AngularJS Support Licenses Sole Source Justification.pdf

JUSTIFICATION FOR SOLE SOURCE PROCUREMENT (OPEN

MARKET OR GSA) UNDER $250,000

Sole source acquisitions may be used on a limited basis and only when the Representative (COR)/Program Official has provided sufficient justification and the Contracting Officer has determined that the circumstances warrant such action. The content for a justification must contain detailed facts and rationale to justify the sole source acquisition. Soliciting from a single source must be done in accordance with FAR 13.106-1(b) or 8.405-6. At a minimum, the following information must be included:

Identification of Program Office, Contracting Activity, and Proposed Requirement, Justification and Program Office Certification:

A. Program Office:

Center for Preparedness and Response Division of Select Agents and Toxins Roybal 21 H-21 Centers for Disease Control and Prevention Atlanta, GA 30333

B. Contracting Activity:

Centers for Disease Control and Prevention Office of Financial Resources Acquisition Branch OAS

C. Identification of Requirement:

1. Nature of Action to be Approved by Contracting Officer:

a. Sole source acquisition of: AngularJS Support Licenses from XLTS

b. Procurement Request (PR) Number (if available): PR# 000HCBCC-2023-71067

2. Proposed Vendor and Estimated Procurement Amount (if available):

a. Proposed Vendor: XLTS.Dev

b. Estimated Procurement Amount:

3. Is the requirement on GSA Schedule? Yes No

If yes, provide schedule number: Click here to enter text.

Rev. 5/15/17

D. Justification:

1. The justification for this non-competitive action is: The purpose of this procurement is to obtain AngularJS annual eFSAP and eIPP systems while long term efforts are made to replace AngularJS in both system frameworks. These licenses will be issued to CDC s developers. The contract will have a base year plus up to 2 option years. Since the end of support by the original author, Google, the proposed vendor has discovered two vulnerabilities and issued two patches in its version of the AngularJS framework. No other company has found any vulnerabilities or provided patches to help keep the software secure. Additionally, the contracted service level agreement for patches of vulnerabilities of varying levels of impact matches the required security posture CDC needs to maintain for its FISMA Triple High system.

In accordance with FAR 13.106-t exceeding the simplified acquisition threshold. (i)

Contracting officers may solicit from one source if the contracting officer determines that the circumstances of the contract action deem only one source reasonably available (e.g., urgency, exclusive licensing agreements, brand-name or industrial mobilization). (ii) Where a single source is identified to provide a portion of a purchase because that portion of the purchase specifies a particular brand-name item, the documentation in paragraph (b)(1)(i) of this section only applies to the portion of the purchase requiring brand-name item. The documentation should state it is covering only the portion of the acquisition which is brand-

Urgency

Exclusive licensing agreements/Proprietary data

Brand name required

Industrial mobilization

Other (e.g., compatibility, space issues, continuity, compatibility, etc.)

In accordance with FAR 8.405-circumstances that may justify the action are (A) An urgent and compelling need exists, and following the procedures would result in unacceptable delays; (B) Only one source is capable of providing the supplies or services required at the level of quality required because the supplies or services are unique or highly specialized; or (C) In the interest of economy and efficiency, the new work is a logical follow-up to an original Federal Supply Schedule order provided that the original order was placed in accordance with the applicable Federal Supply Schedule ordering procedures. The original BPA must not have been previously issued under sole-source or limited-

Urgency

Only One Source

Logical Follow Up

Brand name required

2. Other facts supporting sole source procurement:

a. What can this product/service do that other products/services cannot do?

CDC currently uses AngularJS to develop single-page applications for eFSAP and eIPP systems. As AngularJS is no longer supported by its original author, Google, CDC needs third-party software to securely maintain its applications while long-term efforts are made to replace AngularJS. Web research revealed only two potential vendors that provide licenses that support AngularJS: OpenLogic and XLTS. Both OpenLogic and XLTS were considered as possible vendors to support the overall need. When polling other CIOs within CDC, there was no support of this nature in place by any other organization. OpenLogic does not appear to have any usage among government entities currently. As of 12/19/2022, the official site for AngularJS recommended XLTS.dev and OpenLogic for long-term support. However, as of 12/21/2022, AngularJS.org only recommends XLTS. The primary differentiating factor between the two support organizations is the posture taken by the companies regarding vulnerability discovery and patching. XLTS has been proactive in seeking vulnerabilities and providing patches with its own version of AngularJS, whereas OpenLogic has taken a passive role by providing patches to vulnerabilities discovered by its customers and providing support to software developers to implement patches. A passive approach to patches and vulnerability exposes CDC to unacceptable cybersecurity risk. Therefore, only XLTS has been validated to meet

: Proprietary AngularJS framework version, vulnerability remediation, SLA compliance, browser breakage, and JQuery patches.

b. What other products/services were considered and why did they not meet the need?

OpenLogic was considered, but only XLTS.dev requirements by showing a validated process for vulnerability and patch management

3. Program Office efforts to seek potential offerors:

As part of determining ways to resolve the end of support for AngularJS issue, DSAT worked with internal developers to consider options for replacement, migration, etc. This investigation included research of the AngularJS support site, internet searches for AngularJS alternatives, and discussions with other CIOs within CDC. Internet searches revealed several companies positioned to provide licenses to help company support the expired framework, but only two companies provided licenses in support of the AngularJS framework during the migration process. CDC al and the comercial marketplace. GSA as well as several state and international government entities utilize XLTS. USDA awarded a sole source contract (12314421P0148) to XLTS on August 25, 2021. , Microsoft utilizes both in varying degrees. As a part of market research, CDC scheduled video conference calls to better understand both companies and how they provided licenses in support of the framework. As our primary system is a high security concern, supported components are critical. Cybersecurity Office reviewed the market research and found only XLTS is to be an acceptable solution as described above.

E. Program Office Certification:

I have reviewed this sole source justification and certify the justification is true and accurate to the best of my knowledge and adequate to support other than full and open competition.

Center/Institute/Office COR/Program Official Name/Title: Rhonda Smith

Center/Institute/Office COR/Program Official Signature:

Certification Date: Click here to enter a date.

F. Contracting Office Certification:

I have fully relied on the information provided herein and hereby certify that this justification is accurate and complete to the best of my knowledge and belief:

Contracting Officer Name: Click here to enter text.

Contracting Officer Signature:

Certification Date: Click here to enter a date.