2024.03.14 JA Splunk_Redacted.pdf

CUI

SOURCE SELECTION INFORMATION – See FAR 2.101 and 3.104

CUI

SOURCE SELECTION INFORMATION – See FAR 2.101 and 3.104

LIMITED SOURCE JUSTIFICATION

THIS ACQUSITION IS BEING CONDUCTED UNDER THE AUTHORITY OF THE

MULTIPLE AWARD SCHEDULE PROGRAM

Splunk Zero Trust Architecture

HTC711-24-Q-D039

Control Number: 24-31

1. CONTRACTING ACTIVITY.

United States Transportation Command (USTRANSCOM) Directorate of Acquisition Information Technology (IT) Programs and Support Services Division 508 Scott Drive, Build 1900W, Scott AFB, IL 62225-5327

2. NATURE AND/OR DESCRIPTION OF THE ACTION BEING APPROVED.

The USTRANSCOM Command, Control, Communications, and Cyber Systems Directorate (TCJ6) requires an exception to fair opportunity for the procurement of Splunk software licenses. This acquisition supports USTRANSCOM’s Cloud, Development, Security, and operations (DevSecOps), IT Portfolio Optimization, Zero Trust, and Cyber Domain Mission Assurance and other related initiatives by providing access to log, event, and signal data and enabling customizable analytics to support cyber incident response and environment orchestration in an ever-changing cyber and IT environment.

The proposed action will award a firm-fixed price (FFP) task order to Carahsoft Technology Corporation using the competitively awarded Department of Defense Enterprise Software Initiative (DoD ESI) blanket purchase agreement (BPA) N66001-20- A-0022.

Controlled by: USTRANSCOM Controlled by: Directorate of Acquisition

CUI Category(ies): SSEL Limited Dissemination Control: FED ONLY

POC:

3. DESCRIPTION OF THE SUPPLIES OR SERVICES REQUIRED TO MEET THE

AGENCY’S NEEDS.

Splunk has been utilized across multiple USTRANSCOM environments since initial procurement in Fiscal Year (FY) 2014. This has been previously procured under contract HTC711-23-D-0059 and a limited sources justification was utilized. This software license and maintenance renewal is required to expand existing Splunk capabilities in order to directly support USTRANSCOM Cloud and Zero Trust initiatives. Through the life of this contract, the required Splunk enterprise licenses include maintenance support and updates to Splunk products to maintain functional infrastructure.

The estimated value of the acquisition is .

The anticipated period of performance is 31 March 2024 through 30 March 2025.

4. AUTHORITY AND SUPPORTING RATIONALE AND DEMONSTRATION OF

THE PROPOSED CONTRACTORS’ UNIQUE QUALIFICATIONS TO

PROVIDE THE REQUIRED SUPPLY OR SERVICE.

This is a limited sources justification in accordance with FAR 8.405-6(b) – Items peculiar to one manufacturer. Only one source, Splunk, is capable of providing the log aggregation and analysis service that is compatible with existing infrastructure and currently deployed analytics and orchestration.

Splunk licenses support the requirements of USTRANSCOM’s Cloud, DevSecOps, IT Portfolio Optimization, Zero Trust, Cyber Domain Mission Assurance and other initiatives by providing the log aggregation and analysis service that is compatible with existing infrastructure and currently deployed analytics and orchestration. The capability provides near real-time analysis and correlation of system/application log/event data from disparate sources to support incident detection/response, command staff situational awareness, zero trust orchestration, and environment visualization/analytics. Due to the design of the USTRANSCOM cybersecurity systems and IT infrastructure, and based on market research, Splunk licenses are the only products that will work in the current architecture.

The license renewal is critical to ensure all efforts on the development of the common information model (CIM) for USTRANSCOM can continue. If the license renewal would lapse, this would adversely impact multiple dependent efforts such as: zero trust analytics, automation/orchestration, and cyber domain mission assurance.

While the required capabilities are available from other commercial sources, Splunk is the only manufacturer along with its authorized resellers capable of providing the required licensing and interoperability with existing infrastructure, analytics, and orchestration. Similar products cannot be modified to meet the agency's needs.

Alternative solutions would require significant investment of resources for additional personnel, infrastructure, and applications to reconstruct existing cybersecurity and environmental capabilities.

This requirement is under the mandatory use DoD ESI website IAW DFARS 208.7402;

therefore, no actions can be taken to remove this restriction, and Carahsoft is the only authorized source available to provide the required Splunk licenses.

5. DETERMINATION BY THE ORDERING ACTIVITY CONTRACTING OFFICE

THAT ORDER PRESENTS THE BEST VALUE CONSISTENT WITH FAR

8.404(d).

Supplies offered on Carahsoft Technology Corporation’s BPA are listed at fixed prices, which the Department of the Navy’s Naval Information Warfare Center Pacific has determined to be fair and reasonable for the purpose of establishing the product and price list. The Navy’s determination does not relieve the ordering activity Contracting Officer from the responsibility of making a determination of fair and reasonable pricing for individual orders.

In accordance with FAR 8.404(d), the Contracting Officer will determine the order represents the best value using the proposal analysis techniques at FAR 15.404-1 to establish a fair and reasonable price, such as comparison of proposed prices to historical prices paid and published price lists.

6. DESCRIPTION OF THE MARKET RESEARCH CONDUCTED AMONG

SCHEDULE HOLDERS AND THE RESULTS OR A STATEMENT OF THE

REASON MARKET RESEARCH WAS NOT CONDUCTED.

In accordance with DFARS 208.7402, departments and agencies shall fulfill requirements for commercial software and related services, such as software maintenance, in accordance with the DoD ESI. DoD ESI promotes the use of enterprise software agreements with contractors to allow DoD to obtain favorable terms and pricing for commercial software and related services. DoD ESI does not dictate the products or services to be acquired.

The following solutions were identified as four alternative solutions for log aggregation and analysis: SolarWinds Loggly, Sumo Logic, LogDNA, and Elastic Stack.

Alternative solutions were independently evaluated against the following criteria:

capability, interoperability, and infrastructure/resource requirements. None of the aforementioned alternative solution proved capable of providing the interoperability with existing analytics and orchestration to support cybersecurity mission or Zero Trust /Cloud migration initiatives. Migration to an alternative solution would require capital investment across multiple environments [Non Secure Internet Protocol Router (NIPR)/

SECRET Internet Protocol Router (SIPR)/Cloud] to develop required analytics/orchestration, establish comparable infrastructure, and train system support and user capabilities.

7. ANY OTHER FACTS SUPPORTING THE JUSTIFICATION.

N/A

8. A STATEMENT OF THE ACTIONS, IF ANY, THE AGENCY MAY TAKE TO

REMOVE OR OVERCOME ANY BARRIERS THAT LED TO THE

RESTRICTED CONSIDERATION BEFORE ANY SUBSEQUENT

ACQUISITION FOR THE SUPPLIES OR SERVICES IS MADE.

USTRANSCOM and end user activities continue to research potential, alternate software solutions across the IT portfolio for innovations, reductions in cost, and increased competition. USTRANSCOM continues to explore feasibility, time, effort, and costs associated with migrating to new systems and using new software.

9. THE ORDERING ACTIVITY CONTRACTING OFFICER’S CERTIFICATION

THAT THE JUSTIFICATION IS ACCURATE AND COMPLETE TO THE BEST

OF THE CONTRACTING OFFICER’S KNOWLEDGE AND BELIEF.

I certify that the justification is accurate and complete to the best of my knowledge and belief.

CHAD S. LINDAUER

Contracting Officer

10. TECHNICAL OR REQUIREMENTS PERSONNEL CERTIFICATION

I certify that the supporting data, which form the basis for this justification, are complete and accurate.

Chief, CSSP Detect & Respond

11. WRITTEN DETERMINATION OF THE APPROVING OFFICIAL

IDENTIFYING THE CIRCUMSTANCE THAT APPLIES TO THIS LIMITED

SOURCE JUSTIFICATION.

Based on the above cited justification, I hereby determine the circumstance in FAR 8.405-6(b) applies to this limited source justification.

Competition Advocate