CUI_Knox JEFO 2024_69_Sol Attch_Redacted.pdf

Control No.: MICC 2024-69 vulnerabilities using static application security testing, dynamic application security testing, and interactive application security testing technologies. While Fortify is proprietary to Micro Focus Inc., there are several authorized CHESS resellers.

1) HRC provides enterprise level human resources information technology (IT) and data center capabilities to the total Army. To perform this mission the HRC IT infrastructure consists of two data centers located at Fort Knox and Indianapolis which provide over 3700 servers supporting over 5000 customers. The data centers host over 300 human resource (HR) applications and provide direct access to both the North America Southeast (NASE) and Recruiting Services Network (RSN) networks. Essential to the safe and effective operations of this infrastructure are the security thresholds provided by Fortify Software. Fortify is a software security product that identifies and remediates existing and developed software security vulnerabilities to mitigate and/or eliminate enterprise security risks.

2) HRC uses the Micro Focus Fortify suite of application tools on the NASE network to analyze and ensure compliance with Security Technical Implementation Guide (STIG) security protocols. Fortify analyzes application source code to identify and rank security issues and vulnerabilities allowing developers to mitigate those issues prior to deploying to production. Fortify enables developers to identify, analyze, and resolve possible vulnerabilities efficiently. Fortify has the capacity to conduct this analysis automatically on large quantities of code and provide immediate actionable results. HRC has used Fortify software since fiscal year 2015. This procurement ensures that HRC will continue to provide safe and secure application development through the procurement of the latest and most secure Fortify application tools available.

b. Micro Focus Fortify is currently in use in HRC. In advance of award of the prior contract purchasing Fortify licenses, HRC conducted a review of multiple software products that provide software testing capabilities. Critical to this review was to ensure that the software provided both static and dynamic testing capability, capable of reviewing a broad quantity of software languages, support STIG reporting and provide a multitude of additional capabilities. Products such as Veracode, SonorCube, and HCL Technologies each provided many of the capabilities resident within Fortify but not all of them. Veracode required HRC software to be uploaded to their site prior to analysis, SonorCube does not provide dynamic testing and does not provide sufficient security scanning. HCL Technologies is based in India and does not provide sufficient security scanning. For these reasons, these alternatives were rejected at time of initial award.

c. Impact if justification is not approved. The instant action is to ensure continuity in licensing of existing software and proprietary maintenance already utilized in HRC.

Micro Focus is the only manufacturer of the software listed in paragraph 3 and is the only source of patches and updates for the software. Micro Focus provides both the software and maintenance support through multiple approved resellers on the CHESS contract platform. Without this support HRC will not be able to ensure that applications