JA Exception Fair 26F1494 101926A0871 Recorded Future - R.pdf

JUSTIFICATION FOR EXCEPTION TO FAIR OPPORTUNITY

SECTION 1: IDENTIFICATION OF THE AGENCY AND THE CONTRACTING

ACTIVITY

Department of

State Contracting

Activity ☒ Acquisition Management

Requiring

Activity

Department of State (DoS), Bureau of Diplomatic Technology (DT), Enterprise Applications (EA), Office of Consular Systems & Technology

(CST)

SECTION 2: NATURE AND/OR DESCRIPTION OF THE ACTION BEING

APPROVED

Approval is requested to solicit and award a new Task Order under NASA SEWP using a Firm

Fixed Price (FFP) contract type. The Task Order will be subject to exception to fair opportunity limiting competition to authorized resellers of Recorded Future brand name software and/or services described in Section 3 of behalf of the Requiring Activity.

SECTION 3: DESCRIPTION OF SUPPLIES/SERVICES REQUIRED TO MEET THE

AGENCY’S NEEDS

Item Description Part Number Qty

1 Hosted one (1) year subscription license to the Threat Intelligence

Module for up to five (5) users. Upon purchase of this offering, Customer can also receive access to any number of the listed integrations with Recorded Future's pre-configured settings, and access to API functionality as described at https://recordedfuture.com/integrations/details.Recorded Future -

THREAT-INTELLIGENCE

THREATINTELLIGENCE 1

2 Additional one (1) named user license to the Threat Intelligence

Module. Requires purchase of the Threat Intelligence Module

(THREAT-INTELLIGENCE).Recorded Future - THREAT-USER

THREAT-USER 5

3 Hosted one (1) year subscription license to the Vulnerability

Intelligence Module for up to five (5) users. Upon purchase of this offering, Customer can also receive access to any number of the listed integrations with Recorded Future's pre-configured settings, and access to API functionality as described at

VULNINTELLIGENCE 1

https://recordedfuture.com/integrations/details.Recorded Future -

VULN-INTELLIGENCE

4 Additional one (1) named user license to the Vulnerability

Intelligence Module. Requires purchase of the Vulnerability

Intelligence Module (VULN-INTELLIGENCE).Recorded Future -

VULN-USER

VULN-USER 5

5 Recorded Future Analyst On Demand Credits. 1 Year TermSubject to the terms therein:

https://www.recordedfuture.com/services/catalogue. Except as listed, a scoping call shall be required for any

Intelligence Services engagements to determine number of Credits and timelines.Recorded Future -

AOD-CREDITS

AOD-CREDITS 5

6 Recorded Future Premium Success Plan with a Designated

Technical Account Manager. 1 Year Term* See Note A* Recorded

Future - SUCCESS-PREMIUM

SUCCESS-PREMIUM 1

The estimated value for the entire period of performance is .

SECTION 4: IDENTIFICATION OF THE EXCEPTION TO FAIR OPPORTUNITY

AND THE SUPPORTING RATIONALE

This acquisition is conducted pursuant to 41 U.S.C. 4103 and 4106 as implemented by FAR

16.507-6 and substantiated by the following:

☒ FAR 16.507-7 – Items peculiar to one manufacturer.

This procurement request is for the purchase of Recorded Future (RF). RF accelerates research, detection, triage actions, provides intelligence tippers and threat maps used for every CST threat hunt and has assisted to reduce Threat Hunt analysis time by approximately 60%. The product enriches multiple dashboards and critical to at-hoc reporting (e.g., Daily report, etc.). All external Internet Protocols (IP) and SOC alerting are automatically enriched in Splunk.

The CST automated IP Blocking process is dependent on RF cyber intelligence to determine what IPs are reported to the DT/Cyber Incident Response Team (CIRT). This process has reduced the Mean Time to Detect (MTTD) by 90% since the automated IP Block process was implemented. RF has been central to the rapid maturity of Threat Hunt and SOC operations and is the main source of cyber intelligence used to protect CST operations. RF is used by other

Department of State (DoS) (DT cloud security and Cyber Threat Analysis Division (CTAD) and other political and Military Affairs, Law Enforcement, and Cyberspace and Digital Policy organizations.

Market research included a review of Recorded Future technical documentation, GSA and

SEWP product listings, vendor capability statements, and publicly available product documentation. Specifically, the NASA SEWP Market Research Tool was used to perform a preliminary search using the criteria of “Recorded Future” as the Provider. There were 60 contractors with Recorded Future products on SEWP catalog, of which 49 were small businesses.

Then based on the initial query results, a sub-search by Recorded Future part numbers was initiated using seven (7) product samplings. The output showed between 8 to 10 small businesses with these products already on their SEWP catalog; the details are displayed below:

Thereafter and based on the overall market research findings, formal Request for Information

# 387961was published on the SEWP portal to 127 contract holders in Groups B, C, and D.

The bulleted list below shows the four (4) Contractor Holders who responded to the RFI along with their socio-economic classification:

• New Tech Solutions; Small Business

• Optiv Federal; Other than Small

• Software Information Resource Corp (SIRC); Woman-owned Small Business

• Standard Blazar, LLC; Small Business

The RFI results demonstrate at least three (3) small businesses can provide the needed

Recorded Future part numbers, therefore, this requirement should be set-aside for small business.

SECTION 5: DETERMINATION BY THE CONTRACTING OFFICER THAT THE

ANTICIPATED COST TO THE GOVERNMENT WILL BE FAIR AND

REASONABLE

The Contracting Officer will determine that the anticipated price to the Government is fair and reasonable by evaluating competitive quotes received from authorized Recorded Future (RF) resellers and comparing proposed pricing to the manufacturer's established federal contract price lists (e.g., NASA SEWP). Based on these mechanisms, the Contracting Officer will ensure that the final price of is fair and reasonable prior to award.

SECTION 6. STATEMENT OF THE ACTIONS, IF ANY, THE AGENCY MAY TAKE

TO REMOVE OR OVERCOME ANY BARRIERS THAT LED TO THE EXCEPTION

TO FAIR OPPORTUNITY BEFORE ANY SUBSEQUENT ACQUISITION FOR THE

SUPPLIES OR SERVICES IS MADE.

To help remove barriers that led to this exception for fair opportunity, DT/EA/CST will:

• Conduct periodic market research to identify RF accelerates research, detection, triage actions, and intelligence tippers used to identify threat hunt and apply risk mitigations.

• Evaluate future cyber intelligence capable of determining what IPs are reported to the

DT/Cyber Incident Response Team (CIRT).

• Reassess whether future cyber intelligence products can be used by other Department of

State (DoS) (DT cloud security and Cyber Threat Analysis Division (CTAD) and other political and Military Affairs, Law Enforcement, and Cyberspace and Digital Policy organizations.

• Evaluate whether future migration can be accomplished without substantial redevelopment of Government-owned detection content.

• Reassess the requirement before initiating any follow-on acquisition.

INR/TIO expects to obtain a technical data package or develop a performance specification that will support competition for future acquisitions of the same or similar items.