A02 - JA__20-065-C4IM IT Augmentation Services-Final.pdf

Control No: 20-065 Contractor: BAE Systems, Inc.

Supply/Service: C4IM IT Augmentation Services Est Dollar Value: $11,723,000.00

JUSTIFICATION REVIEW DOCUMENT

FOR JUSTIFICATION AND APPROVAL FOR OTHER THAN

FULL AND OPEN COMPETITION

Service: C4IM IT Augmentation Services (SETA Support)

Authority: 10 U.S.C. 2304(c)(1)

Prepared by: Brian Jackson DSN: 793-5435 Contract Specialist Email: brian.n.jackson14.civ@mail.mil

Contracting Officer: Amanda Schanze DSN:793-1150 Contracting Officer Email: amanda.k.schanze.civ@mail.mil

Technical: Dr. Ronald Gilchrist DSN 312-248-6293 Supervisory IT Specialist/GS14 Email: Ronald.l.gilchrist.civ@mail.mil

Requirements: Mitchel Gunderson DSN 312-248-1482 IT Specialist Email: Mitchel.g.gunderson.civ@mail.mil

Reviews: I have reviewed this justification and find it adequate to support other than full and open competition.

Program Manager: Dr. Ronald Gilchrist DSN: 312-248-6293 Signature:

Legal Advisor:

Warren Reardon DSN 309-782-5822 Signature:

GILCHRIST.RONA

LD.L.1127166419

Digitally signed by

GILCHRIST.RONALD.L.1127166

Date: 2020.07.14 13:01:49 -04'00'

REARDON.WARRE

N.ALBERT.1024534

Digitally signed by

REARDON.WARREN.ALBERT.1

024534835 Date: 2020.07.14 15:38:17 -05'00'

Contractor: BAE Systems, Inc.

Service: C4IM IT Augmentation Services Est Dollar Value: $11,723,000.00

Department of Army Justification and Approval for Other than

Full and Open Competition

1. Contracting Activity: U.S. Army Contracting Command – Rock Island (ACC-RI) Rock Island Arsenal, Rock Island, IL 61299-8000.

2. Description of Action: U.S. Army Cyber Command (ARCYBER) requests a Firm Fixed Price contract with BAE Systems, Inc. ACC-RI projects award for August 2020 and will obligate fiscal year 2020, Operations and Maintenance, Army funds. An acquisition plan is not required because this procurement does not meet the threshold at Defense Federal Acquisition Regulation Supplement (DFARS) 207.103(d)(i)(B).

3. Description of Supplies/Services: ARCYBER requires augmentation resources to manage the operation, sustainment, and maintenance of the information technology (IT) supporting the Command, Control, Communications, Computers, and Information Management (C4IM) of the new Headquarters at Fort Gordon.

Headquarters, Department of the U.S. Army Executive Order 208-16, 21 June 2016, directed ARCYBER to move its Headquarters from Fort Belvoir, VA to Fort Gordon, GA to bolster the ever-growing cyber presence on Fort Gordon and expand the mission with partner agencies such as the Cyber Center of Excellence and National Security Agency (NSA) Central Security Service. Due to the unique requirements centering on power, space, and cooling of the new building, the traditional desktop computer environment was not possible. NSA designed the environmental aspects of the ARCYBER Headquarters to support only thin client enclaves residing on a virtual desktop infrastructure (VDI). A VDI environment is one in which a user has several small thin client hardware devices, which in turn are serviced by servers in a data center. This capability reduces the desktop footprint, but adds to the complexity of the system as the processor, ram, storage, and video functions normally associated with a computer are relocated to servers. While this affords the same or similar capability to the user, the technology providing this service is extremely complex.

After finalization of the environmental design, the shift changed from NSA as the primary service provider to ARCYBER providing the bulk of IT services for the headquarters.

NSA would support telephon , standard video teleconferences (VTCs), and the NSAnet network enclave. As the environment only supported VDI, ARCYBER had to build three VDI enclaves - Non-classified Internet Protocol Router Network (NIPRnet), Secret Internet Protocol Router Network (SIPRnet), and the top-secret Joint Worldwide Intelligence Communications System (JWICS). ARCYBER also added multiple systems with different classifications being accessed from a desktop device, known as multi-independent levels of security (MILS) as an additional aspect of the IT design. This environment is not a standard Army enterprise and is not available at any other Army location. Due to this unique environment, the Fort Gordon Network Enterprise Center

Service: C4IM IT Augmentation Services Est Dollar Value: $11,723,000.00

(NEC) cannot support this environment, nor do the ARCYBER current manning documents provide the required resources for support.

ARCYBER requires contractor support and assistance with operations and maintenance of all computer systems inside the Headquarters and surrounding buildings that belong to ARCYBER. This will include, but is not limited to, customer support, account creation, troubleshooting of computer equipment and IT infrastructure that supports the operations of any computer system within ARCYBER at Fort Gordon.

The period of performance is 31 August 2020 through 31 May 2021. The proposed action will not include an option provision. ARCYBER estimates a dollar value of $11,723,000.00 based on the Independent Government Estimate.

4. Authority Cited: 10 U.S.C. 2304(c)(1), as implemented by Federal Acquisition Regulation (FAR) 6.302-1, Only one responsible source and no other supplies or services will satisfy agency requirements.

5. Reason for Authority Cited: As described at FAR 6.302-1(a)(2), when the supplies or services required by the agency are available from only one responsible source, or, for DoD, NASA, and the Coast Guard, from only one or a limited number of responsible sources, and no other type of supplies or services will satisfy agency requirements, full and open competition need not be provided for.

Because neither ARCYBER nor the Army had the available resources to accomplish the Information Technology Fit Out of the IT of the new headquarters building at Fort Gordon, the Naval Air Systems Command (NAVAIR) designed, procured, configured, tested, and delivered all aspects of the active (computers, servers, network switches, printers, and associated hardware/software) components for the IT enclaves. Active IT Fit Out consists of all computer equipment that will be used by the 2000+ military, civilian and contractors that will occupy and operate within the ARCYBER Headquarters. The original schedule had the Headquarters’ construction being completed in 2019, but delays occurred. Construction was finalized in February 2020, but the IT fit out is ongoing. The majority of NAVAIR’s workforce supporting the IT-fit out is contracted by BAE Systems employees.

Construction delays and COVID-19 impacts includ reduction of manning of the supporting entities for passive wiring, NSAnet, desktop installation, audio visual multimedia and furniture delivery and installation. Since the Army’s IT Fit Out portion could not be accomplished until the passive wiring, furniture, and NSAnet activities were complete, this created a situation where additional days, weeks, and months were needed to accomplish the IT Fit Out. The schedule could not slip so to mitigate the time needed, some fit out activities went to seven day operations and 15 hour days.

ARCYBER requested an exception to travel policy for the key members of the command to accomplish the move to Fort Gordon nonetheless. There were no offsetting adjustments to the full operational capability (FOC) date which thereby shortened the lead time between IT Fit Out and the occupancy of the building. The original integrated

Service: C4IM IT Augmentation Services Est Dollar Value: $11,723,000.00 master schedule had allowed significant time (six months) after construction completion to thoroughly test, assess, and achieve FOC prior to the command occupying the building. However, due to the delays, ARCYBER personnel occupied the building on 2 March 2020, for initial operating capability (IOC), but with minimal subject matter expert support. Had the previous window been afforded, ARCYBER would have had the time to put qualified personnel in place for the sustainment portion. When the window severely decreased, combined with Headquarters Department of the Army’s disapproval of ARCYBER’s request for additional military and DA civilian personnel due to congressional mandated end strengths and higher priorities, it created the need to develop an alternate course of action to solve the immediate resourcing requirement.

BAE Systems is the firm which created the Headquarters VDI and the only vendor qualified to provide sustainment support beginning 31 August 2020, for the period of nine months until ARCYBER can compete a long term contract.

Only BAE Systems possesses the technical expertise, managerial knowledge, and personnel resources required to provide the C4IM Services for ARCYBER Headquarters at Fort Gordon, GA. The vendor has extensive experience in the technological, logistical, and security requirements of supporting NIPRnet, SIPRnet, and JWICS enclaves within a NSA accredited Sensitive Compartmented Information Facility. The ARCYBER Headquarters is co-located with NSA to provide and allow for enhance coordination between the organizations. The extension of the campus also allows for secure joint interoperability in design, architecture and IT services. This will result in a more efficient, secure and joint interoperable environment. Specific clearance requirements are crucial to personnel at the ARCYBER Headquarters. Due to being within the NSA campus, ARCYBER personnel will have to adhere to the additional security requirements. These requirements include having a Top Secret/Sensitive Compartmentalized Information (TS/SCI) clearance and successfully completing the Counter Intelligence Polygraph and Military Affairs Desk Officer (MADO) validations. These are requirements set upon ARCYBER by the NSA and will be required for any personnel to work within the facility.

The MADO validation is a new requirement specific to Fort Gordon. BAE Systems has a vast presence throughout the Department of Defense, the U.S. Army, and Fort Gordon, GA, and is the only vendor with the technical resources and staffing ability to provide qualified, cleared personnel familiar with the exact technology and capabilities in ARCYBER Headquarters immediately.

ARCYBER requires the myriad of services captured in the current ARCYBER & NETCOM & Chief Information Officer/G6 C4IM services list. The C4IM services include VDI, MILS, Audio-Visual and Multimedia (AVMM), Service Desk, Network Operations, Cyber Security, VTC, and the supporting cabling infrastructure. As supported in the market research section of the justification and approval, two other vendors, GC&E and BAH, both currently support some aspects of the C4IM services to ARCYBER and Headquarters Fort Gordon, but in different capacities. However, neither GC&E nor BAH performed the VDI/MILS/service desk functions so neither is able to meet the Government’s immediate requirement.

Service: C4IM IT Augmentation Services Est Dollar Value: $11,723,000.00

BAH conducted the network engineering for the new headquarters. This was a crucial component of the project, but not as unique as the VDI and MILS. BAH’s experience and proven abilities in networking to support the VDI and MILS are not sufficient to render the firm capable of undertaking the complete C4IM augmentation support. BAH’s primary roles in support of the IT Fit Out is cyber security and network engineering and installation. In the cyber security venue, the duties included development and compilation of risk management framework (RMF) artifacts, accreditation facilitation, and tenant security plans. On the networking responsibilities, BAH’s responsibilities included installing properly configured network devices which were high performing but also constituted in accordance with the most current vendor patches, firmware, and Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGS).

These measures are considered hardening the network. This is critical for a Secret and Below Interoperability (SABI) Multiple Independent Levels of Service (MILS) enclave because this segment is not externally accessible for support. All cyber security requirements are the same as in a traditional network but additional efforts are needed to maintain the cyber security posture. In their response to the market research, BAH failed to show substantial experience and understanding of performing these responsibilities.

Any significant vulnerabilities render the VDI, MILS, and SABI enclaves not worthy to remain connected to the Department of Defense Information Network (DoDIN). Denial of the authority to remain connected will be devastating for the command. ARCYBER requires more than just the networking support that BAH is capable of delivering, and will fail to provide command and control in communications support if BAH is the selected vendor.

If the C4IM services augmentation contract was only to support the passive infrastructure, AVMM, and service desk, then GC&E would be in a position to provide services immediately. However, GC&E has not been involved in any of the technical aspects of the IT fit out and does not have the qualified workforce to support the full C4IM services needed. GC&E would be capable of marginally supporting all aspects of the required C4IM services per the market research analysis. ARCYBER cannot piece meal the support efforts. The complicated and intricate nature of the IT within the headquarters mandates a holistic approach to supporting all facets.

The IOC for the ARCYBER Headquarters to include all IT was 02 March 2020. The FOC is 15 July 2020. The normal timeframe for a large, competitive action is anywhere from 14 to 28 months. This timeframe includes time for posting the announcement, the source selection process, and the award of the new contract. The competitive award will be a large scale, complex requirement and is currently in the acquisition requirement package process to narrow down the requirement. The construction delays and Congressional rules for occupancy of a Military Construction project state that ARCYBER must relocate from the legacy location and occupy the building located in Fort Gordon. The delays and the movement requirement are separate but related items, and the bottom line up front result is the command relocating to the new headquarters.

Consequently the building has to be full occupancy ready by 15 July 2020. This building must be occupied within two years of the construction, which does not afford the command the ability to shift the IT fit out in order to compete the requirement. The

Service: C4IM IT Augmentation Services Est Dollar Value: $11,723,000.00 consequence is a much shorter time to resource cleared and qualified expertise for the assumption of the operations and maintenance of the new headquarters in order to meet the FOC of 15 July 2020. Transition from fit out to sustainment occurs in same time frame of the FOC period. Due to the required timeline, awarding a sole source contract to BAE Systems allows the Government to avoid mission failure and allows for the actions required to establish the framework for a competitive action to ensue following this contract.

ARCYBER Headquarters will be a 24/7/365 operation. If the justification is not approved, ARCYBER will not have the human capital resources to provide the necessary IT support for ARCYBER’s Headquarters. Without adequate resources supporting IT services, ARCYBER as a command will fail in its responsibilities to the nation. U.S.

Cyber Command depends on the output and products of ARCYBER to provide title functions to the U.S. Government. ARCYBER cannot fulfil those responsibilities without the IT warfighting platform supporting the headquarters. Information Warfare Cyber Operations depend on the infrastructure consisting of defensive and offensive cyber space operations centered on the IT hardware and software residing in the headquarters to include a VDI. The command delivers cyberspace effects, both defensive and offensive, against global adversaries.

6. Efforts to Obtain Competition: ACC-RI shall publish the notices required by FAR

5.201. Because this is a sole source action, effective competition is not applicable. The Government will achieve subcontracting competition by including FAR clause 52.244-5, Competition in Subcontracting, which states that the contractor shall select subcontractors on a competitive basis to the maximum practicable extent.

7. Actions to Increase Competition: A follow-on competitive solicitation will commence with an award milestone set for May 2021, for a contract with a period of performance of five years. These efforts will begin in July 2020 and exercising the fullest extent of competition. VDI and MILS are growing in popularity consistently during the time period of the initial augmentation contract, some vendors will have gained more knowledge, skills, abilities, and expertise in these areas. Additionally, ARCYBER will also gain more maturity of the environment which will impact any subject matter expertise in the future.

8. Market Research: ACC-RI and ARCYBER conducted market research from September-November 2019 for IT augmentation services, but with no period of performance specified. An initial request for information (RFI) in Federal Business Opportunities posted on 16 September 2019 with responses due 01 October 2019. The RFI resulted in 49 vendor responses. Of the 49 responses, 30 vendors requested to participate in oral presentations held at Fort Gordon, GA. ACC-RI and ARCYBER compiled the data of the 30 vendors that furnished written responses and participated in interviews and determined only three vendors displayed a detailed understanding of the requirement, BAH, GC&E and BAE. In May 2020, ACC-RI changed the associated North American Industry Classification System (NAICS) code from 518210 – Data Processing, Hosting, and Related Services to 541519 – Other Computer Related Services.

Service: C4IM IT Augmentation Services Est Dollar Value: $11,723,000.00

Thirty (30) vendors responded. ARCYBER G6 performed like-kind analysis on the responses as conducted with RFI 1 and determined the responses were indicative of RFI

1. While BAH and GC&E’s responses indicated they understood the requirement, as explained below, BAE is the only vendor capable of meeting the Government’s immediate C4IM needs.

Booz Allen Hamilton (BAH) BAH currently works within Fort Gordon and has an understanding of the MADO process. BAH also has a number of personnel fully cleared within ARCYBER Headquarters and the Whitelaw Building at Fort Gordon, and maintains around 5,000 staff holding TS/SCI clearances. BAH is the prime contractor for Joint Improvised Threat Defeat Organization Headquarters providing service desk, network, systems and cyber security. BAH is currently working to build out ARCYBER Headquarters VDI/MILS/cross domain printing, primarily network and cyber security portions. The vendor understands the concept of VDI/MILS and is currently performing such functions as a subcontract with NAVAIR. However, BAH lacks the capability to satisfy all the C4IM services required by the scope of work. While BAH has shown they are able do the required networking engineering, they failed to show the expertise in complying with all cyber security requirements required to remain in compliance with all applicable policies, regulations, and guidelines. A critical component of the MILS is a separate network. BAH did not have the experience necessary to properly configure this network to meet DISA standards as well as function as integral component of the VDI/MILS enclave. BAH has not demonstrated a level of expertise on VDI, MILS, and compliance with security standards required of the augmentation requirements.

GC&E Systems Group, Inc./Vista (partner) GC&E currently works inside ARCYBER Headquarters under contract with NSA (all aspects of the passive infrastructure). GC&E has an established presence, supporting 15 NECs with C4IM services. GC&E has collaborated with Force Point, and understands the concept of VDI and MILS. They previously worked the IT fit out (in conjunction with NCI) for Army Futures Command (AFC), passive and AVMM. GC&E received excellent feedback from AFC on said work and they accomplished the work on an extremely tight schedule. They are knowledgeable of the MADO process and have a number of cleared personnel in ARCYBER Headquarters at Fort Gordon. GC&E’s current on site efforts are limited to fiber and copper wiring (to include the ancillary connection materials) and they are lacking experience, knowledge, and skills in designing, engineering, installing, and configuring VDI and MILS. These are the core components of the IT in the headquarters.

BAE Systems BAE currently works inside ARCYBER Headquarters under contract with NAVAIR (all aspects of active infrastructure, VDI/MILS/Cross Domain Printing). BAE Systems has a robust established presence performing C4IM services within DoD. BAE has collaborated with Force Point, Nutanix, Dell, and Citrix, giving them a complete understanding of VDI and MILS. BAE also has built an Intelligence Community accredited enterprise level VDI enclave. GC&E and BAH have no equivalent background. BAE is knowledgeable of the MADO process and has a number of fully cleared personnel within ARCYBER Headquarters at Fort Gordon. BAE is the only contractor that meets all the required capabilities needed in this requirement. BAE has

Service: C4IM IT Augmentation Services Est Dollar Value: $11,723,000.00 the most complete knowledge of the ARCYBER Headquarters IT infrastructure to include cabling, servers, desktops, cyber security, printing, VDI, and MILS.

While ACC-RI did not issue an RFI specifically for this nine-month requirement, the results would be the same as the two already issued due to BAE’s unique qualifications.

There would be no benefit to the Government nor to Industry to issue another announcement. Accordingly, the Senior Contracting Official/Senior Executive Service approved a waiver to the requirement to post a sources sought or RFI as required by DFARS 206.302-1(d) and DFARS Procedures, Guidance and Information 206.302-1(d) on July, 8th 2020 and is located within the contract file.

9. Interested Sources: To date, no other sources with the required capabilities have expressed a written interest in this requirement.

10. Other Facts:

a. Procurement History

None

11. Technical Certification: I certify that the supporting data under my cognizance which are included in the justification are accurate and complete to the best of my knowledge and belief.

Date: ____________________ _____________________________ Dr. Ronald Gilchrist

Supervisory IT Specialist

12. Requirements Certification: I certify that the supporting data under my cognizance which are included in the justification are accurate and complete to the best of my knowledge and belief.

Mitchel Gunderson IT Specialist

13. Fair and Reasonable Cost Determination: I hereby determine that the anticipated cost or price to the Government for this contract action will be fair and reasonable based on Comparison of proposed prices with independent Government cost estimates and analysis of other than certified cost or pricing data in accordance with FAR 15.404- 1(b)(2)(vii). In accordance with FAR 15.403-1(b)(3), submission of certified cost or pricing data will not be required, as the services are commercial.

Amanda Schanze Contracting Officer

14. Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Amanda Schanze Contracting Officer

14 July 2020

14 July 2020

15 July 2020

15 July 2020 SCHANZE.AMAN

DA.K.1276290556

Digitally signed by

SCHANZE.AMANDA.K.12762905

Date: 2020.07.15 07:18:46 -05'00'

SCHANZE.AMAN

DA.K.1276290556

Digitally signed by

SCHANZE.AMANDA.K.12762905

Date: 2020.07.15 07:18:10 -05'00'

GUNDERSON.MITCHEL

.GOODWIN.1243030532

Digitally signed by

GUNDERSON.MITCHEL.GOOD

WIN.1243030532

Date: 2020.07.14 13:16:06 -04'00'

GILCHRIST.RONA

LD.L.1127166419

Digitally signed by

GILCHRIST.RONALD.L.1127166

Date: 2020.07.14 13:02:37 -04'00'

Approval

Based on the foregoing justification, I hereby approve the procurement of C4IM IT augmentation services to support ARCYBER at Fort Gordon using an exception to fair opportunity pursuant to the authority of 10 U.S.C.2304(c)(1), subject to availability of funds, and provided that the services or supplies herein described have otherwise been authorized for acquisition.

Date: Signature:

ADELAIDE J. TKATCH

Competition Advocate

TKATCH.ADELAI

DE.J.1228712503

Digitally signed by

TKATCH.ADELAIDE.J.12287125

Date: 2020.07.17 08:38:51 -05'00'