SS Justification_FOE_RADMF_28JAN25 - Competition Advocate signature - 2025-01-28_Redact_Redacted.pdf

Sole Source (Including Brand Name) Justification - Simplified Procedures for Certain Commercial Items

CONTROLLED UNCLASSIFIED INFORMATION

March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 3 of 11March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 3 of 11

V. Demonstration that the contractor's unique qualifications or nature of the acquisition requires the use of the authority cited above (applicability of authority).

In accordance with (IAW) FAR 13.501(a)(2), the contracting officer must justify restricting consideration to Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements. A brand-name item, even if available on more than one contract, is an item unique to one manufacturer. Brand-name specifications shall not be used unless the brand-name, product, or feature is essential to the Government's requirements and market research indicates other companies' similar products, or products lacking a particular feature, do not meet, or cannot be modified to meet, the agency's needs.

A key capability Unified Platform operates and manages on behalf of USCYBERCOM (USCC) is USCC's instantiation of the Big Data Platform (BDP), known as the Caspian-series BDP's, which is comprise of three BDP's, Caspian Pigeon (U), Caspian Schooner (S), and Caspian Clipper (TS) and are leveraged by USCC, JFHQ-DODIN, and other cyber operator units to conduct data ingest, synthesis, exploration, and analysis in executing their defensive cyber operations missions. A core component of the USCC BDP's is the Rapid Analytic Deployment Management Framework (RADMF) which provides a full-suite data lakehouse environment and accelerators that are key in eliminating data silos and enabling dynamic big data analysis through rapid, intelligent, cost effective, and integrated offerings.

As the USCC BDP's are a central component of the broader BDP community, comprised of Army, Air Force, Navy, Marine Corps BDP's, all of which leverage RADMF's data lakehouse accelerator functionality, this feature is critical in facilitating rapid data transport, ingest and analysis across all of the BDP's. Absent the functions this software provides, USCC BDP's ability to interact seamlessly across the BDP community at the data layer would severely inhibit USCC's ability to effectively conduct their defensive cyber missions at the pace required for modern cyber operations.

Additionally, failure to renew RADMF would likely cause a stoppage in operational availability of the USCC BDP's. This would result in significant operational downtime, an increase in costs trying to replace the capability, and the crippling the USCC BDP's and the operations they enable. If RADMF is not renewed, it would require UP to bring down the BDP's and then stand them up as quickly as possible, which would amount to at least $ a month in expenses to re-create a solution. This would be a duplication of cost significantly more than the license of RADMF for the year. Operational downtime is estimated between 9 - 12+ months and additional costs ranging from $ - $ would result from highly specialized developers during that time to implement an alternative solution.

RADMF also supports end-to-end provisioning capabilities, automated provisioning of workflows, resource provisioning, configuration, monitoring, scaling, and removal. The system is deployed in a high availability architecture, ensuring 24/7 operational availability. Additionally, RADMF provides several critical capabilities, including:

1. Provisioning: automated provisioning of a cloud-based multi-node platform capable of deploying clusters of over 15 petabytes in size.

2. BDP automated deployment: rapid and automated provisioning of Big Data Platform Clusters through Continuous Integration/Continuous Delivery (CI/CD) orchestrated pipelines.

3. Data Aggregation and Processing: confident storage, analysis, and querying of structured and unstructured data while ensuring data security, privacy, tracking, accuracy, and usability.

4. Network Data Management: processing engine to handle network packets (PCAP) for observability and threat hunting.

RADMF has an Authority to Operate (ATO). As Environments and systems get ATO's, software falls under the ATO.

RADMF is covered under the current USG's Caspian Contract and its ATO.

Impact if RADMF is not renewed:

RADMF is a critical component of the USCC BDP ecosystem, providing essential capabilities for conducting defensive cyber operations. Its maturity, interconnectedness, and uniqueness make it the only commercially available software that can ensure continuity of operations across the USCC BDPs. Failure to renew RADMF would have severe consequences, putting at risk all three USCC BDP's and potentially crippling a key data platform for hundreds of cyber defense operators and analysts thereby inhibiting USCC, JFHQ-DODIN, and several smaller operational units from

Sole Source (Including Brand Name) Justification - Simplified Procedures for Certain Commercial Items

March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 4 of 11March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 4 of 11 meeting their tasked missions in support of USCYBERCOM Commander priorities.

VI. Description of efforts made to ensure that offers are solicited from as many potential sources as practicable.

Unified Platform conducted extensive market research to identify alternative sources for RADMF including, requests for information via SAM.gov, ESI BPA and NASA SEWP. Our UP Technical Leads and Program Managers then analyzed each response to determine if the proposed products were viable options. None of the alternatives described in the resulting research were able to meet the Government's requirements outlined in the Statement of Objectives (SOO).

