Attach_1,_LSJ_for_18F0349,_ArcSight_Upgrade.pdf

Limited Sources Justification and Approval (J&A)

FOR OFFICIAL USE ONLY

March 2018 FOR OFFICIAL USE ONLY Page 1 of 4

Contracting Activity: 45th Contracting Squadron, Patrick AFB (PAFB), FL 32925

Purchase Request / Local ID Number: F3KTK68117A004

Program / Project (and PE, if applicable): Hewlett Packard Enterprises (HPE) ArcSight Hardware and Software

Program Type (PEO or Other Contracting): Other Contracting

Authority: Multiple Award Schedule Program (FAR 8.405-6)

Estimated Contract Cost (including options): $551,060.55

Is this a Bridge Action as defined in the AF Bridge Action Reduction Plan? Yes No

Description of Limitation:

Only one source under the mandatory DoD Enterprise Software Initiative (ESI) and in accordance with (IAW) DFARS 208.7402, can provide the ArcSight upgrade required under the HP Information Technology Asset Management (ITAM) Blanket Purchase Agreement (BPA).

COORDINATION (AFFARS 5306.304(a) )

Date

08 May 2018

Project Lead / Program Mgr / Requiring Activity

Program Manager John Carter

AFTAC/CYCS-SCXP, 321-494-9446

Signature

APPROVAL (AFFARS 5306.304(a) )

Date

22 Aug 2018

Contracting Officer

Iris Dagani

45 CONS/PKB, 321-494-6287

Signature

CARTER.JOHN.R.

1112743240

Digitally signed by

CARTER.JOHN.R.1112743240

Date: 2018.05.08 12:43:54 -04'00'

DAGANI.IRIS.1387568677

Digitally signed by

DAGANI.IRIS.1387568677

Date: 2018.08.22 20:32:53 -04'00'

March 2018 FOR OFFICIAL USE ONLY Page 2 of 4

I. Contracting Activity.

45 CONS/PKB

1201 Edward H. White II St Patrick AFB, FL 32925

II. Nature and/or description of the action being processed.

Request for a sole source procurement of HPE ArcSight hardware and software to upgrade currently fielded products approaching End of Life/End of Support (EOL/EOS). This firm fixed priced order will be on placed with Carahsoft Technology, Corp. on BPA#: N00104-13-A-ZF46 via ESI. Delivery date will be 10 days after award.

III. Description of supplies/services required to meet agency needs.

Requested items include support for hardware and software to be purchased as stated below:

Line Part No. Description Qty Price

0001 P0K42CA HPE S AS Lgr L7X00S to SDP L7600 Upg Svr 5 $130,263.15 Logger L7505S to Security Data Platform L7600

0002 P0K47CA HPE S AS SDPLXXXXHA to SDPL7600HA Upg Svr 5 $57,894.75 Logger L7505S HA to Security Data PlatformL7600 HA

0003 P0K07CA HP AE 1250 EPS to EE-7600 1250 EPS Upgr 2 $44,000.00 ArcSight Express 7526 1250 sustained EPS to ESM Express-7600

0004 P0K06CA HP AE 1250 EPS HA to EE76001250 EPS HA Upg ArcSight 2 $44,000.00 Express 7526 1250 sustained EPS HA to ESM Express-7600 1250 sustained EPS HA

0005 P0K49CA HPE S ARST CXXXX to CHA C6600 Upgr Svr ArcSight ConnApp 2 $34,736.84 C6502 & C6504 Connector Hosting Appliance Upgrade to C6600

0006 P0K50CA HPE S ARST CXXXXNP/HA to C6600HA Upg Svr ArcSight ConnApp 2 $34,736.84 C6502 and C6504 HA Upgrade to Connector Hosting Appliance C6600 HA

0007 M3E82AAE HP AE2ESMExp 500EPSAddOn Upg HA SW E-LTU 3 $38,346.33 0008 M3E80AAE HP AE 2 ESMExp 500EPS AddOn Upg SW ELTU 3 $76,692.69 0009 M3E77AAE HP AE 2 ESM Exp Add On 50 EPS SW ELTU 10 $32,021.30 0010 M3E78AAE HP AE 2 ESM Exp Add On 50 EPS HA SW E-LTU 10 $22,414.90 0011 HP082A1#Q6A HP SW 1 year 24x7 Support + Content Subscription + 3 $8,433.45

