Brand_Name_Varonis.pdf

Justification for Other Than Full and Open Competition Justification- Brand Name

1. Contracting Activity:

2. Description of Action: This contract action is:

a. The Brand Name requirement(s) in support of this project are:

b. This approval is being requested for brand name acquisition by:

c. A firm fixed price contract will be competitively solicited for this action.

d. The total government estimated cost for each of the Brand Name requirements is:

3. Description of Supplies/Services:

a. The referenced project includes:

b. The specified requirement is unique because:

4. Authority Cited:

The statutory authority permitting Other than Full and Open Competition is 10 U.S.C. 2304(c) (1) as implemented by FAR 6.302-1(c) “Application for brand name descriptions”.

5. Reason for Authority Cited:

a. The use of 10 U.S.C. 2304(c) (1) as implemented by FAR 6.302-1(c) “Application for brand name descriptions” is being applied because:

b. The solicitation will include the justification/rationale for the Brand Name requirement.

6. Efforts to Obtain Competition:

7. Actions to Increase Competition:

8. Fair and Reasonable Cost:

Per FAR 15.404-1(b) – Proposal Analysis Techniques, it is anticipated that the cost to the Government will be fair and reasonable based on competition.

9. Market Research:

Market research was conducted for potential sources that may have capability to fulfill these requirements:

10. Interested Sources:

11. Other Factors:

a. Procurement History:

1. Authority previously used for less than full and open competition.

2.

12. Technical Certification:

I certify that the supporting data under my cognizance, which are included in the justification, are accurate and complete to the best of my knowledge and belief.

Name: Date:

Title:

Signature:

13. Requirements Certification:

I certify that the supporting data under my cognizance, which are included in the justification, are accurate and complete to the best of my knowledge and belief.

NAME: Date:

Title:

14. Contracting Officer Certification:

Based on the foregoing justification, I hereby approve the procurement of the above listed items on an other than full and open competition basis pursuant to the authority of 10 U.S.C. 2304(c) (1) as implemented by FAR 6.302-1(c) “Application for brand name descriptions”, subject to availability of funds, and provided that the services and property herein described above have otherwise been authorized for acquisition.

NAME: Date:

Pat.Euler Typewritten Text

Pat.Euler Typewritten Text

1370155069N Sticky Note Clear and re-sign after proof reading.

1370155069N Sticky Note Chief- Please clear signature.

SMSgt Medina please sign.

DEPARTMENT OF THE AIR FORCE

HEADQUARTERS AIR FORCE SPACE COMMAND

MEMORANDUM FOR ALL MAJCOMs/FOAs/DRUs

FROM: Air Force Authorizing Official 150 Vandenberg Street, Suite 1105 Peterson AFB CO 80914-4420

SUBJECT: Software Products Approval Process

REFERENCES: (a) AFI 33-210, “Air Force Certification and Accreditation (C&A) Program (AFCAP),” 23 December 2008

(b) DoDI 8510.01 “Risk Management Framework (RMF) for DoD Information Systems” 12 March 2014.

(c) AFMAN 33-153 “Information Technology Asset Management (ITAM)” 19 March 2014

1. As the Air Force Authorizing Official (AO), I approve the use of software products as defined in reference (b) from the sources listed on the AF AO SharePoint site, under the “Software Application Approval” documents list, at the following link:

https://cs3.eis.af.mil/sites/afao/default.aspx. Send recommended modifications to this list to the POC email address below.

2. Utilizing reciprocity, this approval extends to any software that has been certified by another DoD AO or Security Control Assessor (SCA).

3. Per reference (b), these software products are considered assessed and require no additional formal test or evaluation. Compliance with this decision is contingent upon the following conditions:

a) The software application is certified as noted in Para 1 or 2.

b) Prior to implementation, the ISSM shall implement any required mitigations to reduce the security risk.

c) The ISSM shall update their applicable Assessment and Authorization documentation and system software lists to reflect any solutions implemented. This update will be considered a no security impact modification to the system accreditation.

4. Requests for additional software applications need to be submitted through your unit Information Systems Security Officer and endorsed by the Wing Information System Security Manager (ISSM). Each request shall be documented via an application request worksheet prior to a certification review. The application request worksheet with instructions and information is found on the Air Force Network Integration Center Software Certification Home page: https://cs1.eis.af.mil/sites/afnic/sc/SitePages/Home.aspx

GUARDIANS OF THE HIGH FRONTIER

5. My POC for this matter is Mr. Joshua Neate, HQ AFSPC A2/3/6MA, DSN 692-2581, af.daa@us.af.mil.

KEVIN B. WOOTON

Brigadier General, USAF Air Force Authorizing Official

GUARDIANS OF THE HIGH FRONTIER

WOOTON.KEVIN.

B.1126991211

Digitally signed by

WOOTON.KEVIN.B.1126991211

DN: c=US, o=U.S. Government, ou=DoD, ou=PKI, ou=USAF, cn=WOOTON.KEVIN.B.1126991211 Date: 2015.06.01 10:25:55 -06'00'

FOR OFFICIAL USE ONLY

Certificate of Networthiness (CoN)

Product: Varonis Data Governance Suite 6.x

Cert# Request Type CoN Type Approval Expiration 201519835 Upgrade Enterprise 11/30/2015 11/30/2018 Mission Area Domain Functional Area Category

Enterprise Infrastructure Environment Computing Infrastructure IT Utilities Application

Description:

Data Governance Suite 6.x collects critical metadata, generates metadata where existing metadata is lacking (e.g. file system filters and content inspection technologies), pre-processes it, normalizes it, analyzes it, stores it, and presents it to IT administrators in an interactive interface. This suite is used to audit access to unstructured data; to verify and report potential access, and actual account holder access to information for all data; and to determine whether permissions are inherited or assigned directly. Data Governance Suite also provides a detailed audit trail of each data access action (i.e., create, open, write, delete, rename, and permissions changes). Permission change details are necessary for auditing and for performing a roll back to a previous data states. All access events can be used to search, sort, and pinpoint how a file was accessed on any monitored server, and when. This information is available directly and interactively in the user interface and via reports. This suite contains: Data Transport Engine; DatAdvantage for Directory Services; DatAdvantage for Exchange; DatAdvantage for SharePoint; DatAdvantage for UNIX/Linux; DatAdvantage for Windows; DatAlert;

DatAnswers; DataPrivilege; and IDU Classification Framework.

Data Governance Suite 6.x is installed on a Windows Server 2008 R2. This application collects different metadata streams. Data Governance has a number of different jobs that are scheduled to run on different intervals from hourly to daily, and weekly. All the data collected is sent to a SQL 2008 database backend for aggregation, normalization, and long term retention. All data stays internal to the local enclave.

Facts:

This is an upgrade to Certificate 201316535.• Varonis Data Governance Suite 6.x is a NetOps tool, but it does not overlap any approved Enterprise selected solutions that meet the Information Staging Management capability.

CoN Link: https://portal.netcom.army.mil/apps/networthiness/_layouts/NetcomCON/rqstcon2.aspx?requestId=23782

Restrictions:

Data Governance Suite 6.x is restricted for use within certified and accredited networks and/or data centers having a current ATO.

1.

If this NetOps capability overlaps an existing Enterprise NetOps tool, then the requesting organization has 1 year to migrate to the approved solution.

2.

Once an Enterprise NetOps solution becomes available and implemented, this product shall be migrated to the approved solution.

3.

POC: netcom.hq.networthiness@mail.mil /(520)538-1199

This Certificate of Networthiness is based on a trusted standardized platform, configured per FDCC. All patches and updates will be provided by the host network administrator (NEC or DECC) in accordance with all technical directives, mandates, and IAVM. This Certificate of Networthiness is no longer valid should the assessed configuration be significantly altered. Per Army Cyber Command guidance, all operating environment will implement HBSS capabilities. Upon expiration of this Certificate of Networthiness, this application must be reassessed to ensure it is still compliant with the GNEC architecture and is still networthy. Should this software version be upgraded prior to this expiration, the new version must be evaluated for networthiness.

Additional Comments:

12/1/2015

X BRADFORD.DANIEL.1124817257

Signed on 2015-11-30T05:00:00Z

Daniel Q. Bradford Senior Executive Service (SES), Deputy to the Commander / Senior Technical Director / Chief Engineer Network Enterprise Technology Command (NETCOM)

12/1/2015

The procurement of Varonis Software that provides data security and monitoring capabilities for the 150th SOW that are currently unavailable and required for file servers and the Electronic Records Management Program.

Text4: This is for the maintenance agreement and upkeep for the software that was previously acquired.

VARONIS- Software is on the Air Force Authority To Operate listing (ATO) for the Air Force network. Currently there is no software on the approved listing that provides these capabilities other then VARONIS.

Please refer to Software Products Approval Memo, (a) AFI 33-210, “Air Force Certification and Accreditation (C&A) Program (AFCAP),” 23 December 2008, (b) DoDI 8510.01 “Risk Management Framework (RMF) for DoD Information Systems” 12 March 2014., (c) AFMAN 33-153 “Information Technology Asset Management (ITAM)” 19 March 2014. Please Reference ATO for Varonis Data Governance Suite 6.x, Certificate# 201519835.

Text5: 150th Communication's Flight 2251 Air Guard Rd SE Kirtland AFB, NM 87117

Need name POC., (Rank/Title, First Last, email)

SSPDA1-500L Qnty. 1 Annual Software Subscription & Support for DatAdvantage® IDU Analytics (Engine) for Windows for 500 users Text8: This is for the Maintenance agreement and upkeep for this software that was previously acquired.

The 150th SOW is in need of an application that can search, migrate, protect, collect, log and report on stored data with sensitive and PII content. This application will eliminate the man hours required to manually process the hundreds of thousands of files that must be reviewed for compliance. The requirement to be able to identify when a sensitive or PII breach has occurred would also be satisfied with this application. This Application would also safely reduce access and/or quarantine, baseline normal activity and alert abnormal activity, spot unwanted data access in real time, and identify unwanted changes and privilege escalations.

Text9: This is for the maintenance agreement and upkeep for this software that was previously purchased.

This is the only known approved application with an Approval to Operate (ATO) on AFNET that encompasses all of the requirements mandated by AFI and AFMAN regulations with integration into AFNET and its IT Enterprise Services.

Please refer to Software Products Approval Memo, (a) AFI 33-210, “Air Force Certification and Accreditation (C&A) Program (AFCAP),” 23 December 2008, (b) DoDI 8510.01 “Risk Management Framework (RMF) for DoD Information Systems” 12 March 2014., (c) AFMAN 33-153 “Information Technology Asset Management (ITAM)” 19 March 2014. Please Reference ATO for Varonis Data Governance Suite 6.x, Certificate# 201519835.

Text10: Research has been conducted by the Information Assurance Office and no other product meets the strict Government requirements or has the accreditation and endorsement to operate in the DoD environment. (Please Reference ATO for Varonis Data Governance Suite 6.x, Certificate# 201519835)

Please refer to Software Products Approval Memo, (a) AFI 33-210, “Air Force Certification and Accreditation (C&A) Program (AFCAP),” 23 December 2008, (b) DoDI 8510.01 “Risk Management Framework (RMF) for DoD Information Systems” 12 March 2014., (c) AFMAN 33-153 “Information Technology Asset Management (ITAM)” 19 March 2014. Please Reference ATO for Varonis Data Governance Suite 6.x, Certificate# 201519835.

Text14: FAR 13.501 Air Force Evaluated Products List (EPL)

Text13: It is known that numerous small businesses do offer Veronis products and services.