DEFEND Bridge Exception to Fair Opportunity Justification Redacted.pdf

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

AUTHORITY: FAR 16.505(b)(2)(i)(B)

Dynamic and Evolving Federal Enterprise Network Defense (DEFEND) Portfolio Class Justification

1. Identification of the agency and the contracting activity, and specific identification of the document as a “Justification for an Exception to Fair Opportunity.”

This document is a class justification for an Exception to Fair Opportunity that is being conducted by the General Services Administration (GSA), Federal Acquisition Service (FAS), Region 8, Acquisition Operations Division (AOD), on behalf of the Department of Homeland Security (DHS); Cybersecurity and Infrastructure Security Agency (CISA).

2. Nature and/or Description of the Action being Approved.

This class justification is for the noncompetitive award of five bridge Task Orders (TOs) under the Alliant 2 Government-Wide Acquisition Contract (GWAC) to maintain critical cybersecurity postures and Continuous Diagnostics and Mitigation (CDM) functionality across the Federal Civilian Executive Branch (FCEB). CISA requires the continuation of services for the DEFEND requirements via five sole source actions to ensure there’s no lapse in support, including operation and maintenance for legacy critical systems. The time provided by the bridge TOs will allow for the implementation of the new functional approach (described in detail in Section 4) procurement strategy, and for necessary systems to become operational to support CDM requirements. The new functional approach will replace the current DEFEND portfolio structure. The current DEFEND portfolio of cybersecurity orders is made up of six TOs-- DEFEND A, DEFEND B, DEFEND C, DEFEND D, DEFEND E and DEFEND F. Each DEFEND TO provides services with the same technical scope to a different group of federal agencies, referred to in this document as the portfolio approach.

However, the requirements for DEFEND F are not included in this class justification because it has sufficient period of performance (PoP) remaining to transition to the completion of the new competitive awards. The requirements included in this class justification are as follows:

The current DEFEND A through E TOs will execute their respective last Option Periods (i.e., Option Period 5) through April 2024. After the conclusion of the current orders, it is necessary to utilize bridge orders to enable continuation of services under the DEFEND portfolio. This will include a continuation of much of the same structure of the current orders which are Cost Plus Award Fee (CPAF) and Cost Reimbursement (CR). Due to the expiration of the Alliant GWAC ordering period, the bridge TOs will be placed under the Alliant 2 GWAC. These bridge TOs will be awarded as sole source TOs placed with the current contractors who are all contractors on the Alliant 2 GWAC.

Noncompetitive award of the bridge orders is necessary because the current DEFEND contract holders are the only awardees capable of providing the services required. There would be unacceptable delays, inefficiencies and reprocurement costs that would not be recovered through competition. To pursue competition for the current DEFEND structure due to the complexity and magnitude of the requirements could take over a year to properly plan, solicit and award for a typical lead time without accounting for potential schedule risks that are inherent to the process. In addition to the procurement lead time, transition would have to be accounted for as well which is discussed in more detail below in Section 4 describing why a successor contractor could not start performance on day one after award.

Due to these factors, there is a high risk that there would be unacceptable delays and almost certainly a lapse in critical services. With the functional approach being pursued over the next couple of years with award and transition anticipated to be complete by 2027 it would be inefficient to pursue competition on the current structure when an improved structure for cybersecurity is so close to being realized. Pursuing competition for both the current structure for short run TOs while pursuing the functional approach at the same time would strain Government resources and would have cost and schedule impact that would not be recovered through competition.

All additional support required is within the technical scope of the current DEFEND TOs and within the scope of both the Alliant and Alliant 2 GWACs. A scope review was completed July 25, 2023, to confirm the scope falls under the Alliant 2 GWAC and that there is sufficient ceiling to cover the requirements. Due to the timeframes needed to award the new functional approach portfolio awards, an approval for a class justification of Exception to Fair Opportunity is needed to continue the necessary level of service under the overall DEFEND portfolio while the functional approach portfolio is actualized. The bridge orders will allow for sufficient time for acquisition planning and industry engagement to provide for competition under the new functional approach awards.

3. A description of the supplies or services required to meet the agency’s needs (including the estimated value).

The CDM Program, established in 2012, provides a dynamic approach to fortifying the cybersecurity of government networks and systems. The CDM Program provides cybersecurity tools, integration services, and dashboards to participating agencies (Chief Financial Officers [CFO] Act agencies and non-CFO Act agencies). The CDM Program supports these CFO and non-CFO Act agencies by improving their respective security postures, delivering better visibility and awareness of their networks, and defending against cyber adversaries. In supporting CISA’s mission, CDM works closely with agencies to deploy capabilities that help agencies protect their hardware and software assets, networks, and the data they contain. Currently, the government maintains dozens of separate, tailored CDM solutions across the FCEB agencies via the DEFEND TOs under the Alliant and Alliant 2 GWACs.

The services and tools necessary via the continuation of the DEFEND requirements resolve CDM capability gaps, enhance existing CDM capabilities, and provide support to the CDM Dashboard Solution of participating Agencies, strengthening of FCEB overall cybersecurity posture. The CDM Solution includes CDM approved products, configured to reflect the CDM Program priorities and Agency policies, that implement a common set of capabilities and enable increased risk-reduction and alignment with Agency risk tolerance. Exact services provided include:

1. Provisioning Agencies with CDM approved products, supporting ancillary products, and providing the associated services to the participating Agencies.

2. Filling gaps in the existing Agency CDM Solutions to achieve a common set of capabilities.

3. Operating and maintaining (O&M) the legacy CDM Solution, while continuing to enhance and refresh CDM approved products, as appropriate.

4. Planning for Agency support of provisioning, configuring, operating, testing, and managing CDM tools, sensors, legacy Agency-level dashboards, and data feeds as well as support for the CDM Solution’s governance.

5. Developing, integrating, operating, and maintaining the capability for CDM-approved products to report information to the CDM Agency Dashboard and feed accurate information to the CDM Federal Dashboard.

6. Designing, building, deploying, and operating the CDM Capabilities for component offices of the participating agencies that opt-in to the CDM Program.

7. Providing Agency-specific training for the CDM Solution and the Agency CDM Dashboard and providing CDM governance support.

The CDM Program helps to protect against cybersecurity incidents such as the Solar Winds cybersecurity attack of 2020. The incident resulted in hackers breaking into SolarWinds systems and adding malicious code to the company's software systems. This also resulted in SolarWinds unknowingly pushing software updates, which included the malicious code, to their clients, just as they would normally do. This ended up exposing sensitive information and data belonging to several government agencies and large private companies.

The Colonial Pipeline is another example of a recent cybersecurity attack. In 2021, Colonial Pipeline suffered a ransomware cyberattack that impacted computerized equipment managing the pipeline. The shutdown affected consumers and airlines along the East Coast. The hack was deemed a national security threat, as the pipeline moves oil from refineries to industry markets and caused the President of the United States to declare a state of emergency. The Colonial Pipeline hack is the largest publicly disclosed cyber-attack against critical infrastructure in the U.S.

The cybersecurity related incidents described above reinforce the high level need to provide cybersecurity products to our nation's government. These growing cybersecurity needs emphasize the importance of, and continued need for, the services and tools provided under the DEFEND portfolio.

tools through Agency Dashboard stack, as well as maintaining data quality and consistency.

o Cybersecurity tool renewal support – this includes development of bill of materials, delivery, and total cost of CDM cyber products.

o Asset Management Gap Fill for DHS HQ and CISA – this includes deployment, implementation and test of Hardware Asset Management, Software Asset Management, Configuration Settings, and Vulnerability Management cyber tools across the DHS enterprise.

o Identify and Access Management Gap Fill for DHS HQ, CISA and FEMA – this includes deployment, configuration and testing of Privilege Access Management (PAM), Identity Lifecycle Management (ILM) capabilities across the DHS enterprise.

o Endpoint Detection and Response (EDR) deployment and implementation – This extends existing Agency and Component EDR coverage to all in-scope endpoints and integrates it with the DHS and Component enterprise Security Information and Event Management (SIEM) capability using commercial-off-the-shelf (COTS) connectors.

o Enterprise Mobile Management (EMM) and Mobile Threat Defense (MTD) deployment and Integration – for EMM this includes discovery of existing mobile technologies, architecture development, full integration, and establishment of asset management-like capabilities for mobile devices. For MTD this includes deployment and implementation of tools, integration of MTD data with EMM solutions and overall integration into the CDM dashboard.

o United States Coast Guard Cloud security support – This includes technical planning and reference architecture development support to build out, implement and maintain Secure Cloud Computing Architecture for a critical Command and control division of USCG.

o Shared Cybersecurity Threat Intelligence Services – procure and configure Cyber Threat Intelligence commercial data feeds to provide critical data to

FCEB.

DEFEND B: Sole Source for a 12-month Base Period plus two 12-month Option Periods and the 6-month option to extend service.

• Supported Agencies: Department of Energy, Department of the Interior, Department of Transportation, US Department of Agriculture, Veterans Affairs, and the Office of Personnel Management.

4. Identification of the exception to fair opportunity (see 16.505(b)(2)) and the supporting rationale, including a demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the exception cited. If the contracting officer uses the logical follow-on exception, the rationale shall describe why the relationship between the initial order and the follow-on is logical (e.g., in terms of scope, period of performance, or value).

This exception to fair opportunity will use FAR 16.505(b)(2)(i)(B) – Only one awardee is capable of providing the supplies and services required at the level of quality required because the supplies and services ordered are unique or highly specialized.

The existing CDM DEFEND TOs core objective is to implement, expand, and maintain CDM Solutions at supported agencies. The figure below depicts the logical architecture of a CDM Solution in place at a DEFEND supported agency.

The operational CDM Solutions, via CDM DEFEND TOs ensure agencies can mitigate cybersecurity risk. Each CDM Solution consists of multiple layers, including:

• Layer A is composed of tools and sensors that, together, provide the coverage of the CDM capabilities.

• Layer B is the integration layer, which aggregates data from agency Layer A tools, performs data normalization, and then transforms and conforms records. Layer B is often tailored to individual agency environments.

• Layer C is the Agency Dashboard, which ingests data from Layer B and presents it to agency users in operationally relevant ways to promote the reduction of cybersecurity risk. The Agency Dashboard is standardized for participating agencies.

• Layer D, also known as the Federal Dashboard, presents a unified view of the cybersecurity posture of the entire FCEB enterprise. The Federal Dashboard is standardized for use by CISA analysts. The Federal Dashboard is a CDM responsibility and operated inside a DHS environment. The DEFEND orders responsibility is to ensure data is available for ingestion into the Federal Dashboard.

Cybersecurity is of such importance that it cannot be allowed to lapse while the new functional approach awards are put into place. The new functional approach represents a shift in the structure of the DEFEND requirements. The current CDM DEFEND requirements aligned agencies into logical groups for each distinct DEFEND orders. The new strategy will functionally align awards that provide cybersecurity support to all agencies. This is explained further in Section 6.

The sole-source awards of the bridge orders for the CDM DEFEND requirements represent a continuation of the current DEFEND TOs (A-E) requirements. The technical requirements for the DEFEND orders have not changed, with no changes to the PWS, the functions or terms of the order because of the circumstances leading up to this Justification. The original requirements remain unchanged for cybersecurity support for both CISA support and other DHS component agencies. These bridge TOs allow for existing CDM Solutions to remain operational and in place, fill gaps in CDM capability deployments, and thereby reduce risks to cybersecurity posture at agencies, while the Government implements a new acquisition strategy for the CDM program (see Section 6. Any other Supporting Facts). The government considers these sole-source awards necessary to continue vital services with the current contractors being the only capable sources of providing the level and quality of services in the time needed to fulfill the requirements.

Operational Support for the Existing Integration Layers

Each CDM DEFEND TO implements a tailored integration layer to meet the requirement of Layer B as part of the CDM Solution. The integration solutions aggregate data from agency tools (Layer A), perform data normalization, and then transform and conform records to ensure proper ingestion to the Agency Dashboard (Layer C). These customized integration layer solutions are individually tailored to agency environments and represent a significant level of effort to support effectively. Each solution is integral to ensuring data is represented in the CDM Agency Dashboard and Federal Dashboard, any downtime of the integration solution would result in errors in the reporting available via the Dashboard. Successful operation of each integration layer requires the operation of custom codes and scripts to assist in data integration from layer A to the integration layer.

The complex nature of the customized integration layer solutions operating for each supported agency results in the current contractor being the only reasonable option to continue the necessary support in the short term without unacceptable gaps and/or excessive costs. The Government’s intent is not for these contractors to continue to operate this solution in perpetuity via a sole-source award. The future acquisition approach as described in Section 6, will implement a standardized approach to the data integration (via the Data Services effort), and thus subsume the function of the existing integration layers. The timing of that Data Services effort gives rise to the need to maintain support to the existing integration layers via the CDM DEFEND awardees. The level of effort required to competitively compete Operations and Maintenance (O&M) activities for existing integration efforts would be costly and inefficient and introduce an unacceptable level of risk to FCEB networks.

Deploying Solutions to Fill CDM Capability Gaps

The CDM DEFEND TOs enhance the cybersecurity posture of supported agencies through the configuration and deployment of solutions that meet CDM capability requirements.

Current estimations show that capabilities deployments will not be considered complete for several capability areas across the DEFEND TOs, notably Asset Management, Enterprise Detections and Response, Mobile, and Identify and Access Management. Deployment of these capabilities has made considerable progress under the DEFEND orders, however gaps in complete coverage will remain at the end of each award.

Sole-source award represents the only viable approach to completing the capability deployments. In each instance the current awardee is well positioned to finish the deployment under a sole-source award. Any change in contractor would require time consuming personnel security activities to occur, thereby delaying successful completion of the deployments. In addition, the capabilities targeted for deployment to meet these capabilities have been analyzed, planned, and implemented by the current awardees, which shows a considerable level of knowledge for these specific solutions.

Maintaining the Existing Integration Layer Authority to Operate.

Each integration solution in place for an agency is accredited, having been integrated into an agency's assessment and authorization (A&A) activities. All Federal IT systems are required to obtain a signed authority to operate (ATO) to process government data. An ATO is a formal declaration that authorizes an IT system (inclusive of service or product) to operate for Government IT purposes. Before an ATO is issued, an agency must categorize the system based on its criticality to government operations, determine what security measures must be implemented, and assess the effectiveness of those security measures. Following successful completion of those activities, an ATO is achieved. The ATO signifies approval by a senior level Government official (typically CIO) and indicates the agency has assumed responsibility for the risk of the IT system which allows the system to now operate. The ATO represents a considerable level of effort to support.

The current awardees represent the most effective approach to assisting in the maintaining of system accreditation. Changes in contractor and any resulting turnover could have the unintended impact of the lapsing of a security accreditation. The future acquisition approach to standardize the data integration layer (via the Data Services effort), will cease the CDM assistance with maintaining the current system accreditations. Considering the upcoming technology change to the data services solution, any new effort spent to maintain the accreditation of the current solution, including training, would be considered inefficient.

The bridge TOs for DEFEND A through E would have been contemplated on the Alliant GWAC they were originally awarded under, however, that contract has ended, and the successor contract Alliant 2 is now in place. The Alliant 2 GWAC provides for the same scope as Alliant and has the current DEFEND contractors that will provide for the continuation of DEFEND services until the new competitive functional alignment awards can be put in place. The process of moving from DEFEND to the functional alignment awards has already started with the Data Services requirement (Layer B) which is in the solicitation phase and is expected to have competition. The DEFEND bridge orders will need to provide for sufficient time to perform pre-solicitation efforts such as: market research, acquisition planning and effective competition, as well as time for solicitation, source selection, award, transition and ATO for the new functional alignment awards.

5. A determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

The Contracting Officer will consider historical pricing from the current DEFEND orders, competitive published prices, the IGCE, prices obtained through market research among other proposal analysis techniques to determine fair and reasonable pricing.

Tools and ODCs are included in the support needed. These tools and ODCs are not only reviewed by CISA for pricing but are graded on their continued vigilance on getting the best prices through performance assessment. Additionally, each current DEFEND awardee has an approved purchasing system, which provides a level of confidence in the contractor’s ability to perform the purchasing function for tools and ODCs. The Government will review all estimated costs to ensure they align with current tools and ODCs needs and reasonable estimates to account for potential needs during performance. These are ancillary needs to the overall requirement and should be CR and not fee bearing.

There is also additional labor that is required in support of these requirements. Labor costs are reviewed for each option and invoicing to ensure they are consistent with industry norms, Bureau of Labor Statistics (BLS) data and historical data drawn from Contract Awarded Labor Category (CALC). Labor costs and related indirect costs are reinforced through continuous reviews and audits performed through Defense Contract Management Agency (DCMA) and Defense Contract Audit Agency (DCAA). The Government will analyze the proposal to ensure these costs are properly represented and that the labor quantity and skill mix is consistent with the requirements and that the estimates reflect that.

The contract type for the labor on the orders will be CPAF and this will help to ensure that the contractors are considering cost efficiencies in performance of the requirement for both the labor and the prices that are paid for the tools and ODCs.

The current costs on the orders have been determined fair and reasonable and the continuing support will be within those same standards. Price and cost analysis will be performed for the bridge order proposals to ensure that they are fair and reasonable. The Government will negotiate to ensure that the individual cost elements are consistent with the proposal and that the final negotiated price is fair and reasonable.

6. Any other facts supporting the justification.

The sole source bridge actions will close out services and supplies under the DEFEND efforts.

CISA has been gathering requirements and is implementing a new strategy to support CDM requirements in the future. As stated above, the CDM DEFEND orders aligned agencies into logical groups for each distinct DEFEND orders. The new strategy will functionally align awards that provide cybersecurity support to all agencies. This modular approach effectively aligns activities and expertise into a cost-efficient approach that sharpens the scope of an effort to prioritize performance outcomes. GSA has engaged in regular syncs to discuss acquisition, programmatic and technical aspects for the new strategy to support CDM requirements with

CISA.

The resulting strategy is generally categorized into four functional efforts:

• Data Services – This represents the integration layer work of the DEFEND orders and the CDM Dashboard order (which like DEFEND F has a PoP that is sufficient to get to the new award and transition). The purpose of the effort is to standardize how data from cybersecurity tools and other relevant authoritative sources at Federal Civilian Executive Branch agencies are integrated into the CDM Dashboard. Relevant data sources will include tools and sensors deployed at agencies, as well as other repositories that are not CDM tools but that may need to be integrated into the CDM solution. The overarching scope and objective are to: (1) standardize the data collection, transformation, and integration of data from Layer A tools into CDM Dashboards (i.e., the “data integration function”) and (2) maintain and enhance CDM Dashboard capabilities.

• Deployment Services – The deployment services objective is to implement solutions to CDM capabilities at all CDM-participating agencies (including CFO Act and non- CFO Act agencies). These solutions are typically commercial off the shelf products, so the Deployment Services contractor will plan, procure, deploy, and configure technologies to meet CDM requirements at a receiving agency. These deployments will continue to require a configuration that ensures successful interoperability within the CDM Agency and Federal Dashboards.

• Advanced Engineering – This requirement is directly aligned to advancing CDM capabilities and technologies through incremental assessments of products, technical reference architecture development, broad testing and prototyping and the development and maintenance of the CDM capability catalog. These services are largely aligned to advanced engineering work executed prior to technology implementation and can serve, in some cases, as the input for CDM deployments across the FCEB.

• Cyber IT Operations, Maintenance and Sustainment – IT O&M and Sustainment of Cyber solutions is a critical gap within the FCEB. Over half of the Agencies participating in the CDM program utilize the DEFEND Task Order to acquire support services to operate and maintain implemented cyber capabilities. The DEFEND integrators have capable SMEs and engineers that are uniquely situated to support the variety of FCEB needs and gaps. This support will focus on but not be limited to IT admin, security engineering, incident response, solution maintenance and upkeep as well as a number of sustainment tasks that shall be identified by participating agencies.

7. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made.

The purpose of this Justification for an Exception to Fair Opportunity is to establish sole source awards that are in the best interest of the Government to ensure that critical functionality remains uninterrupted at CDM supported agencies. As outlined above, the Government is revising the structure of the DEFEND requirements resulting in a more effective and efficient functional alignment. To fully realize this approach more time is required to set the foundations of the requirements documents and shape the acquisition strategies to allow for effective competition. The Government is already in various stages of the acquisition process for each one of the functional area requirements.

The first step in overcoming this barrier is to properly develop the requirements documents for the contemplated new functional alignment awards. The development of the requirements documents necessitates a substantial internal effort to ensure that all the mission areas are captured. This effort is followed by industry engagement through request for information (RFI) and potential industry days or due diligence sessions to help further refine the requirements. Engagement through industry days is an opportunity for the Government to express its goals and describe the rationale behind program changes or changes to the structure of the requirements which is the very circumstance of the DEFEND requirements.

It also helps industry to prepare and be aware of upcoming requirements, especially when there are substantive changes in the structuring of those requirements. The feedback and information garnered from these engagements are vital to understanding the landscape of the competition and how best to approach the requirements.

Acquisition strategy will be utilized to analyze the best avenues for competition whether that be full and open competition, full and open competition after exclusion of sources or an existing vehicle. The Government does not anticipate any additional barriers to effective competition than the ones being overcome through the processes described in this section.

Robust market research, engagement with industry to include analysis of small business opportunities with the Small Business Representatives within GSA will be performed to ensure that all information is being considered in the decision-making process.

This process has already started for Data Services (Layer B) and Deployment Services, through RFIs and due diligence sessions for Data Services which, as appropriate, will be utilized for the other functional alignment requirements as well. The Government is removing the barriers to competition with the revised acquisition stated above. Once the functional alignment requirements are fulfilled through competitive acquisitions and fully transitioned, there will no longer be a need for the bridge orders described in this justification.

The bridge orders will be descoped or terminated as necessary as the new competitive functional approach awards are awarded and requirements for full assumption of performance risk is executed.