Form USPTO-OP-011 - GSA Limited Source Justification (LSJ) -FY23 XOR MOD_3_20_23_Final.pdf

FORM USPTO-OP-011.v4.0 (8/2022)

Our Mission: “The Office of Procurement is committed to serving as business partners and advisors to the

USPTO community to provide best value goods and services in support of the USPTO’s mission.”

CUI//SP-PROCURE

Controlled by: United States Patent and Trademark Office, OCAO, RICPO, 571-272-9990

LIMITED SOURCES JUSTIFICATION (LSJ)

(Sole Source)

(35 U.S.C. 2(b)(4)(A) and FAR 8.405-6(a))

SECTIO N I. CO MPLETED BY THE PRO GRAM OFFICE

Program Office: Office of the Chief Information Officer / Cybersecurity Division (OCIO/CD)

Program Office POC: Maureen Daley

Title of Procurement: Cybersecurity Operations Support Services – Modification for additional work

Acquisition Package #: ACQ-23-0556

Estimated Value (including options)

Base Award Total: $31,474,995.30 Estimated Increase: $9,632,183.12 (~23%)

Contracting Officer: Stephan Batt Contracting Officer Phone: (571) 272-2190 Vendor Name (if applicable): XOR Security, LLC

Contract or Order # (if applicable): GS-35F-525GA/

1333BJ22F00280018

The following LSJ has been prepared to meet the requirements of Federal Acquisition Regulation (FAR) 8.405-6, and FAR 17.502-1(a).

1. Identification of the agency and contracting activity

United States Patent and Trademark Office (USPTO) Office of the Chief Financial Officer (OCFO) Office of Procurement (OP) Alexandria, VA

2. Nature and/or description of the action requiring approval

The USPTO OP intends to negotiate and award a bilateral task order modification to XOR Security, LLC.

3. Description of the supplies or services required and the estimated value thereof

The USPTO must process a considerable amount of commercially sensitive and confidential information on its IT networks and databases that require a high level of cybersecurity. Due to an increasing number of cyber threats to government infrastructures across the United States, government policy makers have imposed additional cybersecurity requirements than originally competed under task order #1333BJ22F00280018. The USPTO cybersecurity division has an immediate need to provide greater security to the agency. In providing this higher level of security, the USPTO Security Operations Center (SOC) requires the contractor to increase the level of effort to be able to provide operational Firewall Admin support for the following devices. The USPTO is in the process of deploying new perimeter firewalls (Palo-Alto) and replacing legacy Juniper SRX in the Manassas Datacenter as the new on-prem perimeter firewalls. USPTO has approximately (15) on-Prem perimeter firewall clusters, approximately (20) Contractor Access System (CAS) firewall clusters, and approximately (12) virtual firewalls will be deployed in USPTO private cloud environments to enforce cloud to on-prem and cloud-to-internet egress security policy and monitoring.

Our Mission: “The Office of Procurement is committed to serving as business partners and advisors to the

USPTO community to provide best value goods and services in support of the USPTO’s mission.”

CUI//SP-PROCURE

Controlled by: United States Patent and Trademark Office, OCAO, RICPO, 571-272-9990

Additionally, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) released supplemental High Value Asset Program Supplemental Guidance in October 2022. This states, “AES-Qualified Assessors can be third-party or agency independent assessors. If qualified, agencies shall begin assessing and/or providing alternative reports for their Non-Tier 1 systems once every three years starting in Fiscal Year 2023, Quarter 1 (FY23 Q1).” To maximize the USPTO’s cybersecurity posture, the agency seeks to comply with the CISA policy as well as the Office of Management & Budget Memorandum 19-03, Strengthening the Cybersecurity of Federal Agencies by enhancing the High Value Asset Program, by providing DOC with High Volume Asset (HVA) assessment as soon as possible.

Tier 1 HVAs will be assessed once per year. Non-Tier 1 HVAs will be assessed once every other year, or every three years, depending on the asset tier. Other Non-HVA systems have been included in the schedule on direction of federal leadership and have been included as required to be tested once per year. Moreover, USPTO has the added duty under 35 USC § 122 to maintain the confidential status of patent applications that could be jeopardized by a cyber breach. These require the current vendor to increase the level of effort in the Penetration Testing task. The total price impact of these changes is estimated to be $9,632,183.12 throughout the life of the task order. Since the current vendor is already qualified to do the HVA work, and is completing very similarly scoped work for the USPTO, it is the most logical choice to ensure nearly immediate compliance with the aforementioned policy. If the agency is unable to procure these services from the current vendor, there will be a lengthy schedule delay which could harm the agency’s cybersecurity posture.

Procurement of a new order alone could take up to six (6) months, plus another 1-2 months for onboarding, training, and ramping up of the new task order. The schedule impacts of such a delay would be unnecessary and potentially harmful to the agency. The current contractor already has the necessary qualified personnel and resources to complete the requirements as soon as possible enabling USPTO to achieve a higher state of cybersecurity in a much shorter period of time, thus ensuring the cybersecurity safeguard of commercially sensitive information on its IT network and systems.

4. Any other facts supporting the justification No other facts are necessary to support this limited source justification.

SECTIO N II. CO LLABO RATIO N BETWEEN THE PRO GRAM OFFICE AND OP

5. Authority and supporting rationale: Authority and supporting rationale (see FAR 8.405-6(a)(1)(i)) and, if applicable, a demonstration of the proposed contractor’s unique qualifications to provide the required supply or service.

This acquisition is conducted under the authority of the Multiple Award Schedule Program.

Consideration of schedule contractors will be restricted to fewer than the number required by Federal Acquisition Regulation (FAR) 8.405-6(a)(1)(C).

The USPTO awarded task order #1333BJ22F00280018 to XOR Security, LLC in May 2022. The award included a one-year base period and four (4) one-year option periods, for a total five-year period of performance. The task order was competed under the General Services Administration’s (GSA) Highly Adaptive Cybersecurity Services (HACS) schedule contract to identify the best value vendor in the areas of Experience, Technical Approach, Management & Staffing Approach, and Price. Of the 16 companies that submitted responses to the solicitation, XOR Security was ultimately determined to represent the best overall value to the agency.

Our Mission: “The Office of Procurement is committed to serving as business partners and advisors to the

USPTO community to provide best value goods and services in support of the USPTO’s mission.”

CUI//SP-PROCURE

Controlled by: United States Patent and Trademark Office, OCAO, RICPO, 571-272-9990

Due to recent CISA and OMB guidelines for each agency to provide DOC with High Volume Asset (HVA) assessment, combined with the unforeseen testing requirements mentioned above, there is an immediate need to modify XOR’s task order to add these cybersecurity scope-related requirements. XOR already has existing capabilities and internal expertise necessary to meet the agency’s requirements. Additionally, XOR’s recent and relevant success in securing the task order and performing satisfactorily logically informs the agency’s decision to include these additional tasks into the task order. Considering schedule, funding, and existing institutional knowledge and capabilities, XOR is best positioned to complete this critical work needed to continue the agency’s mission in the immediate timeframe required. No other vendor could become fully mission capable in the short duration needed, and the USPTO does not have the framework in place to award another contract during the necessary timeframe. Any delay or learning curve if competition were held and another vendor selected other than the current incumbent vendor would be detrimental to USPTO’s cybersecurity Mission. Accordingly, in the interest of economy and efficiency, the new requirements represent a logical follow-on to the original competitive federal supply schedule order, which was awarded less than one year ago.

6. Description of the market research conducted among schedule holders and the results, or a statement of the reason market research was not conducted

Prior to awarding XOR’s task order in May 2022, the agency conducted substantial market research identify small and large businesses that could meet the agency’s requirements. The market research included a Request for Information (RFI), which garnered substantial industry interest, with over 80 responses received.

This recent, relevant market research helped shape the requirement, which was competed openly amongst large and small businesses, and eventually awarded to XOR Security, a small business. XOR is still the best choice to complete this critical work needed to continue the mission in a timely fashion. No other vendor could become fully mission capable and USPTO doesn’t have framework in place to award another vendor during the necessary timeframe. Any other choice than the current incumbent vendor would be detrimental to USPTOs cybersecurity mission.

7. Actions, if any, the agency may make to remove or overcome any barriers that led to the restricted consideration before any subsequent acquisition

Only one source will be solicited for the reasons stated in section 5, above. The Government will continue to research the industry for available products and alternatives. This limited sources justification will be posted on SAM.gov, informing the vendor community of the present barriers to competition for this requirement.

SECTIO N III. CO MPLETED BY OP

8. Determination by the ordering activity Contracting Officer that the order will represent the best value to the Government consistent with FAR 8.404(d), and “determination of best procurement approach” consistent with FAR 17.502-1(a)

Pursuant to FAR 8.404(d), GSA has already determined the prices of supplies and fixed-price services, and rates for services offered at hourly rates, under schedule contracts to be fair and reasonable; however, prior to the award of the proposed order, pricing information will be obtained from the proposed contractor and price analysis will be performed and documented to sufficiently determine that the order represents the best value and results in the lowest overall cost alternative (considering price, special features, administrative cost) to meet the Government’s needs.

Our Mission: “The Office of Procurement is committed to serving as business partners and advisors to the

USPTO community to provide best value goods and services in support of the USPTO’s mission.”

CUI//SP-PROCURE

Controlled by: United States Patent and Trademark Office, OCAO, RICPO, 571-272-9990

SECTIO N IV. REVIEW AND APPROVAL

9. Technical Certification

By signature below, the Technical Representative certifies that the supporting data necessary to form the basis for this justification is accurate and complete to the best of their knowledge and belief. Furthermore, the Technical Representative certifies that the justification has been adjudicated by the Program Office and OP.

Technical Representative Digital Signature

10. Contracting Officer’s Certification

By signature below, the ordering activity Contracting Officer certifies that this justification is accurate and complete to the best of their knowledge and belief.

Contracting Officer’s Digital Signature

11. Level above Review (LAR) (see PM 2017-01 for definition) (required for actions valued at or >$700K)

By signature below, the ordering activity LAR certifies that this justification is accurate and complete to the best of their knowledge and belief.

Level Above Review’s Digital Signature

12. Office of General Law (OGL) Counsel (required for actions valued at or >$700K)

By signature below, the ordering activity OGL Counsel certifies that this justification is legally sufficient to the best of their knowledge and belief.

Office of General Law Counsel’s Digital Signature

Users, Daley, Maureen Digitally signed by Users, Daley, Maureen Date: 2023.03.15 08:53:37 -04'00'

Andrew E. Squire Digitally signed by Andrew E. Squire Date: 2023.03.15 15:09:21 -04'00'

Users, Batt, Stephan

Digitally signed by Users, Batt, Stephan Date: 2023.03.16 06:55:47 -04'00'

Our Mission: “The Office of Procurement is committed to serving as business partners and advisors to the

USPTO community to provide best value goods and services in support of the USPTO’s mission.”

CUI//SP-PROCURE

Controlled by: United States Patent and Trademark Office, OCAO, RICPO, 571-272-9990

13. Bureau Procurement Official (BPO)/ Director of OP (or Designee) (required for actions valued at or >$700K)

By signature below, the ordering activity BPO/Director of OP certifies that this justification is accurate and complete to the best of their knowledge and belief.

BPO/Director of OP (or Designee) Digital Signature

14. Competition Advocate Approval: Approval (required for actions valued from $700K to $13.5M)/Concurrence (required for actions valued above $13.5M)

In accordance with FAR 8.405-6(d)(2), the Competition Advocate, certifies that they have reviewed this justification and has determined that sufficient facts exist to support the justification.

Competition Advocate Digital Signature