DC2 Justification and Approval - Redacted.pdf

U.S. Department of Homeland Security Office of the Chief Procurement Officer

Justification and Approval for Other Than Full and Open Competition Version 3.0

JUSTIFICATION AND APPROVAL FOR OTHER THAN FULL AND OPEN

COMPETITION

41 U.S.C. 3304(a)(7)

Justification No: FY20-0059

Pursuant to the requirements of the Competition in Contracting Act (CICA) as implemented by the Federal Acquisition Regulation (FAR) Subpart 6.3 and in accordance with the requirements of FAR 6.303-1, the justification for the use of the statutory authority under FAR Subpart 6.3 is justified by the following facts and rationale required under FAR 6.303-2 as follows:

1. Agency and Contracting Activity.

The Department of Homeland Security (DHS), Office of Procurement Operations (OPO), Information Technology Acquisition Center (ITAC) proposes to award on behalf of the Office of the Chief Information Officer (OCIO) a contract on the basis of other than full and open competition.

2. Nature and/or Description of the Action being Approved.

(a) OCIO/OPO/ITAC propose to establish a strategically sourced Indefinite

Delivery/Indefinite Quantity (IDIQ) Contract without further competition. This Justification and Approval covers the anticipated IDIQ award and all Task Orders executed against it.

(b) The current Data Center 2 (DC2) IDIQ contract, HSHQDC-15-D-00015, was awarded to Perspecta, LLC formerly Hewlett Packard Enterprise Services (HPES) (13600 EDS Drive, A3S-B53, Herndon, VA 2017) on May 12, 2015.

The contract period of performance ends on June 26, 2020. Under this Justification and Approval, OPO/ITAC contemplates award to the current provider Perspecta, LLC.

(c) The Data Center 2 contract will be a hybrid, which will allow for a mix of Firm

Fixed Price (FFP), Labor Hour (LH), and Time and Materials (T&M) CLINs/Orders. The contract will have a potential ordering period of three years consisting of a 2-year base period and (2) 6-month option periods.

(d) The estimated total value broken out by performance period is represented below:

Base Year 1:

Base Year 2:

Option Period 1:

Option Period 2:

Total:

Justification and Approval for Other Than Full and Open Competition

(e) The IDIQ contract will be available for use by all DHS Components. The type of funding used for each Task Order will be determined by the DHS ordering Component. It is expected, however, that most funding will be Operations and Support (O&S).

(f) The IDIQ contract for Data Center 2 will have a potential ordering period of three (3) years. Depending on when individual task orders are placed, the year of their funding will vary. It is expected that O&S funding will be limited to fiscal years, 2020, 2021, and 2022.

(g) The solicitation number for this effort is 70RTAC20R00000016.

(h) The Data Center 2 computing and data storage requirements are enterprise wide.

During Option Period 3, June 2018 through June 2019, there were 52 active Task Orders on the current IDIQ contract, used by 12 DHS components, which resulted in total purchasing in the amount of for that period.

Going forward, DHS’ strategy is to remove all systems from this Data Center by migrating or retiring each system. Costs are expected to decline as systems are moved out of the facility. The referenced strategy for DC2 follows recent Office of Management and Budget (OMB) guidance entitled “Update on Data Center and Cloud Optimization Initiative,” issued on June 25, 2019. This memo specifically calls for the consolidation and closure of data centers through the use of cloud technologies.

The initial decision to exit DC2 was made in May 2018, approximately 2 years from the current IDIQ contract expiration period. Since that time, the migration out of DC2 has proved to be more complicated than expected. To assess if an application or system is ready to migrate, there is an established decision process. In some cases, the system may be ready to retire, which means the system is not worth the investment to migrate to the cloud. However, when the system is not retired, the system may be re-hosted in the cloud, redesigned to operate in the cloud, or simply replaced with functionality already in the cloud. In other cases, the system may not be able to migrate to the cloud for business or security reasons. In that scenario, the systems would have to either stay in the existing Data Center or migrate to another Data Center.

For those systems and applications deemed appropriate for cloud migration, redesign efforts involve system and software redevelopment. In other cases, the decision to migrate out of DC2 coincided with system implementation efforts in DC2. When a system implementation effort was underway, the move into DC2 continued without interruption.

Another migration consideration is the migration of data at rest, including archived data, which has proven to be more complicated and costly than expected. This was especially true when the data was stored on shared infrastructure within DC2. A migration to the

Justification and Approval for Other Than Full and Open Competition cloud involves extracting data from systems shared among other DHS users. As a result, careful coordination has to occur to ensure service is not interrupted and data retention requirements are met. Simply put, given the breadth of services currently being provided in DC2, there is not sufficient time to exit by June 2020 without service disruptions.

There are currently 153 systems that need to migrate out of DC2. Of these 153 systems, 41 systems or 27% have already been decommissioned and no longer operate in DC2;

these systems are deemed “complete” in their migration out of DC2. The decommissioning for all system status is as follows:

The table shows that 56% of the systems are scheduled to migrate within 5 months of the current contract expiration, and 17% of the systems are scheduled to migrate out of DC2 after the current contract expiration in June 2020. Therefore, OCIO requires continued services by the incumbent DC2 contractor beyond the current end date. The new contract allows for the efficient exodus from the facility and supports agency efforts to conduct a competitive procurement for requisite services at DHS DC1, which will serve as the new hosting facility for many systems that migrate from DC2.

For 95% of the systems, the system owners are executing a plan to exit DC2. Their completion dates are reflected in the chart above. However, for the remaining 5%, the system owners are still developing their exit plans, but have been given a firm deadline of December 18, 2021 to exit DC2. They are accounted for in the Jan.-Dec. 2021 deadline noted in the chart above. OCIO is working with these system owners to remove impediments to implementation.

3. Description of Supplies/Services.

The existing DC2 IDIQ enterprise contract provides comprehensive data storage and management services including, but not limited to, the following:

Justification and Approval for Other Than Full and Open Competition

• Hosting/Computing Services

• Application Services

• Data Storage Services

• Operation and Maintenance Services

• Data Archiving

• Decommissioning Services

• Disaster Recovery/Continuity Services

• Technical Guidance

• Hardware & Software

• Network & Security Infrastructure

• Program & Project Management

• Migration Services

• Private Cloud Services

The IDIQ contract award to be established by OPO/ITAC as represented within this Justification and Approval shall include the same scope reflected above within the existing DC2 IDIQ contract. Comprehensive data storage and management services are required to ensure a complete and effective migration from DC2.

4. Identification of Statutory Authority Permitting Other Than Full and Open

Competition.

The statutory authority permitting other than full and open competition is 41 U.S.C.

3304(a)(l) pursuant to FAR 6.302-1, only one responsible source and no other supplies or services will satisfy agency requirements.

5. Demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the authority cited.

This IDIQ contract action requires the use of other than full and open competition to award continued comprehensive data storage and management services. The rationale, relevant details and circumstances, alternatives considered, and mission impacts of not approving the Justification and Approval are provided in the subsections below:

DHS OCIO is responsible for providing enterprise-level information technology (IT) services to support DHS missions through a variety of solutions. These services must meet the full range of DHS Component availability requirements and provide requisite security controls for the full range of mission data. DHS Headquarters operates two enterprise data centers known as DC1 and DC2. The DC2 IDIQ contract is currently held by Perspecta Inc., which ends in June 2020.

In October 2019, DHS/OCIO realized a number of legacy systems could not be moved out of the DC2 facility before the end of the contract period without excessive risk to mission critical operations. The DHS Headquarters OCIO

Justification and Approval for Other Than Full and Open Competition Version 3.0 determined that DC2 contract services would need to be continued to enable a smooth transition with limited operational risk. DHS system owners have been given until December 2021 to have their systems decommissioned in DC2.

The current DC2 IDIQ contract provides services performed at a contractor-owned contractor-operated facility. As a result, a new vendor would not have the authority or access to the current DC2 facility and therefore would not be able to perform the subject services to maintain operations of the current data center. A significantly high level of technical, security, and project risk exist if systems would become unavailable if services were to be secured outside of the current DC2 IDIQ contract provider. If another supplier was selected, this would involve finding space at another data center, moving equipment to that new data center, and finally going through a security authorization process to ensure the new location has an Authority to Operate. Going through these steps would add risk as creating a new space and ensuring the infrastructure is secure would add technical, schedule and cost risk. If the incumbent supplier was not used, there would also be duplication of certain costs. First, duplicate equipment would have to be purchased to simultaneously operate in another data center. Second, duplicate space in leased data center facilities would need to be purchased while still operating in DC2. Third, additional professional services would need to be purchased to perform the migration from DC2 to another location. In addition, there is insufficient time to relocate all systems to other data centers or cloud alternatives before the end of the current contract expiration. The number of systems housed in DC2 are declining as they are transitioned out of the facility. The remaining systems require maintenance and support while they transition out, so using current staff and equipment is the lowest cost and risk option to attain the requisite level of support. Therefore, only the incumbent DC2 supplier is capable of providing these services for systems that continue to operate in DC2 without introducing additional performance and scheduling risks and duplicated costs.

A primary alternative is to move systems out of DC2 and into DC1. However, for many systems, DC1 and DC2 operate as disaster recovery or backup sites. If a disaster recovery site is already in DC1, then both the primary and the backup site operating in the same location, which is not a viable solution. Another alternative would be to move the systems in DC2 to a leased colocation facility. This would create a duplicate expense as described above. In addition, there would be both performance and schedule risk as it would involve an acquisition, an engineering project, and another security assessment and authorization. Finally, an alternative would be to migrate the systems to cloud service providers. However, in many cases, the work needed to ready the application for cloud migration would not be done by June 2020. These plans are already in process but will not be completed by the current contract expiration. Therefore, the three alternatives considered add risk to continued operations and add expense for duplication of services.

The systems that are expected to remain in DC2 are essential to DHS operating and performing its mission to protect the Homeland. In many cases, these systems are the disaster recovery site for DC1. These systems include systems to manage identity, Justification and Approval for Other Than Full and Open Competition run DHS financial operations and maintain secure devices and systems within DHS.

If the systems operating in DC2 are not operated and maintained without interruption, the DHS and Component missions will be adversely impacted given the need and reliance upon real time computing capabilities. The mission risks of such interruptions are too high and untenable for the Department and its Components.

Other suppliers can offer the services to those being currently provided in DC2.

However, the time to move equipment and applications, test the equipment and applications, and transition operations to another supplier cannot be done prior to the expiration of this contract in June 2020 and without some duplication in costs to the Government. The duplication in cost estimated at would exceed the savings achieved through any competition. Rebuilding infrastructure in another data center would mean duplicate equipment and labor costs. The current DC2 contractor has experience with the ongoing exodus effort and the related migrations that are underway.

Indeed, the planning and execution of the DC2 Exodus has occurred for more than 2 years. In many cases, this cost duplication would delay eventual migration to the cloud or system retirement.

Although 27% of the migrations have already been completed, migrations are technically and logistically complicated and time consuming. Frequently, in addition to the planning and technical development efforts, most will involve multiple acquisitions. For example, during the migration of the DHS enterprise network out of DC2, the project involved the following: six months of planning and redesign; 5 months of acquisition processing; and eventually another 18 months to implement the design, test the design, and obtain security compliance approvals. The enterprise network project took 29 months in total to implement the successful migration. Many of the remaining systems in DC2 have similar complexity as the enterprise network project.

DHS has made progress on the DC2 Exodus. As previously mentioned, the remaining 153 systems in DC2 will all be decommissioned by 2021. The proposed sole source DC2 IDIQ contract will provide the necessary time to effectively complete the exit of all systems from the facility.