HW Replacement Service 0012 HP082A1#Q65 HP SW 1 year 24x7 Support + Content Subscription + 3 $15,000.00

HW Replacement Service 0013 HP082A1#Q77 HP SW 1 year 24x7 Support + Content Subscription + 10 $7,364.90

HW Replacement Service 0014 HP082A1#Q7C HP SW 1 year 24x7 Support + Content Subscription + 10 $5,155.40

HW Replacement Service Total: $551,060.55

IV. Identification of the justification/rationale for limiting sources and demonstration of the contractor's unique qualifications to provide the required supply/service.

FAR 8.405-6 requires an ordering activity to justify its actions when restricting consideration of schedule contractors to fewer than required in FAR 8.405-1.

FAR 8.405-6(a)(1)(i)(B), “Only one source is capable of responding due to the unique or specialized nature of the work”.

March 2018 FOR OFFICIAL USE ONLY Page 3 of 4

Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STiGs), Committee on National Security Systems Instruction (CNSSI) 1253, and DoD Instruction (DoDI) 8500.2 require continuous system activity log monitoring and auditing of all network connected devices. The exponential growth of daily logs requires some form of automation to facilitate effective monitoring and auditing. ArcSight is the Air Force standard for meeting these mandated requirements. The ArcSight log file format is required for reporting security metrics to DISA; using other vendor solutions requires software conversion processing before files can be uploaded/forwarded to DISA. Additional software processing would add delays, complexity, and additional costs to our reporting requirement.

See attached letter regarding the Certificate to Field (CTF) for HP ArcSight Management Center (ArcMC) v2.5 and above. This letter allows for the purchase of the requested upgrade and the ability to test the software prior to being deployed for full use, as required for all classified networks.

V. Determination by the ordering activity Contracting Officer that the order represents the best value consistent with

FAR 8.404(d).

Fair and reasonable pricing will be determined by price analysis in accordance with FAR 15.404-1(b)(2) as referenced in FAR 8.404(d) Deviation. "The Government may use various price analysis techniques and procedures to ensure a fair and reasonable price." The methods to be used for this requirement will be based on historical prices paid and competitive published price lists.

VI. Description of the market research conducted and the results, or explain why market research was not conducted.

Market research shows this item is available on ESI, a required source.

Carahsoft Technology, Corp.

ESI BPA: N00104-13-A-ZF46 (exp. 12/31/18) GSA Schedule: GS-35F-0119Y

CAGE: 1P3C5, DUNS: 088365767

Large Business

VII. Other facts supporting the justification.

DoD ESI is a mandatory source. DFARS 208.7402 states that departments and agencies shall fulfill requirements for commercial software and related services, such as software maintenance, in accordance with the DoD ESI. ESI promotes the use of enterprise software agreements (ESAs) with contractors that allow DoD to obtain favorable terms and pricing for commercial software and related services. A search of ESI has determined that only one reseller is available for the HP ArcSight Network Security software.

AFTAC has integrated ArcSight into multiple mission networks with extensive customization, content authoring, and training for AFTAC's site-specific data flows. Migrating to alternate vendors would require completely new security logging architecture designs and the integration of new logging procedures. 25AF utilizes ArcSight for log analysis and reporting.

AFTAC leverages vendor specific experience, expertise, and training by utilizing the same logging software suite that is in use at our HQ organization.

VIII. Actions the agency may take to remove or overcome any barriers that led to the restricted consideration before any subsequent acquisition for the supplies or services.

This requirement is under the mandatory DoD ESI website IAW DFARS 208.7402; therefore, no actions can be taken to remove or overcome this restriction.

This requirement allows for consistency and will not require additional measures to utilize the software. For future purchases, the Program Manager and Contracting Officer will review current rules, regulations and stay updated on business processes and communications/software requirements as well as any additional suppliers that could provide competition in the market.

March 2018 FOR OFFICIAL USE ONLY Page 4 of 4

IX. Certification by the Contracting Officer.

As evidenced by my signature above, I have determined this document to be both accurate and complete to the best of my knowledge and belief.

X. Certification by the technical/requirements personnel.

As evidenced by my signature above, I certify that any supporting data contained herein, which is my responsibility, is both accurate and complete.