CMU-SEI_Justification_ _Approval_document.pdf

JUSTIFICATION FOR OTHER THAN

FULL AND OPEN COMPETITION

I. Contracting Activity

Air Force Life Cycle Management Center, Enterprise Acquisition Division (AFLCMC/PZM), Hanscom Air Force Base, MA, Justification for Other Than Full and Open Competition

II. Nature And/or Description of the Action Being Processed

This is a class Justification & Approval (J&A) for Other Than Full and Open Competition to extend the current contract and award a follow-on contract to Carnegie Mellon University (CMU), to operate the Software Engineering Institute (SEI), hereinafter referred to as CMU-SEI, a Federally Funded Research and Development Center (FFRDC).

The current contract (FA8721-05-C-0003) with CMU-SEI is a cost reimbursable (no fee) contract that will expire on 30 June 2015. The performance period will be extended, for a period of one year (from 1 July 2015 to 30 June 2016), to allow in-process non-severable work to be completed, and extend in-process severable efforts (however, in-process work that is severable will not be continued beyond 12 months from the date in which the work began). The total estimated value increase of the current contract is , from to . The current contract ceiling will be increased and the performance period extended by issuing a contract modification no later than 30 June 2015.

The follow-on contract will be a new cost reimbursable single award Indefinite Delivery/ Indefinite Quantity (IDIQ) contract, with numerous resulting Task Orders, issued to CMU.

While historically contracts for CMU-SEI have not included a fee, the follow-on contract may include “need for fee” as explained in the Department of Defense Management Plan (Appendix E) to cover ordinary and necessary operating expenses that are not other allowable costs under the contract. The initial ordering period of the IDIQ is for five (5) years commencing on 01 June 2015 through 31 May 2020, with an option for an additional five (5) year ordering period from 01 June 2020 through 31 May 2025. Exercise of the option is subject to the needs of the agency and the renewal of the CMU SEI comprehensive review.

The follow-on contract will be awarded one month before FA8721-05-C-0003 expires to accommodate the award of new projects on the new contract to allow for a full period of performance. There will be a subsequent period of delivery/completion for up to twelve (12) months following the end of the ordering period.

This effort for Research and Development (R&D) work is designated “Other Contracting” as defined by AFFARS 5302.101.

The following cost estimate is based on the independent government estimate that encompasses the cost to operate the FFRDC for a total of ten years and five months. The sum of the work CMU-SEI will perform from January 2015 through May 2025 (aggregate of all Task Orders on the new contract and the modification to the current contract) will not exceed .The breakout of the estimated cost is as follows:

Modification to Current Contract (Jan-May ’15):

Modification to Current Contract (Jun ’15 – May ’16):

New Sole-Source IDIQ Award:

Total

III. Description of Supplies/Services Required to Meet the Agency’s Needs

The Government is in need of establishing and maintaining objective access to superior information science and software engineering techniques that can be maintained in the presence of sophisticated and rapidly developing cyber threats. The proposed contract extension and sole-source award for CMU-SEI are for R&D services residing within CMU-SEI’s core competencies of information science and software engineering and are to be provided to numerous Department of Defense (DoD) and other Government agency programs. CMU-SEI provides the essential engineering, research, and development capability to meet the Government’s need.

The SEI is operated by the Carnegie Mellon University under prime contracts with the Air Force.

Though housed at CMU’s campus in Pittsburgh, PA, SEI functions as a research laboratory for the DoD and is sponsored by the Under Secretary of Defense of Acquisition, Technology, and Logistics (USD(AT&L)).

The new follow-on contract is ( for the five-year base period and for the five-year option period), assuming approximately 195 DoD Staff Years of Technical Effort (STE) annually for DoD programs, plus Military Intelligence Programs/National Intelligence Programs (MIP/NIP), non-DoD efforts, and excluded procurement purchases. The total estimated value increase of the current contract is , from to . The total estimated value of this class J&A is ; this value is the estimated cost to operate CMU-SEI for the period of 01 June 2015 to 31 May 2025 and increase the ceiling of the current contract.

The types of Department of Defense funds used will be Operation and Maintenance (O&M), Research, Development, Test & Evaluation (RDT&E), Other Procurement, and Working Capital funds. The funding provided by non-DoD agencies, in support of CMU-SEI’s work on their research programs, will be placed on contract as Air Force (AF) funds via reimbursable budget authority (RBA).

The proposed new contract and current contract extension will provide for the continuation of CMU-SEI’s current mission under the overall policy and program guidance of the DoD FFRDC Management Plan (dated 25 April 2011), Comprehensive Review, and the renewed Sponsoring Agreement. The current Sponsoring Agreement expires 5 May 2015, and a renewed Sponsoring Agreement, valid for five years, will be incorporated, by reference, into the existing contract and the new contract.

IV. Statutory Authority Permitting Other Than Full and Open Competition

The authority cited for this acquisition is 10 U.S.C. 2304(c)(3), as implemented by FAR 6.302- 3(a)(2)(ii), “to establish or maintain an essential engineering, research, or development capability to be provided by an educational or other nonprofit institution or a federally funded research and development center.”

V. Demonstration That the Contractor’s Unique Qualifications or Nature of the Acquisition Requires the Use of the Authority Cited Above (Applicability of Authority)

FAR 35.017(a)(4) states “long term relationships between the Government and FFRDCs are encouraged in order to provide the continuity that will attract high-quality personnel to the FFRDC. This relationship should be of a type to encourage the FFRDC to maintain currency in its field(s) of expertise, maintain its objectivity and independence, preserve its familiarity with the needs of its sponsor(s) and provide a quick response capability.” The DoD FFRDC Management Plan also encourages long-term relationships between the Government and FFRDCs in order to provide the continuity that will attract highly skilled personnel to CMU-SEI.

FFRDCs maintain long-term capability in core competencies in domains that continue to be of great importance to the DoD and all means available should be used to preserve and strengthen them. CMU-SEI’s core competencies are in the information science and software engineering areas.

Prior to extending the contract, FAR 35.107-4 requires the Sponsor of the FFRDC to conduct a comprehensive review of the use and the need for the FFRDC. The Sponsor (USD(AT&L)) conducted a Comprehensive Review in the spring of 2014; the report was finalized and approved on 20 July 2014. This Comprehensive Review validates the CMU-SEI FFRDC for a period of five years; the Air Force contracts with CMU cannot be continued beyond five years unless the next Comprehensive Review validates the continued need of the CMU-SEI prior to option exercise.

The USD(AT&L) Comprehensive Review (dated 20 July 2014) determined that, “The DoD needs to establish and maintain access to superior information science and software engineering techniques. Further, this superiority must be maintained in the presence of sophisticated and rapidly developing cyber threats. These objectives can be advanced by a software-focused FFRDC.” CMU-SEI is the only DoD FFRDC providing essential engineering and research capabilities in the areas of information science and software engineering that satisfy the aforementioned need. This recognition is illustrated by the following commitment appearing in the comprehensive review: “The continued commitment of the USD(AT&L) to fund research at the SEI and the over $100M/year in user-driven Project Work Statement work points to a continued need for the SEI” (Comprehensive Review, page 6). SEI’s unique research advances the state of knowledge and improves the capabilities and trustworthiness of software-reliant systems essential to improving the DoD’s ability to combat rapidly developing cyber threats.

CMU-SEI is unique in many aspects. CMU-SEI is free of perceived or actual conflicts of interest, which provides an objective approach to solutions and has the ability to assist the DoD and other stakeholders with software challenges by engaging with industry users. Engaging with industry users results in: accessing and leveraging industry’s rapid innovation in research, technologies and best practices to understand emerging ideas and take full advantage of them to keep the Government on the leading edge; increasing software assurance and cyber security by accelerating the introduction and widespread use of high-payoff software and cyber research, technologies and practices to industry partners including those in the Defense Industrial Base (DIB), critical infrastructure, and DoD supply chain; and gaining industry buy-in and collaboration on challenges faced by the DoD via a trusted advisor relationship through venues such as collecting, synthesizing and disseminating important anonymous data (e.g.

vulnerabilities, cost data), and fostering the development, evolution and adoption of software and cyber standards. Additionally, other unique factors include CMU-SEI’s deep understanding of robust software development and fielding practices that are vital to developing warfighter excellence; staff that regularly engages with leading universities and R&D institutions by participating in research collaborations, teaching, mentoring, and leadership in the organizations;

advanced software engineering principles and practices that have served as a national resource in software and cyber security; and delivery of value for the warfighter through a combination of line-funded research and problem-solving engagements, enabling highly significant results in diverse areas related to software.

FFRDCs were established to perform the mission of providing the DoD with unique capabilities in many areas where the government cannot attract and retain personnel in sufficient depth and numbers (DoD FFRDC Management Plan, page 1). The CMU-SEI FFRDC was established specifically to provide objective and independent R&D to the DoD. Its mission is to provide technical leadership and innovation, through R&D, to advance the practice of software engineering technology in support of DoD needs.

Over the years, CMU-SEI has provided technical innovations in client technical solutions, Cyber Intelligence, Operations and Technologies, Cyber Workforce Development, Architecture Practices, real-time systems design and software assurance, Agile practices and measurement capabilities, secure coding and malware analytics, and Software Engineering Measurement and Analysis for the DoD. The utilization of CMU-SEI’s pool of highly educated and leading software cyber and technical experts, including ready access to the faculty and students of Carnegie Mellon, strengthens the DoD and other Government agencies’ overall resources. These advantages increase the probability of achieving mission success. CMU-SEI’s staff expertise crosses the entire acquisition lifecycle from invention to sustainment within its core competencies of software engineering and information science. Their deep understanding of robust software development and fielding practices are vital to developing warfighter excellence.

SEI can also rely on its extensive relationships with industry and academia when additional expertise is required.

Over the past 30 years, CMU-SEI has provided and continues to provide expertise in the software and cyber domains, on a grand scale, addressing needs across the Federal Government and covering the lifecycle of the system software in a manner that is free from conflict of interest. The capabilities developed over the past 30 years are not resident in any other entity, nor is there a governmental capability, on such a scale, to address national defense issues related to the software and cyber domains, thus demonstrating the need to maintain the capabilities possessed by CMU-SEI. The DoD does not inherently have the capability to meet the need to develop and sustain a competitive advantage in software systems. The ability to address this issue in such a way to achieve better acquisition outcomes is ideally suited for an FFRDC.

The Comprehensive Review stated that, “The SEI should continue to maximize DoD access to novel ideas by discovering and catalyzing innovation found across industry, academia, and the Government. It should continue to develop and demonstrate innovative technologies, scientific principles, prototypes, and practices. Lastly, the SEI should continue to transition innovative technologies, scientific principles, prototypes, and practices to organizations that support the Nation’s defense” (Comprehensive Review, page 45).

To complete the balance of the Comprehensive Review criteria, the Comprehensive Review panel determined:

(1) numerous independent evaluations of the software landscape have reiterated the criticality of software and the need to improve how it is developed and acquired in the DoD;

(2) SEI is an independent, unbiased, agent well-suited to assess the current state of any given approach, technology, or process and provide general guidelines and recommendations to its sponsors;

(3) SEI engages with industry users to gain an understanding of current and emergent technologies and best practices in the software cyber community and transition the rapid and broad community adoption of SEI technologies;

(4) SEI is being operated in a cost-effective and efficient manner;

(5) the need for the SEI to fulfill the Sponsor’s special technical need and requirements continues to exist;

(6) the SEI’s skill set fills a unique role by directly connecting software research with acquisition savvy to enable the transition of new ideas to the defense industry and the DoD;

(7) the SEI is efficient and effective at meeting the sponsor’s needs. In accordance with the

DoD Plan for Administration of the CMU SEI, the SEI is tasked to perform annual self-assessments of their execution to the Joint Advisory Council (JAC) and the JAC Executive Group (JAC EG). The Sponsoring Agreement requires that SEI review the results of customer surveys. Annual customer feedback surveys indicate that SEI scores highly in meeting sponsor user needs (Comprehensive Review, page 35).

(8) the criteria for establishing the SEI continues to be satisfied and the SEI is fulfilling its current (2010) Sponsoring Agreement which is in compliance with FAR 35.017-1.

The Comprehensive Review states, “The software problems faced by the DoD demand broad, unbiased, secure, and open solutions. The Department relies on FFRDCs to provide a true independent, honest-broker perspective to help arbitrate among the competing alternatives to find the best solution for the Warfighter” (Comprehensive Review, page 14). The CMU-SEI is a nonprofit organization primarily focused on issues of national defense affecting the DoD and other Government agencies. Unlike a for-profit entity, CMU-SEI maintains its technical objectivity and independence and provides research solutions that are free from outside influences or conflicts of interest. This independence of operating as a nonprofit enables CMU- SEI to deal impartially with all parts of the government as well as industry and academia, and ensures CMU-SEI’s continued capacity to transition proven technologies and techniques broadly.

This is further supported in the OASD(R&E)’s determination in the Comprehensive Review that “the SEI is the only reasonable, existing source for the type of software engineering support that the Department needs.” The changing needs of the sponsor “…do not warrant the creation of a new FFRDC. The SEI is best positioned of all FFRDCs to adapt to the Department’s emerging needs in information sciences” (OASD(R&E) Memo dated 30 May 2014, page 3).

VI. Description of Efforts Made to Ensure that Offers Are Solicited From as Many Potential Sources as Deemed Practicable

FAR 35.017-4(a) provides that, when reviewing FFRDCs “the sponsor, prior to extending the contract or agreement with an FFRDC, shall conduct a Comprehensive Review of the use and need for the FFRDC.” The mandatory Comprehensive Review validates that a requirement for an FFRDC exists and includes consideration of alternate sources to meet the sponsor’s needs.

The Comprehensive Review considered alternatives in industry, academia, and other FFRDCs.

Specifically, the Sponsor conducted an efficiency and effectiveness assessment on the ability of alternative sources to meet the sponsor’s needs, maintain objectivity, independence, quick response capability, currency in its field(s) of expertise, and familiarity with the needs of the sponsor. The Comprehensive Review panel validated that academia, industry, and the Government do not possess the depth and breadth of knowledge and experience in the highly specialized areas that CMU-SEI supports because they are not positioned to provide the scale and technical expertise required by DoD and other government agencies. CMU-SEI provides objective expertise to the Government that is unique and cannot be obtained from for-profit entities. What is more, because the core work of other FFRDCs does not include providing technical leadership and innovation in information science and software engineering, no other FFRDC can meet the Sponsor’s needs either. Therefore, no additional sources were solicited to accomplish the work being performed by CMU-SEI.

IAW FAR 5.202(a)(10), the proposed contract action is made under conditions described in 6.302-3, and therefore will not be synopsized.

VII. Determination by the Contracting Officer that the Anticipated Cost to the Government Will be Fair and Reasonable

In accordance with the Comprehensive Review, “the SEI is being operated in a cost-effective and efficient manner” (Comprehensive Review, page 40). This conclusion is supported by the USD(D) review of FFRDC activities in 2012 and yearly audits conducted by the Office of Naval Research (ONR) and Defense Contract Audit Agency (DCAA). Further, it states “The Under http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/06.htm%23P136_19281

Secretary of Defense (Comptroller) (USD(C) conducted a comprehensive assessment of FFRDC activities in October 2012 which was focused on the value of FFRDC in comparison to private service providers. The assessment found evidence that some for-profit entities may undercut the price that FFRDCs charge, but the technical competency of the product was not the same.”

The contracting officer shall ensure that the cost will be fair and reasonable prior to contract award. DCAA, AFLCMC/PZF price analyst, and the ONR will provide the necessary support to ensure that the final contract price will be fair and reasonable. In accordance with Defense Federal Acquisition Regulation Supplement (DFARS) 215.403-1(c)(4)(D), certified cost or pricing data is not required from non-profit organizations (CMU-SEI), but will be required by subcontractors if their proposals exceed the certified cost or pricing data threshold. However, submission of other than cost or pricing data will be used to the extent necessary to determine price reasonableness and cost realism. This data will be used to support the Government evaluation of the proposed estimated costs.

The ONR negotiates annual indirect rates based on incurred cost audits, and the Defense Contract Management Agency (DCMA) Administrative Contracting Officer (ACO) and DCAA auditors will also provide the surveillance required to monitor a Cost Reimbursement contract after award.

A yearly Financial Management Review will be conducted to cover a portfolio review and cost control measures. The review will address obligations and expenditure rates, STE management, cost outliers, and schedule outliers. This information will be detailed to the sub-program level.

The cost control measures will address mutually agreed upon targets to reduce cost. Items examined will include Lab Services, Facilities and Administration, Employee Benefits, salaries/wages, excluded outside procurement, non-excluded procurement, overall DCAA findings and ONR assessment of DCAA findings.

VIII. Description of the Market Research Conducted and the Results, or a Statement of the Reasons Market Research was not Conducted

Market Research was central to the Comprehensive Review, and serves as the Market Research for this particular effort. A Technical Review Panel (TRP) was convened to support the Comprehensive Review. The TRP members were selected for their broad program management and technical expertise and experience in contracted research across all the DoD components and Department of Homeland Security. The TRP was chaired by the former head of DoD research (including labs and University Affiliated Research Centers) who has extensive experience across the intelligence community. The aggregated experience of the TRP resulted in a panel with demonstrated capability in analyzing the software focused R&D market. The TRP examined the body of evidence provided by the Services and the Sponsor. The TRP concluded that there is no other existing source that can meet the Sponsor’s needs. This was amplified by a 30 May 2014 ASD(R&E) memo, stating “no such entity exists today. An attempt to duplicate or replace the SEI’s capability would be costly, risk failing to create a comparable capability, and disrupt the support that DoD receives” (OASD(R&E) Memo dated 30 May 2014, page 2). The mandatory Comprehensive Review examined alternative sources when evaluating considerations to meet the sponsor’s needs in accordance with FAR 35.017-4(c)(2) and determined “there is no alternative source that can meet the Sponsor’s needs.”

IX. Any Other Facts Supporting the Use of Other Than Full and Open Competition

None.

X. List of Sources, If Any, That Expressed Interest In the Acquisition

Not applicable. See Section VI, above.

XI. A Statement of The Actions, If Any, The Agency May Take To Remove Or Overcome Any Barriers To Competition Before Making Subsequent Acquisitions For The Supplies Or Services Required

There have not been actions taken to foster competition of sources for this FFRDC contract.

FFRDCs are established to operate in the public interest, free from organizational conflicts of interest, to assist the DoD in ways that industry, non-profit contractors that work for industry, and for-profit contractors cannot. CMU-SEI maintains long-term capabilities in core competencies and in R&D domains such as software engineering, cyber security, prototyping, and collaborative networking. AFLCMC/PZM relied on the findings of the Comprehensive Review to validate the requirement of the continued need for the FFRDC. Every five years DoD undertakes an exhaustive Comprehensive Review to determine whether there is a continuing need for the FFRDC.

Due to the unique nature of the CMU-SEI FFRDC, there are no plans at this time to create competition in the future.

Although there are no planned actions to foster competition for the CMU-SEI contract, when the CMU-SEI FFRDC creates technical data and/or computer software through its state of the art research and development, the Government receives unlimited rights to the technical data/computer software. The Government users may then use this data to competitively seek follow-on actions in the commercial market place.

XII. Contracting Officer’s Certification

The Contracting Officer’s signature on the Coordination and Approval document evidences that he has determined this document to be accurate and complete to the best of his knowledge and belief (FAR 6.303-2(b)(12)).

XIII. Technical/Requirements Personnel’s Certification

The Program Manager’s signature on the Coordination and Approval document evidences that the technical and/or requirements data contained herein, is both accurate and complete (FAR 6.303-2(c)).