REDACTED - FOE - UP Splunk 18June2026_ Signed_10JUL26.pdf

Justification for an Exception to Fair Opportunity or to Use Brand-Name Restriction

CONTROLLED UNCLASSIFIED INFORMATION

16 Jun 2022 CONTROLLED UNCLASSIFIED INFORMATION Page 2 of 6

Another goal to attain in the exploratory phase is the ability to develop, deploy, and maintain malware analysis, which will protect our country against cyber-attacks from enemy forces. In order to support our continued efforts to stay abreast of cyber threats and attacks we must continue to explore and progress our cyber security efforts to meet the ever evolving forms of malicious threats and cyber-attacks; thus the UP requests to use FY26 0100 (O&M) funding to explore and develop defenses that may possibly raise situational awareness of attacks from the graphical regions to the graphical global stratospheric levels.

Use of FY26 30100 funding will support UP's continued cybersecurity efforts, which are critical to deterring hostile forces and protecting our warfighters and citizens from malicious cyber-attacks. FY26 0100 funds support the UP's development of the force structure as the cyber mission works to build the force capacity and capability.

The Order for these services/licenses will be a new contract award with a Firm Fixed Price (FFP) CLIN structure and a Period of Performance of 1 Year with the performance starting 29 July 2026 through 28 July 2027 using FY26.

(3) Description of the supplies/services required to meet the agency's needs:

This renewal effort will provide the following:

P/N: SE-T-LIC-ST-100GB

On-Premise Splunk Enterprise licenses and associated support (100GB)

In addition to acquiring the following:

P/N: USER-CONF-REG-2

Splunk Conf User – Conference Attendance Conference Attendance (10 seats)

Splunk Enterprise Security (ES) is a data centric, Security Information and Event Management (SIEM) that delivers data-driven security insights for full breadth visibility into our security posture. Allows for continuous security monitoring with custom views with key security metrics, prioritize & act on incidents, and handle multi-step investigations.

Splunk Conf User – Conference Attendance allows 10 designated attendees full-pass entry to keynotes, technical breakout sessions, hands-on labs, and the Source/Pavilion. Typically packaged at a bundled or volume rate, providing a more cost-effective option than purchasing 10 separate individual general admission passes.

(4) Justification for restricting consideration to a brand-name item:

IAW 538.7104-4 Items peculiar to one manufacturer the sole source basis will be executed IAW 538.7104-3(a)

IAW DFARS 208.7402, agencies shall fulfill requirements for commercial software and related services, such as software maintenance IAW DoW ESI (see website at http://www.ESI.mil). ESI promotes the use of enterprise software agreements with contractors that allow DoW to obtain favorable terms and pricing.

Splunk brand name items listed are essential to the governments requirements because it is fielded in our mission systems. Only the OEM can support these items which are currently approved parts of the Air Force Network (AFNet). The renewals must be identical to the products and licenses in use. Their is only one product available due to the nature of use.

Government Information Assurance requirements are dictated by Defense Information Systems Agency (DISA) and Joint Interoperability Test Command (JTIC). The baseline for the affected mission cannot be changed to accommodate other than the brand name licenses and product support. Usage of a similar product, if one were available, would void our current Authority to Operate (ATO).

Impacts to INFINITEVISION & DCTS

Failure to acquire these critical licenses would prevent active mission systems from staying current, creating immediate security vulnerabilities across the network. This technical gap could result in detrimental mission failures and unauthorized downtimes, leaving the Government highly exposed to malicious cyber attacks. Furthermore, the Air Force would lose its vital capability to ingest, enrich, transform, sort, index, analyze, and store the massive quantities of digital data required to support real-time tactical operations and successfully identify malware threats.

16 Jun 2022 CONTROLLED UNCLASSIFIED INFORMATION Page 3 of 6

There is currently only one reseller of Splunk on the DoW ESI BPA. Follow-on research will be conducted prior to solicitation and action will be competed if additional resellers are added.

