NGINX JOFOC_EXTERNAL.pdf

Brand Name Justification, NGINX, Page 1 of 3

NATIONAL TRANSPORTATION SAFETY BOARD

Justification for Other Than Full and Open Competition

“NGINX Software Licenses”

1. Program Office / Procurement Request:

Office of Chief Information Officer, Computer Services Division (CIO-10)

2. Nature of Action:

The purpose of this Justification for other Than Full and Open Competition (JOFOC) is to provide documentation that explains why this specific requirement is to be restricted to NGINX brand name products only.

3. Description of Requirement:

The National Transportation Safety Board (NTSB) has a requirement to support and maintain the agency’s existing NGINX products which facilitate the NTSB’s public-facing De-Militarized Zone (DMZ) network, also known as a Perimeter Network, using reverse proxies. A DMZ network is a sub-network that contains and exposes an organization’s external-facing services to the untrusted, public-facing internet. The purpose of a DMZ is to add an additional layer of security to an organization’s local area network (LAN) – an external network can access only what is exposed on the DMZ, while the rest of the organization’s network is firewalled. The DMZ functions as a small, isolated network positioned between the internet and the private network and allows the NTSB extra time to detect and address cybersecurity breaches before those breaches can penetrate the internal network.

NGINX support is required because of NTSB’s initiative to build a public-facing DMZ using an industry standard design by placing reverse proxies in at the edge, rather than directly exposing servers to the internet. NGINX is an open source web server software that serves as a reverse proxy, HTTP load balancer, and email proxy for IMAP, POP3, and SMTP. NGINX offers an event-driven and asynchronous architecture, which makes NGINX a reliable solution in terms of speed and scalability.

With NGINX, one master process can control multiple worker processes. The master maintains the worker processes, while the workers do the actual processing. Because NGINX is asynchronous, each request can be executed by the worker concurrently without blocking other requests.

NGINX’s technical capabilities include:

• Reverse proxy with caching

• IPv6

• Load balancing

• FastCGI support with caching

• WebSockets

• Handling of static files, index files, and auto-indexing

• TLS/SSL with SNI

Brand Name Justification, NGINX, Page 2 of 3

The required items are as follows:

Part Number Description Quantity

F5-NGX-CTRLENT-

CFG

NGINX Controller - Enterprise Support Level

F5-NGX-CTRLBASE-

ENT

NGINX Controller base license - Enterprise 24x7 Support -\ 30 min SLA

F5-NGX-CTRLADC-

ENT

NGINX Controller Load Balancing license with 20 instances included - Enterprise 24x7 Support - 30 min SLA

F5-NGX-SPT-ENT NGINX Enterprise Support (24x7) 1 F5-NGX-MS-WAF ModSecurity WAF for Nginx Plus (Pro and

Enterprise)

F5-NGX-SPT-ENT NGINX Enterprise Support (24x7) 2 F5-NGX-PLS-PRE NGINX Plus per instance license, Premium Support (Per Month, 7x24)

F5-NGX-SPT-PRE NGINX Premium Support (24x7) 4

In FY20, the NTSB purchased NGINX software and professional services via purchase order 9531BM20P0041, which expires on 8/2/2021. This requirement is for ongoing software maintenance and support after the expiration of the current order. The period of performance shall include a base year and one option year.

4. Authority Cited:

The authority permitting other than Full and Open competition for this procurement is FAR 13.106-1(b)(1)(i) for purchases not exceeding the Simplified Acquisition Threshold. The only portion being limited is the brand name.

5. Unique Qualifications / Circumstances of Requirement:

The NTSB is currently using NGINX and its unique technical capabilities to manage the requirement to facilitate the public facing DMZ and perimeter network. NGINX provides support and maintenance tailored for their proprietary products that other vendors do not have the capability to provide due to the proprietary nature of the brand name product. Due to NGINX being the technical solution currently in place, using a product other than NGINX for support would not provide the NTSB with solution-specific expertise to perform ongoing maintenance and support which would leave the agency vulnerable to cybersecurity risks.

When the current NGINX software was purchased under 9531BM21P0041, the NTSB also purchased professional services to assist with the installation, configuration, and deployment of the software. If the NTSB were to switch to a different software, professional services would need to be purchased again to assist with the configuration and deployment of the new solution. Renewing the NGINX software licenses ensures continuity of service and no duplication of cost and labor.

In addition, due to the ubiquity of NGINX, it is much easier to find contractors who are experienced and qualified to handle technical support outside of the standard software maintenance, should it be needed at a future date. If the NTSB was to purchase a

Brand Name Justification, NGINX, Page 3 of 3 different product, there would be a risk of troubleshooting delays and downtime that would affect the entire NTSB network.

For these reasons, NGINX is the only product that has the technical capabilities to satisfy the NTSB’s maintenance and support requirement.

6. Efforts to Determine Only One Source:

While this requirement is restricted to NGINX brand name products, a request for quotes (RFQ) will be posted to the Federal Business Opportunities website (www.beta.sam.gov) to maximize competition, in accordance with FAR 5.102(a)(1). A copy of this Justification will be included with the solicitation in accordance with FAR 5.102(a)(6). Market research has indicated that there are multiple resellers of this product, but the NTSB does not expect to obtain quotes from two or more responsible Small Business concerns. Therefore, this will be conducted as an unrestricted purchase.

7. Contracting Officer’s Determination:

I have reviewed the above JOFOC, and determined that based on the information provided, it is accurate and complete, the anticipated cost of any subsequent sole source award would be in the best interest and fair and reasonable to the Government.

8. Market Research:

See Section 6, “Efforts to Determine Only One Source” above.

9. Other Pertinent Information:

N/A

10. List of Interested Parties:

Other companies/organizations have not expressed an interest in this requirement.

11. Efforts to Remove Barriers to Competition:

The NTSB will continue to conduct market research to determine if NGINX is the only source or if there are other sources that are capable of meeting the NTSB’s requirement.

12. Contracting Officer’s Certification The Contracting Officer certifies that this JOFOC is accurate and complete.