A-13_12_Pt_Sole_Source_Redacted.pdf

BRAND NAME JUSTIFICATION

(1) Identification of the agency and the contracting activity.

Dept. of Commerce

National Institute of Standards and Technology

Acquisition Management Division

325 Broadway, Div. 164, Bldg. 111, M.S. 194

Boulder, CO 80305

(2) Nature and/or description of the action being approved.

This is a Brand Name Justification for other than full and open competition prepared in accordance with Federal

Acquisition Regulation (FAR) 13.501(a) and in order to issue an acquisition under the authority of FAR 13.5

Simplified Procedures for Certain Commercial Items. This action is necessary to replace (8) firewall appliances with four (4) higher-end appliances along with licenses to run numerous virtual firewalls on each pair of replacement appliances and security “blades” to enhance network security functionality. The current firewall appliances on the Boulder campus will reach end of life in early 2017 at which time they will no longer be supported by the vendor.

(3) A description of the supplies or services required to meet the agency’s needs (including the estimated value).

Four (4) Model 23800HPP High Performance Firewall Appliance with Next Generation Threat

Protection

Virtual System Licensing - CPSB-VS025 (25 Virtual System package)

Premium Software Support and Maintenance for 9 months to be added to Check Point User Center #

6598303

Estimated value:

(4) An identification of the statutory authority permitting sole source (including Brand Name) acquisitions.

The statutory authority permitting Brand Name acquisition is made pursuant to FAR 13.501, Special

Documentation Requirements, which implements 41 U.S.C. 1901.

(5) A demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the authority cited.

NIST has built the firewall component of its network security infrastructure on Check Point hardware and software. On the Gaithersburg campus, there are seven pairs of Check Point firewalls; two pairs are Internet-facing; 5 pairs are internal firewalls protecting infrastructure servers as well as OU specific network segments.

On the Boulder campus, there are five pairs of Check Point firewalls; two pairs are Internet-facing; three pairs are internal firewalls protecting infrastructure servers as well as OU specific network segments. NIST also runs two Check Point firewalls “in the cloud” within Amazon Web Services (AWS). Additionally, NIST has deployed a redundant Check Point management system with manager servers deployed to both campuses, ensuring continuation of firewall operations in the event of a failure, damage, or disaster occurrence on either campus.

Purchasing incompatible firewall hardware and software would splinter firewall security services at NIST into two independent security infrastructures with separate and independent administration, firewall management services, and log management. Firewall policies consistent of hundreds of integrated protection “rules” per firewall and thousands of shared defined network “objects”. Two firewall infrastructures would prevent NIST from taking advantage of those economy of scale from a rule-base perspective. Besides the negative technical implications of independent firewall security infrastructures, this would impose a substantial learning curve for government employees and potentially require additional staff to manage separate security infrastructure.

Due to the proprietary nature of firewall products, the hardware, software and maintenance are commingled.

Check Point hardware/software, maintenance and technical support are only available through manufacturer approved and authorized vendors.

(6) A description of efforts made to ensure that offers are solicited from as many potential sources as is practicable, including whether a notice was or will be publicized as required by Subpart 5.2 and, if not, which exception under 5.202 applies.

Market research was conducted to determine authorized resellers.

To ensure quotations are solicited from as many potential sources as possible, this RFQ will be posted to

Fed Biz Ops to promote maximum competition.

(7) A determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

A previous contract, SB1341-15-AE-0031, was awarded for similar items to a Checkpoint reseller. The

Government will be able to use historical pricing as a means to ensure a fair and reasonable price is achieved. Additionally, an IGE was developed which will also aid in determining fair and reasonableness. Lastly, competition among resellers will establish a fair market price for the items.

(8) A description of the market research conducted (FAR Part 10) and the results or a statement of the reason market research was not conducted.

The Program Office contacted 3 authorized CheckPoint resellers.

The Contract Specialist (CS) reviewed GSA for sources and found 4 sources available, 2 of whom were small business, only one of which was most likely to be able to fulfill the requirement. A Request for Information was posted on e-Buy with CheckPoint resellers holding GSA contracts directly notified of the posting. The posting resulted in 3 responses of suppliers unable to provide the requested products. No responses were received from the CheckPoint schedule holders.

(9) Any other facts supporting the use of Brand Name Items:

None

(10) A listing of the sources, if any, that expressed, in writing, an interest in the acquisition.

Fortinet, Inc., Bryan Skelton, bskelton@fortinet.com, (910)340-0473

Patriot (Fortinet reseller), Abby Gurian, agurian@partiort-tech.com, (301)695-7500

Mad Security, Kevin J. Belcher, kbelcher@madsecurityinc.com, (603)766-4965

(11) A statement of the actions, if any, the agency may take to remove or overcome any barriers to competition before any subsequent acquisition for the supplies or services required.

NIST continues to use solicitation methods to promote commercial firms for these types of service. NIST attempts to increase the competition base for its unique requirements through the use of market research and public announcements. As requirements continue, NIST will continue to research for GSA vendors as well as open market vendors that can fill the agency’s needs.

Inquiries from possible suppliers to the contract specialist are referred to the technical point of contact for evaluation relating to the POC’s needs.

http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/05.htm#P55_9233 http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/05.htm#P66_10346 http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/10.htm#TopOfPage bskelton@fortinet.com mailto:agurian@partiort-tech.com mailto:kbelcher@madsecurityinc.com

(12) CERTIFICATIONS:

I hereby certify that this justification for other than full and open competition is accurate and complete to the best of my knowledge and belief.

Date

Date