Fortify SCA Licenses & Annual Maintenance Support

Background
The Department of Defense, Washington Headquarters Services, Acquisition Directorate, Enterprise Research and Engineering Division, Technology Analysis & Services Branch (ERED/TASB) is seeking the renewal of DTIC’s annual maintenance package for its Fortify Static Code Analyzer (SCA) software licenses manufactured by Micro Focus Government Solutions, LLC. The Fortify software is part of the DoD Platform One and Cloud One recommended security components included in Big Bang. It helps to address immediate security issues in software, reduce systemic risk, meet compliance goals, identify exploitable vulnerabilities, and ensure that security is built-in to all future software from the beginning. The previous contract was awarded to Carahsoft Technology Corporation; an other than small business on 10 June 2017 and expired on 10 June 2020. The current contract was awarded to METGreen Solutions, Inc; a Service Disabled Veteran Owned Small Business (SDVOSB) on 11 June 2020 and expires on 10 June 2023.

Work Details
The action requests the approval of a Limited Source Justification for the renewal of DTIC’s annual maintenance package for its Fortify Static Code Analyzer (SCA) software licenses manufactured by Micro Focus Government Solutions, LLC. The Fortify software continues to improve and thoroughly analyze source code for known industry vulnerabilities.
Market research was conducted on Enterprise Software Initiative (ESI), General Services Administration (GSA), National Aeronautics and Space Administration’s (NASA) Solution for Enterprise-Wide Procurement (SEWP), and previous purchases. ESI has two other than small businesses with Blanket Purchase Agreements (BPA) and GSA Federal Supply Schedules (FSS). NASA SEWP’s market research tool identified multiple SEWP contract holders that can meet the requirement.
Cost estimates were submitted by several small businesses and one other than small business.

Period of Performance
The current contract was awarded to METGreen Solutions, Inc; a Service Disabled Veteran Owned Small Business (SDVOSB) on 11 June 2020 and expires on 10 June 2023.

Place of Performance
The products selected for market survey include Fortify, Checkmarx, Veracode, Rapid 7, Contrast Security, Netsparker, and Portswigger.