JA 22-0010_Redacted.pdf

J&A-22-0010

4. Statutory Authority Permitting Other Than Full and Open Competition

10 U.S.C. 2304 (c)(1), Federal Acquisition Regulation (FAR) 6.302-1: only one responsible source and no other supplies or services will satisfy agency requirements.

5. Rationale Justifying Use of Cited Statutory Authority

The P-8A aircraft is a commercial derivative aircraft based on the 737-800 ERX developed by The Boeing Company (Boeing) and purchased by the Government under the Low Rate Initial Production contract, N00019-09-C-0022. Boeing selected FortiGate (developed by FortiNet) as the firewall device for the P-8A Poseidon aircraft based on requirements derived from Department of Defense Instruction 8500.1 and the National Information Assurance Partnership approved products list. The Advanced Telecom Computing Architecture chassis architecture had already been selected and FortiNet was the only firewall vendor that had a product (the FortiGate appliance) in that form factor to support the P-8A. FortiNet is the developer of the FortiGate firewall technical support and services and the latest anti-virus and intrusion protection files, all of which require an active license subscription. The Government does not possess the technical data package required for the FortiGate firewall to allow for full and open competition of the software license.

Furthermore, competing and qualifying another firewall product would result in an unacceptable delay to fulfill agency requirements for P-8A cybersecurity. This delay would negatively impact the Maritime Patrol and Reconnaissance Aircraft (MPRA) programs ability to perform mission execution. Prior P-8A Original Equipment Manufacturer analysis identified a high technical risk to replace the current FortiGate product as it would require major platform re-architecture. It is anticipated it would take three or four years, at a minimum, to qualify and field another firewall product into the P-8A when considering the time for integration and testing, assuming the technical risk is resolved. This would leave the program with a significant gap in support coverage for updated anti-virus and intrusion protection files for a significant period of time.

This would be catastrophic to the cyber posture and unacceptable to the P-8A program, especially since this system allows updates on the aircraft much more often than the other systems that have to wait for new software deliveries. Without proper cybersecurity measures on the aircraft, the aircraft becomes vulnerable to cyber threats; thus, putting in jeopardy the ability to successfully execute MPRA missions.

6. Description of Efforts Made to Solicit Offers from as Many Offerors as Practicable

Although research through various on-line search engines can identify other sources for communications systems firewalls, FortiGate is the only approved system for the P-8A Poseidon Aircraft. FortiNet has authorized numerous businesses the right to resell the licenses, support and return material authorizations for the FortiGate firewall. Therefore, the support and subscription for FortiGate can only be purchased from an authorized federal reseller.

Market research was conducted and confirmed that there are multiple vendors authorized by FortiNet to distribute the FortiGate licenses required. Various internet sites (Federal Procurement Data System and Dynamic Small Business Search) and various search engines (Google, Yahoo &

J&A-22-0010

Bing) were queried for potential sources of the licenses to meet P-8A requirements. FortiNet was contacted and provided a list of authorized vendors capable of meeting the requirements.

In accordance with FAR 5.201, Request for Information/Sources Sought Notice (RFI/SSN) and synopsis were posted on the Federal Business Opportunities website on 1 October 2021 and 18 October 2021, respectively. The notices id competition, based upon the results of market research. Five (5) responses were received from the RFI/SSN, with two (2) companies currently on the FortiNet Federal Partner list provided by FortiNet and three (3) others that were not on the list. Of those not on the list, two (2) of those companies, and provided capability statements and also provided an expired authorized reseller certificate. The Contract Specialist responded to and stating that their company was not found on the FortiNet Federal Partners list of authorized Federal resellers of FortiNet FortiGate licenses and are unable to meet requirement. No additional response was received from and . The third company, Partner for each vendor, so they consolidated to streamline. They previously requested information on the systems, such as specifications, etc., which the Contract Specialist did not provide. They responded that without knowing more details about what is needed, they would not need to take the step to become a Partner. Two (2) e-mail responses were received as a result of the synopsis from and stating that they were interested in submitting a response. The one (1) company, is currently on the FortiNet Federal Partners list; however, the second company, , is not. The Contract Specialist responded to that their company was not found on the FortiNet Federal Partners list and that they are unable to meet the

7. Determination of Fair and Reasonable Cost

The Contracting Officer has determined the anticipated cost to the Government of the suppliers/services covered by this J&A will be fair and reasonable.

8. Actions to Remove Barriers to Future Competition

For reasons set forth in paragraph 5, NAVAIR has no plans to conduct a full and open competition for future procurements. If another potential source emerges, NAVAIR will assess whether a full and open competition for future requirements is feasible.

The original contract, N68335-17-D-0009, was competed as a limited competition between Because this effort is a follow-on for supplies and services previously awarded on a limited competitive basis, in accordance with DFARS PGI 206.304(a)(i), the prior J&A was provided to the approval authority for review. Approval of this J&A signifies the approval authority has made the determination required by DFARS PGI 206.304(a)(ii).