JA_Splunk HW_Redacted.pdf

DEFENSE LOGISTICS AGENCY

CONTRACTING SERVICES OFFICE - PHILADELPHIA

700 ROBBINS AVENUE

PHILADELPHIA, PENNSYLVANIA 19111-5092

JUSTIFICATION AND APPROVAL

FOR OTHER THAN FULL AND OPEN COMPETITION

1. IDENTIFICATION OF THE AGENCY AND CONTRACTING ACTIVITY.

2. NATURE AND/OR DESCRIPTION OF THE ACTION BEING APPROVED.

This justification authorizes the use of other than full and open competition for the procurement of brand name specific Hewlett Packard Enterprise (HPE) Splunk UBA Hardware and Support to support Splunk UBA application for DLA’s Insider Threat Program. The solicitation will be issued via Open Market procedures as a Combined Synopsis/Solicitation-Request for Proposal (RFP) posted to the Contract Opportunities on the Beta.SAM.gov website, which has replaced the Federal Business Opportunities (FBO) website. The award of a firm-fixed price contract is contemplated.

3. A DESCRIPTION OF THE SUPPLIES OR SERVICES REQUIRED TO MEET

THE AGENCY’S NEEDS/ESTIMATED DOLLAR AMOUNT.

The Cybersecurity Technology is in need of procuring the HPE Splunk UBA Hardware and Support that will add additional capabilities to the Insider Threat. HPE Splunk User Behavioral Analytics (UBA) Hardware is specifically designed to maintain the large amounts of cybersecurity security events that are processed by the Splunk UBA software. HPE’s Solid State Drives provide Splunk UBA the ability to ingest and provide real-time integration and collection of logs and events from multiple sources, allowing rapid identification of

For Official Use Only (FOUO) Source Selection Information – See FAR 2.101 and 3.104

Page 1 or 7

SPLUNK Hardware & Support

For Official Use Only (FOUO) security and performance issues from across the network. The HPE hardware was engineered to meet all the UBA software specifically, providing DLA with the ability to protect against adversaries that are continuously attempting to compromise US National Defense Systems and Networks every day. The success of the mission also relies on availability and performance of the HPE hardware. The HPE Hardware requires support in order to provide next day replacement parts in the event of hardware failure. This system is a critical portion of DLA’s Cybersecurity posture and all hardware pieces are required by DoD guidelines to have support in order to replace any hardware failures. The full breakdown of items can be found in Attachment 1_BoM_Splunk HDW.

4. IDENTIFICATION OF THE STATUTORY AUTHORITY PERMITTING

OTHER THAN FULL AND OPEN COMPETITION:

The statutory authority permitting other than full and open competition is Title 10, U.S.C 2304 (c),(1), as implemented by the Federal Acquisition Regulation (FAR) 6.302-1, “Only one responsible source and no other supplies or services will satisfy the agency requirement.”

Only authorized resellers of brand name, HPE, are able to provide the required Splunk Hardware and Support for the DLA.

5. DEMONSTRATION THAT THE PROPOSED CONTRACTOR’S

UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITIONS REQUIRES USE OF THE AUTHORITY CITED:

In accordance with FAR 6.302-1, the HPE brand name is essential to the Government’s requirement because the supplies or services required by the agency are available from only one responsible source, and no other type of supplies or services will satisfy the agency’s requirements. A brand name product, whether available on one or more contracts, is an item particular to one manufacturer and may be procured by brand name specification if essential to the Government’s requirements. The HPE brand name is essential to the Government’s requirements, thereby precluding consideration of products manufactured by another company.

DLA requires brand-name specific HPE Splunk UBA Hardware and Support for the DLA Insider Threat software. Without this brand-name HPE Splunk Hardware and Support, the Agency will be unduly impacted by not having access to patches and updates for DLA’s existing HPE hardware, as well as all other associated mission-critical hardware and software currently in use by the Agency in order to comply with Joint Task Force Global Network Operations (JTF-GNO) and Defense Logistics Agency

Computer Emergency Response Team (DLA-CERT) policy. Failure to respond to vulnerabilities and upgrade taskings would result in non-compliance with policy and potential disconnection from the DoD network by the Defense Information Systems Agency (DISA), the DoD Agency responsible for network connectivity.

HPE Splunk UBA Hardware and Support is essential to the Government’s requirement of maintaining system continuity, system integration and efficiency in operations. Splunk UBA is licensed by the amount of data that is collected on a daily basis versus the number of end users or devices that are being monitored by the software. DLA has purchased a 800 GB license to satisfy our UBA logging requirements. In the event that the HPE hardware would suffer a hardware failure DLA CERT and DLA Insider Threat programs would be blind to any possible insider threat attacks until the hardware issue is resolved.

Market research indicates other companies’ similar products do not meet, nor can they be modified to meet, the agency’s needs. Although other products exist, which perform the same functions as the required HPE Splunk UBA Hardware and Support, these products do not meet the Government’s requirements because only HPE servers are compatible and interoperable with existing HPE hardware in use by the Government.

Use of non-HPE equipment to meet this requirement would inhibit DLA Information Operations’ (J6) computers from being interoperable and sharing information amongst DLA computers configured with the HPE equipment already in use, creating an unacceptable level of performance risk, including risk of mission failure. HPE Splunk UBA Hardware and Support is owned by HPE and is available only through the original equipment manufacturer, HPE, and its designated resellers.

6. DESCRIPTION OF EFFORTS MADE TO ENSURE THAT OFFERS ARE

SOLICITED FROM AS MANY POTENTIAL SOURCES AS IS

PRACTICABLE:

This requirement will be solicited as a 100% Small Business Set-Aside via a Combined Synopsis Solicitation Request for Proposal (RFP) posted to the Beta.Sam website. All authorized small business resellers of HPE will be given an opportunity to submit a quote.

HPE is the only known company that provides Splunk UBA Hardware and Support. The introduction of similar software provided by different sources would require significant expenditures of funding to obtain the new product. It would also require significant training efforts that would demand unacceptable resource reallocation. Finally, it would cause significant schedule delays resulting in mission day-to-day failure.

7. DETERMINATION BY THE CONTRACTING OFFICER THAT THE

ANTICIPATED COST TO THE GOVERNMENT WILL BE FAIR AND

REASONABLE:

As the Contracting Officer, I hereby determine that pricing will be fair and reasonable based on pricing analysis in accordance with FAR 15.404-1. It is anticipated that the Government will use various prices analysis techniques including, but not limited to:1) comparison of proposed prices received in response to the solicitation (reference FAR 15.404-1(b)(2)(i); 2) comparison with competitive published price lists (reference FAR 15.404-1(b)(2)(iv); and

3) comparison of proposed prices with prices obtained through market research of the same or similar items (reference FAR 15.404- 1(b)(2)(vi)), in order to obtain a fair and reasonable price.

8. A DESCRIPTION OF THE MARKET RESEARCH CONDUCTED AND THE

RESULTS OR A STATEMENT OF THE REASONS MARKET RESEARCH

WAS NOT CONDUCTED:

Market research was conducted by the Contract Specialist in conjunction with the Program Management Office via open market email request, a Request for Information (RFI) posted on the NASA SEWP V website, and a Sources Sought announcement posted to GSA eBuy website.

Since two or more small business authorized HPE resellers responded to the open market research request and demonstrated ability to support the requirement, the current requirement will be solicited as a 100% Small Business Set-Aside via a Combined Synopsis Solicitation Request for Proposal (RFP) posted to the Beta.Sam website.

9. ANY OTHER FACTS SUPPORTING THE USE OF OTHER THAN FULL

AND OPEN COMPETITION:

N/A

10. A LISTING OF SOURCES, IF ANY, THAT EXPRESSED, IN WRITING, AN

INTEREST IN THE ACQUISITION:

11. A STATEMENT OF ACTIONS, IF ANY, THE AGENCY MAY TAKE TO

REMOVE OR OVERCOME ANY BARRIERS TO COMPETITION BEFORE

ANY SUBSEQUENT ACQUISITION FOR THE SUPPLIES OR SERVICES

REQUIRED:

At this time, the required HPE Splunk UBA Hardware and Support is the only product that will support DLA’s current requirement and meet the Government’s needs. However, DLA has exercised and continues to exercise competition as often as possible and is required to conduct ongoing reviews to keep abreast of new technology, both in industry and in the Government. DLA uses a variety of vendors, manufacturers, and contracts/orders to fulfill its requirements and will continue its practice of surveying the market to ensure full and open competition to the maximum extent practicable.

J6 is required to conduct ongoing reviews of IT solutions in order to keep abreast of new technology, in both Government and private sectors. According to the IT Solutions document, whenever substantial improvement over presently identified solutions is demonstrated, the existing document will be updated to ensure DLA continues to use the best products and services for their mission requirements.

13. ATTACHMENTS.

Attachment 1_BoM_Splunk HW