91003119P0005_BNJ_04162019.pdf

BRAND NAME JUSTIFICATION

Department of Education – Federal Student Aid

Trustwave AppProDetective Software Maintenance & Support

This acquisition is being conducted in accordance with FAR subpart 13.501(a)(I)(ii), Simplified Acquisition Procedures.

1. Identification of the agency and the contracting activity: United States Department of Education, Federal Student Aid (FSA)

2. Nature and/or description of the action being approved: The purpose of this acquisition is to renew FSA’s software maintenance and support for the Trustwave AppDetective Pro Software. This renewal will assist FSA in meeting FISMA requirement as it pertains to risk reduction and continuous system monitoring. The software and maintenance support is for the following software packages currently deployed within FSA:

AppDetectivePro for Vulnerability Assessment: This software allows FSA to conduct vulnerability assessment for its mainframe database platforms. The software performs relational database security testing and assessment for database applications to support broad security assessment coverage and reports database application security scanning results for FISMA compliance considerations.

The AppDetectivePro for Assessment: This software allows FSA to conduct vulnerability assessments of FSA’s non mainframe databases. It performs relational database security testing and assessment for database applications; supports broad security assessment coverage; and reports database application security scanning results for FISMA compliance considerations.

3. A description of the supplies or services required to meet the agency’s needs (including the estimated value): The following is a description of the software maintenance and support that is being procured:

Description License Type Quantity

Software Product: AppDetectivePro - Vulnerability Assessment for IBM DB2 on OS/390 or z/OS

Instance 6

AppDetective Professional Named User 1

The estimated price is $339,000.00 if all options are exercised. The period of performance is from April 1, 2019 to March 31, 2020 if all options are exercised.

4. An Identification of the statutory authority and support rationale.

This procurement will be conducted in accordance with 41 U.S.C.1901 or 41 U.S.C.1903 (Simplified Acquisition Procedures).

5. A demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the authority cited.

There are products that provide similar functionality that the AppProDetective software provides, but does not possess all the functionality that AppProDetective software

Brand Name Justification Trustwave AppProDetective Software Maintenance possesses. Trustwave’s AppDetective PRO is a database and possesses big data scanner capability that is capable of uncovering configuration mistakes, identification and access control issues, missing patches, or any toxic combination of settings that could lead to escalation of privileges attacks, data leakage, denial-of-service, or unauthorized modification of data held within data stores. Key features include:

Automate inventory, testing, information gathering and analysis to empower you with the intelligence needed to harden your data warehouses.

Access extensive and continuously updated analytics and a knowledgebase of best practices, configuration settings and vulnerabilities.

Create new data security controls or customize from existing pre-built controls based on industry standards and regulatory requirements.

AppDetectivePRO reports and dashboards provide consolidated view of vulnerabilities, threats, risks, and compliance efforts.

Examines relational databases and data stores for configuration mistakes, identification, and access control issues.

Moving to a new software product that performs similar functionality would potentially increase associated software and mainframe vulnerabilities, require FSA to acquire new license(s); configure business applications; retrain the staff in the operations of the new software; and software maintenance. Any cost savings achieved in conducting a competition would be offset by these expenses. Therefore, it is more cost effective for FSA to renew the Trustwave AppProDetective software maintenance.

6. A description of efforts made to ensure that offers are solicited from as many potential sources as is practicable, including whether a notice was or will be publicized as required by and, if not, which exception under 5.202 applies.

FSA has had Trustwave AppProDetective software since 2013 and it continues to meet FSA’s operational requirements. Therefore, no other potential sources were solicited.

7. A determination by the contracting officer that the anticipated cost to the

Government will be fair and reasonable.

Price reasonableness will be determined by using historical pricing that FSA has paid in the past.

8. A description of the market research conducted and the results or a statement of the reason market research was not conducted.

Market research was conducted, similar software exists, but does not provide the total security protection/coverage (or provides less) required at the pricing (now!) afforded to FSA. It was determined that it was not in FSA’s interest to move to a new software suite that provides the same functionality (or less) as Trustwave AppProDetective Software. Any cost savings achieved would be negated by the costs (higher!) associated with deploying the

Brand Name Justification Trustwave AppProDetective Software Maintenance new software within in the FSA environment, testing, reconfiguring business applications, training, etc.

9. Any other facts supporting the use of other than full and open competition.

There are no additional facts needed to support this Brand Name Justification.

10. A listing of the sources, if any, that expressed, in writing, an interest in the acquisition.

No other sources have expressed interest as of the date of this justification.

11. A statement of the actions, if any, the agency may take to remove or overcome any barriers to competition before any subsequent acquisition for the supplies or services required.

In the near term it is the intention of FSA to continue to use the Trustwave AppProDetective software outlined in Section 3 of this Brand Name Justification. The financial savings in moving to a different software suite that provides the functionality of AppProDetective software is minimal taking into consideration of expenses required to deploy a new software platform. If FSA business/security requirements change in the future, FSA will conduct new market research to determine if there are potential vendors that could support FSA’s new business requirements.

12. Technical Requirements Personnel Certification

I certify this requirement meets the Government’s minimum need and that the support data, which forms a basis for this justification, is complete and accurate. The requiring FSA program office has provided written supporting data, which is contained in the contract file, that verifies the technical requirements and support the government ongoing need to use the aforementioned brand name commercial items.

Anthony Booker Contracting Officer’s Representative FSA Technology Office

13. Certification

I certify that the data supporting this Brand Name Justification is accurate and complete.

Therefore, the Contracting Officer hereby determines that it is in the best interest of Federal Student Aid to move forward with this Brand Name acquisition.

Andrew Jernell Contracting Officer Federal Student Aid