NNG15SD26B-136.pdf

Sourcefire Physical Appliance and Software Licenses Control Number: TAC-18-50280

Justification for Other than Full and Open Competition Coordination Matrix

Information Technology Operations (ITOPS), Infrastructure Operations (10) Sourcefire Physical Appliance and Software Licenses Control Number: TAC-18-50280

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition and Logistics Technology Acquisition Center 1701 Directors Boulevard Suite 600 Austin Texas 78744

2. Description of Action: This proposed action is for a firm-fixed-price (FFP) delivery order (DO) issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-Wide Acquisition Contract (GWAC) to acquire Sourcefire physical appliances, software licenses, and warranty and maintenance.

3. Description of the Supplies or Services: VA, Technology (Ol&T), Information Technology Operations (ITOPS), Infrastructure Operations (10) Security Management division requires 11 Sourcefire physical appliance and associated software licenses to be perpetually assigned to the associated Sourcefire appliances. VA's Continuous Readiness Information Security Program (CRISP) requires system security monitoring of all system logs and network connectivity to provide event and log correlation, event alerting and information security threat intelligence, automated integration, and reporting of all network intrusion attempt activity, which the 10 data center Security Threat Module (STM) security infrastructure standard. Using combined STM Intrusion plug-in data feeds from Sourcefire, collectively referred to as Sourcefire brand name intrusion prevention appliance and software meet these requirements. The intrusion prevention appliance includes standard software and licenses. Finally, VA requires warranty/maintenance to begin once the 11 new Sourcefire intrusion prevension appliances are accepted; the required maintenance includes 24/7 telephone and email support, and updates for one year. A 12 month warranty and maintenance period for the Sourcefire appliances and perpetual licenses is included. The warranty maintenance period will commence upon VA's acceptance of the Sourcefire appliances.

The Sourcefire appliances will be delivered within 30 days aft

4. Statutory Authority: The statutory authority permitting this exception to fair opportunity is Federal Acquisition Regulation (FAR) Subpart 16.505(b)(2)(i)(b) entitled, "Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized."

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in section 8 of this justification, VA has determined that limited competition is viable among authorized resellers of brand name Sourcefire software, and one year software maintenance. Sourcefire brand name software is the only software that can continue to build upon Security Management Division's existing Sourcefire -based

Appliance and Software Licenses Control Number: TAC-18-50280 intrusion prevention system. Other brand name intrusion prevention solutions researched were unable to integrate with the currently fielded Sourcefire architecture and Sourcefire -based intrusion prevention licensing. Additionally, no other brand name intrusion prevention system is interoperable or compatible with the currently fielded Sourcefire -based intrusion prevention system and Sourcefire brand name architecture and centrally managed licensing. Specifically, the current system and software communicates through a source code that is based on Sourcefire proprietary data. No other software can provide this communication capability without this source code. Any other brand name item would not be able to communicate with the existing infrastructure due to the proprietary constraints. Existing Sourcefire brand name security appliance inventory includes existing ownership of 12 existing Sourcefire -related appliances and licenses spread over 10 10 data centers. The existing Sourcefire infrastructure consists of the 11 Sourcefire physical appliances and associated software licenses that are being refreshed under this proposed action and an additional 12 Sourcefire physical applian·ces and associated software licenses spread over 1 O 10 data centers. Due to the interoperability and compatibility issues previously discussed, utilizing any other brand name appliance and software instead of the existing 11 Sourcefire products would result in having to replace the other 12 Sourcefire items.

This would result in delivery delays of over 3 years and duplicated costs of $4 million that would not be recovered in competition. In addition to the VA's continuous monitoring requirement, these intrusion prevention appliances are needed to support the VA's Information Technology (IT) visibility to the Network initiative. Specifically, only Sourcefire brand name security appliances can provide upstream forwarding of any localized network intrusion activity data into the existing 10 Sourcefire architecture. The upstream of data is critical to produce a single view collective status of all security related activity over the network. This will ultimately provide 10 a single interactive view that displays the monitored IO's network's security posture of all network elements of malware protection. This is a VA function that is required per documented Federal Information Security Management Act (FISMA) controls. Furthermore, any other brand name software cannot accomplish this because another product cannot communicate, nor integrate with the architecture and licensing of, the Infrastructure Operations Console, and thus will not allow security visibility of malware activity on the network.

Additionally, data monitored and provided by another vendor will not integrate with the existing toolset, vendor proprietary threat feeds which is based on Sourcefire brand name security architecture and licensing. Finally, only resellers can provide the warranty and maintenance services required. This is due to the need for access to the proprietary Sourcefire technical data to ensure all services provided are properly configured.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in the market research section of this document. This effort did not yield any additional sources that can meet the Government's requirements. It was determined however that limited competition is viable among authorized resellers for this brand name item. In accordance with FAR 5.301 and 16.505(b)(2), this action will be synopsized at award on the Federal Business Opportunities Page (FBO) and the justification will be made publicly available.

Information Technology Operations (!TOPS), Appliance and Software Licenses Control Number: TAC-18-50280

7. Actions to Increase Competition: In order to remove or overcome barriers to competition in future acquisitions for this requirement, the agency will work with the program office to continue to perform market research to consider and ascertain if any other sources can provide these services in the future.

8. Market Research: The Government's technical experts conducted market research by reviewing other similar malware protection full packet capture systems. This market research is an ongoing process starting in 2017 and continuously being conducted, as recently as January 2018. The other similar appliances and software reviewed included International Business Machines (IBM) Proventia Network Intrusion Prevention Sysytem (IPS), Hewlett Packard (HP) Tipping Point IPS, and Palo Alto Networks IPS. Based on reviews of these products, the Government's technical experts determined that none of these products can meet the Government's interoperability and compatibility requirements previously discussed. Additionally, none of these other products can offer the upstream forwarding of localized data into the existing 10 Sourcefire console architecture, which is critical in producing a single view collective status of all Sourcefre security related activity over the network. Additionally, VA networking Subject Matter Experts regularly review industry trade publications and conduct internet research to ascertain if any other brand name appliance and software is available. Based on all of these market research efforts, the Government's technical experts have determined that only Sourcefire brand name security appliance and licensing can meet all of IO's needs.

Additionally, market research was conducted in April 2018 utilizing the NASA SEWP V GWAC Provider Look-up tool to ascertain the extent of limited competition among resellers. The results of the search found that there are numerous resellers of these products that could possibly meet VA's needs, including Service-Disabled Veteran- Owned Small Businesses. Therefore, limited competition is anticipated.

9. Other Facts: N/A

Appliance and Software Licenses Control Number: T AC-18-50280

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on.

adequate price competition and discounts among NASA SEWP V GWAC holders who are resellers of the required brand name Sourcefire brand name security appliance and licensing. NASA SEWP V GWAC holder catalog prices have already been determined to be fair and reasonable. Additionally, price analysis shall be conducted by comparing the proposed prices will be compared to the Independent Government cost Estimate.

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Appliance and Software Licenses Control Number: T AC-18-50280

Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition of Sourcefire physical appliances, software licenses, and warranty and maintenance on a limited competition basis pursuant to the statutory authority cited in paragraph 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.

Date: _r-J -(fl Signature: