Brand_Name_JA_Splunk.8JUL2015_CA_FINAL_(2).pdf

1 EITSD-Splunk Software

July 07, 2015

BRAND NAME JUSTIFICATION

FAR 13.501 – SPECIAL DOCUMENTATION REQUIREMENTS

1. AGENCY AND CONTRACTING ACTIVITY:

Requiring Agency:

Department of Defense (DoD) Washington Headquarters Services (WHS) Enterprise Information Technology Services Directorate (EITSD)

Contracting Activity:

Department of Defense Washington Headquarters Services (WHS) – Acquisition Directorate 1155 Defense Pentagon Washington, DC 22301-1155

2. NATURE/DESCRIPTION OF ACTION(S):

This action requests the approval for a Brand Name Justification for the procurement of Splunk Enterprise Security Information and Event Management (SIEM) software and support solution. This contract will be firm-fixed price (FFP), with an estimated award date of July 08, 2015. This is a new requirement and the recommendation is to procure the Splunk soft-ware on a sole-source (brand name) basis to Nisga’a Data Systems under the 8(a) program.

3. DESCRIPTION OF SUPPLIES/SERVICES:

The EITSD has a requirement for Splunk Enterprise Security Information and Event Man-agement (SIEM) software. The Splunk SIEM software solution includes software licenses, software maintenance, training, and implementation support.

The proposed Splunk SIEM solution will enable EITSD to:

• be compliant with DoD enterprise logging management requirements for Mission Assur-ance Controls for Integrity and Availability per DoD Instruction 8500.2, Information As-surance (IA) Implementation;

• have the ability to monitor and detect insider and external threats on the network;

• reduce incident investigation times through a consolidated search of all security-related data; and,

• provide real-time monitoring and analysis of security event data.

DEPARTMENT OF DEFENSE

WASHINGTON HEADQUARTERS SERVICES

1155 DEFENSE PENTAGON

WASHINGTON, DC 20301-1155

Acquisition Directorate

2 EITSD-Splunk Software

The period of performance associated with this procurement shall be for one (1) year from the date the software is received. The contract has a total estimated value of $692,661.60 us-ing fiscal year 2015 Procurement funds.

This procurement will include the following Splunk SIEM items:

(1) SE-GB-P, Splunk Enterprise Perpetual License (Peak Daily Volume: 300.00 GB)

(1) ES-GB-P, 1 Year of Splunk Enterprise Support

(1) APP-SESS-GB-P, Splunk App for Enterprise Security Perpetual, Non-Standard - (Peak

Daily Volume: 300.00 GB)

(2) APP-SESS-ES-GB-P, I Year of ES Enterprise Support

(1) APP-SVMW-100GB-P, Splunk App for VMware Perpetual, 100GB - (Peak Daily Volume: 100.00 GB)

(1) APP-SVMW-ESGB-P, 1 Year of Splunk App for VMware Enterprise Support

(6) PS-DEP-US-5, Splunk Professional Services Deployment (5 Days)

(1) EDU-ADMCERT-ONSITE, Splunk Admin Certification V6 Track, Onsite, Maximum 12 students

(2) EDU-ARCH-1, Splunk Architect series V6 Track, Architect lab not included, 1 student

4. IDENTIFICATION OF STATUTORY AUTHORITY:

FAR 13.501(a) Sole Source (including brand name) acquisitions. This justification uses the format at FAR 6.303-2, modified to reflect an acquisition under the authority of the test program for commercial items at 41 U.S.C. 1901.

5. DEMONSTRATION OF CONTRACTOR’S UNIQUE QUALIFICATIONS:

Splunk Enterprise Security Information and Event Management (SIEM) software is the only product that meets all of the Government’s technical and functional requirements. There are no other products on the market that provide EITSD with the capability to satisfy its critical Enterprise Logging Management requirements. In January of 2015, EITSD conducted a detailed analysis of alternatives of five (5) Enterprise Logging Management tools (LogRhythm, McAfee Nitro, IBM QRadar, HP Arcsight, and Splunk). Unlike the other tools reviewed, Splunk does not rely upon complex connectors or rule files to enforce a pre-defined data structure within a specific technology domain. Therefore, it does not require considerable EITSD engineering resources to collect data and extract value from that data, enabling a reduced level of effort for EITSD’s engineering resources. Splunk, out of the box, provided the most capability at the best value. As a result, Splunk was found to be the only solution that enabled EITSD to meet all of the mandatory DoDI 8500.2 log management

3 EITSD-Splunk Software requirements for Mission Assurance for Integrity and Availability, with little to no customizations.

Splunk is the only enterprise log management tool that is able to read data from virtually any source, such as network traffic, web servers, custom applications, application servers, hypervisors, and global positioning systems. It is the only platform that can ingest all data, provide rapid visualization, and provide a comprehensive analysis of data (both historical and real-time) from any machine data source. Splunk is also the only solution that provides log event and correlation management of all entries into a single integrated location, providing operational intelligence across all information technology (IT) data. It can index and store log data in a unique manner to allow faster access to all data that is not limited by log or event format. This is unique, as Splunk is able to work across multiple heterogeneous environments within EITSD. As a result of this capability, EITSD will be able to decommission three (3) software tools (Dell Quest Intrust, TIBCO LogLogic, and HP ArcSight), saving approximately $117,000 annually. Splunk’s integrated data analysis and correlation capability, as described above, replaces the need for these decentralized tools.

Splunk’s software solution is the only one that can maintain a history of every log sent, allowing EITSD system administrators to conduct after-the-fact investigations for historical analysis at any time. Splunk does this efficiently as its solution is not based on a relational database. It provides the ability to store and compress event and log data in its original compressed format and can support up to 3,000 messages per second. Therefore Splunk enables EITSD to meet compliance and archiving requirements while reducing the costs of hardware-based storage. Combined with the fact that Splunk is the only log management software that’s able to operate on standard commodity hardware and appliances, EITSD will be able to free-up 7.2 terabytes (TB) of storage space, as it will no longer require the use of ArcSight Logger (4TB), Proxy Backup (1TB), LogLOgic (2TB), and Intrust (200GB).

As highlighted above, the procurement and implementation of Splunk will provide EITSD with real-time integration and collection of logs and events from multiple sources, allowing rapid identification of security and performance issues from across the network. Splunk also provides the most cost effective solution for EITSD’s compliance with mandatory DoDI

8500.2 log management requirements for Mission Assurance for Integrity and Availability.

In summary, Splunk provides immediate cost and storage savings as it provides EITSD with a solution that does not require costly customizations, consolidates the combined capabilities of three (3) existing EITSD-managed tools, and allows EITSD to free-up a significant amount of storage space as it eliminates the use of four (4) log management storage services.

6. FEDBIZOPPS ANNOUNCEMENT/POTENTIAL SOURCES:

Exception 5.202(a)(4) applies to this requirement. The proposed contract action is expressly authorized or required by a statute to be made through another Government agency, including acquisitions from the Small Business Administration (SBA) using the authority of section 8(a) of the Small Business Act.

4 EITSD-Splunk Software

7. DETERMINATION OF FAIR AND REASONABLE COST:

In accordance with FAR Part 13.5, Test Program for Certain Commercial Items, the WHS Acquisition Directorate Contracting Officer will make a determination of fair and reasonable pricing, using the procedures in FAR13.106-3 to include comparison to an independent Government estimate and comparison of the proposed price with prices found reasonable on previous purchases.

8. DESCRIPTION OF MARKET RESEARCH:

In January of 2015, EITSD developed a business case analysis for an Enterprise Logging Management Platform. As a part of this business case, EITSD conducted an analysis of alter-natives for five (5) Logging and Event Management software tools. Tools evaluated included HP Arcsight, IBM QRadar, McAfee Nitro, LogRhythm, and Splunk. Tools were evaluated based on the following criteria:

• Provides EITSD with the ability to meet and maintain logged data for at a minimum of 1 year, in accordance with DODI 8500.2 regarding Mission Assurance Controls for Integri-ty and Availability.

• Provides EITSD with the ability for integrated monitoring and detection of insider threats on the network.

• Enables incident investigation times by searching all security-relevant data.

• Enables reduced application downtime and escalations by speeding problem diagnosis.

• Ability to monitor all security-relevant data in real time to maintain situational aware-ness.

• Provides complete visibility and analysis across all EITSD servers and network devices from a single centralized management console.

• Meets EITSD’s enterprise business objectives (business effectiveness, operational effi-ciency, improved customer satisfaction, enhancement of enterprise growth and maturity, low customization, and cost effective).

Based on the above criteria, Splunk was evaluated as the optimal enterprise log management solution, satisfying all of EITSD’s requirements with native out-the-box capabilities, reduc-ing the costs of engineering customizations and storage requirements. Specifically, unlike the other tools evaluated, Splunk provided extensive log collection capabilities across EITSD’s IT environment (highly scalable), the most intuitive log search capability, the most advanced dash boarding and analytics capability, built-in support for external threat intelligence feeds for both open source and commercial sources, the most adaptable architecture allowing de-velopment of various plug-ins for enhanced monitoring and analytics, and the most cost ef-fective solution compared against capabilities provided in the other four (4) tools.

EITSD also leveraged the results of a 2014 Gartner study of 15 SIEM tools. Based on the re-sults of this study, Splunk was evaluated as leader in the Gartner Magic Quadrant for SIEM tools. Splunk came out ahead in its ability to provide organizations with an advanced security intelligence platform, leveraging analytics to help detect both known and unknown advanced threats. The Gartner study reinforced EITSD’s market research and analysis of alternatives, 5 EITSD-Splunk Software resulting in Splunk being identified as the only solution able to meet EITSD’s Enterprise Logging Management requirements.

9. ANY OTHER SUPPORTING FACTS:

The Splunk SIEM solution is an approved Federal Information Security Management Act (FISMA) compliant reporting and alerting solution. Splunk is also compliant with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37 standards for the application of the Risk Management Framework to Federal Information Systems (also re-flected in DoDI 8510.01, Risk Management Framework for DoD Information Technology).

Splunk is also designed to enable the six-step continuous monitoring process steps identified in NIST SP 800-137, “Information Security Continuous Monitoring for Federal Information Systems and Organizations.”

10. LISTING OF INTERESTED SOURCES:

Splunk is proprietary software and can only be purchased via an authorized reseller.

Agreements are not listed on GSA Federal Supply Schedule. There are small business authorized resellers for Splunk software items in the commercial marketplace to satisfy Government technical requirements. A small business that is also an Alaskan Native Corporation (ANC), Nisga’a Data Systems, has been identified as an authorized reseller of Splunk software.

11. ACTIONS TAKEN TO REMOVE BARRIERS TO COMPETITION:

EITSD will continue to evaluate the market for software services and maintenance commercially available that will fulfill the Government’s unique need to provide search functionality for EITSD’s Non-classified Internet Protocol Router (NIPR) and Secret Internet Protocol Router (SIPR) Resource Domain. The Government intends to compete all follow-on requirements on a brand-name or equal basis.

12. CONTRACTING OFFICER CERTIFICATION:

I certify that this justification is accurate and complete to the best of my knowledge and belief.

Signature:

Florence Kasule Contracting Officer WHS-AD

Name and Title Organization

6 EITSD-Splunk Software

13. REQUIREMENTS CERTIFICATION:

I certify that the facts and representations under my cognizance which are included in this justification and which form a basis for this justification are complete and accurate.

Jerry Russell Division Chief Resource & Supplier Management EITSD

Name and Title Organization

14. AGENCY COMPETITION ADVOCATE APPROVAL:

I have reviewed this justification and approve it, as required by FAR 13.501(a)(2)(ii).

Wendy Schermerhorn Alternate Competition Advocate WHS-AD

Name and Title Organization