Redacted_JA Other than Full and Open Justification_Trellix.pdf

J&A Number: N00167-26-SIMACQ-CD-10-0009 sophisticated cyber threats that could compromise national security operations and sensitive defense information.

Trellix Endpoint Security Suite was selected to align with Department of Defense cybersecurity standards and provides integration capabilities with existing security infrastructure already deployed across Naval Surface Warfare Centers. The platform enables centralized security management, real-time threat response, and comprehensive endpoint visibility necessary for maintaining operational security posture.

To meet these critical cybersecurity requirements, we require the purchase of the following endpoint security licenses and professional.

Part Number Description Qty

TRLXESI-

TRXEPPSUITEG-

Trellix DoD ESS Endpoint Security Suite is a unified one-year endpoint security capability for enterprise and military customers. It is comprised of the DoDs endpoint security baseline, which provides endpoint protection, detection, response, and system compliance audit capabilities for up to 22,099 workstations

Trellix - TRLXESI-TRX-EPPSUITEG-25:

17945013-NAI

TRLXESI-

TRXSRVSUITEG-

Trellix DoD ESS Server Security Suite is a unified one-year endpoint security capability for enterprise and military customers. It is comprised of the DoDs endpoint security baseline, which provides server protection, detection, response, and system compliance audit capabilities for up to 3471 Servers

Trellix - TRLXESI-TRX-SRVSUITEG-25:

17945013-NAI

ENSYWM-AA-GG

Trellix Software Support on Windows 7 ENS-Client

- Standard Offering -Technical Support Service [Qty 1001 - 2000]

Trellix - ENSYWM-AA-GG

1,064

Period of performance: 16 December 2025 - 15 December 2026

The Government’s minimum needs have been verified by the certifying technical and requirements personnel.

The Product Service Code (PSC) for this procurement will be 7A21 IT and telecom - business application software (perpetual license software).

4. Statutory Authority Permitting Other Than Full and Open Competition

This brand name justification is pursued in accordance with FAR 16.505(a)(4), which provides that an Agency may procure items peculiar to one manufacturer, provided that the particular brandname, product, or feature is essential to the Government’s requirements, and market research indicates other companies’ similar products, or products lacking the particular feature, do not meet, or cannot be modified to meet, the Agency’s need.

5. Rationale Justifying Use of Cited Statutory Authority

NSWC requires the procurement of Trellix Endpoint Security Suite to maintain continuity of critical cybersecurity operations across the enterprise. Trellix has been deployed across Naval Surface Warfare Centers for several years, with cybersecurity and IT staff extensively trained on its proprietary management console, threat intelligence integration, and incident response workflows.

Trellix provides unique capabilities that distinguish it from top competitors including CrowdStrike, SentinelOne, and Carbon Black. Unlike competing solutions, Trellix offers native integration with its proprietary Threat Intelligence Exchange (TIE) enabling real-time threat indicator sharing across all enterprise endpoints without requiring third-party tools.

Trellix's Dynamic Application Containment (DAC) technology provides zero-day malware protection through behavioral analysis in isolated virtual containers - a capability competitors either lack or require separate licensing to achieve. Additionally, Trellix uniquely combines endpoint detection and response (EDR) with data loss prevention (DLP) in a single integrated console, while competitors require multiple separate products and management interfaces.

If the organization is unable to procure this cybersecurity solution, it will create significant security vulnerabilities across our endpoint infrastructure, potentially compromising the confidentiality, integrity, and availability of defense information systems. The existing security infrastructure requires these capabilities to maintain adequate protection levels for mission-critical systems and data.

If the Government transitioned to an alternative platform, the loss of multi-year threat intelligence data, custom detection rules, and incident response playbooks would create significant cybersecurity gaps. Migration costs would exceed several million dollars and require twelve to eighteen months of implementation time, during which endpoint security coverage would be degraded, potentially exposing critical defense systems to advanced threats.

Alternative solutions evaluated failed to meet all government requirements and lack Trellix's comprehensive integration capabilities with existing DoD security tools. Competing products cannot provide the seamless threat intelligence sharing capability required for enterprise-wide protection.

Under alternative solutions, additional tools and manual processes would be required to achieve equivalent security coverage, significantly increasing operational complexity and costs.

