CMTRE616R035_JA_redacted.pdf

Justification & Approval Subject: CMTRE616R035

The following paragraphs, in accordance with Federal Acquisition Regulation Part 13.106- 1(b)(1)(i), are provided to support sole source limited source justification for proposed orders exceeding the micro-purchase threshold, but not exceeding the simplified acquisition threshold.

Brand-name, proprietary, Offsec Services Limited’s Hosted Virtual Lab software subscription is required for the Defense Information Systems Agency (DISA) Risk Management Executive (RME) Risk Analysis Branch’s DISA Red Team (DRT) mission of Chambersburg, PA.

. The one-year period of performance (POP) will begin following the award date, with the estimated POP of September 26, 2016 through September 25, 2017.

are available for this procurement. The applicable North American industrial classification system code is 511210 Software Publishers with a sales size standard of $38.5 million.

With this software, the DTR will have a simulated real world corporate network infrastructure for virtual penetration testing to practice, improve upon, and discover new tactics, techniques, and procedures (TTPs) for identifying and thwarting unauthorized infiltration. The subscription provides access on a 24 hour, seven-days a week basis to this virtual private network or VPN connection environment simultaneously by one management and 20 user DTR account holders with assigned usernames and passwords. The virtual network will be comprised of forty virtual machines with non-standard configurations so that some of the most unique vulnerability cases encountered in penetration testing may be simulated and addressed. Virtual machines hosted in the virtual network will feature a variety of operating systems, including Windows, Linux, Android, and supervisory control and data acquisition or SCADA software. This will enable users to hone a broad set of skills for identifying and countering offensive attacks.

Without this commercially available software, the government estimates a custom testing environment developed to meet agency needs would cost an estimated for various hardware and software infrastructure item, and at least dedicate two DTR employees over a 2-year period to the development effort (

). Valuable DTR employee resources would be diverted from existing tasks that would jeopardize the efficiency and effectiveness of the team’s work and mission.

Extensive government market research was performed via internet searches and discussions between January and May . It was discovered that agency needs would only be met with the Hosted Virtual Lab offered by Offsec Services Limited. Although there are other virtual lab software products, they do not offer the same benefits, such as the administrator account and the dedicated environment. The management or administrator account that is only available from Offsec Services Limited is crucial to the government’s ability to control power to the virtual network, revert machines when needed, control which machines are viewable to each user, and track each user’s progress. Without the dedicated and completely separate virtual network provided by, DRT members would be accessing the same environment as regular users and this could compromise the new TTPs discoveries made by the DRT. Costs of an alternate solution that doesn’t meet the technical needs of the DRT are estimated to be higher too.

Based on current market research, dated January and May , it has been determined that the brand-name software subscription product of Offsec Services Limited is the only product capable of fully supporting the government’s need. A dedicated, virtual penetration testing lab software tool is not a widespread IT security offering and Offsec Services Limited provides the IT security offering at a price point that is lower than the cost of other software solutions, including purchasing a current offering or developing an in-house solution. This requirement is for proprietary products and/or product support and no other competitor products exist in the market at this time to meet the governments’ need. The Hosted Virtual Lab subscription is solely available from Offsec Services Limited, a large business, which has sole ownership and access to the software source code to provide the required product and upgrades, maintenance releases, patches, and troubleshooting support. There are no authorized resellers for this product, which is only offered to the government through an open-market purchase order. The solicitation will be emailed to the software manufacturer and posted to FedBizOpps.

Based on the justification provided and to the best of my knowledge and belief, a determination is made that this justification is accurate and complete.