PWS139-J&A_Urgent_-Redacted.pdf

USCG Firewall Replacement

Source Selection Information – see FAR 2.101 and 3.104

JUSTIFICATION AND APPROVAL

FOR OTHER THAN FULL AND OPEN COMPETITION

Authority: 10 U.S.C. 2304(c)(2)

1. AGENCY AND CONTRACTING ACTIVITY:

The Department of Homeland Security, United States Coast Guard (USCG), Command, Control, Communication, Computers, and Information Technology (C4IT) Service Center, Contracting and

Procurement Division (CPD).

2. NATURE AND/OR DESCRIPTION OF THE ACTION BEING APPROVED:

The USCG awarded a sole source contract to Federal Defense Solutions for the purchase and installation of Fortinet firewall devices for the Operations System Center (OSC). The firewalls are replacing the current firewalls that are on the OSC network. The USCG requires continued operations and continued firewall protection, without which would leave the USCG open to security threats and negatively impact daily operations. Installation of the firewall is needed to reduce the

USCG vulnerabilities and ensure continued operations to the 40,000 users utilizing the network and systems these firewalls support.

3. DESCRIPTION OF SUPPLIES/SERVICES:

The USCG requires continued, uninterrupted services for over 30 systems, including Mission

Essential systems that communicate with external partners including other U.S. government agencies, commercial industry, and foreign governments. These systems allow Coast Guard personnel to execute vital operational missions, including but not limited to, Search and Rescue

(AMVER), law enforcement (MISLE), and commerce (SANS). These systems reside in a network zone that is isolated from the internal Coast Guard network.

The external network is currently protected by 24 Fortinet FortiGate firewalls at four Point of

Presence (POP) locations. The 24 Fortinet FortiGate firewalls currently in place are failing, causing service interruption to the USCG systems, including Mission Essential systems, and leaving the entire USCG at risk to a cybersecurity incident. The purchase of the new Fortinet firewall devices and installation will be to replace the current failing 24 firewalls. These firewalls serve a number of important purposes such as, controlling traffic that is permitted to traverse from one side to the other; packet filtering; and logging traffic that passes through. These include the primary Coast

Guard firewalls at each gateway location that control all traffic into and out of the USCG network, as well as smaller firewalls used for out-of-band management networks, scanning networks, network lab, and others. The firewalls at each of the gateways are the USCG's first line of defense for Cybersecurity so it is extremely important that they are functioning correctly and up to date with all security patches. These firewalls are located at four geographically diverse locations. These locations are the only points where the Coast Guard network can be accessed from points external to the Coast Guard network. Maintaining them in a high state of Cyber Security readiness is extremely important.

The USCG purchased Fortinet firewall devices and installation to replace the 24 failing firewalls.

The delivery requirement for the Commercial-Off-The-Shelf (COTS) firewall devices is within 30 days after award. There are fifteen (15) days of on-site services included with the award that will start once the hardware is on-site.

Total Estimated Value = $3,546,542.40 Item

Descriptio n Quantity

Unit Price

Total Price

Fortinet hardware (FG-6301F-USGBDL-950-12) 10

Fortinet hardware (FG-2000E-USG) 12

Fortinet hardware (FG-30E-USG) 12

Centralized Management appliance (FMG-400E) 2

Centralized log & analysis appliance (FAZ-1000E) 1

1GE SFP RJ45 transceiver (FG-TRAN-GC) 240

10GE SFP+ transceiver module (FG-TRAN-

SFP+SR)

25GE/10GE dual rate SFP28 transceiver (FG-

TRAN-SFP28-SR)

Per Day charge for On-site Resource Services (FP-

10-PS001-800-01-01)

Fixed Travel and Expenses for Professional Services

(FP-10-TE001-000-00-00)

GRAND TOTAL $3,546,542.40

4. IDENTIFICATION OF STATUTORY AUTHORITY PERMITTING OTHER THAN

FULL AND OPEN COMPETITION:

This acquisition is being conducted under the authority of 10 U.S.C. 2304(c)(2), as implemented by the Federal Acquisition Regulation (FAR) Subpart 6.302-2, Unusual and Compelling Urgency.