Replacing Trellix would halt ongoing cybersecurity modernization efforts, force continuation of legacy security contracts scheduled for sunset at substantial additional cost, and revert automated security services to manual processes, reducing the organization's ability to respond to emerging cyber threats in real-time.

Based on these factors, Trellix Endpoint Security Suite is the only solution that can meet the Government's comprehensive endpoint security requirements while maintaining operational continuity and integration with existing defense cybersecurity infrastructure.

6. Description of Efforts Made to Solicit Offers from as Many

Offerors as Practicable

The Government conducted market research in accordance with FAR 10.002(b)(2)(vii), focusing on alternatives to Trellix-enabled endpoint security solutions. CrowdStrike, SentinelOne, Carbon Black, and Symantec were identified as companies who make endpoint security products and who have an existing presence within the federal government. Additionally, numerous manufacturers could provide specific software elements to replace portions of Trellix solutions. However, in all cases, the estimated costs of replacement efforts would be two to four times higher and require a significant overlapping investment in order to reconfigure and redevelop existing solutions while maintaining cybersecurity requirements. A risk review determined that the increased costs, retraining personnel, loss of historic threat intelligence data, and potential for security coverage gaps would place all projects across the enterprise at a high risk.

NSWCCD determined that maintaining and growing the current Trellix platform and toolset solution reduces operational cybersecurity risks and supports fully meeting mission requirements.

The Trellix software contains proprietary components including the Threat Intelligence Exchange (TIE) and Dynamic Application Containment (DAC) technologies. Trellix software products have demonstrated the ability to meet the comprehensive requirements for integrated endpoint detection and response with data loss prevention capabilities. No other sources have access to the proprietary threat intelligence algorithms and behavioral analysis engines within the Trellix software and therefore would be unable to reasonably provide like-in-kind solutions.

Using an incomplete set of endpoint security capabilities and tools would pose a significant and unacceptable risk to the Government's mission requirements and cybersecurity posture.

Pursuant to FAR 16.505(a)(4), the Government will make this Justification available on the Government point of entry (SAM.gov), the Government will ensure that the contract file will be documented as to any responses received from making the Justification available.

7. Determination of Fair and Reasonable Costs

The Contracting Officer has determined that the anticipated costs to the Government for the items covered by this Justification will be fair and reasonable consistent with FAR 15.404-1 by using price analysis, including historical cost estimating relationships from previous procurements in accordance with (IAW) Class Deviation – 2014-O0011.

8. Actions to Remove Barriers to Competition

WCHQ/NSWCCD will continue to perform market research to identify and assess sources for future requirements related to this effort and if another potential source emerges, WCHQ/NSWCCD will assess whether full and open competition is feasible. Although market research indicates multiple sources capable of partial endpoint security solutions, none of these vendors currently possess holistic solutions that enable the required seamless integration across DoD networks while providing real-time threat intelligence sharing, unified endpoint detection and response, integrated data loss prevention, and comprehensive security management in a single platform.

CERTIFICATIONS AND APPROVAL

TECHNICAL/REQUIREMENTS CERTIFICATION (FAR 6.303-2(c))

I certify that the facts and representations under my cognizance, which are included in this justification and its supporting data, except as noted herein, are complete and accurate to the best of my knowledge and belief.

TECHNICAL AND REQUIREMENTS COGNIZANCE:

Signature Name (Print) and Title (Code) Phone No. Date

LEGAL SUFFICIENCY REVIEW (NMCARS 5206.303(90))

I have determined this justification is legally sufficient.

CONTRACTING OFFICER CERTIFICATION (FAR 16.505(c)(1))

I certify that this justification is accurate and complete to the best of my knowledge and belief.

DUHAIME.KRISTEN.M.1 Digitally signed by

DUHAIME.KRISTEN.M

Date: 2025.11.21 11:55:02 -05'00'

APPROVAL BLOCK (FAR 16.505(c)(2) for a proposed contract exceeding $900,000, the Advocate for Competition approval)

Upon the basis of the above justification, I hereby approve, as the solicitation of the proposed procurement(s) described herein using other than full and open competition, pursuant to the authority of 10 U.S.C.3204(a)(1).

(TITLE OF APPROVING OFFICIAL)

Signature Name (Print) Date