SSJ_HPE_Webinspect_and_Fortify_Attachment.docx

SOLE SOURCE JUSTIFICATION (SSJ)

UNDER THE SIMPLIFIED PROCEDURES FOR

CERTAIN COMMERCIAL ITEMS

1. IDENTIFICATION OF AGENCY AND CONTRACTING ACTIVITY

Agency: Social Security Administration

Contracting Officer’s Technical Representative:

Project Title: Maintenance for Hewlett-Packard Enterprise (HPE) Webinspect and Fortify.

Proposed Contractor: Authorized Resellers of HPE

Tracking Information: Advanced Procurement Plan (APP) #: OTSO-17-313Z9 Relevant current/previous order #: SS00-16-30227

2. NATURE OF ACTION BEING APPROVED

Type of Action:

__X_ New award ____ Modification of existing award

Contemplated Contract Type:

__X_ Firm fixed-price ____ Time and materials/labor hour ____ Combination

We seek approval of a SSJ to obtain the following:

____ Expansion of mainframe software licensing required for compliance with our license agreement, due to agency mainframe hardware capacity increases. Since commercial mainframe software companies commonly license software based on the capacity of the mainframe hardware on which we install software, we are responsible for expanding our mainframe software licenses commensurate to the hardware capacity each time we upgrade mainframe hardware.

__X_Maintenance of Webinspect and Fortify software, manufactured by HPE.

We will solicit a proposal and award a single firm-fixed-price award to any authorized reseller of HPE for a one-year period.

3. DESCRIPTION OF SUPPLIES/SERVICES AND ESTIMATED VALUE

Estimated Cost:

WebInspect is a penetration-testing tool with a focus on web application security. WebInspect finds vulnerabilities in database security before a hacker can and then mitigates them in a timely fashion. Fortify scans source code for common coding errors that can lead to exploitable vulnerabilities. This tool discovers weaknesses in the early life cycle for agency developed applications. Developers can than alter the code to remove these before the application is released into production. These products are used in OSOHE and the Office of Information Systems (OIS).

This software is currently deployed for the following programs:

· Software Development Security Project

· Enterprise Penetration Testing Program

· Vulnerability Management Program

The maintenance subscription for HPE software includes updates, fixes and patches, as well as online and telephone technical support, allowing the software to remain operational in a changing environment. Maintenance allows us access to the latest changes and security patches, and allows the software to continue to operate in a changing environment.

4. IDENTIFICATION OF STATUTORY AUTHORITY PERMITTING OTHER THAN FULL AND OPEN COMPETITION

41 U.S.C. § 1901, as implemented by the Federal Acquisition Regulation (FAR) 13.5—“Simplified Procedures for Certain Commercial Items”.

The acquisition is “commercial” in nature, as defined at FAR Section 2.101, and will be solicited using FAR Part 12, as well as the procedures outlined at FAR 13.500.

The basis for restricting competition is that a reasonable basis exists for concluding that the agency’s minimum needs can only be satisfied by:

___ (1) Unique supplies or services available from only one source or only one supplier with unique capabilities __x_ (2) The existence of limited rights in data, patent rights, copyrights, or secret processes; the control of basic raw material; or similar circumstances, make the supplies and services available from only one source

5. DEMONSTRATION OF CONTRACTOR'S UNIQUE QUALIFICATIONS

HPE is the copyright holder for HP software. Only HPE has the right to issue an enterprise license for this software. Furthermore, while HPE does not sell directly to the government, the company requires agencies to purchase through authorized resellers, since HPE and its authorized resellers have legal access to the proprietary source code necessary to provide software maintenance. Software maintenance includes a subscription to version upgrades, updates, fixes and patches, as well as telephone support for resolving issues.

Continued maintenance of these HP software products is essential. Access to upgrades, updates, and fixes and patches ensures software continues to be compatible with the operating system and is in good working order. Without maintenance, these is potential for a major delay in normal day-to-day and essential operations. Any interruption to maintenance can severely affect our service to the public.

6. EFFORTS MADE TO SOLICIT FROM AS MANY POTENTIAL SOURCES AS IS PRACTICABLE

___ FedBizOpps Sources Sought posted from XXXXX to XXXXXX, and a copy is included in the contract file.

_X__ FedBizOpps Synopsis of Proposed Contract Action posted from 03/02/2017 to 03/08/2017, and a copy is included in the contract file.

____ Responses received listed under item 10 below.

__X No responses received. (Responses received from HP resellers only)

Based on the results of the posting, as well as market research described in item 8 below, we do not believe there are any entities other than authorized resellers with similar capabilities at this time.

7. DETERMINATION BY THE CO THAT THE ANTICIPATED COST TO THE GOVERNMENT WILL BE FAIR AND REASONABLE PRICE

In accordance with FAR Part 15.404, the CO will perform a final price analysis in order to determine the eventual awardee’s proposed price is fair and reasonable.

8. DESCRIPTION OF MARKET RESEARCH

See Section 6 above.

These software products are proprietary products licensed to the agency. Market research has confirmed that HPE Company is the copyright holder of this software; therefore, the only known source capable of providing the required software and maintenance is HPE Company and their authorized resellers. Market research indicates there are at least three authorize resellers, Immixtechnology, Carahsoft and Integrio.

Additionally, __X_ We used market research conducted within 18 months of the anticipated award date. Therefore, we consider the information still current, accurate, and relevant.

__X_ When examining whether this is a requirement for Commercial vs Non-Commercial items, market research helped determined that this requirement involves __X_A) Items of a type customarily available in the commercial marketplace;

____ B) Items of a type customarily available in the commercial marketplace with modifications; or ____ C) Items used exclusively for governmental purposes (i.e. not commercially available).

Market research helped determine ____ Customary practices regarding customizing, modifying, or tailoring of items to meet customer needs and associated costs;

____ Customary practices, including warranty, buyer financing, discounts, contract type considering the nature and risk associated with the requirement, etc., under which commercial sales of the products or services are made;

____ Requirements of any laws and regulations unique to the item needed;

____ Availability of items that contain recovered materials and items that are energy efficient;

X Distribution and support capabilities of potential suppliers, including alternative arrangements and cost estimates; and ____ Size and status of potential sources (see FAR Part 19).

X Techniques for conducting market research include any or all of the following:

____ (i) Contacting knowledgeable individuals in government and industry regarding market capabilities to meet requirements.

____ (ii) Reviewing the results of recent market research undertaken to meet similar or identical requirements.

__X_(iii) Publishing formal requests for information in appropriate technical or scientific journals or business publications.

____ (iv) Querying the government-wide database of contracts and other procurement instruments intended for use by multiple agencies available at https://www.contractdirectory.gov/contractdirectory/ and other government and commercial databases that provide information relevant to agency acquisitions.

____ (v) Participating in interactive, on-line communication among industry, acquisition personnel, and customers.

____ (vi) Obtaining source lists of similar items from other contracting activities or agencies, trade associations or other sources.

____ (vii) Reviewing catalogs and other generally available product literature published by manufacturers, distributors, and dealers or available on-line.

____ (viii) Conducting interchange meetings or holding presolicitation conferences to involve potential offerors early in the acquisition process.

____ Additional information, sources, comments

9. ANY OTHER SUPPORTING FACTS

HPE sells directly to the government. There are also authorized resellers.

In accordance with FAR 4.1102, 4.1201, and 9.401, upon selection of an awardee, the CO will examine the System for Award Management in order to make an affirmative determination of the contractor’s responsibility.

10. LIST OF SOURCES EXPRESSING INTEREST IN THE ACQUISITION IN WRITING

No other sources have expressed an interest in this acquisition.

11. ACTIONS AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS TO COMPETITION BEFORE ANY SUBSEQUENT ACQUISITION IS REQUIRED

We will continue to survey the market place by synopsizing our requirement and reviewing product literature and capability statements submitted by the vendor community.

CONTRACTING OFFICER’S TECHNICAL REPRESENTATIVE (COTR) AND PROGRAM OFFICIALS’ RECOMMENDATION

AND CERTIFICATION

The COTR and other program officials hereby certify that the information provided in support of the justification for an exception to fair opportunity, and which forms the basis for this justification, is accurate and complete.

CERTIFICATION BY THE CONTRACTING OFFICER AND

OTHER CONTRACTING OFFICIALS

The contracting officer and other contracting officials hereby certify that the information provided in support of this justification for an exception to fair opportunity is accurate and complete to the best of their knowledge and belief.