FA8771-16-A-0001_Telos_Follow-on_BPA_JA_signed.pdf

Limited Sources Justification and Approval (J&A)

Contracting Activity: AFMC AFLCMC/HICK 501 East Moore Drive Maxwell AFB-Gunter Annex, AL 36114

Purchase Request/ Local ID Number: 16-J&A-003

Program / Project (and PE, if applicable): ESI/Telos Blanket Purchase Agreement (BPA)

Program Type (PEO or Other Contracting): PEO

Authority: Multiple Award Schedule Program (FAR 8.405-6)

Estimated Contract Cost (including options): $27,651,492.00

COORDINATION (A F F A R S 5 3 0 6 . 3 0 4 ( a) )

X

X

X

X

X

APPROVAL (A F F A R S 5 3 0 6 . 3 0 4 ( a) )

X

Description of Limitation:

The Defense Information Systems Agency (DISA) has identified Telos Automated Message Handling System (AMHS) as the only authorized product for automated, web-based distribution and management requirements of organizational messaging for use with the Organizational Messaging System (OMS).

Since 2002 DoD has predominately used Telos AMHS, Xacta Information Assurance (IA) Manager, and Xacta Certification and Accreditation (C&A) products to meet OMS requirements. Telos is the only source for Telos AMHS and Xacta products and support.

Date PEO

RICHARD T ALDRIDGE SES

AFMC AFLCMC/HI

DSN: 596-5341, COM: (334) 416-5341

Signature

Date Contracting Officer

LASHUNYA JOHNSON-VINSON

AFLCMC/HICK

DSN: 596-2545, COM: (334) 416-2545

Signature JOHNSON- Digitally signed by JOHNSON-

VINSON.LASHUNYA.E.1109699523

VINSON.LASHUNY DN: c=US, o=U.S. Government, ou=DoD, ou=PKI, ou=USAF, cn=JOHNSON-

A.E.1109699523 VINSON.LASHUNYA.E.1109699523

Date:2016.02.2511:51:13-06'00'

Date Project Lead/Program Mgr/Requiring Activity

RAY A PERRY

AFLCMC/HICA-SEAMLS

DSN: 596-2678, COM: (334) 416-2678

Signature

Date Communications and Info Systems Officer (CSO)

RAY A PERRY

AFLCMC/HICA-SEAMLS

DSN: 596-2678, COM: (334) 416-2678

Signature

Date Local Legal Reviewer

JEFFREY S TITRUD

AFLCMC/HJA

DSN: 596-2974 Com: 334-416-2974

Signature jeffrey s. titrud

Date

2/25/2016

Chief of the Contracting Office (COCO)

CYNTHIA C CREWS

AFLCMC/HIK

DSN: 596-5614, COM: (334) 416-5614

Signature

Cynthia C. Crews

Date Competition Advocate

DONALD S POOLE III

AFMC AFLCMC/PK

DSN: 713-6359, COM: (937) 713-6359

Signature

2/25/2016

2/25/2016

2/26/2016

2/26/2016

Ray A. Perry

Ray A. Perry

I. Contracting Activity.

Air Force Material Command (AFMC)/Air Force Life Cycle Management Center (AFLCMC) 501 East Moore Drive, Bldg 884 Maxwell AFB-Gunter Annex, AL 36114

II. Nature and/or description of the action being processed.

Upon approval to pursue other than full and open competition, the United States Air Force (USAF) will negotiate and award a new DoD Enterprise Software Initiative (ESI) Blanket Purchase Agreement (BPA) to Telos Corporation for Telos AMHS, Xacta Information Assurance (IA) Manager (including Certification and Authentication (C&A)) products and related support. This BPA will provide Telos and Xacta products and allow the purchase of new software licenses and continue maintenance and support. These requirements have been factored into the estimated dollar value of the proposed BPA. The partners in this agreement are DoD and General Services Administration (GSA) Federal SmartBuy. Users of this proposed BPA include Active Duty, Reserve, National Guard, Government Civilians and Contractors, all Federal, State and Tribal Governments. This agreement applies to CONUS and OCONUS sites. The proposed agreement will replace the existing agreement awarded in September 2009 and extended through 31 March 2016. The current GSA Schedule with Telos is GS-35F-4315D, BPA Number FA8771-09- A-0301. The total, new BPA value is estimated at $27.6M. The anticipated period of performance is 5 years (a base period of one year from 1 April 2016 through 31 Mar 2017, with four subsequent one-year option periods: 1 Apr 2017 through 31 Mar 2018; 1 Apr 2018 through 31 Mar 2019; 1 Apr 2019 through 31 Mar 2020; and 1 Apr 2020 through 31 Mar 2021. This new BPA will provide Telos products and support on a firm fixed price basis.

III. Description of supplies/services required to meet agency needs.

DoD has continuing requirements for an AMHS capability and Governance, Risk and Compliance (GRC) software and support to provide automated, web-based distribution and management of organizational messaging used with the Organizational Messaging System (OMS), formally the Defense Messaging System (DMS). AMHS is a critical OMS operational element. An AMHS sends and receives classified and unclassified messages; provides connectivity to and interoperability within the OMS community. It provides guaranteed delivery to the intended recipients and maintains writer to reader accountability. It includes incoming message and text processing, profiling, retrospective search and retrieval, on-line archive, outgoing message processing, and message composition and coordination. An AMHS is supported by GRC software products.

GRC is a product category. Software companies may offer one or several systems (such as separate IA or C&A products) or an integrated platform to provide a GRC capability. A GRC product assures information and managing risks related to the use, processing, storage, and transmission of this information or data and the systems and processes used for DoD purposes. OMS utilizes GRC products which ensure security of information systems by evaluating, testing, and examining security controls. It compares the current systems' security posture with OMS standards and ensures that security weaknesses are identified. Telos AMHS and Xacta IA products are required to meet these requirements. Approximately $27.6M of these products will be required. Multiple types of funding will be used by ordering activities to make their required purchases.

IV. Identification of the justification/rationale for limiting sources and demonstration of the contractor's unique qualifications to provide the required supply/service.

FAR 8.405-6 requires an ordering activity to justify its actions when restricting consideration of schedule contractors to fewer than required in FAR 8.405-1 or 8.405-2. In addition, all orders exceeding $150,000 shall be placed on a competitive basis (by providing a fair notice of the intent to make the purchase) unless a written determination is justified and approved. The specific circumstance that justifies restriction for this acquisition is FAR 8.405-6(a)(1)(i)(B) which states, “Only one source is capable of providing the supplies or services required at the level of quality required because the supplies or services are unique or highly specialized”. The authority for limited sources are 10 U.S.C. 2304(c) and 41 U.S.C. 3304(a)(1).

In 2002, the Telos AMHS was selected as the best overall AMHS product by the Joint Staff (JS) Organizational Messaging Working Group (OMWG) based on its adaptability, scalability, and sunk investment costs. Also in

2002, the Defense Information Systems Agency (DISA), in turn, identified Telos AMHS as the only authorized product for automated, web-based distribution and management requirements of organizational messaging for use with the OMS. Telos' AMHS is the only DISA authorized core product for use with the OMS that meets the requirement for automated, web-based distribution and management of organizational messaging. In addition, it is the only product certified by Joint Interoperability Test Command (JITC) for interoperability, existing Multi-command Requirements Operational Capability (MROC) and Allied Communications Publication (ACP) 120, 123, 126 and 128 security specifications.

Telos Corporation has experienced Xacta and AMHS certified system architects and engineers to provide the continued technical support services required to modify the software for agency and user specifications.

These personnel also provide the necessary training once those software changes are implemented in the field. The requirement to customize features, protocols and behaviors of these applications to successfully integrate with legacy DMS/OMS systems requires the vendor to possess and maintain intimate and unique knowledge which also prohibits other vendors from performing or sustaining the requirement. See certification summaries and other information at https://jit.fhu.disa.mil/ and https://jit.fhu.disa.mil/cert/ cert_let.00/sep/amhs.htm.

The Telos AMHS and Xacta IA Manager software, associated software maintenance and related incidental services are the only products that fulfill the form, fit and functional requirements and are essential to the Governments' requirements. No other company's similar items or products lacking the particular feature described below can meet DoD agencies needs. An agreement directly with Telos is necessary to satisfy the need for new and recurring Xacta IA Manager and Telos AMHS Licenses. Telos is the only authorized seller of Telos and Xacta products, services, and training which are the most widely used message handling products within DoD.

DMS interfaces with FORTEZZA which is an information security system that implements cryptographic algorithms via a PC card storing private keys and other data needed to gain access. The KOV-12 FORTEZZA card which is cleared up to Top Secret/Sensitive Compartmented Information (SCI) is used extensively for DMS. In 2008 DISA compared the capabilities of different Domain FORTEZZA core products: Northrop Grumman (NG) Decision Agent (DA), Telos AMHS, and Space & Naval Warfare Systems Command (SPAWAR) Defense Messaging Dissemination System (DMDS). After comparing, DISA determined Telos AMHS was the most widely used core domain FORTEZZA product for the DMS X.400 service enterprise implementations by DoD elements. Telos AMHS is used by all Combatant Commands and all Services and many government agencies.

DISA recommended to retain Telos AMHS as the `only' DMS core Domain FORTEZZA product based on capabilities provided and proliferation. Effective 30 Sep 09, DISA DMS Global Service Manager support for NG DA and SPAWAR DMDS as core products was discontinued. All DoD users of NG DA and SPAWAR DMDS were encouraged to transition to Telos AMHS. Also, effective 1 Oct 2009 DoD Services and Agencies, the Intelligence Community (IC) and non-DoD users continuing the use of NG DA and SPAWAR DMDS products must fund all costs related to retaining these products as DMS Product Review Team products. This would include vendor software maintenance, DMS-Sustainment integration and test costs, and JITC test costs.

DISA determined it would not be cost-effective for the government to maintain two separate messaging systems.

Telos AMHS is proprietary software. Maintenance for these products include program updates, bug fixes, documentation, product tailoring and help-desk support, etc. and are available only from Telos; the only authorized reseller of Xacta products. The Government has no access to the software source code. Telos makes software updates available to all customers who purchase maintenance. Since the software source code and documentation are all proprietary, only Telos:

• Can provide software maintenance and helpdesk support for Telos AMHS

• Has access to proprietary data, in-house technology training and first- hand product knowledge.

• Can provide the full range of required support because of the existence of limited data rights, patent rights, copyrights, intellectual property rights or similar items.

Telos AMHS and Xacta IA Manager products will continue to ensure OMS standardization, integration, and will avoid higher sustainment (separate maintenance and training) and testing costs, and ensure joint interoperability.

V. Determination by the ordering activity Contracting Officer that the order represents the best value consistent with FAR 8.404(d).

DISA has identified Telos AMHS as the only authorized product for automated, web-based distribution and management requirements of organizational messaging for use with OMS. In addition, it is the only product certified by JITC for interoperability, existing MROC and ACP 120, 123, 126 and 128 security specifications. DoD has predominately used Telos AMHS, Xacta IA Manager, and Xacta C&A products to meet OMS requirements.

However, DoD has begun using alternate solutions to C&A and AMHS products. Enterprise Mission Assurance Support Service (eMASS) is becoming the predominate DoD C&A product. DoD Instruction

8510.01 Enclosure 5, Paragraph 1.c. states "PMs/ISOs (program managers/information system owners) deploying systems across DoD Components will post security authorization documentation to Enterprise Mission Assurance Support Service (eMASS) or other electronic means to provide visibility of authorization status and documentation to planned receiving sites". eMASS is a government off the shelf (GOTS) C&A software product. Further, SAF/CIO A6 has stated, "other electronic means have not been approved/authorized by the AF at this time; eMASS is the AF preferred product of record until new or updated guidance is issued." The Army is also replacing commercial C&A products with eMASS. U.S. Fleet Cyber Command/U.S. TENTH Fleet has stated that eMASS also is the Navy's C&A solution. eMASS is now in full scale deployment and is projected to become the DoD standard C&A product (reference: DISA/ID 52).

While there is no set completion date for total DoD conversion to eMASS, requirements for the Xacta C&A product will be ultimately eliminated. Regarding AMHS, the Army and AF will continue to use Telos AMHS, but the Navy has replaced it with the Command and Control Office Information Exchange (C2OIX), a Navy developed AMHS product.

VI. Description of the market research conducted and the results, or explain why market research was not conducted.

IAW FAR Part 10 the SEAMLS office conducted market research on possible sources of supply and maintenance support for AMHS/GRC products. Using Gartner research documents this research consisted of the determination of potential products, investigation into the products capabilities and the background on the products and publishers performance. The sources are listed in the Market Research Report dated 28 July 2015. This research disclosed that COTS AMHS products are readily available from Telos, Northrup Grumman Decision Agent (DA), and Boeing Multimedia Message Manager (M3). These products appear to provide similar capabilities and to satisfy core OMS requirements.

However, as stated above, the Telos AMHS has been considered the best overall product by the Joint Staff Organizational Messaging Working Group since 2002 and is the sole message handling system authorized for use with OMS. Telos AMHS is a DISA "core" product. Introduction of a new/ different AMHS to replace the Telos product would require significant capital investment and a considerable amount of time to test, field and integrate. Additionally if a DoD organization decided to switch from the Telos AMHS software to another existing product, such as DA or M3, they would take on all responsibilities for life-cycle support of the product. This would include funding software maintenance to the vendor, testing/approving updates to the product and ensuring security compliance (Vulnerability Assessment and C&A activities) associated with the product. A reasonable estimate is that this BPA would cost approximately $5.5M per year, not including any possible product licensing costs.

Telos AMHS complies with the MROC 3-88 Change 2. As the sole "core" OMS end-user product, it is the only end- user organizational messaging product supported by DISA. Market research indicated that due to Telos being DISA's sole solution for OMS AMHS requirements, the costs, time and efforts required to certify and replace the existing Telos capability; Telos meeting JITC certification requirements, MROC and ACP 120, 123,126 and 128 security specifications; being on the AF APL; and having an existing GSA schedule --makes Telos the sole company that meets the AMHS requirement.

While the existence of competing GRC products seemingly indicates that a fair and open competition should be held (per FAR 8.405-6) the almost universal use by DoD of the Telos Xacta IA Manager GRC products, the prohibitive costs, time, effort and operational impact required to field a replacement GRC product must be considered. While there is no set date for DoD total conversion to eMASS, it being the DoD "preferred" C&A product will greatly reduce, if not eventually eliminate, requirements for the Xacta C&A product as well as any consideration of an alternate product.

Market research was conducted to determine the availability of alternate sources for AMHS and GRC products. There are no suitable alternative contract vehicles which offer these products. There are no authorized resellers for Telos products. Telos software is proprietary. The government has no access to the software source code. Telos makes software updates available to all customers who purchase maintenance.

Since the software source code and documentation are all proprietary, only Telos can provide software maintenance and help- desk support for Telos products. Telos has sole access to proprietary data, in house technology training, and first hand product knowledge. Only Telos can provide the full range of required support. Telos is the parent company of Xacta.

VII. Other facts supporting the justification.

DoD has a significant investment of almost $60M in Telos AMHS and Xacta products procured through the previous and the existing BPA. Maximizing the effectiveness of previous DoD Telos software investments and maintaining previous purchases is far more cost-effective than purchasing new software and maintenance from another vendor. The Market Research Report determined that (see Paragraph VI), "replacing existing Telos products with alternative products will not only incur the initial cost of purchasing new software, there would be additional costs incurred for training both support and user personnel. The transition and training would have operational impacts as the software and personnel build operational capability. Also, there would be a significant amount of effort required to recreate and convert existing infrastructure and designs to a new platform. More importantly, there is significant uncertainty around the impact to wartime support environments - both in garrison and expeditionary;

connected and disconnected - during conversion of the existing automated, web-based distribution and management requirements of organizational messaging capabilities to a new platform."

VIII. Actions the agency may take to remove or overcome any barriers that led to the restricted consideration before any subsequent acquisition for the supplies or services.

This agreement will be executed following guidance of all applicable statutes and regulations including FAR Subpart 8.4, Defense FAR Supplement Subpart 208.4, Air Force FAR Supplement Subpart 5308, and GSA ordering procedures. The USAF is constantly looking for new and improved ways to process and share information (i.e., messaging) across the enterprise in a secure manner. IT technology, product development and improvements are continually being researched and reviewed.

Determinations of product(s) which best meet customer requirements and “best buy” policy is a systematic and formal process. As soon as future technology improvements present a viable, cost-effective alternative solution, the USAF will work towards a competitive solution.

IX. Certification by the Contracting Officer.

As evidenced by my signature above, I have determined this document to be both accurate and complete to the best of my knowledge and belief.

X. Certification by the technical/requirements personnel.

As evidenced by my signature above, I certify that any supporting data contained herein, which is my (our) responsibility, is both accurate and complete.