JA-25-DC3oE-0709_Trellix IDIQ_Final_Redacted FINAL.pdf

Contractor Program/Equipment: Trellix Endpoint Security System (ESS) Software Subscription

JUNE 2025

JUSTIFICATION REVIEW DOCUMENT

FAR Part 6 Justification and Approval for Other than Full and Open Competition

Program/Equipment: Software Engineering Center (SEC) for Department of the Army agencies

Authority: 10 United States Code 3204(a)(1) as implemented in Federal Acquisition Regulation 6.302-1(a)(2) Only one responsible source and no other supplies or services will satisfy agency requirements.

Prepared by:

l

Contracting Officer:

Technical:

Requirements:

Reviews: I have reviewed this justification and find it adequate to support other than full and open competition.

Program Manager:

Legal Counsel:

Advocate for Competition:

FAR Part 6 Justification and Approval for Other than Full and Open Competition

1. Requiring Activity: US. Army Communications-Electronics Command (CECOM) Software Engineering Center (SEC), 6585 Surveillance Loop, Aberdeen Proving Gound, Maryland 21005

2. Contracting Activity: Army Contracting Command-Aberdeen Proving Grounds, ATTN: Digital Capabilities Center of Excellence (DC3oE), 6472 Integrity Court, Building 4401, Aberdeen Proving Grounds MD 21005

3. Description of Action: Request approval to award a new noncompetitive five-year Firm-Fixed Price, Single Award Indefinite Delivery Indefinite Quantity (IDIQ) contract to Trellix Public Sector LLC, 1640 Boro PL., Suite 300, Mclean, VA 22102, CAGE: 7E4U5, for Trellix Endpoint Security System (ESS) software maintenance and platinum support for Army-wide ordering. The ordering period is 28 September 2025 through 27 September 2030. The applicable North American Industry Classification System (NAICS) code is 513210 – Software Publishers, with a size standard of $47 million. The year of funds will be Fiscal Year 25, the type of funds is Operation and Maintenance, Army (OMA).

4. Description of Supplies / Services: The requirement is for Army-wide software maintenance and platinum support for the Trellix (formerly McAfee) Endpoint Security System (ESS) software suite to ensure cybersecurity for the Department of the Army networks. This commercial off-the-shelf (COTS) brand-name software supports critical cybersecurity functions across the Army, including the United States Army, Combatant Commands, DoA agencies and Field Activities, and other Department of the Army (DoA) supported sites with a direct Secret Internet Protocol Router Network connection to the DoA Information Network (DoA Enterprise). The requirement includes support for existing Government-owned ESS software licenses for endpoints such as thick clients, thin clients, ultra-thin/zero clients, mobile clients, servers, and virtual clients on all classifications of networks (Secret or below for specified combat support agencies). The software provides capabilities such as:

- Agent control mechanism

- Agent Protection

- Modular Protection

- Intrusion Prevention

- Ports, Protocols, and Services Control and Management

- Intrusion Detection

- Application Wrapper

- Application Control

- File Protection

- Registry Protection

- Anti-Malware

- Anomaly Detection (e.g., behavioral)

- Audit Log Filtering and Reporting

- Non-Compliant Host Quarantine

- Reputation Services

- Endpoint Detection Response

Trellix ESS software supports facets of the DoA including United States Air Force, United States Marine Corps, United States Navy, and activities of the United States Army not under other contract coverage, Combatant Commands, DoA agencies and Field Activities, and the following combat support agencies: Defense Intelligence Agency, National Geospatial-Intelligence Agency, National Reconnaissance Office, National Media Exploitation Center, National Security Agency, as well as the Coast Guard, National Guard, Reserves, and any DoA-supported site with a direct Secret Internet Protocol Router Network connection to the Army Information Network, hereafter referred to as the “DoA Enterprise”. All DoA Enterprise-owned networks are covered by this agreement, regardless of the person operating the computing systems.

