HSFLGL-16-Q-00527_BNO_JA_Redacted.pdf

405-146 (MRSD/PRO)

MEMORANDUM TO:

THROUGH:

FROM:

SUBJECT:

REFERENCE:

September 8, 2016

Chief, Specialized Service Branch

FLETC/PRO

Contracting Officer

FLETC/PRO

Chief, IT Infrastmcture Branch

F etfernl Law E11force111e11t Trai11i11g Ceuters U.S. Department of Homeland Secm·ity 1131 Chnrel Crossing Rond Glynco, Geol'gin 31524

Homeland Security

Cyber Security Operation� Center (CSOC)

FLETC/CSD

Justification and Approval (J & A) for Other than Full and Open Competition (Brand Name) for Purchase Requisition Number 16NET3 l 3 5 Carbon Black Protection & Incident Response

FAR 6.302�1, Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements (Brand Name)

Pursuant to the requirements of the Competition in Contracting Act (CICA), as implemented by FAR Subpait 6.3 and in accordance with the requirements of FAR 6.303,.1, the justification for the use of statutory authority under FAR Subpali 6.3 is justified by the following facts and rationale required under FAR 6.303-2 as follows:

(1) Agency and Contracting Activity. The Depaitment of Homeland Security (DHS), Federal Law Enforcement Training Centers, Procurement Division proposes to renew licensing, maintenance and supp6rt on the previously purchased Carbon Black Enterprise Incident Response and Carbon Black Enterprise Protection software, and continue ongoing implementation of the softwme.

(NOTE: Carbon Black has recently changed its name from Bit9.)

If www.flctc.gov

I

9/8/16

(2) Nature and/or description of the action being approved. The purpose of this procurement is to obtain annual licensing and maintenance support for referenced softwa1:e which the FLETC has previously purchased.

(3) Description of Supplies/Services. Annual licensing, maintenance a.nd support for Carbon Black Protection and Carbon Black Incident Response. The project is still in implementation stage, so ongoing professional services associated with the implementation are included. Services required are estimated at Five Days (40 Hours) for Protection suite for migrating to high enforcement on servers and endpoints and tuning, and one day (8 hours) for the implantation ofincident Response for tuning of the product and completion of deployment. The estimated value of this procurement is

(4) Identification of Statutory Authority Permitting Other than Full and Open Competition. The statutory authority pe1mitting other than full and open competition is 41 U.S.C. 253 (c)(l) implemented by the Federal Acquisition regulation (FAR) 6.302-1 entitled "Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements (Brand Name)."

(5) Demonstration that the Nature of the Acquisition Requires use of the Authority Cited. Carbon Black Protection and Carbon Black Incident Response software were procured in FY15 as patt of the President's Cyber Sprint initiative. Carbon Black Protection and Carbon Black Incident Response are not available under the mandatory-use DHS Continuous Diagnostics and Mitigation (CDM) program. The only application whitelisting product, similar to Carbon Black Protection, on the CDM BPA is McAfee Application Control, which does not requirements. The McAfee product does not provide MD5, SHAl and SHA2(56) hash, nor does it track an infinite history of file hashes that have existed in the environment. These features are needed to reconstruct events to check for an advanced, persistent threat and confi1m if one ever existed. There are no incident response products, similar to Carbon Black Incident Response, listed on the CDM BP A. The Carbon Black products purchased in FY15 meet requirements and are estimated to have a four year operational life. Implementation of the Carbon Black products is ongoing. The duplication of effort required by shifting to a new product every year is not practicable.

(6) Description ofEffotts Made to Ensure that Offers are Solicited from as Many Potential Sources as is Practicable. Carbon Black software licensing and suppmt are only available through Carbon Black authorized resellers. Authorized resellers will be solicited through the Government-wide point of entry at FedBizOpps.

(7) Dete1mination by the Contracting Officer that the Anticipated Cost to the Government will be Fair and Reasonable. Given that Carbon Black has multiple authorized resellers for these products, it is anticipated that two or more quotes will be received, establishing effective competition. In the absence of effective competition, other price analysis tools, such as comparison to catalog pdces ancl historical purchasing infmmation, will be used to evaluate pricing.

(8) Description of the Market Research. Mat·ket research was conducted against vendors identified on the CDM BPA as discussed in paragraph (5) above. Additionally, research was conducted focusing on significant mat·ket leaders for incident response and application whitelisting products.

The FLETC has existing product deployments from many of these vendors including Cisco

(Advanced Malware Protection for Endpoints), Fidelis (formally AccessData responder 1), and Guidance Software (EnCase Endpoint Security) and McAfee Application Control. Additionally, the FLETC takes advantage of DHS enterprise-wide deployments of other vendors within this space. The chosen solution, Carbon Black, met business requirements and provided defense in depth without duplicating existing technologies which were already deployed elsewhere in the environment. The solution is expected to last a minimum of 4 years.

(9) Any Other Facts Suppmting the Use of Other Than Full and Open Competition. None.

(10) A Listing of the Sources, if Any That Expressed, in Writing, an Interest in the Acquisition. No other sources expressed interest, in writing, in this acquisition.

(11) A Statement of the Actions, if Any, the Agency May Take to Remove or Overcome Any Ba11'iers ' to Competition Before Any Subsequent Acquisition for Supplies or Services Required. When the Carbon Black solution reaches end of life or no longer meets the FLETC's requirements, additional market research will be conducted for replacement Protection and incident response solution via Intemet research, vendor demonstrations, and review of technical publications to include maintenance and life cycle costs, migration costs, training costs, and other centrally managed configuration and management tools.

I certify that the data suppo1ting the recommended use of other than full and open competition is accurate and complete to the best of my knowledge and belief.

I certify this requirement meets the Government's minimum need and that the suppo1ting data, which fmms a basis for this justification, is complete and accurate.

Date

APPROVAL:

Date Chief, Specialized Services Branch

9/8/16