5. DEMONSTRATION THAT THE NATURE OF THE ACQUISITION REQUIRES

USE OF THE AUTHORITY CITED:

The firewalls experienced catastrophic intermittent failures at Operations Systems Center (OSC).

This impacted users Coast Guard wide and created a situation of unusual and compelling urgency.

The impact to users ranged from inability to access mission essential systems, high value assets and task critical assets utilized on a daily basis to continue mission readiness. Some of the impacts were access to the Alert Warning System (AWS), AMVER, CGPORTAL (SharePoint), Homeport, Ship Arrivals/Notification (SANS), and other critical systems that enable the USCG to perform its mission. The inaccessibility to AMVER had the potential to impact the availability of ship locations necessary for the USCG to perform search and rescue, which would result in the potential for loss of life and limb. The inaccessibility to SANS meant the Captains of the Port were not be able to properly vet and authorize arrival of commercial and passenger vessels to U.S. Ports, which impacted national commerce operations and compromised port security and safety. The inaccessibility to CGPORTAL impacted each end user’s ability to perform basic tasking

(administrative and operational) for all USCG personnel.

A sole source to Federal Defense Solutions for Fortinet firewalls was necessitated due to the compelling urgency of the situation. Federal Defense Solutions was selected for award because

Fortinet indicated the company is the only authorized reseller that could immediately meet our urgent need. The failure of the firewalls led to all 30 OSC hosted systems going offline and significant mission impacts that could not continue. There was no way to patch or fix the failed firewalls. The best solution considering the impacts felt and the need for quick and effective resolution to ensure continued operations with no further impact was to replace the firewalls.

Fortinet brand firewalls were selected because Fortinet firewalls are already used by OSC on the

USCG network. Additionally, only Fortinet certified technicians can do the installation of Fortinet firewall devices. Thus, the use of Fortinet firewalls can expedite the failure remediation without the additional requirements to reconfigure infrastructure or train for use.

6. DESCRIPTION OF EFFORTS MADE TO ENSURE THAT OFFERS ARE

SOLICITED FROM AS MANY POTENTIAL SOURCES AS DEEMED PRACTICAL:

No efforts were made for this requirement due to the urgent nature for uninterrupted service, zero downtime, and the short timeframe.

7. DETERMINATION BY THE CONTRACTING OFFICER THAT THE

ANTICIPATED COST TO THE GOVERNMENT WILL BE FAIR AND

REASONABLE:

The Contracting Officer determined the proposed price for the firewall hardware are fair and reasonable based on historical pricing and the vendors ability to meet an expedited delivery schedule.

8. DESCRIPTION OF MARKET RESEARCH:

Market research was not conducted for this requirement due to the urgent nature and need for continued and uninterrupted service.

9. ANY OTHER FACTS SUPPORTING THE USE OF OTHER THAN FULL AND

OPEN COMPETITION:

None.

10. A LISTING OF THE SOURCES, IF ANY, THAT EXPRESSED, IN WRITING, AN

INTEREST IN THE ACQUISITION:

None.

11. A STATEMENT OF THE ACTIONS, IF ANY, THE AGENCY MAY TAKE TO

REMOVE OR OVERCOME ANY BARRIERS TO COMPETITION BEFORE ANY

SUBSEQUENT ACQUISITION FOR SUPPLIES OR SERVICES REQUIRED:

Barring catastrophic failure in the future, competing future firewall purchases is anticipated prior to hardware reaching end of life.

12. Contracting officer’s certification.

I certify that the data supporting the recommended use of other than full and open competition is accurate and complete to the best of my knowledge and belief.

Contracting Officer

13. Requirements personnel certification.

I certify this requirement meets the Government’s minimum need and that the supporting data, which forms a basis for this justification, is complete and accurate.

Technical Representative

14. Legal Counsel Review.

I reviewed this Justification and Approval and find it legally sufficient.

Procurement Law Attorney

APPROVAL:

Coast Guard Procuring Activity Competition Advocate