Brand_Name_Justification-_SB1341-15-RQ-0280.pdf

SUBJECT: Brand Name Only Justification

TITLE: Check Point Hardware, Software, Maintenance and Support

SOLICITATION NUMBER: SB1341-15-RQ-0280

Use of the statutory authority 41 USC 3304(a)(5) requires that the supplies or services required by the agency must be of a particular brand name.

This is a Brand Name Only requirement for Check Point hardware, software, maintenance and support. The NIST Network Security Team uses strategically placed Check Point firewalls to provide network security protection for both NIST campuses. Additionally, NIST uses Check

Point Intrusion Prevention System (IPS) blades on all Internet-facing firewalls.

The NIST firewall infrastructure is based on Check Point and Nokia products (in 2009 Check

Point acquired the Nokia security appliance business). The firewall infrastructure consists of

Check Point and Nokia firewalls running the Check Point firewall application, Check Point management devices, and other devices supporting firewall management. The firewalls are considered a moderate availability service at NIST; therefore, firewall appliances are deployed in redundant pairs with one active and one standby appliance at each enforcement point. Because the NIST firewall infrastructure is based on Check Point products, the refreshment of the existing infrastructure must also be Check Point products, to allow for uninterrupted service and unnecessary costs.

On the Gaithersburg campus, there are seven pairs of Check Point firewall appliances; two pairs are Internet-facing; 5 pairs are internal firewalls protecting infrastructure servers as well as OU specific network segments. On the Boulder campus, there are four pairs of Check Point firewall appliances; two pairs are Internet-facing; two pairs are internal firewalls protecting infrastructure servers as well as OU specific network segments. NIST also runs two Check Point firewalls “in the cloud” within Amazon Web Services (AWS).

The drivers for this procurement are the need for periodic hardware refreshment, the ever increasing demand for more Internet bandwidth, and the expansion of firewall protection “to the cloud.” As for hardware refreshment, with an organization such as NIST with a technology mission, it is common for network devices to be refreshed every 5 years. We are continuing that refreshment process with this procurement. As for the increasing demand for more Internet bandwidth, NIST Gaithersburg currently has 48M of Internet bandwidth which is expected to increase to 2G (2,000M) this year. As for the expansion of firewall protections “to the cloud,” while NIST does not own hardware “in the cloud,” the Check Point policy, management, and logging services will be provided by Check Point appliances located on the NIST campuses.