Varonis_Brand_Name_JA_Redacted.pdf

Source Selection Information – See FAR 2.101 and 3.104

DEPARTMENT OF THE NAVY

NAVSUP FLEET LOGISTICS CENTER NORFOLK

700 ROBBINS AVENUE, BLDG 2B

PHILADELPHIA, PA 19111-5083

IN REPLY REFER TO

290.1D:JS

J&A #: 18-070

JUSTIFICATION AND APPROVAL

BRAND NAME JUSTIFICATION

1. Identification of Agency and Contracting Activity:

The requiring activity is the Bureau of Medicine and Surgery (BUMED), 7700 Arlington Blvd., Falls Church, VA 22042.

The contracting activity is the Fleet Logistics Center (FLC), Norfolk, Contracting Department, Philadelphia Office, 700 Robbins Avenue, Building 2B, Philadelphia, PA 19111-5083.

2. Description of the Action Being Approved:

This Justification and Approval (J&A) authorizes and approves the brand name action for the procurement of Varonis data loss prevention software. It is intended to award a Firm Fixed-Price contract.

3. Description of Supplies/Services:

BUMED requires Varonis software (produced by Varonis Systems), licensing, training subscription, software upgrades and support, repair services, and professional services on behalf of the Navy Bureau of Medicine and Surgery (BUMED). The purpose of this effort is to purchase, install, and provide maintenance, technical support services, and training software subscription to all of BUMED’s Medical Treatment Facilities.

The total estimated value for this requirement is $ . The period of the contract action will be from 29 September 2018 to 28 September 2019. There will be no options included in the contract action. Fiscal Year 2018, Operations and Maintenance, Navy (O&M,N) appropriations will be utilized to fund the requirement.

4. Statutory Authority Permitting Sole Source:

41 USC 1901(e)(2) - a sole source acquisition under the authority of the Special Rules for

Commercial Items, as implemented by FAR 13.501(a).

5. Rationale Justifying Use of Cited Statutory Authority:

The requirement is for software licenses and support for data loss prevention capabilities throughout BUMED’s MTFs.

Although there are other data lost prevention software applications on the market, Varonis is the only software that provides:

User behavior analytics allows DatAdvantage to learn how accounts use their permissions to automatically provide recommendations for achieving the least privilege model. (Patented technology)

As part of DatAdvantage, bi-directional visibility allows customers to see who has access to a specific file/folder and all the files/folders across the network that a specific user/group has access to, and the ability to modify access rights in a single pane of glass.

(Patented technology)

DatAdvantage provides an audit log of every single file touch, successful or unsuccessful, on all unstructured data platforms.

Permissions modeling in DatAdvantage is the ability to simulate permission changes in the environment to determine the effect of achieving the least privilege model without causing business disruptions.

Data classification classifies and locates sensitive content in files, who has access to them, who is accessing them, and what actions users are taking on them within the same console.

DatAdvantage automatically discovers highest risk folders/files and generates prioritized reports to plan mitigation.

On-demand or automated risk assessment reporting to understand security posture and track success of security programs

Additionally, Varonis software is on the Defense Health Agency Approved Product List, which is a list of software that is approved for use by DHA commands, which includes BUMED.

Varonis software can be purchased from and supported by Varonis authorized resellers.

6. Description of Efforts Made to Solicit Offers from as Many Offerors as Practicable:

In FY17, Navy Medicine put in an IT governance request to DHA to review cybersecurity analytical capabilities for implementation across the Military Health System enterprise. The

DHA could not take on the project and sent the governance request back to the Services for implementation. Navy Medicine reviewed numerous audit tools of this capacity, which often fail to identify anomalous patterns and vulnerabilities, leading to delayed discovery of system failures. This generated delays in systems and subsequent delays in the delivery of care to patients, simultaneously creating gaps and major risks for Information Technology (IT) systems.

Market research determined that Varonis does not have the same issues. To comply with the

NDAA, the Bureau of Medicine and Surgery (BUMED) needs to deploy a navy-wide enterprise solution and vulnerability monitoring strategy. The Varonis software has unique qualification making it the only data loss prevention software that can meet the government's minimum requirements.

The DoD Unified Capabilities (UC) APL is established in accordance with the UC Requirements

(UCR 2013) document. Its purpose is to maintain a single consolidated list of products that have completed Interoperability (IO) and Information Assurance (IA) certification. Use of the DoD

UC APL allows DoD Components to purchase and operate UC systems over all DoD network infrastructures. UC APL certifications testing consist of two test sections, Interoperability (IO) and Information Assurance (IA) testing. DoD customers can only purchase related equipment, both hardware and software that has been certified both IO and IA testing compliant with FSO

STIG. The Varonis software is the only data loss prevention software on the UC APL.

The APL is the only listing of equipment by DoD to be fielded in DoD networks. DoD components are required to fulfill their system needs by only purchasing APL listed products, providing one of the listed products meets their needs. This means the APL must be consulted prior to purchasing a system or product. Varonis has received a Certificate of Networthiness

(CoN) and is on the Defense Health Agency Approved Product List.

In accordance with FAR 19.5, the Contracting Officer can set aside acquisitions exceeding the micro-purchase threshold for competition restricted to small business concerns. Varonis identified a number of small businesses capable of providing the required supplies.

There is reasonable expectation that quotes will be received from two responsible small businesses.

7. Determination of Fair and Reasonable Cost:

The Contracting Officer has determined the anticipated cost to the Government of the supplies covered by this J&A will be fair and reasonable.

8. Actions to Remove Barriers to Future Competition:

Future requirements will be handled on a case by case basis. If another potential source emerges, FLC Norfolk, Philadelphia Office, will assess whether competition for future requirements is feasible.

9. CONTRACTING POINT OF CONTACT:

The point of contact for this contracting action is Jillian Staskin, Phone 215-697-9813, and email jillian.staskin@navy.mil.

J&A Number: 17-056

CERTIFICATIONS AND APPROVAL

TECHNICAL/REQUIREMENTS CERTIFICATION

I certify that the facts and representations under my cognizance which are included in this

Justification and its supporting acquisition planning documents, except as noted herein, are complete and accurate to the best of my knowledge and belief.

Technical/Requirements Cognizance:

_____________________________ James A. Perkins _________ (703) 681-9516 7 Sep 18

Signature Name (Printed) Phone No. Date

LEGAL SUFFICIENCY REVIEW

I have determined this Justification is legally sufficient.

CONTRACTING OFFICER CERTIFICATION

I certify that this Justification is accurate and complete to the best of my knowledge and belief.

To the extent that the J&A value is between $150K and $700K, the Contracting Officer’s signature below also represents approval of the J&A.

CONTRACTING ACTIVITY COMPETITION ADVOCATE REVIEW

To the extent that the J&A value is between $700K and $13.5M, the Competition Advocate’s signature below also represents approval of the J&A/LSJ.