SAM JEFO Redacted 9.24.25.pdf

Attachment 6 U.S. Customs and Border Protection

Justification for Exception to Fair Opportunity (JEFO) – FAR 16.505

Version 2.0 November 2020

Date: 07/23/2025 PR Number: 2014-8622

1. Agency and Contracting Activity.

The Department of Homeland Security (DHS), U.S. Customs and Border Protection (CBP), Office of Information and Technology (OIT), Cyber Security Directorate (CSD) and the CBP Office of Acquisition, Information Technology Contracting Division (ITCD) prepared this brand name justification for exception to fair opportunity.

2. Nature and/or description of the action being approved.

CBP intends to use a brand name specification pursuant to FAR 16.505(a)(4) for the procurement of JFrog Enterprise+ software licenses and annual maintenance, which is an artifact repository (repo) manager that is language-agnostic and allows for a high-availability and secure repo that is secure and stable. In order to support multiple development teams using multiple languages, CBP requires a repository that supports software packages created by different languages and technologies, support for Docker images and security scanning of artifacts, including AI models, stored in the repository.

CBP proposes to award one Firm-Fixed-Price delivery order, competed as a 100% total small business set aside among authorized resellers of JFrog Enterprise+ under the NASA SEWP V multiple award indefinite-delivery/indefinite quantity (IDIQ) contract vehicle.

Pursuant to FAR 16.505(a)(4), restricting consideration to an item peculiar to one manufacturer (e.g., a particular brand-name, product, or a feature of a product that is peculiar to one manufacturer) must be justified.

3. A description of the supplies or services required to meet the agency’s need (including the estimated value).

CBP proposes to award a firm fixed-price delivery order for new software of JFrog Enterprise+ licenses.

CSD, Cyber Security Engineering (CSE) in its goal to implement a state-of-the-art SecDevOps capability, will require the above JFrog Enterprise+ tool to provide a binary Artifactory repositor, Advanced Security with the XRay scanning tool, and an Application Firewall to ensure internet-based software is scanned prior to entering the software development environment within the CBP domain. JFrog also provides advanced application security (AppSec) code weakness detection, application firewall protection, Gitlab repository scanning, and AI Model scanning features allowing cybersecurity risk reporting and software code fixes for CBP customized software and binary software coming into CBP from the internet.

The software must be able to provide the following:

The minimum requirements to achieve the objectives of an on-premises repository, X-Ray scanning tool for the CI/CD pipeline, and an application firewall to verify ingress binary software coming from the internet includes:

1. Repository Manager:

An Enterprise-wide repository is required to house incoming binary software from the internet including Docker images. The repository must be compatible with an integrated Application Firewall to ensure internet ingress software packages are automatically scanned for malware prior to entering the CBP domain. The repository manager must allow for on-premises CBP domain installation and work in a high-availability Kubernetes environment and finally support automatic repository replication to ensure shared repositories are synchronized.

2. Repository Manager and AI:

The repository must allow for the storage, retrieval, and scanning of Artificial Intelligent models and supporting software.

3. Application Firewall:

An Application Firewall is required to facilitate scans of ingress binary software and AI models from the internet prior to the software entering a development environment within the CBP domain. The Application Firewall must fully integrate with the Repository Manager and provide automatic scans when internet based software is downloaded from an external source.

4. Advanced Security:

The Repository, Firewall, and Scanning tools are required to be compatible and work to achieve Advanced Security. This includes data sharing, reporting, and executing on-demand scans of software packages. Advanced security identifies code weaknesses and recommends fixes when scans are triggered from either the IDE desktop or directly from the tool’s user interface .

5. Software Language and Package Type Support:

Due to the vast array and diversity of internet based software packages, a requirement to support a large number of packages and software languages is needed for internet-supply chain scanning software.

6. Scan from Desktop within Developer’s Environment:

The ability for software developer’s to scan from their desktop within an Integrated Development Environment (IDE) is a key requirement to push application security practices to the left of the software development build cycle.

