remove Barriers to Competition in the Future:

NSWC PHD will continue to conduct market research as warranted to provide a broader vendor base as applicable for the types of supplies/services covered by this document. If another potential source emerges, NSWC PHD will assess whether competition for future requirements is feasible.

mailto:ben.tacheny@augustschell.c mailto:DOD@blackwood.ai mailto:AP-Invoices@redriver.com mailto:Missy.nieters@wwt.com mailto:GSASales@ironbow.com mailto:dlittle@thundercattech.com

CERTIFICATIONS AND APPROVAL

TECHNICAL/REQUIREMENTS CERTIFICATION

I certify that the facts and representations under my cognizance, which are included in this justification and its supporting acquisition planning data, except as noted herein, are complete and accurate to the best of my knowledge and belief.

Technical Cognizance:

Mark Erdman, Requirements Generator, D42

Legal Counsel:

I certify that this justification is accurate and complete to the best of my knowledge and belief.

DEBERRY.JULIANNE.S

URANE.1522887796

Legal Office:

Digitally signed by

DEBERRY.JULIANNE.SURANE.1522887796

Date: 2026.04.28 07:53:53 -07'00'

Julianne Surane Deberry, Assistant Counsel, 00L

Contracting Officer:

I certify that this justification is accurate and complete to the best of my knowledge and belief.

PRINCIPE.VINNIE.MARI

E.1254388340

Digitally signed by

PRINCIPE.VINNIE.MARIE.1254388340

Date: 2026.04.27 15:48:47 -04'00'

Contracting Officer Signature:

Vinnie Principe, Contracting Officer, 027

ERDMAN.MARK.J.12670 Digitally signed by

83181

ERDMAN.MARK.J.1267083181