An RFI was released on SAM.gov, on 2 Oct 2024. UP received and analyzed 23 responses, to include but not limited to:

alternate proprietary products, AWS, and open source or COTS products to be used in conjunction with proprietary products. Every alternative product response was unable to meet one or several of the functionalities and or capabilities or required a considerable and consequential amount of time to implement. RADMF is the only product that can meet UP's Performance, Operational, Security, and User Requirements without significant architecture modification taking upward of 9-12 months.

A competition was not conducted since RADMF is a central product integrated within the larger USCC BDP community which spans all the military services. If competed and an alternative product was chosen, the alternate product would also have to be accepted and integrated among a much larger community beyond Unified Platform.

VII. Determination by the Contracting Officer that the anticipated cost to the Government will be fair and reasonable.

The PCO will perform price analysis IAW FAR 13.106-3 to determine that the overall price is fair and reasonable and represents the best value for the Government by comparing prices previously paid for this software to the contractor on previous contract that were also procured under a sole source environment. This allows for the increased size in the Caspian UPDNs. Also, we will request Other than Certified Cost or Pricing Data IAW FAR 15.404 to determine price fair and reasonable.

VIII. Description of the market research conducted and the results, or a statement of the reasons market research was not conducted.

Our market research strategy encompassed the following categories:

a. Identify available authorized resellers of the RADMF product.

b. Identify similar, available products and solutions in the market.

c. Review features and functionality of alternatives.

d. Assess integration and compatibility with our DevSecOps platform.

In our exploration of alternative products and solutions to RADMF, UP provided industry with license agnostic objectives and characteristics of the needed support to propose to.

Vendor responses to Request for Information (RFI):

UP issued a Market Research Request on 25 Oct 2024 on NASA SEWP to determine if any vendors were authorized resellers of the RADMF software owned by Enlighten. No vendors responded to the sources sought. UP also searched GSA's 2nd Generation Information Technology Blanket Purchase Agreements (2GIT) to determine if there are any authorized resellers. 2GIT provides access to commercial Off-The-Shelf (COTS) hardware/software and ancillary services. There are not resellers of RADMF on 2GIT, however the owner Enlighten is on 2GIT.

UP issued an RFI on 2 Oct 2024, on SAM.gov for possible RADMF alternatives. The 23 responses are listed below along with a synopsis & analysis of each response.

Sole Source (Including Brand Name) Justification - Simplified Procedures for Certain Commercial Items

March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 5 of 11March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 5 of 11

1) GovTron recommended a proprietary solution using open-source and proprietary applications. The recommended solution is not Commercial-Off-the-Shelf (COTS) or currently integrated. Solution would require a moderate level of development and integration. It's estimated development timeline would be 6 to 9 months.

2) Oracle recommends integrating multiple, well established, proprietary application to support all capabilities outlined in the RFI. Recommended solution is COTS and estimated it would take a moderate amount of integration. It is estimated development timeline would be 6 to 9 months.

3) BMC recommended a proprietary Graphical User Interface (GUI) product to visualize data and cloud provisioning.

The recommendation does not address BDP orchestration, data management, or CI/CD. BMC did not recommend a complete solution to address objectives. It is estimated development timeline would be 12+ months.

4) Deloitte did not submit a recommended product or solution. The vendor only generically referenced the required capabilities and indicated they were capable of performing in the particular capability areas. The vendor did not recommend a complete solution to address objectives. Any solution from this vendor is likely to have an estimated development timeline of 12+ months.

5) Elastic recommended a proprietary solution using open-source and proprietary applications. Recommended solution is not COTS or currently integrated. Solution would require a moderate level of development and integration.

It's estimated the development timeline would be 6 to 9 months.

6) SAIC recommended a proprietary solution using open-source and proprietary applications. Recommended solution is COTS but would require moderate level of integration with UP platforms. It's estimated the development timeline would be 6 to 9 months.

7) Ulu HI-Tech did not sufficiently respond to the RFI. Response only recommended to keep using AWS vs moving to Azure. The vendor gave no other responses to RFI Objectives. There is no reasonable expectation that the vendor would be able to address the objectives.

8) GuidePoint response focuses heavily on Secure Cloud Computing. The response did not indicate any ability to address BDP orchestration or other key capabilities. The recommended solution is proprietary and is not COTS or currently integrated. It is estimated development timeline would be 12 + months.

