FA8751-15-C-0008_JnA_redacted.pdf

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION

I. CONTRACTING ACTIVITY

AFRL/RIKO, 26 Electronic Pkwy, Rome NY 13441

II. NATURE AND/OR DESCRIPTION OF THE ACTION BEING PROCESSED

The Government requires the capability to visualize network scans or targeted web crawls for an all-inclusive network discovery and/or defensive awareness. To accomplish this need, software licenses and associated plugins to equip and allow Cyber Protection Teams to enable computer network operation system modernization and training will be procured. Based on market research for capabilities to equip the Cyber Protection Teams, the following list of items is contemplated for procurement:

ITEM: Endgame Torchpoint Application (1 Year Term License, P/N EG-TP-APP-1Y-T) DESCRIPTION: Endgame Command and Control Application Torchpoint Hunt Package (1 year term)

ITEM: Endgame Torchpoint Listening Post (1 Year Term License, P/N EG-TP-LP-1Y-T) DESCRIPTION: Endgame Listening Post - DCO (1 year term)

ITEM: Endgame Torchpoint Advanced Windows Agent Enterprise Maintenance (1 Year Term P/N EG-TP-AG-WIN‐1Y -ES) DESCRIPTION: Maintenance for DCO Hunt Endpoint

ITEM: Endgame Torchpoint Advanced Linux Agent (1 Year Term License, P/N EG-TP-

AG-LINUX-1Y-T)

DESCRIPTION: Linux DCO Hunt Endpoint (1 Year term)

ITEM: Endgame Torchpoint Agent Stealth Package (1 Year Term License, P/N EG-TP-

AG-STEALTH-T)

DESCRIPTION: Endgame Torchpoint Agent Stealth Package (1 Year term) ‐ 1 Deployment Module, 1 Stealth Persistence Module, 10 Stealth Agent Signatures

ITEM: Endgame Catalog Points (P/N EG-POINTS) DESCRIPTION: Endgame Catalog Points – 2 Points

The items above were identified as the only commercially available, non-developmental, integrated software capabilities that can meet the full suite of requirements. The estimated value of the acquisition is . Delivery will be required within 30 days of award and will extend one (1) year from the date of delivery. Items are commercially available.

III. DESCRIPTION OF THE SUPPLIES/SERVICES REQUIRED TO MEET THE

AGENCY’S NEEDS

AFLCMC/HNCY has a requirement for commercially available software licenses to equip Marine

Corps Cyber Protection Teams (CPT) to enable computer network operation system modernization and training. Specifically, they require EndGame TorchPoint, and compatible plugins. RDT&E (3600) funds will be used for this effort. The licenses are needed for one year.

IV. STATUTORY AUTHORITY PERMITTING OTHER THAN FULL AND OPEN

COMPETITION

10 U.S.C. 2304(c)(1), only one responsible source and no other supplies or services will satisfy agency requirements.

V. DEMONSTRATION THAT THE CONTRACTOR’S UNIQUE QUALIFICATIONS OR

NATURE OF THE ACQUISITION REQUIRES THE USE OF THE AUTHORITY CITED

ABOVE (APPLICABILITY OF AUTHORITY)

AFLCMC/HNCY requires the capability to command and control these cyberspace assets and tools. AFLCMC/HNCY requires the capability to remotely deploy agents to non-permissive environments through a secure command and control infrastructure using a web based interface.

AFLCMC/HNCY requires that agents deployed within a defended network operate in an assured manner (both system operations and communication mechanisms) across Windows and Linux platforms. AFLCMC/HNCY also requires the capability to perform post deployment management, visualization and reporting on all tools via a common web interface. While this commercially available system is expected to provide significant capability, AFLCMC/HNCY requires that the command and control interface provide an open API for integration with third party tools and capabilities. (TorchPoint)

AFLCMC/HNCY requires rapidly available plugins to provide perishable capabilities that can interoperate with these systems. These plugins must be guaranteed to work on these frameworks and platforms without user integration or regression testing. (EndGame plugins)

Based on market research performed by AFLCMC/HNCYC for capabilities to equip Air Force Cyber Protection Teams, who have very similar operational and training requirements as MARFORCYBER Cyber Protect Teams, EndGame TorchPoint and EndGame developed plugins were identified as the only commercially available, non-developmental, integrated software capabilities that can meet the full suite of AFLCMC/HNCY requirements.

