JA BN Red Hat Final_Redacted.pdf

OFFICE OF ACQUISITION MANAGEMENT

ICE Acquisition Manual 3016.505-90

ITEMS PARTICULAR TO ONE MANUFACTURER (BRAND-NAME)

WHEN PLACED UNDER AN INDEFINITE DELIVERY INDEFINITE QUANTITY (IDIQ) CONTRACT

FAR 16.505(a)(4) and 16.505(b)(2)(ii)

J&A-25-0159

1. Agency and Contracting Activity.

The Department of Homeland Security (DHS), U.S. Immigration and Customs Enforcement (ICE), Office of Acquisition Management (OAQ) proposes to award an Indefinite Delivery Indefinite Quantity (IDIQ) Delivery Order on behalf of the ICE/Office of Chief Information Officer (OCIO)/Systems Engineering Division (SED) resulting from a solicitation containing a brand-name specification.

2. Nature and/or description of the action being approved.

(a) Name of the ICE, DHS, or Multiple-Agency Multiple Award Contract that the delivery/task order or modification is being placed under National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) Women Owned Small Business (WOSB)

(b) This procurement will be open to competition among qualified SEWP V vendors within the Women Owned Small Business Social Economic categories. Authorized SEWP V resellers must be able to provide the required name brand.

(c) Identify contract type and whether new action or modification:

Firm Fixed Price, New Action under FAR 16.505

(d) Dollar amount for this justification:

(e) Title of the required brand-name manufacturer and products:

Brand Name Products: Red Hat Enterprise Linux (RHEL) Operating System (OS) and Red Hat Ansible Automation Platform (AAP) software entitlements Manufacturer: Red Hat, Inc.

3. Description of Supplies/Services.

ICE programs depend on customized applications to support a wide variety of mission related functions related to Homeland Security Investigations (HSI) investigations and enforcement operations, Enforcement Removal Operations (ERO) detention and deportation activities and Management and Administrative (M&A) functions that support the ICE mission. The ICE HSI, ERO and M&A programs have developed and utilize more than 1,600 Continuous Integration Continuous Delivery (CICD) pipelines which automate the deployment of infrastructure and applications, allowing the Agency to

ITEMS PARTICULAR TO ONE MANUFACTURER (BRAND-NAME)

WHEN PLACED UNDER AN INDEFINITE DELIVERY INDEFINITE QUANTITY (IDIQ) CONTRACT

than one contract, is an item specific to one manufacturer.

Rationale:

Market research was conducted out between 2/6/2025 and 5/15/2025. This research involved internet research of products from various software vendors. OCIO assessed competing products to RHEL such as Ubuntu, Debian, Kali, openSUSE, Oracle Linux, Rocky Linux, and Amazon Linux 2. These products are competing Linux distributions currently available in the Linux OS market space. The Government performed an analysis of each product’s ability to support and secure new and existing ICE applications and workloads in accordance with ICE policies for software and hardware in the ICE Cloud.

The specific requirements are listed in the next paragraph.

The Government also assessed Ansible Automation Platform competing products such as Puppet, Chef, GitHub, and Jenkins (which ICE already uses) that can be used to automate some aspects of application delivery but cannot (or will not) support all the requirements listed below in the “For Application Automation” requirements section.

ICE has implemented the RHEL and AAP tools in very specific fashion, resulting in each product having requirements that must be met for the products to be authorized for use and to function correctly in the ICE environment.

With Linux OS’, the software is typically built as a package, distributed through repositories, and managed on the end-user’s system through package managers. Each Linux distribution typically contains thousands of packages, many of which are required dependencies for other packages. The Linux distribution uses a package manager to install the package(s) corresponding to that distribution’s installation instructions.

Each Linux distribution uses a different package manager, which leads to compatibility issues with other Linux distributions. The tools needed to manage the operating system are unique to each product and would require application modifications to rewrite and redeploy, making them incompatible with the current infrastructure. For example, RHEL uses the Red Hat Package Manager (RPM), while Kali and Ubuntu use the Apt-Get package manager. These differences in packaging create incompatibilities in the usage of the Kali and Ubuntu OSs by ICE applications and utilities. This incompatibility extends to the application architecture, maintenance platforms, and support tools employed by ICE

OCIO.

For LINUX requirements ICE OCIO needs the product to,

• Support automated entitlement registration to an ICE managed distribution and management server. That server must be able to provide all relevant and necessary patches, repositories, security updates and fixes required by the

ITEMS PARTICULAR TO ONE MANUFACTURER (BRAND-NAME)

WHEN PLACED UNDER AN INDEFINITE DELIVERY INDEFINITE QUANTITY (IDIQ) CONTRACT

Government,

• Be able to provide confirmed product state side support for any issues related to their product(s),

• Have a FedRAMP High compliant certification,

• Be compatible with existing ICE implementations and systems and not result in system outages, integrity, or operational support issues,

• Support Defense Information Systems Agency (DISA) Security Technical

Implementation Guides (STIGs) compliance requirements,

• Support live kernel patching,

• Have a trusted software supply chain,

• Support SELinux, and the enforcement of access control policies for applications, files, and computing processes.

The Linux competitors listed above cannot meet the ICE Linux OS requirements listed.

Some can meet a single or several requirement(s), but they cannot meet all the requirements.

For Application Automation requirements ICE OCIO needs the product to,

• Support advanced post provisioning automation to multiple environment architectures such as containers, serverless and virtual compute,

• Provide confirmed stateside support for any issues related to their product,

• Be compatible with existing ICE implementations and systems and not result in system outages, integrity, or operations,

• Not use agents for targeting deployments or updates,

• Provide a console that displays a “single pane of glass” level of visibility to all operations being supported by the application,

• Provide an automation platform that natively supports High Availability (HA) configurations within cloud environments,

• Be an independent application, not a module or integration of a larger suite of tools,

• Utilize a human readable scripting language.

The chief competitors to Ansible Automation Platform are Puppet and Chef. There are other products such as GitHub, GitLab, and Jenkins but they do not have the necessary feature sets to support the ICE requirements listed above. Chef is no longer a viable option for ICE after announcing they would no longer support ICE or Customs & Border Patrol (CBP), which leaves Puppet. This product does not provide confirmed stateside support, and adoption is not feasible or financially possible for the Agency at this time. The Puppet implementation architecture requires complex coding and frequent updates to developed code which results in additional time-consuming tasks reducing the overall efficiency of the product and value of the investment.

ITEMS PARTICULAR TO ONE MANUFACTURER (BRAND-NAME)

WHEN PLACED UNDER AN INDEFINITE DELIVERY INDEFINITE QUANTITY (IDIQ) CONTRACT

As mentioned above, the market research indicates that while there are other Linux and Application Automation products available, the other products cannot support the requirements listed above. Using other Operating System and Automation Management software products could potentially result in inoperability, compatibility issues, and interface problems that would compromise the applications supporting ICE’s missions.

(a) The Red Hat, Inc. software products are currently the only ones compatible with the management infrastructure deployed at ICE. The ICE Cloud server management utility that supports our Red Hat implementation has been automated and interfaces with key infrastructure at Red Hat to provide software and support for product and licensing related issues.

Market research results indicate that although there are other Linux products available, they lack the features required by the Government and do not meet the needs of ICE OCIO. These products also cannot be modified to meet these needs. Furthermore, other competitors are unable to provide key technical support elements for hosted applications, such as secure operating systems, automated delivery, confirmed stateside support and integration of containerized infrastructure, as required by ICE OCIO.

ICE cannot tolerate outages or sustained performance issues of any magnitude related to these products, as they support critical law enforcement applications and activities, and the use of less secure operating systems could introduce unforeseeable security risks to these activities. Procuring an alternate product other than RHEL and AAP would require a complete redesign and/or replacement of the OS and other supporting products. It would also necessitate a redesign of all applications that run on the RHEL OS and a redesign and recoding of all automation and containerization scripts and pipelines.

There are many variables that would go into evaluating the cost for converting any application to run on a new OS platform. Converting involves numerous activities, most of them complex, time consuming and costly in the form of man-hours, subject matter expertise, and application developers. An application may need to be completely rewritten, application teams may need to learn a new language, interfaces may need to be redesigned, new code libraries may be required, new test plans, security, requirement reviews and other similar activities could be necessary in order to convert a single application.

The estimated cost for implementing this level of change for a single application is $2,202,496.00. The cost for converting 150 applications is $330,374,400. This cost does not include the 50 plus 3rd party applications also affected by this level of change. It also does not take into consideration the impact on ICE mission activities resulting from the changes to applications.

ITEMS PARTICULAR TO ONE MANUFACTURER (BRAND-NAME)

WHEN PLACED UNDER AN INDEFINITE DELIVERY INDEFINITE QUANTITY (IDIQ) CONTRACT

5. Determination by the contracting officer that the anticipated cost to the

Government will be fair and reasonable.

The contracting officer determines that the anticipated price(s) will be fair and reasonable based on adequate price competition. Multiple NASA SEWP contract holders provide this brand name software and are authorized resellers. The government has a reasonable expectation that at least 3 quotes will be received.

6. Any other facts supporting the justification. None

7. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made.

As ICE continues to be proactive in integration and modernization of its information systems, and as improvements are made to technology, ICE will continuously update its market research to determine if other competitors will offer the features needed to fulfill the requirement.

8. If the total dollar value of this action exceeds $30,000.00, OAQ intends to provide the justification and supporting documentation along with the solicitation to all (IDIQ) contract awardees under the NASA SEWP under the WOSB category in accordance with FAR 16.505(a)(4)(iii)(A).

9. Technical/Requirements Personnel Certification.

I certify that this requirement meets the Government’s minimum need and that the supporting data, which form a basis for the Brand-Name Justification, are accurate and complete.

10. Contracting Officer Certification.

I hereby certify that the Brand-Name Justification is accurate and complete to the best of my knowledge and belief.

ITEMS PARTICULAR TO ONE MANUFACTURER (BRAND-NAME)

WHEN PLACED UNDER AN INDEFINITE DELIVERY INDEFINITE QUANTITY (IDIQ) CONTRACT

11. Approval: