FY20-12111 Fortify Software_Brand Name Justification_2.pdf

13 October 2017 (Rev 1)

OTHER THAN FULL AND OPEN COMPETITION JUSTIFICATION FOR SIMPLIFIED

ACQUISITION PROCEDURES (SAP)(UNDER $250K)

PMD ID Number:

Department:

Type of Justification:

Company Name/Brand Name:

Company Address (if sole source):

Company POC and Phone Number (if sole source):

Description of Product, Supplies or Services required to meet the Agencies needs:

Statutory Authority Permitting Other than Full and Open Competition: FAR 13.106-1(b)(1)

FY20-12111

Code 104

Brand Name

Brand Name: Micro Focus Fortify

1) Micro Focus Fortify Premium Edition Suite Software E-LTU Support and Updates 24x7H7S88AAE QTY 1

2) Micro Focus Fortify Scanning User Software E-LTU Support and Updates 24x7 M3C90AAE Qty 5

✔ Identification of the Justification Rationale: The material or service must be compatible in all aspects (form, fit, and function) with existing systems presently installed.

A patent, copyright, proprietary data, or licensing agreement limits competition.

These are "direct replacements" parts/ components for existing equipment.

Urgency (rare)

Identification of the Justification Rationale Explained:

**If using form, fit, and function, describe the current equipment and how the new item/service must coordinate or interface.

**If using patent, copyright, proprietary data, describe the proprietary data.

**If using direct replacement, describe this below.

**If using urgency, describe when you became aware of the requirement and the impact of not having this complete by this time frame.

This request is for Micro Focus Fortify Static Code Analyzer which consists of managed software service and user licenses. The Fortify Premium Edition Suite includes Fortifiy Software Security Center (SSC) software and support, which is the required managed service installed on a NSWCPHD managed CLIN27 server. User licenses and support are required for client scanning and connecting to SSC. Static Code Analyzer automates the software assurance process for developed code by testing for vulnerabilities and providing compliance assessments against Defense Information Systems Agency STIGs (Security Technical Implementation Guides) and other security mandates. This software application is for the benefit of software developers and is not required to run the data center. The software will be run via NMCI (developer) Science & Technology workstations. This brand name is required to be compatible with the system utilized by NAVSEA headquarters. This is also the only product the Government is are aware of that maps DISA STIG controls to National Institute of Standards and Technology (NIST) controls which is needed for Risk Management Framework.

This software must match what is currently used in all ways (form, fit, and function). If it does not, the Government will not be able to perform the software assurance process for developed code by testing for vulnerabilities and providing compliance assessments against DISA STIGS and other security mandates.

Specific Characteristics of the Item or Service Required that Limit the Availability to a Sole Source or Brand Name:

**This is the most important section. Explain in detail why this company or brand are the only ones that can meet the requirement.

Market Research Conducted:

This is a contract renewal for previously purchased software and support. The Government has invested in training and time to learn the Micro Focus Fortify suite. Moving to another vendor would significantly impact productivity because developers would have to manually check and fix each STIG setting and vulnerabilities, which is very time consuming Fortify scanning automatically recommends best practices and solutions to make code compliant. No other vendor has software that can satisfy all requirements that Fortify does.

Fortify SCA integrates with our existing development environment through DISA Application STIGs rulepacks, scripts, Visual Studio IDE plugins, and GUI tools so developers can write secure code that will pass IG inspections.

It supports all the programming languages Code 104 develops in, including: ASP.NET, C#, Javascript, and T-SQL.

Contacted company TSPi and requested a market research pricing estimate for the 2 items that are required by the technical point of contact (Mr. Brandon Dooley). TSPi returned a market estimate citing the costs for both items required. TSPi received estimates from their re-sellers to send estimates for the same software and software support.. The Government received market research pricing estimates from OSI Federal Tech and SHI for the requirements.

Competing software researched were HCL AppScan, Parasoft DTP (Development Testing Platform), and Veracode Static Analysis which do not include DISA Application STIGs support in their static code scanning tools. Fortify SCA maintains updated rulepacks for the latest DISA Application STIGs which is mandatory to help Code 104 developers maintain security compliance that pass IG inspections.

Statement of Actions, if any to Remove Barriers to Competition in the Future:

Any Other Facts Supporting Justification:

Technical Requirement Certification:

I certify that the facts and representations under my cognizance, which are included in this justification and which form a basis for this justification, are complete and accurate.

Technical/Requirements Cognizance Signature: DOOLEY.BRANDON.M.1

295556753 Digitally signed by DOOLEY.BRANDON.M.1295556753 DN: c=US, o=U.S. Government, ou=DoD, ou=PKI, ou=USN, cn=DOOLEY.BRANDON.M.1295556753 Date: 2020.04.13 11:52:51 -07'00'

Signature Print Name, Title and Code Phone No. Date

Barrier to competition would be removed if another vendor had static code scanning software that could scan for the latest DISA Application STIGs, and recommend fixes to remove identified vulnerabilities.

Contracting Officer:

I certify that this justification is accurate and complete to the best of my knowledge and belief.

Signature Print Name, Title and Code Phone No. Date

Contracting Officer Signature: ANDERSON.CHRISTINE.G.102143 Digitally signed by

ANDERSON.CHRISTINE.G.1021435798

Date: 2020.04.14 08:25:45 -04'00'