Limited Source Justification For Limited Sources on The Federal Supply Schedule Program.pdf

SENSITIVE BUT UNCLASSIFIED

LIMITED SOURCES JUSTIFICATION FOR LIMITING SOURCES ON THE FEDERAL

SUPPLY SCHEDULE PROGRAM

FAR Part 8.4

1. Identification of the agency and the contracting activity:

The Department of State Office of Acquisition Management proposes to enter into a delivery order on a limited sources basis for a network alerting tool that discovers, tracks Department of State systems on behalf of Cyber Threat Analysis Division (CTAD) and notifies Technical Analysis and

Special Operations (TASO) analysts of risky and out-of-policy activities on Department owned perimeter Dedicated Internet (DIN) devices. The period of performance will initially be for a Base, followed by two (2) twelve-month option years.

2. Nature and/or description of the action being approved.

This continuation request to purchase services delivered by manufacturer, Expanse. Expanse partners with reseller Carahsoft Technology Corporation under GSA contract vehicle

(GS-35F-0119Y), this information can also be found on GSA Advantage.

3. A description of the supplies or services required to meet the Department’s needs.

The requirement is to provide cyber threat hunting mission capabilities on Department of State systems. The TASO branch has a critical requirement to collect information regarding Department-owned Dedicated Internet Network (DIN) connections at foreign and domestic locations for threat hunting purposes. As part of this effort, TASO has identified a lack of visibility into the

Department’s DIN infrastructure and requires this specific solution to allow further visibility into the

DIN infrastructure.

4. The authority and supporting rationale and, if applicable, a demonstration of the proposed contractor’s unique qualifications to provide the supply or services.

This acquisition is conducted under the authority of the Multiple-Award Schedule Program (41

U.S.C. 152(3), and 40 U.S.C. 501), as implemented by FAR 8.4 and substantiated by the following:

☒ FAR 8.405-6(a)(1)(i)(B) - Only one source is capable of providing the supplies or services required at the level of quality required because the supplies or services are unique or highly specialized. Carahsoft Technology Corp is the only approved reseller for Expanse brand products.

SENSITIVE BUT UNCLASSIFIED

Expanse was the only cybersecurity company identified that could deliver the threat hunting capabilities to meet CTAD mission requirements.

5. A determination by the ordering activity Contracting Officer that the order represents the best value consistent with FAR 8.404(d) and FAR 8.405-(d).

The Contracting Office determines that the anticipated sole source price will be fair and reasonable, as the quotation will be based on GSA FSS equivalent prices offered by the vendor under schedule.

Additionally, the Government has negotiated an additional discount from the contractor. By signing the justification the Contracting Officer makes a determination that the price to the Government are expected to be fair and reasonable.

6. A description of the market survey conducted and the results or a statement of the reasons a market survey was not conducted.

CTAD performed internet searches of cybersecurity companies capable of meeting its mission requirements. Additionally, CTAD analysts and leadership routinely attend cybersecurity forums and conferences sponsored by cybersecurity companies. Expanse was the only company identified that could meet CTAD mission requirements. The ability to accurately detect, monitor, and provide netflow data into and out of potentially internet-exposed Department systems on a large scale is only offered by Expanse.

7. Any other facts supporting the use of this justification.

CTS/CTI/CTAD/TASO has the need for a software tool that can remotely and continuously collect netflow data into and out of the Department’s DIN infrastructure and alert TASO upon detection of suspicious traffic flows. The product must be configurable to model DoS’s existing network perimeter rules, and send alerts when those constraints appear to be violated.

8. A statement of the actions, if any, the agency may take to remove or overcome any barriers to competition before any subsequent acquisition for the supplies or services required.

CTAD will monitor the cybersecurity industry for vendors capable of providing a competitive product that meets mission requirements.