FBO_Posting_J_&_A_HBSS.pdf

FOR OFFICIAL USE ONLY

Justification and Approval (J&A) for Other Than Full and Open Competition

FOR OFFICIAL USE ONLY 14 Nov 2017 Page 1 of 5

Is this a new or amended J&A Document? New Amended ( Prior to Award Only! )

Funding level for this acquisition: < $700K > $700K and < $13.5M > $13.5M and < $93M > $93M

Contracting Activity: 21CONS/PKC

Purchase Request / Local ID Number: TBD

Program / Project (and PE, if applicable): NORAD & USNORTHCOM (N&NC) J6 Host Based Security System (HBSS)

Program Type (PEO or Other Contracting): Other Contracting

Authority: 6.302-1 – 10 USC 2304(c)(1), Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements

Estimated Contract Cost (including options): $153,328 J&A Type: Class Individual

COORDINATION (AFFARS 5306 . 304 ( a) ) ** The text in the signature blocks below is editable, including the title.

** To remove a row, click the "X" next to the signature block. CAUTION: Once removed, it can only be restored by downloading the BLANK FORM again.

APPROVAL (AFFARS 5306 . 304 ( a) )

NOTE: If a Justification and Approval was approved for the preceding acquisition, a copy of the approved J&A for the predecessor action must be included in the staff package for approval of the instant J&A. This applies to J&A staff packages that are submitted for review and approval at a level above the contracting officer. The predecessor J&A will be used as a reference document by the approving official.

Sign and Save Procedure

FOR OFFICIAL USE ONLY 14 Nov 2017 Page 2 of 5

(See "Specific Guidance for Completing this Template" below.)

I. Contracting Activity.

21 CONS/PKC

135 Dover Street, Bldg. 350

Peterson AFB, CO 80914

II. Nature and/or description of the action being processed.

The Government intends to solicit through other than full and open competition, a firm fixed price contract to S4, Inc for Host Based Security System (HBSS) analysis. S4 is the incumbent small business and this action is for a six (6) month bridge contract along with six (6) one month options. These items are being procured using O&M (3400) funds.

III. Description of supplies/services required to meet agency needs.

The HBSS is the Department of Defense (DOD) commercial-off-the-shelf (COTS) suite of software applications used within the DOD to monitor, detect, and counter attacks and intrusions against the DOD computer networks and systems. The Enterprise-wide Information Assurance and computer Network Defense Solutions Steering Group (ESSG) sponsored the acquisition of the HBSS System for use within the DOD Enterprise Network. HBSS is deployed on both the Non-Classified Internet Protocol Routed Network (NIPRNet) and Secret Internet Protocol Routed Network (SIPRNet) and will be a future requirement for NORAD Enterprise Network (NEN) with priority given to operationalizing the application on the SIPRNet.

The Contractor analyzes the HBSS modules and operationalizes the use within DCO and DODIN execution. Per OPORD 12- 1016, required modules are: Host Intrusion Prevention System (HIPS), Virus Scan Enterprise (VSE), Asset Configuration Control Monitor (ACCM), Device Control Monitor (DCM)/Data Loss Prevention (DLP), and Rogue Sensor Detection (RSD).

The Contractor formulates host-based intrusion detection/prevention signatures (IDS/IPS) based on cyber threat advisories, industry best practices, and known intrusion sets to support Cyber Discovery, Analysis, and Forensic Assessment operations for the CWOC.

The Contractor supports DCO incident triage to include leveraging HBSS related data to assist in determining scope, urgency, and potential impact, lead HBSS event analysis processes and validate unknown behavior with the appropriate functional group through the appropriate tuning tools.

The Contractor collaborates and interacts with the applicable Intelligence organizations to facilitate the sharing of HBSS related artifacts to including analysis reports, and spreadsheets in support of DCO and DODIN execution.

The period of performance is 6 February 2018 through 5 August 2018.

IV. Statutory authority permitting other than full and open competition.

10 U.S.C. 2304(c)(1), as implemented by FAR 6.302-1(a)(2)(iii)(A), services may be deemed to be available only from the original source in the case of follow-on contract for the continued provision of highly specialized service when it is likely that award to any other source would result in substantial duplication of cost to the Government that is not expected to be recovered through competition.

FOR OFFICIAL USE ONLY 14 Nov 2017 Page 3 of 5

V. Demonstration that the contractor's unique qualifications or nature of the acquisition requires the use of the authority cited above (applicability of authority).

N&NC is currently engaged in the competitive acquisition of a five year contract for Cyberspace Operations and Warning Center (CWOC), Host Based Security System (HBSS) Analysis Support and Defensive Cyber Operations (DCO) services. N&NC is utilizing the DoD Information Analysis Centers Program Management Office (DSIAC), Defense Technical Information Center (DTIC), an inter-agency acquisition, to procure the CWOC DCO support services contract.

These services were previously procured by 21CONS. This successor acquisition is encountering unexpected delays that will result in a break in these highly specialized services if an interim contract is not awarded. In order for 21CONS to competitively award a contract for the aforementioned services to prevent a break in service, substantial duplication of cost will occur not expected to be recovered through competition. Competing an additional HBSS requirement would incur non-recoverable costs to recruit, train, and certify another contractor's staff for continued mission support for this short six month performance period. This HBSS requirement is being absorbed into a DTIC task order that combines multiple requirements and is currently estimated to be awarded in Aug 2018. This justification allows for a contract modification that will add a six month period of performance to ensure services until the award and transition period of the DTIC task order is completed. Only the minimum number of months required to transition the work under this task order to the competitive follow-on will be used.

A noncompetitive bridge contract to the incumbent contractor, S4, Inc. allows for streamlined evaluations/ negotiations to complete, utilizing current contract pricing (already determined fair and reasonable) as the basis for negotiation for a short six month contract with six one-month options. Utilizing a competitive contract award approach will require a team of individuals to evaluate, document, an award the contract action, similar to the team that is already working on the competitive acquisition taking place at the DTIC. Applying the limited acquisition resources to evaluating multiple contract vehicles at the same time would duplicate activities being performed for the current follow-on DTIC acquisition already underway, further delaying the DTIC task order award. This would be an inefficient use of the N&NC organization's resources already strained due to other on-going mission requirements. The dedicated efforts of a five person team consisting of 21 CONS and N&NC personnel plus reviewers and clearance officials costs over $50K/month which is duplicated at the DTIC task order award. Furthermore, the estimated costs to transition to a new contractor is $13K which is also a cost duplicated at the DTIC task order award.

Not continuing the existing contract could introduce new contractors without the required knowledge and experience which directly impacts the HBSS. Training new contractors would consume time that could be better utilized in carrying out daily operations

S4, Inc. is currently performing the HBSS contract and will be retained to ensure mission critical delays do not occur while the new contract acquisition can be completed. Currently, S4 Inc. personnel are the only contractors who hold all the required certifications and clearances for immediate/continual performance and prevention of a break-in- service.

They are also intimately familiar with the N&NC Cyberspace mission, and they are fully capable of continuing performance during the delay in award under competitive contractual procedures. S4 Inc. having the certifications and clearances in-place will ensure no break-in-service, no additional startup/administrative burdens/costs associated with demobilizing incumbent contract personnel, closing out badging/credentials of these personnel; then mobilizing a potential new contractor with the required badging/credentialing.

For the reasons described formally, completing an additional competitive acquisition, combined with the costs of transitioning a new contractor to complete a short term contract adds significant duplication of costs that utilizing a short term bridge contract does not.

VI. Description of efforts made to ensure that offers are solicited from as many potential sources as practicable.

Under the subject J&A, N&NC/J6 provided technical documentation for execution of a follow-on competitive contractual action in a timely manner, but interaction with the cognizant contracting officer created an acquisition situation where a bridge contract was required because the follow-on competitive contractual action could not be

FOR OFFICIAL USE ONLY 14 Nov 2017 Page 4 of 5 executed in a timely manner and would create a critical break-in-services to HBSS. Based upon time frames involved and the acquisition situation described in paragraph V, the successor contractual efforts will be a competitive contractual action anticipated for award during the six (6) months of the J&A period, but requires a non-competitive contractual action to the S4 Inc. to ensure no critical break-in-service.

VII. Determination by the Contracting Officer that the anticipated cost to the Government will be fair and reasonable.

The Contracting Officer (CO) anticipates the cost to the Government will be determined fair and reasonable on the basis of price and/or cost analysis and by using cost or pricing data to analyze elements of cost. The proposed labor staffing and technical approach will be evaluated by the Government technical evaluators and the results of the technical evaluation will be used in the development of the Government objective. In addition, assistance can be requested from the Defense Contract Audit Agency (DCAA) and/or Defense Contract Management Agency (DCMA) for the results of recent audits and for any applicable Forward Pricing Rate Recommendations (FPRAs) or Forward Pricing Rate Agreements (FPRAs).

VIII. Description of the market research conducted and the results, or a statement of the reasons market research was not conducted.

For this acquisition, the Government did not conduct market research as this is a bridge for continued support being provided by the incumbent contractor. Pricing research has been conducted by reviewing the historical costs/funding on the current contract.

IX. Any other facts supporting the use of Other Than Full and Open Competition.

As stated in paragraph V above, the proposed 6-month contract bridge would ensure continuation of mission essential services. S4, Inc., the contractor currently performing in the HBSS Analysis to provide expert analysis, written recommendations, and course of action development to assist in the creation and implementation of N&NC/J6's overarching DCO and DODIN Defense in Depth Strategy and Execution under contract FA2517-12-D-9001-0009 MOD 6.

S4 personnel hold required certifications and clearances for performance, is familiar with the complexity of N&NC Cyber Space mission, and is fully capable of performing the proposed contract. Any break in service will result in additional administrative burdens/costs associated with demobilizing incumbent contract personnel, closing out badge/credentials of these personnel; mobilizing a potential new contractor with the required badging/credentialing and the elimination of a proper phase-in/phase-out period to ensure seamless transition. Because of the critical nature of the HBSS and the acquisition situation the HBSS requirement is currently in, a follow-on 6-month contractual action is the only available contractual execution methodology available to ensure there is no break-in-service.

X. List of any sources that expressed, in writing, an interest in the acquisition.

No other sources were requested, the follow on acquisition will be released for competition.

XI. A statement of the actions, if any, the agency may take to remove or overcome any barriers to competition before making subsequent acquisitions for the supplies or services required.

The Government is currently engaged in the acquisition strategy to competitively acquire successor services in a follow-on Base Year, plus four (4) one (1) year option periods through a new contract being executed by the DoD Information Analysis Centers Program Management Office (DSIAC), Defense Technical Information Center (DTIC) as an inter-agency acquisition of HBSS support contract.

The Commander of NORAD and USNORTHCOM, General Lori J. Robinson, USAF, approved this service acquisition

FOR OFFICIAL USE ONLY 14 Nov 2017 Page 5 of 5 greater than $150K but less than $10M, in a signed Requirements Approval Document.

Opportunities for industry to participate competitively in the planned follow-on will occur through a release for proposal to industry with fair opportunity ordering under the DTIC contract vehicle.

This contract bridge is to support the potential gap in services during the follow on acquisition, release for proposal, source selection and transition period.

XII. Certification by the Contracting Officer.

As evidenced by my signature above, I have determined this document to be both accurate and complete to the best of my knowledge and belief.

XIII. Certification by the technical/requirements personnel.

As evidenced by my signature above, I certify that any supporting data contained herein, which is my responsibility, is both accurate and complete.

Remove the Guidance pages below. Remove the IACR pages below.