SIGNED_BRAND_NAME_JUSTIFICATION_SYMANTEC_05-10-2017_(2).pdf

Brand Name Justification Department of Education ‐ Federal Student Aid

Symantec Verisign (Tokens) License and Support Services

1. Identification of the agency and the contracting activity.

Department of Education (DoED), Federal Student Aid (FSA) Acquisitions. This document is a brand name justification (BNJ) prepared in accordance with the criteria stated in FAR Part 13.501(a)(1)(ii) & 6.303-2.

2. Nature and/or description of the action being approved.

The purpose of this acquisition is acquire software maintenance pertaining to Federal Student Aid (FSA) Symantec Verisign (tokens) software that is currently integrated into the FSA’s IT environment and business applications. Two-Factor Authentication is required to access business applications and is essential in supporting a mobile workforce. Without Two-Factor Authentication FSA’s IT Infrastructure and business applications would be highly venerable to “hackers” who attempt to penetrate FSA’s IT Infrastructure and attempt to access and steal personal information that resides within FSA’s business applications.

3. A description of the supplies or services required to meet the agency’s needs

(including the estimated value).

FSA requires the following software maintenance and services for a period of performance of 7/1/2017 to 6/30/2018:

Part # Part Description Quantity 21374382 SYMC Validation and ID protection 82,600

Authentication Service 50,000-999,999 Users Hosted ACD-GOV SUB Gold 12 Months

21375354 SYMC Validation and ID protection 82,600 Service – Enterprise Support 50,000-999,999 Users ACD-Government Platinum 12 Months

Estimated value for base year service is $501,382.00. The following is the estimated total cost and period of performance for the option periods:

7/1/2018 – 6/30/2019 Option Year One $501,382.00 7/1/2019 – 6/30/2020 Option Year Two $501,382.00 7/1/2020 – 6/30/2021 Option Year Three $501,382.00 Total Estimated Cost Base and Option Years $2,005,528.00

4. An identification of the statutory authority and supporting rationale.

Statutory authority is 41 USC 1901 – Simplified Acquisition Procedures

5. A demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the authority cited.

Symantec Validation and ID Protection (VIP) service, offers a wide range of authentication methods the include applications for mobile phones (soft tokens) and hardware tokens. These services prevent unauthorized logins to FSA’s IT Enterprise even when passwords have been compromised or shared among different services by the end user. Not renewing these components would terminate the authentication service provided to FSA users and would significantly increase IT security risks. It would limit access to FSA systems and impact the agency’s ability to continue to safeguarding crucial system that FSA relies on in meeting its mission.

Symantec is a leader in the multifactor authentication market segment. FSA has utilized the Symantec products listed in Section 3 over the last five years, which continues to meet FSA operational requirements as it pertains to the authentication of end users accessing FSA business applications. These products have been integrated into FSA’s AIMS system that extends the authentication services to numerous critical business applications that include COD, NSLDS, etc. Moving to a different authentication platform would require extensive testing by FSA to ensure that it works with the current applications that use authentication services. Integrating a new authentication product into FSA IT environment could cost up to $3 million. Additional training of FSA personnel would also be required. In addition, FSA would have to issue new software and hardware tokens to its workforce and stakeholders, which could impact up to 80,000 users who access FSA business applications. Any saving achieve would be offset by cost of implementing a new verification system into FSA IT environment.

6. A description of efforts made to ensure that offers are solicited from as many potential sources as is practicable, including whether a notice was or will be publicized as required by Subpart 5.2 and, if not, which exception under 5.202 applies.

Market research has identified a sufficient number of resellers (listed below) to insure adequate competition. The solicitation will be publicized on FedBizOpps to allow maximum amount of resellers the opportunity to submit quotes.

Vendors

Aurora Systems Consulting Small Disadvanted Business Concern, Minority Owned Ivan Trusevych ivan@aurorait.com 310-530-82600

GovSmart, Inc SBA 8(a), HUBZone Certified, Minority Owned Brent Lillard brent@govsmart.com 434-326-0660

SHI International Corp.

Woman Owned, Minority Owned Katelyn Dilley Katelyn_Dilley@shi.com 732-868-5926 Ext. 8685926

GeminiTech, LLC Small Business, Woman Owned, EWOSB concern Karen James Karen.James@geminitech.net 808-843-1000

7. A determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

The Contracting Officer will determine the price is fair and reasonable by using historical pricing that has been paid in past.

8. A description of the market research conducted among schedule holders and the results or a statement of the reason market research was not conducted.

Market research was limited to authorized resellers of Symantec Verisign services.

9. Any other facts supporting the justification.

There are other products similar to Symantec Validation and Id Protection. However, they do not provide a full set of features that are embedded in the Symantec Validation and Id protection base software product. This would require FSA to purchase additional components from the vendor to receive the same level of support that is currently being offered in Symantec base product and would result in an overall increase price.

In addition, the reporting functionality of similar products is weak as it pertains to multifactor authentication solutions. They are no more than “log files” compared to robust reporting tools offered by Symantec. Symantec offers a variety of reports, such as user, credential, and audit reports, and the ability to schedule particular reports and have real-time monitoring of alerts and other activities that other products do not possess.

The Symantec product also allows customers the ability to push one-time passwords to mobile users, which is critical to support FSA mobile workforce and stakeholders.

10. A listing of the sources, if any, that expressed, in writing, an interest in the acquisition.

None.

11. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the restricted consideration before any subsequent acquisition for the supplies or services is made.

None

12. Certification.

This justification is accurate and complete to the best of my knowledge and belief. The requiring FSA program office has provided written supporting data, which is contained in the contract file, that verifies the technical requirements and support the government ongoing need to use the aforementioned brand name commercial items.

Andrew Jernell Contracting Officer US Department of Education Federal Student Aid

APPROVED

Denise Roberts Competition Advocate Federal Student Aid