This acquisition is for the continued software maintenance and platinum support, which includes continuing access to Trellix updates, changes, patches, upgrades, associated documentation, vulnerability identification, and related information for maintaining and securing the Army’s global network. This includes classified and unclassified networks, data centers, and various communication services like voice, video, and satellite communication. These capabilities extend beyond physical devices to virtual clients and mobile electronic devices (excluding phones and tablets). Software maintenance and platinum support shall be provided to specified Army Enterprise endpoints on all classifications of networks, except for the above combat support agencies which are limited to support for computers attached to networks classified at Secret or below Army’s endpoints, defined as follows:

• Thick client- Network client running on a fully capable system, for example, local processing and storage capability; can operate independently if not connected to a network.

• Thin Client – Network client running on a minimally-capable system, for example, minimal local processing and storage capability; cannot operate independently if not connected to a network.

• Ultra-Thin, or Zero Client – Network client with no capability outside of network context.

• Mobile Client – Network client which moves frequently and connects at different points;

changing threat profiles, policies, and protection requirements; may connect directly to commercial systems/internet, then back to DoA Enterprise.

• Server – Responds to client requests; provides enterprise services.

• Virtual Client – Client running virtually on a host platform; no physical resources.

The Government requires an endpoint cybersecurity system that seamlessly integrates with existing DoD infrastructure. It must also comply with Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) and associated compliance frameworks across the DoD Information Network.

The Army’s cybersecurity strategy is based on a "defense-in-depth" approach and is rapidly transitioning to a Zero Trust Architecture (ZTA). In this model, no user, device, or application is inherently trusted, and every connection must be verified. Trellix's suite of products is crucial to this strategy because it provides a centralized, comprehensive, and adaptive security platform that addresses a wide range of threats at the endpoint level.

DISA, as the lead agency for the Department of Defense Information Network (DODIN), manages and enforces the use of these tools across the entire enterprise. The Trellix suite is primarily used to meet rigorous requirements outlined in documents such as Security Technical Implementation Guides (STIGs) and various operational orders (OPORDs).

Trellix Endpoint Security (ENS) Suite. This is the core of the Trellix solution for the Army. It's a single, integrated agent that provides multi-layered protection on endpoints like laptops, desktops, and servers.

Antivirus and Anti-Malware: This is the base layer of protection, using signature-based and behavioral analysis to detect and block known and unknown threats.

For an organization with millions of endpoints, this is a critical first line of defense against common attacks.

Host-Based Firewall: The Trellix host firewall is used to enforce strict network policies on individual devices. It ensures that only authorized connections are made to and from the DODIN, a "deny-by-default" approach that is a cornerstone of DISA's security posture.

Exploit Prevention: This component protects systems from zero-day exploits and vulnerabilities by monitoring and blocking common attack techniques used to compromise applications and operating systems.

Web and Device Control: DoA and DISA use this to manage and control the use of external devices like USB drives and to enforce policies on web browsing to prevent malware downloads and access to malicious sites.

Trellix ePolicy Orchestrator (ePO). For an organization of the DoA's scale, managing security across millions of endpoints is a monumental task. Trellix ePO is the central management console that makes this possible.

Centralized Policy Management: DISA and DoA components use ePO as a "single pane of glass" to deploy, configure, and enforce security policies across the entire network. This ensures consistent application of STIGs and other security mandates.

Asset Management and Compliance: ePO provides a comprehensive view of all managed endpoints, their security status, and their compliance with DoA requirements. This is critical for audits and for ensuring every device on the network is configured correctly and up to date.

Automated Updates: The ePO server automates the distribution of content updates (like new virus definitions) and software patches to all endpoints, a vital process for responding to new and evolving threats.

Trellix Endpoint Detection and Response (EDR). While traditional endpoint security focuses on prevention, EDR is designed for a Zero Trust world where a breach is assumed to be inevitable. Trellix's EDR solution is essential for the Army’s defensive cyber operations.

Continuous Monitoring and Visibility: EDR constantly monitors all activities on an endpoint, collecting telemetry data on processes, file changes, and network connections.

Threat Hunting: This data is fed into the Trellix platform, which uses (Artificial Intelligence) AI and machine learning to identify suspicious activity and anomalies that might indicate a sophisticated attack that bypassed other defenses. Army cyber analysts use these capabilities for proactive threat hunting.

Automated Response: When a threat is detected, the EDR solution can automatically act, such as isolating the compromised device from the network to prevent lateral movement of the threat.

Forensic Investigation: EDR provides the ability to perform deep forensic analysis on compromised endpoints, which is crucial for understanding the scope of an incident, identifying the root cause, and developing better defenses. Trellix's EDR has even achieved Impact Level 5 (IL5) High Provisional Authorization, certifying it for use in protecting mission-critical, unclassified data.

Trellix Email Security. Email remains a primary vector for cyberattacks, particularly phishing and zero-day threats. The DoA has specifically selected Trellix to protect its millions of email inboxes.

Zero-Day Network Defense: This program focuses on stopping attacks that exploit vulnerabilities before they are publicly known. Trellix's solution provides advanced protection against sophisticated phishing and malicious attachments.

Cloud and ZTA Adoption: Trellix's email security solution supports DISA's Zero Trust Architecture goals by providing a flexible and secure way to protect email in both on-premises and cloud environments, aligning with the DoA's cloud migration initiatives

The relationship between the Army and Trellix is a long-standing partnership built on the need for a robust, scalable, and centrally managed endpoint security solution. The Trellix software suite, with its focus on prevention, detection, and automated response, would not receive software updates, fixes, and pushes, which would expose the network to intrusions and cyber security attacks.

The DoA has standardized on the Trellix Endpoint Security platform. The ePolicy Orchestrator (ePO), Trellix’s centralized management console, provides a "single pane of glass" for managing, configuring, and reporting on endpoint security across the entire Army information network. This standardization is a critical operational and security requirement, not just a preference. Introducing an alternative solution would disrupt this enterprise-wide standard, leading to a fragmented security posture and serious interoperability issues. While resellers of the Trellix ESS exist, market research and analysis conducted showed awarding to the resellers through CHESS would result in the Government paying an unnecessary higher rate premium, reducing the funds available for other critical mission needs. This IDIQ is crucial for CECOM SEC to streamline the acquisition of Trellix products and services, significantly reducing administrative costs. By consolidating procurement efforts, it enables the Government to enhance transparency, achieve greater cost efficiency, ensure scalability, and secure rapid access to Trellix's capabilities with optimal purchasing power.

b. Alternatives:

c. Impact if Not Approved:

Failure to approve this justification would disrupt cybersecurity operations across the Army, leaving Army systems non-complaint with Joint Force Headquarter DODIN OPORD 8600 requirements for endpoint security and networks vulnerable to intrusions due to outdated software, unpatched vulnerabilities, and lack of support. This would result in significant security risks, non-compliance with DoA mandates, and potential mission failure, which cause substantial harm to national security.

Based on the critical need for enterprise-wide standardization, the deep integration with existing DoD infrastructure, and the non-negotiable requirement for DISA STIG compliance and authority to operate (ATO), Trellix is the only responsible source whose supplies and services will satisfy the agency’s requirements. The Trellix Endpoint Security software suite, and the Trellix brand specifically, is the only solution that can provide the necessary security, interoperability, and operational continuity without creating unacceptable security vulnerabilities and operational disruptions to the DoD's mission. The acquisition is therefore justified on a sole-source basis under the authority of FAR 6.302-1(a)(2).

1) Consequence of Non-Standardization: Implementing a different vendor's solution would require the deployment of a new, separate management console, creating a complex and inefficient dual-vendor environment. This would increase administrative overhead, complicate vulnerability management and compliance, and hinder the ability to respond to threats in a coordinated, timely manner. The DoA's cybersecurity strategy, as managed by the Defense Information Systems Agency (DISA), is predicated on the ability to enforce consistent security policies and receive real-time threat intelligence from a single, integrated platform. Only the Trellix suite, with its ePO backbone, can satisfy this enterprise-wide interoperability requirement, without having to re-engineer and overhaul the Air Force Central Command’s (AFCENTs) current cybersecurity infrastructure.

2) The DoA has invested substantial resources in the long-standing deployment and integration of Trellix products across millions of endpoints, including highly specialized and mission-critical systems. These systems are deeply integrated with the Trellix security agents and management infrastructure. Replacing this established architecture would necessitate a complete and costly "rip-and-replace" effort that would incur significant technical and operational risks.

a. Impact on Mission Readiness: A "rip-and-replace" would require the uninstallation of the Trellix agent from countless devices, many of which are in remote or deployed locations, and the installation and configuration of a new agent. This process would leave a significant portion of the DODIN unsecured for approximately 18-24 months, creating a dangerous security gap and placing critical missions at risk. While historically a standard migration to another system across the DoD is estimated to take 18-24 months. A five-year ordering period for the proposed IDIQ contract is essential to ensure continued compliance with established DoD DISA security standards and leverage our existing 15-year integration in Trellix ESS. A standardized deployment across the Department requires consistent endpoint configurations already validated and proven effective. Maintaining these established endpoint requirements, providing ongoing support, addressing evolving threats, and ensuring scalability necessitates a longer-term contract. Furthermore, the extensive training, operational procedures, and command-and-control frameworks built around the Trellix platform would be rendered obsolete, severely impacting the readiness of DoA cyber defense forces.

b. Cybersecurity Compliance and DISA Security Technical Implementation Guides (STIGs). DISA, as DoA’s combat support agency for information systems, has developed and maintains a comprehensive set of STIGs to secure all DoA information systems. These STIGs are a mandatory baseline for all DoA network devices and often contain specific, detailed configuration requirements that can only be met by the standardized and validated software. Unique STIG- Compliance: The Trellix Endpoint Security suite has been a key component of the DoA's STIG compliance posture for many years. It has undergone extensive testing, validation, and accreditation by DISA to ensure it meets the stringent security controls required by DoA. The existing Trellix software is the only brand that has been fully integrated into the STIG and compliance validation framework at an enterprise scale. An alternative solution would lack this accreditation, making it impossible to satisfy mandatory compliance requirements and pass security inspections without a significant and lengthy re-accreditation process, which may be 18-24 months based on historical standard migration to another system across the DoD and period of time required to select, integrate, test, and field the new system.

3) Critical Mission and Required Delivery Schedule. The acquisition of the Trellix Endpoint Security software is not a routine IT purchase; it is a critical, mission-essential requirement for the Department of the Army (DoA) agencies and the Department of the Army. The current security threat landscape, characterized by sophisticated and persistent cyberattacks from state-sponsored actors and other malicious entities, necessitates the continuous and uninterrupted protection of the Army Information Network. The required delivery schedule and lead-time for this software are not measured in weeks or months, but in immediate operational capability. Our network defense posture depends on the continuous and up-to-date functionality of the Trellix suite. The required delivery schedule is a constant, as new licenses, patches, and threat intelligence updates must be deployed as they become available to maintain network resilience and counter evolving threats. The lead-time is therefore zero; the need for this capability is constant and cannot be paused. A failure sole source in this procurement would force a full and open competition, introducing a significant and unacceptable delay in the acquisition process. This delay would result in a serious injury to the Government in the following ways:

a. Degradation of Cybersecurity Posture: A full competition would halt the flow of critical software updates, patches, and new licenses for the Trellix product suite.

