J&A_FourInc_FBO.pdf

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

FAR Part 16.505(b)

1. Identification of the agency and the contracting activity:

The Office of Acquisition Management proposes to do a modification to an existing order with exception to fair opportunity for additional Nexpose IP scans and Consoles previously awarded under NASA SEWP Delivery Order # SAQMMA17F1936 on behalf of the Office of Cyber Monitoring and Operations (DS/CTS/CMO). The total estimated cost of this action is $1,119,490.98.

2. Nature and/or description of the action being approved.

Modification to SAQMMA17F1936 which was issued against NASA SEWP V contract number NNG15SC73B. This delivery order is a Firm Fixed Price delivery order.

3. A description of the supplies or services required to meet the Department’s needs.

Securing the Department’s networks depends on having a solid understanding of the vulnerabilities present therein. Each computer is assigned an IP address, each of which needs to be scanned with a vulnerability scanning software. The Department currently uses

Rapid7’s Nexpose scanner for that task. We currently have the ability to scan 170,000 IP addresses.

However, in the course of conducting network discovery scanning, Nexpose identified tens of thousands more IP addresses (approximately 25,000 more) than the old scanner the

Department used to be able to evaluate or even identify. In addition, as the Department moves to the cloud, the number of IPs on our network will expand dramatically. These remaining IP addresses need to be scanned, and the team performing the scans will need more centralized management systems (e.g. consoles as referred to throughout the rest of this document) that are required to collect the results of those scans.

As a result, DS/CTS/CMO is requesting to expand our Nexpose license 80,000 additional

IP addresses and 22 additional consoles, at an estimated initial cost of $477,947.38. These goods require that the quantity on the current contract be expanded to a total of 250,000

IPs and 25 consoles. Within the following year, an expansion to 300,000 IPs and 30 consoles is anticipated for a total estimated final cost of $1,119,490.98. This will allow

CMO to ensure that the entirety of the Department’s network is scanned on a regular basis, which will help confirm they are patched for critical vulnerabilities. This protects the

Department’s network from being compromised and data from potentially being exfiltrated.

4. Authority permitting a Fair Opportunity Exception and the supporting rationale.

This acquisition is conducted pursuant to 41 U.S.C. 4103 and 4106 as implemented by FAR

16.505(b)(2) and substantiated by the following:

☒ FAR 16.505(b)(2)(i)(C) – The order must be issued on a sole-source basis in the interest of economy and efficiency because it is a logical follow-on to an order already issued under the contract, provided that all awardees were given a fair opportunity to be considered for the original order.

Order # SAQMMA17F1936 was awarded on a brand-name only basis using Fair

Opportunity procedures in June 2017 under RFQ # SAQMMA17Q0211. It is in the government’s best interest to negotiate a sole source modification within the constraints of the of the original awarded order period of performance. This will result in the intended economies and efficiencies that were contemplated for the original RFQ award.

5. A determination by the Contracting Officer that the anticipated cost to the Government will be fair and reasonable.

The Contracting Officer determines that the anticipated price(s) will be fair and reasonable based on these products already being pre-negotiated through the NASA SEWP GWAC.

By signing the justification the Contracting Officer makes a determination that the price to the Government are expected to be fair and reasonable.

6. Any other facts supporting the justification.

Software licenses like vulnerability scanners are usually based on the number of IP addresses they can scan and the number of consoles that communicate scan results to end users. The greater the number of IP addresses and consoles, the greater expense the tool incurs because the tool is doing additional work.

The initial contract requirement of 170,000 IP addresses and 3 consoles was an in-good-faith, best guess effort estimate of the size of the Department’s network. These numbers were based on the performance of the previous vulnerability scanning tool. This tool indicated the size of the network was much smaller than currently understood to be true.

Because of the performance of the current vulnerability scanner, CMO now understands the network is far bigger than originally anticipated. It is also the expectation that the size will only grow as the Department moves to the cloud; however, due to the current license requirements, CMO is unable to scan the entirety of the network, which puts the network’s security in jeopardy and puts critical information and assets at risk of cyber threats.

Obtaining the additional IP addresses and consoles will allow CMO to resume scanning the entire network for critical vulnerabilities. This process allows DS and IRM to patch the vulnerabilities and make the network safer from outside threats.

7. Actions the agency May Take to Remove or Overcome Any Barriers to Increase

Fair Opportunity before any subsequent acquisitions for the supplies or services is made., CTS is already in the process of working to re-compete the vulnerability management solutions for the following reasons:

Due to anticipated growth;

Current contract last option to execute expires in 2020; and

Bureau-wide directive to move into a cloud-based, if available