Justification and Approval for Other than Full Competition - Stealthpath.pdf

DEPARTMENT OF THE ARMY

LITTLE ROCK DISTRICT, CORPS OF ENGINEERS

Post Office Box 867

LITTLE ROCK, ARKANSAS 72203-0867

REPLY TO

Contracting Division Control No. SWL-20-05

Justification and Approval for Other Than Full and Open Competition

1. Contracting Activity: U.S. Army Corps of Engineers, Southwestern Division, Little Rock District, Post Office Box 867, Little Rock, Arkansas 72203-0867

2. Description of Action: This is a new Firm-Fixed-Price contract for Stealthpath’s ZSuite Zero-Trust solution (software and support services) funded with Operations and Maintenance dollars.

3. Description of Supplies/Services: The Contractor shall provide software and configuration support for the implementation of Stealthpath’s ZSuite ecosystem to include ZAware a handheld network assessment and incident response solution and ZAlert a Continuous Behavioral Monitoring Service as well as consultation on its use consistent with Zero Trust principles outlined in their proprietary Zero Trust Essentials assessment guide. This assessment guide was piloted and has also been assessed by the USACE CIO in collaboration with US NETCOM. It is consistent with both Federal and Department of Defense standards but goes beyond and addresses the nuisances of critical infrastructure security not fully addressed by current standards.

The attached list outlines the requirement for 20 ZAware tablets for use in OT network assessments of critical infrastructure sites and 5 ZAlert installations, Stealthpath’s Intrusion Detection System (IDS) software and support services. National Institute of Standards and Technology (NIST) developed the Risk Management Framework (RMF), and RMF has since been mandated by the Department of Defense. In addition, Presidential Executive Order 14028, Improving the Nation’s Cybersecurity, requires the development of plans for the enablement of zero-trust principles. Stealthpath’s services bring together a unique Information Security Continuous Monitoring (ISCM) approach representing a critical piece of RMF as it allows for continuous monitoring and vulnerability management without any impact to operational networks and propels UCIC’s ability to define their zero-trust plan in accordance with the Presidential Executive Order in a timely manner.

The Stealthpath Behavioral Monitoring Solution is based upon the concept of migrating entirely towards only “whitelisted” permitted connections and conversations based upon authenticated and authorized actions. Consistent with the core of zero-trust, it authenticates the identification of each device based upon multi-factor behavioral traits and validates authorized behaviors explicitly, down to each unique connection, and the payload type moving across the connection.

- 2 -

The Operational Technology (OT) devices do not support as a rule the traditional IT solutions of multi-factor authentication, where the Stealthpath behavioral pattern monitoring provides logically and functionally the multi-factor concept for OT devices with limited security processing capabilities. This investment will allow for the implementation of a Zero Trust program for Civil Forks OT assets by combining Critical Infrastructure network assessment with ISCM of five critical infrastructure facilities and support the development of UCIC’s zero trust implementation plan and the development and enhancement of associated operational processes.

This is a time sensitive requirement this pilot program and must be completed by the end of FY2025. The government estimated value of this acquisition is $742,450.00.

4. Authority Cited: 10 U.S.C. § 2304(c)(1); FAR 6.302-1 -- Only one responsible source and no other supplies or services will satisfy agency requirements.

5. Reason for Authority Cited: UCIC-MCX is a first of its kind organization within USACE, and many of the requirements do not have any previous operational or acquisition history.

