JA_-_Advanced_Cyber_Defense_Tool_Training_____Redacted.pdf

MICC Control No: Gordon-2016-8

Version – MAY 2016 FOR OFFICIAL USE ONLY

JUSTIFICATION REVIEW DOCUMENT

FAR SUBPART 13.5 SIMPLIFIED PROCEDURES FOR CERTAIN COMMERCIAL ITEMS –

SOLE SOURCE JUSTIFICATION AND APPROVAL

Program/Equipment: FY16 Advanced Cyber Defense Tool Training, U.S. Army Cyber Protection Brigade (USACPB), Fort Gordon, Georgia

Authority: 10 USC 2304(c)(1) ,as implemented by Federal Acquisition Regulation (FAR) 6.302-1, Only One Responsible Source, and No Other Supplies or Services Will Satisfy Agency Requirements.

Amount: $646,077.00

Name: Sherrilyn Rice

Reviews: I have reviewed this justification and find it adequate to support other than full and open competition.

FAR Subpart 13.5 Simplified Procedures for Certain Commercial Items – Sole Source Justification and Approval

1. CONTRACTING AGENCY: Mission and Installation Contracting Command – Fort Gordon, GA (MICC-Fort Gordon).

2. 2. Description of Action: U.S. Army Cyber Protection Brigade requests a Firm-Fixed-Price (FFP) contract with Security Onion Solutions, LLC for advanced individual training and low density subject matter expertise enhancement training. It includes Defensive Cyberspace Operations (DCO) training specific in the Security Onion tool suite for Cyber Protection Teams (CPTs) in order to support the needs of the United States Cyber Command (USCC) Cyber Mission Force training program. The Government projects award for 30 September 2016 Operations and Maintenance funds will be used. An acquisition plan is not required because this procurement does not meet the threshold at Defense Federal Acquisition Regulation Supplement 207.103(d)(i)(B).

3. Description of Supplies/Services: Advanced individual training tailored towards the CPT personnel will occur in one week period in six separate iterations over a one year period. Six additional iterations of training will be available for the following year at the discretion of executing one option year to this contract.

This training is designed to provide and validate hands-on training of high-quality content and curriculum to Soldiers and DA Civilians.

. An instructor will provide vital hand-on training for CPTs taught on-site at Fort

Gordon. CPTs will participate in collective training events that will reinforce the training.

The period of performance for services is 30 September 2016 to 29 September 2017 with one (1) Option Year.

Base Period: 9/30/2016 to 9/29/2017

Option Period 1: 9/30/2017 to 9/29/2018

Total: $646,077.00

4. Authority Cited: 10 U.S.C. 2304(c)(1), as implemented by FAR 6.302-1 Only One Responsible Source, and No Other Supplies or Services Will Satisfy Agency Requirements.

5. Reason for Authority Cited: Pursuant to FAR 6.302-1(a)(2)(i), Security Onion Solutions offers a product that is not inherent to the Government

The software distribution of the tool suite is heavily utilized by CPTs. Although the software distribution is free, advanced subject matter expertise training on the conglomerate of all of the tools is not available in the Government nor is it available in the private sector other than by said company. Security Onion Solutions offers an innovative training concept tailored specifically towards CPTs to further develop a unique skill set. This skill set has proven to be the right fit to satisfy critical training requirements to prepare the Soldiers and DA Civilians to support the DoD current and future efforts in cyberspace. The cyberspace domain and the line of operations identified within this domain have changed and continue to change significantly and persistently. This advanced cyber security training is designed to assist the DoD and U.S. Army in defeating the threats associated with operations within the cyberspace domain.

a. Background:

CPTs were created to fill an urgent cyber defense need: to detect and deter adversarial threats to the cyberspace domain and adapt to defeat those threats. This training program advances, adapts, and focuses on advanced capability for intrusion detection, security monitoring, and log management, allowing CPTs to quickly and effectively respond to incidents and conduct analysis of packets as they traverse wired and wireless systems and services.

b. Alternatives:

At this point, the only alternative, which is unacceptable, would be to cancel the FY16-17 classes. CPT personnel would be forced to research and piecemeal skill sets and training from public websites and learn on deployed missions. This would be severely limit their operational capability into detecting and defending against adversarial activity.

