CORE_Impact_-_Justification_Approval_Redacted.pdf

JUSTIFICATION APPROVAL DOCUMENT

Contracting Activity: ACC AMIC/JWAC

Purchase Request/Local Identification Number: FY15 planned for 6/30/2015 contract award.

Program Name: Joint Warfare Analysis Center (JWAC) - J9 - CORE Impact

Estimated Contract Cost (including options):

Type Program: Other Contracting

Authority: FAR 13.501(a)(1)(ii)

Type J&A: Individual

Project Manager

Contracting Officer

JUSTIFICATION APPROVAL

I. Contracting Activity/Requiring Activity:

Department of the Air Force

ACC AMIC/JWAC

4048 Higley Road Dahlgren, VA 22448-5144

Department of the Air Force/STRATCOM Joint Warfare Analysis Center (JWAC) 4048 Higley Road Dahlgren, VA 22448-5144

II. Description of Action Being Processed:

JWAC requires a software based multi-vector penetration testing solution to enhance current and future lab requirements. Only one software suite can meet JWAC’s requirements, CORE Impact. CORE Impact is an industry leading comprehensive testing suite for identifying vulnerabilities in a network environment.

III. Description of the Supplies/Services Required to Meet the Agency’s Needs:

Existing and future operational requirements are driving expansion of JWAC Cyber lab capabilities to better meet the needs of JWAC customers. Part of this expansion will require a robust capability to detect potential vulnerabilities on JWAC systems. To ensure maximum flexibility with current and future network configurations, JWAC determined that a penetration testing suite that provides multi-threat surface detection and evaluation of vulnerabilities is key to providing network security. Further, the software suite must also be frequently updated to reflect newly discovered vulnerabilities. Finally, the software suite must also be able to operate in both an internet connected and stand-alone environment, both physical and virtual. Key functional and performance requirements are listed below:

- Support for multiple networks

- Ability to incorporate vulnerability testing against industrial control systems

- Support usage from both physical and virtual platforms

- Test multiple attack surfaces including endpoint, network, and host/client systems

- Frequent updates to include zero day exploits

- Detailed reporting capability

- Severity of exposure (threat) risk analysis reporting and documentation

- Ease-of-use / low initial operator investment

CORE Impact is the only software that meets all of these requirements.

IV. Statutory Authority Permitting Other Than Full and Open Competition:

This requirement will be acquired under authority of 41 U.S.C. 1901 as implemented by FAR 13.501(a)(1)(ii).

V. Demonstration That the Contractor’s Unique Qualifications or Nature of the Acquisition Requires Use of the Authority Cited Above:

Market research determined that only CORE Impact provided vulnerability testing against industrial control systems.

VI. Description of Efforts Made to Ensure That Offers Are Solicited From as Many Potential Sources as Deemed Practical:

CORE Security software is not available via ESI or GSA SmartBuy. CORE security lists all resellers and partners on their website (http://www.coresecurity.com/resellers-and-var-partners), none of which are Netcents vendors. CORE Security software is available via GSA Advantage with the exception of the SCADA exploit add on package from one reseller, IT Federal Sales LLC. This software should be procured via open market to ensure that offers are solicited from as many potential sources as possible.

VII. Determination by the Contracting Officer That the Anticipated Cost to the Government Will be Fair and Reasonable:

Prices will be determined fair and reasonable by the contracting officer prior to award using price analysis techniques in Far 15.401. It is anticipated that competition will form the basis of fair and reasonable pricing. If competition is not received, comparison will be to historical prides paid. Comparison will be made to price lists and to prices obtained through market research, if possible.

VIII. Description of the Market Research Conducted and the Results or a Statement of the Reasons Market Research Was Not Conducted:

JWAC surveyed current penetration testing and vulnerability analysis software suites ranging from freeware (Kali Linux / Metasploit) to commercially available (CORE Impact / Metasploit Pro). CORE Impact was the only software suite that met all of the requirements listed in paragraph 2. The other software packages did not provide specific industrial control system vulnerability testing packages which is a critical component of the JWAC requirement.

IX. Any Other Facts Supporting the Use of Other Than Full and Open Competition:

None.

X. List of the Sources, if Any, That Expressed Interest in the Acquisition:

See Section VIII above.

XI. A Statement of the Actions, if Any, The Agency May Take to Remove or Overcome Any Barriers to Competition Before Making Subsequent Acquisitions for the Supplies or Services Required:

ACC AMIC/JWAC and STRATCOM/JWAC will continue to monitor various market information to determine whether any other source can meet future requirements prior to any subsequent acquisition. All requirements are thoroughly reviewed to ensure competition is not unnecessarily restricted. Future procurements will be competed among resellers to foster competition, if applicable.

XII. Contracting Officer’s Certification:

As evident by the signatures on the Justification Review Document, the Contracting Officer has determined that this document and any supporting data contained herein is accurate and complete to the best of his/her knowledge.

XIII. Technical/Requirements Personnel’s Certification:

As evidenced by the signatures on the Justification Review Document, the Program Manager has certified that any supporting data contained herein is both accurate and complete to the best of his/her knowledge.