JA_MFR_CMTMA3152180-r.docx

Memo For Record Subject: Domain Name System (DNS) Response Policy Zones (RPZ) Threat Data Feed Subscription Funding No: CMTMA3152180

The following paragraphs, in accordance with Federal Acquisition Regulation (FAR) Part 13.106(b)(1)(i), are provided to support the limited source justification for proposed orders exceeding the micro-purchase threshold but not exceeding the simplified acquisition threshold.

Defense Information Systems Agency (DISA) Infrastructure Development Directorate - Network Services Division is requesting procurement of commercial-off-the-shelf renewal of the 1 year Infoblox Disk File Write RPZ Feed Subscription which is used to support DISA DNS Enterprise Recursive Service (ERS) system. The part number is: IB-SUBS-01-DFW2-1400. The period of performance is August 7, 2015 through August 6, 2016. This software support was previously procured under contract HC1028-14-P-0177, which expires August 6, 2015. Fiscal Year 2015 Defense Working Capital Funds funding is provided for the procurement under number CMTMA3152180.

This portion of the DISA DNS defense plan covers the filtering of recursive DNS queries consistently for all resolvers utilizing a DNS firewall based on RPZ. RPZ is a mechanism that performs DNS query filtering based on query and/or query response characteristics.

The Infoblox threat data feed subscription provides electronic transfer of updated internet threat data through full/incremental DNS zone transfers to DISA recursive/caching servers. The threat data feed subscription consists of malicious domains & IP addresses associated with Spam, Botnet, Trojans, phishing sites, Worms, or otherwise known domains/IP addresses utilized by Application Productivity Tool and other developing 0-day threats. Additionally, the Infoblox threat data feed subscription provides a facility for GeoIP filtering based on both DNS country code and IP address association. Also, due to the dynamic nature of the external threats, this threat data feed subscription sends updates at least every 4hrs.

Not procuring the Infoblox Threat Data Feed Subscription would leave DISA vulnerable to security risks on internal government systems. As it relates to meeting mission goals of USCYBERCOM & DCC with regard to the ERS tool, the Infoblox threat data feed subscription is the only provider that currently supports our needs.

Market research has confirmed there are no other products currently on the market that will meet the government’s requirements. The Infoblox Threat Data Feed Subscription (IB-SUBS-01- DFW2-1400) is proprietary and is only available through authorized Infoblox resellers. Market research has revealed the products are available through small businesses. Infoblox stated that they do have small business authorized resellers Sun Management, a small business and BAI Federal, a small business. As such, this requirement will be posted to all authorized Infoblox small business resellers via Fed Biz Opps (FBO).

Based on the justification provided by DISA, a determination has been made to solicit the above brand name requirement through FBO; open to all small business Infoblox authorized resellers.