A07 JOFOC - Open Market - Redacted.pdf

JUSTIFICATION AND APPROVALS FOR OTHER THAN FULL AND OPEN COMPETITION

IRON MOUNTAIN DATA CENTER HOSTING

FEDERAL ACQUISITION REGULATION (FAR) 13.501

1. Identification of the agency and contracting activity.

The United States (US) Department of Defense (DoD) Defense Counterintelligence and Security Agency (DCSA) Contracting and Procurement Office (CPO) proposes to enter into a contract on a basis of other than full and open competition on behalf of the Office of the Chief Information Officer (OCIO).

a. Requesting Activity/Program Office:

DCSA OCIO

27130 Telegraph Road Quantico, VA 22134

b. Contracting Activity:

DCSA CPO

27130 Telegraph Road Quantico, VA 22134

2. The nature and/or description of the action being approved.

Per FAR 8.402(f), DCSA intends to award a Sole Source Line Item on a limited source basis as Open Market Items against General Services Administration (GSA) Federal Supply Schedule GS-03F- 049GA (Contractor: Iron Mountain Information Management, LLC (Iron Mountain)), pursuant to the authority of FAR 13.501(a)(1)(ii). These Open Market Items are in support of the one-time installation space expansion.

These products will be incorporated into DCSA’s Task Order against the GSA FSS for Data Center Colocation Hosting and will have a one-year period of performance. The total estimated value of these open market products combined is $ .

This action is for a Firm-Fixed-Price (FFP) order directly to Iron Mountain off its established GSA FSS, GS-03F-049GA. The purpose of this document is to obtain the necessary approvals for open market items that will be procured on the referenced FSS.

Of note, a separate limited-source justification has been developed in accordance with 8.405- 6(a)(1)(i)(B), only one source can provide the supplies or services required at the level required because the supplies or services are unique or highly specialized, for the holistic Iron Mountain requirement.

3. A description of the supplies or services required to meet the agency’s needs.

DCSA OCIO requires the renewal of existing data center space and expansion upon the existing space within Iron Mountain’s Boyers, PA facility. The Contractor shall provide information technology (IT) hosting services, power, and network connectivity to DCSA’s IT equipment.

Network connectivity will be provided by DCSA; however, the Contractor shall provide direct connectivity between DCSA’s current data center and the data center hosting services environment. DCSA will maintain access to and operational control of its operations within the data center hosting services environment.

The open market items for inclusion within the FSS Order include one-time installation materials to support space expansion, including:

o Cable tray (across aisle) x QTY 1 o Cabinet grounding x QTY 8 o Containment (overhead) x QTY 8 o Containment (doors) x QTY 2 o Cabinet Material 48U x 750mm Wide x 1200mm Deep Enclosure x QTY 8 o Rack Power Distribution Unit (PDU) Material x QTY 16

Total Estimated Cost (Open Market Line Item Only): $

Period of Performance (Open Market Line Item Only): Twelve (12) months, 27 March 2025 – 26 March 2026

4. Identification of the statutory authority permitting other than full and open competition.

Only one responsible source and no other supplies or services will satisfy agency requirements in accordance with FAR 6.302-1. This justification is prepared in accordance with FAR 13.501(a)(1)(ii), using the format at FAR 6.303-2.

5. A demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the authority cited.

DCSA has an immediate need to renew its existing data center hosting environment, capable of accommodating up to 32 racks of equipment with a total power draw of 160 kilowatt (kW).

DCSA requires the capability to expand to 320kW if necessary to meet future needs, and requires a dedicated, contiguous, and secure caged environment that is constructed from floor to ceiling around the DCSA identified computing equipment space. DCSA servers and IT equipment currently hosted in Iron Mountain’s Boyers, PA facility must be maintained. This requirement will renew and expand the current DCH services at Iron Mountain in Boyers, PA, which is a Tier III DCH environment that meets Federal Information Processing Standard 199 requirements for IT systems.

Iron Mountain is the only data center colocation facility within a fifty (50) mile radius of DCSA’s Boyers, PA office, Zip Code 16018, that also meets required Federal security controls compliance and criteria. DCSA requires a colocation data center facility within 50 miles of its Boyers, PA office due to the necessary connectivity between the current and expanded operations in terms of data communications and support personnel. DCSA is required to maintain access and operational control of data center operations, and onsite support is required to ensure power and cooling are maintained. Additionally, maintaining data center hosting within 50 miles of DCSA’s Boyers, PA office is required to minimize DCSA staff response times to outages within a one (1) hour timeframe, and enable accessibility given that regular on-site support from DCSA is needed.

Furthermore, DCSA’s planned Recovery Time Objective (RTO) is 1 hour, which equates to 50 miles, in which business operations are restored or resources are again available for use after a disaster. DCSA employees who work out of the office in Boyers, PA need the ability to access the network servers and storage within a limited distance of 50 miles, which corresponds to a maximum of 1 hour to respond in person in case of network and/or power outages.

Iron Mountain is only vendor that can meet all of DCSA’s requirements for compliance and security. Specifically, DSCA requires a colocation center that meets the following criteria:

o Certified Telecommunications Industry Association (TIA) Tier III identified by Technology Institute IA-942 (TIA’s American National Standards Institute (ANSI)/TIA-942 Standard) o National Institute of Standards and Technology (NIST) Certified o Federal Risk and Authorization Management Program (FedRamp) certified o Federal Information Security Modernization Act (FISMA) High Compliant

Iron Mountain is a FISMA compliant Data Center that meets federal facility security level 3. Iron Mountain’s data center complies with FISMA High Accredited NIST 800-53A independent controls/auditing and NIST 800-53 security controls. These controls support development of secure and resilient federal information systems. Compliance with NIST guidelines is a major component of FISMA compliance, which provides agencies with the information they need to maintain a high level of security and eliminate vulnerabilities in a timely and cost-effective manner. Potential penalties for Government agencies that fail to comply with FISMA include censure by Congress, reduction in Federal funding and reputational damage.

Iron Mountain’s facility is in compliance with FIPS 199 high risk requirements, meeting Tier III data center standards in accordance with Uptime Institute’s guidelines. Specifically, Iron Mountain is a Tier III DCH environment that is ISO 20000-1:2011 certified and FIPS 199 compliant to ensure superior value in the design, delivery and improvement of IT services.

Implementation of ISO 20000-1:2011 is an international IT service management ITSM standard that enables organizations to align processes with industry best practice. Additionally, it has FIPS 199 impact assessment, which establishes 3 potential levels of impact: low, moderate, and high, relevant to securing Federal information and information systems for each of the three stated security objectives: confidentiality, integrity and availability.

Based on the location proximity to the DCSA Boyers, PA site and Federal security control requirements, Iron Mountain is the only source capable of meeting OCIO’s data center hosting requirement. While several other facilities offer data center colocation services, Iron Mountain is the only source who maintains the required Federal security controls and also provides the data center colocation services required within the geographic area needed.

IAW the procedures in FAR Subpart 13.5, Iron Mountain is a unique sole source vendor that is the only vendor that meets the specific requirements. Iron Mountain is the only vendor capable of providing the data center requirements, which include open market items, specified by DCSA OCIO for supplies, services, and support to satisfy mission requirements. The required specifications for the Data Hosting Center to operate are unique to Iron Mountain and the underlying hardware which was installed in September of 2021. Implementing any other support other than Iron Mountain’s would not meet the requirements set forth by DCSA to be compatible with DCSA’s secure enclosure installation.

6. A description of efforts made to ensure that offers were solicited from as many potential sources as is practicable.

A Notice of Intent was posted in accordance with FAR subpart 5.201(b)(1)(i).

7. Determination by the Contracting Officer that the anticipated cost to the Government will be fair and reasonable.

Prices on Iron Mountain’s Authorized Federal Supply Schedule Pricelist are determined to be fair and reasonable at the contract level. All required items, with the exception of open market items, have been verified on Iron Mountain’s GSA pricelist and are available for purchase. Open market items will be reviewed by obtaining copies of sales receipts within the last 18 months for the same items sold to other Government/non-Government customers. The Contracting Officer has determined that the anticipated price will be fair and reasonable based on publicly available pricelists for the same or similar items. In addition, the Contracting Officer may ask the vendor for supplemental information to support a price reasonableness determination.

The Quotation will be evaluated to ensure technical acceptability and fair and reasonable pricing. For price analysis, the Government may utilize the techniques within FAR 15.404-1(b) to ensure a fair and reasonable price is obtained.

8. A description of the market research conducted (FAR Part 10) and the results or a statement of the reason market research was not conducted.

In accordance with Federal Acquisition Regulation (FAR) 10.002, market research was conducted in October 2024 and February 2025.

The market research for this action focused on identifying data centers within a 50-mile range of the DCSA Boyers, PA office followed by researching on the internet each data center’s certifications for the DCSA established criteria:

1) Data center colocation space must be physically located within 50 miles of Boyers, Pennsylvania (PA).

2) The Contractor must provide IT hosting services, power, air conditioning, and network connectivity to DCSA’s IT equipment.

3) The Contractor’s colocation facility must provide a capability that meets or exceeds Tier III requirements (referred to as Tier III+ in this document) identified by TIA-942 (TIA’s ANSI / TIA-942 Standard | TIA Online) . These Tier III+ requirements include:

a) Tier 3 / National Institute of Standards and Technology (NIST).

b) Federal Risk and Authorization Management Program (FedRAMP) certified.

c) Federal Information Security Management Act of 2022 (FISMA) High Compliant.

Iron Mountain Data Center in Boyers, PA is the only data center within 50 miles of Boyers, PA that meets all of the criteria established by DCSA that offers co-location, is Tier III certified, NIST certified, FedRAMP certified and FISMA high compliant. It was determined that Iron Mountain Data Center Hosting can be procured with Iron Mountain directly via GSA Schedule GS-03F-049GA with same pricing structure as DCSA has leveraged for the existing contract, also based upon the same GSA Schedule.

9. Any other facts supporting the use of other than full and open competition.

DCSA mandates data centers to be within a defined range to maintain data sovereignty and security controls. OCIO and CPO conservatively estimated to procure an alternative contractor requires them to obtain the necessary mission support requirements, which could take six (6) to twenty-four (24) months to become compliant. This includes multiple authorization paths, the complexity of the system, and the preparedness of the organization, and a development of a System Security Plan (SSP) and remediation plans, including submitting results to the Supplier Performance Risk System (SPRS).

In addition, DCSA’s need for continued reliability and standardization of Data Center’s equipment will lead to minimal downtime due to the proven reliability, quality, and structured maintenance, all of which are essential elements that enhance efficient and effective operations. This is especially true of IT products and services where the risk of an exponential increased cost is very high in the event of any downtime. The productivity of an agency’s work is extremely dependent on the reliability of its IT support operations.

At this time, the use of any other contractor could harm the agency by causing severe disruption of interoperability and greatly increase the chance for impeding the agency’s mission. It would not be timely or economically sound to invest, change, or waive the requirements where the implementation risks are unknown.

10. A listing of the sources, if any, that expressed, in writing, an interest in the acquisition.

The following companies submitted capability statements in response to the publicly posted Notice of Intent to Sole Source Open Market Items:

1.

2.

11. A statement of the actions, if any, the agency may take to remove or overcome any barriers to competition before any subsequent acquisition for the supplies or services required, if subsequent acquisitions are anticipated.

DCSA will continue to regularly assess the market by contacting knowledgeable individuals in Government and industry including DCSA partners and other United States Government agencies to identify any additional sources that may have the necessary capabilities to meet DCSA’s minimum requirements. DCSA will continue to conduct market research to ascertain if changes occur in the marketplace that would enable future actions to be competed.

CERTIFICATION

I certify that the facts and representations under my cognizance which are included in this justification, and which form a basis for this justification are complete and accurate.

Chief- Program/Portfolio Management, Programs & Execution Office of the Chief Information Officer Defense Counterintelligence and Security Agency

APPROVAL

Contracting Officer:

This review serves as concurrence and my written determination that the aforementioned circumstances apply in accordance with FAR 13.501(a)(2)(ii).

Contracting Officer Defense Counterintelligence and Security Agency (DCSA) Contracting and Procurement Office (CPO)