Tanium ONSITE SUPPORT LSJ REDACT_Redacted.pdf

UNITED STATES MARINE CORPS

MARINE CORPS SYSTEMS COMMAND

2200 LESTER STREET

QUANTICO, VIRGINIA 22134-6050

IN REPLY REFER TO:

Code: CT-2.4-CS3

J&A Number: 20,211

LIMITED SOURCES JUSTIFICATION

1. Contracting Activity

Marine Corps Systems Command

Program Office PMM-172/CS3

Portfolio Manager Supporting Establishment Systems (PfM SES)

2200 Lester Street

Quantico, VA 22134-5010

2. Nature and/or Description of the Action Being Approved

This acquisition is conducted under the authority of the

Multiple Award Schedule Program under Title III of the Federal

Property and Administrative Services Act of 1949.

This justification seeks approval of the use of limited sources under Federal Acquisition Regulation (FAR) 8.405-6(b) – Items peculiar to one manufacturer and in accordance with the requirements at Defense Federal Acquisition Regulation

Supplement (DFARS) subpart 208.74, which requires agencies to fulfill requirements for commercial software and related services through the Department of Defense (DoD) Enterprise

Software Initiative (ESI). As described more fully below, the proposed action is the use of a brand name specification in the procurement of Tanium On-site Technical Account Manager (OTAM) support. The proposed action is for firm-fixed-price delivery order under the Department of the Navy Enterprise Software

Licensing Agreement, Blanket Purchase Agreement (BPA)

The Marine Corps Systems Command (MCSC) Contracting Activity proposes to restrict consideration of scheduled contractors to an item peculiar to one manufacturer. Specifically, MCSC plans to restrict the procurement of the support required to brand name Tanium OTAM support. EC America is the single BPA holder for Tanium software and OTAM support on the DoD ESI contract.

Accordingly, this action is to be awarded as a sole source BPA call to:

EC America

8444 Westpark Dr # 200

McLean, VA 22102

3. Description of Supplies/Services

The proposed contract action is to procure Tanium OTAM support services.

The corresponding OTAM support services will provide the technical expertise in Tanium to plan, build in the lab, document, secure, test, and obtain accreditation/authorization for the Marine Corps Enterprise Network (MCEN) Tanium solution.

The technical experts provided under this effort will also work with Marine Forces Cyberspace Command (MFCC) technical experts to complete deployment of required configuration changes in the production environment to bring it in compliance with the authorized solution. The support will work with project team and operations staff to bring a model representation of the current solution into the EEVE lab environment, making it the functional copy of production to be used for design documentation, integration planning, and testing. The technical experts provide the technical and hands on planning needed to complete the work required to obtain a full Authority-To-Operate (ATO). They also provide over the shoulder training and knowledge transfer to PMM

N&I engineers.

The Period of Performance (PoP) is 12 months beginning on 29 May

2020. The estimated dollar value for this procurement is

. The estimated costs are for one year, as Tanium does not offer pricing for option periods. Please see total estimated cost below for one year of OTAM support:

Table 1

APPROP FY20

O&M for OTAMS

Total

4. Identification of the Justification Rationale

This is a procurement for items peculiar to one manufacturer as authorized under FAR 8.405-6(b). As described herein, only a brand name item peculiar to one manufacturer can provide the

OTAM support requested to satisfy the agency’s current need. No other brand name other than the Tanium OTAM support will be able to fulfill the agency’s requirement.

The FY 2017 National Defense Authorization Act (NDAA) directed the DoD to implement a Comply-To-Connect function as part of a continuous monitoring capability. In February 2019, the DoD

Chief Information Officer (CIO) directed the Joint-Force

Headquarters Department of Defense Information Network (JFHQ-

DODIN), U.S. Cyber Command, and the Office of the Secretary of

Defense Principal Cyber Advisor, to take actions to implement software capabilities in support of the DoD continuous monitoring process.

In response to Congressional and DoD CIO direction, the U.S.

Marine Corps Forces Cyberspace Command (MARFORCYBER) issued

Tasking Order 19-0030 dated 6 March 2019. This directed the

Marine Corps Cyber Operations Group to implement a software solution to address Comply-To-Connect and Endpoint Protection and Monitoring requirements. Based on some previous investments described below, the Marine Corps chose to leverage existing investments in Tanium software and associated OTAM support to address these requirements. In addition, a DoD CIO Memo entitled

“Enabling Asset Discovery and Automated Reporting” dated 15

April 2019, expressed the goals to obtain full asset visibility and enable automated reporting across all endpoints

(workstations and servers) on Non-Classified Internet Protocol

Router Networks and Secret Internet Protocol Router Networks by

30 September 2019, and to initiate the implementation of

Automated Continuous Endpoint Monitoring (ACEM). The action covered by this justification facilitates compliance with these initiatives.

The current Endpoint Security solution, Host-Based Security

System (HBSS) by McAfee, no longer meets cybersecurity requirements and presents capability gaps in Discovery, Endpoint

Detect & Respond (EDR), and Application Containment. In response, DoD has instituted a federated capability for automated reporting by the Components to provide full asset visibility across the DoD enterprise. The asset discovery and automated reporting effort is the initial implementation of ACEM for the Department.

Tanium software has unique capabilities that are not available in other competing products. The Tanium software architecture contains proprietary technology for passing data efficiently across networks in a manner superior to traditional hub-and-spoke network architectures. It does so through the use of software agents distributed across all endpoints. Information about the network, events occurring on the network, and data are distributed across these agents and each is utilized as required. Through the use of this technology, Tanium software is able to dramatically reduce the total amount of network bandwidth required to retrieve data from endpoints and deliver data to endpoints of a network by reducing the amount of communication required between servers and endpoints. This technology also enables the Tanium software to adjust data communication pathways to continuously pass data across the network as endpoints are added or removed. In addition, information about millions of endpoints can be obtained in a matter of seconds and actions to manage those endpoints can be quickly executed. As a result, Tanium software is able to provide near real-time information about endpoints (e.g.

configuration, policy compliance, and identification of unmanaged endpoints) regardless of how many are on the network.

This in turn enables the rapid identification of potential threats to the network and enables network operators to rapidly execute actions to respond to those threats. These unique capabilities are critically important tools necessary for detection of and defense against ever-present threats to Marine

Corps networks.

In addition to the unique capabilities Tanium products provide, the Marine Corps has expended significant fiscal and human capital resources into the deployment, configuration, and training of personnel to establish the Tanium capability for the

Marine Corps. For example, in 2017, the Marine Corps purchased

220,000 Tanium licenses with all available modules as well as

OTAM support and hardware services to configure and host Tanium server software. In 2018, the Marine Corps built upon the previous investment and purchased services that provided 150,000 licenses with all available modules, OTAM support, and technical training for Government personnel. The implementation of the

Tanium capability will continue during 2020 as Government personnel continue to be trained on existing Tanium modules and those released during 2020. Procurement of Tanium OTAM support is critical to support this continuing implementation effort, and as described below, no other companies’ similar products meet, or can be modified to meet, the Government’s requirements.

The services provided under the Tanium OTAM support package are the only method of accomplishing these tasks since only Tanium

OTAMs have unrestricted access to internal Tanium subject matter experts who can provide detailed configuration guidance specific to the Marine Corps.

Further, the implementation of Tanium-related hardware and software on the MCEN requires an Authority to Connect/Authority to Operate (ATC/ATO), which involves numerous individual tasks.

Any transition to a new platform would therefore involve a significant amount of downtime and degradation of performance during the transition period, which injects unnecessary risk to

Marine Corps networks. The Government estimates that the cost to transition from the Tanium capability to one or more alternatives to be about $3.2M, which includes the purchase of new hardware, training, and OTAM support. This estimate is based on actual Tanium implementation costs to date, as well as estimated costs to finalize the Marine Corps implementation of

Tanium during 2019 and 2020, but it excludes the OTAM support, which would actually drive the costs up further. There would also be an overlap in OTAM support for Tanium and any replacement software products of at least one year as the new software and associated hardware are installed, configured, and tested and Government personnel begin their initial training on the new software. Transition activities would consume additional

Government personnel resources as personnel begin training and perform testing activities on the new software platform(s).

These costs are not likely to be recovered through competition.

In addition, the DoD has established a federated capability and an accompanying concept of operations across the Department that leverages prior investments in Tanium to enable automated reporting by DoD Components and full asset visibility across the

DoD enterprise in order to comply with the provisions of the

FY2017 NDAA and the related DoD CIO policy mentioned above. A migration to an alternative software capability by the Marine

Corps would result in a degradation of this DoD-level capability until additional engineering work and testing could be completed to re-establish the federated capability utilizing a replacement software platform. This would require additional resources, time, and money to be expended at the DoD-level, and similarly creates unnecessary risks for the DoD environment.

Without the Tanium OTAM, the Marine Corps will not meet the current deadline to complete the ATO package by the end of

October 2020. The Marine Corps will also not be able to configure the lab instance as it is currently configured within production preventing the sustainment of the solution through testing changes and updates in the lab prior to deploying into production. The OTAM is also required to provide over the shoulder and live information sharing with engineers within the

Program Office. Classroom training offered by the vendor on the system does not provide the depth needed to build and sustain

Tanium. Only hands on training from an OTAM will provide the skillset needed by Marine Corps engineers to take over the engineering and testing responsibilities for this system. It is estimated that at least 12 months of direct support provided by the Tanium OTAM support package is needed to build the skillset within the program office for this critical system. Without an effective design, sustained under the program office with interfacing systems, there will remain a significant risk to the performance of production systems that any changes or updates will render an incorrect configuration and cause major end user outages. Without the Tanium OTAM, the program office will not be able to design and deploy changes to the production solution to allow for use of existing Tanium capabilities that are in full use today.

5. Determination of Best Value

ESI promotes the use of Enterprise Software Agreements (ESAs) with contractors that allow DoD to obtain favorable terms and pricing for OTAM support services. Although there is only one authorized Tanium reseller available through ESI, market research shows that the price offered through ESI is competitive. Prior to award, the contracting officer will compare the prices quoted from ESI to prices available through other Government-wide contract vehicles to ensure that any order represents the best value and is in the best interest of the

Government. The Contracting Officer intends to request price reductions before placing any order and will use the price analysis techniques discussed above to determine the price fair and reasonable. Should the prices available via other commercial means be more advantageous to the Government, the procedures at

DFARS PGI 208.7403 will be invoked.

6. Description of Market Research Conducted

Market research was conducted by PMM-172 on Tanium OTAM support using information and quotes from authorized resellers and the current provider of Tanium services. Market research did not reveal any third-party providers of the required OTAM support;

only Tanium provided support has the requisite access to the OEM necessary to meet the Government’s requirements. Market research did however demonstrate that Tanium OTAM support is available via other vendors on other contract vehicles. For example, both Federal supply schedules and Government-Wide

Acquisition Contracts were reviewed with the following results:

• Tanium is available on DoD ESI through one authorized reseller;

• Tanium is available on National Aeronautics and Space

Administration Solutions for Enterprise-Wide Procurement (NASA

SEWP) through seven authorized resellers; and

• Tanium is available on GSA Advantage through one authorized reseller.

Although the required support is available through multiple contract vehicles, DFARS 208.74 requires the use of DoD ESI if any ESI contract meets the agency’s needs under conditions and terms that represent the best value to the Government. Further, in accordance with DoD Directive 8470.01E and in performance of the functions as DoD Executive Agent for Core Enterprise Technology Agreements (CETAs), Navy PEO EIS has designated the

Tanium BPA as the first DoD CETA. The CETA designation means this purchasing vehicle is mandatory for DoD for Tanium products and services. Accordingly, since market research shows that the

ESI contract offers the required products, and since the Tanium

BPA has been designated as a CETA, MCSC must fulfill the requirement through ESI.

7. Other Facts Supporting the Justification

None.

8. Actions to Remove Barriers to Future Competition

The Marine Corps will continue to conduct market research to determine if competing products offer a comparable or better value to the Govrnment. If competing products are identified, the Marine Corps will pursue a competitive process to assess whether replacement of existing Tanium-brand support is operationally and fiscally feasible. If market research shows that other companies can provide OTAM-type product support equivalent to that provide by Tanium, then competition will be sought to the maximum extent practicable. Further, if future circumstances warrant continued procurement of brand name items, MCSC will explore other contract sources beyond the DoD ESI contract vehicle to ensure the most advantageous pricing for

Marine Corps requirements.

CERTIFICATIONS AND APPROVAL

TECHNICAL AND REQUIREMENTS CERTIFICATION:

I certify the facts and representation under my cognizance, which are included in this Justification and its supporting acquisition planning documents, are complete and accurate to the best of my knowledge and belief.

TECHNICAL COGNIZANCE:

Date

CS3 Program Manager

LEGAL SUFFICIENCY REVIEW:

I have determined this Justification is legally sufficient:

Associate Counsel

Office of Counsel, Marine Corps Systems Command

Email:

CONTRACTING OFFICER CERTIFICATION:

I certify that this Justification is accurate and complete to the best of my knowledge and belief:

Contracting Officer

Marine Corps Systems Command

Email: