Attachment 2 - Brand Name Justification_Redacted.pdf

Sole Source (Including Brand Name) Justification - Simplified Procedures for Certain Commercial Items

CONTROLLED UNCLASSIFIED INFORMATION

March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 2 of 9March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 2 of 9

I. Contracting Activity.

HQ ACC AMIC/PKAB

300 Exploration Way Hampton, VA 23666

Contracting Officer: Maj Odie Freeman Requiring Activity: ACC/A6, POC: Mr. Michael A. Parman

II. Nature and/or description of the action being processed.

This action is a new order. The intent is to award a Firm-Fixed Price (FFP) Purchase Order (PO) to procure CompTIA Security+ Exam Vouchers and CompTIA Security+ Continuing Education (CE) Tokens.

The intent of this Brand Name Justification is to authorize the purchase of these CompTIA Security+ Exam Vouchers and Security+ CE Tokens on a brand-name basis. This PO will only be used to procure the Exam Vouchers and CE Tokens that are used to test for the CompTIA Security+ certification or maintain the certification, not procure training for the certifications or the certifications themselves.

While this action is awarding a new PO, ACC/A6 has previously purchased CompTIA Security+ Exam Vouchers and CE Tokens directly from General Services Administration (GSA) via

Additionally, ACC/A6 leveraged ACC AMIC/PKAB to purchase CompTIA Security+ Exam Vouchers and Security+ CE Tokens prior to the end of Fiscal Year 2024.

III. Description of supplies/services required to meet agency needs.

The below two items are required to meet agency needs. ACC/A6 is acquiring CompTIA Security+ Exam Vouchers and CompTIA Security+ CE Tokens. The estimated total contract value is $ The below information details the description and quantity to be purchased. 3400 funds will be used to fund this PO and delivery will be two weeks after receipt of award.

CLIN/Item Quantity Estimated Unit Price Estimated Total Cost

0001: CompTIA Security+ Exam Voucher 372 $ $ 0002: CompTIA Security+ CE Token 12,003 $ $

The Exam Vouchers are required for individuals who have completed the required training for the Security+ certification and are ready to test for the certification. The CE Tokens are required for Airmen who have already received the Security+ certification and are looking to renew and maintain their certification.

Department of Defense (DoD) 8140 mandated an enterprise-wide solution to train, certify, and manage the DoD Information Assurance (IA) workforce. The AF IA workforce is located across functional communities. Cyber operators and maintainers are required to be 8570/8140 certified which they achieve and maintain through the exam voucher and maintenance token process. AF Cyber certification program is supporting AF members with exam and maintenance fees for cyber coded positions for the AF Enterprise level. If members do not achieve/maintain their certifications, they are not allowed to accomplish the network administrative tasks necessary to ensure the enterprise is secure.

IV. Statutory authority permitting other than full and open competition.

DAFFARS 5313.501 - 10 U.S.C. 3572, Implementation of Simplified Acquisition Procedures (41 U.S.C. 1901)

Sole Source (Including Brand Name) Justification - Simplified Procedures for Certain Commercial Items

March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 3 of 9March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 3 of 9

V. Demonstration that the contractor's unique qualifications or nature of the acquisition requires the use of the authority cited above (applicability of authority).

As stated above, the intent of this Brand Name Justification is to authorize the purchase of the CompTIA Security+ Exam Vouchers and CE Tokens on a brand-name basis. These specific Exam Vouchers and CE Tokens are essential to the Government's requirement. These brand-name items can be purchased from a licensed/authorized reseller; however, they must be purchased on a brand-name basis to meet the Government's requirement.

CompTIA is the only brand capable of providing the Security+ Exam Vouchers and Security+ CE Tokens to best meet the DoD cybersecurity requirements while maintaining the CompTIA Security+ certifications currently held by personnel. In accordance with (IAW) DAFMAN 17-1305 paragraphs 2.15.8., 2.20.1., 4.4.1., and 4.4.3., military and civilian personnel in cybersecurity workforce positions must achieve and maintain DoD approved cybersecurity foundational certifications/requirements. IAW paragraph 4.4.3, privileged access shall be removed for any personnel who does not have or maintain qualifications in active and good standing after the transition date. The CompTIA Security+ certification is referenced on the DoD Cyber Exchange website in the DoD 8140 Documents Library as an appropriate certification to meet the DoD cybersecurity requirements (https://cyber.mil/wid/dod8140/documents-library). The Cyber Enablers, Cybersecurity (CS), and Information Technology (IT) spreadsheets under the DoD 8140 Qualification Matrices and Training Repository heading have tabs detailing the certification to work role mapping. The matrix and repository provide a central location to review existing cyber qualification options that meet the requirements of the DoD Cyberspace Workforce Qualification and Management Program (DoDM 8140.03) and supports the continued professional development of the DoD cyber workforce. The Security+ certification is among those certifications that are mapped to specific Work Role Titles. Additionally, the Security+ Exam Voucher is required by the

ACC A6/A6F is required to fund the first chance exam for each Airman to complete their training. There are no other brands available to take the exam and renew the certifications provided by CompTIA. Therefore, the CompTIA Security+ Exam Vouchers and Security+ CE Tokens provide the means to obtain and maintain one of the approved certifications and must be purchased on a brand-name basis.

As the CompTIA Security+ Exam Voucher is required for , the cost of switching to another certification would encumber unit readiness due to additional training costs, member salary lost, exam cost, and maintenance fees, as well as the intangible time lost to an organziation while personnel retrain. Therefore, due to these tangible (including course costs, salaries, exam costs, and other maintenance fees) and intangible (mission impact of unqualified personnel) costs, it is in the Government's best interest to purchase the Security+ Exam Vouchers for personnel to obtain the certification, as well as the Security+ CE Tokens for personnel to maintain the certification, on a brand-name basis. Additionally, failure to procure the brand-name CE Token would require personnel to re-acquire the certification at a much greater cost in exam preparation time, fiscal cost, and impact to their unit's mission.

Finally, IAW DAFMAN 17-1305 paragraph 4.4., civilian and military personnel may be subject to administrative action if they do not obtain or maintain foundational requirements within nine months of assignment to a DoD Cyberspace Workforce Framework (DCWF) coded role, meet residential requirements within 12 months of assignment to a DCWF coded role, or maintain their qualified status by meeting continuing education requirements. During the 8570 to 8140 transition period, incumbent members are expected to maintain DAF funded certifications by meeting continuing education requirements and requesting and submitting their voucher for annual fees, unless officially notified that the certification will not be required for any of their DCWF coded role and their role is in progress to transition to DCWF in that fiscal year. As stated previously, privileged access shall be removed for any personnel who does not have or maintain qualifications in active and good standing after the transition date. IAW DAFMAN 17-1305, civilian personnel who fail to meet or maintain qualifications may not perform any cyberspace tasks unless under the direct supervision of a cybserspace qualified individual and the commander determines appropriate actions IAW local civilian personnel policies. The individual's remaining cyberspace tasks must be reassigned to another individual who has the appropriate qualification in good standing. Military personnel who fail to meet or maintain qualifications also may not perform any cyberspace tasks unless under direct supervision of a cyberspace qualified individual. DAFMAN 17-1305 paragraph 4.4.5. and subparagraphs detail the steps a military member's commander will take following that individual's failure to meet or maintain qualifications. The failure to certify and/or recertify both civilian and military personnel would significantly degrade the ability of their unit to complete their mission as it would limit the number of qualified personnel to accomplish critical cybersecurity work across ACC. The CompTIA Security+ certification is

Sole Source (Including Brand Name) Justification - Simplified Procedures for Certain Commercial Items

March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 4 of 9March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 4 of 9 already approved by the DoD as an acceptable certification for the required credentials and other brands cannot provide an Exam Voucher or CE Token compatible with the CompTIA brand. Therefore, it is in the Government's best interest to procure the brand-name Security+ Exam Vouchers and Security+ CE Tokens in order to assist in enabling personnel to meet and maintain required qualifications.

VI. Description of efforts made to ensure that offers are solicited from as many potential sources as practicable.

Efforts will be made to ensure that offers are solicited from as many potential sources as practicable. As stated above, the required two items can be purchased from a licensed/authorized reseller; however, they must be purchased on a brand-name basis to meet the Government's requirement. The Government's intent is to award a PO to procure the two required CompTIA items.

Additionally, the Government issued three Requests for Information (RFIs) to identify as many potential sources (licensed/authorized resellers) as practicable. The RFIs were issued to all 74 GSA 2nd Generation IT (2GIT) BPA vendors;

all 428 GSA Multiple Award Schedule (MAS) 611420 vendors; and finally a Sources Sought was issued via SAM.Gov. The Government received and reviewed 11 RFI responses from vendors stating they are capable of providing the required items. However, it was later confirmed by CompTIA that vendors possess a letter of supply allowing them to resell CompTIA products in the open market. The details of each RFI are discussed in Section VIII of this justification as well as maintained in the contract file in the "Market Research" tab.

VII. Determination by the Contracting Officer that the anticipated cost to the Government will be fair and reasonable.

The Government intends to award a PO to a vendor who has the capability to provide both required CompTIA items.

Based on market research and IAW FAR Part 13, this requirement will be solicited as full and open under NAICS Code 611420 via a Combined Synopsis/Solicitation who CompTIA confirmed are authorized resellers possessing a letter of supply. The Government will rely on adequate competition to establish price fair and reasonableness IAW FAR 13.106-3(a)(1).

VIII. Description of the market research conducted and the results, or a statement of the reasons market research was not conducted.

The required CompTIA Security+ Exam Vouchers and Security+ CE Tokens are Commercial-Off-The-Shelf (COTS) items that can be bought by both public and private entities. The intent is to award a PO to procure these items through a Combined Synopsis/Solicitation. The market research conducted for this requirement and the results are detailed below and the full market research report is maintained in the contract file.

The brand-name CompTIA Security+ Exam Vouchers and Security+ CE Tokens are the only items that can fulfill this requirement for ACC/A6. To conduct market research and identify as many potential sources/offerors as practicable, the Government issued three RFIs. The GSA 2GIT RFI was issued via GSA eBuy on 1 Aug 24 with a closing date of 12 Aug

24. The RFI was issued to all 74 2GIT vendors as 2GIT is the USAF mandatory source for IT requirements. The RFI included an attachment that listed all the required CompTIA Exam Vouchers and CE Tokens (including Security+) and requested that vendors provide a response indicating which Exam Vouchers and CE Tokens they can provide. The Government received a total of 23 responses from 2GIT vendors; however, all 23 were 'No Quote' responses. The Government issued a second RFI to all 428 vendors on GSA MAS 611420. The Government received a total of 16 responses to this RFI, nine 'No Quote' responses and seven Sources Sought responses. Out of the seven Sources Sought responses, two small business vendors stated they were capable of fulfilling ACC/A6's requirement. A third RFI was issued as a Sources Sought via SAM.Gov. The Government received two responses from small business vendors stating they could provide the Security+ Exam Vouchers and Security+ CE Tokens.

As stated above, ACC/A6 leveraged ACC AMIC/PKAB to purchase CompTIA Security+ Exam Vouchers and Security+ CE Tokens prior to the end of Fiscal Year 2024.

Sole Source (Including Brand Name) Justification - Simplified Procedures for Certain Commercial Items

March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 5 of 9March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 5 of 9 here is not a reasonable expectation that at least two or more responsible small businesses, competing independently, will be able to submit a priced offer in response to a solicitation for this requirement. This is due to CompTIA informing the Government that only vendors who have a letter of supply from CompTIA authorizing them to resell CompTIA products in the open market, and

The FAR/DFARS Reps and Certs were reviewed on SAM.Gov for vendors, and vendors are under NAICS Code 611420. Therefore, this requirement will be solicited as full and open under NAICS Code

611420 via a Combined Synopsis/Solicitation who possess the letter of supply from CompTIA.

IX. Any other facts supporting the use of Other Than Full and Open Competition.

None.

X. List of any sources that expressed, in writing, an interest in the acquisition.

The Government reviewed 11 vendor RFI/Sources Sought responses that are detailed in the Streamlined Market Research and Acquisition Approach report saved in the contract file. The Government reviewed four small business responses from vendors responding to the Sources Sought notice issued via SAM.Gov. Two of the vendors stated they are capable of fulfilling ACC/A6's requirement and can provide the two required items. The Government also reviewed seven RFI responses from GSA MAS 611420 vendors. Two of those small business vendors also indicated they are capable of fulfilling ACC/A6's requirement and can provide the two required items in the open market. However, as stated above, CompTIA confirmed only vendors who possess a letter of supply allowing them to resell CompTIA products in the open market. Therefore, the Government intends to solicit this requirement via a Combined Synopsis/Solicitation

XI. A statement of the actions, if any, the agency may take to remove or overcome any barriers to competition before making subsequent acquisitions for the supplies or services required.

Currently, only the CompTIA Security+ Exam Vouchers and Security+ CE Tokens meet ACC/A6's requirement and allow personnel to test for the required Security+ certification at the conclusion of their training and/or maintain the required Security+ certification after it is initially received. If at any time in the future, a different "brand" of Exam Vouchers and CE Tokens are compatible with testing for and maintaining this specific certification, then they will be considered if they meet the requirements set by DoDM 8140. As detailed above, CompTIA is the only brand of Exam Vouchers and CE Tokens that will allow individuals to obtain and/or maintain the CompTIA Security+ certifications mandated by the DoD. The tangible and intangible costs of switching to a different certification brand after an individual's training has concluded or after an individual has already obtained the certification is not in the best interest of the Government.

Additionally, these two required items can be purchased through licensed/authorized resellers, and efforts are being made to solicit from as many sources as practicable by issuing a Combined Synopsis/Solicitation for this requirement to vendors who possess a letter of supply to resell CompTIA products. If at any time in the future CompTIA confirms that additional vendors become licensed/authorized resellers with a letter of supply, these vendors will be considered in future solicitations.

XII. Certification by the Contracting Officer.

As evidenced by my signature above, I have determined this document to be both accurate and complete to the best of my knowledge and belief.

XIII. Certification by the technical/requirements personnel.

As evidenced by my (our) signature(s) above, I (we) certify that any supporting data contained herein, which is my (our)

Sole Source (Including Brand Name) Justification - Simplified Procedures for Certain Commercial Items

March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 6 of 9March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 6 of 9 responsibility, is both accurate and complete.