Inactive

DRAFT- No Award Has Been Made JUSTIFICATION AND APPROVAL FOR OTHER THAN FULL AND OPEN COMPETITION CONTRACTING AGENCY The Office of Acquisition Management is conducting this acquisition of other than f... DRAFT- No Award Has Been Made JUSTIFICATION AND APPROVAL FOR OTHER THAN FULL AND OPEN COMPETITION CONTRACTING AGENCY The Office of Acquisition Management is conducting this acquisition of other than full and open competition – “Brand Name” for SPLUNK SKUs for Certified Profession Services to provide dedicated specialized technical support services on behalf of IRM/FO. DESCRIPTION OF ACTION – This Justification and Approval sets forth the facts and requests approval to award a Blanket Purchase Agreement for Brand Name, SPLUNK SKUs certified professional services (SPLUNK specific certification). The services to be provided are for Splunk Professional Services (SPS) to support existing Splunk users across the Department of State and 41 other entities. BPA Calls will be issued to provide services on a “Labor-Hour” basis. A SPLUNK Enterprise Level Agreement (ELA) was awarded in FY19. DESCRIPTION OF SUPPLIES/SERVICES – The objective of the Splunk Professional Services BPA is to procure Splunk certified staff. DoS has multiple offices currently utilizing Splunk licensing/software, maintenance, and support. DoS has identified a continued and growing need to analyze increasingly large amounts of complex data collected from a range of diverse sources. Splunk is an IT search and analytics engine for machine data collected from multiple sources and platforms. The Splunk software indexes in any format of IT data from any source in real time, including logs, configurations, messages, traps, alerts, activity reports, stack traces and metrics from all DoS applications, servers, and devices. DoS is a large consumer of Splunk products and has been an active user of these products for several years. DoS has made a significant investment in the core Splunk platform. Currently Splunk products support data analytics across various Bureaus within DoS (e.g. Diplomatic Security, Comptroller and Global Financial Services, Information Resources Management). Its value as a data analytics tool ensures that each Bureau has real time access to mission critical information in the support of their objectives. Splunk can offer a scalable tool that will easily integrate these data sets and provide Bureaus continued access to a familiar tool. The increased value will come from data aggregation across DoS and ensure that Bureaus have access to any useful data sets owned by other groups. Given the critical nature of these and other current Splunk deployments, the development, training, implementation, and operational costs associated with replacing Splunk products would be cost prohibitive. In addition to the large investment in Splunk that has already been completed, the use of Splunk products is expected to increase in the coming years. DoS level data sets will continue to grow in size and complexity and our reliance on an analytics tool will become key to future successes. Increasing the DoS Splunk ingestion rate will allow the organization to expand capabilities in tandem with expanding requirement. The Department is using Splunk for a broad spectrum of analytics needs and for organizing and correlating disparate data sets. This technology captures, indexes, and correlates real-time data in a searchable repository for generating reports, alerts, dashboards, and visualizations. Splunk is a horizontal technology used for application management and monitoring, security and compliance, business and web analytics, and predictive analytics. Among other benefits, locally and collectively, Splunk will enable the Department to significantly save time, decrease outages, speed up detection of issues, accelerate troubleshooting and investigations, and maximize transparency and awareness for improved compliance. To enable the Department’s utilization and to realize its potential, IRM requires the use of Splunk Professional Services (SPS) or a Splunk Certified Services Provider to augment the existing service integrator or other technical resources and to provide dedicated, specialized consultants. Areas where SPS will support include: Architecture Expertise Data Onboarding Walkthrough Forwarder Configurations and Deployments User/Professional Experience Splunk Applications Upgrades Deployment Documentation Role-based Access Control Updates Project Management These services require that SPS consultants assist with maturing Splunk operations, increase adoption, and establish a common operational standard and model across the Department. This standard and common information model will enable greater inter-office and inter-bureau information sharing through a dynamic and federated environment that shares a technology platform. The Department requires Enterprise Splunk support services in support of implementing the Splunk platform across the Department’s network. The estimated dollar amount for the services is $19,800,000.00. This will allow the Office of IRM/FO to support the 37 regional and functional bureaus that comprise the Department of State, and the broad and diverse aspects of the foreign affairs and diplomatic missions that have come to define the organization, who now relies on a complex web of interconnected software and hardware to support communications, collaboration, and the entire data lifecycle, from creation to protection, dissemination, and destruction. AUTHORITY CITED - The statutory authority cited is FAR 6.3021 (41 U.S.C. 2304(a)(1)) Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements – Brand Name. It is deemed that it is in the best interest of the Government that the requested services only be procured with accompanying SPLUNK certification SKUs to support the Department of State requirements. REASON FOR AUTHORITY CITED – IRM has identified that other companies’ certifications/uncertified services would not meet requirements given the current Splunk implementation across the Department and reporting requirements. Only brand name SPLUNK SKUs can provide the services required at the level of quantity required because the services are unique and/or highly specialized. Currently more than 18 different offices and programs across the Department use Splunk to support their IT operations and security missions. To ensure the best utilization and adoption of the Splunk technology, the Department intends to take a dual-pronged approach that combines education and training with Splunk’s professional services (Splunk PS) resources. Professional services will be brought in to augment existing service integrator or other technical resources and will provide dedicated, specialized consultants to