FY26 Tanuim_J A_Redacted.pdf

Limited Sources Justification I. Agency/Contracting Activity.

Agency: Defense Manpower Data Center, 400 Gigling Rd, Seaside, CA 93955 Contracting Activity: DHRA, 4800 Mark Center Drive, Alexandria, Virginia, 22350

II. Nature and/or description of the action being approved.

This action is for the award of a new, firm-fixed-price Department of War (DoW) Enterprise Software Initiative (ESI) order to Carahsoft Technology, Corp. for Tanium endpoint security management software subscriptions. This procurement is necessary to ensure the continuity of critical cybersecurity capabilities for the Defense Manpower Data Center (DMDC) and to comply with a new, mandatory-for-use DoW agreement.

This new procurement is required because the DoW has established a new set of multi-award Blanket Purchase Agreements (BPAs) for cybersecurity software. The Tanium BPA under this initiative, N66001-23-A-0049 held by Carahsoft, has been designated as a Core Enterprise Technology Agreement (CETA), making it the mandatory source for Tanium products within the DoW.

The new CETA supersedes the previous ESI BPA (N6600119A0057) held by EC America, Inc. Consequently, Defense Human Resources Activity/Acquisition Management Directorate is unable to exercise the remaining option periods on the preceding order (H9821023F0161) and must transition to this new mandatory vehicle to maintain operational capabilities and compliance.

The proposed order to Carahsoft Technology, Corp. will consist of one 12-month base period, plus four (4) 12-month option periods (billed annually), total estimated amount of Fiscal Year (FY) 2026 Operating and Maintenance (O&M) funds are identified and available for obligation for the base period in the total estimated amount of .

III. Description of supplies/services required to meet agency needs (including the estimated value).

The DMDC requires the continuation and maintenance of its enterprise endpoint management and security platform for the Non-Secure Internet Protocol Router (NIPR) environment. This platform is essential to maintain compliance with DoW mandates, provide enterprise-wide asset visibility, and deliver real-time discovery, reporting, and configuration data for all DMDC endpoints.

Specifically, DMDC requires a single, integrated solution that is commercially based, threat-informed, and provides the following critical capabilities:

Real-Time, At-Scale Visibility: Provide a comprehensive and continuously updated inventory of all hardware and software assets across the enterprise in seconds, regardless of network size. The solution must be able to ask questions in plain language and receive complete, accurate results from every endpoint.

Federated Architecture for DoW-Wide Reporting: The solution must be capable of natively federating with the Joint-Force Headquarters Department of Defense Information Network (JFHQ-DODIN) Joint Tanium Federated Server (JTFS), in compliance with JFHQ-DODIN OPORD 19-0055, to provide automated endpoint and asset data rollup for enterprise-wide situational awareness.

Distributed, High-Speed Patching and Remediation: Conduct remote patching, software deployment, and configuration changes across all endpoints with minimal impact on network bandwidth. The solution must utilize a linear-chain or peer-to-peer architecture to distribute packages and actions without requiring extensive and costly dedicated distribution points.

Continuous Compliance Monitoring and Enforcement: Ensure all endpoints are secure and in continuous compliance with Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs), Center for Internet Security (CIS) Benchmarks, and other enterprise-specific configuration standards. The platform must be able to identify configuration drift in near real-time and automatically remediate it.

Proactive Threat Hunting and Rapid Incident Response: Support real-time monitoring and response by enabling network defenders to proactively hunt for indicators of compromise (IOCs) and advanced persistent threats (APTs) across all endpoints simultaneously. The solution must provide the ability to immediately isolate affected machines, deploy countermeasures, and remediate threats at enterprise scale.

Single, Lightweight Endpoint Agent: The platform must utilize a single, lightweight agent to perform all core functions, including asset inventory, patching, compliance, threat hunting, and remote management. This is critical to reduce endpoint complexity, minimize performance impact, and avoid the conflicts and security gaps that arise from deploying multiple, disparate agents.

Protect Data Integrity and Enable Mission Confidence: By providing unparalleled speed, scale, and accuracy, the platform must protect the integrity and confidentiality of data and information assets, enabling mission owners and network defenders to have full confidence in the security and status of the information they are using.