DHS is conducting a competitive Data Center and Cloud Optimization (DCCO) procurement designed to provide data centers services, like those offered in DC2, cloud services, and colocation services. The draft DCCO solicitation is targeted for release in May 2020. Continued services provided through the proposed DC2 IDIQ contract will ensure proper migration of mission critical efforts to DC1 as appropriate, and to the represented DCCO procurement underway.

6. Description of Efforts Made to Ensure that Offers are Solicited from as Many Potential Sources as is Practicable.

The marketplace for service providers that appear to meet the DC2 requirement is characterized by large IT services and management companies with data center operations experience. The

Justification and Approval for Other Than Full and Open Competition availability of those service providers who are not the DC2 incumbent contractor vendors to provide services is not practical in a COCO facility as the vendor who owns the facility is, by definition, the only one who can provide the support at the subject facility. DHS made the decision to exit DC2 and consolidate some of those services into DC1, which is being competitively solicited under the DCCO requirement.

That same marketplace will have an opportunity to provide services under the DCCO competitive acquisition; however, for DC2 since the data center support and services are COCO, the most feasible approach is to continue support through the DC2 vendor on a new contract to cover the necessary time to migrate the remaining DHS customers out of the COCO DC2 housed facility.

DHS will post this Justification and Approval Document to beta.SAM.gov in accordance with

FAR 6.302-1.

7. Determination by the Contracting Officer that the Anticipated Cost to the Government will be Fair and Reasonable.

The contracting officer has determined that the anticipated prices will be fair and reasonable. Due to the commercial nature of the services to be acquired, FAR 15.403- 1(b)(3) prohibits the Contracting Officer from requiring certified cost and pricing data.

In the absence of certified cost and pricing data or adequate price competition, the price reasonableness determination by the contracting officer will be based on historical knowledge of prices paid, and comparison with competitive published price lists.

Specifically, the price of the proposed DC2 IDIQ contract will be negotiated based on several years' worth of historical prices paid and enterprise contract usage data collected and documented.

8. Description of Market Research.

DHS conducted market research regarding data centers and cloud services throughout the past year. In February 2019, DHS released a Request for Information (RFI) entitled, “Request for Information for Information Technology Compute and Storage Modernization, Cloud Migration and Data Center Optimization Initiative,” on the Federal Business Opportunities (FBO) website, which asked for industry feedback on Data Center Optimization and Cloud Migration Services. DHS received over 100 responses from industry under the RFI. The RFI was in support of current DC2 migration efforts as well as ongoing DCCO exploration.

The market research clearly indicated that closing a DHS data center, like DC2, is an optimal solution as alternatives to providing services in DC2 are available through other DHS data centers, like DC1, leased colocation sites, and cloud service providers.

The Government performed internal market research in preparation for the DC2 Exodus by reviewing the process to migrate systems from DC2 to leased, collocated data centers. This includes an enterprise network relocation project from DC2 to another colocation facility

Justification and Approval for Other Than Full and Open Competition that began in 2019. Finally, an ongoing collaboration effort with Components on their migration out of DC2 shows migrations plans that consider cloud and colocation alternatives contributed to the subject approach.

9. Any Other Facts Supporting the Use of Other Than Full and Open Competition.

Any service disruptions within DC2 would be untenable for DHS and its ability to perform its mission of protecting the Homeland. Service continuity within DC2 is paramount and avoids a situation where DHS components create additional data center contracts/awards, potentially resulting in, for example, increased cost and enterprise risk. If disjointed it could also negatively impact interconnectivity and put DHS at great risk of data loss. A deliberate and careful transition will minimize or mitigate these risks.

In accordance with the National Institute of Standards and Technology (NIST) Special Publication 800-34, Contingency Planning Guide for Federal Information Systems, all moderate- or high-impact systems should include a strategy to recover and perform system operations at an alternate facility for an extended period. NIST 800-34 also recommends that contingency planning controls for systems with a moderate security categorization should include the identification of an alternate processing site, and that organizations should identify an alternate processing site that is separated from the primary processing site to reduce susceptibility to the same threats. Many of the remaining applications/systems in DC2 are categorized as moderate- or high- impact.

The DHS enterprise computing framework and requirements have changed significantly since the market research effort began in 2019. This includes a strategic objective to end collocating systems and purchasing services from DC2, in order to consolidate data centers as required by OMB. The DCCO contract will involve the purchase of services in DC1, colocation services, and cloud service providers. The anticipated competitively awarded DCCO contract is expected to provide the migration path for the systems that remain in DC2. Since services provided in DC2 are mission essential, the Government requires uninterrupted support until the planned system migrations can be completed.

(a) The systems operated from DC2 are essential to the mission of DHS and require 24x7 support and cannot experience a lapse in service. The OCIO team is working with the Component system owners to minimize the time and risk associated with transition and disposition.

(b) The cost to the Government for the duplication of services is:

This estimate is based on three components of cost – colocation space, equipment, and labor. To create a system in a replicated DC2 environment, this would involve the purchase of leased data center space, replication of the equipment in DC2, and the labor and professional services to design, test, and implement the migration from DC2 to the new location. This value was derived based on the amount of colocation, equipment, and labor required to provide technical support for upgrading the remaining 26 systems in preparation for transition and performing systems and security testing to operate in a new environment within a DHS data center or provided via commercial cloud services.

Justification and Approval for Other Than Full and Open Competition

10. A Listing of the Sources, if Any That Expressed, in Writing, an Interest in the Acquisition.

In February 2019, DHS issued an RFI, and as previously mentioned received over 100 responses.

The information gleaned from this RFI was used in better assessing immediate DC2 migration efforts. An Intent to Sole Source notification was posted on February 12, 2020 to beta.SAM.gov.

DHS did not receive any clear and convincing evidence that a competition would be advantageous to the Government in response to the posting.

11. A Statement of the Actions, if Any, the Agency May Take to Remove or Overcome Any Barriers to Competition Before Any Subsequent Acquisition for Supplies or Services Required.

The proposed two-year base ordering period of the sole source DC2 IDIQ contract supports continued efforts in effectively vacating the DC2 facility by the provided deadline of December 18, 2021. Therefore, the subject contract will allow for the system owners to complete their DC2 Exodus Plans and allow time for the final removal of the DHS infrastructure from DC2. Many systems and applications exiting DC2 will migrate into DC1. The competitive DCCO acquisition has a target draft solicitation release date of May 2020, followed by a target award in October 2020. The new DC2 contract will allow for a transition phase for the competitive DCCO award. Based on ongoing market research and a wealth of RFI responses received from industry, DHS fully anticipates adequate competition being recognized in response to the referenced DCCO requirements.

(a) There is no expectation that technical specifications will be revised in support of the proposed DC2 IDIQ contract. DHS/OCIO is exploring potential changes in requirements and scope to focus future work on the exodus of DC2.

(b) While the primary purpose of using a sole source procurement to provide DC2 services is to avoid interruption of mission critical services, the potential three-year performance period for the contract also enables DHS components to have a successful migration out of DC2 and allows the DHS OCIO to conduct a competitive procurement through DCCO for future data center services.

Justification and Approval for Other Than Full and Open Competition

I

12. Contracting Officer's Certification. I certify that the data supporting the recommended use of other than full and open competition is accurate and complete to the best of my knowledge and belief.

Contracting Officer Date

13. Technical/Requirements Personnel Certification. I certify this requirement meets the Government's minimum need and that the supporting data, which forms a basis for this justification, is complete and accurate.

Date

14. Legal Counsel Review. I reviewed this Justification and Approval for Other Than Full and Open Competition in accordance with HSAM 3006.304-70 and find it legally sufficient.

APPROVAL:

I recommend approval of this justification.

Procuring Activity Advocate for Competition Date

Justification and Approval for Other Than Full and Open Competition

I recommend approval of this justification.

Head of Contracting Activity Date

I approve this justification.

Chief Procurement Officer Date