J and A Redacted.pdf

OFFICE OF ACQUISITION MANAGEMENT

ICE Acquisition Manual 3016.507-90

ITEMS PARTICULAR TO ONE MANUFACTURER (BRAND-NAME)

WHEN PLACED UNDER AN INDEFINITE DELIVERY INDEFINITE QUANTITY (IDIQ) CONTRACT

RFO FAR 16.507-7

J&A-26-0176

This justification is in accordance with Federal Acquisition Regulation (FAR) 16.507-7 (Class Deviation 26-04, REV 10F

1).

1. Agency and Contracting Activity.

The Department of Homeland Security (DHS), U.S. Immigration and Customs Enforcement (ICE), Office of Acquisition Management (OAQ) proposes to award an Indefinite Delivery, Indefinite Quantity (IDIQ) delivery order on behalf of the ICE/ Office of Chief Information Officer (OCIO)/Systems Engineering Division (SED) resulting from a solicitation containing a brand-name specification.

2. Nature and/or description of the action being approved.

(a) Name of the ICE, DHS, or Multiple-Agency Multiple Award Contract that the delivery/task order or modification is being placed under: National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-Wide Acquisition Contract (GWAC)

(b) This procurement will be issued to all authorized resellers within the NASA SEWP V Women Owned Small Business (WOSB) Socio Economic category to acquire the brand name products.

(c) Contract Type: Firm-Fixed Price (FFP)

(d) Identify whether new action or modification to an existing action: New

(e) Dollar amount for this justification:

(f) Title of the required brand-name manufacturer and product: Red Hat, Inc.; Red Hat Enterprise Linux (RHEL) Operating System (OS) and Red Hat Ansible Automation Platform (AAP) software entitlements

(g) Type of Funding: Operations and Support

(h) Year of Funding: Multi-Year (Fiscal Years 2025- 2026)

1 FAR Class Deviation 26-04 REV 1 is implemented as a result of Revolutionary FAR Overhaul, referred to as RFO, following Executive Order 14275, Restoring Common Sense to Federal Procurement. All citations in this document follow applicable DHS RFO Deviations therefore are referred to as RFO.

ITEMS PARTICULAR TO ONE MANUFACTURER (BRAND-NAME)

(i) Solicitation Number: TBD

(j) Background information about the requirement:

To minimize the impact of security threats and vulnerabilities to ICE assets deployed to the ICE Cloud environment, the ICE OCIO mandated that all products, services and/or resources provisioned in or deployed to the ICE Cloud be compliant with both Federal Risk and Authorization Management Program (FedRAMP) and International Traffic in Arms Regulations (ITAR) to safeguard ICE and national security interests. This security policy is one of the baseline standards for any tools, resources, services or solutions being implemented in the ICE Cloud environment. ICE has standardized the use of RHEL for supporting Linux OS requirements. RHEL is a popular open-source operating system distribution, based on the Linux kernel. RHEL is known for its stability, security features, and long-term stateside support for enterprise business workloads. This operating system currently supports over 100applications in multiple environments (non-production, stage, FQT, and production) in the ICE Cloud and is deployed to over 1300 servers. RHEL is the only Linux OS which complies with both FedRAMP and ITAR regulations.

3. Description of Supplies/Services.

(a) ICE has a requirement for REHL Operating System (OS) and Red Hat Ansible Automation Platform (AAP) Software entitlements.

To continue utilizing the Red Hat products and remain compliant from security, legal, operational, and contractual perspectives, ICE requires the renewal of the annual software maintenance and support entitlements for both RHEL and AAP. These products support new and existing ICE mission essential applications for all ICE programs. Currently ICE has more than 150 application development teams that utilize over 1300 Linux servers across multiple environments, the Red Hat entitlements enable ICE administrators to manage:

• RHEL package management and repository tools,

• RHEL software resources (repositories, patches and bug fixes),

• Registration capabilities for servers and Linux based resources,

• Security and patch compliance for application servers,

• Deployment of updated Automated Machine Images (AMIs) that comply with ICE security and hardening policies and can be used by ICE Application Development Teams to deploy secure servers and resources.

ITEMS PARTICULAR TO ONE MANUFACTURER (BRAND-NAME)

(b) The period of performance will be 12 months.

(c) Performance duration and cost:

Period Time Price Total Base 12 mos.

4. Statutory Exception and Rationale.

Exception:

The specific exception for providing for brand-name awards under multiple award contracts is RFO FAR Subpart 16.507-7(a). An item peculiar to one manufacturer can be a particular brand-name, product, or a feature of a product peculiar to one manufacturer.

A brand-name item, even if available on more than one contract, is an item peculiar to one manufacturer. Brand-name specifications must not be used unless the particular brand-name, product, or feature is essential to the Government’s requirements and market research indicates other companies’ similar products, or products lacking the particular feature, do not meet, or cannot be modified to meet, the agency’s needs.

Rationale:

(a) Describe the Government’s requirement.

To minimize the impact of security threats and vulnerabilities to ICE assets deployed to the ICE Cloud environment, the ICE OICO mandated that all products, services and/or resources provisioned in or deployed to, the ICE Cloud, be compliant with both Federal Risk and Authorization Management Program (FedRAMP) and International Traffic in Arms Regulations (ITAR) to safeguard ICE and national security interests.

ICE has implemented the RHEL and AAP tools in the following fashions; For the RHEL Operating System (OS) ICE has deployed the Security-Enhanced Linux (SELinux) Kernal in “Enforcing Mode” which acts as an OS firewall for accessing programs, processes, files and system resources. Additionally, as part of its security baseline for Linux operating systems. ICE is also required to comply with the Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) which is a highly detailed cyber-hardening blueprint used to secure information technology assets. It serves as the official security standard for any hardware, software, or network infrastructure deployed to the ICE

ITEMS PARTICULAR TO ONE MANUFACTURER (BRAND-NAME)

environment(s). The DISA STIG in conjunction with the SELinux results in a very customized operating system configuration. For Ansible Automation Platform (AAP) this product also has its own DISA STIG configuration as well as a Center for Internet Security (CIS) Benchmarks configuration requirements. In addition to the DISA STIG and CIS requirements, AAP is also mandated to require all automated hosts (servers that are configured through an Ansible automation script) register exclusively with an on-premises Red Hat Satellite sever/secure proxy to block direct outbound internet traffic. The combination of the DISA STIG, the CIS benchmark and the FedRAMP configuration result in a more complex implementation configuration. to ensure compliance with FedRAMP, ITAR and NIST security configuration standards. Adherence to these configuration results is necessary to ensure the products are authorized for use and that they function correctly in the ICE environment.

For LINUX requirements ICE OCIO needs the product to:

• Support automated entitlement registration to an ICE managed distribution and management server. That server must be able to provide all relevant and necessary patches, repositories, security updates and fixes required by the Government,

• Be able to provide confirmed product state side support for any issues related to their product(s),

• Have a FedRAMP High compliant certification,

• Be compatible with existing ICE implementations and systems and not result in system outages, integrity, or operations.

(b) List the particular brand-name product, or feature and how it is essential to the Government’s requirements.

The Office of the Chief Information Officer (OCIO) requires Red Hat brand-name products and features to meet its essential enterprise Operating Systems needs within the ICE Cloud and is both FEDRAMP and ITAR security compliant. This security policy is one of the baseline standards for any tools, resources, services or solutions being implemented in the ICE Cloud environment. ICE has standardized the use of RHEL for supporting Linux OS requirements. RHEL is a popular open-source operating system distribution, based on the Linux kernel. RHEL is known for its stability, security features, and long-term stateside support for enterprise business workloads. This operating system currently supports over 100applications in multiple environments (non-production, stage, FQT and prod) in the ICE Cloud and is deployed to over 1300 servers.

ICE has also developed multiple (more than 1300) Continuous Integration Continuous

ITEMS PARTICULAR TO ONE MANUFACTURER (BRAND-NAME)

Delivery (CICD) Pipelines which automate the deployment of infrastructure and applications enabling the Agency to deploy resources quickly and consistently to any of the ICE Cloud environments. These pipelines use the Red Hat Ansible Automation Platform (AAP) to support this integration and delivery. These two products provide ICE the basis for implementing and maintaining secure and compliant applications in the ICE Cloud. Red Hat software ensures timely security updates, and reliable operation across the ICE Cloud environments, minimizing downtime and supporting OCIO’s mission-critical activities.

(c) Describe the recent market research that was conducted to support the brand-name requirement. Include the dates the market research was conducted.

The Government researched several NASA SEWP V vendors to solicit market research pricing and availability. Of the three vendors that were solicited, one responded with pricing and availability of the products required by the Government. The information in that response was used to generate the pricing and availability of the products. Market Research was successfully completed 7/6/2026.

(d) Identify whether market research indicates that other companies’ similar products meet the agency’s needs, or whether they lack the particular feature(s) identified above.

For Red Hat Licensed Products, the government researched other products. This research involved internet research of products from various software vendors. OCIO assessed competing products of RHEL such as Ubuntu, Debian, Kali, openSUSE, Oracle Linux, Rocky Linux, and Amazon Linux 2. The Government performed an analysis of each product’s ability to support and secure new and existing ICE applications and workloads in accordance with ICE policies for software and hardware in the ICE Cloud. The specific requirements are listed in section (e) of the justification.

The Government also assessed Ansible Automation Platform competing products such as Puppet, Chef, GitHub, and Jenkins (which ICE already uses) that can be used to automate some aspects of application delivery but cannot (or will not) support all the requirements listed below in the section (e).

(e) Identify whether market research indicates that other companies’ similar products, or products lacking the particular feature cannot be modified to meet the agency’s needs

The market research indicates that while there are other Linux and Application Automation products available, RHEL competitors like Ubuntu, Debian, Kali, openSUSE, Oracle Linux, Rocky Linux, and Amazon Linux 2 cannot support the requirements listed below.

Additionally, the AAP competitors like SaltProject (formerly SaltStack, Puppet and Chef cannot support the requirements listed below:

• Support advanced post provisioning automation to multiple environment

ITEMS PARTICULAR TO ONE MANUFACTURER (BRAND-NAME)

architectures such as containers, serverless and virtual compute,

• Provide confirmed stateside support for any issues related to their product,

• Be compatible with existing ICE implementations and systems and not result in system outages, integrity, or operations,

• Not use agents for targeting deployments or updates,

• Provide a console that displays a “single pane of glass” level of visibility to all operations being supported by the application,

• Provide an automation platform that natively supports High Availability (HA) configurations within cloud environments,

• Be an independent application, not a module or integration of a larger suite of tools,

• Utilize a human readable scripting language.

The chief competitors to Ansible Automation Platform are Puppet and Chef. There are other products such as GitHub, GitLab, and Jenkins but these products, while incorporating the functionality to automatically kick off a script and/or provide continuous integration/continuous delivery capabilities, are not designed to handle the post provisioning and configuration of software. Using GitHub or GitLab or Jenkins would result in code that includes raw SSH commands which violates ICE coding practices and lacks Ansible’s safety idempotency and error handling. Additionally, they do not support the configurations required to support the requirements listed above. Chef is no longer a viable option for ICE after announcing they would no longer support ICE or Customs & Border Patrol (CBP), which leaves Puppet. This product does not provide confirmed stateside support, and adoption is not feasible or financially possible for the Agency at this time. The Puppet implementation architecture requires complex coding and frequent updates to developed code which results in additional time-consuming tasks reducing the overall efficiency of the product and value of the investment.

Using other Operating System and Automation Management software products could potentially result in inoperability, compatibility issues, and interface problems that would compromise the applications supporting ICE’s missions. Competitors’ products cannot be modified to meet ICE’s needs.

5. Determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

Multiple NASA SEWP V, WOSB vendors, provide brand name products.

The Government has a reasonable expectation that at least two quotes will be received so the contracting officer will determine that price(s) are fair and reasonable based on adequate price competition. The SEWP V contract achieves fair opportunity and competitive pricing by allowing all eligible contract holders to respond to solicitation. Additionally, prices have been determined fair and reasonable at the NASA SEWP V contract level.

ITEMS PARTICULAR TO ONE MANUFACTURER (BRAND-NAME)

6. Any other facts supporting the justification. None

7. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for supplies or services is made.

As ICE continues to be proactive in integration and modernization of its information systems, and as improvements are made to technology, ICE will continuously update its market research to determine if other competitors will offer the features needed to fulfill the requirement.

8. OAQ intends to:

☐ Post the justification and supporting documentation on the agency website used to solicit offers for orders under the contract in accordance with RFO FAR 16.507-7 (c)(1)(i);

☒ Provide the justification and supporting documentation along with the solicitation to all (IDIQ) contract awardees under the NASA SEWP V GWAC, WOSB socio-economic category, in accordance with RFO FAR 16.507-7(c)(1)(ii).

ITEMS PARTICULAR TO ONE MANUFACTURER (BRAND-NAME)

9. Technical/Requirements Personnel Certification.

I certify that this requirement meets the Government’s minimum need and that the supporting data, which form a basis for the Brand-Name Justification, are accurate and complete.

Technical Representative/COR Date

10. Contracting Officer Certification.

I hereby certify that the Brand-Name Justification is accurate and complete to the best of my knowledge and belief.

Contracting Officer Date

11. Approval:

Date

Competition Advocate & Head of Contracting Activity