III_-_JEFO.pdf

Justification for Brand Name Exception to Fair Opportunity Exceeding the SAT pursuant to FAR 16.505(a)(4)

JEFO No.:

Date: April 11, 2019 PR Number:

1. Agency and Contracting Activity

The Department of Homeland Security (DHS), United States Citizenship and Immigration Services (USCIS), Office of Contracting (OCON) prepared this brand name justification for an exception to fair opportunity for the procurement of Tenable.io software to assist in identifying security vulnerabilities and to improve the DHS security scorecard.

2. Nature and/or description of the action being approved

DHS/USCIS/OCON intends to award a delivery order using limited competition under the First Source II Strategic Source Vehicle (SSV). Pursuant to FAR16.505(a)(4), restricting consideration to an item peculiar to one manufacturer (e.g., a particular brand-name, product, or a feature of a product that is peculiar to one manufacturer) must be justified. A brand-name item, even if available on more than one contract, is an item peculiar to one manufacturer.

3. A description of the supplies or services required to meet the agency’s need (including the estimated value).

DHS/USCIS/OIT/OCON requires vendor-hosted vulnerability and configuration management software delivered as software as a service. As part of this solution, the government requires the software to have the following functionality:

Ability to scan Linux, Windows, and Macintosh servers and workstations, network switches, routers, and other network devices for vulnerabilities and compliance with USCIS, DHS, DISA, and Center for Internet Security, security hardening guides.

Network-based scanning using Tenable Nessus scanners (there are other vulnerability and configuration management products that claim to work with Nessus scanners (eg.

BeyondTrust Retina), but no software as a service products are able to output scan results in the .nessus file format)

Ability to scan Linux, Windows, and Macintosh servers and workstations using agents deployed on these servers and workstations.

Ability to output scan results in nessus format (this is the only format accepted by DHS for inclusion in the DHS CyberSecurity scorecard)

Compliance with Continuous Diagnostics and Mitigation (CDM) data requirements Ability to identify when an asset has multiple associated IP addresses network connections or has been scanned

Tenable.io will be procured on a firm fixed-price basis. The total estimated value of this effort is with a period of performance of twelve (12) months; August 1, 2019 to July 31, 2020.

Attachment III

70SBUR19Q00000183

4. Identify the exception to fair opportunity and supporting rationale.

DHS/USCIS/OIT/CON intends to procure a brand name specification for Tenable.io software in accordance with FAR 16.505(a)(4)(i). The exception is based on FAR 16.505(b)(2)(i)(B), only the manufacture of Tenable.io software and its authorized resellers are capable of providing the Tenable.io software required at the level of quality required because the Tenable.io software is unique or highly specialized and peculiar to the Original Equipment Manufacturer (OEM) and its authorized resellers.

DHS/USCIS/OIT/CON intends to purchase a 100,000 asset license for Tenable.io, 100 hours of consulting and implementation support, and two days of on-site training.

Tenable.io is licensed based on the number of assets scanned. Tenable.io is a cloud-based software as a service (SaaS) solution for managing security vulnerabilities and compliance with security hardening guidelines. It is the successor product to Tenable Security Center 5, which USCIS owns and uses to scan all USCIS IT assets for vulnerabilities and compliance with DHS-mandated security hardening guidelines.

DHS/USCIS/OIT/CON intention to require for Tenable.io, in exclusion to other products, is based on the following considerations:

Support for host-based scanning agents Compatibility with Xacta Continuum, the system DHS headquarters uses to generate the monthly and yearly DHS Cybersecurity Scorecard Compatibility with the DHS Continuous Diagnostics and Mitigation (CDM) program and tools.

Integration with USCIS current cybersecurity tools

In determining that Tenable.io was the only solution that met USCIS’ requirements, DHS/USCIS/OIT/CON considered the following solutions:

Qualys Cloud Platform Tenable.io Tenable Security Center 5 (Currently owned solution)

Host Based Scanning Agents Currently, USCIS network-based vulnerabilities and configuration scans are unable to scan about 20 percent of IT assets each month, because they are disconnected from the network, users are using them to telework, or they are turned off. Agents solve this problem by performing scans when the devices are turned on and then periodically thereafter. These agents address key blind spots in USCIS’ ability to scan all of its assets. On average, this issue reduces USCIS’ vulnerability management score on the DHS scorecard by 20 percent.

