MFR-Non_Competitive_FAR_PART_13_under_SAT__CODE_DX_092518_Redacted.pdf

CEHNC-CT 9/25/2018

MEMORAN DUM FOR RECORD

SUBJECT: Non-Competitive Action under FAR Part 13, Simplified Acquisition Procedures, Office of Deputy Assistant Secretary of Defense (Systems Engineering) (ODASD(SE)) for the Joint Federated Assurance Center (JFAC), Software Vulnerability Detection, Test, and Evaluation of Code DX Software Licenses, solicitation number W912DY-18-Q0078

1. Authority: FAR 13.106-l(b)(l).

Pursuant to FAR 13.104, the contracting officer must promote competition to the maximum extent practicable from the source whose offer is the most advantageous to the Government, considering the administrative cost of the purchase. However, in accordance with FAR 13.l06-1 (b)(l ), the contracting officer may solicit from one source if the determination is made that the circumstances of the contract action deem only one source reasonably available ( e.g., urgency, exclusive licensing agreements, brand name, or industrial mobilization) for purchases not exceeding the Simplified Acquisition Threshold (SAT). This memorandum addresses the Contracting Officer's determination to award a procurement action on a non-competitive basis utilizing FAR Subpart 13, Simplified Acquisition Procedures (SAP).

2. Description of Supply & Background This acquisition is for the purchase of Code DX Software Licenses in support of ODASD(SE) JFAC test and evaluation. The JFAC is chartered to provide a suite of Software Assurance (SwA) tools and techniques, across DoD . The purpose of providing these tools and techniques throughout the software development lifecycle is to reduce the security vulnerabilities in deployed software. JFAC holds meeting with stakeholders and charter member organizations to evaluate available commercial offerings. Each product is evaluated based on the method of deployment, the flexibility of end user licensing, and suitability for operation according to JFAC procedures. From those available software packages, JFAC selects one from each of the five “families” of code analysis software based on budget availability and enterprise requirements. The five “families are as follows:

Static Analysis - A static analysis tool reviews program code (source code, byte code, or binaries) without executing it, searching for application

Dynamic Analysis - Dynamic program analysis is the analysis of computer software that is performed by executing programs on a real or virtual processor. For dynamic program analysis to be effective, the target program must be executed with sufficient test inputs that may produce

7176084

Origin-Analysis - Origin-analysis describes a tool that examines software artifacts, such as source code, to determine their origins and authors. This analysis can inform testers of obsolete third-party code or . Origin-analysis tools often fall under the static analysis tool category, but JFAC singles them out in the suite to stress the need for SwA tools that consider and examine third party code or libraries, not just the code developed by the DoD.

Vulnerability-Analysis - Vulnerability analysis describes a broader category of tools that may use static analysis, dynamic analysis, origin analysis, or any hybrid of these techniques, to include tools that aggregate the results of multiple tools or that monitor developer environments.

Architectural Modeling - Where architectural modeling describes the process of examining the artifacts of a software design and the design itself to ensure the resulting program operates only as intended, and not in any other manner. By using formal methods, projects can mathematically model software to discover and that could be

The software packages selected for evaluation in FY18 are Checkmarx, CodeDX, and Code Sonar.

3. Considerations & Solicitation In accordance with FAR 13.106-l (a) and 13.104 the Contracting officer considered the following when selecting CODE DX, INC. (7QDQ0) for award.

The CODE DX software licensing agreement must be modified for ODASD(SE) JFAC test and evaluation rights and therefore, the CODE DX software licenses must be acquired through a Purchase Order. CODE DX, Inc is the original manufacturer and does not have authorized distributors that sell directly to the Government. Because of CODE DX’s exclusive licensing agreement, solicitation number W912DY-18-R-0078 was issued on 25 September 2018, to CODE DX, Inc.

4. Determination Based upon the foregoing, the Contracting Officer determines that it is in the best interest to award this contract sole source to CODE DX, Inc, in the amount of $249,998.98.

Digitally signed by

BROWN.ARLENE.CECILI

A.1257176084 DN: c=US, o=U.S.

Government, ou=DoD, ou=PKI, ou=USA, cn=BROWN.ARLENE.CE

CILIA.1257176084

Date: 2018.09.25 07:24:40 -06'00'

Arlene C. Brown Contracting Officer

BROWN.A

RLENE.CE

CILIA.125