MicroFocus BNJ_Redacted.pdf

Small Purchase Brand Name Mandatory Justification for HP/MicroFocus Fortify

1. Identify the required supplies or services by keyword nomenclature and model or stock number, and quantity. Identify the proposed source.

The Brand Name Justification (BNJ) authorizes and approves the procurement of one year software support of HP/MicroFocus Fortify and HP/MicroFocus WebInspect licenses. The Digital Networks and Applications (DNA) Department uses HP/MicroFocus Fortify and HP/MicroFocus WebInspect as our primary developing, deploying and vulnerability analysis software tools.

The proposed acquisition is for the software support of both HP/MicroFocus Fortify licenses and HP/MicroFocus WebInspect Licenses. The total estimated price for this firm-fixed-price (FFP) procurement and the period of performance for the requirement is to align the licenses we currently own into one annual software maintenance contract.

2. What unique capabilities does the proposed contractor/manufacturer possess which make it the only one capable of satisfying this minimum requirement?

The brand name HP/MicroFocus Fortify software product is required to ensure compliance with the 2013 National Defense Authorization Act and continuation of services without any interruptions in the programs that are vital to NAVAIR/Fleet operations.

HP/MicroFocus Fortify software scans and evaluates developer source code, providing alternate solutions to avoid cyber security vulnerabilities. Integration of HP/MicroFocus Fortify into the software development life cycle facilitates the identification and repair of security defects. HP/MicroFocus Fortify software provides analytic remediation and management capabilities necessary to identify, remove, contain, and prevent security vulnerabilities in software.

HP/MicroFocus Fortify provides the automated capability to analyze hundreds of thousands of lines of code for security vulnerabilities in minutes rather than labor intensive manual methods. The program integrates with developer environments for real-time analysis of code and also provides feedback and suggests different methods to perform those functions using best practice and security techniques. Artifacts can be provided to security personnel for review, streamlining the implementation and accreditation process.

HP/MicroFocus WebInspect provides an automated scan of our applications in real time to determine runtime code vulnerabilities.

These tools are required to support Naval Air Systems Command (NAVAIR) DNA Department, in Patuxent River, MD. This software is used for critical Fleet and NAVAIR applications such as the Airworthiness Flight Clearance Process, the Justification & Approval Process (J&A), Command Workflow Automation Tool (CWAT), Engineering Change Proposal (ECP), and Test Management and Reporting Tool (TMRT).

HP/MicroFocus Fortify has been integrated into these software tools during the development phase to analyze Application Security issues early in the life cycle.

This acquisition uses a commercial item brand-name description to specify a particular brand-name product that is peculiar to one manufacturer. HP/MicroFocus is the sole manufacturer and owner of the HP/MicroFocus Fortify and HP/MicroFocus WebInspect product line. HP/MicroFocus Fortify and HP/MicroFocus WebInspect software is available via a GSA and open market resellers. The brand name requirement is based upon the urgent requirements to effectively manage security compliance.

Which of these capabilities are mandatory?

Automated static code analysis is a requirement of the Defense Information Security Agency’s (DISA) Security Technical Information Guide (STIG) for Application Development. DNA is mandated through Cyber Security policy to meet all DISA STIG requirements for achieving NETWARCOM Authority to Operation (ATO) for full application accreditation.

This software improves the quality and security of applications developed by the NAWCAD DNA Division. The use of automated vulnerability tools is mandated by the 2013 National Defense Authorization Act (NDAA), SEC. 933 “IMPROVEMENTS IN

ASSURANCE OF COMPUTER SOFTWARE PROCURED BY THE DEPARTMENT OF

DEFENSE”. The 2013 NDAA requires that baseline software assurance policy shall (1) require use of appropriate automated vulnerability analysis tools in computer software code during the entire lifecycle of a covered system, including during development, operational testing, operations and sustainment phases, and retirement; and (2) require covered systems to identify and prioritize security vulnerabilities and, based on risk, determine appropriate remediation strategies for such security vulnerabilities.

3. Was a market search or other informal survey conducted? Describe your search or survey?

Yes. The subject matter expert (SME) conducted market research by reviewing vendor websites, reading vendor whitepapers and attending conferences, seminars and webinars.