7. An On-Premise Solution which Offers Fast Scan Times and a local Software Resident Scanner must be installed on-premise to ensure fast scan times and to ensure software is kept within the agencies domain.

8. Integrated Reporting Full report integration between the Repository, Firewall, and Scanner is a requirement to ensure Cyber Threats are understood and presented in a holistic manner

The estimated price of this procurement is $

The period of performance is a one-year base period.

4. Identify the exception to fair opportunity and supporting rationale, including a demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the exception cited.

____X_____FAR 16.505(b)(2)(i)(B). Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized. [Brand Name]

This procurement is in accordance with FAR 16.505(a)(4)(ii) – Use of brand name specification.

The exceptions at FAR 16.505(b)(2) do not apply as this is a brand-name justification. However, the justification format at FAR 16.505(b)(2)(ii)(B) applies and is modified to reflect a brand-name justification. Fair opportunity will be limited to small business vendors under the NASA SEWP V vehicle who are authorized resellers of JFrog products, or who have business relationships with authorized resellers that permit them to provide the required JFrog products.

Rationale:

Only one source is capable of providing the supplies required as they are peculiar to one manufacturer, JFrog, Inc.

The marketplace for an Artifact Repository consists of two products: the JFrog Artifactory and the Nexus Sonatype. At the Repository level, both products are relatively equal in nature. The difference is that JFrog, in addition to providing the repository, also provides Advanced Security using the Xray product feature which scans for security vulnerabilities in binary software components, Docker Images, AI models and supporting software. JFrog provides a fully integrated, built-in application firewall component within Artifactory named Curation. The Sonatype Firewall is not integrated with the repository and does not offer integrated reporting.

Curation scans software coming in from the internet, including AI models, prior to saving the artifacts within the CBP domain. JFrog’s Advanced Security features offer the capability to scan both source code and binaries stored within the Repository and by software developers on their desktop.

No other companies’ similar products meet, and cannot be modified to meet, the agency’s needs.

Sonatype has a similar repository component named Nexus. Nexus does not provide a fully integrated application firewall scanner. In addition, the Nexus repository does not support AI model storage nor does it have AI model security scanning capabilities. JFrog allows for download and application of patches that would be applied by CBP locally, whereas, Nexus requires internet connectivity in order to upload data to their servers. Due to DHS OneNet Security guidelines this would not be a viable option since connecting to the internet would make CBP data vulnerable to security breaches; this is why a fully on-Premise repository solution is required.

The use of the JFrog Enterprise+ software will minimize server downtime, support high availability network configuration with a cluster of two of more Artifactory servers on the same local area network (LAN). This means that if one server goes down, the service will continue undisrupted.

Artifactory is the single tool that “talks” to all the different technologies, increasing productivity, reducing maintenance efforts and promoting automated integration between the different parts.

Designed from the ground up to fit into any development ecosystem, Artifactory manages any repository layout offering native-level support for all major package formats, including the platform on which the CBP production environment is based.

Multilayer analysis of containers, software artifacts, and AI models are possible for vulnerabilities, license compliance and quality assurance, and to continuously govern and audit all artifacts consumed and produced in the CI/CD pipeline. JFrog Xray performs artifact analysis for all major package formats across the CI/CD pipeline.

5. Determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

The Contracting Officer anticipates adequate price competition is available amongst the NASA SEWP V small business vendors to determine pricing as fair and reasonable. NASA SEWP V is a Best in Class, category management approved vehicle to acquire commercially available IT commodities to support DHS business units in accomplishing their assigned missions. The Contracting Officer will use various price analysis techniques to determine a fair and reasonable price, including a comparison of proposed prices received and a comparison to the Independent Government Cost Estimate.

6. Any other facts supporting the justification.

None.

7. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made.

CBP will continue to conduct market research to determine if the market has changed and if a better solution becomes available. Furthermore, as CBP moves to the cloud, additional market research is being conducted with various cloud and “software as a service providers” to