This alternative would assume great risk and detrimentally limit defensive cyberspace operations.

c. Justification:

The primary mission of these cyberspace warriors is Defensive Cyberspace Operations (DCO). The training is intended to comply with Joint Cyberspace Operations doctrine as outlined in the US Cyber Command Concept of Operations (CONOPS) Joint Cyberspace Training and Certification Standards (JCT&CS), dated 7 Feb 2012, signed by General Keith B. Alexander.

Security Onion Solutions is the sole proprietor of the training; they currently do not have any resellers or distributors. Security Onion Solutions is a small business and local to Ft. Gordon, minimizing embedded cost for training. They possess subject matter expertise on all of the following intrusion detection and cyber defense and intrusion defense tools included in the suite that no other vendor possesses, . Additionally, the vendor has firsthand knowledge and experience working with military DCO elements of the CMF, their needs, skills required, and operational impact, vastly different from cyber defense in the private sector. No other vendor is currently capable of delivering this specific and operationally-tailored training.

it is critical that the Government sole source this training with an the only vendor that can fulfill the require and has the plan of instruction, experience and an understanding of CPT mission requirements.

d. Prior Acquisitions:

Not applicable.

e. Impact:

No other organization has the ability to deliver all the resources required to maintain the level of expertise needed to meet the requirements of this effort. Failure to support this training will result in a high level or risk when employing CPTs with a limited critical knowledge capability. Without properly trained DCO operators, the Army’s and Combatant Commands’ networks, systems, and data will be at risk. The Army will not have personnel qualified to detect and analyze vulnerabilities and respond to the threat of exploits against our information systems and services, and will not be prepared to provide confidentiality, integrity, and availability for our information systems.

Disapproval would result in Cyber Soldiers and DA Civilians not properly trained and to defend our national and strategic interest from multiple proven cyber related security risks, resulting in the Army falling farther behind in maintaining the secure posture of the Department of Defense Information Networks (DoDIN) from the veracity and voracity of those that threaten harm to the DOD. The Army has the largest exposure to the cyber domain; disapproval may result in a real-world operational failure by the war-fighter due to our failure to properly train and equip our cyber workforce for the present and imminent threats posed in cyberspace

6. Efforts to Obtain Competition: A sources sought synopsis with a draft PWS, was publicized on 8 July 2016 to FedBizOpps as required by FAR 5.201; one response were received but was deemed technically unacceptable. To promote competition the MICC-Fort Gordon will continue to synopsize and conduct market research to ensure there are no other vendors that can provide the requirement. MICC-Fort Gordon will continue to verify that the requirement are still proprietary to Security Onion Solutions, LLC.

7. Actions to Increase Competition: A notice was publicized on FedBizOps as required by FAR 5.201 on 08 July 2016. To date no other firms have expressed an interest in this procurement effort. To promote competition the MICC-Fort Gordon will continue to synopsize and conduct market research to ensure there are no other vendors that can provide the requirement. MICC-Fort Gordon will continue to verify the requirement are still proprietary to Security Onion Solutions, LLC. A sole source synopsis will be issued and any responses will be considered.

8. Market Research: Extensive market research was conducted (Internet searches, telephonic communications, Cyber conference exhibits, electronic communications, and literature searches) to determine the availability of other companies certified to provide advanced security onion training. A search of DSBS and keyword Security Onion returned no firms with the capability. Only Security Onion Solutions, LLC was found. The vendor has provided a sole source letter.

9. Interested Sources: Preliminary technical information submitted by in response to the sources sought notice has been reviewed by the requiring activity who have advised that . does not meet the requirements in the sources sought notice," The company had experience in WIN-T and other Signal Corps program s of record, but outlines absolutely zero cyber defense experience. The requirement is for extremely focused cyber defense tool training: Their document does not speak to the technical knowledge of their employees and how they will provide training at Ft. Gordon, GA." The requiring activity reviewed and deemed the vendor technically unacceptable. The requiring activity stated is not capable of meeting all technical requirements as defined in the PWS. proposal states that they are capable of performing all technical requirements defined in the PWS, but their proposal does not define all specific technical topics and are therefore not capable to facilitate the extremely technical and specialized training expertise needed. They specifically did not define in their proposal their ability to train in the ELK log aggregation tool, nor custom tool tuning via Pulled Pork or BPFs to filter traffic. The combined partnership does not show a past performance history of Cyber Defense/Security specialized training in intrusion detection, log analysis, etc. The requiring activity and stated they are not capable of meeting all technical requirements.

did not write to the technical requirements of PWS nor did they submit a capabilities statements.

Instead they submitted a training brochure.

10. OTHER FACTS:

a. Procurement History: Past efforts were made in coordination with Security Onion Solutions to obtain required mission training for cyber defense tools and monitoring. Three separate training sessions were purchased via Government Purchase Card (GPC) Security Onion Conference and two sessions of Security Onion Basic Training in FY15.

b. Acquisition data availability: Time, effort, and money have been invested in developing and advanced Security Onion training. Security Onion Solutions is the only vendor capable of providing comprehensive training on the entire tool suite. Security Onion Solutions is the best and most cost efficient way to meet the needs of the U.S. Army Cyber Protection Brigade.

c. Unusual and compelling urgency: Not applicable.

d. Subcontracting Competition: Not applicable.

11. TECHNICAL/REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance included in this Justification are accurate and complete to the best of my knowledge and belief.

12. MANAGEMENT REVIEW/APPROVAL: The requirement herein described is a valid requirement for the activity named in this Justification. The technical and requirements information contained in this Justification represent the minimum needs of the Government. The only way to satisfy this requirement is by limiting the competition as described herein.

13. FAIR AND REASONABLE COST DETERMINATION: I hereby determine that the anticipated price for this contract action will be fair and reasonable. Certified Cost and Pricing data will not be obtained.

The techniques identified at FAR 15.404-1(b) will be used to ensure award will be at fair and reasonable prices. The Contracting Officer used a comparison of industry cost for similar work. Additionally, the techniques identified at FAR 15.404-1(c)(2)(iii) will be used to further ensure award will be at fair and reasonable prices.

Contracting Officer

14. PROCURING CONTRACTING OFFICER CERTIFICATION: I certify that this Justification is accurate and complete to the best of my knowledge and belief.

Dig i ta l ly s ig n e d b y

M C ADO O .T AR A.L AF O NDA.1 1 1 0 5 4 7 0 8 7

DN: c = US , o = U.S . Go v e rn m e n t, o u = Do D, o u = P K I, o u = US A, c n = M C ADO O .T AR A.L AF O NDA.1 1 1 0 5 4 7 0 8 7 Da te : 2 0 1 6 .0 9 .1 5 1 5 :0 7 :2 1 -0 4 '0 0 '

Contracting Officer

X MCADOO.TARA.LAFOND

A.1110547087

Dig ita l ly s ig n e d b y M C ADO O .T AR A.L AF O NDA.1 1 1 0 5 4 7 0 8 7

DN: c = US , o = U.S . Go v e rn m e n t, o u = Do D, o u = P K I, o u = US A , c n = M C ADO O .T AR A.L AF O NDA.1 1 1 0 5 4 7 0 8 7

Da te : 2 0 1 6 .0 9 .1 5 1 5 :0 7 :0 2 -0 4 '0 0 '

MCADOO.TARA.LAF X ONDA.1110547087