Redacted JA ArcSight Maint.pdf

FOR OFFICIAL USE ONLY - PROCUREMENT SENSITIVE - SOURCE SELECTION SENSITIVEVersion 1.5 MAR 2020 Page 1 of 3

Reset Form

DEFENSE FINANCE AND ACCOUNTING SERVICE

Contract Services Directorate

3990 E. Broad Street Bldg. 21, Room 2B029

Columbus, OH 43213-1152

Justification And Approval For Other Than Full And Open Competition - Brand Name

FAR 16.5 - Indefinite-Delivery Contracts - Exception to Fair Opportunity

COMMERCIAL ITEMS (Brand Name)

Purchase Request #(s) NITYU21RV010 CONTRACTING ACTIVITY: DFAS Contract Services Directorate

1. REQUIRING ACTIVITY:

DFAS-I&T Infrastructure and Production Support

2. DESCRIPTION OF THE ACTION BEING APPROVED: Solicit a Brand Name requirement and award a Contract/Order.

3. DESCRIPTION OF SUPPLIES/SERVICES: This justification covers the acquisition of the following article(s):

DFAS requires HPE and ArcSight maintenance renewal support products. This includes maintenance for hardware and software associated with the Enterprise Security Manager (ESM) component of the ArcSight application. Continuous monitoring of systems is a key component of Cyber Security, threat identification, incident detection and mitigation. This project replaces legacy (end of life) equipment and enhances the monitoring capabilities of DFAS’ unclassified and classified systems. ArcSight is the central logging repository for all computer security events generated at DFAS including; firewalls, servers (Windows, Linux, and UNIX), intrusion prevention systems, network devices, and web content filters. Not only are these logs used during computer security events but in many cases have mandated retention requirements. ArcSight provides a mechanism to accumulate, archive, correlate, and report upon these events for rapid response to computer security-related events. The procurement also increases existing user access monitoring capabilities to DFAS systems as mandated by DoD directives.

The Required Delivery Date/PoP is: 10/2/2020 Estimated Value (include option): Option(s) NO

FAR 16.505(a)(4) Items peculiar to one manufacturer

5. RATIONALE JUSTIFYING USE OF CITED STATUTORY AUTHORITY

4. STATUTORY AUTHORITY PERMITTING OTHER THAN FULL AND OPEN COMPETITION:

DFAS requires to procure maintenance to support its existing software and hardware components. The HPE and ArcSight hardware and software components are proprietary and only proprietary HPE and ArcSight products can fill DFAS' needs to maintain the components DFAS currently owns and has software licenses for.

DFAS has numerous ArcSight components that make up the DFAS monitoring system. DFAS uses ArcSight Smart-Connectors and ArcSight Management Center (ArcMC) appliances for collecting logged events from monitored network endpoints. The collected logs are forwarded to ArcSight Loggers which forward to ArcSight Enterprise Security Management (ESM). The ArcSight Loggers are used for long-term log retention, while ESM is used for event correlation, reporting and alerting. ESM reduces hundreds of millions of daily events to a much smaller actionable set of interesting events for further analysis and review. ESM is critical for DFAS security incident detection and investigation.

Replacing ArcSight would require significant effort to replace years of custom developed content for incident detention and reporting, as well as the retraining of DFAS Computer Network Defense Service Provider (CNDSP) Operations staff on any replacement system.

While an alternate Security Information Events Management system (SIEM) may be able to perform similarly, the reengineering cost associated with such a transition would be very high. The ArcSight ESM console provides security organizations with comprehensive, real-time, and expert security information analysis and remediation capabilities.

The replacement of the current ArcSight, with ESM, aligns DFAS to ArcSight roadmap for the foreseeable future. DFAS has already invested considerable capital into ArcSight, over since 2009. That is for a perpetual license and should be considered commercial list price. That price does NOT include the hardware necessary to run the solution. Furthermore, there would be considerable time and effort required from the CNDSP to convert existing reports and infrastructure over to the alternate solution. Those events would either need to be migrated to the alternate system, if such a migration is possible, or ArcSight would need to remain in service to provide

FOR OFFICIAL USE ONLY - PROCUREMENT SENSITIVE - SOURCE SELECTION SENSITIVEVersion 1.5 MAR 2020 Page 2 of 3 historical reporting alongside the replacement solution. Furthermore, all historical events that DFAS must retain are within the ArcSight system.

6. DESCRIPTION OF EFFORTS MADE TO SOLICIT OFFERS FROM AS MANY OFFERORS AS PRACTICABLE:

An RFI was posted to determine the interested vendor base on

12/26/2019 And closed on which resulted in responses from 8 interested vendor(s)1/24/2020

7. A SHORT DESCRIPTION OF RESULTS OF RFI/BETA.SAM.GOV POSTING, OR MARKET RESEARCH CONDUCTED OR A STATEMENT

OF THE REASON NONE OF THE ABOVE ACTIONS WERE CONDUCTED.

Requirement will be competed among brand name resellers. NASASEWP RFI# 138798. Two line items needed to be increased by 25 and updated quotes were requested from 7/30/20-8/7/2020 and 4 NASASEWP and 1 ESI were SUBMITTED. ESI QUOTE #23098555, one quote received from 7/31/2020. See further in 8.

8. LIST OF THE SOURCES THAT EXPRESSED A WRITTEN INTEREST IN THE ACQUISITION.

9. ANY OTHER FACTS SUPPORTING THE USE OF OTHER THAN FULL AND OPEN COMPETITION:

None

10. A STATEMENT OF THE ACTIONS, IF ANY, THE AGENCY MAY TAKE TO REMOVE OR OVERCOME ANY BARRIERS TO COMPETITION BEFORE ANY SUBSEQUENT ACQUISITION FOR THE SUPPLIES OR SERVICES REQUIRED.

None

FOR OFFICIAL USE ONLY - PROCUREMENT SENSITIVE - SOURCE SELECTION SENSITIVEVersion 1.5 MAR 2020 Page 3 of 3

11. DETERMINATION OF FAIR AND REASONABLE COST: The contracting officer will determine that the anticipated cost to the Government of the service/supplies covered by this justification will be fair and reasonable.

12. TECHNICAL/REQUIREMENTS REPRESENTATIVE CERTIFICATION:

I hereby certify that this justification is made in good faith, that the supporting data and information are accurate and complete to the best of my knowledge and belief, and that I would not be making this request if it were feasible to fully compete this requirement. I further certify that this request is not the result of lack of advanced planning or a desire to expend funds while those funds are still available.

Title:Name: Signature

Technical Reviewer

Requiring Activity/Program Management Office Certification:

Name: Title: Signature

13. CONTRACTING OFFICER’S CERTIFICATION: I hereby certify that this justification is made in good faith, that the supporting data and ____information are accurate and complete to the best of my knowledge.

Org. CodeName:

Title: Contracting Officer Signature

15. COMPETITION ADVOCATE REVIEW AND CONCURRENCE: (>$700,000)

Name: Signature

14. LEGAL SUFFICIENCY REVIEW(>SAT): OGC review completed per FAR 6.303-1

Name: Signature