The required Tanium capabilities, previously licensed under individual modules such as Deploy, Asset, Core, Comply, Patch, Discover, and Threat Response, are now offered as consolidated bundles under the new mandatory-for-use DoW CETA (N66001-23-A-0049) with Carahsoft. To ensure continuity of service and maintain all existing and mandated capabilities, DMDC requires the procurement of the following successor product bundles:

Tanium Core Plus (TAN-CORE-PLUS-S): To satisfy the foundational requirements for real-time asset inventory, endpoint discovery, and core platform management (previously covered by the Asset, Discover, and Core modules).

Tanium Endpoint Management Plus (TAN-EPMGMT-PLUS-S): To perform enterprise-wide software deployment and system patching (previously covered by the Deploy and Patch modules).

Tanium Risk & Compliance Plus (TAN-RC-PLUS-S): To conduct continuous compliance monitoring against DISA STIGs and other enterprise standards (previously covered by the Comply module).

Tanium Incident Response (TAN-IRESP-S): To provide our network defenders with the tools for proactive threat hunting and rapid incident response (previously covered by the Threat Response module).

This transition to the new bundled offerings represents a change in product nomenclature and packaging only, not a change in the underlying operational requirement. The capabilities provided by these new bundles are the same as those previously licensed and are essential for maintaining DMDC's security posture and compliance with DoW directives, including JFHQ-DODIN OPORD 19-0055.

The estimated prices and periods of performance are specified in the table below.

Period Unit and Quantity Total Base 1 year Option Period 1 1 year Option Period 2 1 year Option Period 3 1 year Option Period 4 1 year

IV. Authority and supporting rationale (see 8.405-6 (b)(1)) and, if applicable, a demonstration of the contractor's unique qualifications to provide the required supply/service.

In accordance with DFARS 208.74, the DoW must satisfy its needs for commercial software through the DoW ESI when such agreements are available.

The FY 2017 National Defense Authorization Act (NDAA) directed the DoW to implement a Comply-To- Connect function as part of a continuous monitoring capability. In February 2019, the DoW Chief Information Officer (CIO) directed the JFHQ-DODIN, U.S. Cyber Command, and the Office of the Secretary of Defense Principal Cyber Advisor to take actions to implement software capabilities in support of the DoW continuous monitoring process. Consequently, in 2019 JFHQ-DODIN issued Operations Order (OPORD) 19- 0055, "Operation Spartan Tally – Tanium Operationalization," which required Department-wide Tanium Federated Server implementation. Fragmentary Order (FRAGO) 1 to this OPORD directed DoW Agencies and Field Activities to install Tanium software ‘on all endpoints in order to facilitate automated endpoint identification, asset enumeration and status reporting to the Joint Tanium Federated Server on NIPR Network and SIPR Network.’

In accordance with DoW Directive 8470.01E, and under the authority of the Navy Program Executive Office Enterprise Information Systems (PEO EIS) as the DoW Executive Agent for CETA, a new BPA for Tanium has been designated as the DoW CETA. This CETA designation makes this purchasing vehicle the mandatory source for all DoW acquisitions of Tanium products and services. The current call order was awarded under the previous CETA, N6600119A0057 on July 6, 2023, to the authorized reseller, EC America, Inc. The new CETA, N66001-23-A-0049, awarded July 14, 2023, identifies Carahsoft Technology, Corp. as the sole authorized reseller for this mandatory agreement, replacing the previous BPA holder.

The implementation of Tanium-related hardware and software on the DMDC Enterprise Network required an Authority to Connect/Authority to Operate (ATC/ATO), which involves numerous individual tasks. Any transition to a new platform would involve, at a minimum, approximately twelve months of downtime and degradation of performance during the engineering and deployment of a new solution and the transition period, which injects unnecessary risk to DMDC networks, as no alternative platforms currently comply with DMDC’s ATC/ATO. There would also be an overlap in license and support for Tanium, and any replacement software products of at least one year as the new software and associated hardware are installed, configured, and tested and Government personnel begin their initial training on the new software.

Transition activities would consume additional Government or contractor personnel resources as personnel begin training and performing testing activities on the new software platform(s). Assuming two dedicated full-time personnel for the one year it takes to engineer and deploy the solution, this cost would be approximately $500k in manpower, on top of the duplicative licensing. These costs are not likely to be recovered through competition. A migration to an alternative software capability by DMDC would result in a degradation of this DoW-level capability until additional engineering work and testing could be completed to re-establish the federated capability utilizing a replacement software platform. This would require additional resources, time, and money to be expended at the DoW-level and similarly creates unnecessary risks for the DoW environment.

V. Determination by the ordering activity Contracting Officer that the order represents the best value consistent with FAR 8.404(d).

The Contracting Officer has determined that placing this order against the mandatory-for-use DoW ESI BPA for Tanium (N66001-23-A-0049) represents the best value to the Government. The DoW ESI program is a strategic sourcing initiative that leverages the DoW's enormous buying power to establish enterprise-wide agreements that provide the most favorable pricing and terms. The designation of this specific BPA as a CETA further solidifies that it has been vetted at the highest levels and is considered the optimal procurement vehicle for this capability.

In accordance with FAR 8.404(d), and to ensure the pricing for this specific order is fair and reasonable, a comprehensive price analysis will be performed. The techniques used will include:

Evaluating the proposed unit prices against the pre-negotiated ceiling prices established in the ESI CETA.

Comparing the total proposed price against the Independent Government Cost Estimate (IGCE).

Analyzing the proposed pricing against historical pricing paid for the same or similar Tanium subscriptions under the previous BPA.

Furthermore, the Contracting Officer intends to request additional discounts from Carahsoft beyond the established ESI-level pricing. A final determination of fair and reasonable pricing will be documented upon the conclusion of this analysis and any subsequent negotiations.

VI. Description of the market research conducted among schedule holders and the results, or a statement of the reason market research was not conducted.

Market research was conducted to identify all available sources for the required Tanium software subscriptions. This research confirmed that while Tanium products are listed on other contract vehicles, such as NASA SEWP and GSA Advantage, their use is precluded by DoW policy for this requirement. The governing regulation, DFARS 208.7402(a), mandates that DoW agencies shall fulfill requirements for commercial software through the DoW ESI. This directive is further reinforced by the designation of the new DoW ESI BPA for Tanium (N66001-23-A-0049) as a CETA, in accordance with DoW Directive 8470.01E. The CETA designation makes this purchasing vehicle mandatory for use across the DoW for all Tanium products and services. Accordingly, market research was focused on the mandatory ESI vehicle. Research on the DoW ESI website confirmed that the new Tanium CETA identifies a single authorized reseller: Carahsoft Technology, Corp. No other providers are authorized to sell Tanium products under this mandatory-for-use agreement. Therefore, competition is effectively restricted to the single source designated at the DoW enterprise level.

VII. Any other facts supporting the justification.

N/A

VIII. Actions the agency may take to remove or overcome any barriers that led to the restricted consideration before any subsequent acquisition for the supplies or services.

The principal barrier to competition is the DoW mandate to use the Tanium platform for endpoint security and the designation of the DoW ESI BPA N66001-23-A-0049 as a mandatory-for-use CETA.

Accordingly, DMDC will take the following actions prior to any subsequent acquisition:

1. Monitor DoW Enterprise Agreements: DMDC will continuously monitor the status of the DoW ESI CETA program.

Should the Tanium BPA cease to be a mandatory CETA, or if alternative, technically equivalent platforms are added to a new mandatory agreement, DMDC will re-evaluate the marketplace for competitive opportunities.

2. Stay Apprised of DoW Directives: The command will remain apprised of any changes or superseding orders to JFHQ-DODIN OPORD 19-0055. A modification or rescission of the requirement to federate endpoint data using the Tanium platform would be a key enabler for considering alternative solutions.

3. Conduct Ongoing Market Research: In parallel, DMDC will continue to conduct market research on emerging endpoint security technologies to maintain an understanding of the competitive landscape.

Should these programmatic and top-level barriers be removed, DMDC is committed to pursuing competition. However, any future competitive assessment would require a comprehensive business case analysis to determine if the benefits of switching platforms would outweigh the significant operational risks, duplicative costs, and mission degradation associated with migrating away from the established and DoW-integrated Tanium infrastructure.

IX. Certification by the Contracting Officer.

As evidenced by my signature above, I have determined this document to be both accurate and complete to the best of my knowledge and belief.

X. Certification by the technical/requirements personnel.

As evidenced by my (our) signature(s) above, I (we) certify that any supporting data contained herein, which is my (our) responsibility, is both accurate and complete.