VI. DESCRIPTION OF EFFORTS MADE TO ENSURE THAT OFFERS ARE

SOLICITED FROM AS MANY POTENTIAL SOURCES AS DEEMED PRACTICABLE

Sources Sought Notice:

AFRL, leveraging previous sources sought research performed in January 2015 by the Air Force Lifecycle Management Center, Cryptologic and Cyber Systems Division, identified several possible commercial solutions. Based on the information provided, no other commercially available solutions provide the integrated suite of capabilities provided by TorchPoint and LightStorm. In addition, FedBizOpps.Gov was searched for similar efforts and produced zero relevant results for “EndGame”, “LightStorm”, or “TorchPoint”.

Notice of Intent to Sole Source:

VII. DETERMINATION BY THE CONTRACTING OFFICER THAT THE

ANTICIPATED COST TO THE GOVERNMENT WILL BE FAIR AND REASONABLE

The Contracting Officer anticipates the cost to Government will be fair and reasonable based on a complete analysis of the contractor’s prices in accordance with applicable and appropriate FAR bases for award as specified in FAR 13.106-3(a), Basis for Award. Commercial price lists, procurement history and other available pricing information, such as evidence and documentation provided by the Contractor recording prior sales of the same items, will be reviewed. A determination of fair and reasonable pricing as required by statute and regulation will be made by the Contracting Officer.

VIII. DESCRIPTION OF THE MARKET RESEARCH CONDUCTED AND THE

RESULTS, OR A STATEMENT OF THE REASONS MARKET RESEARCH WAS NOT

CONDUCTED

Market research was conducted IAW with FAR 10.002 procedures. Market research was based on the requirements complexity, past experiences, and determination if the items are available commercially to meet the Government’s need. The AFRL team leveraged previous market research performed by AFLCMC/HNCY to identify possible commercially available solutions for their ongoing support of Air Force Cyber (AFCYBER) CPTs. Based on this market research, EndGame is the only software developer that produces a full suite of interoperable systems that can meet the requirements of AFLCMC.

Other systems from were considered but based on the market research could not provide the required capabilities as a commercially available, non-developmental item.

IX. ANY OTHER FACTS SUPPORTING THE USE OF OTHER THAN FULL AND OPEN

COMPETITION

N/A

X. LIST OF SOURCES, IF ANY, THAT EXPRESSED INTEREST IN THE ACQUISITION

See Section VI above.

XI. A STATEMENT OF THE ACTIONS, IF ANY, THE AGENCY MAY TAKE TO

REMOVE OR OVERCOME ANY BARRIERS TO COMPETITION BEFORE MAKING

SUBSEQUENT ACQUISITIONS FOR THE SUPPLIES OR SERVICES REQUIRED

Based on FAR guidance, this requirement will be reviewed on a per annum basis to review the market place. AFLCMC will continue to perform market research for non-developmental, commercially available and supported systems that can meet the requirements of the Air Force Cyber, and other United States Cyber Command Cyber Protection Teams.

Though replies to the first two notices of intent produced weak or no leads to products alternative to EndGame’s, the third for the current effort did result in promising product alternatives or potential replacement products. The Government has engaged two of the three respondents to notice of intent FA8751-15-R-0040 for product demonstrations.

Additionally, AFRL will continue to invest research and development resources in this area for next generation Cyber Protection Team systems provide capabilities that cannot be provided through any commercially available software solutions.

XII. CONTRACTING OFFICER’S CERTIFICATION

The contracting officer’s signature on the Coordination and Approval Document evidences that he/she has determined this document to be both accurate and complete to the best of his/her knowledge and belief (FAR 6.303-2(a)(12)).

XIII. TECHNICAL/REQUIREMENTS PERSONNEL’S CERTIFICATION

As evidenced by their signatures on the Coordination and Approval Document, the technical and/or requirements personnel have certified that any supporting data contained herein, which is their responsibility, is both accurate and complete (FAR 6.303-2(b)).