JA Exception Fair Corelight - R

JUSTIFICATION FOR EXCEPTION TO FAIR OPPORTUNITY

SECTION 1: IDENTIFICATION OF THE AGENCY AND THE CONTRACTING

ACTIVITY

Department of
State Contracting ☒
Activity

Acquisition Management

Requiring
Bureau of Intelligence & Research Technology & Innovation Office (INR/TIO) Activity

SECTION 2: NATURE AND/OR DESCRIPTION OF THE ACTION BEING

APPROVED

Approval is requested to solicit and award a new Task Order under NASA SEWP using a Firm Fixed Price (FFP) contract type. The Task Order will be subject to exception to fair opportunity limiting competition to authorized resellers of Corelight, Inc., 548 Market St, PMB 77799, San Francisco, CA 94104-5401 brand-name software and/or services described in Section 3 on behalf of the Requiring Activity.

SECTION 3: DESCRIPTION OF SUPPLIES/SERVICES REQUIRED TO MEET THE

AGENCY’S NEEDS

The Bureau of Intelligence and Research (INR) requires specialized commercial services to enhance and maintain the Cross Domain Solution (CDS) for the Department of State. A CDS is a specialized hardware and software system that controls and sanitizes the transfer of sensitive data between networks of different security classifications. Because these systems guard the boundaries of critical national security enclaves, they are subject to strict federal regulations and rigorous oversight. Consequently, any deployed CDS must pass extensive lab-based testing to meet the evolving “Raise the Bar” (RTB) standards developed by the National Security Agency (NSA). This procurement focuses on acquiring NSA RTB compliant hardware and software to monitor the CDS.
INR’s minimum requirements for CDS monitoring are:
• NSA RTB compliant passive inspection of all traffic traversing CDS boundaries. • Integration with existing enterprise detection analytics, detection engineering, and SOC workflows, which consume Corelight-specific Zeek metadata.

Accordingly, INR will procure:
• Proprietary CoreOS & Hardware Acceleration: VMware virtual appliance sensor and bundle subscription license featuring open-source security tools Zeek, Suricata, SPCAP, YARA, Threat Intelligence, ET Pro, and Fleet for 1 Gbps of capacity. • Proprietary Appliance Customization Services: Professional services to configure and optimize the Corelight appliance to continuously monitor enterprise network traffic, generate high-fidelity network metadata, detect malicious activity, support threat hunting, and enable rapid incident investigation and response. • Training and U.S. based support: Expert support with intensive training for personnel