assist the Department with the development of their Splunk deployments. Splunk owns the proprietary rights to the software source code and is the only source for Splunk licenses, maintenance, and services for the products. DoS has a substantial deployment of Splunk products, and these products are integrated into the Department's systems and networks in a highly complex manner. Splunk PS and Splunk certified consultants are required to complete significant training and enablement before they can support customers directly. This enablement includes mandated certification of Splunk’s core Enterprise offerings and associated accreditations on any of Splunk premium applications. Continued use of Splunk products ensures DoS is able to meet its mission with minimal downtime. Splunk requires recertification and re-accreditation on a periodic basis and as new enablement materials become available. As a result, use of Splunk SKUs provides optimal assurance that contractors employed through this contract will be able to utilize the SPLUNK software with minimal learning curve and a guaranteed level of competence, which SPLUNK company has provided to those individuals who meet SPLUNKs required level of competence. This significantly reduces the risk of project failure in the short and long term. Splunk does not sell directly to the federal government; instead, it sells through certified resellers/partners. EFFORTS TO OBTAIN COMPETITION – We have done extensive work to find competition per FAR 5.102(a)(6) for the requirement to post the brand name justification. A search of all GSA contract holders was conducted to ensure all Splunk Professional Services SKU resellers were identified and considered (see for example https://www.gsaadvantage.gov/advantage/ws/catalog/product_detail?gsin=11000057943304) FAIR AND REASONABLE COST DETERMINATION – The Contracting Office determines that the anticipated price(s) will be fair and reasonable based on the fact that this is a BPA being procured off GSA Schedules. Offerors are quoting off Government estimate of the level of effort. In addition, Offerors that have the SPLUNK SKUs will be competing against each other thereby ensuring a competitive acquisition. By signing the justification, the Contracting Officer makes a determination that the cost/price to the Government are expected to be fair and reasonable MARKET RESEARCH – The office has done extensive market research for previous ELA award and current request. Gartner’s (Independent third party research company) research shows that Splunk ranked #1 in Gartner’s 2019 Market Share for performance analysis: AIOps, ITIM, and other monitoring tools report. Additional market research will be conducted prior to future procurements. OTHER FACTORS – The Department has a substantial deployment of Splunk products and services, and these products are integrated into the Department's systems and networks in a highly complex manner. The market for Splunk products changes rapidly in association with broader technological trends and the continued expansion of “big data” and requirements to review, process and make sense of greater and greater quantities of complex data very quickly. As such, the Department needs to partner with a value-added Offeror to procure Splunk certified contract personnel that can address these challenges and ensure the Department is able to meet its mission with minimal downtime. When questions arise about Splunk products (either that have been deployed or that may be purchased), it is critical that the Department's value added Offeror is recognized by Splunk as a SPLUNK certified Offeror, such that the Offeror can address these questions themselves, or can successfully get answers from Splunk. Failure to do this can result in system downtime and prevent the accomplishment of mission requirements or create security vulnerabilities. The Offeror’s role is critical in the Department’s successful implementation of Splunk. Therefore, the Department has a requirement to establish the Blanket Purchase Agreement with an Offeror that has the expertise and working relationship with Splunk to adequately support the Department. Furthermore, in its role, the Offeror is in a position to be able to advise the Department on implementation and utilization of current and planned SPLUNK software integration as well as whether or not the Department’s planned purchases will be technologically feasible and in compliance with Splunk licensing procedures. This deep knowledge and advisory capability is acquired by the Offeror through close collaboration and training with Splunk. Market research conducted prior to the acquisition has found that only Offerors with personnel certified with SPLUNK SKUs have the aforementioned characteristics that the Department requires. These Offerors have the highest priority access to Splunk resources and have the technological expertise and training to effectively advise DoS on Splunk products and deployment. Absent Splunk certification guaranteeing the Offeror meets a certain level of competency, DoS has no means of determining whether or not an Offeror has achieved the minimal competencies for successful SPLUNK services. In addition, only Splunk offers tailored vendor-produced educational content to enable users at every level of the Department, from technical engineers and analysts to senior executives. Whether novices or experts, Splunk’s Department-focused Customer Success Manager will assist each individual or group in identifying the right learning path or certification track based on the business needs and budget resources available. These skills also make up Splunk SKU certification which the DoS seek to procure. For an enterprise as vast and complex as DoS, ensuring the level of expertise guaranteed by Splunk SKUs is essential. Partnering with an Offeror that is not officially certified would pose a significant risk to DoS. Vendors who would seek to sell the Department non-Splunk Professional Services are not able to deliver the same level of consistency and quality in their delivery, nor are they sanctioned by Splunk or entitled to the additional benefits Splunk provides in the form of partner training, enablement, documentation, and other materials. As a result, SPLUNK SKUs certification is a key technical requirement of this solicitation. INTERESTED SOURCES – List of potential vendors (Vendors are GSA and NASA SEWP) ACTIONS TO INCREASE COMPETITION – The nature of this acquisition prevents the DoS from considering, at this time, certifications given by any company other than Splunk. IRM and AQM will continue to consider the introduction of services and certifications that are designated by other IT Offerors and/or possible replacement of existing Splunk-based systems.