A.02.05 Brand Name J&A.pdf

DEPARTMENT OF THE ARMY

LITTLE ROCK DISTRICT, CORPS OF ENGINEERS

Post Office Box 867

LITTLE ROCK, ARKANSAS 72203-0867

REPLY TO

Contracting Division Control No. SWL -21-006

Justification and Approval for Other Than Full and Open Competition

1. Contracting Activity: U.S. Army Corps of Engineers, Southwestern Division, Little Rock District, Post Office Box 867, Little Rock, Arkansas 72203-0867

2. Description of Action: This is a new Firm-Fixed-Price contract for OTMS (Operational Technology Monitoring Solution) Hardware. Funded with Operations and Maintenance allocations.

3. Description of Supplies/Services: The Contractor shall provide parts and equipment necessary for implementation of OTMS, Operational Technology Monitoring Solution. The attached list of parts includes multiple components for Viavi nTAPs, Nuvo 7000, POC-410, Dell R340 and 840 Servers, Intel network interface cards (NICs) and Cisco Integrated Service Routers (ISR). These parts and equipment are needed to provide continuous monitoring and vulnerability management without any impact on operational networks. NIST developed the Risk Management Framework (RMF). Ongoing monitoring is a critical part of that risk management process and this continuous monitoring solution fulfills the requirement of a disciplined and structured process that integrates information security and risk management activities into the system development life cycle. The government estimated value of this acquisition is $662,180.00.

4. Authority Cited: 10 U.S.C. § 2304(c)(1); FAR 6.302-1 -- Only one responsible source and no other supplies or services will satisfy agency requirements.

5. Reason for Authority Cited: The currently configured sites all use Dell Computers. The Dell Integrated Dell Remote Access Controller (iDRAC) is a piece of hardware that sits on the server motherboard that allows Systems Administrators to update and manage Dell systems, even when the server is turned off. The iDRAC is not compatible with the HP Integrated Lights- Out solution or any other solution such as; Intel uses RMM2 (remote management 2), Sun (now Oracle) uses ILOM (Integrated Lights Out Manager), or the IBM uses IMM (Integrated Management Module). If the iDRAC is not used, this would require the sites to learn and maintain two different server management systems. Interoperability between manufacturers of these types of components is not a standard within the industry. The proprietary nature of this equipment makes a description of relevant characteristics unfeasible. In addition, the initial phase of the OTMS was implemented with Dell servers and to ensure the continuity of operations this is the best solution.

- 2 -

Mr. Joshua Hendricks, SCADA Security Engineer, has affirmed that Viavi Network Test Access Points (TAP) are the only equipment appropriate for this requirement. In the SCADA environment a truly passive TAP is required. Through testing of several different vendor products, the Viavi TAPs were identified as truly passive and cannot inject network packets into the SCADA environment. Network interference in critical infrastructures poses a severe risk due to the potential for catastrophic equipment damage and loss of life.

The NUVO 7000 is the only computer that is environmentally hardened and meet the size and power requirements for the areas they will be installed. In addition, they are the only device that had 6 network interface cards (NIC) with a possible expansion to 10 in an industrial ruggedized computer.

The POC-410 is the only computer that is environmentally hardened and meet the size and power requirements (significantly smaller than the NUVO 7000) for the areas they will be installed. In addition, they are the only industrial ruggedized computer that has 3 NICs instead of

2. This gives us the capability to utilize a tap in a smaller location.

Cisco was chosen in order to interface with our current Cisco based infrastructure. Cisco devices also have more extensive security options that are necessary for our circumstances. They are also the only option for Industrial and ruggedized networking equipment.

6. Efforts to Obtain Competition: This is a brand name specific requirement, and there are no limitations on sources. The requirement will be solicited under full and open competition on SAM.gov. This action not exempt from the publicizing requirements of FAR 6.305, and will be posted on SAM.gov within 14 days of contract award.

7. Actions to Increase Competition: Not applicable. This is a brand specific requirement that can be fulfilled by multiple vendors.

8. Market Research: A technical evaluation of this requirement was conducted by Mr. Joshua Hendricks, SCADA Security Engineer, as certified below. Mr. Hendricks determined that there are no other brand name equivalent products that would interface with the current equipment already installed.

Quotes were either generated via government websites or via the manufacturer.

9. Interested Sources: Viavi, cdwg.com, gsaadvantage.org

10. Other Facts: No other pertinent facts.

11. Technical Certification: I certify that the supporting data under my cognizance which are included in the justification are accurate and complete to the best of my knowledge and belief.

Signature: Date:

Name and Title: Joshua Hendricks, SCADA Security Engineer

- 3 -

Joe Daniels

Joe Daniels

12. Requirements Certification: I certify that the supporting data under my cognizance which are included in the justification are accurate and complete to the best of my knowledge and belief.

Signature: Date:

Name and Title: Gilbert T. Peters, Physical Security Specialist

13. Fair and Reasonable Cost Determination: I hereby determine that the anticipated cost to the Government for this contract action will be fair and reasonable. Price will be evaluated based on government cost estimate. Certified cost and pricing data will not be requested.

Digitally signed by Joe Daniels

Signature: Date: 2021.08.12 17:10:07 -05'00' Date: 12AUG2021

Name and Title: Joseph C. Daniels, Contracting Officer

APPROVAL

14. Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Digitally signed by Joe Daniels

Signature: Date: 2021.08.12 17:10:19 -05'00' Date: 12AUG2021

Name and Title: Joseph C. Daniels, Contracting Officer