This pause would leave a wide and growing gap in our defenses, making the Army cyber network vulnerable to known and emerging cyber threats. With millions of endpoints reliant on the Trellix platform, a delay would create a catastrophic security risk, potentially allowing adversaries to exploit vulnerabilities that have been patched on commercial networks. The risk of a successful, widespread cyberattack on the Army network is a direct and "serious injury" to national security.

b. Inability to Meet Mandated Compliance: The Defense Information Systems Agency (DISA) mandates the use of specific, accredited, and STIG-compliant software. The Trellix suite has been thoroughly vetted, tested, and is integrated into the DoA's compliance framework. A full and open competition would introduce a new vendor whose product is not accredited and has not been validated to meet the stringent STIG requirements. The lengthy process for a new vendor to achieve this level of accreditation would take months, if not years, leaving Army components in a state of non-compliance. This non-compliance is a serious injury, as it violates mandatory regulations and places the entire network at risk.

c. Disruption of Mission-Critical Operations: The Trellix software is embedded in countless commands, control, communications, computers, and intelligence

(C5ISR) systems. These systems are used in military operations worldwide, from strategic planning to tactical execution. Introducing an alternative product through a new procurement would necessitate a massive and disruptive "rip-and-replace" effort. The time and resources required to uninstall the existing software, deploy a new solution, retrain personnel, and re-integrate the new product would severely disrupt operational readiness. This disruption to mission-critical systems and the resulting impact on military operations constitutes a direct and undeniable serious injury.

d. Substantial Duplication of Cost: Pursuing a full and open competition and migrating to a new platform would require a new investment in infrastructure, training, and the replacement of all current licenses. The government has already made a significant, long-term investment in the Trellix ecosystem. This is a follow-on requirement for a continuing service. A change in vendors would result in substantial duplication of cost to the government, which may be 18-24 months, as we would be forced to abandon our current investment and restart from the ground up. This financial injury is a direct and foreseeable consequence of not limiting sources to the incumbent provider. To elaborate, a change in vendors would result in a substantial duplication of cost to the government, estimated at which is not expected to be recovered through competition. This estimate accounts for the costs of acquiring new licenses, ranging from per endpoint annually for a network of thousands, as well as personnel hours required for planning, agent replacement, training, and a full Risk Management Framework (RMF) accreditation process to obtain a new Authority to Operate. Furthermore, the transition would incur incalculable costs related to lost productivity, network downtime, and heightened security risk, requiring additional resources for mitigation. These costs are considered unavoidable and in addition to the current investment in the existing solution a competitive procurement should be pursued.

7. Efforts to Obtain Competition:

a. Effective competition: Market research was conducted from 12-15 August 2024 for the Requests for Information (RFIs) posted on CHESS (RFI number 504491), GSA eBuy (RFI number 1717738), and NASA SEWP (RFI number 320297).

responded to the NASA SEWP RFI. No vendors responded to the GSA eBuy RFI. These respondents are authorized resellers on CHESS. All responses confirmed that only Trellix can provide the required ESS maintenance and support.

Although the Government recognizes that authorized resellers exist, awarding this IDIQ is crucial for CECOM SEC to significantly reduce administrative costs by consolidating procurement efforts, enhancing transparency, achieving greater cost efficiency,

14. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable. Competition is expected on this requirement in order to determine reasonableness. However, if reasonableness is unable to be determined by competition, a price analysis, comparison to Independent Government Cost Estimate, comparison to historical prices, and/or comparison to commercial prices may be done. Additionally, certified cost or pricing data will not be required in accordance with FAR 15.403-1(b)(3), as a commercial item is being acquired.

15. Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Approval

Based on the foregoing justification, I hereby approve the procurement of the Trellix Endpoint Security System (ESS) Software Subscription on an other than full and open competition basis pursuant to the authority of Title 10 U.S.C. §3204(a)(1) as implemented in (FAR) 6.302-1(a)(2), Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirement.. The estimated value of the new contract is for a five-year, one one-year base period and four one-year options with a period of performance from 28 September 2025 to 27 September 2030.

The approval is subject to availability of funds, and provided that the supplies and/or services herein described have otherwise been authorized for this acquisition.