SF 1014 - Justification for an Exception to Fair Opportunity 9.9.26 Final.pdf

DEPARTMENT OF THE TREASURY

Page 1 of Treasury Standard Form – 1014 (Rev 12/24)

Prescribed by Treasury: DTAP 1016.505 Tracking No.

SF 1014 - JUSTIFICATION FOR AN EXCEPTION

TO FAIR OPPORTUNITY

ACQUISITION TITLE: “Firewall Security Management Tool - Tuffin Support”

1. Identification of the requiring activity and the contracting activity:

The requiring activity is the Internal Revenue Service (IRS) / Office of the Chief Procurement Officer (OCPO), Information Technology Operation Division, Enterprise Operations Branch (EOps).

2.a Nature and/or description of the action being approved:

The purpose of this JEFO is to obtain approval to award a Firm Fixed Price to procure approval for brand name acquisition, purchase, and update of commercially available proprietary. This acquisition will provide an enterprise-grade solution for managing and automating network security policies across firewalls, routers, cloud platforms, and distributed network architectures. Competition will be limited to authorized resellers of brand name specific items via NASA SEWP on a Lowest Price Technically Acceptable (LPTA) basis.

Tufin Enterprise software is a network security policy management platform used to automate, manage, and monitor network security policies and firewall configurations across complex IT environments. It helps organizations improve security, maintain compliance, reduce configuration risk, and automate network access changes. This product will replace the existing FireMon Security Policy Management (SPM) platform currently in use within the agency’s network security environment.

The Tufin Enterprise Suite will deliver enhanced capabilities in security policy automation, change tracking, configuration compliance, network mapping and visualization, segmentation governance, and audit support. This includes full integration with the agency’s ServiceNow IT Service Management (ITSM) platform to support standardized, automated, and auditable change workflows. This procurement will support ongoing modernization efforts by enabling automated risk assessment, rule lifecycle management, network path analysis, and continuous compliance across hybrid environments.

This acquisition is necessary to modernize and improve the agency’s security policy management processes, reduce operational risk, enhance visibility across complex networks, and align with Zero Trust, federal cybersecurity, and audit-readiness requirements.

2.b Name of the vendor. TBD 2.c Requisition No.: 5000222195 2.d Bridge contract: ☐ Yes No 2.e Brand name: Yes ☐ No

Page 2 of Treasury Standard Form – 1014 (Rev 12/24)

Prescribed by Treasury: DTAP 1016.505 Tracking No.

3.a A description of the supplies or services required to meet the agency’s needs:

This is a bona fide FY2026 requirement to procure Security Policy Management software that provides centralized management, automation, and visibility across the IRS enterprise network security infrastructure.

The required solution must provide capabilities including:

Security policy management and lifecycle administration.

Change tracking and automated policy analysis.

Security policy optimization and rule cleanup.

Device configuration compliance monitoring and audit reporting.

Network segmentation analysis and validation.

Network topology visualization and path analysis to support troubleshooting and impact assessments.

Integration with IT Service Management (ITSM) tools to support automated change management workflows.

Automation capabilities for proactive risk assessment, change request verification, change design validation, path identification, and target device selection.

Enterprise reporting and audit capabilities to support operational, security, and regulatory compliance requirements.

These capabilities are required to improve the efficiency, accuracy, and security of firewall policy administration, strengthen compliance with IRS cybersecurity requirements, reduce operational risk associated with manual processes, and support enterprise-wide network security operations.

As discussed in Section 4b, market research determined that Tufin Enterprise Suite is the only solution capable of meeting all of the IRS's technical, operational, integration, and interoperability requirements without introducing unacceptable mission or operational risk.

SF 1014 - JUSTIFICATION FOR AN EXCEPTION

TO FAIR OPPORTUNITY

ACQUISITION TITLE: “Firewall Security Management Tool - Tufin Support”

Page 3 of Treasury Standard Form – 1014 (Rev 12/24)

Prescribed by Treasury: DTAP 1016.505 Tracking No.

