1.08- SANS Justification and Approval-redacted.pdf

DEPARTMENT OF THE NAVY

NAVSUP FLEET LOGISTICS CENTER NORFOLK

700 ROBBINS AVENUE – BUILDING 2B

PHILADELPHIA, PA 19111-5083

J&A #20-055

JUSTIFICATION AND APPROVAL

FOR USE OF SOLE SOURCE

1. Identification of Agency and Contracting Activity.

Requiring Activity: Naval Criminal Investigative Service (NCIS)

27130A Telegraph Rd

Quantico, VA 22134

Contracting Activity: NAVSUP Fleet Logistics Center Norfolk Contracting Department, Philadelphia

Office, 700 Robbins Ave, Bldg 2B, Philadelphia, PA 19111-5083

2. Description of the Action Being Approved.

This is a new requirement for the award of a sole source, firm-fixed-price (FFP) order for educational courses and certifications provided solely by Escal Institute of Advanced Technologies, Inc. (SANS

Institute). This requirement is in support of the Naval Criminal Investigative Service (NCIS) Cyber

Workforce Continuous Learning Program.

3. Description of Supplies/Services.

The instant requirement is for an enterprise-wide solution that incorporates cyber investigation training, counterintelligence training and management training along with required certifications in order to remain compliant with Department of Defense (DoD) Directives and SECNAV Instruction. The course curriculum shall be accredited by the American National Standards Institute (ANSI), and be compliant with Department of Defense (DoD) Directive 8140.01 “Cyberspace Workforce Management”, which has renumbered and reissued the list of certified and compliant courses IAW DoD Directive 8570.01-M

“Information Assurance Workforce Improvement Program”. These courses must address the Office of

Personnel Management (OPM)’s National Initiative for Cybersecurity Education (NICE) Cyber Core

Competencies (CCCs): (1) Computer Network Defense, (2) Technology Awareness, (3) Vulnerabilities

Assessment, (4) Infrastructure Design, (5) Information Assurance, and (6) Information Systems/Network

Security.

The objective of this requirement is to provide high quality training services in accordance with SECNAV

Instruction 1543.2 “Cyberspace/Information Technology (IT) Workforce (WF) Continuous Learning”, which requires that all DoN Cyberspace/IT WF professionals accomplish specific training objectives on an annual basis, and SECNAV M-5239.2 “DoN Cyberspace IT and Cybersecurity Workforce

Management and Qualification Manual”, which establishes a qualification matrix for all continuous learning education courses affiliated with the DoD Directive 8570.01-M certified course list. Each NCIS

Cyber IT/WF professional will earn and maintain the appropriate Cyber Network Defense credentials and proficiency and provide the necessary technical Continuing Professional Education credits (CPEs) for advanced certification maintenance.

The following table provides the estimate for the requirement. The base year requirement will be funded with FY20 O&MN funds. Options will be funded with O&MN funds appropriate to the fiscal year in which the options are exercised:

Classes/trainings

Base Date of award thru 12 months thereafter

83 classes/courses

Option I End of Base period thru 12 months thereafter

83 classes/courses

Option II End of Option I thru 12 months thereafter

83 classes/courses

Option III End of Option II thru 12 months thereafter

83 classes/courses

Total 332 classes/courses

Name of Contractor: Escal Institute of Advanced Technologies, Inc. (SANS Institute)

11200 Rockville Pike Ste 200

North Bethesda, MD 20852

4. Statutory Authority Permitting other than Full and Open competition.

The statutory authority permitting this sole source action is 41 U.S.C. 1901, Simplified acquisition procedures - a sole source acquisition using simplified acquisition procedures for the acquisition of commercial items, as implemented by FAR 13.501(a).

5. Rationale Justifying Use of Cited Statutory Authority.

The NCIS Cyber Directorate supports and advances the agency’s mission of investigating and defeating criminal, terrorist, and foreign intelligence threats to the Department of the Navy (DoN) – in the maritime domain, ashore, and in cyberspace. The strategic goals of the Cyber Directorate are threefold: (1) Operate a unified cyber capability across the DoN network enterprise in support of law enforcement and counter-intelligence activities and protect DoN personnel, assets and infrastructure from foreign intelligence, criminal and terrorist threats; (2) Conduct operations and investigations in the cyber domain and provide digital information and analysis of counter-intelligence of evidentiary value; and (3) Enhance shared cyber situational awareness and implement operational, intelligence, and information-sharing relationships with key cyber counterparts to enable active network defense. The Cyber Directorate within

NCIS provides an agile, enterprise capability that supports the law enforcement/counter-intelligence mission and drives innovation in collaboration with mission partners, industry, and academia to out-maneuver and defeat threats to the DoN in cyberspace.

The NCIS Cyber Directorate training program is responsible for providing the means for training its

Information Assurance Manager (IAM)/ Information Assurance Technician (IAT) Cyber Investigators through a Continuous Learning Program (CLP) that incorporates course availability into its approved annual training budget and plan. NCIS IAM/IAT Cyber Investigators have significant security responsibilities and must receive specialized training to maintain their proficiency with the DoD cyber networks. The courses under the CLP program must be accredited by ANSI based on an International

ANSI/ISO/IEC 17024 accreditation program for personnel certification. This ANSI accreditation is required to ensure NCIS IAM/IAT Cyber Investigators are trained in the most up-to-date, highest caliber methods and have undergone a fair, valid, and reliable assessment to verify that they have the necessary competencies to combat cyber threats. The SECNAV Instruction 1543.2 “Cyberspace/Information

Technology (IT) Workforce (WF) Continuous Learning” requires that all DoN Cyberspace/IT WF professional accomplish three specific training objectives on an annual basis. First, they must maintain a

Level-II or III commercial certification under the SECNAV M-5239.2 mandate by attaining and reporting

Cyber Continuing Professional Education (CPE) credits. Second, they must attend a minimum of 40 hours of CPEs annually in the Cyber field according to the same mandate of SECNAV M-5239.2. Lastly, they must maintain their Computer Network Defense (CND) Incident Response Level-III advanced certifications with CPEs. The training CPEs required to meet these certification maintenance requirements must be of a formal technical nature from an ANSI-certified course curriculum and all courses must be certified by a Global Information Assurance Certification (GIAC) provider. GIAC

Certifications are unique to information security since they offer multiple technical and practical certifications in the areas of Cyber Security, Forensics and Management related courses. A GIAC certification is needed by NCIS Cyber directorate in order for its IAM/IAT professionals to remain compliant with the aforementioned directives and instructions.

SANS Institute is a well-versed educational firm that is capable of providing all of the cyber security, technical and managerial subject matter courses needed by NCIS’ IAM/IAT professionals. SANS

Institute is able to answer in depth questions on multiple topics, provide and facilitate the required training in a classroom and/or online setting, and is experienced at course designing, tracking and implementing strategies that use sound principles of learning to identify and achieve goals. More importantly, SANS Institute courses are accredited by ANSI and they are the only firm to offer the required GIAC certification for their courses, which SANS uses to measure specific skills and knowledge areas rather than general InfoSec knowledge. NCIS uses these affiliated GIAC courses/certifications for tracking all of their IAM/IAT professionals IAW SECNAV Instruction 1543.2 and SECNAV M-5239.2.

As a part of the Cyberspace/IT WF and CND CLP requirements, the courses provided by the SANS

Institute are a vital component to the program curriculum as they hone significant Information Assurance

(IA) & CND competency skills and qualify the IAMs/IATs as effective members of the NCIS Cyber

Directorate.

Besides offering the required ANSI accredited courses and GIAC certification, the SANS Institute’s voucher training program provides the necessary training mode and scheduling flexibility best suited to meeting NCIS training needs for its IAMs/IATs professionals. These courses can be taken online with an instructor, online on-demand, or in a standard classroom setting. The SANS Institute voucher training program offers ANSI accredited level courses with the affiliated GIAC certifications in a one-time purchase and allows the customer to accurately design, track and implement the necessary courses needed for its IAM/IAT professionals to stay up-to-date on their annual training requirements. The SANS

Institute voucher training program offered via the SANS Institute will provide NCIS the necessary technical and managerial courses to remain compliant with all directives and instructions. The services offered by SANS Institute have been determined to be the only one that can meet the Government’s minimum requirements.

6. Description of Efforts Made to Solicit Offers from as Many Offerors as Practicable.

NCIS Leadership conducted market research that included a review of GSA schedules and private sector training. NCIS reviewed GSA schedules for potential providers who could offer development training that focused on cybersecurity. Businesses like were all researched by NCIS. The courses offered by each of these schedule holders could not meet the minimum needs of the government. While the curriculum offered by these GSA Vendors includes Level-

I/II commercial courses/certifications, these course offerings failed to meet the Government’s minimum requirements for approved Level III courses. In addition, none of the courses offered the GIAC certification required in order to comply with the DoD Directives and Instructions.

SANS Institute has been identified as the only provider that can offer the required Level III courses and

GIAC certifications needed to ensure compliance with the DoD Directive 8570.01-M list of certified courses and the SECNAV Instruction 1543.2 “Cyberspace/Information Technology (IT) Workforce (WF)

Continuous Learning” training objectives. Lastly, market research indicated that all other providers only offer traditional training courses in specific geographical regions, whereas the SANS Institute offers flexible training in ninety (90) cities nationwide via multiple delivery methods such as large events, small and local community classes, and online web-based instruction with courses updated routinely to keep up with technology all of which is needed to meet the needs of a geographically dispersed NCIS workforce.

NCIS also looked into several private sector cybersecurity training providers and their offerings including

. However, none of the private companies could meet government’s minimum requirement to provide a GIAC certification for the approved course listing stated in the DoD Directive 8570.01-M “Information Assurance Workforce Improvement Program”.

7. Determination of Fair and Reasonable Cost.

The NAVSUP Fleet Logistics Center (FLC) Norfolk Philadelphia Office Contracting Officer has determined the anticipated cost to the Government for the equipment listed in paragraph 3 and covered by this J&A will be both fair and reasonable.

8. Actions to Remove Barriers to Future Competition.

For the reasons set forth in paragraph 5 above, NAVSUP FLC Norfolk, Philadelphia office has no plans at this time to compete future requirements for the types of services covered by this document. However, NCIS is continually assessing the marketplace since as NCIS’ mission and operational requirements change, other service offerings may be considered viable for future acquisitions. If another potential source or service offering emerges, NAVSUP FLC Norfolk, Philadelphia Office will assess whether competition for future requirements is feasible.

9. Contracting Point of Contact.

The point of contact at NAVSUP FLC Norfolk Contracting Department, Philadelphia Office is Mr. James

McDevitt (Code 280.3J) who may be reached at 215-697-5025 or james.h.mcdevitt@navy.mil.

CERTIFICATIONS AND APPROVAL

TECHNICAL/REQUIREMENTS CERTIFICATION

I certify that the facts and representations under my cognizance which are included in this Justification and its supporting acquisition planning documents, except as noted herein, are complete and accurate to the best of my knowledge and belief.

Technical Cognizance:

Signature Name (Printed) Phone No. Date

Requirements Cognizance:

LEGAL SUFFICIENCY REVIEW

I have determined this Justification is legally sufficient.

CONTRACTING OFFICER CERTIFICATION

I certify that this Justification is accurate and complete to the best of my knowledge and belief. To the extent that the J&A/LSJ value is between $250K and $700K, the Contracting Officer’s signature below also represents approval of the J&A/LSJ.

CONTRACTING ACTIVITY COMPETITION ADVOCATE REVIEW

To the extent that the J&A/LSJ value is between $700K and $13.5M, the Competition Advocate’s signature below also represents approval of the J&A/LSJ.