Attachment 2_BNJ_FireEye_redacted.pdf

BRAND NAME JUSTIFICATION

FAR 6.302-1(c) / 13.106-1

The justification shall be posted with the solicitation/award as applicable. (see 5.102(a)(6) and 16.505(a)(4)(iii)(A)).

Agency/Office Name: Indian Health Service (IHS)/HQ/OIT Date: 04/04/2024

1. “Brand Name” of product: FireEye (AX) Maintenance Renewal

2. Description of “brand name” product: Software Maintenance Renewal of FireEye -5550AX-HW

Part no./Subscription: AX5550D2WGAEAT-AG, 5550 AX DTI 2W 1 YR SUB Growth, FireEye AX Subscription, AX5550GVM-AT-AG FireEye Software Support, and NRHDDGEN2-AT-AG Hardware Support

1. **Multi-Vector Analysis:** Multi-vector analysis that combines signature-based detection, behavioral analysis, and machine learning to identifies and block advanced threats across multiple attack vectors. IHS is currently using FireEye AX for threat detection ensures that organizations are protected against a wide range of cyber threats.

2. **Real-Time Threat Intelligence:** :** Provides real-time updates on the latest cyber threats and attack techniques. Enabling IHS to stay ahead of evolving threats and proactively defend against cyber-attacks.

3. **Dynamic Sandboxing:** :** Provides dynamic sandboxing feature that allows IHS to analyze suspicious files and URLs in a secure, isolated environment. The sandboxing technology used by FireEye AX is highly advanced and can detect and analyze sophisticated malware that may evade traditional security measures.

4. **Customizable Virtual Execution Environments:** :**Operates in customized virtual execution environments for analyzing and executing potentially malicious content. This feature allows security teams to simulate different operating systems and configurations to understand how malware behaves in various environments.

5. **Threat Hunting Capabilities:** :** Has advanced threat hunting capabilities that enable security teams to proactively search for indicators of compromise and potential security threats within their network. This proactive approach of threat detection helps IHS to continuously identifying and mitigating threats before they cause significant damage.

6. **Centralized Management Console:** :**Has a centralized management console that provides a unified view of security events, alerts, and policies across the organization.

This centralized console streamlines security operations and enables security teams to manage and monitor security controls effectively.

7. **Automated Incident Response:** :** Has automated incident response capabilities that allow IHS Cybersecurity Operation Center (CSOC) to automatically respond to security incidents based on predefined rules and policies. The automated response capability helps IHS reducing response times and mitigate the impact of security incidents swiftly in efficient manner

8. **Threat Intelligence Sharing Platform:** :** This capability of the FireEye Threat Intelligence Platform, enables IHS to share threat intelligence with other Federal Entities who utilize FireEye. The threat intelligence sharing platform enhances collaboration and enables IHS to benefit from shared threat intelligence to improve IHS’s security posture.

The justification shall be posted with the solicitation/award as applicable. (see 5.102(a)(6) and 16.505(a)(4)(iii)(A)).

Agency/Office Name: Indian Health Service (IHS)/HQ/OIT Date: 04/04/2024

Yes No (If your answer is “no,” please complete the rest of this document)

(If the answer is “yes,” sign this document, send in with your Purchase Request (PR) package and provide a list of your salient characteristics/specifications.

5. If the answer to No. 4 is “no,” complete the following:

A. Because of patent rights, copyrights, propriety secret processes, control of certain materials or components providing superior utility or capability, purchasing a different/similar product cannot be obtained. See below for explanation.

B. Because program requirements cannot be modified so that competitive products or services may be used. See below for explanation.

C. Because the product or service is unique and easily established as on-of-a kind. See below for explanation.

6. If the answer to No. 4 is “no,” please indicate reason(s) for restricting competition. The only restriction under this action is the utilization of brand name specifications based on the following facts:

The FireEye AX security product software/hardware maintenance is currently in use within the IHS Division of Information Security (DIS) Cybersecurity Operation Center (CSOC) for threat intel purposes. The required hardware maintenance is necessary to be able to prevent malware attacks against the IHS network by ensuring the existing FireEye AX hardware remains operational. This action is for the procurement of software and hardware maintenance services only. No other brand name hardware appliances and software can accomplish this functionality because no other product can communicate or integrate with the existing FireEye AX architecture, infrastructure, and licensing with the single collective view AX Console, and thus will not allow monitoring and visibility of malware activity on the network. Due to these propriety constraints, use of any alternative service provider would necessitate the complete replacement of the brand name FireEye AX infrastructure currently in place.

Indicate other reasons for restricting competition:

If replacement efforts were established of the whole, complete infrastructure, the estimated costs would be approximately and would take approximately 2 years of testing to accomplish. The estimates are based on previous acquisitions and on previous implementation experience.

3. Name of manufacturer of “brand name” product: FireEye

4. The “brand name” provided is to identify the standard of quality necessary. Equivalents can/will be considered :

The justification shall be posted with the solicitation/award as applicable. (see 5.102(a)(6) and 16.505(a)(4)(iii)(A)).

Agency/Office Name: Indian Health Service (IHS)/HQ/OIT Date: 04/04/2024

7. Describe the market research conducted (how it was made, websites, tests, calls, interviews made, etc) and the results of the research.

Due to the purchase of the renewal of the FireEye Software maintenance, there are many sources to choose from, both small and large. Through the National Institute of Health Information Technology Acquisition and Assessment Center (NITAAC), CIO – CS IT Commodities/Solutions alone, there are at least 64 Government-Side Acquisition Contract (GWAC) holders, 42 of them are small businesses under the North American Industry Classification System (NAICS) code who may be capable of supporting our software renewals CIO-CS | NITAAC (nih.gov).

Also, in the previous acquisition for the exact renewal in FY 2022 made through the NASA SEWP, RFQ229570 (75H70422Q00024/75H70422F80016), 8 small business contractors were capable and provided a quote. Small business competition is available and can/will be awarded.

8. Program Office Certification This is to certify that the portion of this justification, developed by the undersigned program office personnel, including supporting information and/or data verifying the Government’s minimum needs or requirements, or other rationale for limited sources, are accurate and complete.

Official Name & Title Signature Date Contracting Officer’s Representative

April 12, 2024

Requestor’s Immediate Supervisor

9. Contracting Officer Certification This is to certify that the justification for the proposed acquisition has been reviewed, and, to the best of my knowledge and belief, the information and/or data provided support the rationale and justification therefore, recommendation for approval is accurate and complete.

Official Name & Title Signature Date Contracting Officer

Javier Medina-velazquez -S Digitally signed by Javier Medina-velazquez -S Date: 2024.04.15 10:55:06 -04'00'