832016921 JA Redacted.pdf

JUSTIFICATION & APPROVAL (J&A) FOR FEDERAL ACQUISITION

REGULATION (FAR) SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Schedule/Multiple Award Contract (MAC)

Orders under MAC/ Fair Opportunity – FAR 16.505, Department of Defense FAR Supplement (DFARS) 216.505-70, Procedures, Guidance and Information (PGI) 216.505-70

Purchase Request Number: To Be Determined (TBD) Contract Number: HC1047-18-D-2003 Task/Delivery Order Number: TBD Procurement Title: XTS Bug Bounty (BB) Remediation Estimated Value:

Statutory and Regulatory Authority: 10 U.S.C. 2304c(b) and FAR 16.505(b)(2)(i)(B)

EXCEPTION TO FAIR OPPORTUNITY

Number: JA20-175

Upon the basis of the following justification, I, as the Procuring Activity Competition Advocate, hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C. 2304c(b) and Regulatory Authority of FAR 16.505(b)(2)(i)(B).

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

Defense Information Systems Agency (DISA)/ DISA/Development and Business Center (DBC)/ Perimeter Division (ID5) 6910 Cooper Avenue Fort Meade, Maryland 20755

Contracting Activity:

DISA/Defense Information Technology Contracting Organization (DITCO) PL8311 2300 East Drive, Building 3600 Scott Air Force Base, Illinois 62225

2. NATURE/DESCRIPTION OF ACTION(S): The nature of this action is to issue a new task order to BAE Systems, Inc. against Systems Engineering, Technology, and Innovation contract HC1047-18-D-2003 for BB Remediation services and products. The requirement includes aremote monitoring capability on the commercial-off-the-shelf, BAE Systems, Inc. brand-name XTS Guard units, previously acquired by DISA. In order to comply with the National Cross Domain Strategy Management Office (NCDSMO)’s Raise-the-Bar (RTB) requirements, remote monitoring capability of the XTS Guard is required. The task order will be funded with operations and maintenance (O&M) funds, and will consist of a firm fixed price line item.

3. DESCRIPTION OF SUPPLIES/SERVICES: The DISA/DBC/ID5 Cross Domain Enterprise Service (CDES) program requires the ability to manage the XTS Guard from a remote location.

In order to do accomplish this, the Government requires implementation of the remote

XTS BB Remediation-JA20-175

Page 2 of 5 Pages monitoring capability on the XTS Guard. The Government requires engineering, design, development and testing support for BB Remediation of the XTS Guard in order to comply with the NCDSMO’s RTB requirements. One of the RTB requirements includes implementation of a remote monitoring capability for the XTS Guard. Remote monitoring is defined as the ability to remotely monitor the configuration and operation of the XTS Guard and includes actions such as: journaling, auditing, and logging subsystem. This includes the centralized audit/logging daemon, central journal daemon, and remote transfer. Remote monitoring can also be used to remotely manage the XTS Guard. The period of performance for the task order consists of only a 12-month period estimated to start September 17, 2020 and end on September 16, 2021.

The estimated lifecycle cost of this requirement is .

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity. FAR 16.505(b)(2)(i)(B) – Only one awardee is capable of providing the supplies or services required at the level of quality required because supplies or services ordered are unique or highly specialized.

(b) Description of the Justification. Since 2013, the Government has acquired XTS Guard systems as part of DISA’s CDES infrastructure. The BAE XTS Guard for XTS BB Remediation is a highly specialized commercial-off-the-shelf product. To comply with the NCDSMO’s RTB requirements to enable remote monitoring of the XTS Guard, CDES requires highly specialized services to implement the capability. Only BAE Systems, Inc., can implement the remote monitoring capability on XTS Guards because BAE Systems is the original equipment manufacturer (OEM) and does not license sale of the proprietary products or servicing of the XTS Guard to other companies. The XTS Guard suite of products while commercially-off-the-shelf is proprietary to BAE Systems, Inc. Only BAE System Inc. Cybersecurity Portfolio engineers are highly specialized and authorized to modify the proprietary software and Secure Trusted Operating Program (STOP) system.

Currently, no other vendor is authorized to modify the proprietary software and STOP operating system of the XTS Guard.

(c) Justification.

(1) Minimum Government requirements. The verified minimum requirements of the

Government include the implementation of remote monitoring capability to the BAE XTS Guard for BB Remediation. The deliverables include design drawings and demonstration of the remote monitoring capability of the BAE XTS Guard.

(2) Proposed sole source contractor. BAE Systems, Inc., the OEM and servicer of the proprietary XTS Guard.

(3) Discussion regarding cause of the sole source situation. As discussed in paragraph 4(b), since 2013 DISA’s infrastructure has come to include brand name BAE XTS Guards. Only BAE Systems, Inc.’s Cybersecurity Products Portfolio engineers can perform the highly specialized task in engineering, designing, developing and testing

Page 3 of 5 Pages because the XTS Guard software and STOP operating system software codes are proprietary to BAE Systems, Inc.

(4) Demonstration of unique source. The Government conducted market research and did not identify any other company that can provide XTS Guard products or accomplish the Government’s XTS BB Remediation support needed. BAE Systems, Inc. is the OEM of the XTS Guard and solely maintains the proprietary information needed to make changes to the CTS Guard. BAE Systems and their Cybersecurity Portfolio engineers are the only ones highly specialized to perform the proprietary services to implement the required remote monitoring capability, which the Government needs to meet the NCDSMO’s RTB requirements.

(5) Procurement discussion. XTS Guard and the proprietary support services are only available by the OEM, BAE Systems. This is a follow-on service procurement to continue to provide Bug Bounty Remediation monitoring services, with an expanded focus of insuring “remote” monitoring capabilities; which also ensure compliance with NCDSMO’s RTB requirement for remote monitoring. Additional equipment to facilitate the remote monitoring of each XTS Guard will be acquired and deployed.

This task order follows contract GS-35F-351DA, task order HC102819F1141, the deployment of Bug Bounty Remediation. Only one source is capable of responding due to the unique or specialized nature of the work, which includes BAE Systems XTS Guard Suite, STOP license suite, maintenance and support, and product training.

(6) Impact. If the Government were unable to obtain BAE Systems, Inc. highly specialized support for XTS BB Remediation, the CDES would not comply with the NCDSMO’s RTB requirements and the Department of Defense’s (DoD) cross domain enterprise email capability may become vulnerable to cybersecurity attacks. The reach would extend to all of CDES’s cross domain mission partners including the United States Armed Forces, Combatant Commands, DoD agencies, coalition partners and other Federal agencies.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION: A price evaluation will be accomplished to determine the price fair and reasonable. Fixed price labor rates have been established on the SETI Full and Open contract vehicle and will be used in conducting the price analysis.

6. MARKET RESEARCH: Market research was conducted to identify all qualified sources and the results thereof. BAE Systems, Inc. is the OEM for the XTS Guard, and market research was conducted to determine whether authorized resellers are available to provide the requirements.

The market research did not find any resellers, and as a result, there were no other service providers found. BAE Systems, Inc., is the only company that can provide XTS Guard products and the XTS BB Remediation support. The XTS Guard software and STOP operating system software codes are proprietary to BAE Systems, Inc.

Based on current market research, dated July 2020, it has been determined that only BAE Systems, Inc., can fully support the Governments need. These services are highly specialized and no other vendor can provide the proprietary products and/or product support. No competitor functional replacement products exist in the market at this time to meet the Government's need.

The Government will continue to conduct market research to determine if there are changes in

Page 4 of 5 Pages the market place that would enable future competitive actions, i.e. there are similar products and/or product support in the marketplace that provide the same functionality; the original equipment manufacturer releases ownership rights of product; or it is economically feasible to procure a new system.

7. ANY OTHER SUPPORTING FACTS: None.

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History.

(1) GS-35F-351DA/HC102819F1141 awarded on September 17, 2019.

(2) Sole Source order award to BAE Systems, Inc., General Services Administration

Schedules/Federal Supply Schedules in accordance with FAR 8.405-6.

(b) At this time, it is deemed that only BB Remediation of the XTS Guard would be able to function with DISA’s current architecture. The BB Remediation must be procured through BAE Systems, Inc. Regardless, the Government will continue to search the marketplace, and alternative solutions will continually be researched to determine if they will function with currently used products. If the Government determines that BAE Systems BB Remediation is no longer required or other products meet the Government’s needs, the Government will seek full and open competition for the required functionality.

If similar requirements arise, every effort will be made to compete it to the maximum extent practicable.

Page 5 of 5 Pages

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE: See separate signature page

TITLE/ORGANIZATION: Lead Engineer/ID22

PHONE: DATE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE: See separate signature page

TITLE/ORGANIZATION: Program Manager/ID22

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE: See separate signature page

TITLE/ORGANIZATION: CONTRACTING OFFICER/DITCO/PL8311

PROCURING ACTIVITY COMPETITION ADVOCATE (PACA) APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief. Since this justification does not exceed $13.5M, this review serves as approval and my written determination that the aforementioned FAR circumstances apply.

NAME: SIGNATURE: See separate signature page

TITLE/ORGANIZATION: Procuring Activity Competition Advocate

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

Brittney Galle, 618-418-6327, brittney.e.galle.civ@mail.mil