15T0213_FBO.pdf

QAG‐CX‐XXXX Rev B

12 Feb 2013

Enclosure 1

NONCOMPETITIVE PROCUREMENT JUSTIFICATION

(Simplified Acquisition Procedures (SAPs) Micropurchase Threshold to $150K)

The service or product(s) listed on requisition(s) below is/are precluded from competition for reasons indicated below.

There are no suitable substitutes available.

Restricted to the following source. Provide original manufacturer’s name. (If a sole source manufacturer distributes via dealers, ALSO provide dealer information.)

Manufacturer: Core Security, Boston MA Manufacturer’s Dealer/Rep: See Quote Attached

Description of the product or services required, the estimated cost, and required delivery date (products) or Period of Performance (services). The Government’s requirement is to purchase Core Impact

Qty of 01 - Estimated U/P: $ Required delivery date

Specific characteristics of the material or service that limit the availability to a sole source (unique features; function of the item;

unique capabilities; facilities or special equipment; etc.). Describe in detail why only this suggested source can furnish the requirements to the exclusion of other sources. Core Security, Inc. is the original software developer and the only source that sells this specific configuration that can be utilized for multi-vector penetration testing and vulnerability management. No other vender provides the following capabilities in a single package:

1. Ability to prioritize vulnerabilities coming from a large number of assets deployed as part of

2. Importing Tenable Nessus vulnerability data

3. Importing Metasploit vulnerability data

4. Prioritize vulnerabilities with exploit matching and attack paths

5. Validate prioritized exploits in an automated fashion (web and network)

6. Provide multi-vector Penetration Testing ability on existing and developmental programs

7. Provide automated vulnerability remediation capabilities

8. Provide outsider threat testing which protects the systems from potential hacks and attacks which could render the DoD system useless.

9. Allows plug in software that is already owned by the DoD thus enhancing the protective measure and maintain compliance.

This specific software is required to perform multi-vector Penetration Testing, vulnerability checks, patching, patch validation, and maintain compliance in accordance with DoD mandate.

This software will be utilized within a collection of DoD mandated cybersecurity and cyber-engineering tools/services as part of a which is utilized for the research, development, certification and accreditation, and sustainment of .

For non-personal services indicate the highly technical or specialized expertise required. Describe the contractor’s workforce, QAG‐CX‐XXXX Rev B

12 Feb 2013

Enclosure 1 methods, materials or unique management or operating systems. If it is unique because of knowledge of key individuals, what is the basis of the knowledge that another firm could not obtain the same or equivalent expertise? Could another firm obtain the necessary highly specialized experience or technical capability in time to perform the requirement?

The required product(s) or service(s) represent(s) the minimum requirements of the Government and no other product(s) or service(s) can satisfy the need.

FILL IN ALL APPLICABLE BLANKS BELOW

The product(s) must be compatible in all aspects (form, fit, and function) with existing systems presently installed. Describe the equipment you have now and how the new item/service must coordinate, connect, or interface with the existing system.

Patent rights, copyrights, trade secrets, technical data, secret processes, or other propriety data essential for contract performance limits competition. The proprietary data is:

These are “direct replacements’ parts/components for existing equipment .

Other information to support a sole-source buy: There are requirements for both internal and external dimensions and configurations, weight restrictions, low power, ruggedization, mobility, ease of transportability, and compatiblility with end fabrication product in mind.

I CERTIFY THAT STATEMENTS CHECKED, AND INFORMATION PROVIDED ABOVE, ARE COMPLETE AND CORRECT TO THE BEST OF MY KNOWLEDGE. I UNDERSTAND THAT THE PROCESSING OF THIS SOLE-

SOURCE JUSTIFICATION PRECLUDES THE USE OF FULL AND OPEN COMPETITION.

Signature

Code

Title Date Based on review of the above statements and information, I concur with processing this procurement on a noncompetitive basis.

Contracting Officer Signature Date 8/26/2015