JFrog JEFO Redacted_Redacted.pdf

Attachment 4 U.S. Customs and Border Protection

Justification for Exception to Fair Opportunity (JEFO)

– RFO 16.507-6

March 2026

Date: 05/26/20206 PR Number: 20154295

1. Agency and Contracting Activity.

The Department of Homeland Security (DHS), U.S. Customs and Border Protection (CBP), Office of Information and Technology (OIT), Cyber Security Directorate (CSD) and the CBP Office of Acquisition, Information Technology Contracting Division (ITCD) prepared this brand name justification for exception to fair opportunity.

2. Nature and/or description of the action being approved.

CBP intends to solicit a requirement using brand-name specifications among holders of the NASA SEWP V multiple-award indefinite-delivery, indefinite-quantity contract for the procurement of JFrog Enterprise+ software licenses and annual maintenance. Pursuant to RFO 16.507-7, restricting consideration to an item peculiar to one manufacturer (e.g., a particular brand-name, product, or a feature of a product that is peculiar to one manufacturer) must be justified.

3. A description of the supplies or services required to meet the agency’s need (including the estimated value and the period of performance).

CBP proposes to award a firm fixed-price delivery order the renewal of JFrog Enterprise+ software licenses.

CSD, Cyber Security Engineering (CSE) in its goal to implement a state-of-the-art SecDevOps capability, continues to require the above JFrog Enterprise+ tool to provide a binary Artifactory repositor, Advanced Security with the XRay scanning tool, and an Application Firewall to ensure internet-based software is scanned prior to entering the software development environment within the CBP domain. JFrog also provides advanced application security (AppSec) code weakness detection, application firewall protection, Gitlab repository scanning, and AI Model scanning features allowing cybersecurity risk reporting and software code fixes for CBP customized software and binary software coming into CBP from the internet.

The software must be able to provide the following:

The minimum requirements to achieve the objectives of an on-premises repository, X-Ray scanning tool for the CI/CD pipeline, and an application firewall to verify ingress binary software coming from the internet includes:

1. Repository Manager:

An Enterprise-wide repository is required to house incoming binary software from the internet including Docker images. The repository must be compatible with an integrated Application Firewall to ensure internet ingress software packages are automatically scanned for malware prior to entering the CBP domain. The repository manager must allow for on-premises CBP domain installation and work in a high-availability Kubernetes environment and finally support automatic repository replication to ensure shared repositories are synchronized.

2. Repository Manager and AI:

The repository must allow for the storage, retrieval, and scanning of Artificial Intelligent models and supporting software.

3. Application Firewall:

An Application Firewall is required to facilitate scans of ingress binary software and AI models from the internet prior to the software entering a development environment within the CBP domain. The Application Firewall must fully integrate with the Repository Manager and provide automatic scans when internet-based software is downloaded from an external source.

4. Advanced Security:

The Repository, Firewall, and Scanning tools are required to be compatible and work to achieve Advanced Security. This includes data sharing, reporting, and executing on-demand scans of software packages. Advanced security identifies code weaknesses and recommends fixes when scans are triggered from either the IDE desktop or directly from the tool’s user interface.

5. Software Language and Package Type Support:

Due to the vast array and diversity of internet-based software packages, a requirement to support a large number of packages and software languages is needed for internet-supply chain scanning software.

6. Scan from Desktop within Developer’s Environment:

The ability for software developers to scan from their desktop within an Integrated Development Environment (IDE) is a key requirement to push application security practices to the left of the software development build cycle.

7. An On-Premise Solution which Offers Fast Scan Times and a local Software Resident Scanner must be installed on-premise to ensure fast scan times and to ensure software is kept within the agency’s domain.

8. Integrated Reporting Full report integration between the Repository, Firewall, and Scanner is a requirement to ensure Cyber Threats are understood and presented in a holistic manner

The estimated price of this procurement is .

The period of performance is from 09/30/2026-09/29/2027.