9) Plus3IT recommended a proprietary solution focused on Infrastructure as code and cloud computing. The response did not indicate any ability to address BDP orchestration or other key capabilities. The recommended solution is proprietary and is not COTS or currently integrated. It is estimated development timeline would be 12+ months.

10) Sterling recommends suggest using all native AWS tools to support all RFI objectives. UP has considered the use of several AWS native tools and have found them insufficient to address the Governments needs across all classification domains; as well as maintaining ownership of critical data.

11) Villa-Tech recommended a proprietary solution. Recommended solution is not COTS or currently integrated.

Solution would require a moderate level of development and integration and lakes the required data lake capability.

It's estimated development time line of 6 to 9 months

12) Aurelius recommended a proprietary solution heavily focused on cloud computing. The response did not indicate any ability to address BDP orchestration or other key capabilities. The recommended solution is proprietary and is not COTS or currently integrated. It is estimated development timeline would be 12+ months.

13) Bluebery Hawaii did not submit a proposed product or solution; instead, they provided a corporate statement and past contracts. Since no recommendation was proposed it was not possible to discern what the vendor would propose for UP objectives and what an implementation might look like. Based on listed previous contracts it is not clear that the vendor could develop a solution within 12+ months.

14) Zaden recommended multiple proprietary and open source tools that could be used to address the RFI Objectives.

Sole Source (Including Brand Name) Justification - Simplified Procedures for Certain Commercial Items

March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 6 of 11March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 6 of 11

The vendor's recommended solution is not COTS or currently integrated. It is estimated development timeline would be 12+ months.

15) Thorben did not recommend a solution or mention a preferred product. The vendor only outlines non specific contractor capabilities related to RFI objectives. Based on the vendors response it is not clear that the vendor could develop a solution within 12+ months.

16) BEAT recommends integrating multiple, well established, open-source application to support all Objectives outlined in the RFI. Recommended solution is not COTS or currently integrated. It is estimated the development timeline would be 6 to 9+ months.

17) Blackwood recommended a proprietary solution using open-source and proprietary products. Recommended solution is COTS but would require moderate level of integration. It's estimated the development timeline would be 6 to 9+ months.

18) Qumulo recommended a proprietary solution focused on data management. The recommended solution would have to be integrated with other orchestration and CI/CD tools. The recommended solution is proprietary and is COTS but is not currently an integrated solution. It is estimated development timeline would be 6 to 9+ months.

19) Tangram recommended a solution that focuses on a proprietary software integration product. Submission focus on the technology required to bridge systems together across application, environments, systems. Solution does not address the Government's need for BDP orchestration, CI/CD, and other listed objectives. Based on submission it is not clear that the vendor could produce a solution within 12+ months.

20) Raft recommended integrating multiple, well established, proprietary application to support all Objectives outlined in the RFI. Recommended solution is not COTS or currently integrated. It is estimated development timeline would be 6-9+ months

21) Cubic recommended solution focuses on data management and dissemination. The recommended solution does not discuss other capabilities related to BDP Orchestration and CI/CD tools. It is unclear if this vendor is capable of supporting the Objectives. It is estimated development timeline would be 12+ months

22) Parsetek did not submit a proposed product or solution; instead, they provided a corporate statement and past contracts. Since no recommendation was proposed it was not possible to discern what the vendor would propose for UP objectives and what an implementation might look like. Based on listed previous contracts it is not clear that the vendor could produce a solution within 12+ months.

23) Rexus recommends integrating multiple, well established, open-source application to support all objectives outlined in the RFI. Recommended solution is not COTS or currently integrated. It is estimated development timeline would be 9-12+ months.

There are no Authorized Resellers/Direct Sellers of RADMF on DoD ESI, 2GIT or NASA SEWP. There also are no resellers outside these vehicles.

Market research was conducted to attempt to identify other sources for this license but none were found. This included reviewing ESI responses of the 23 interested vendors and other required sources, which revealed no ability to purchase the licenses in question. Several other contracts were currently available to purchase RADMF, but all of them were sole-source contracts to Enlighten, which reinforced that no independent option was available. The program manager also conducted online search for other RADMF sellers on the open web. However, no other sources were discovered.

Therefore, the PMO has concluded that Enlighten is the only manufacturer of RADMF license and the sole reseller.

IX. Any other facts supporting the use of Other Than Full and Open Competition.

Maintaining the subject licenses that provide a core functionality across the USCC BDPs is vital to ensuring those

Sole Source (Including Brand Name) Justification - Simplified Procedures for Certain Commercial Items

March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 7 of 11March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 7 of 11 programs are operating as expected for the cyber operations community UP supports. Any lapse in the support that this license provides could severely impact Unified Platform's ability to ensure the USCC BDP's are operational and performing as expected for the operational community.

X. List of any sources that expressed, in writing, an interest in the acquisition.

No alternative sources have been developed or located. See Section VIII above.

XI. A statement of the actions, if any, the agency may take to remove or overcome any barriers to competition before making subsequent acquisitions for the supplies or services required.

The way ahead discussed in the previous J&A was to utilize Army's alternative to RADMF named Cyber Operations Broad Responsive Agreement (COBRA) Other Transaction Authority (OTA). Thus far the Army has been unsuccessful in developing the RADMF alternative and has since procured additional RADMF licenses.

As discovered in our market research, the US Army is currently utilizing a contract for RADMF (Contract No.

W519TC23C0001) awarded to Enlighten IT Consulting LLC (Cage Code: FZCG3) in the amount of $ as a UCA. The UCA was finalized to bring the contract amount to a ceiling of $ The US Army also had a Sole Source Justification (SSJ) approved on 21 Sept 2022 for this effort. The Army has utilized Enlighten (EITC) since 2016 when they began work on the development of RADMF to support the Army's BDP, named Gabriel Nimbus (GN). Since 2016, EITC has been awarded two (2) sole source contracts to continue the effort, most recently in 2020 under contract (W52P1J-21-C-0002) under the authority of FAR6.302-1, as supported by the J&A 20-115. Because of the stalled COBRA program, they have had to continue use with EITC for support and maintenance of the BDP using the proprietary RADMF licenses.

For this current requirement, after analyzing the products submitted for RADMF market research, it has been identified as the only product able to meet our requirements comprehensively sooner than 9-12+ months.

There are no Authorized Resellers/Direct Sellers of RADMF on DoD ESI, 2GIT or NASA SEWP. There also are no resellers outside these vehicles.

As described in the attached previous J&A approved by the Army in September 2022, the US Army attempted to develop an alternative to RADMF with the Cyber Operations Broad Responsive Agreement (COBRA) Other Transaction Authority (OTA), which aimed to be a Government-owned solution, allowing for future competition and eliminating the Government's reliance on Enlighten for its RADMF license. At this time, COBRA OTA has not been able to complete the OTA phases, testing, and fielding of its prototype, therefore, no alternative is available.

Also described in the previous J&A, UP planned to deploy Unified Platform Version 1 (UPv1), which aimed to use a different approach to deploy and sustain the Caspian's, not requiring RADMF. If it were successful, the Government would have been able to choose methods of deployment the following year.

Ultimately, assumptions were made with the vision, intent and ultimate implementation of UPv1 that did not come to fruition. At this time, the Program office is not planning to pursue the previous paths of UPv1 and COBRA (though the Army is still working solutions) as they proved to be non-viable solutions. Instead, the program office will work within the upcoming contract Period of Performance to analyze, and do possible test runs of new innovative options that market research provides, that could possibly meet the needs of the Government. Until an alternative source or option is developed, the Unified Platform PMO requires a sole source contract with Enlighten to provide continued support and maintenance of the Caspian-series UPDN's.

XII. Certification by the Contracting Officer.

As evidenced by my signature above, I have determined this document to be both accurate and complete to the best

Sole Source (Including Brand Name) Justification - Simplified Procedures for Certain Commercial Items

March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 8 of 11March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 8 of 11 of my knowledge and belief.

XIII. Certification by the technical/requirements personnel.

As evidenced by my (our) signature(s) above, I (we) certify that any supporting data contained herein, which is my (our) responsibility, is both accurate and complete.

Sole Source (Including Brand Name) Justification - Simplified Procedures for Certain Commercial Items

March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 10 of 11March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 10 of 11

Contracting without providing for full and open competition shall not be justified on the basis of lack of advance planning by the requiring activity or concerns related to the amount of funds available (e.g., funds will expire) (10 U.S.C. 3204)

VI. Description of efforts made to ensure that offers are solicited from as many potential sources as practicable.

(FAR 6.303-2(b)(6))

Describe all efforts taken (or to be to be taken) to ensure that offers are solicited from as many potential sources as practicable under the circumstances. Although Market Research is covered in Section VIII, the information in Section VI should correlate with the Market Research described in Section VI. The following issues should be addressed in this paragraph:

Sources Sought Synopsis (used as part of market research). If a sources sought synopsis was issued, state the date the synopsis was issued and a brief description of its content. If any responses were received, describe in detail the results of the screening process and the rationale for determining the unacceptability of any synopsis respondents. Reference FAR 13.105, Synopsis and Posting Requirements.

