LSJA McAfee IPS.pdf

Controlled Unclassified Information (CUI) – SOURCE SELECTION INFORMATION

FAR 3.104

DEFENSE FINANCE AND ACCOUNTING SERVICE (DFAS)

Contract Services Directorate (CSD)

3990 E. Broad Street Bldg. 21, Room 2B029

Columbus, OH 43213 1152

Limited-Sources Justification Federal Acquisition Regulation (FAR) Subpart 8.4 – Federal Supply Schedules

Purchase Request#: NITYU21RV126

AUTHORITY: Section 201 of the Federal Property and Administrative Services Act of 1949 (40 U.S.C. 501)

REFERENCES:

• FAR 8.405-6 (b) – Items peculiar to one manufacturer. An item peculiar to one manufacturer can be a particular brand name, product, or a feature of a product, peculiar to one manufacturer. A brand name item, whether available on one or more schedule contracts, is an item peculiar to one manufacturer.

• DFARS 208.7402 – Departments and agencies shall fulfill requirements for commercial software and related services, such as software maintenance, in accordance with the DoD Enterprise Software Initiative (ESI) (see website at http://www.esi.mil/). ESI promotes the use of enterprise software agreements (ESAs) with contractors that allow DoD to obtain favorable terms and pricing for commercial software and related services. ESI does not dictate the products or services to be acquired.

1. Identification of the agency and the contracting activity.

a. Requiring Activity:

DFAS Information and Technology Infrastructure and Production Support

DFAS-ZTDAB

8899 East 56th Street Indianapolis, IN 46249-2801

b. Contracting Activity:

DFAS – Columbus

CSD-ZECAB

3990 East Broad Street Building 21, Room 2B036 Columbus, OH 43213-1152

2. Nature and/or description of the action being approved.

The purpose of this document is to obtain the necessary approvals for a limited source acquisition in accordance with FAR 8.405-6, Limited Sources. For this acquisition, “Limited Source” pertains to the restriction of competition to the brand name McAfee Intrusion Prevention Systems (IPS).

The acquisition strategy is to issue a Request for Quote (RFQ) through the Department of Defense (DoD) Enterprise Software Initiative (ESI) in accordance with Defense Federal Acquisition Regulation Supplement (DFARS) 208.7402.

3. A description of the supplies or services required to meet the agency’s needs (including the estimated value).

DFAS I&T Infrastructure & Production Support requires the renewal of software and hardware maintenance for the current McAfee Intrusion Prevention Systems (IPS). McAfee IPS protects DFAS systems from network attacks by selectively enforcing a policy at the network perimeter. DFAS network security uses HTTPS inspection to protect critical Internet-facing applications. Therefore, there is a requirement to decrypt and inspect HTTPS traffic and to send event data to the existing central forensics database and have active fail-over capability and power-off pass-through, which limits the risk of hardware or software failure.

Limited-Sources Justification Federal Acquisition Regulation (FAR) Subpart 8.4 – Federal Supply Schedules

Purchase Request#: NITYU21RV126

Controlled Unclassified Information (CUI) – SOURCE SELECTION INFORMATION

FAR 3.104

P a g e 2 | 4

The DFAS Computer Network Defense Service Provider (CNDSP) is required to demonstrate development of custom attack signatures in its Intrusion Prevention and Detection programs. The McAfee IPS solution interoperates with DFAS security event database and with the host-based security system. It is critical this equipment and software be covered by a maintenance contract to assure the equipment can be repaired / replaced if needed, and that updates, patches, and bug-fixes can be applied to the hardware and software. This maintenance agreement will also give DFAS access to the vendor’s technical support program for the installation, use, and troubleshooting of this equipment and software.

The period of performance for this acquisition is for a one (1) year term from 12/31/2020 – 12/30/2021. Option periods will be not included in the solicitation as this product has been determined to be “End of Life”.

The estimated value of this acquisition is . The estimated value is based on an Independent Government Cost Estimate (IGCE) developed through budgetary quotes received during market research.

The authority and supporting rationale (see 8.405-6(a)(1)(i) and (b)(1)) and, if applicable, a demonstration of the proposed contractor’s unique qualifications to provide the required supply or service.

The regulatory code permitting this limited source justification is 48 CFR § 308.405-6, as implemented by statutory authority FAR 8.405-6(b), Items peculiar to one manufacturer.

DFAS has purchased McAfee IPS appliances (Hardware/Software/Maintenance) via multiple contracts in FY08 through FY19.

