JA_831609248_(signed).pdf

Page 1 of 6 Pages

JUSTIFICATION FOR OTHER THAN FULL AND

OPEN COMPETITION (OTFAOC)

Federal Acquisition Regulation (FAR) Part 6 Justification & Approval (J&A), Supporting Procurements under FAR Part 12, FAR Subpart 13.5, and FAR Part 15

Purchase Request Number: 831609248 (DITCO Tracking #) Contract Number: To be determined Task/Delivery Order Number: N/A Procurement Title: Data and Identity Verification Process Services Estimated Value:

Statutory Authority: 10 U.S.C. 2304(c)(5)

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION (OTFAOC)

Justification for OTFAOC Number: N/A

Upon the basis of the following justification, I, as the Contracting Officer, hereby approve the use of other than full and open competition of the proposed contractual action pursuant to the authority of FAR 6.302-5(b)(6), sole source awards under the Veterans Benefits Act of 2003 (15 U.S.C. 657f).

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

Requiring Agency:

Defense Manpower Data Center (DMDC) Enterprise Business Management 4800 Mark Center Drive, 04E25 Alexandria VA, 22305

Contracting Office:

DISA/DITCO/PL8312

2300 East Drive, Bldg 3600 Scott AFB, IL 62225

2. NATURE/DESCRIPTION OF ACTION(S):

This is as a new sole source award to a service-disabled veteran-owned small business (SDVOSB). The contract type is firm-fixed price with one-year base period of performance (PoP). The estimated PoP is September 28, 2016 through September 27, 2017. The estimated contract amount is estimated to be . Funds from the requesting agency are from a revolving fund with the statutory authority 5 U.S.C. 1304 (e)(1). The servicing agency’s authority is the Economy Act (31 U.S.C. 1535/FAR 17.5).

3. DESCRIPTION OF SUPPLIES/SERVICES:

The background for this requirement is from the effects of the targeted data breach of the Office of Personnel Management (OPM) that resulted in the Personally Identifiable Information (PII) being compromised. The Department of Defense (DoD) and OPM are working together to mitigate the damage to personnel, to include the development and

Page 2 of 6 Pages implementation of a Government verification service which will provide data breach and protection notices to the affected individuals. An Undefinitized Contract Action (UCA) was awarded as contract number HC1028-15-P-0340 in September 2015, and definitized in March 2016 at a total price of . The following services are being performed under contract HC1028-15-P-0340:

(1) Returned Mail Operations – The contractor shall develop, test, and implement procedures to handle the processing of returned mail. Trained analysts will manually process forms by scanning the quick response code on each mailing in order to record the reason for return. A database will be developed in order to capture and track the information. Individuals who believe they may have been affected by the breach, but have not received notification, will be able to manually complete a form to submit to the Government verification service provider, who will process each form and take action as necessary.

(2) Operations and Application Support – The contractor shall support website maintenance to continue a self-service, user friendly, public website managed on the DMDC infrastructure. Personnel will be able to securely provide PII information in order to investigate their eligibility without calling a Government call center.

This requirement will provide the Government with additional mailing notification support, a returned mail system, security operations, application sustainment, verification web services and back end process for an estimated . The back end process is required to determine whether a requestor’s PII was compromised and therefore entitled to services. The estimated PoP is September 28, 2016 through September 27, 2017. The estimated contract amount is estimated to be .

4. IDENTIFICATION OF STATUTORY AUTHORITY:

In accordance with sole source awards under the Veterans Benefits Act of 2003, 10 U.S.C.2304(c)(5). (FAR 6.302-5/DFARS 206.302-5. 15 U.S.C. 657f.

5. DEMONSTRATION OF CONTRACTOR’S UNIQUE QUALIFICATIONS:

(a) Description of events.

(1) In June of 2015, OPM announced that it had been the target of a data breach involving personnel records including PII and background investigation information. In July 2015, the estimated number of stolen records increased . The Secretary of Defense and White House staff have requested expedited mitigation and implementation action related to the breach in accordance with the DoD Directive 5400.11-R, "DoD Privacy Program". An aggressive implementation schedule was identified to include performance of this effort beginning by September 28, 2015, the returned mail processing application being active by October 9, 2015, and the website being active by November 17, 2015.

Contract HC1028-15-P-0340 was awarded as a UCA in September 2015, and definitized in March 2016 in order to meet the above requirements. Due to a higher

Page 3 of 6 Pages than anticipated response to the initial letters, the Government requires additional mailing notification support, a returned mail system, security operations, application sustainment, verification web services and back end process for an estimated

(b) Justification.

(1) Minimum Government requirements. The contractor is a capable source who possesses the required Top Secret facility security clearances (to include the ability to access a DoD Sensitive Compartmented Information Facility (SCIF) which would require a Top Secret/ Sensitive Compartmented Information personnel clearance); has knowledge of DMDC’s infrastructure (which would require having a basic understand of the systems semantics, hardware interoperability, security procedures, and basic understanding the internal database administrative requirements); and has knowledge of methodologies used in support of data analytics supporting OPM data breaches and newly integrated DoD hardware and software configuration supporting the identity resolution of affected personnel, and ability to fully perform the effort.

(2) Proposed sole source contractor. The proposed sole source contractor is Advanced Onion, Inc. (AO), a SDVOSB. AO is uniquely qualified to support the Government’s verification service requirement due to their existing facility security clearances, existing cleared contractor personnel who already have access to the DMDC facilities and SCIFs, knowledge of DMDC’s infrastructure, and AO has the ability to meet the full requirements of the Government within the established timeline. To date, AO is the only contractor who has supported DMDC with OPM breach identity verification processes to include cyber, information assurance, IT development and hardware support. Additionally, AO personnel are the only current contractors located at DMDC with immediate access to two approved SCIFs. It is estimated that it would take another contractor that does not already possess these salient characteristics approximately three to six months to reach the current capabilities of AO, which is not acceptable given the need for the vendor supporting this effort to hit the ground running. The Government does not have the funding nor the time to allow for a transition.

(3) Discussion regarding cause of the sole source situation. In June of 2015, OPM announced that it had been the target of a data breach involving personnel records including PII and background investigation information. In July 2015, the estimated number of stolen records was increased . The Secretary of Defense and White House staff have requested expedited mitigation and implementation action related to the breach in accordance with the DoD Directive 5400.11-R, “DoD Privacy Program”. An aggressive implementation schedule was identified to include performance of this effort starting by September 28, 2016

. Services are on-going under contract HC1028-15-P-0340, and now an additional requirement exists for more personnel due to a higher than anticipated response to the letters. A new contractor would require at least three to six months to stand up their operations, but it is essential that the work begin at the time of award; the

Page 4 of 6 Pages

Government would not able to sustain its operations while another contractor transitions.

(4) Demonstration of unique source. In accordance with FAR 19.1406 and 6.302-5(b)(6), award shall be made to AO (a SDVOSB) on a sole source basis as the contracting officer does not have a reasonable expectation that offers would be received from two or more SDVOSBs. As discussed in paragraph 5(b)(2), AO already possesses the necessary facility security clearances, cleared personnel with DMDC access, knowledge of DMDC’s infrastructure, and is currently supporting DMDC with identity verification processes. AO is the only company identified that can perform all of the Government’s requirements. It is estimated that it would take another contractor approximately three to six months to reach the current capabilities of AO, which does not meet the minimum requirements for this acquisition. AO performed services under contract HC1028-15-P-0340, and remains the only contractor who can continue to perform. They developed a website and mail processing application under contract HC1028-15-P-0340, and another contractor would be unable to support the additional personnel, as they do not have the knowledge or experience of prior services performed.

(5) Procurement discussion. Based on the nature of the requirement, there is not a reasonable expectation that another SDVOSB is capable of meeting the performance parameters of this effort; therefore, a sole source award to AO is the most appropriate course of action. AO will be continuing the support they were providing on contract

HC1028-15-P-0340.

(6) Impact. As a result of the OPM data breach, American citizens consisting of current and retired federal employees, active duty and retired service men and women have had their PII and financial information compromised by foreign adversaries. As fully described in paragraph 5(b)(3), the impact of not awarding this contract action on a sole source basis includes furthering the DoD’s and OPM’s noncompliance with DoD Directive 5400.11 and increases the risk of additional impacts related to the compromised PII and future attempts to breach Government databases. This new support of an additional personnel falls within the same Directive, and it is vital to continue to support the ongoing effort to protect their PII.

6. FEDBIZOPPS ANNOUNCEMENT/POTENTIAL SOURCES: Synopsis not required in accordance with FAR 5.202(a)(4).

7. DETERMINATION OF FAIR AND REASONABLE COST: The contracting officer will make a determination that the anticipated price/cost to the Government is fair and reasonable using a variety of techniques identified at FAR 15.404. Techniques will include comparison to similar contracts/services and associated rates and the independent Government cost estimate. In addition, if necessary, the contracting officer will request certified cost and pricing data, or other than certified cost and pricing data in order to make a fair and reasonable determination.

Page 5 of 6 Pages

8. MARKET RESEARCH: Market research was performed in accordance with FAR 10.002 prior to the award of HC1028-15-P-0340, in September 2015. A review of the Federal Supply Schedules and the Dynamic Small Business Site did identify that there were small businesses that could potentially perform pieces of the work; however, it was determined unlikely that any other contractor could perform the entire requirement within the compressed timeframe necessary. The identified sole source contractor, AO, is a SDVOSB; therefore, additional market research efforts focused on locating other potential SDVOSB contractors who could meet the Government’s requirements and compressed schedule. As addressed above and throughout the J&A, AO was the only identified SDVOSB contractor that currently held the appropriate TS facility security clearance, TS/SCI cleared personnel in place, and enough knowledge of the requirement and DMDC infrastructure to begin performance immediately. AO performed the requirements under contract HC1028-15-P-0340, and now the same requirements exist for approximately an additional personnel due to a higher than anticipated rate of responses.

9. ANY OTHER SUPPORTING FACTS: A sole source award to AO is in compliance with FAR 19.1406 Sole Source Awards to Service-Disabled Veteran-Owned Small Business Concerns, and FAR 6.302-5(b)(6) Sole source awards under the Veterans Benefits Act of 2003 (15 U.S.C. 657f).

10. LISTING OF INTERESTED SOURCES:

As provided in paragraph 8, AO was the only source identified in market research efforts to determine capable sources. No additional interested sources were identified that could meet the minimum requirements stated in paragraph 5(b)(1).

11. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FULL AND OPEN COMPETITION:

(a) Procurement History.

(1) HC1028-15-P-0340, awarded as a sole-source contract to an SDVOSB UCA Award September 2015.

Definitization March 2016

(b) At this time, Advanced Onion remains the only vendor who can complete this work. Until this requirement’s security and knowledge requirements are relieved, the Government will require a vendor who has the security clearances and institutional knowledge that Advanced Onion possesses.

(c) If the requirement’s security and knowledge requirements are relieved, the Government will expand market research efforts and plan to transition the requirement into a state that another contractor would have ample time to establish necessary attributes to be able to compete for a follow-on contract.

12. REFERENCE TO THE APPROVED ACQUISITION PLAN (AP): NA. This effort is below the threshold requiring an AP.

Page 6 of 6 Pages

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

TITLE/ORGANIZATION:

PHONE: DATE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

TITLE/ORGANIZATION:

PHONE: DATE:

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief. Since this effort exceeds $150K but does not exceed $700K, this certification serves as APPROVAL.

NAME: SIGNATURE:

TITLE/ORGANIZATION:

PHONE: DATE:

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO