Justification and Approval Firmware_redacted.pdf

U.S. Department of Homeland Security Office of the Chief Procurement Officer

Justification and Approval for Other Than Full and Open Competition Version 3.4

1 | P ag e

J&A# FY24-039

JUSTIFICATION AND APPROVAL FOR OTHER THAN FULL AND OPEN

COMPETITION

(Authority 41 U.S.C. 3304(a)(1))

Pursuant to the requirements of the Competition in Contracting Act (CICA) as implemented by the Federal Acquisition Regulation (FAR) Subpart 6.3 and in accordance with the requirements of FAR 6.303-1, the justification for the use of the statutory authority under FAR Subpart 6.3 is justified by the following facts and rationale required under FAR 6.303-2 as follows:

1. Agency and Contracting Activity. The U.S. Department of Homeland Security, Office of

Procurement Operations (DHS/OPO) prepared this Justification and Approval for Other Than Full and Open Competition on behalf of the DHS Science and Technology Directorate (S&T).

2. Nature and/or Description of the Action being Approved.

DHS intends to procure research and development (R&D) services for novel firmware analysis methods on a sole source basis. This R&D requirement is expected to identify firmware components of information technology (IT) and operational technology (OT) used in various devices. This effort will also decompose firmware into various sub-components to identify open-source software (OSS) that will be reviewed and listed on a firmware bill of materials (FBOM) to determine the prevalence of OSS in various devices and system components.

(a) Nature of action. DHS intends to enter a sole source contract with a service-disabled veteran-owned small business concern.

(b) Name and address of the contractor.

NetRise, Inc.

1806 Ferdinand St.

Austin, TX 78702

(c) Contract type. The anticipated contract type is firm fixed price (FFP).

(d) Estimated total value (including options).

Period Total

Base Period 24 mo.

Total:

(e) Type of funding. Infrastructure Investment and Jobs Act (IIJA) R&D funding pursuant to Public Law 117–58, 135 STAT.

Justification and Approval for Other Than Full and Open Competition Version 3.4

2 | P ag e

(f) Year of funding. FY22.

(g) Solicitation number. 70RSAT24R00000010.

(h) DHS/S&T conducts research supporting security testing capabilities related to telecommunications equipment, industrial control systems, and open-source software that originates from the IIJA.

3. Description of Supplies/Services.

The scope of this requirement includes the analysis and decomposition of device firmware to identify dependencies amongst various OSS components. Once the analysis and decomposition steps are completed, a cross-correlated library of firmware, associated devices, and supporting OSS projects will be developed. The successful performance of this effort requires extensive expertise in firmware image analysis and identification. Analysis of firmware, while predominantly based on the vendor-provided or otherwise available software images, should allow for the possibility of firmware image capture from devices post-deployment.

The objective of this effort is to build a capability to analyze firmware images at scale with a horizontal and vertical lookup of what assets run software and firmware that calls on the same OSS. The developed library of cross-correlated software dependencies will be leveraged to execute firmware image analysis at scale and produce software bills of materials in Software Package Data Exchange (SPDX) format. In addition, it requires an API-centric solution for interoperability with other platforms. The successful completion of this project is an understanding of OSS prevalence that informs decisions on OSS prioritization and resource allocation to securing OSS.

4. Identification of Statutory Authority Permitting Other Than Full and Open

Competition.

The statutory authority permitting other than full and open competition is 41 U.S.C.

3304(a)(1) implemented by the FAR Subpart 6.302-1 entitled “Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements.”

5. Identification of Exception to the Buy American Statute

The Buy American statute does not apply to this procurement.

6. Demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the authority cited.

(a) The rationale for using the authority cited above is that only NetRise has been determined to be capable of satisfying the agency requirements described herein. Based on market research and the lack of responses to related agency R&D solicitations described in Section 7 below, the capacity to decompose firmware of operational technology to meet the government’s requirement currently rests solely with NetRise.

Justification and Approval for Other Than Full and Open Competition Version 3.4

3 | P ag e

(b) The agency has sought to utilize open competition for requirement pursuant to congressional mandate of PUBLIC LAW 117–58, 135 STAT. This included the establishment of two Economy Act inter-agency agreements, two Small Business Innovation Research (SBIR) awards, and seven Silicon Valley Innovation Program (SVIP) awards. However, after the letting of these contracts, the remaining scope of work as per this sole source remained outside the expertise of those entities. The unique capability held by NetRise is the ability to identify, decompose, and analyze firmware of operational technology at scale. No other organization, including the recently researched company System and Technology Research (STR), as well as 90+ other companies researched, have this capability currently.

(c) Further technology scouting and market research was performed by the program office by engagement at industry events, conferences, expos and similar, along with verbal presentations solicited across potential performers. However, only one reasonable source and no other supplies or services were deemed to satisfy agency requirements.

Other supplies and services were not identified as capable of modification to commercial off the shelf (COTS) nor government off the shelf (GOTS) solutions to the specific requirement of firmware identification, capture, and decomposition on post deployment IT and OT devices.

(d) Should this J&A not be approved, DHS/S&T will be unable to fulfill its congressional mandate pursuant to the IIJA. The decomposition of firmware is necessary for the complete development of the software library system that the other above-cited contracts will be developing and designing.

7. Description of Efforts Made to Ensure that Offers are Solicited from as Many Potential

Sources as is Practicable.

As outlined above in Section 6.a., SBIR solicitation topics AF203-CSO1 and AF211-CSO1 were released for open competition. No responses were received under the SBIR topic calls for this requirement. Under the SVIP solicitation 70RSAT21R00000006, open competition was conducted for this agency requirement and no responses addressing this requirement were received as well. Further, a notice of intent to sole source the requirement described herein was subsequently issued on the System for Award Management (SAM).

8. Determination by the Contracting Officer that the Anticipated Cost to the Government will be Fair and Reasonable.

The contracting officer determines that the anticipated price(s) will be fair and reasonable based on price analysis including comparison of the proposed pricing to the independent government cost estimate for this requirement and other related contracts and agreements for similar services. In addition, since the contracting officer considers NetRise’ services to meet the definition of commercial services, the contractor will be required to submit other than certified pricing data in accordance with FAR 15.403-4 to establish a fair and reasonable price for the proposed contract action.

Justification and Approval for Other Than Full and Open Competition Version 3.4

4 | P ag e

9. Description of Market Research.

A key component of this project and system will be the analysis, decomposition, and library building of firmware components of operational technology. While this is not an emerging space per se of technology development, little has been done to date and few entities exists with the expertise, capacity, or wherewithal, to perform such work. Initial market research was conducted in April 2023.

This effort seeks to conduct R&D involving very low technology readiness level, currently estimated at TRL-2 or TRL-3. As such, this is highly novel R&D and there exists little to no past performance specifically on this type of work across any company, research or educational institute, or government agency to date. Ergo, because this work is highly novel, little to no past performance exists for NetRise with the Federal government in systems such as SAM or otherwise to date for this scope of work.

Following the lack of responsive submissions under the SBIR and SVIP solicitations, further market research was conducted from May to June of 2023 by the program office through various engagements with industry representatives at industry events, conferences, and expos, along with verbal presentations solicited across potential performers. Based on this market research, along with other desk research performed by the program office, only one source, NetRise, can meet this requirement.

10. Any Other Facts Supporting the Use of Other Than Full and Open Competition.

The firmware analysis is part of an overall project and system seeking to develop an end-to-end open-source software image decomposition, data anonymization, and vulnerability identification project supporting DHS’s Cyber and Infrastructure Security Agency (CISA).

The scope of this project is unique, and spans IT (i.e., information processing software and hardware), OT (i.e., field devices, detectors, etc.), software (i.e., information processing programs and operating systems) and firmware (i.e., permanent, embedded programs and operating systems which presupposes software more fundamentally). Therefore, this requirement cannot be modified to enhance competition.

11. A Listing of the Sources, if Any That Expressed, in Writing, an Interest in the

Acquisition.

During market research and the program office’s request for verbal presentations from industry vendors, the sole source vendor, NetRise, was identified as the only source with the capability to meet this requirement. A briefing was held on September 25, 2023, with STR, however, based on the Q&A, as well as a review of their capabilities, it was determined that STR’s expertise does not currently have the capabilities to meet the entire scope of work needed for this requirement. Additionally, STR’s capability brief failed to demonstrate that STR’s firmware analysis techniques are non-destructive. Non-destructive

Justification and Approval for Other Than Full and Open Competition Version 3.4

5 | P ag e means of firmware analysis, like that which the sole source vendor NetRise possesses, is a mandatory condition for fulfilling this government requirement.

12. A Statement of the Actions, if Any, the Agency May Take to Remove or Overcome Any

Barriers to Competition Before Any Subsequent Acquisition for Supplies or Services Required.

DHS/S&T will continue to utilize open competition vehicles to attempt to satisfy its R&D requirements, as was attempted with this requirement. No subsequent acquisitions for this requirement are planned currently.

(Remainder of this page left blank intentionally)