(5) Contracting Officer's determination that the anticipated cost to the Government will be fair and reasonable:

IAW DFARS 208.7402, Departments and agencies shall fulfill requirements for commercial software and related services, such as software licenses, in accordance with the DoD ESI, therefore ESI BPA holders are the directed/mandatory sources to provide the brand name products and associated support identified in this acquisition. DoD ESI is a BPA under GSA's FSS.

For the actions covered by this Limited Sources Justification, the contracting officer will utilize one or more of the techniques listed under FAR 15.404-1(b)(2), including the comparison of proposed prices received in response to the solicitation, the comparison of proposed prices with independent Government cost estimates, and the comparison of proposed prices to historical prices paid for the same or similar items.

(6) Other facts supporting the justification:

Based on the initial purchase conducted approximately 23 months ago under HNCK limited Sources Justification and Approval (J&A) for HNCK and UP (Contract #FA8307-23-F-B127) in the amount of $ it was determined in order to maintain operations on a fielded weapons systems the government must use the Original Equipment Manufacturers (OEM). The Defense Information Systems Agency (DISA) and the Joint Interoperability Test Command (JITC) dictates the affected weapons systems cannot be changed to accomodate other than the brand name licenses and product support because use of similar products will not maintain the current Authority to Operate (ATO). If the brand name licenses are not renewed and explored this will leave the Government's weapons systems vulnerable to malicious attacks.

(7) Actions the agency may take to remove or overcome any barriers to decreasing the use of brand-name items before any subsequent acquisition of the supplies or services:

At this time, the Government does not anticipate overcoming barriers to this brand name item. The ESI/CETA contract vehicle ordering period ends 14 July 2029.

Currently, there is only one reseller of the brand name items on the DoD ESI BPA; however, Contracting will continue conduct follow-on research before solicitation and after award to determine if additional resellers are added for competition purposes. This particular Blanket Purchase Agreement (BPA) was competed; however, this action will be competed if additional resellers or the brand name are added to the BPA.

(8) Program Manager's certification that supporting data is accurate and complete:

As evidenced by my signature below, I certify that any supporting data contained herein, which is my responsibility, is both accurate and complete.

(9) Contracting Officer's certification that the justification is accurate and complete:

As evidenced by my signature below, I certify that the justification is accurate and complete to the best of my knowledge and belief.

(10) Approving Official's determination that FAR16.505(a)(4)(i) applies to the order:

As evidenced by my signature below, I hereby determine that the use of brand-name restriction applies.

16 Jun 2022 CONTROLLED UNCLASSIFIED INFORMATION Page 4 of 6

Date

17 Jun 2026

Program Manager Chris Coy, GG-12, DAF

AFLCMC/HNCP/ (210) 279-7359

Signature

Date

07 Jul 2026

Contracting Officer Karin A T Werner , GG-13, DAF

AFLCMC/HNCKP

Signature

COY.CHRIS.D.108303

Digitally signed by

COY.CHRIS.D.1083034072

Date: 2026.06.18 10:54:51 -05'00'

WERNER.KARIN.A

T.1092254360

Digitally signed by

WERNER.KARIN.A T.1092254360

Date: 2026.07.07 06:57:15 -05'00'

16 Jun 2022 CONTROLLED UNCLASSIFIED INFORMATION Page 5 of 6

Instructions for Completing the Template IAW FAR 16.505(b)(2)(ii)(B)

(2) State whether the action is a new order or a modification to an existing order. Identify the basic multiple award contract number and the order number for the current action. Also identify the type of the order/line items on the order (e.g., Firm Fixed price, Cost Plus Fixed Fee, etc.).

(3) Specifically describe the supplies/services to be acquired including the price/cost and quantity of each item in the order and the total estimated value of the order. For services, state whether services are performance-based, and if not, provide rationale for not being performance based. State the delivery/performance schedule/period for the items under the order. Explain how the requirement/order fits under the scope of the basic multiple award contracts.

