Redacted_TSF-1013 Sole Source Justification_Brand Name_Final_Redacted.pdf

Treasury Standard Form – 1013 (Rev 5/18)

Prescribed by Treasury: DTAP 1013.501

1. Identification of the requiring activity and the contracting activity:

Requiring Activity: U.S. Department of the Treasury, Office of the Comptroller of the Currency (OCC), Information Technology Services

Contracting Activity: U.S. Department of the Treasury, OCC, Acquisition Management

2.a Nature and/or description of the action being approved:

This is a brand name justification for Palo Alto Unit 42 Public Sector Expertise on Demand Subscription, 8-hour remote response time with up to 1600 consulting hours in each period of performance (POP). The anticipated contract type is firm-fixed price. The POP will be for one base year and four option years after contract award.

2.b Name of the vendor. TBD 2.c Requisition No.: TK pending FY26 budget availability in $MART 2.d Bridge contract: ☐ Yes ☒ No 2.e Brand name: ☒ Yes ☐ No 3.a A description of the supplies or services required to meet the agency’s needs:

1. Investigative Analysis

• Utilize identity and threat hunting methodologies to identify additional indicators of compromise.

• Review and analyze commercial, open source, and proprietary information to determine attribution.

2. Log Analysis

• Analyze logs on OCC's SIEM Platform, Splunk and native application logging, and Microsoft Sentinel if relevant information is required.

3. Identity and Access Management Review

• Examine IDP Tenant Access using the OTKA or EntraID Portal if required.

4. Endpoint Detection and Response (EDR)

• Review IOC events for signs of malicious identity and cyber activity on the application, platform or enterprise.

• Access Trellix EDR or any other EDR or identity platform as required.

3.b Includes IT: ☐ Yes ☒ No NAICS 541519; PSC DA1010 3.c IGCE/Estimated dollar value:

The total IGCE is inclusive of one base year contract. The per-year annual price includes Unit 42 Public Sector Expertise on Demand Subscription and 8-hour remote response time. Up to 1600 consulting hours.

4. Identification of the authority being used (Check the box that applies):

☒ 41 U.S.C. 1901 – Simplified acquisition procedures.

☐ 41 U.S.C. 1903 – Special emergency procurement authority.

5. A demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the authority cited:

The OCC conducted web searches of several threat intelligence services to determine the best fit for the OCC. The OCC reviewed the websites of several threat intelligence companies that provide these services to include CrowdStrike, eSentire, IBM Solutions, Google Security Operations, ConnectWise and Palo Alto Networks Unit 42.

The Information Technologies Services Office (ITS) of the OCC reviewed the services of the six threat intelligence services and determined that Palo Alto Networks' Unit 42 meets all the requirements of the OCC and would provide the OCC with the best outcome for identifying the threat actors involved in a cyber compromise.

In reviewing the six companies OCC found the following:

• CrowdStrike provides incident response, penetration services, compromise assessments and threat intelligence.

• ESentire provides managed detection and response, extended detection and response, threat intelligence, incident response, security operations center, risk advisory and consulting.

• IBM Solutions provides threat management and Security Information and Event Management (SIEM), data security, incident response and preparedness, and threat intelligence.

• Google Security provides cloud security, endpoint and application security, threat detection and response, and security analytics.

• ConnectWise provides security operations center, SIEM, threat detection and response, risk assessments, and vulnerability management.

These companies do not provide the services ITS is seeking in its statement of work (SOW) as the companies do not provide the level of enhanced detection and attribution services OCC requires.

The market research that was conducted found that Palo Alto Unit 42 provides enhanced detection and response, security operations platform, real time intelligence on emerging threats that support proactive security measures.

Palo Alto Unit 42 offers a dedicated research unit with a comprehensive threat research focus, responsive to ITS’ statement of work. This differentiates Palo Alto’s Unit 42 from other companies that provide threat intelligence, as their services are often heavily tied to service models (for example Security Operations Centers), with a reliance on enterprise suite solutions, endpoint-centric approaches, or cloud-native emphasis.

6. A description of efforts to ensure that offers were solicited from as many potential sources as is practicable, including whether a notice was or will be publicized as required by FAR subpart 5.2 and, if not, which exception under FAR 5.202 applies:

In accordance with FAR subpart 5.2, a notice of intent to award a Brand Name contract under the authority of FAR subpart 13.5 will be posted on the Government Point of Entry. This notice will afford an opportunity for all responsible sources to submit a capability statement which shall be considered by the Government.

7. A determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable:

The Contracting Officer will determine the prices to be fair and reasonable based on expected competition found on SAM.gov.

8. A description of the market research conducted (see FAR part 10) and the results or a statement of the reason market research was not conducted:

The OCC conducted web searches of several threat intelligence services to determine the best fit for the OCC. The OCC reviewed the websites of several threat intelligence companies that provide these services to include CrowdStrike, eSentire, IBM Solutions, Google Security Operations, ConnectWise and Palo Alto Networks Unit 42.

9.a Any other facts supporting this justification:

None 9.b Attachments: ☐ Yes ☒ No

10. A listing of sources, if any, that expressed, in writing, an interest in the acquisition:

11. A statement of the actions, if any, the Requiring Activity or Contracting Activity may take to remove or overcome any barriers to competition before any subsequent acquisition for the supplies or services required:

The requiring activity will continue to survey the marketplace and perform market research to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made.

12. Certifications and Approvals:

12.a Program Office certification (Requiring Activity). I hereby certify that any supporting information and data provided, which form the basis for this justification, are accurate and complete to the best of my knowledge and belief.

Date:

Signature:

Contracting Officer certification and approval. I hereby determine the circumstances of this acquisition support the justification to acquire the item(s) on a sole source (including brand name) basis under the authority of FAR subpart 13.5. I also certify this justification is accurate and complete to the best of my knowledge and belief. Therefore, unless additional approvals are required as prescribed below, as the authorized contracting officer for this acquisition, I hereby approve this justification.

Name: Marlon Holland Date:

Sig ture: