Attachment 3 - Brand Name Justification.pdf

NATIONAL TRANSPORTATION SAFETY BOARD

Justification for Other Than Full and Open Competition

“MetaFlows Network Security Appliance and Associated Software Subscriptions”

1. Program Office / Procurement Request:

Office of Chief Information Officer, Computer Service Division (CIO-10)

2. Nature of Action:

The purpose of this Justification for other Than Full and Open Competition (JOFOC) is to provide documentation that explains why this specific requirement is to be limited to the brand name MetaFlows, Inc. for the Network Security Appliance and Associated Software Subscriptions.

3. Description of Requirement:

The National Transportation Safety Board (NTSB) Office of the Chief Information Officer (OCIO) has a requirement to support and maintain our existing Metaflows installation that has been purchased and installed since 2017.

Metaflows is used for a multifunction cyber security platform which provides Deep Packet Inspection(DPI), Intrusion detection and Intrusion Prevention along with advanced malware analysis. These capabilities are required to support cyber incident response and fulfill OMB M1725 (Office of management and budget memorandum 1725) mandated FISMA Audit 2017 requirements within the agency: The following are mandated components and functionality stipulated by the OMB directive:

• Ability to fulfill following requirements within FISMA Title III of the E-Government act of 2002: CA-7 continuous monitoring, IR-5 incident monitoring, SI-3 intrusion detection tools and Techniques, CM-4 monitoring configuration changes

• Meet the IDS/IPS standards defined in NIST 800-94 “Guide to Intrusion and Prevention Systems”

• Intrusion Prevention system: Ability to prevent cyber intrusions without being an inline device. Runs entirely in software and can scale to 10 Gbps of network traffic on commodity hardware. Runs in passive mode (not inline) and provides intelligent technology to block unwanted traffic (ransom-ware, bots, spyware, P2P, Malware etc.)

• Exfiltration detection investigation capabilities: Flow, Log, and Packet analysis and Correlation)

• Sandboxing of attachments and web links for malware detection

• Outbound encryption and exfiltration detection capability through Deep Packet inspection

• Provide industry standard cyber threat intelligence

• Insider threat detection capability per executive order 13857: Ability to detect PII and sensitive data exfiltration attributed to the user and the end-point.

• Ability to provide all the above capabilities/technologies under a one integrated platform

• Ability to run on non-proprietary commodity hardware or Cloud environments

• Technology to reduce excessive false positives

4. Authority Cited:

FAR 13.106-1(b)(1), Soliciting from a single source. Contracting officers may solicit from one source if the contracting officer determines that the circumstances of the contract action deem only one source reasonably available (e.g., urgency, exclusive licensing agreements, brand-name or industrial mobilization).

5. Unique Qualifications / Circumstances of Requirement:

Since 2017 the NTSB is has been using the Metaflows platform and its unique technical capabilities to manage the requirement to facilitate the multifunction cyber security platform which provides Deep Packet Inspection(DPI), Intrusion detection and Intrusion Prevention along with advanced malware analysis.

Metaflows provides support and maintenance tailored for their proprietary products that other vendors do not have the capability to provide due to the proprietary nature of the brand name product. Due to Metaflows being the technical solution in place using a non-Metaflows vendor for support would not provide us with solution specific expertise to perform ongoing maintenance and support which would leave us vulnerable to cybersecurity risks.

For these reasons, Metaflows is the only vendor that has the technical expertise and capabilities to satisfy the NTSB’s maintenance and support requirement.

6. Efforts to Determine Only One Source:

The OCIO conducted market research on other viable products and determined that, while there are other brand name products that can provide the individual capabilities/requirements as separate products, none are able to provide the collective combined capabilities in one appliance/platform. Using multiple products to perform the required security will add substantial duplication of cost to the government that is not expected to be recovered through competitive products that were researched.

Also, the capability to provide Passive IPS (Soft IPS) and significant reduction of false positives (Multi-session correlation) are unique capabilities provided by the MetaFlows brand name product and not provided by other products of OCIO research. While Metaflows is the manufacturer of the required products, maintenance and subscription, it does have a re-seller of its products. The Request for Quote, along with the Brand Name Justification, will be posted to the Federal Business Opportunities (FBO) website in accordance with FAR 5.102(a)(6).

7. Contracting Officer’s Determination:

I have reviewed the above JOFOC, and determined that based on the information provided, it is accurate and complete, the anticipated cost of any subsequent sole source award would be in the best interest and fair and reasonable to the Government.

8. Market Research:

See Section 6, “Efforts to Determine Only One Source” above.

9. Other Pertinent Information:

N/A

10. List of Interested Parties:

No other companies/organizations have expressed an interest in this requirement.

11. Efforts to Remove Barriers to Competition:

The NTSB will continue to conduct market by monitoring the market for responsible sources and provide requirements for competition. The Request for Quote, along with the Brand Name Justification, will be posted to the Federal Business Opportunities (FBO) website in accordance with FAR 5.102(a)(6).