UCIC-MCX evaluated several vendor’s Intrusion Detection System (IDS) software in an Industrial Control Environment in the lab setting. During lab testing Stealthpath provided demonstrated characteristics unavailable in the other software applications tested:

a. Stealthpath is a passive solution that does not require an external connection to the internet. Additionally, the system is deployed on a completely air-gapped basis requiring no internet connection. Other vendors tested required a connection to the internet that made them unsuitable for application in a critical infrastructure environment.

b. The air-gapped deployment server performs STIG and SCAPSCAN check on all equipment and operating systems aligning to DISA standards as an automated part of deployment. System provides a Software Bill of Material for each build and cryptographically signs and continually checks all containers, providing a secured solution for critical infrastructure deployments.

c. Stealthpath is a behavioral based IDS and not a signature-based IDS. The technology is based on a whitelisting methodology using PCAP resolved attributes and user defined attributes to provide multi-factor authorization and authentication alerting at the conversation and connection.

d. Stealthpath provides a multi-factor behavioral attribute verification process for both authentication of devices and authorization of inter-device communication.

e. Stealthpath provides the capability for the export and analysis of an asset’s behavior history at the connection and conversation level of detail, a feature not available on other IDS solutions currently available on the market. (As defined in the Stealthpath taxonomy)

f. Stealthpath behavioral analysis is based on a novel database structure containing time series and graph databases allowing for novel inference in behavioral analysis. It’s data agnostic allowing for the capture of additional data types for use in attribute tagging and AI algorithms providing an advanced digital fingerprinting capability.

g. Stealthpath allows for the reconstruction of PCAP data for any time period within the user defined retention policy. Other solutions only capture and save PCAP data when an alert is triggered.

h. Stealthpath provides a connection and conversation behavior visualization dashboard, unlike other software solutions tested, that allows extended attributes to be applied to the device to make analysis more intuitive.

- 3 -

COPELAND.PHILLIP.L.1297530 Digitally signed by

COPELAND.PHILLIP.L.1297530689

Date: 2024.07.16 18:10:53 -05'00'

i. Stealthpath has demonstrated that it can export PCAP or enriched data to UCIC preferred toolsets for additional data consolidation and analysis.

Beyond the lab testing, Stealthpath performed a detail review of one of the hydropower dams utilizing their assessment framework and brought a framework that was unique and aligned to the security demands of protection requirements of an isolated critical infrastructure facility.

Mr. Mr. Phillip L. Copeland, Director, UCIC-MCX, National ISSM, has affirmed that Stealthpath IDS and perspective on zero trust principles in practice is unique and the only software appropriate for this requirement. In the SCADA environment a truly passive IDS solution is required. When managing critical infrastructures, network interference and external internet connections pose a severe risk due to the potential for catastrophic equipment damage and loss of life. Interoperability between manufacturers of these types of systems is not a standard within the industry. The proprietary nature of this equipment makes a description of relevant characteristics unfeasible.

6. Efforts to Obtain Competition: Only one responsible source and no other supplies or services will satisfy agency requirements.

7. Actions to Increase Competition: Not applicable. Only one responsible source and no other supplies or services will satisfy agency requirements.

8. Market Research: A technical evaluation of this requirement was conducted by Mr. Phillip L.

Copeland, Director, UCIC-MCX, National ISSM as certified below. Mr. Copeland has determined that there are no other brand name equivalent products that would meet the performance standards of this requirement.

9. Interested Sources: Stealthpath

10. Other Facts: No other pertinent facts.

11. Technical Certification: I certify that the supporting data under my cognizance which are included in the justification are accurate and complete to the best of my knowledge and belief.

Signature: Date:

Name and Title: Mr. Phillip L. Copeland, Director, UCIC-MCX, National ISSM

12. Requirements Certification: I certify that the supporting data under my cognizance which are included in the justification are accurate and complete to the best of my knowledge and belief.

- 4 -

PETERS.GILBERT.T. Digitally signed by PETERS.GILBERT.T.1231276439 1231276439 Date: 2024.07.17 09:22:29 -05'00'

Name and Title: Gilbert T. Peters, Physical Security Specialist

13. Fair and Reasonable Cost Determination: I hereby determine that the anticipated cost to the Government for this contract action will be fair and reasonable. Price will be evaluated based on government cost estimate. Certified cost and pricing data will not be requested.

Name and Title: Sarah Hagood, Contracting Officer

APPROVAL

14. Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Name and Title: Jonathan J. Sawrie, Contracting Officer