EZProtect Renewal Justification.pdf

JUSTIFICATION

Bureau Enhanced Acquisition Management System

Source Selection Sensitive in accordance with FAR 2.101 and FAR 3.104.

Procurement ID: ePRO-2025- 16378

BEAMS User Guide BEAMS Feedback

Intake Acq Plan Biz Incl Tech QA Justification Local Clauses Evaluation Review Contract Admin

SUMMARY

Procurement Title:

Adaptus LLC - EZProtect FY2025 (2/1) Program Office:

Operations: T&I

Contracting Officer:

McKay, Crystal (CFPB)

Contract Specialist:

McKay, Crystal (CFPB)

Acquisition Strategy:

Sole Source - SAT or over

Anticipated Award Date:

Base and All Options Value:

$626,692.50 (Total Contract Value)

BR Total Amount:

$0.00

Type Of Action:

New Contract/Agreement

Bureau:

CFPB

Contract Type:

Firm Fixed Price

Contract Number:

Is it Sole Source?

Yes No

FAR Reference:

6.302-1 Only one responsible source and no other supplies or services will satisfy agency requirements

PERIOD OF PERFORMANCE

Base Period (Months):

Number of Option Periods:

Option Period 1 (Months):

COSTS Note: the Base Amount(s) do not update from the Buy Request after the first time they are copied.

If the Base Amount in the BR changes, you may need to manually update it here.

Life-Cycle Estimated Total:

$626,692.50

Base (From Buy Request 1):

$105,000 Note: You may over-ride the base amount(s).

Base (From Buy Request 2):

$177,555 If the background color is yellow, the amount does not match the Buy Request.

Option Year 1 Cost:

$344,137.5

FAR 6.3

JUSTIFICATION AND APPROVAL

FOR OTHER THAN FULL AND OPEN COMPETITION

(FAR) 6.302

Date Needed:

Nature/Description of Action, Supplies, and Services [FAR 6.303-2(b)(2] and (3):

Display Acq Plan Statement of Need To procure EZProtect, which is a virus and malware scanning tool for Mosaic documents on the CFPB Salesforce platform.

Statutory Authority Permitting Other than Full and Open Competition [FAR 6.303-2(b)(4)]:

6.302-1 Only one responsible source and no other supplies or services will satisfy agency requirements

Description of Market Research and Results [FAR 6.303-2(b)(6), (8) and (10)]:

Display Acq Plan Market Research Market research determined that Adaptus is the only vendor able to provide the EZProtect solution and therefore, the only vendor who has the ability to quote pricing. The Program Office evaluated two other secure scanning products, F-Secure (foreign vendor) and CyberAlarm (Not clear that Salesforce files are included - no information on existing customers). Additional market research will continue being conducted in an effort to provide adequate competition and fair pricing for the long term effort.

CFPB is currently utilizing Salesforce platform software for their cloud services. EZProtect Enterprise Gov XL helps protect their internal security, since Salesforce does not have an inherent virusscanner to scan Mosaic documents. The Consumer Financial Protection Bureau’s (CFPB) Technology and Innovation (T&I) team manages all the technology needs of the Bureau. Within T&I, theEnterprise Platforms (EP) team manages the Bureau’s Salesforce platform. With the rollout of the Bureau’s Mosaic system onto the Salesforce platform, there is a specifi c need to scan Mosaicdocuments for viruses, malware, and Trojan horses.

https://sharepoint.cfpb.local/promgt/procure/eProcurement/Documents/Docs%20Posted%20in%20BEAMS%20Form%20for%20Client%20Use/BEAMS_Client_User_Guide.pdf https://sharepoint.cfpb.local/promgt/procure/eProcurement/Lists/BEAMS%20Feedback%20Tracker/Issue/newifs.aspx?List=d2403db3%2D56d3%2D4191%2Dbfab%2Dc88f7272ab4a&Source=https%3A%2F%2Fsharepoint%2Ecfpb%2Elocal%2Fpromgt%2Fprocure%2FeProcurement%2FLists%2FBEAMS%2520Feedback%2520Tracker%2FAllItems%2Easpx&RootFolder=&Web=c7d7e3f5%2D98d7%2D4224%2Da3d7%2D4365e09d6c7e

Demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the authority cited:

Determination of Fair and Reasonable Cost/Price [FAR 6.303-2(b)(7)]: The Contracting Officer determines that the anticipated price(s) will be fair and reasonable based on the following information:

Any Other Facts Supporting the Use of Other than Full and Open Competition [FAR 6.303-2(b)(9)]:

Actions Taken to Remove or Overcome Barriers to Competition [FAR 6.303-2(b)(11)]:

CERTIFICATION

Technical/Requirements Official [FAR 6.303-2(c):

I certify that the facts and representations under my cognizance, which are included in this justification and which form a basis for this justification, are complete and accurate.

Contracting Officer [FAR 6.303-2(b)(12):By signing below, I certify that this justification is accurate and complete to the best of my knowledge and belief.

SIGNATURES Contract and Legal Reviews Policy

Person Decision Approved Date and Time

Senior Program Official (Only applicable under FAR 8.4)

Approve

Technical/Requirements Official Clear

Pham, Danny (CFPB);

Contracting Officer Clear

McKay, Crystal (CFPB)

Competition Advocate Clear

Coleman, CC (CFPB)(she/her/hers);

The CFPB Enterprise Platforms Team conducted market research with inputs from CFPB’s Salesforce Retained Program Architect, CFPB’s Salesforce Customer Success Manager, review of the Salesforce AppExchange and consultation from Salesforce systems integrators working with the CFPB currently. The team identified three products on the market that support Salesforce virus and malware scanning and document containment.

In addition to EZProtect, the other two products examined are F-Secure (F-Secure Corporation), and CyberAlarm (Starpond, Inc.).

F-Secure has the ability to do full scans and re-scans on demand. It supports scanning of active content, Chatter Files, documents, attachments, and files in Salesforce. However, it does not have the ability to blacklist certain file types and it cannot scan static resources. Additionally, all of its technical and support resources, including people that maintain servers, are located in Finland which does not comply with CFPB’s cybersecurity standards. Currently F-Secure has no existing paid customers. It has some customers testing the app in beta.

CyberAlarm has the ability to scan Salesforce attachments against a comprehensive list of known virus signatures and malicious code. CyberAlarm offers a free "Scan Attachments" feature but requires a Paid License for real-time protection and additional security features. Paid feature offers support for Attachments in Communities, Service Cloud and Sales Cloud, Visualforce. However, it is not clear if Salesforce Files are included. Information gathered is based solely on what was available on the Salesforce AppExchange listing for this solution and the company website. Neither site contained detailed information.

The vendor was nonresponsive when the Enterprise Platforms team tried to obtain additional information about the product. No information was available regarding existing customers.

The costs will be higher than the previous contract due to restructuring of the pricing, increase in demand and enhancements the vendor has put in place to handle the rise in demand. Pricing will be compared with the IGCE which has taken into account all the changes.

CFPB's current solution support will expire on 2/1/25. Therefore, an anti-virus product must be in place at that time, to ensure protection from possible cyber security issues. This sole source will meet CFPB’s needs most efficiently.

The Office of Tehcnology and Innovation continues to evaluate emerging technology in an effort to promote competition while maintaining a secure environment.

1/29/2025 4:37:42 PM

1/30/2025 12:41:22 PM

1/30/2025 12:51:44 PM

javascript:

javascript:

javascript:

javascript:

javascript:

javascript:

javascript:

javascript:

https://sharepoint.cfpb.local/promgt/procure/Reference%20Library/Policies%20and%20Procedures/Contract%20%20and%20Legal%20Reviews%20-%20Policy%20and%20Procedures/Procurement%20Review%20Policy%20Amendment%2011%20Final%206_9_20.pdf

Head of Contracting Activity

Senior Procurement Executive

Justification Signature History Stamp

Source Selection Sensitive in accordance with FAR 2.101 and FAR 3.104.

STATUS

Pre-Solicitation Review

Submit & Notify

Save & Close

Exit without Saving

NOTES Flag for Review

Notes captured in this common space facilitate communication between all Stakeholders in this

Procurement.

Please specify which tab your note is about Created By Date and Time

Morrow, Jennifer

(CFPB)

Morrow, Jennifer

(CFPB)

Morrow, Jennifer

(CFPB)

Morrow, Jennifer

(CFPB)

Insert new note

HISTORY

Created By:

Morrow, Jennifer (CFPB) Creation Date:

11/22/2024

Creation Time:

4:42:08 PM

Last Modified By:

Coleman, CC (CFPB) (she/her/hers)

Last Modified Date:

1/30/2025

Last Modified Time:

12:56:20 PM

Office of the Chief Procurement Officer Operations Division

Consumer Financial Protection Bureau

||Competition Advocate Coleman, CC (CFPB)(she/her/hers)has Approved 2025-01-30T12:51:44 ||CO McKay, Crystal (CFPB)has Approved 2025-01-30T12:41:22 ||Technical Requirements Offical Pham, Danny (CFPB)has Approved 2025-01-29T16:37:42 ||||||

COR has contacted vendor for updated pricing for IGCE. Current submitted IGCE is with prior pricing at 3% escalation. Submitted prior AOA and Sole Source J&A for background.

Acq Plan 11/22/2024

4:40:13 PM

This procurement package will be updated to reflect an IGCE/total POP of base plus four. Current services extended from 12/27-2/1. Award needed by 2/1 to avoid service lapse. COR updating docs.

Acq Plan 12/17/2024

8:28:01 AM

2024 AOA still applicable Acq Plan 12/20/2024

1:55:59 PM

Added SLA request from Program Office (re: email from 1/16). Acq Plan 1/16/2025

6:08:50 PM

javascript:

javascript:

javascript:

javascript:

javascript:

javascript: