Signed_LSJ_for_Extension_to_GSA_FSS_Contract_No._GS35F0323J_BPA_No._GS00T13AJA0014_BPA_Call_No._NRC-HQ-10-17-O-0001.pdf

MEMORANDUM TO: Mark Lohrmann, Contracting Officer

FROM: Shalom Nevet, COR, OCIO/SDOD

SUBJECT: LIMITED SOURCES JUSTIFICATION (LSJ)

1. Nature and/or description of the action being approved.

Extension to GSA Federal Supply Schedule (FSS) Contract No. GS35F0323J, Blanket Purchase Agreement (BPA) No. GS00T13AJA0014, BPA Call No. NRC-HQ-10-17-O-

a. Acquisition purpose and objectives. The NRC is required as part of its responsibilities under the Federal Information Security Modernization Act of 2014, to implement the Department of Homeland Security (DHS) Continuous Diagnostics and Mitigation (CDM) Program. The implementation of CDM aligns with the President’s Management Council and NRC Project Aim recommendations, which were accepted by the Commission with our progress being tracked by the NRC Executive Director for Operations. The CDM program will provide the agency with automated information systems security control assessments and provide those deltas, if any that the agency should address to sustain an effective cybersecurity defense-in-depth posture.

Project background. The Government computer networks and systems contain sensitive, safeguards, classified, and personal information. Recent data breaches and the growing numbers and sophistication of cyber-attacks on Federal Government networks are a clear indicator of the efforts and resolve put forth by our adversaries to gain access to this information. Therefore, it is vital that each agency protects the sensitive data, the information systems, and the networks from an attack and theft of data.

However, most agencies are faced with the challenge to provide essential services to their staff and their constituents while protecting the sensitive information. To address this dilemma, the Department of Homeland Security (DHS) and the General Services Administration (GSA) developed the Continuous Diagnostics and Mitigation (CDM) program.

The CDM program is based on a set of tools and sensors that diagnose, assess, and identify threats and provide risk assessment in real-time. The data from the tools and sensors are ingested into the CDM database, analyzed, and then provide the security posture for each system, and for the agency as a whole. The CDM dashboard reports can then alert the network managers to their most critical cyber risks, based on the weighted risk factor. Prioritizing the cyber-threats enable the agency to allocate the required resources based on the severity of the risk.

While in the implementation of the CDM is based on a number of Commercial Off-The- Shelf (COTS) tools, integrating, sorting, and grouping these large amount of data into meaningful singular dashboard was a major challenge for the CDM designers. To solve this challenge, GSA issued a task order in 2015 (GSQ0015AJ0087) which would integrate the data from the security tools and develop the CDM dashboard. HPE was one of the winners (Group E) of this task order, and later was selected by NRC as the CDM integrator due to the on-going development activities in 2018 and the complexity of the CDM environment. In 2017, HPE become Enterprise Services, LLC.

In an effort to promote the CDM program to the all Government agencies, DHS funded the initial phase of the project. However, from March 2017 on, it was the responsibility of each federal Agency to provide the contract vehicle and funding for future enhancements and Operations and Maintenance (O&M) activities for CDM.

Subsequently, the NRC negotiated and awarded GSA FSS Contract No. GS35F0323J, BPA No. GS00T13AJA0014, BPA Call No. NRC-HQ-10-17-O-0001 to the contractor identified below.

Name and address of the proposed contractor(s).

Enterprise Services LLC 13600 EDS Dr A3S-B53 Herndon, VA 20171

2. Description of the supplies or services required to meet the agency’s needs.

OCIO requires an extension to GSA FSS Contract No. GS35F0323J, BPA No.

GS00T13AJA0014, BPA Call No. NRC-HQ-10-17-O-0001 for one year in order to enable the contractor to continue with the implementation of CDM for the NRC. The reasons are explained in the following paragraphs.

In the original design, the CDM project intended to collect a large amount of system security information that would be analyzed and displayed in an agency CDM dashboard that also sent summary data to a federal CDM dashboard hosted at DHS.

This effort required installation of ten new servers involved in data collection and analysis, and due to the complexity of this system the length of time required to troubleshoot configuration issues so that it functioned properly was much longer than anticipated.

Due to limitations of the lab environment provided by the contractor, CDM system configurations could not be adequately tested prior to deployment on the NRC network which further increased time needed for troubleshooting.

As a new development effort, the CDM project lacked a complete architectural vision or concept of operations from U.S. Department of Homeland Security (DHS). For that reason, the CDM project is behind the schedule originally reflected in GSA FSS Contract No. GS35F0323J, BPA No. GS00T13AJA0014, BPA Call No. NRC-HQ-10- 17-O-0001. In July of 2017, the schedule for full deployment was set for Q3-FY17.

In October, this date was shifted to Q1-FY18. In February, 2018, the full deployment was shift to Q3-FY18. The security scan data feed integration into the NRC CDM Dashboard only began to function as required in March, 2018.

Based on the above-mentioned, OCIO requires the following for this extension:

Description

Qty

Unit

Estimated Unit Price

Estimated Amount

Labor - FFP LOE - Data and System Security Analyst / Specialist III effort and Data Integration Manager effort

MO

$31,803.40

$381,640.81

ACT Fee GSA Acquisition, Contracting, and Technical Fee (2%)

MO $636.07 $7,632.82

Estimated Total

$389,273.63

a. Acquisition Information.

• Requirement type.

☒ Information Technology (IT) or Electronic and Information Technology (EIT)

• Type of action.

☒ Follow-on

• Proposed contract/order type.

☒ Firm-fixed-price

• Statement of Work Type Check the appropriate box:

☒ Level of Effort

• Requisition number: OCIO-18-0127

• Total estimated dollar value and performance/delivery period.

$389,273.63 with the period of performance of one year (June 12, 2018 – June 11, 2019)

3. Identification of the justification rationale.

☒ This acquisition is conducted under Federal Acquisition Regulation

(FAR) 8.405-6.

☐ Urgent and compelling need exists ☒ Only one source is capable of providing the supplies or services

(i.e., peculiar item, brand name item) ☐ Logical follow-on

4. Description of the proposed contractor(s) unique qualifications to provide the required supply or service.

The contractor implemented its own unique dataflow capability using its proprietary software uCMDB and JBoss Fuse. These tools ingests and summarizes real-time security status for all NRC information technology components, excluding wireless network access. In addition, the contractor is currently providing the CDM Application Operation and Maintenance (O&M) for the other five agencies under the GSA CDM Phase 1 Task Order. Thus, they are the only responsible source to obtain full CDM Phase 1 continuing development, operational, and administrative support for the NRC.

Without the support of the contractor as the CDM integrator provider, the NRC would suffer unacceptable delays in meeting the requirements to operate and maintain the CDM solution. The contractor is in the process of completing the upgrade to the CDM Dashboard, testing the dataflow under load, and documenting the process for NRC Designated Approving Authority to approve placing the application into production.

As such, the contractor is the only capable entity that has the background, experience and capability to provide application administration and management as soon as this requirement is awarded.

5. Description of the efforts made by the Contracting Officer (CO) to determine that the cost/price of the contract/order is fair and reasonable consistent with FAR 8.404(d) or 15.406-2.

The contracting officer will perform price analysis and will only award the modification to extend GSA FSS Contract No. GS35F0323J, BPA No. GS00T13AJA0014, BPA Call No.

NRC-HQ-10-17-O-0001 if the price is deemed to be fair and reasonable. GSA has already determined the GSA FSS fixed hourly rates to be fair and reasonable, and the CMasS BPA rates are lower than those rates. In addition, as required by FAR 8.405, the ordering activity will consider the level of effort and the mix of labor proposed to perform a specific task being ordered, and will use that information as well as the independent Government cost estimate and the professional judgment from the COR to determine whether the total price is reasonable

6. Description of the market research conducted (see FAR Part 10) and the results, or a statement of the reasons market research was not conducted.

See Section 5 above.

7. Other factors supporting the justification, if any.

The contractor has worked with the NRC to complete testing, security control resolution and documentation for NRC Designated Approving Authority to approve placing the application into production, working with the agency independent security control assessors and other security stakeholders.

8. List sources, if any, that have expressed an interest in the acquisition.

No other sources have expressed an interest in the proposed acquisition.

9. If applicable, describe the actions the agency may take to remove or overcome any barriers that led to the restricted consideration before any subsequent acquisition for the supplies or services is made.

The Acquisition Management Division will closely scrutinize future requests for the same or similar services to ensure that any restrictions to competition are adequately justified, supported and documented.

10. Certifications

By signing below, the COR certifies that the justification is accurate and complete to the best of his or her knowledge and belief.

Contracting Officer Representative

Shalom Nevet Date

This is to certify that the justification for the proposed acquisition has been reviewed and that, to the best of my knowledge and belief, the information and/or data provided to support the rationale and recommendation for approval is accurate and complete.

Contracting Officer

Mark S. Lohrmann Date