Base Period

OEM Part CI HW/SW Description

QTY

Number

TF-T1220 3172A/

31CO

HW T-1220 Appliance with 1-Year Support and

Warranty

TF-T820 3172A/

31CO

HW T-820 Appliance with 1-Year Support and Warranty

TS-ENTPRS-

FW-UNIT

3156A SW License Tufin Enterprise per Firewall Unit. (Enterprise Licensing)

TF-PS-CUSTOM 2518 Prof Service Professional Services for a Tufin solution as defined in a customized and agreed-upon SOW

TF-PS-DEPLOY- 3157 SW Deployment Base Package for a new Enterprise Deployment.

ENTPRS

TF-PS-DEPLOY-

ST-ADD-

FWUNIT-20

3157 SW Deployment Package Option for 20 TOS Monitored Firewall Units.

TF-PS-

INTEGRATE-

SNOW

3157 SW Deployment Package – Workflow Integrator (WFI) Integration with ServiceNow (up to 5 integration points).

TF-PS-

EXTENSION-

APP

3157 SW Deployment Package Option for One (1) Extension and Integration Application

Option Year Period 1

TF-HW-WTY-

1YR (T1220)

2575 HW

Maintenance

Appliance Support and Warranty 1-Year for T800, T1200, T820, T1220

TF-HW-WTY-

1YR (T820)

2575 HW

Maintenance

Appliance Support and Warranty 1-Year for T800, T1200, T820, T1220

TS-ENTPRS-

FW-UNIT

3156A SW License Tufin Enterprise per Firewall Unit. (Enterprise Licensing)

Option Year Period 2

TF-HW-WTY-

1YR (T1220)

2575 HW

Maintenance

Appliance Support and Warranty 1-Year for T800, T1200, T820, T1220

TF-HW-WTY-

1YR (T820)

2575 HW

Maintenance

Appliance Support and Warranty 1-Year for T800, T1200, T820, T1220

TS-ENTPRS-FW-

UNIT

3156A SW License Tufin Enterprise per Firewall Unit. (Enterprise Licensing)

Option Year Period 3

TF-HW-WTY-1YR

(T1220)

2575 HW

Maintenance

Appliance Support and Warranty 1-Year for T800, T1200, T820, T1220

TF-HW-WTY-1YR

(T820)

2575 HW

Maintenance

Appliance Support and Warranty 1-Year for T800, T1200, T820, T1220

TS-ENTPRS-FW-

UNIT

3156A SW License Tufin Enterprise per Firewall Unit. (Enterprise Licensing)

TO FAIR OPPORTUNITY

ACQUISITION TITLE: “Firewall Security Management Tool - Tufin Support”

Page 4 of Treasury Standard Form – 1014 (Rev 12/24)

Prescribed by Treasury: DTAP 1016.505 Tracking No.

Option Year Period 4

TF-HW-WTY-1YR

(T1220)

2575 HW

Maintenance

Appliance Support and Warranty 1-Year for T800, T1200, T820, T1220

TF-HW-WTY-1YR

(T820)

2575 HW

Maintenance

Appliance Support and Warranty 1-Year for T800, T1200, T820, T1220

TO FAIR OPPORTUNITY

ACQUISITION TITLE: “Firewall Security Management Tool - Tufin Support”

Page 5 of Treasury Standard Form – 1014 (Rev 12/24)

Prescribed by Treasury: DTAP 1016.505 Tracking No.

TS-ENTPRS-FW-

UNIT

3156A SW License Tufin Enterprise per Firewall Unit. (Enterprise Licensing)

3.b Includes IT: Yes ☐ No NAICS: 541519 and PSC 7J20 3.c IGCE/Estimated dollar value:

The IGCE contains a 12-month base period and three 12-month option periods. The total amount of $1,944,315.79. See breakdown:

Base Period: 9/30/2026-9/29/2027 $799,261.11 Option Period 1: 9/30/2027-9/29/2028 $354,634.21 Option Period 2: 9/30/2028-9/29/2029 $381,684.61 Option Period 3: 9/30/2029-9/29/2030 $408,735.86

4.a Identification of the exception to fair opportunity being used:

☐ FAR 16.505(b)(2)(i)(A) – The agency need for the supplies or services is so urgent that providing a fair opportunity would result in unacceptable delays.

☐ FAR 16.505(b)(2)(i)(B) – Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

☐ FAR 16.505(b)(2)(i)(C) – The order must be issued on a sole-source basis in the interest of economy and efficiency because it is a logical follow-on to an order already issued under the contract, provided that all awardees were given a fair opportunity to be considered for the original order.

☐ FAR 16.505(b)(2)(i)(D) – It is necessary to place an order to satisfy a minimum guarantee.

☐ FAR 16.505(b)(2)(i)(E) – For orders exceeding the simplified acquisition threshold, a statute expressly authorizes or requires that the purchase be made from a specified source.

FAR 16.505(a)(4) – The requirement is for an item peculiar to one manufacturer. (i.e., Brand Name specifications) 4.b Supporting rationale:

Brand name specification FAR 16.505 (a) (4) Tufin Maintenances Services and Consultant Support is a significant factor in supporting the Tufin infrastructure with efficiencies and experience by adjusting to new models which include similar components functionality. From a user perspective, efficiencies are realized through familiarity and training with system equipment and functionality, less disruptive.

The IRS has identified Tufin Enterprise to replace the FireMon Firewall Management Security Manager tool. With the agency’s extensive network of on-premises and cloud-based firewalls, Tufin delivers continuous, real-time network visibility through dynamic topology mapping. The platform integrates with enforcement points—including firewalls, routers, cloud accounts, and Secure Access Secure Edge (SASE) services—via Application Programming Interface (AP)I and Command Line Interface (CLI) access to retrieve live configurations and routing data.

This capability enables Tufin to generate an interactive, unified map that consolidates traffic flows, endpoints, and connectivity paths across hybrid environments.

Tufin provides comprehensive Security Policy Management capabilities, including change tracking, policy optimization and cleanup, device configuration compliance and audit, and network segmentation management. It enhances network visibility through detailed mapping, visualization, and path analysis to support efficient troubleshooting and operational insight.

TO FAIR OPPORTUNITY

ACQUISITION TITLE: “Firewall Security Management Tool - Tufin Support”

Page 6 of Treasury Standard Form – 1014 (Rev 12/24)

Prescribed by Treasury: DTAP 1016.505 Tracking No.

Additionally, Tufin integrates with ServiceNow to support ITSM change management processes. This integration enables automation of key functions such as proactive risk assessment, change request verification, change design and path identification, and target selection, streamlining workflow efficiency and reducing manual intervention.

Tufin will manage all Layer 3 network devices, enabling dynamic generation of comprehensive network device audit reports and facilitating rule cleanup for unused, redundant, overlapping, shadowed, or overly permissive firewall rules. This capability allows teams to quickly fulfill audit requests across all devices in real time and to regularly validate and remove unnecessary rules, thereby reducing the overall attack surface. Through automation, Tufin also standardizes the process of policy creation, modification, and retirement across all enforcement points. Each change, cleanup, and update is executed safely, consistently, and in full compliance with established standards—ensuring faster operations without increasing risk.

Internal review:

Requirement Product A Tufin Product B Centralized review of firewall policies Meets Meets Meets

Policy recommendations based on environment (reordering, redundant, shadowed, etc.

Meets Meets Meets

Rule implementation automation features Meets Meets Meets

Ability for centralized management and logging

Meets Meets Meets

Support for IRS PIV Implementation, TACACS, or SAML

Meets Meets Meets

Direct Vendor Supported ServiceNow Integration (new)

Partially Meets Meets Meets

Must be a US based company

Meets Meets Meets

IPv6 Compliant Meets Meets Does not meet

508 Compliant Meets Does not meet Does not meet Audit logging Meets Meets Meets

TO FAIR OPPORTUNITY

ACQUISITION TITLE: “Firewall Security Management Tool - Tufin Support”

Page 7 of Treasury Standard Form – 1014 (Rev 12/24)

Prescribed by Treasury: DTAP 1016.505 Tracking No.

API that does not require username/password authentication to use and is well documented

Does not meet Meets Partially meets

Customizable rule auditing reports

Meets Meets Meets

Centralized rule change tracking (who what when where)

Meets Meets Meets

Customizable compliance reporting

Meets Meets Meets

Support for custom SSL Certs

Meets Meets Meets

Role Based Access Controls

Meets Meets Meets

Active Directory Support for user level access

Meets Meets Meets

Must support Cisco (including VRF's), F5, Palo Alto, Fortinet for path analysis

Does not meet Meets Meets

Hardware and virtual appliances available

Meets Meets Meets

Partial policy shadowing review

Does not meet Meets Does not meet

Object based search of firewall policy

Does not meet Meets Does not meet

Real Time detailed analysis of policy utilization

Does not meet Meets Does not meet

TO FAIR OPPORTUNITY

ACQUISITION TITLE: “Firewall Security Management Tool - Tufin Support”

Page 8 of Treasury Standard Form – 1014 (Rev 12/24)

Prescribed by Treasury: DTAP 1016.505 Tracking No.

Infoblox IPAM integration

Does not meet Meets Does not meet

Qualys Scan result integration

Meets Meets Meets

Supports SASE Solutions

Meets Meets Meets

Supports AWS Govcloud Security Groups

Meets Meets Does not meet

User defined workflows

Meets Meets Meets

Multi-Site High Availability

Meets Meets Meets

Tufin is fully compliant with IRS IPv6 requirements and satisfies the enterprise's technical, security, and operational needs. In contrast, Products A and B contain multiple critical deficiencies—including the lack of Virtual Routing and Forwarding (VRF) support, missing mandatory integrations, outdated API authentication methods, and incomplete compliance with IRS security and operational requirements—that cannot be mitigated or accepted within the IRS enterprise environment. As a result, Tufin is the only solution that meets the comprehensive technical, cybersecurity, integration, and future-state network architecture requirements necessary for deployment across the IRS enterprise.

5. A determination that the anticipated cost to the Government will be fair and reasonable:

This requirement will be competed among Tufin resellers under the NASA SEWP V GWAC holders. All contractors responding to the notice of fair opportunity can submit a quote and have that quote fairly considered. Total evaluated price shall be the basis for evaluating price for award. Discounts offered by each quoter to its NASA SEWP V Contract price list will be evaluated. The Contract Specialist will determine fair and reasonable prices at the outset of adequate price competition in NASA SEWP GWAC (Government-Wide Acquisition Contract).

6.a Any other facts supporting this justification:

This investment aligns with and supports Cybersecurity and Infrastructure initiatives. The Tufin Firewall solution will provide developers, internal service providers, end users, and external IRS customers with a secure, stable, and seamlessly connected environment.

Tufin ensures the security and reliability of network data transfers, reinforcing the IRS’s commitment to maintaining a resilient and compliant infrastructure.

TO FAIR OPPORTUNITY

ACQUISITION TITLE: “Firewall Security Management Tool - Tufin Support”

Page 9 of Treasury Standard Form – 1014 (Rev 12/24)

Prescribed by Treasury: DTAP 1016.505 Tracking No.

6.b Attachments: Yes ☐ No IGCE, SOW and Acq Plan

7. A statement of the actions, if any, the Requiring Activity and Contracting Activity may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies and services is made:

IRS will continue to pursue market research, issue Request for Information requesting new solutions and the feasibility of utilizing other technologies. Also, IRS management will plan an acquisition strategy that complies with the requirements to obtain maximum competition in the future.

