Redacted J A.doc

JUSTIFICATION

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

a. Requiring Activity:

Defense Information Systems Agency (DISA)

Program Executive Office Mission Assurance and Network Operations

(PEO-MA/IA5)

6914 Cooper Avenue

Ft. Mead, MD 20755-0549

b. Contracting Activity:

DISA/Defense Information Technology Contracting Organization (DITCO)

Software Section (PL8321)

2300 East Drive

Bldg 3600

Scott AFB, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

a. The nature of this action is to continue the software maintenance for brand name, McAfee and Symantec, enterprise software licenses for anti-virus (AV) and anti-spyware (AS) capabilities. The McAfee and Symantec AV/AS capabilities includes maintenance updates for existing perpetual licenses for the currently installed AV/AS solutions for all Department of Defense (DoD) Components. AV/AS Tier III Help Desk Support will be required in addition to training and optional Subject Matter Experts (SME’s). SME’s will be used on an as needed basis only.

b. The recommendation is to award two Firm-Fixed-Price (FFP) open market contracts. The McAfee software maintenance will be set-aside for 8(a) authorized resellers and the Symantec software maintenance will be set-aside for authorized small business resellers. The period of performance for each contract is a one-year base period and four one-year option periods. The anticipated period of performance, for each contract, is 17 September 2012 through 16 September 2017.

c. FY 2012 Operation and Maintenance funding was provided for the procurement. Military Interdepartmental Purchase Request numbers DIAMZ25046 and DIAMZ25011 have been issued for the base year.

3. DESCRIPTION OF SUPPLIES/SERVICES:

a. A key element of the DoD computer defensive environment is the ability to prevent, detect, and eradicate viruses and worms that create vulnerabilities and impact mission accomplishment. The Government requires a continuation of existing AV/AS capabilities that will largely be a client based assessment solution deployed on information technology (IT) infrastructures throughout DoD.

b. The McAfee and Symantec AV/AS software suites provide a scalable enterprise AV/AS solution to the DoD. The AV/AS software suites provide real-time protection for multiple operating systems against identified threats, utilizing industry best practices. The suites also protect the DoD enterprise networks (owned, operated, and supported) and connected systems (laptops, desktops, servers, wireless systems and email gateways virtual clients), from malicious software, to include but not limited to viruses, trojan horses, worms, bots, and rootkits. The software suites of solutions provide protection from malware that may be transmitted through various mediums including removable media, email, internet spam, malicious web sites, Instant Messaging systems and collaboration tools. The solutions identify unsafe web sites during searches, protect against identity theft by securing, storing, and managing login credentials and personal information, and prevent hackers from eavesdropping and collecting information while using an application. Additionally, the solutions provide tune-ups by having insight into recent activities to help prevent computer slowdowns by automatically finding and fixing personal computer problems, all while preventing degradation on low bandwidth extensions to the enclave.

c. The McAfee and Symantec AV/AS software suites of solutions also implement mandated DoD standards such as Federal Desktop Core Configuration and Security Technical Implementation Guides (STIGs). The software suites also interoperate with the DoD Host Based Security Solution (HBSS) and keep tactical deployed enclaves with low bandwidth current without network degradation. HBSS integration, and interoperation, is important because the interoperability of the solution requires incidents occurring on the host and the state data from the host to be passed to the HBSS ePolicy Orchestrator (ePO) Server. This requires event parsers to be developed and incorporated into ePO. The solution must capture events and report them in real time to be effectively used in data correlation at the Tier I level. There is no impact on, or requirement for Tier II support.

d. Additionally, the software licensing structure allows all DoD military members and civilian employees the right to use the products on personal/home computers and personal electronic devices, at no additional cost.

e. For continued AV/AS enterprise use and implementation, Tier III helpdesk support and training will be required. SME support may be required on an as needed basis.

f. The following Period of Performance (PoP) and estimated life cycle costs for both McAfee and Symantec software license maintenance, Tier III helpdesk support, training and SME support is as follows:

PoP

4. IDENTIFICATION OF STATUTORY AUTHORITY:

This acquisition is conducted under the statutory authority of 10 U.S.C§2304 (c)(1), and the regulatory authority of FAR 6.302-1/DFARS 206.302-1, only one responsible source and no other supplies or services will satisfy agency requirements. The items/services are peculiar to one manufacturer’s brand name. Only the original equipment manufacturers or their authorized resellers will satisfy the requirement. No other vendors or distributor can legally obtain access to the software nor make duplicate copies, since it is protected by copyright and patent laws.

5. DEMONSTRATION OF CONTRACTOR’S UNIQUE QUALIFICATIONS:

a. McAfee and Symantec own the copyrighted source software with all legal rights, privileges, and ownership contained therein. No other source may legally modify or change the software, nor would they have access to the source code to do so. The identified AV/AS capabilities are proprietary software manufactured by McAfee and Symantec. In order to avoid a gap in capability in protecting the DoD from malware threat, it’s necessary to procure these products to continue the use of the existing AV/AS capabilities.

b. McAfee and Symantec are uniquely qualified to provide these services to the DoD Enterprise. The specific unique characteristic that the McAfee and Symantec AV/AS capabilities offer, which is not offered by other similar software, includes complete integration with HBSS Operational framework. The McAfee and Symantec AV/AS products are integrated with the HBSS framework and they provide a choice for Combatant Commands, Services and Agencies (CC/S/A’s) to satisfy DoD Enterprise AV/AS requirements. This is based upon the economy, and efficiency of maintaining state of the art AV/AS solutions installed on over 95% of the DoD Enterprise.

c. The DoD community has been using the McAfee and Symantec Antivirus solutions across their networks since at least 2002. The current AV/AS solutions provide DoD unique capabilities and tools to detect and counter known cyber-threats to DoD enterprise assets.

f. Failure to procure the continuation of McAfee and Symantec AV/AS capabilities will cause a significant increase in cost due to the time, effort, and costs associated with transitioning the DoD enterprise to the new antivirus product and integrating that new antivirus solution into the existing HBSS infrastructure. Based on historical experience, it would take up to 18-36 months to implement a new AV/AS solution on the same percentage of the DoD network upon which the McAfee and Symantec solution is currently implemented. 9. ANY OTHER SUPPORTING FACTS

a. The use of an AV/AS solution is required by the DoD mandated Windows Desktop Application STIG Version 3, Release 1, dated 09 March 2007 and Tasking Order 07-06, Mitigate Trojan on Global Information Grid. In many instances, the Combatant Commands, Services and Agencies use more than one AV/AS product to provide a layered security strategy to reduce vulnerability and defend against a wide range of threats. A virus that slips by one vendor may be caught by another. The DoD currently utilizes two AV/AS solutions, McAfee and Symantec.

Page 1 of 4 Pages