Other Actions. In this paragraph, discuss any other actions taken or planned to facilitate competition for this acquisition. The discussion should include actions tried or considered even if the actions were unsuccessful. If the efforts were unsuccessful, so state and describe why.

Qualifying Country Sources. If qualifying country sources have expressed interest, but are to be excluded, provide supporting rationale.

VII. Determination by the Contracting Officer that the anticipated cost to the government will be fair and reasonable. (FAR 6.303-2(b)(7))

Include a statement by the contracting officer that the anticipated cost will be considered fair and reasonable and provide the basis for this determination. The steps that will be taken to ensure the final contract price will be fair and reasonable are also described here. Describe the extent of cost or price analysis anticipated including the requirements for certified cost or pricing data, technical evaluations, and audits.

VIII. Description of the market research conducted and the results, or explain why market research was not conducted. (FAR 6.303-2(b)(8))

Generally, some form of market research should be conducted. Discuss any market research conducted pursuant to FAR Part 10 and describe results of that research. Market research is any effort undertaken to determine if sources capable of satisfying the agency's requirements exist and to determine if commercial items or non-developmental items are either available or can be modified so that they will satisfy the agency's needs. Market research should be focused not only on identifying alternate sources, but also on alternate equipment or substitutes that might fulfill the Government needs with only minor modification.

Regardless of the approach used, the results should provide a high level of confidence that no other qualified sources exist.

When other exceptions from the requirement to obtain full and open competition are relied upon, the market research might be limited to an examination of the acquisition history and experience with the marketplace under previous acquisitions for the same or similar items.

If no market research was conducted, so state and provide the rationale.

IX. Any other facts supporting the use of Other Than Full and Open Competition. (FAR 6.303-2(b)(9)(i))

Provide any other facts supporting the use of other than full and open competition, including an explanation of why technical data packages, specifications, engineering descriptions, statements of work, statements of objectives, or purchase descriptions suitable for full and open competition have not been developed, are not being developed, are not being used, or are not available.

X. List of sources, if any, that expressed interest in the acquisition. (FAR 6.303-2(b)(10))

Sole Source (Including Brand Name) Justification - Simplified Procedures for Certain Commercial Items

March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 11 of 11March 2023 CONTROLLED UNCLASSIFIED INFORMATION Page 11 of 11

If a sources sought synopsis was done and all interested sources are included in Section VI, it is acceptable to state, “See Section VI above.”

XI. A statement of the actions, if any, the agency may take to remove or overcome any barriers to competition before making subsequent acquisitions for the supplies or services required. (FAR 6.303-2(b)(11))

Describe any actions taken or to be taken to foster competition for future acquisitions of the supplies or services being acquired.

Describe potential actions that could be taken to remove the barriers to competition that have been identified in the justification and include a milestone schedule, where available, for accomplishing these actions. For example, if a follow-on competitive acquisition is planned, so state and provide the planned award date, or state that the Government will attempt to acquire rights in technical data and computer software sufficient to compete follow-on acquisitions as a priced option in the contract action that is the subject of this Justification, or (if applicable) state how the Government intends to challenge nonconforming markings on technical data and computer software delivered to it under previous contracts so those markings can be removed in order that the technical data and computer software may be used in support of a follow-on competitive acquisition, or describe plans to qualify additional sources.

Address efforts to ensure competition for future spare parts and maintenance in support of systems or equipment covered by the justification, even when these acquisitions will be accomplished by other organizations. Include a discussion on available breakout data.

If no actions are planned, so state and provide reasons. If approval is sought for more than one year, explain why a sole source effort is required for the planned time duration.

For a non-competitive follow-on acquisition to a previous award for the same supply or service supported by a Justification citing the same authority, include a discussion of the actions planned to overcome barriers to competition established in the previous justification, the status of those actions, and the results of those actions. The approval authority shall determine whether the planned actions were completed. If the planned actions were not completed, the justification for the follow-on acquisition shall be approved by the approval authority one-level above the approval authority for the previous justification (see FAR 13.501(a)(2)). If the previous justification was approved by the Senior Procurement Executive (SPE), the approval remains at the SPE level.

[DFARS 213.501(a) and DFARS PGI 206.304(a)(S-70)(ii)]

XII. Certification by the Contracting Officer. (FAR 6.303-2(b)(12))

As evidenced by his/her signature, the contracting officer has determined this document to be both accurate and complete to the best of his/her knowledge and belief.

XIII. Certification by the technical/requirements personnel. (FAR 6.303-2(c))

As evidenced by their signatures, the technical and/or requirements personnel have certified that any supporting data contained herein, which is their responsibility, is both accurate and complete.