Palo Alto Networks - Brand Name Justification - Approved - for RFP Posting.pdf

U.S. Department of Homeland Security Justification and Approval for Other Than Full and Open Competition

Office of the Chief Procurement Officer Version 3.2

JUSTIFICATION AND APPROVAL FOR OTHER THAN FULL AND OPEN

COMPETITION

41 U.S.C. 3304(a)(1)

Pursuant to the requirements of the Competition in Contracting Act (CICA) as implemented by the Federal Acquisition Regulation (FAR) Subpart 6.3 and in accordance with the requirements of FAR 6.303-1, the justification for the use of the statutory authority under FAR Subpart 6.3 is justified by the following facts and rationale required under FAR 6.303-2 as follows:

1. Agency and Contracting Activity.

The Department of Homeland Security (DHS), Office of Procurement Operations (OPO), Information Technology Acquisition Center (ITAC) has prepared this Brand Name Justification and Approval for Other Than Full and Open Competition. This is a brand name justification to cover Palo Alto Networks’ software license and maintenance support that will be procured in support of the Office of Chief Information Officer (OCIO)’s Homeland Security Enterprise Network (HSEN).

2. Nature and/or Description of the Action being Approved.

The OCIO’s Enterprise Operations Division (EOD) has identified the need to procure Palo Alto Networks branded software license and maintenance support.

Pursuant to FAR 6.302-1(c), the intent is to award a brand name firm fixed price contract for a base plus four option years restricting consideration to items peculiar to one manufacturer.

The action being requested is a new award with a 12-month base period and four 12-month option periods.

The estimated total value (including options) is as follows:

Year Total Price

Base Year $X,XXX,XXX.XX Option Year 1 $X,XXX,XXX.XX Option Year 2 $X,XXX,XXX.XX Option Year 3 $X,XXX,XXX.XX Option Year 4 $X,XXX,XXX.XX Total $XX,XXX,XXX.XX

U.S. Department of Homeland Security Justification and Approval for Other Than Full and Open Competition

(a) Type of funding: Operations & Maintenance

(b) Year of funding FY23

(c) Solicitation number: 70RTAC23R00000028

(d) This is a re-competition to the Merlin International Inc. delivery order 70RTAC22FR0000066 awarded under the DHS’s First Source II contract vehicle. The performance period for that order is: 6/27/2022 - 6/26/2023

3. Description of Supplies/Services.

Palo Alto Software license and maintenance support for the Homeland Security Enterprise Network (HSEN) at the colocation facilities (Equinix East/West)

DHS Homeland Security Enterprise Network (HSEN) has a requirement at the colocation facilities (Equinix East/West) for Palo Alto Networks Enterprise License and Support Agreement.

The licenses included within this ELA consists of the following: Threat Prevention, DNS Security, Advanced URL Filtering, Wildfire, Global Protect Gateway, Enterprise Data Loss Prevention, 6000 Software NGFW Credits to deploy VMSeries, CN-Series, Subscription Services, and Virtual Panorama to manage Software Firewalls, SaaS Security Included Services and Support (ESA): Extended Expertise (Full-Time Resident Engineer), Extended Expertise (Part-Time Resident Engineer), Palo Alto Networks Focused Services Plus, and United States Government Premium Support.

In addition to providing services in support of the DHS HSEN Palo Alto Networks Enterprise License and Support will provide services for DHS Cybersecurity & Infrastructure Security Agency (CISA) Licensing: Threat Prevention, DNS Security, Advanced URL Filtering, Wildfire, Global Protect Gateway, Enterprise Data Loss Prevention, SaaS Security Included Services and Support (ESA): Palo Alto Networks Focused Services Plus, United States Government Premium Support.

4. Identification of Statutory Authority Permitting Other Than Full and Open Competition.

The statutory authority permitting other than full and open competition is FAR Subpart 6.302-1 entitled “Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements” and more specifically, FAR 6.302-1(c) - “Application for brand-name descriptions”

U.S. Department of Homeland Security Justification and Approval for Other Than Full and Open Competition

5. Identification of Exception to the Buy American Statute

N/A

6. Demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the authority cited.

OPO intends to procure software license and maintenance support, by utilizing brand name specifications, for Palo Alto Networks’ software license and maintenance support in accordance with FAR 6.302-1(c).

HSEN (Homeland Security Enterprise Network) is DHS’ shared Wide Area Network (WAN) for all of DHS. It is a collection of thousands of sites spread across all 22 DHS Components.

