CUI - JA25-071 - 842571048_Redacted.pdf

JA25-071-MES

CUI

Page 1 of 10 Pages

Controlled By: DISA Controlled By: SD51 CUI Category: Procure Distribution/Dissemination Control: FEDCON POC: disa.meade.id.list.mde@mail.mil

JUSTIFICATION & APPROVAL (J&A) FOR FEDERAL ACQUISITION

REGULATION (FAR) SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Schedule/Multiple Award Contract (MAC)

Orders under MAC/ Fair Opportunity – FAR 16.505(b), Department of Defense FAR Supplement (DFARS) 216.505(b), Procedures, Guidance and Information (PGI) 216.505(b)

Purchase Request Number: 842571048 Contract Number: HC104718D2004 Task/Delivery Order Number: To be determined Procurement Title: Mobility Enterprise Services (MES) Estimated Value:

Statutory and Regulatory Authority: 10 U.S.C. 3204(a) and FAR 16.505(b)(2)(i)(B)

Exception to Fair Opportunity Number: JA25-071

Upon the basis of the following justification, I, as Head of the Contracting Activity, hereby approve this exception to fair opportunity pursuant to the authority of FAR 16.505(b)(2)(i)(B).

1. REQUIRING AGENCY AND CONTRACTING ACTIVITY:

(a) Requiring Agency:

Defense Information Systems Agency (DISA) Acquisition Program Executive Office Services (SD) Enterprise Services Portfolio Management Office (SD5) Mobility Branch

(SD51)

6914 Cooper Avenue Fort Meade, Maryland 20755

(b) Contracting Activity:

DISA/Defense Information Technology Contracting Organization (DITCO) PS8414 2300 East Drive, Building 3600 Scott Air Force Base, Illinois 62225

2. NATURE/DESCRIPTION OF ACTION(S):

(a) The nature of this action is to procure an enterprise-wide mobility solution capable of supporting the unclassified and classified capability for the Department of Defense (DoD), approved Foreign Nationals supporting DoD, and other entities of the Federal Government requiring this service. The MES solution will continue support for the DoD Mobility

Page 2 of 10 Pages

CUI

Classified Capability (DMCC) and the DoD Mobility Unclassified Capability (DMUC) service offerings by leveraging current capabilities and integrating new capabilities across these platforms.

(b) This action will be awarded as a new firm fixed price (FFP) sole source task order to Booz Allen Hamilton (BAH) under the DISA Systems Engineering, Technology & Innovation (SETI) MAC indefinite delivery indefinite quantity vehicle. Fiscal Year 2025 Operations and Maintenance and Defense Working Capital will fund this action.

3. DESCRIPTION OF SUPPLIES/SERVICES:

(a) The DISA Mobility Program Management Office (PMO) has a requirement to continue providing the classified and unclassified mobility offerings. The DoD Mobility, as a program, encompasses multiple subcomponents that when integrated, provide customers with enterprise-level unclassified and secure classified protected communication services, ensuring interoperability, increased security, access to information, and reliable service.

The classified capability is required to be Commercial Solutions for Classified (CSfC) interoperable according to the National Security Agency (NSA) Information Assurance (IA) standards and Mobile Access Capability Package (MA CP) compliance thresholds.

The required classification levels are DMCC-Secret (S) and DMCC-Top Secret (TS).

DMCC-S operates on Secret Internet Protocol Router Network (SIPRNet) and interfaces with the Defense Enterprise Office Solution (DEOS) DoD365-secure cloud equivalent environment that is Impact Level 6 certified. DMCC-TS is an isolated TS network that tunnels through SIPRNet via High Assurance Internet Protocol Encryptor for connections to the Defense Red Switch Network, which is connected to the United States Intelligence Community. Due to the DISA Mobility PMO’s required classified capabilities, the MES contractor needs to be a CSfC Trusted Integrator (TI). A CSfC TI is defined as an organization that meets NSA established criteria and is qualified to assemble and integrate components according to a CSfC capability package, test the resulting solution, provide a body of evidence to the solution Authorizing Official/Designated Approving Authority, maintain the solution and be the first line of response in troubleshooting or responding to security incidents. To perform these tasks, the contractor must have demonstrated experience in system integration, with the technologies to be integrated, in formal testing processes and in evidence generation for system authorization. NSA provides criteria to establish a baseline for CSfC TIs.

The unclassified capability is required to be supported within a complex Non-Classified Internet Protocol Router Network (NIPRNet) and interfaces with the DEOS DoD365-J cloud equivalent environment that is Impact Level 5 certified. The MES contractor needs to have experience with unclassified Enterprise Mobility Management (EMM), Mobile Application Management (MAM) and Mobile Threat Defense (MTD) systems.

Required services include development, testing, mobile application management, product support, cybersecurity, Tier III engineering, and integration support within a complex classified and unclassified environment. Engineering activities include design and impact

Page 4 of 10 Pages

CUI

has led to the sole source environment. Having additional time would not influence the decision. It would take both a business need and experience for other CSfC TIs to gain the level of expertise required to support a Dual IPSec VPN on two different types of operating system (OS) platforms. It would also take a lab with full-scale operational expertise required for supporting a production-based system meeting a large senior leader customer base expectation.

The same can be applied in supporting an extensively large unclassified enterprise level EMM, MAM, and MTD production deployment that supports multiple Microsoft Office 365 tenants simultaneously. Only through experience and availability to such systems can the organizational expertise be attained in designing, deploying, updating and operating systems to the level currently deployed for DMUC, DMCC-S and DMCC-TS while simultaneously meeting the customers’ missions. BAH is the only source that is a CSfC TI with the required EMM, MAM, and MTD experience to meet the DISA Mobility program needs.

(2) Minimum government requirements. This requirement is for continued engineering and technical support for DMUC and DMCC with the following services: 1) Contract and Program Management Support, Product Support, Systems Engineering Support and Risk Management; 2) Technical Writing; 3) Nation Partner Solutions; 4) Systems Cybersecurity; 5) Assessment and Authorization; 6) Architecture Assessment and Support; 7) Requirements Process; 8) Testing (Software Unit Testing; Validation and Verification Testing; Interoperability and Integration Testing; Government Functional Testing; User Acceptance Testing); 9) Life Cycle Sustainment; 10) Internet Protocol (IP) version 6; 11) Integration; 12) Public Key Infrastructure/Enabling Identity and Management Support; 13) Capability Assessment; 14) System Operations; 15) Tier III; 16) Change Management; 17) Logistics and Asset Management; 18) Mobile Managed and Un-Managed Application Vetting/Support; and 19) Intune Integration and Support (Optional). Access to both NIPRNet and the SIPRNet for DMUC and DMCC-S/DMCC-TS respectively, are essential to provide the mobility customers with access to the applications, resources, and data that are essential for them to complete their mission across a very large disparate customer base throughout the Federal Government.

(3) Proposed sole source contractor and demonstration of unique source.

The proposed sole source contractor is BAH, the current MES-Classified (MES-C) and MES-Unclassified (MES-U) contractor. The primary reasons for the sole source situation are the complexity of the requirements along with the highly specialized and unique skills needed to successfully maintain the classified and unclassified mobility systems. These diversified aspects provide the level of customer service, and the wide array of device services required by users, especially senior leaders inside and outside the DoD. BAH possesses the experience across the mobility enterprise with the unique and specialized experience, knowledge, and expertise in the following areas for classified and unclassified:

a) Classified

1. BAH is a CSfC TI, an NSA CSfC certified third-party expert, guiding organizations through the process of building, testing, registering, and

Page 5 of 10 Pages

CUI

deploying CSfC solutions. It is their specialized expertise, which provides the knowledge and experience required to navigate the complexities of the CSfC program and implement secure solutions.

2. BAH is experienced with CSfC Dual IPSec VPN deployment, a CSfC means for connecting a mobile device to a classified gateway via nested VPN tunnels. It allows any application to be loaded and used indefinitely on the end user device (EUD), thus providing the greatest customer flexibility. This is an extremely complex capability that BAH possesses.

3. BAH is specialized in CSfC requirements analysis, which is required to execute a fully operational DMCC system.

4. BAH has experience integrating CSfC EUDs. Integrating EUDs to operate in a Dual IPSec environment is complex in that the EUD OS must be setup for doing VPN chaining so user data can be transported via the nested VPN tunnels, which occurs in the OS transport layer.

b) Unclassified

1. BAH implements policy and control settings for over 66 customer organizations that is spread out over 265,000 users that is growing over 5,000 users/month, with the required enterprise level experience. DMUC is the largest deployed MDM in DoD, requiring managing and operating a five each multi-core that is replicating enterprise MDM while defining and deploying granular policy for each of the customers.

2. BAH has the required MAM, MDM and MTD experience. Currently the MDM supports a Mobile Application Store of 1,440 deployed applications of which there are 1,049 iPhone OS (iOS) applications and 391 Android applications, respectively. Of these applications, there are 115 iOS and 42 Android MDM managed applications respectively, that are processing DoD Controlled Unclassified Information data. Additionally, there are 167 applications that have been canceled or removed from deployment due to cybersecurity risk, e.g. TikTok, Signal, etc. MTD is a combination of the device monitoring and subsequent MDM policy enforcements, at an enterprise level capability. Inherent in this is defining what are the threats to be monitored, what alerts are required, how it is integrated, what alerts are to be defined in the MDM as well as what are the subsequent MDM policy actions to be executed that are reticent of the threat encountered.

This unique combination of skillset is what makes BAH the only contractor capable of performing the required work. Only BAH can meet all the CSfC classified and unclassified requirements with the experience to support both mobility systems.

(4) Procurement discussion.

a) The constraints of the procurement have been provided in Section 4(b)(3) “demonstration of unique source”, specifically meetig the classified CSfC mandatory requirements as well as the unclassified enterprise level size and unique requirements of EMM, MAM and MTD systems.

b) The Government has been procuring the classified and unclassified capabilities from BAH since 2015. The original procurement awarded in 2015, the MES-C

Page 6 of 10 Pages

CUI

awarded in 2020, and the MES-U awarded in 2021, were competed acquisitions.

This new sole source task order to BAH is a consolidated, continuation of the two current task orders that can only be performed by BAH.

(5) Impact. Without the award of this task order to BAH, there will be a detrimental impact to the DISA mobility mission and the DMUC, DMCC-S, and DMCC-TS customers. The lack of experience for both classified and unclassified capabilities would result in an extremely steep learning curve across the board, specifically in Dual IPSec VPN and enterprise Level DMCU management. Not only would another contractor be learning about and understanding the complexity of the DISA Mobility PMO services and processes, but they would also have to simultaneously conduct troubleshooting, support system updates, maintain operations, and enhance existing services. This may result in errors that would negatively impact system(s) by operating under reduced capability or creating an outage. Ultimately, this will impact the customers, to include, the Secretary of Defense, DoD Honorables, members of Congress, Federal Agencies, military departments, and combatant commands. This sole source to BAH will ensure continuity from the current task orders to a unified task order with no degradation due to learning curves caused by lack of knowledge and experience in meeting the complexity of the mobility services that are required.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION:

The price will be evaluated using one or more of the techniques defined in FAR Part 15.404 in order to determine if they are reasonable and complete. Reasonableness is established through cost and price analysis techniques as described in FAR 15.404. The Contracting Officer shall compare quoted prices to the pre-established SETI contract prices and the Independent Government Cost Estimate. A determination will be made that the award represents the best value to the Government.

6. MARKET RESEARCH:

(a) On October 31, 2024, the Government conducted market research using a Sources Sought Notice (SSN) submitted to all ENCORE III large and small businesses and to industry via the Government-wide point of entry, SAM.gov. The SSN solicited sources for the Government’s consideration of combining the DMUC and DMCC requirements into one acquisition. The SSN included seven capabilities that were identified if supporting DMUC, DMCC (DMCC- /DMCC-TS), or both mobility systems. Primarily, the MES contractor would need to be a CSfC TI and have experience with unclassified EMM, MAM and MTD systems.

When responding to the SSN, the company was to identify if they can meet one or both mobility systems. A total of 14 responses were received, consisting of 11 small businesses and three large businesses. The first step was to determine if the companies were a CSfC TI. Of the 14 submittals, two large businesses and two small businesses were CSfC TIs.

The next step was to determine if the CSfC TI companies had experience with unclassified

Page 7 of 10 Pages

CUI

EMM, MAM, and MTD systems. Only BAH was identified as a CSfC TI with the required EMM, MAM, and MTD experience.

On December 27, 2024, additional market research was conducted, targeting large and small businesses that were CSfC TIs and had experience with an unclassified EMM, MAM, and MTD systems. The DISA Mobility PMO solicited companies on the CSfC TIs List, https://www.nsa.gov/Resources/Commercial-Solutions-for-Classified- Program/Trusted-Integrator-List/ that did not respond to the initial SSN. Four responses were received, consisting of three large businesses and one small business. None of the responses to this additional market research had the required experience in EMM, MAM and MTD systems. BAH remains the only source capable to meet the unclassified and classified requirements.

(b) Based on current market research, dated August 2024 – April 2025, it has been determined that only the aforementioned support service provided by BAH can fully meet the Government’s need. The small business market is not capable of executing either the unified MES order or for status quo of keeping MES-C and MES-U separate orders. A consolidated order requires the small business to be a qualified CSfC TI as the prime since the CSfC TI workload is over 50% of the costs. A small business that was a CSfC TI was not identified that also had the knowledge and experience to support the majority of the unclassified work that consisted of EMM, MAM and MTD. This requirement is for unique classified and unclassified experience and knowledge, wherein no competitor functional capability exist in the market at this time to meet the Government's need. The Government will continue to conduct market research to determine if there are changes in the marketplace that would enable future competitive actions, i.e., there are similar capability in the marketplace that provides the same classified and unclassified services.

7. ANY OTHER SUPPORTING FACTS:

None

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History.

(1) MES-C

Contract/Task Order: HC108420D0004/HC108420F0242

Contract Vehicle DISA Single Award Indefinite Delivery Indefinite Quantity

Brief Description: MES-C for DMCC Engineering and Support Services

Contractor: BAH Business Type Large Business Period of performance (including all options):

July 20, 2020 – July 19, 2025 July 20, 2025 – January 19, 2026 (FAR 52.217-8)

Page 8 of 10 Pages

CUI

Life Cycle Contract Value:

Contract Type: FFP Method of Acquisition: Single Award Delivery Order

(2) MES-U

Contract/Task Order: HC102818D0006/HC108421F6105 Contract Vehicle ENCORE III Full & Open Suite

Brief Description: MES-U for DMUC Engineering and Support Services

Contractor: BAH Business Type: Large Business Period of performance (including all options):

April 4, 2021 – April 3, 2025 April 4, 2025 – October 3, 2025 (FAR 52.217-8)

Life Cycle Contract Value:

Contract Type: FFP Method of Acquisition: Competed Fair Opportunity

Contract/Task Order: GS00Q09BGD0019/HC104715F0005 Contract Vehicle General Services Administration Alliant

Brief Description: Unclassified and Classified Mobility Engineering and Support Services

Contractor: BAH Business Type: Large Business

Period of performance (including all options):

February 4, 2015 – February 3, 2020 February 4, 2020 – August 3, 2020 (FAR 52.217- 8)

Life Cycle Contract Value:

Contract Type: Cost Plus Fixed Fee Method of Acquisition: Competed Fair Opportunity

(b) Actions to remove barriers. There were no prior non-competitive awards for previous or current procurements, leading to any barriers or reduced competition. Proposed actions to remove barriers in the future:

(1) Preliminary capability briefing to industry: Thirty months prior to soliciting the follow-on MES, publish an unclassified briefing invite on SAM.gov. This brief will outline of the expected needs of the DISA Mobility PMO for the skillsets and experiences required to support the program. This will allow industry time to further develop their skillsets and experiences required to support the program, promoting competition.

(2) Draft PWS to industry: Twelve months prior to soliciting the follow-on MES, publish a draft PWS on SAM.gov. This will give industry time to refine their skillsets and experiences required to support the program, support the formation of future teaming arrangements, etc., leading to increased competition.

Page 9 of 10 Pages

CUI

(3) Work with NSA CSfC PMO to present at their annual CSfC Conference on the needs of the DISA Mobility PMO for Dual IPSec VPN and future directions of the program’s system enhancements.

(c) Related prior awards without the need for exception to fair opportunity. There were no prior non-competitive awards. Since 2015, the DISA mobility services have migrated to more complex and larger systems. DMCC has moved from the simpler Transport Layer Security application to the more complex Dual IPSec VPN architecture. DMUC complexity has increased from an EMM only to both MAM and MTD, all of which must integrate with the EMM for both policy enforcement and alerts. As such, the market does not have the skillsets and experience set to meet the requirements needed to execute the MES combination of DMUC and DMCC systems.