Apriva MESA VPN and CCS for DoD Mobility Classified Capability – Secret (DMCC-S)

Gateways

Page 1 of 6 Pages

POC: Vietterung Doan;

JUSTIFICATION FOR OTHER THAN FULL AND

OPEN COMPETITION (OTFAOC)

Federal Acquisition Regulation (FAR) Part 6 Justification & Approval (J&A), Supporting Procurements under FAR Part 12 and FAR Part 15

CSS Tracking Number: 842674756 Funding Document Number:

Contract Number: To be determined Procurement Title: Apriva ISS LLC (Apriva) Mobile Environment Security Architecture (MESA) Virtual Private Network (VPN) and Command and Control Services (CCS) for Department of Defense (DoD) Mobility Classified Capability – Secret (DMCC-S) Gateways Estimated Value:

Regulatory Authority: 10 U.S.C. 3204(a)(1), FAR 6.103-1, Only one responsible source and no other supplies or services will satisfy agency requirements.

Justification and Approval (J&A) Number: Not applicable

1. REQUIRING AGENCY AND CONTRACTING ACTIVITY:

Requiring Agency: Defense System Information Agency (DISA)/ Mobility Program Management Office (SD34) Contracting Activity: DISA)/Defense Information Technology Contracting Organization

(DITCO) PS8414

2. NATURE/DESCRIPTION OF ACTION(S):

Type of Action: New contract Type of Contract: Firm Fixed Price

3. DESCRIPTION OF SUPPLIES/SERVICES:

This requirement will provide VPN software licenses to support voice and data services for legacy DMCC-S end user devices (EUDs) consisting of the Non-Custom Read Only Memory (Non-CROM): Samsung S24, Samsung S25, Samsung Tab S9. Windows Data-at-Rest (WINDAR): Dell 5350, Dell Pro 13. The VPN must be approved by the National Security Agency (NSA) Commercial Solution for Classified (CSfC) program, compatible with the current DMCC-S Secure Mobile Device Gateways (SMDG) architecture and support the legacy EUDs.

The requirement will provide software at a total cost of for a 1-year base period. This will allow DISA to accomplish its mission of DMCC-S.

4. IDENTIFICATION OF STATUTORY AUTHORITY:

Page 2 of 6 Pages

The United States Code (U.S.C.) and FAR reference permitting other than full and open competition: (use dropdown) 10 U.S.C. 3204(a)(1), FAR 6.103-1, Only one responsible source and no other supplies or services will satisfy agency requirements.

5. DEMONSTRATION OF CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE

NATURE OF THE ACQUISITION REQUIRED:

Unique Qualifications: Apriva’s unique VPN design supporting the DMCC-S effort is the only VPN compliant with the NSA CSfC program and proven compatible with the DMCC-S SMDG architecture supporting the legacy EUDs. At inception, the Apriva MESA VPN was the only NSA CSfC approved standards-based Internet Protocol Security VPN available. As such, the contractor will be required to provide the Apriva MESA VPN license agreement which authorizes use of gateway operations and associated SMDG testing facilities. Due to the unique design and implementation of the Apriva MESA VPN within the gateway infrastructure, a VPN license agreement is required to continue DMCC-S services without interruption.

Impact: The Apriva MESA VPN design solution cannot be replaced without significant disruption of service to the DMCC infrastructure and its end users, as well as potentially disturb NSA Mobility Access Capability Package compliance of the current architecture. Replacing the existing infrastructure is beyond the scope of the Government’s current needs and would result in a loss of DISA's investment in the existing infrastructure. Awarding to a source other than Apriva would result in substantial duplication of cost to the Government that is not expected to be recovered through competition. Attempts to prematurely transition services would result in critical mission failure due to the dependencies listed above. Thus, an award to a source other than Apriva would result in unacceptable delays in fulfilling the Government’s requirements. Without execution of the plan indicated in this J&A, the DMCC-Secret gateways supporting worldwide mission essential personnel will be halted due to an expired Apriva MESA VPN license agreement. Furthermore, failure to execute would result in significant loss of the allocated funds ) which have been expended in engineering and operations for this effort to date and could cause potential duplication of costs for the Government which may not be recouped. It is in the best interest of the Government at this time for DISA to continue the support provided by Apriva and maintain the classified support provided to senior DoD officials through the SMDG services.

6. DESCRIPTION OF THE EFFORTS MADE TO ENSURE THAT OFFERS ARE

SOLICITED FROM AS MANY SOURCES AS POSSIBLE:

On May 21, 2026 a sources sought was posted to sam.gov to all vendors, stating the intent to sole source to Apriva for the MESA VPN. No responses were received.

The Government intends to synopsize this contract action in accordance with FAR Part 5 procedures and the J&A will be publicly posted.

7. DETERMINATION OF FAIR AND REASONABLE COST:

A determination will be made by the contracting officer that the contract represents the best value to the Government, as defined in FAR 2.101, and results in the lowest overall cost alternative (considering price and administrative costs) to meet the Government's needs. The

Page 3 of 6 Pages contracting officer will also determine the pricing information valid for comparative purposes.

Certified cost and price data is not required for this commercial item acquisition, in accordance with (IAW)FAR 15.403-2(b)(3).

IAW FAR 15.404-1(b), the contracting officer will determine whether the price is fair and reasonable, based on one or more of the following:

(a) Comparison of proposed prices received in response to the solicitation;

(b) Comparison of the proposed prices to historical and existing prices paid, whether by the Government or other than the Government, for the same or similar items;

(c) Comparison of proposed prices with the independent Government cost estimates.

8. MARKET RESEARCH:

Market research was conducted from 10 April 2026 to 5 May 2026 and consisted of the sources sought notice posted to SAM.gov on May 21, 2026, reviewing previous acquisitions and current contract, HC108425C0003, HC108421C0006, HC108420D0004, and HC101317C003;

reviewing existing DISA-wide contract vehicles and other government-wide acquisition contracts, collaborating with DISA engineers and subject matter experts, DISA leadership, NSA subject matter experts, and Secret Gateway technical subject matter experts regarding the unique nature of Apriva’s MESA VPN as it supports the DMCC-S Program.

Market research was conducted to determine if any viable alternative solutions exist to support the Mobile Environment Security Architecture (MESA) VPN. Other VPN solutions on the National Security Agency (NSA) Commercial Solutions for Classified (CSfC) Components List were analyzed; however, none were found to be viable options for this environment. The technical evaluation of alternative vendors revealed that their proposed solutions rely on proprietary architecture. None of the alternative vendors researched are capable of providing a solution that is interoperable with the existing infrastructure required to support DMCC-S devices. The DMCC program requires a standards-based VPN solution capable of broad client integration. Samsung devices remain the designated and proven hardware platform for the DMCC way forward and are certified and approved with the standards-based strongSwan VPN client. Because the alternative vendor VPN solutions utilize proprietary protocols, they are fundamentally non-interoperable with the Samsung strongSwan VPN client utilized across the DMCC-S fleet. Introducing a non-compatible VPN vendor would necessitate a complete rebuilding of the device baseline, resulting in a substantial duplication of cost to the Government that is not expected to be recovered through competition.

Based on current market research, dated April 2026 through May 2026, it has been determined that only the aforementioned MESA VPN software licenses provided by Apriva, can fully meet the Government’s need and is in the best interest of the agency.

9. ANY OTHER SUPPORTING FACTS:

None.

Page 4 of 6 Pages

10. LISTING OF INTERESTED SOURCES:

None.

11. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FULL AND OPEN COMPETITION:

Reviewing officials and the approval authority have reviewed the previous J&A, which was routed with this J&A, and determined any planned actions to remove barriers to competition listed on the previous justification were considered. The DMCC-S infrastructure has transitioned to the NSA CSfC Aruba VPN for the next generation of EUDs, but there is no other alternative to support the legacy EUDs. After reviewing the actions taken, it is determined that a sole source environment still exists.

a. Procurement History.

1) Contract number: HC101317C0003

a. Contractor: Apriva

b. Business size: Small

c. Type of acquisition: Sole Source

d. Period of Performance (PoP): February 1, 2017 to January 31, 2020 and February 1, 2020 - July 31, 2020 (FAR 52.217-8)

2) Contract number/Task Order: HC108420D0004/HC108420F0242

a. Contractor: BAH

b. Business size: Large

c. Type of acquisition: Full and open

d. PoP: July 20, 2020 to July 19, 2021 (for MESA VPN licenses only)

e. Background: HC108420D0004, Mobility Enterprise Services – Classified was competed full and open, resulting in an single award indefinite delivery, indefinite quantity contract awarded to BAH. Task order, HC108420F0242, was awarded on July 20, 2020, to provide the DMCC-S VPN Solution, system engineering support, capability integration and Tier III support services. BAH proposed use of the current unique MESA VPN as their solution, subcontracted to Apriva; however, BAH did not include the MESA VPN license procurement as part of their solution. Due to the Government oversight for these licenses at award, the VPN license cost was added via bilateral modification in the base year only (July 20, 2020 – July 19, 2021) to allow time to procure a separate contract action that is in the best interest of the Government and is supported by this OTFAOC justification.

3) Contract number: HC108421C0006

a. Contractor: Apriva

b. Business size: Small

c. Type of acquisition: Sole Source

d. PoP: July 20, 2021 to July 19, 2025

4) Contract number: HC108425C0003

Page 5 of 6 Pages

a. Contractor: Apriva

b. Business size: Small

c. Type of acquisition: Sole Source

d. PoP: July 20, 2025 to July 19, 2026

b. To eliminate this dependency in the future, the Government team is currently working the next contract action which will include an open source system requirement that is NSA approved, as well as the design and schedule for a pending MACP 2.8.0 compliant gateway convergence plan to consolidate the existing DMCC-Secret gateways with the TS solution which would provide for better efficiency in both cost and operations.

Current technology trends and market research show positive results that the Government will be able to contract for a NSA CSfC approved solution as part of the future follow-on

Page 6 of 6 Pages

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Viettrung T. Doan SIGNATURE/DATE:

TITLE/ORGANIZATION: Systems Engineer

PHONE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Roger L. Hulbert SIGNATURE/DATE:

TITLE/ORGANIZATION: Program Analyst

PHONE:

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief. Since this effort exceeds the SAT but does not exceed $10M, this certification serves as APPROVAL.

NAME: Timothy G. Madura SIGNATURE/DATE:

TITLE/ORGANIZATION: DISA/DITCO/PS8414

PHONE:

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

Timothy G. Madura,