In accordance with (IAW) FAR 10.002, market research by technical representatives was conducted to accomplish research and analysis of the Government’s requirements, to determine availability and functionality required to meet the Government’s needs, and to obtain competitive market pricing available on Enterprise Software Initiative (ESI), General Service Administration (GSA), National Aeronautics and Space Administration Solutions for Enterprise-Wide Procurement (NASA SEWP), and other available contract avenues. Through market research, technical subject matter experts determined HP/MicroFocus Fortify software supported all the major source code languages in use by NAWCAD DNA HP/MicroFocus Fortify was the only software of its kind which automated over 66% of the manual security checks.

Market research determined that HP/MicroFocus Fortify and HP/MicroFocus WebInspect Software is not available through mandatory supply sources (i.e., ESI), as discussed at DFARS 208.7402. However, the product is available via a GSA and open market resellers.

4. What material evidence exists that the Government would be injured if the noncompetitive procurement is not made?

Without this product, NAWCAD will be at risk of non-compliance for Security mandates.

HP/MicroFocus Fortify and HP/MicroFocus WebInspect are the only Software that can meet this requirement of NAWCAD DNA without an unacceptable delay, and the use of this software results in substantial cost savings to the Government. Security compliance done through manual methods costs the government more than one million dollars annually in developer labor hours. For example, for each software release, a developer is required to comply with DISA STIGS. Each release requires over 120-160 man hours to develop, review, and comply with DISA STIGS, at an average cost of $85 per man hour, which is $13,600 per release. An average development team size is 3 developers, for a total cost of $40,800 per release. The average application will have between 8-10 releases per year, for a total average cost of security compliance of $408,000 annually.

Multiply this for approximately 4 software applications, for a total cost of $1,632,000. The use of HP/MicroFocus Fortify and HP/MicroFocus WebInspect significantly reduces the manual effort of application security compliance. HP/MicroFocus Fortify automated manual security checks, which reduced the number of developer man hours for every release. In an Agile development environment with more frequent releases, this reduction of manual checks is significant. HP/MicroFocus Fortify is the only software of its kind which is approved in the Department of the Navy Applications and Database Management System (DADMS). All software must be approved in DADMS prior to procurement and installation on developer desk tops or servers.

Provide the date by which the supplies or services must be delivered. How was this date determined?

Supplies or services must be delivered is October 01, 2023 which is determined by the existing maintenance contract end date. This is the date the HP/MicroFocus Fortify software support must be purchased to support the critical Fleet and NAVAIR applications.

5. What steps are being taken to foster competition in subsequent purchases for similar requirements? If none, why not?

We will continue to conduct market research for the best most compatible product that meets the requirements. We will attend conferences and seminars on this product and similar products in order to evaluate and compare products for applicability to these requirements. We will meet with vendors to understand the capabilities of their products how the products would fit into the current and planned architectures and the tools ability to meet defined requirements.

Through the use of competitive acquisition procedures, the contracting officer will make a best value determination. NAVAIR will seek additional discounts if the price of the order exceeds the maximum order threshold, in accordance with FAR 8.405-1(d). ln accordance with FAR 15.404-1(b), the PCO will utilize the following means to ensure fair and reasonable pricing is negotiated:

1. Adequate price competition

2. Comparison with published price list(s)

As indicated above, the Navy intends to compete this purchase among a number of authorized resellers and, as such, does not anticipate any barriers that preclude the Agency from meeting the requirements at FAR 8.405-1 and FAR 8.405-2.

Future procurements of HP/MicroFocus Fortify Software will be required as the NAWCAD DNA Business Process Management requirements continue to grow to meet customer requirements. The DNA Subject Matter Experts (SME) will continue their market research efforts to identify specific Application Security compliance software by attending information technology trade fairs and conferences and conducting research via the Internet to monitor the commercial marketplace for unique and innovative information technology solutions and promote future competition that is not limited to certain brand-name products where practical. Where brand-name products are required, the Navy will continue to promote competition amongst authorized resellers where practical.