Improving this score is a key management objective for FY19 and FY20.

Both Qualys Cloud Platform and Tenable.io provide superior support for host-based scanning agents. Both solutions support scanning devices using agents when these devices are connected to the USCIS network or when connected to the Internet. Both provide automatic agent management capabilities, limiting the labor required to manage these agents. Tenable Security Center 5 supports agents, but does not support scanning devices while they are connected to the Internet, and requires manual management of these agents.

This greatly increases the labor costs required to operate the system.

Compatibility with Xacta Continuum:

The DHS cybersecurity program requires all DHS components to scan all IT assets for vulnerabilities and compliance with DHS-mandated security hardening guidelines. All components must upload this information to Xacta Continuum, the product DHS uses to produce the monthly and yearly DHS cybersecurity scorecards. Currently, Xacta Continuum, is only capable of ingesting vulnerability and configuration information using Tenable’s proprietary data form (the .nessus file format). No other formats are currently supported by DHS for submission of this data. Tenable.io and Tenable Security Center 5, being manufactured by Tenable, are both able to product the required vulnerability and configuration scan files in the proprietary .nessus format. Qualys Cloud Platform does not support exporting vulnerability or configuration information using this format.

Compatibility with the DHS Continuous Diagnostics and Mitigation (CDM) program and tools:

DHS also uses vulnerability and configuration compliance information for the Continuous Diagnostics and Mitigation program (CDM) dashboards. The CDM program maintains these dashboards for each DHS component, for DHS and each of the other cabinet agencies, and for the Federal Government as a whole. Unlike the DHS cybersecurity scorecard, which is generated monthly, the CDM dashboards are continuously updated with vulnerability and configuration compliance information, providing a real-time view of USCIS’, DHS’ and the Federal Government’s IT vulnerabilities. The DHS HQ CDM program, which is responsible for implementing the CDM program at DHS, supports utilizing data from Tenable, in the Tenable data format. The DHS CDM program is currently integrating Tenable data into the DHS CDM dashboards, utilizing the Tenable data format. If USCIS purchased a different tool, with a different data format, it would be required to redo this work, at considerable expense.

Integration with USCIS current cybersecurity tools:

The government has already deployed over 150 Tenable Nessus vulnerability and configuration scanners. The ability to continue to use these scanners is critical to limit the workload associated with implementing this requirement. Tenable Security Center 5 currently uses these scanner to perform network-based scanning of all USCIS IT assets.

Tenable.io, being manufactured by the same manufacturer, fully supports using these scanner for network-based scanning. Qualys only supports using its proprietary scanners for network-based scanning. Utilizing Qualys would require wholesale replacement of the existing scanner infrastructure and building new scanners. This would add considerable expense and slow the project, resulting in continued negative scores on the DHS cybersecurity scorecard.

Competition Considerations:

Tenable is the only manufacturer of Tenable.io. Licenses for Tenable.io are available through a large number of resellers on First Source II and other purchasing vehicles.

5. Determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

The Contracting Officer (CO) anticipates competition between DHS FirstSource II, socio-economic category vendors since market research shows that these licenses are available through multiple resellers. Therefore, price reasonableness will be based on adequate competition.

6. Any other facts supporting the justification.

There are no other facts supporting this justification.

7. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made.

DHS/USCIS/OIT will continue work with DHS headquarters and monitor whether DHS’ system for producing the DHS cybersecurity scorecard (Xacta), has implemented support for alternative products or data feeds. Once such support is implemented, the government will continue to seek competition in further acquisitions for the same type of support, thus, reducing the barriers to competition.

8. DHS intends to post this requirement on FedBizOpps pursuant to FAR 16.505(b)(2)(ii)(D).

This requirement shall be solicited to FirstSource II HUBZone contractors directly in accordance with the First Source II Ordering Guide.

9. Technical/Requirements Personnel Certification.

Pursuant to FAR 16.505(b)(2)(ii)(B)(9), I certify that this requirement meets the Government’s minimum need and that the supporting data, which form a basis for the justification, are accurate and complete.

10. Contracting Officer Certification and Approval

Pursuant to FAR 16.505(b)(2)(ii)(B)(8), I certify that this justification is accurate and complete to the best of my knowledge and belief and hereby determine that the circumstances for an exception to fair opportunity exist: