EFO for FedMall Additional Hosting Requirements Follow-On_REDACTED.pdf

Source Selection Information See FAR 2.102 and 3.104 contains one (1) four-month base period, two (2) one-year option periods and one (1) six-month option period. The contract will expire on May 2, 2022 if all options are exercised.

3. A DESCRIPTION OF THE SUPPLIES OR SERVICES REQUIRED

TO MEET THE AGENCY’S NEEDS/ESTIMATED DOLLAR

AMOUNT:

FedMall requires additional infrastructure for the existing hosting services provided by Credence Management Solutions. The current requirement follows SP4709-20-F- 0043 and requires Credence to provide the infrastructure necessary for FedMall to maintain upgraded software to comply with Risk Management Framework (RMF) requirements and host the code scanning application Fortify to comply with RMF requirements. The infrastructure will provide FedMall with the additional hosting resources required to:

Maintain upgraded software to comply with Risk Management Framework (RMF) requirements Host the code scanning application Fortify to comply with RMF requirements

Both tasks are necessary to maintain the cybersecurity posture required by DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT).

FedMall competitively awarded a new hosting services contract to Credence in July 2019 under SP4709-19-F-0044. The hosting services required were based on the current architecture of FedMall at the time. This included provisioning for the versions of software FedMall uses to provide customers the ability to order NSN and commercial items online. To comply with RMF requirements, all systems are required to run supported versions of software. To meet this requirement FedMall upgraded its software versions to maintain its compliance posture in accordance with RMF. The upgrade required the hosting contractor, Credence, to provide parallel instances for FedMall’s development, test and production environments to allow the FedMall Sustainment contractor (USIT) to install and configure more recent supported versions of the software. RMF also requires continuous monitoring and code scans. J61 previously provided Fortify code scans as part of their enterprise support. This was discontinued in 2019 and was a finding on subsequent FedMall RMF assessments identified for remediation. FedMall’s Internet System Security Manager (ISSM) required an action plan to resolve the issue, driving the need to add an additional instance to host the Fortify software to resume source code scans and close the finding. This was accomplished under sole-source requirement SP4709-20-F-0043, which was awarded on May 1, 2020 with a period of performance of May 3, 2020 through November 2, 2020. Once the upgraded environments were fully configured and operational, the hosting contractor, Credence, removed the older environments configured with unsupported software. The end state is FedMall development, test and production environments with fully supported software in compliance with RMF requirements.

The Task Order Period of Performance is expected to begin on February 3, 2021 and continue through November 2, 2021 (nine months). No option periods are included. The estimated dollar value for this requirement is

4. IDENTIFICATION OF THE EXCEPTION TO FAIR OPPORTUNITY (SEE FAR

16.505(b)(2)) AND THE SUPPORTING RATIONALE, INCLUDING A

DEMONSTRATION THAT THE PROPOSED CONTRACTOR’S UNIQUE

QUALIFICATIONS OR THE NATURE OF THE ACQUISITION REQUIRES

USE OF THE EXCEPTION CITED:

Per FAR 16.505(b)(2)(i)(B), an exception to the fair opportunity process is justified because only Credence is capable of providing the services required at the level of quality required because the services ordered are unique or highly specialized.

PIEE is an efficient, effective common hosting environment for functional procurement capabilities managed by the DLA J6 Strategic Capabilities and Processes Office (SC&P).

FedMall is one of these functional procurement capabilities. One of the SC&P missions is to provide an enterprise cloud hosting environment for PIEE systems.

The PIEE is the primary enterprise procure-to-pay (P2P) application for the Department of Defense and its supporting agencies. PIEE delivers access to a number of independently managed business applications and capabilities. The PIEE Common Operating Environment (COE) represents a new Department of Defense (DoD) acquisition strategy of providing procurement business and financial services capability to procurement professionals in support of the Warfighter. The PIEE is not an individual Information Technology (IT) application or system. Rather, it is a collaborative COE based on core components designed to present a virtual procurement work space for professional procurement individuals.

PIEE leverages cloud computing and virtual servers to gain efficiency and standardize the software and hardware footprint, reduce system interfaces, and reduce architecture complexity. PIEE consolidates the common capabilities, leveraging data across application and reducing system interfaces. Consolidation of procurement capabilities, such as FedMall (a government electronic mall), under the PIEE infrastructure will help achieve savings in acquisition, sustainment, and manpower resources, and will improve DoD’s ability to execute its missions while defending its networks against growing cyber threats. PIEE enables enterprise role-based access to its environment for functional procurement capabilities, such as FedMall, to adopt Single-Sign-On capability.

An Integrated approach of PIEE capabilities will enhance business agility and allow effective management of common data and infrastructure. PIEE capabilities currently support over 450,000 users and the processing of in excess of $4.6 billion dollars of transactions in DoD annually.

The PIEE Hosting environments are grouped for procurement systems, support far-reaching interfaces and provide integrated procurement capabilities across all government agencies. Many DoD and Government agencies use the PIEE Systems to fulfill their e-business procurement requirements. The hosting infrastructure is one stop for procurement capabilities for the integration efforts under the PIEE infrastructure. The tightly coupled design of the infrastructure and procurement capabilities allows PIEE to process extremely high data volumes in a very efficient manner. This requires the PIEE

Cloud Service Provider (CSP), Credence Management Solutions, to support and maintain scalable infrastructure. Due to the homogenous nature of the PIEE environment, the data, functional processes and capabilities can overlap within procurement core capabilities resulting in leveraging common capabilities within the PIEE environment. To fulfill a customer requirement, there often has to be both a data translation map developed and a PIEE core capability update needed to take place, which includes items like customized data reporting, data translation and validation routines that utilize the PIEE core capabilities functionality. Both actions must be worked within a single hosting environment to ensure that the solution is efficiently leveraging the common procurement capabilities without duplicating the data. If a single hosting provider is not used, then difficulties can be anticipated with capability integration due to duplication of hosting environment, interfaces and subsequent architectural complexities, likely resulting in a complex or unusable environment. These difficulties create the potential of mission failure created by data delays, as well as impacts to management of contracts, orders, invoicing and payment.

The requirement under SP4709-20-F-0043 to add capacity for the system upgrade and Fortify scanning implementation effected the architecture of FedMall hosted in the PIEE infrastructure. Both the OS Upgrade and the Fortify source code scanning solution required additional infrastructure over that required for FedMall maintenance and sustainment. The Fortify source code scanning solution and the upgrade of the COTS (commercial off the shelf) software packages that comprise the FedMall systems were required for FedMall to remain STIG compliant. This was due to the end-of-support, and end-of-life deadlines of the software versions deployed on 4/30/2020. Due to the requirements of the COTS, the process could not be performed as an in-place upgrade on the existing hosting/server systems. It required new server/VM's configured and fresh, out-of-box (OOB) installations of the new COTS software versions, followed by migration of existing configurations and tools, and migration/transformation of the database systems. Parallel environments to support incremental installation and testing were required to prevent system downtime, which impacts FedMall customers’ ability to order NSN and commercial items. Integration with other components of the existing FedMall architecture was also necessary to successfully upgrade and meet compliance requirements. A sole source task order with the existing hosting contractor was the only way to effectively complete the requirement.

The upgrade was completed successfully and the older environments were taken down.

Hosting infrastructure is required to support the upgraded operating system and Fortify code scanning application. This task order will be for the infrastructure requirement in excess of that provided by PIEE hosting task order SP4709-19-F-0044.

It is extremely vital that hosting be maintained by the same vendor (Credence) that was awarded PIEE Hosting support task order SP4709-19-F-0044 in order to maintain the integrity of the FedMall system. Only Credence is capable of providing the services required at the level of quality required in the required timeframe. The update requires an interdependency between the current infrastructure and the additional infrastructure which is most efficiently managed by having one contractor responsible for both aspects.

Introducing another contractor would present schedule and performance risks.

The current task order with Credence (SP4709-19-F-0044) supports the same type of services that are required under this acquisition, and the affected applications are interdependent. It is important that the task orders are managed by a single contractor responsible for all services so that consistency in configuration management will be achieved. Introducing another vendor would require additional efforts related to hosting environments, integrations, interfaces and testing.

The prominent role FedMall is playing in providing essential supplies during the current COVID-19 pandemic highlights how essential FedMall is to the welfare of the warfighter and the nation. FedMall cannot be down for maintenance for extended periods. The introduction of another contractor would present unacceptable schedule and performance risks, which would jeopardize the Government’s ability to deliver essential goods and services to the warfighter or address the COVID-19 pandemic. Another contractor would require 1-3 months to on-board their staff and require significant ramp-up time to familiarize their developers with the current architecture and to provision the required infrastructure, significantly impacting the performance and viability of FedMall.

5. A DETERMINATION BY THE CONTRACTING OFFICER THAT

THE ANTICIPATED COST TO THE GOVERNMENT WILL BE

FAIR AND REASONABLE:

As the Contracting Officer, I hereby determine that the anticipated cost to the Government will be fair and reasonable. It is anticipated that the Government will use various price analysis techniques including, but not limited to: (1) Comparison of proposed prices to historical prices paid; (2) Comparison of proposed prices with Independent Government cost estimates; and/or (3) Comparison of proposed prices obtained through market research for the same or similar services.

6. ANY OTHER FACTS SUPPORTING THE JUSTIFICATION:

None.

7. A STATEMENT OF THE ACTIONS, IF ANY, THE AGENCY MAY TAKE

TO REMOVE OR OVERCOME ANY BARRIERS THAT LED TO THE

EXCEPTION TO FAIR OPPORUNITY BEFORE ANY SUBSEQUENT

ACQUISITION FOR THE SUPPLIES OR SERVICES IS MADE:

The PIEE Hosting Task Order was originally competed under JETS, and DLA plans to compete the next task order to the maximum extent possible under JETS when the original expires in May 2022. DLA has and continues to exercise competition as often as possible and is required to conduct ongoing reviews to keep abreast of new technology, both in industry and in the Government. As a continuing effort, DLA uses a variety of vendors, manufacturers and contracts to fulfill its requirements and will continue its practice of surveying the market to ensure full and open competition.