36C10B20C0026-001.doc

Ascertia Software Maintenance, Support and Update Services

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION

1. Contracting Activity:

Department of Veterans Affairs (VA)

Office of Procurement, Acquisition, and Logistics

Technology Acquisition Center

23 Christopher Way

Eatontown, NJ 07724

2. Description of Action: The proposed action is to award a Firmed-Fixed Price (FFP) contract on a sole-source basis for the renewal of the brand name Ascertia software maintenance and support services to Technology Solutions Group, Inc. (TSG) located at 11877 Douglas Rd., Suite 102-116, Alpharetta, GA 30005.

3. Description of Supplies or Services: VA Office of Information and Technology, Solution Delivery, Directory Services, has a requirement for brand name Ascertia software maintenance and support for Online Certificate Status Protocol (OSCP) and Certificate Revocation List (CRL) services and Public Key Infrastructure (PKI) service within VA. OCSP CRL and PKI services are integral to VA’s email encryption and system logon. The maintenance will provide support for issues, fixes and new software releases in support of the Ascertia software. The period of performance for this requirement is a 12-month base period with four 12-month option periods. The total estimated price of the proposed action is XXXX, inclusive of four option periods.

4. Statutory Authority: The statutory authority permitting other than full and open competition is 41 U.S.C. 3304(a)(1) as implemented by the Federal Acquisition Regulation (FAR) 6.302-1 entitled, “Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements.”

5. Rationale Supporting Use of Authority Cited Above: The proposed source for this action is TSG, located at 11877 Douglas Rd., Suite 102-116, Alpharetta, GA 30005. Based on extensive market research, as described in Section 8 of this document, it was determined that no other source, other than TSG can provided the required software maintenance services.

In Fiscal Year 2012, VA conducted a competition to satisfy its PKI, OSCP and CRL requirements, and as a result of this competition, Ascertia software was selected.The required maintenance and support to be provided under this action is critical to ensure the continued functionality of VA’s PKI, OCSP, and CRL. VA uses PKI for email encryption, system logon, and monitoring the availability of their systems. OCSP and CRL services are integral to PKI, because they allow VA to validate the issued PKI certificates to protect the integrity of their computer systems. Ascertia software maintenance and support consists of patches and updates that only Ascertia, or its certified reseller of Ascertia products and services can provide. Specifically, a source must have access to manipulate the proprietary source code in order to provide seamless interoperable patches and updates. As noted in section 8 of this justification, TSG is only authorized reseller, and therefore the only source that can provide these updates.

Additionally, while other entities provide some similar services for their own solutions, such as Citrix and Cisco, none of these sources can provide the required interoperable patches, updates and maintenance services of the deployed solution. Only through replacement of the entire Ascertia software solution, could these firms or its resellers provide the required maintenance.

Failure to procure the required maintenance and support services as proposed would disable ability to keep the software up to date and performing at optimal levels. Intoducing a new application would pose significant risk to VA operations.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in the market research section 8 of this document. This effort did not yield any additional sources that can meet the Government’s requirements. There is no competition anticipated for this acquisition. Additionally, the proposed action will be synopsized on the Federal Business Opportunities Page in accordance with FAR FAR 5.201. Any proposals that are received shall be evaluated.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the market place that would enable future actions to be competed.

8. Market Research: Market Research conducted in December 2019 via posting of a Request for Information (RFI) on December 13, 2019 on the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-Wide Acquisition Contract (GWAC) website. The NASA SEWP V GWAC RFI resulted in zero responses. As a result, an RFI was posted to the Contract Opportunities Page on February 6, 2020, which provided a description of the service required and requested information describing the company’s capability to meet the requirements. The Contract Opportunities RFI closed on February 12, 2020 with one response received from TSG. TSG stated that it is an authorized reseller of Ascertia software and services. Formal documentation of this status has been provided directly from Ascertia, the original equipment manufacturer (OEM). The Government followed up to see if additional authorized resellers could be identified by contacting the OEM, Ascertia, requesting information about the authorized resellers of their products and services. OEM responded on February 6, 2020 with an email stating that TSG is the only authorized reseller of the Ascertia products and services. Therefore, services will be sole sourced to TSG due to Ascertia’s proprietary rights to the software.

Additional Market Research was conducted in December 2019 by the Government’s technical experts via review of other similar products websites, to ascertain if replacement of this software was viable. Specifically, VA technical experts reviewed other software tools that included Citrix NetScaler Gateway and Cisco Unified Communications Manager to determine if these alternatives software products were capable of satisfying the Government’s requirements, such as providing continuous monitoring, updating or applying bug fixes to support the software.

Citrix NetScaler Gateway – Security device which includes a capability to monitor OCSP and CRL traffic. This is a hardware device, not an application, and would require an install location for each device. It monitors OCSP responders by creating traffic (OCSP protocol messages) and evaluating the returned response. It does not perform continuous monitoring, required under this effort, but does a cache response which is less reliable than continuous monitoring.

Cisco Unified Communications Manager – provides monitoring capability for OCSP responses and CRL availability. It is not the primary purpose of the application; the applications primary purpose is certificate management; end point monitoring is an added feature of the application. It monitors OCSP responders by creating traffic (OCSP protocol messages) and evaluating the returned response. It performs monitoring based on the encoded content of a certificate. At this time, the Government does not require certificate management capability, and therefore would provide VA with unnecessary capabilities.

Additionally, each of these brands offers a proprietary software system that will only operate with its approved hardware and software.

9. Other Facts: None.

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

Date: __________________________ IT Specialist

Signature: ________

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on price analysis to include comparison of negotiated prices to the Independent Government Cost Estimate and historical pricing.

Date: ________________________________ Procuring Contracting Officer Signature: ____________________________

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief. As this contract action does not exceed $700,000, the certification below required by FAR 6.303-2(b)(12) serves as approval.

Date: ________________________________

Procuring Contracting Officer Signature: ____________________________