Failure to fully fund the Tufin acquisition will prevent the IRS from deploying a modern, integrated solution capable of enhancing firewall ticketing, policy management, and IRM compliance for policy synchronization and recertification across multiple IRS agencies. This shortfall will significantly impair the agency’s ability to meet Trusted Internet Connections (TIC) 3.0 and IRM compliance requirements, resulting in a degradation of policy consistency and weakening of overall cybersecurity posture. Without an operational firewall policy management tool, essential functions such as policy auditing, monitoring, recertification, incident response, and forensic analysis will be severely limited—heightening the risk of undetected cyber threats and delaying recovery during security incidents.

In addition, the absence of an effective policy monitoring capability increases the likelihood of audit findings, operational downtime (particularly during Filing Season), and potential exposure of taxpayer data. These operational and compliance gaps would elevate security, reputational, and mission risks during periods of peak network and data activity. I

8. Certifications and Approvals:

8.a Program Office Certification (Requiring Activity). I hereby certify that any supporting information and data provided (e.g., the Government’s minimum needs or requirements, or other rationale for the limited sources) and which form the basis for this justification for an exception to fair opportunity, are accurate and complete to the best of my knowledge and belief.

Name: Lisa Connor Date:

Lisa McVay Connor Digitally signed by Lisa McVay ConnorSignature: Date: 2026.09.02 12:42:05 -04'00'

8.b Contracting Officer Certification and Approval. I certify this justification for an exception to fair opportunity is accurate and complete to the best of my knowledge and belief.

Therefore, unless additional approvals are required as prescribed below, as the authorized contracting officer for this acquisition, I hereby approve the processing of this requirement based on the authority specified in 4.a above.

Name: Fatima Paen Date:

Signature: Fatima A. Paen Digitally signed by Fatima A. Paen Date: 2026.09.02 13:38:24 -04'00'

9. Additional Reviews and Approvals (As applicable):

9.a Bureau Chief Information Officer or Authorized Designee (for IT requirements that are over $5 million, but not exceeding $90 million) (Contracting Activity). I have reviewed

TO FAIR OPPORTUNITY

ACQUISITION TITLE: “Firewall Security Management Tool - Tufin Support”

Page 10 of 4 Treasury Standard Form – 1014 (Rev

12/24) Prescribed by Treasury: DTAP Tracking No.

this justification and find it to be accurate and complete to the best of my knowledge and belief, and representative of the Government’s need. Therefore, I hereby consent to the approval of this justification. (Note: The Bureau CIO may delegate their authority for proposed contracts over $5 million, but not exceeding $15 million to the Associate Bureau CIO(s).)

Name: Date:

Signature:

9.b Advocate for Competition (if over $900,000, but not exceeding $20 million) (Contracting Activity). I have reviewed this justification for an exception to fair opportunity and find it to be accurate and complete to the best of my knowledge and belief. Therefore, unless additional approvals are required as prescribed below, as the ordering activity’s Advocate for competition, I hereby approve this justification based on the authority specified in 4.a above.

Name: Julius Bradshaw Date:

Signature:

9.c Head of the Procuring Activity or Authorized Designee (if over $20 million, but not exceeding $90 million) (Contracting Activity). I have reviewed this justification for an exception to fair opportunity and find it to be accurate and complete to the best of my knowledge and belief. Therefore, unless additional approvals are required as prescribed below, as the head of the procuring activity or authorized designee, I hereby approve this justification based on the authority specified in 4.a above.

Name: Date:

Signature:

9.d Treasury Chief Information Officer (for IT requirements that are over $90 million). I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief, and representative of the Government’s need. Therefore, I hereby consent to the approval of this justification.

Name: Date:

Signature:

9.e Senior Procurement Executive (if over $90 million) (Contracting Activity). I have reviewed this justification for an exception to fair opportunity and find it to be accurate and complete to the best of my knowledge and belief. Therefore, as the senior procurement executive, I hereby approve this justification based on the authority specified in 4.a above.

Name: Date:

9/10/2026

TO FAIR OPPORTUNITY

ACQUISITION TITLE: “Firewall Security Management Tool - Tufin Support”

Page 11 of 4 Treasury Standard Form – 1014 (Rev

12/24) Prescribed by Treasury: DTAP Tracking No.

Signature: