Redacted_JA24-081 CUI - 842469570.pdf

CUI

Page 1 of 8 Pages

Controlled By: DISA Controlled By: HC34 CUI Category: PROCURE Distribution/Dissemination Control: FEDCON POC: Justin Sollenberger, 717-918-6149; Justin.W.Sollenberger.civ

JUSTIFICATION FOR OTHER THAN FULL AND

OPEN COMPETITION (OTFAOC)

Federal Acquisition Regulation (FAR) Part 6 Justification & Approval (J&A), Supporting Procurements under FAR Part 12, and FAR Part 15

Purchase Request Number: HC110424MP60008 Contract Number: To Be Determined (TBD) Task/Delivery Order Number: TBD Procurement Title: International Business Machines (IBM) Zero Trust Compliancy Software Solution Estimated Value:

Statutory and Regulatory Authority: 10 U.S.C. §3204(a)(1) and FAR6.302-1

Justification for OTFAOC Number: JA24-081

Upon the basis of the following justification, I, as Procuring Activity Competition Advocate (PACA), hereby approve the use of other than full and open competition of the proposed contractual action pursuant to the authority of FAR 6.302-1, only one responsible source and no other supplies or services will satisfy Agency requirements.

1. REQUIRING AGENCY AND CONTRACTING ACTIVITY:

Requiring Agency:

Defense Information Systems Agency (DISA)/Hosting and Compute (HAC)/HC3 6906 Cooper Avenue Fort Meade, Maryland 20755

Contracting Activity:

DISA/Defense Information Technology Contracting Organization (DITCO)/PS8413 2300 East Drive, Building 3600 Scott Air Force Base, Illinois 62225

2. NATURE/DESCRIPTION OF ACTION(S):

(a) The purpose of this action is to procure a proprietary, brand-name, commercial off-the-shelf IBM Zero Trust Compliancy Software solution for DISA, in support of Data Center Mechanicsburg and Data Center Ogden. The procurement will be awarded as a firm-fixed price, sole source contract to IBM Corporation, the original equipment manufacturer (OEM) of IBM Zero Trust Compliancy Software solution.

JA24-081 IBM Zero Trust Compliancy

Page 3 of 8 Pages

• Serve as mediation layer between Mainframes and DoD Identity Credential and Access Management (ZERO TRUST COMPLIANCY) solutions (i.e., Radiant Logic Application programming interface APIs, Sailpoint plugins, etc.);

• User Self-service password reset, and account unlock;

• Certificate-based authentication, Personal Identity Verification, Common Access

Card (CAC) support; comply with DoD Mainframe Security Technical Implementation Guide audit standards;

• Create and manage IDs within the Multi Host Internet Access Portal internal user account repository (Windows Active Directory) utilized by Microfocus (OpenText) Host Access for the Cloud.

4. IDENTIFICATION OF STATUTORY AUTHORITY:

This acquisition is conducted under the statutory authority of 10 U.S.C. §3204(a)(1) and the regulatory authority of FAR 6.302-1/Defense FAR Supplement 206.302-1, only one responsible source and no other supplies or services will satisfy Agency requirements. The software and support are peculiar to a specific brand-name, IBM.

5. DEMONSTRATION OF CONTRACTOR’S UNIQUE QUALIFICATIONS:

(a) Description of events.

The required IBM software and support is the only brand capable of meeting the Government’s requirement due to the particular features that are essential to the requirement as mentioned above. In addition, only IBM software and support would be able to function with the current IBM products/infrastructure in place at DISA. Market research indicates other companies’ similar products, or products lacking particular features, do not meet, or cannot be modified to meet, the agency’s needs.

(b) Justification.

(1) Minimum Government requirements.

The Government’s minimum requirements are for a Zero Trust Compliancy Software solution, to include web-based installation, scripting, implementation, and customization assistance, as described in paragraph 3, to ensure a quick and smooth rollout process to upgrade cybersecurity.

The software licenses, software subscriptions and support required by DISA to meet the Zero Trust Compliancy Software solution requirement are as follows:

• Verify Access Virtual Enterprise Edition subscriptions

• Verify Governance Enterprise

• Verify Governance Host Adapters

• zSecure CICS Took Kit V3 perpetual licenses

• z/Multi-Factor Authentication V2

• IBM Lab Services for MFA Integration

Page 4 of 8 Pages

• IBM Lab Services for Security Verify Solution Implementation

To implement and maintain the Zero Trust Compliancy solution, DISA requires assistance to create architectural design to support the MVP solution based on stated requirements and assist in deployment of the IBM Security Verify Access (ISVA) and IBM Security Verify Governance (ISVG) solution in a single non-production environment. Configuration assistance is required with the ISVA and ISVG MVP solution to support a Zero Trust Compliancy software MVP, and conduct unit testing of the Verify MVP solution, assist DISA to system test and resolve any issues, document the solution in a deployment summary, and conduct transfer of information sessions. Lastly, DISA requires assistance with deployment of the ISVA and ISVG in production and configure according to the documented design and deployment summary. Only IBM’s software and unique support allow for successful integration support of the DISA’s Zero Trust Compliancy requirement.

Per Directive DoDI8520.03 Identity Authentication for Information Systems, the Identity Provider (IdP) and Automated Account Provisioning (AAP) are initial enterprise Zero Trust Compliancy software capabilities that are now ready for DoD-wide adoption. For any applications that will persist beyond September 31, 2025, system owners will adopt Enterprise, or another federated DoD Zero Trust Compliancy Software Capability as approved by the Change Control Board.

• Phase 1: Adopt an approved Enterprise or federated IdP by September 30, 2025.

• Phase 2: Implement AAP services for system user account creation and management for CAC and non-CAC holders by December 31, 2028.

The DoD Enterprise Zero Trust Compliancy Software capabilities and services include DoD Public Key Infrastructure, Defense Manpower Data Center's Person Data Repository, Mission Partner Registration, Enterprise Identity Attribute Service: DISA Global Federated User Directory, Identity Provider, Master User Record, and Automated Account Provisioning System.

Effective immediately, all components will maximize the use of DoD enterprise Zero Trust Compliancy software capabilities unless the component implements an approved alternative Zero Trust Compliancy software solution.

(2) Proposed sole source contractor and demonstration of unique source.

IBM is the only vendor that can deliver both the software installation and unique support that is needed to train DISA staff. IBM is the only vendor capable of conducting design workshops with DISA to solidify solution requirements for an initial Zero Trust Compliancy.

(3) Discussion regarding cause of the sole source situation.

Page 5 of 8 Pages

DISA has a need for reliable, responsive, and vendor supported Zero Trust Compliancy products to meet Mission Partners’ requirements. Beginning in 2004, IBM hardware was integrated and standardized into DISA’s Data Center Mechanicsburg and Data Center Ogden. From 2004 to present DISA has invested over in the hardware configuration. Given this established IBM hardware architecture, only IBM software and support can be utilized, as it is. This proprietary solution is only available from IBM as they own the copyrighted source code with all legal rights, privileges, and ownership contained therein. Additionally, market research confirmed that IBM’s software and support are the only products that meet all the capability requirements for DISA’s Zero Trust Compliancy Software solution. IBM is the sole licensor of the software and support, and there are no resellers authorized to resell this software and support. IBM Zero Trust Compliancy products are essential to the Government’s requirements, and market research indicates other companies’ similar products, or products lacking particular features, do not meet, or cannot be modified to meet the Government’s needs without significant program, operational and cost risk to DISA and the supported missions. It is not economically feasible to deviate from the currently installed IBM proprietary hardware/software infrastructure as alternating to an alternative OEM would require a minimum 5-year period implementation phase.

Therefore, the Government’s minimum requirements are for proprietary IBM Zero Trust Compliancy software and support as described above.

(4) Impact.

Failure to procure the required solution would result in the inability to establish and maintain a consistent security posture as security software must be configured, distributed and successfully installed. DISA will not be able to effectively operate and manage the diverse and increasing number of systems in its enterprise. There is an increased risk that service level agreements will not be met due to downtime of systems, performance degradation, and lack of proactive means of measuring and correcting system capacity and availability problems. The ever-increasing volume of operating environments in DISA’s computing centers cannot be managed without enterprise-level system tools and lack of these tools could result in an inability to accurately monitor, report, and review service performance.

6. CONTRACT OPPORTUNITIES ANNOUNCEMENT/POTENTIAL SOURCES:

A notice of the proposed contract action, along with a redacted justification for OTFAOC, will be published on SAM.gov website, as required by FAR 5.2, with the intention to award a sole source contract to IBM Corporation.

7. DETERMINATION OF FAIR AND REASONABLE COST:

A determination will be made by the contracting officer that the order represents the best value to the Government, as defined in FAR 2.101, and results in the lowest overall cost alternative (considering price, special features, and administrative costs) to meet the Government's needs.

The contracting officer will determine that the resulting contract prices will be fair and

Page 6 of 8 Pages reasonable, based on comparison with the prices outlined below. The contracting officer will also determine the pricing information valid for comparative purposes. Certified cost and price data is not required for this commercial item acquisition, in accordance with FAR 15.403- 1(b)(3). The contracting officer will determine whether the price is fair and reasonable based on:

(a) Comparison of the proposed prices to historical and existing prices paid, whether by the Government or other than the Government, for the same or similar items.

(b) Comparison with competitive published price list and published market prices of the same commodities.

(c) Comparison of proposed prices with the independent Government cost estimate.

8. MARKET RESEARCH:

(a) Market research for the requested software solution was conducted from September 2023 through May 2024. The Government gathered information from a variety of sources to include internet searches, exchanges with knowledgeable individuals in industry/Government, reviewing catalogs and other contractor literature, conducting internal discussions, and reviewing existing DISA-wide contract vehicles and other Government Wide Acquisition Contracts, and direct communication with IBM to determine potential sources. IBM provided a letter dated June 6, 2024, stating that “No other 3rd party resellers or distributors are authorized by IBM to provide installation services, and support for the referenced products identified in the IBM mainframe "Zero Trust solution" on behalf of IBM Expert Labs.”

(b) As part of market research, a request for information for the required software and support, to include ten capability areas for vendors to respond to and explain how their products would meet the ten capability areas, was posted via NASA SEWP V to Groups B, C, and D under NAICS code 541519 and Group A under NAICS code 334111. Three vendors provided responses; two under NAICS 541519; and one under NAICS 334111.

A review was completed on the three responses that were provided. Of the three respondents, only IBM met all ten of the stated capability areas. Therefore, it was determined that only IBM’s solution was able to meet the Government’s need. The next step in conducting market research was to determine a method of procurement. Market research indicated that the IBM software and support are not available through a DoD ESI BPA or via a General Services Administration (GSA) Federal Supply Schedule (FSS). Additionally, this requirement does not fall under NAICS 334111, Electronic Computer Manufacturing as we are procuring software and support. Therefore, the software and support are not available through NASA SEWP. As the software and support are being provided 100 percent by the OEM, IBM, a large business, a sole source procurement shall be conducted, and the solicitation will be sent directly to IBM.

(c) Based on current market research dates and data listed in paragraphs a. and b., it was determined that only the aforementioned brand-name product and/or product support, IBM, can fully support the Government’s need. No competitor functional replacement

Page 7 of 8 Pages products exist in the market at this time to meet the Government’s need. The Government will continue to conduct market research to determine if there are changes in the marketplace that would enable future competitive actions, e.g., there are similar products and/or support in the marketplace that provides the same functionality, the OEM releases ownership rights of the product, or it is economically feasible to procure a new system. A request for proposal will be posted to SAM.gov.

9. ANY OTHER SUPPORTING FACTS: None

10. LISTING OF INTERESTED SOURCES:

None. When market research was conducted, no other sources expressed interest in this requirement.

11. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FULL AND OPEN COMPETITION:

(a) Procurement history. Not Applicable

(b) During the market research conducted, it was deemed that only IBM software and support would be able to function with the current IBM products/infrastructure in place at DISA. If the OEM, IBM, elects to surrender their legal ownership, copyright, and/or intellectual property rights and move toward a complete open-source solution for the product support being purchased under this procurement, or if the Government should determine this brand-name software is no longer required or other software meets the Government’s need, then DISA will seek a competitive acquisition approach for the required functionality. While the infrastructure utilizing IBM will be the solution for the foreseeable future as it is the only solution that meets DISA’s requirement, if a similar requirement arises, every effort will be made to compete it to the maximum extent practicable.

Page 8 of 8 Pages

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE/DATE:

TITLE/ORGANIZATION:

PHONE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE/DATE:

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE/DATE:

PACA APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief. Since this justification does not exceed , this review serves as approval and my written determination that the aforementioned FAR circumstances apply.

NAME: SIGNATURE/DATE:

TITLE/ORGANIZATION:

PHONE:

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

Carmelyn Anne L.G. Bryan, (618) 418-6237, carmelynanne.bryan.civ@mail.mil, or Kristen Abbott, kristen.m.abbott2.civ@mail.mil, (618) 418-6977