The HSEN core infrastructure consists of multiple system components that works together to implement the overall functional system in order to provide network services, 24x7 365 days a year, to all 22 DHS Components, Other Government Agencies (OGA), Participating Government Agencies (PGAs) and Trade Partners worldwide. One of the most critical HSEN infrastructure system components that are currently in production and actively being used are the Palo Alto Firewalls, which is a Next Generation Firewall, that provides the ability to provide real-time protection, detect known and unknown threats using intelligence in order to reduce risk and prevent a broad range of attacks to DHS and all the DHS Components’ network.

The Palo Alto Networks’ software and equipment are currently being used in the DHS HSEN Production environment 24x7 365 days a year. The Palo Alto Networks’ software license and maintenance support are essential to the DHS HSEN WAN infrastructure Policy Enforcement Points (PEP) and Redundant Trusted Internet Connection (TIC) service delivery current production environment to meet DHS minimum requirements.

Introducing a new vendor software and equipment to the HSEN network infrastructure at this time, introduces a significant risk to DHS and the 22 DHS Components. It is essential to the DHS HSEN network architecture, maintenance platforms, and systems to require the continued use of the Palo Alto software and equipment to ensure HSEN’s current working production environment functionality, security, capacity, and fail-over capability within the DHS WAN network including between the public cloud and DHS datacenter environments.

Introducing a new/different vendor software and equipment to the HSEN network core system at this time will require a significant redesign of the current HSEN network infrastructure configuration, a network architecture review of the HSEN network infrastructure, as well as, a new system/product functionality compatibility architecture review with the other 22 DHS Components to ensure operational integrity and interoperability between the new vendor software and equipment and all the other system

U.S. Department of Homeland Security Justification and Approval for Other Than Full and Open Competition components within the HSEN network infrastructure environment and between the 22 DHS Components.

Due to the fact that the Palo Alto software and equipment are placed in the most critical areas inside the DHS HSEN core network infrastructure, not doing a full functionality and compatibility review of the new vendor to replace the Palo Alto software and equipment could result in catastrophic impacts to the DHS HSEN WAN network and to the DHS mission due to incompatible devices and software configurations. These full functionality and capability reviews can only be accurately determined by putting the new software and equipment in production with live production traffic as a lab or simulated environment cannot capture the complexity and traffic flows of HSEN and the thousands of DHS Component applications traversing through HSEN.

Secondly, the introduction of new vendor equipment and software within the two geographically redundant DHS DataCenters would require a significant new investment, resources, and time that is not expected to be recovered through competition and would present unacceptable delays in fulfilling the agency’s minimum requirements. The level of effort involved related to new design, configuration changes and updates, testing a new system to replace an existing highly and fully functioning and technically capable system would also introduce new and significant unknown risk to an otherwise stable system and environment.

Market research indicates other vendor’s solutions do not have the features required by DHS such as:

- Only Palo Alto provides machine learning powered protection with inline deep learning that stops more threats than other vendor solutions

- Only Palo Alto’s Next Generation Firewall stops patient zero with industry first real-time protection against zero-day and highly evasive threats

- Palo Alto’s Next Generation Firewalls consistently provide 30% higher performance with security services enabled in 3rd party testing, like the Miercom testing reports for all use cases, including branch and remote offices, campus and HQ and Data Center.

- In the same third party validation testing, Palo Alto Next Generation Firewalls maintained predictable throughput with Cloud-Delivered security services enabled, while the competition showed significant performance degradation.

- Palo Alto delivers Zero Trust security with natively integrated solutions that provide continuous trust verification without compromising performance

- Palo Alto provides continuous security protection inspection for all applications, users and devices with inspection traffic to prevent all threats, including highly evasive, never-seen-before threats

- Forrester performed a market analysis of 10 market leaders by researching, analyzing, and scoring key technical and performance criteria. The vendors include Barracuda Networks, Check Point Software Technologies, Cisco, Forcepoint, Fortinet, Juniper Networks, Palo Alto Networks, SonicWall, Sophos, and WatchGuard. Palo Alto

U.S. Department of Homeland Security Justification and Approval for Other Than Full and Open Competition

Networks ranked the highest in terms of service offerings and technical strategy. Palo Alto ranked at the top in many of the key areas, including Policy creation and management, Zero Trust, IPSec and VPN, SD-WAN, DNS, IDS/IPS, automated malware analysis, and threat intelligence. Palo Alto Networks, long known as the leaders in next-generation firewall (NGFW), demonstrate real innovation across multiple criteria in the network security space - network security is infused with Artificial Intelligence (AI) and Zero Trust principles.

o Other vendor’s similar products, or products lacking the particular feature, do not meet, or cannot be modified to meet, the agency’s needs. Previous implementation and design attempts with non-Palo Alto Networks solutions have not been successful nor have other vendors been able to successfully provide the necessary services. For example, prior to the initial purchase of the Palo Alto products and software to support the HSEN infrastructure, the program management office experienced failed integration attempts which utilized competing lower cost solutions. The solutions were unsuccessful and extremely timely – costing the DHS OCIO almost two years, $18M, and a complete reversal of efforts and ultimately contract failure. Mission failure would result if this justification to continue the use of the requested requirements is not approved.

- DHS Cloud Access Point 2 (DCAP2) use the Palo Alto Next Generation Firewalls to replace the DHS Reverse Proxy Content Analysis Solution (CAS)/Anti-Virus solution, provided by the BlueCoats. Efforts are underway to replace the BlueCoats at DHS Cloud Access Point 1 (DCAP1)

7. Description of Efforts Made to Ensure that Offers are Solicited from as Many Potential Sources as is Practicable.

This Brand Name Justification will be posted with the solicitation in accordance with FAR 5.102(a)(6).

8. Determination by the Contracting Officer that the Anticipated Cost to the Government will be Fair and Reasonable.

The contracting officer will determine that the anticipated prices are fair and reasonable based on market research, commercial pricelists, competition among resellers, and prior acquisition history. The Contracting Officer will determine that the proposed contract action represents the best value and will result in the lowest overall cost, in accordance with contract terms and conditions and the evaluation method specified in the solicitation. The solicitation utilizes a lowest price technical acceptable evaluation method. Market research identified at least 7 small business firms that could provide offers.

U.S. Department of Homeland Security Justification and Approval for Other Than Full and Open Competition

9. Description of Market Research.

See Section 6 above for a description of the current Market.

Additionally, Market research determined that a longer term (base year with four 12-month option periods) contract is required to ensure the best pricing to the Government. The research also demonstrated the existence of several small business resellers of this product and service.

Market research was conducted and determined that a longer term (base year with four 12-month option periods) contract is required to ensure the best pricing to the Government. The required DHS strategic sourcing vehicle, First Source II is at its last year of performance and not suitable for such a long-term award action. Similarly, NASA SEWP V has an expiration period in 2025, well before the 2028 ultimate completion date of this proposed award action and has been deemed not suitable for this acquisition. Similarly, market research also found limitations related to Palo Alto software license GSA schedule contract holders, and thus an open market solution has been determined to be in the best interests of the DHS.

10. Any Other Facts Supporting the Use of Other Than Full and Open Competition.

Continuing to utilize Palo Alto Networking software and hardware for the HSEN mitigates risks associated with multiple configurations and incompatibilities within the infrastructure.

11. A Listing of the Sources, if Any That Expressed, in Writing, an Interest in the Acquisition.

Only Palo Alto resellers have expressed interest in the requirement.

12. A Statement of the Actions, if Any, the Agency May Take to Remove or Overcome Any Barriers to Competition Before Any Subsequent Acquisition for Supplies or Services Required.

The OCIO, along with the support of OPO, will continue to conduct market research to review available technology and products for networking solutions to promote competition in future acquisitions. If there is a fundamental shift in the technology solutions available in the market that are beneficial to the DHS, action may be taken to plan, test, and migrate the infrastructure and networking solutions. Additionally, HSEN will be looking to modernize and will allow for alternative vendors to be introduced into the network.

U.S. Department of Homeland Security Justification and Approval for Other Than Full and Open Competition

13. Contracting Officer’s Certification. I certify that the data supporting the recommended use of other than full and open competition is accurate and complete to the best of my knowledge and belief.

Gregory Ruderman Contracting Officer

14. Technical/Requirements Personnel Certification. I certify this requirement meets the Government’s minimum need and that the supporting data, which forms a basis for this justification, is complete and accurate.

Stacy Johnson Technical Representative

APPROVAL

Victoria Short Head of the Contracting Activity

GREGORY S

RUDERMAN

Digitally signed by

GREGORY S

RUDERMAN

Date: 2023.06.23 14:59:06 -04'00'

STACY M

JOHNSON

Digitally signed by

STACY M JOHNSON

Date: 2023.06.23 15:18:47 -04'00'

VICTORIA D SHORT

Digitally signed by VICTORIA D

SHORT

Date: 2023.06.23 16:37:40 -04'00'