In total, DFAS has invested over in the purchase and maintenance of the McAfee IPS and management tools to date, not including associated engineering and implementation costs. To replace all existing McAfee hardware and software would cost over . Additionally, there would be costs over associated with the re-engineering and implementation of the existing infrastructure and hardware to accommodate a new solution, as well as ongoing maintenance costs. Total replacement and maintenance costs for 5 years are estimated at over . Therefore, to move away from McAfee IPS would result in substantial costs to DFAS, which are not expected to be recovered through competition and new source selection process.

Considering the foregoing, the determination has been made that it is in DFAS’ best interest to leverage the current investment in McAfee and renew the annual maintenance, as opposed to competing for a new software product. The McAfee IPS (Intrushield) represents the most cost effective product to meeting the Government’s need, and ensure continuity of operations without interruption. Therefore, it is in the best interest of DFAS to procure the McAfee IPS annual renewal licenses as specified in this requirement.

A determination by the ordering activity contracting officer that the order represents the best value consistent with 8.404(d).

DFARS 208.7402 requires agencies to fulfill requirements for commercial software and related services in accordance with the DoD Enterprise Software Initiative (ESI) utilizing the acquisition procedures found in DFARS PGI 208.7403. Market research conducted via both open market and through ESI determined that the terms and conditions of the existing Enterprise Software Agreements (ESA’s) on ESI represent the best value to the Government at the lowest potential cost. Based on an RFQ issued against DoD ESI Contract Vehicles, and with an expectation of competition, it is anticipated the pricing will be fair and reasonable, as determined under the terms and conditions of the RFQ to be submitted to all DoD ESI vendors. Pursuant to DoD Class Deviation (CD) 2014- O0011- Determination of Fair and Reasonable Prices When Using Federal Supply Schedule Contracts, the Contracting Officer will be responsible for making a determination of price reasonableness in lieu of guidance found at FAR 8.404(d).

A description of the market research conducted among schedule holders and the results or a statement of the reason market research was not conducted.

Market research was conducted via the issuance of a Request for Information (RFI) for the purpose of seeking as many potential sources as possible. RFI 166112 was put out on NASA SEWP from 8/13/2020 to 8/26/2020; however no vendor responses were received. Although McAfee is the sole manufacturer and provider of the product, there are many distributors authorized through McAfee to resell McAfee licenses, maintenance and support offered through the ESI contract vehicle. Competition will be sought among all authorized resellers for the best possible pricing. Two (2) ESI sources were contacted via email for pricing and availability information. The following vendors responded with pricing and interest in pursuing the acquisition:

Purchase Request#: NITYU21RV126

Controlled Unclassified Information (CUI) – SOURCE SELECTION INFORMATION

FAR 3.104

P a g e 3 | 4

Based on market research findings, in accordance with DFARS 208.7402, an RFQ will be issued to authorized distributors through

ESI.

7. Any other facts supporting the justification.

In determining a fair and reasonable price, the Contracting Officer will review and compare the current offered pricing to historical pricing that was awarded on contract HQ0423-20-F-0019 to Carahsoft for a total amount of $467,040.32 along with reviewing the quotes obtained during market research.

8. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the restricted consideration before any subsequent acquisition for the supplies or services is made.

The McAfee IPS is a unique product designed to provide specific protection to the DFAS IT Network. To date, the Government has invested substantial resources (money and engineering) in the infrastructure that the product supports. To procure a different protection software will require re-engineering the infrastructure at a huge additional cost. This equipment is end of life and we will be decommissioning it throughout the year.

9. Evidence that any supporting data that is the responsibility of technical or requirements personnel (e.g., verifying the Government’s minimum needs or requirements or other rationale for limited sources) and which form a basis for the justification have been certified as complete and accurate by the technical or requirements personnel.

I hereby certify that this justification is made in good faith, that the supporting data and information are accurate and complete to the best of my knowledge and belief, and that I would not be making this request if it were feasible to fully compete this requirement. I further certify that this request is not the result of lack of advanced planning or a desire to expend funds while those funds are still available.

Technical Reviewer:

Name: _______ Title: __ Signature: ____

Requiring Activity/Program Management Office Certification:

Name: ____ _________ Title: Signature: _____

10. Contracting Officer’s Certification and Approval (FAR 8.405-6(d)):

I hereby certify that this justification is made in good faith, that the supporting data and information are accurate and complete to the best of my knowledge.

Printed Name:

Title: Contracting Officer Organization Code: DFAS/CSD-CO/ZECAB Signature: _____________________________

00'

'00'

-05'00'

Purchase Request#: NITYU21RV126

11. Review for Legal Sufficiency:

Printed Name: ________________ Signature: _________________

-05'00'