FY24 Cyber Assessment Tool Automated__Brand Name_Redacted.pdf

MEMORANDUM TO THE FILE

Subj: USE OF OTHER THAN FULL AND OPEN COMPETITION FOR AN

ACQUISITION UNDER THE SIMPLIFIED ACQUISITION THRESHOLD

I. BACKGROUND:

1. FAR 13.106-1(b)(1)(i) states for purchases not exceeding the simplified acquisition threshold, Contracting Officers may solicit from one source if the Contracting Officer determines that the circumstances of the contract action deem only one source reasonably available (e.g., urgency, exclusive licensing agreements, brand-name or industrial mobilization).

2. As required by FAR 13.106-3(b)(3)(i), this memorandum explains the absence of competition for this acquisition, as only one source will be solicited for this requirement (or for a portion of the requirement) and the requirement is not expected to exceed the simplified acquisition threshold.

II. DESCRIPTION OF ITEM OR SERVICE:

The Marine Corps Tactical Systems Support Activity (MCTSSA) is seeking a comprehensive automated security control assessment tool that will enable MCTSSA to efficiently evaluate the security posture of command and control (C2) and weapon systems. The tool must support various security frameworks to include, but not limited to: NIST Cybersecurity Framework, NIST SP 800-53, Cyber Survivability Endorsement Implementation Guide (CSEIG) version 3.

The tool must also provide detailed insights and provide recommendations to enhance the cyber resiliency of the system under test.

MCTSSA seeks to acquire software tools that will increase the effectiveness of cyber assessments by automating adversarial actions that could target USMC programs of record. The tools must include custom integrations that allow operators to upload custom scripts without external oversight or approval in an air-gapped environment with no reliance on external connections.

The software tools must have the ability to:

1. Operate in an air-gapped environment with no reliance on external connections.

2. Create custom attack scripts without external oversight or approval.

3. Ability to import vulnerability scan data from Tenable.

4. Emulate Advanced Persistent Threat (APT) groups.

The software listed in Table 1 from Picus Security (Picus), the original equipment manufacturer (OEM), will be utilized by the MCTSSA Cyber Assessment Branch to increase the effectiveness of cyber assessments by automating adversarial actions that could target United States Marine

Corps (USMC) programs of record. The tools also include custom integrations that allow operators to upload custom scripts.

Table 1

Item Product Code Product Name Qty

1 PL-OnPrm-AG-T3 Air-gapped Platform | Maintenance support for air-gapped deployments

2 APV-Base Attack Path Validation Base | Reveals and validates high-risk attack paths to critical assets, limiting the number of hosts discovered during assessments to the maximum number of hosts licensed.

1,000

3 ASV-Base-T3 Attack Surface Validation | Cyber Asset Inventory for subscribed devices (includes integrations with AD, SCCM, Crowdstrike EDR,Tenable.sc and more coming) Up to 2500 assets

4 Bu-3+-T3

Complete Security Posture Bundle with Detection Analytics | Includes all attack modules (Network Infiltration, Email, Web Application, Endpoint, Data Exfiltration). Agents included: 10 simulation, 2 attacker.

The Picus products or equal listed in Table 1 are critical to emulating the tactics, techniques, and procedures of an advanced persistent cyber threat. These products take tasks that are time consuming and automates them so that the highly skilled cyber operators can spend more time on discovering novel vulnerabilities that may be missed without sufficient time to research them.

Specifically, the software tools will be deployed in an air-gapped environment with no connectivity to external resources required. The software will integrate updated threat intelligence from various feeds and will ingest cyber scan data from a variety of sources. The software will have custom integrations that allows operators to upload custom scripts that are not already part of the database.

III. THE DETERMINATION FOR USE OF OTHER THAN FULL AND OPEN

COMPETITION IS BASED ON THE FOLLOWING (select all that apply):

A. ___ ONLY ONE RESPONSIBLE SOURCE (select all that apply):

1. ___ RESTRICTIVE RIGHTS. The source has established proprietary rights, limited rights in data, patent rights, copyrights or secret processes in the item or service required.

2. ___ EXCLUSIVE LICENSING AGREEMENTS. The item or service is only available from the Original Equipment Manufacturer (OEM), or there is only one authorized distributor or technical representative for the OEM.

3. ___ OTHER REASONS.

B. X BRAND NAME. Item required must be a brand name product, or feature of a product, particular to one manufacturer.

MCTSSA tested several automated security control assessment tools and have determined that the software from Picus in Table 1 best fit MCTSSA’s needs.

MCTSSA also issued a Request for Information (RFI) and a Request for Quote (RFQ). The results did not yield solutions that would better fit MCTSSA’s needs. This is a brand name or equal requirement. Companies responding to future RFQs must state how their software will meet or exceed the Picus Software solution.

Picus disclosed that these items were only available through authorized resellers.

C. ___UNUSUAL AND COMPELLING URGENCY. The supplies or services are of such unusual and compelling urgency that the Government would be seriously injured unless the agency is permitted to limit the number of sources from which it solicits bids or proposals.

Urgent requirements are supplies or services that will result in a work stoppage or are mission critical and the routine processing time would result in injury to the Government. The determination that the procurement for the above item/service is an urgent and compelling requirement is based on the following:

1. Date on which the requirement was first identified:

2. Required delivery date/period of performance:

3. Explanation of why delivery/commencement of services by the date mentioned above is required:

4. If appropriate, include any additional pertinent information.

IV. CERTIFICATIONS/APPROVALS:

A. Technical / Requirements Certification: I certify that the facts and representation under my cognizance which are included in this justification are complete and accurate to the best of my knowledge and belief.

B. Certification/Approval. See FAR 13.501

Marlanea M. Kirkbride, Contracting Officer Marine Corps Tactical Systems Support Activity