(Note: The Contracting Officer must ensure that the order is issued within the period of performance and within the maximum value of the contract).

(4) Include the appropriate exception from FAR 16.505 (b)(2) and the supporting rationale. FAR16.505(b)(1)(i) requires the Contracting Officer to provide each awardee under a multiple award contract, a fair opportunity to be considered for each order exceeding $3,000 unless a statutory exception applies. The specific exception that precludes the fair opportunity process for this acquisition is FAR 16.505(b)(2)(i)(__) [Insert A,B, C, D, or E]. If a brand name product description is being justified, use this section to explain why the particular brand name, product, or feature is essential to the Government's requirements and why other companies' similar products/services do not meet, or cannot be modified to meet, the agency's needs.

FAR 16.505(b)(2)(i)(A): “The agency need for the supplies or services is so urgent that providing a fair opportunity would result in unacceptable delays”. When using this exception provide a detailed justification with supporting documentation that explains the exact urgency of the requirement and the mission impact if awarded to any other contractor. The user/customer typically provides this supporting information. Recommend attaching supporting documentation to the back of the document. General statements of urgency are not acceptable.

FAR 16.505(b)(2)(i)(B): “Only one awardee is capable of providing the supplies or services required at the level at the level of quality required because the supplies or services ordered are unique or highly specialized”. When using this exception provide a detailed justification, with supporting documentation, as evidence of the “unique or highly specialized” nature of the procurement. The user/customer typically provides this supporting information.

Supporting documentation may be attached to the back of the document. General statements are not acceptable.

FAR 16.505(b)(2)(i)(C): “The order must be issued on a sole-source basis in the interest of economy and efficiency as a logical follow-on to an order already issued under the contract, provided that all awardees were given a fair opportunity to be considered for the original order”. When using this exception provide information on the previously competed order under this contract and detail the economies and efficiencies that will be obtained by going sole source for the follow-on order. The user/customer typically provides this supporting information.

General statements are not acceptable.

FAR 16.505(b)(2)(i)(D): “It is necessary to place an order to satisfy a minimum guarantee.”

FAR 16.505(b)(2)(i)(E): “For orders exceeding the simplified acquisition threshold, a statute expressly authorizes or requires that the purchase be made from a specified source.”

Discuss the market research that was conducted by the user/technical team/contracting officer among the supplies/services of all awardees that resulted in the conclusion that a fair opportunity exception applied. The narrative in this section should provide a high level of confidence that the requirements of FAR 16.505(b)(1) and DFARS 216.505-70 could not be met. If no market research was conducted, state so and provide the rationale. If any other awardee expressed interest in fulfilling the requirement, but was not considered a potential source, explain why that awardee cannot provide the required supplies/perform the service.

16 Jun 2022 CONTROLLED UNCLASSIFIED INFORMATION Page 6 of 6

If the use of a brand name purchase description is being justified, the market research should include an analysis of any industry proposed alternative products or approaches to meeting the requirements. Additionally, the Government's efforts to identify as many potential sources as practicable offering the required brand name item(s) should be addressed.

(5) This paragraph needs to be tailored based on the types of CLINs in the order and the pricing arrangements on the basic multiple award contract. If the contract did not establish the price for the supply or service, the Contracting Officer must establish prices for each order IAW FAR 15.4. The paragraph needs to describe the steps that will ensure that the prices/estimated cost of the order will be fair and reasonable. For example, even if firm-fixed prices were obtained under adequate price competition in the award of the multiple award contract, the Contracting Officer still needs to consider market conditions and other factors that may have changed since contract award and explain the basis in the determination that prices/costs are fair and reasonable prior to award of the order.

(6) Provide any other facts supporting the use of exceptions to the fair opportunity process.

(7) Include a statement of the actions, if any, to be to be taken to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made. If no actions are planned, so state and provide reasons.