EJBCA justification.pdf

U.S. DEPARTMENT OF JUSTICE

UNICOR, Federal Prison Industries, Inc.

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION:

Authority Cited- Sole Source-FAR 6. 3 02-1 41 USC-253 (c) (1 )/1 0 USC-2304 (c) (1 )

1: Identification of the agency and the contracting agency.

Federal Prison Industries (FPI) must maintain the operation and maintenance of its newly implemented Public Key Infrastructure (PKI) which was upgraded from late 2024 through early 2025. This enterprise-level core service includes vendor-specific hardware (e.g., EJBCA/Hardware Secure Modules) and software that provide cryptography, certificate authority, endpoint certificate, and digital security across the entire FPI computing environment. It is through annual subscription-based licenses that keep the hardware and software operational. Additionally, maintenance, troubleshooting, hardware replacement, and software upgrades are provided through annual Premium Support. The proposed contracting agency is KeyFactor, which specializes in encryption and PKI. They are the manufacturers and developers of the appliances and software.

2: Nature and/or description of the action being approved.

FPI is needing to maintain the certificate authority that provides cryptography and security across the FPI environment. The certificate authority is a highly complex area of IT that is a unique skillset. Acquiring a consultant with the knowledge and ability to upgrade the certificate authority in a government environment and ensure that it does not negatively impact the many applications and processes that rely on a functioning certificate authority is a critical need.

1. 3: A description of the supplies or services required that meet the agency' s needs (including the estimated dollar amount).

Vendor will provide hardware, including a Hardware Secure Module (HSM), relevant software, and services, to include training on how to utilize the new environment. The anticipated cost is approximately $ 134,306.53.

4: A demonstration that the proposed contractor' s unique qualifications or the nature of the acquisition requires the use of the authority cited.

The proposed contractor is the incumbent that implemented the current certificate authority (the previous company, CSS Security, was acquired and incorporated into the current vendor) and already has demonstrated experience in implementing a certificate authority into the FPI environment. The vendor also has experience in other government agencies. The certificate authority is a central portion of the FPI IT architecture and having a vendor with familiarity with our current certificate authority is a significant differentiation of the current vendor.

5: A description of effects made to ensure that offers are solicited from as many potential sources as is practical including whether a CBD notice was, or will be, publicized as re quired by Subpart 5.2 and, if not, which exception under

5. 202 applies.

A sole source acquisition is being requested due to the unique nature of the certificate authority and the experience of the vendor in working with the unique nature of the certificate authority. As per FAR 6. .3 05 " this sole source award will be made publicly available within 1 4 days after contract award

6: A determination by the Contracting Officer that the anticipated cost to the Government will be fair and reasonable.

The quote for the project was obtained from the incumbent. Price is determined to be fair and reasonable based on

7: A description of the market survey conducted and the results or a statement of the reasons a market survey was not conducted.

The request is for the services to be acquired is to use an already existing contract through SEWP from a vendor that meets the detailed and highly technical needs of FPI. Due to the detailed and highly technical nature of the project and the qualifications of the vendor" a sole source acquisition is justified.

8: Any other facts supporting the use of other than full and open competition.

The nature of the project is highly technical and a highly qualified vendor is needed with previous government experience.

9: A listing of sources, if any, that expressed in writing, an interest in the acquisition

N/A

1 0. A statement of the actions, if any, the agency may take to remove or overcome any barriers to competition before any subsequent acquisitions for the supplies or services are required.

The award notice will be posted publicly. If any other vendors reply" contracting will document the response in the file to ensure that any future actions take information received into account.

11. Contracting Officer certification that the identification is accurate and complete to the best of the Contracting Officer's knowledge and belief.

Supervisory IT Specialist Approve/Disapprove & Date

Supervisory Contracting Officer Approve/Disapprove & Date amitchell Highlight jhunt Highlight