4. Identify the exception to fair opportunity and provide supporting rationale, including a demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the exception cited.

____X_____RFO 16.507-7. Brand-name justification for items peculiar to one manufacturer.

Rationale:

Only one source is capable of providing the supplies required as they are peculiar to one manufacturer, JFrog, Inc.

The marketplace for an Artifact Repository consists of two products: the JFrog Artifactory and the Nexus Sonatype. At the Repository level, both products are relatively equal in nature. The difference is that JFrog, in addition to providing the repository, also provides Advanced Security using the Xray product feature which scans for security vulnerabilities in binary software components, Docker Images, AI models and supporting software. JFrog provides a fully integrated, built-in application firewall component within Artifactory named Curation. The Sonatype Firewall is not integrated with the repository and does not offer integrated reporting.

Curation scans software coming in from the internet, including AI models, prior to saving the artifacts within the CBP domain. JFrog’s Advanced Security features offer the capability to scan both source code and binaries stored within the Repository and by software developers on their desktop.

Sonatype has a similar repository component named Nexus. Nexus does not provide a fully integrated application firewall scanner. In addition, the Nexus repository does not support AI model storage, nor does it have AI model security scanning capabilities. JFrog allows for download and application of patches that would be applied by CBP locally. Due to DHS OneNet Security guidelines this would not be a viable option since connecting to the internet would make CBP data vulnerable to security breaches; this is why a fully on-Premise repository solution is required.

The use of the JFrog Enterprise+ software will minimize server downtime and support high availability network configuration with a cluster of two of more Artifactory servers on the same local area network (LAN). By leveraging the HA (High Availability) configuration it ensures that if one server is down that the systems functions will continue by leveraging the other systems in the cluster.

Artifactory is the single tool that “talks” to all the different technologies, increasing productivity, reducing maintenance efforts and promoting automated integration between the different parts.

Designed from the ground up to fit into any development ecosystem, Artifactory manages any repository layout offering native-level support for all major package formats, including the platform on which the CBP production environment is based.

Multilayer analysis of containers, software artifacts, and AI models are possible for vulnerabilities, license compliance and quality assurance, and to continuously govern and audit all artifacts consumed and produced in the CI/CD pipeline. JFrog Xray performs artifact analysis for all major package formats across the CI/CD pipeline.

5. Determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

The Contracting Officer anticipates adequate price competition is available amongst the NASA SEWP V small business vendors to determine pricing as fair and reasonable. NASA SEWP V is a Best in Class, category management approved vehicle to acquire commercially available IT commodities to support DHS business units in accomplishing their assigned missions. The Contracting Officer will use various price analysis techniques to determine a fair and reasonable price, including a comparison of proposed prices received and a comparison to the Independent Government Cost Estimate.

6. Any other facts supporting the justification.

None.

7. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made.

CBP will continue to conduct market research to determine if the market has changed and if a better solution becomes available. Furthermore, as CBP moves to the cloud, additional market research is being conducted with various cloud and “software as a service providers” to determine the best configuration and path forward for CBP’s various systems and applications.

All models are still being researched and considered.

8. CBP will post this justification with the solicitation on the NASA SEWP V contract vendor portal pursuant to RFO 16.507-7(c)(1).

9. Technical/Requirements Personnel Certification:

Pursuant to RFO 16.507-6(d)(2)(ix), I certify that this requirement meets the Government’s minimum need and that the supporting data, which form a basis for the justification, are accurate and complete

Date

10. Contracting Officer Certification and Approval:

Pursuant to RFO 16.507-6(e)(1), I certify that this justification is accurate and complete to the best of my knowledge and belief and hereby determine that the circumstances for an exception to fair opportunity exist and legal review was obtained when required based on dollar value.

Mary W. Carson Contracting Officer Date

MARY W CARSON Digitally signed by MARY W CARSON Date: 2026.05.26 09:51:37 -04'00'