LSJ_Final_redacted.pdf

LIMITED SOURCES JUSTIFICATION

REQ. NO. NSIR-19-0061

1. Nature and/or description of the action being approved.

Noncompetitive increase in scope for task order

a. Acquisition purpose and objectives.

The U.S. Nuclear Regulatory Commission’s (NRC) Office of Nuclear Security and Incident Response (NSIR) requests a noncompetitive modification to Contract GS35F0229K, Task Order NRC-HQ-11-14-T-0002 with Oasis Systems, LLC (“Oasis”) to extend the period of performance by thirteen months, to December 31, 2020, to support the remaining Milestone 8 Full Implementation Cyber Security inspections and the completion of the Assessment of the Power Reactor Cyber Security Program. NSIR also requests an increase in the task order ceiling price in the amount of $4.2 million to cover the costs of anticipated requirements for that extension period.

b. Project background.

In 2009, the NRC published the cyber security rule, 10 CFR 73.54 “Protection of Digital Computer and Communication Systems and Network.” The cyber security rule is a performance-based programmatic requirement that ensures the functions of digital computers, communication systems, and networks associated with safety, important-to-safety, security, and emergency preparedness are protected from cyber-attacks. The cyber security rule requires licensees and license applicants to submit a cyber security plan describing how security measures will be implemented to comply with the requirements of the rule. Regulatory Guide (RG) 5.71 “Cyber Security Programs for Nuclear Facilities,” was developed to provide guidance for implementing the requirements of 10 CFR 73.54. Nuclear Energy Institute (NEI) developed NEI 08-09, “Cyber Security Plan for Nuclear Power Reactors,” which provided an industry-developed template that licensees could use when submitting their Cyber Security Plans to the NRC for review and approval. The NRC endorsed Revision 6 to NEI 08-09. During 2011, the Temporary Instruction 2201/004 was developed for the Inspection of the Interim Cyber Security Milestones 1-7 and the Inspection Manual Chapter 0609, Appendix E, Part IV, “Cyber Security Significance Determination Process was developed to evaluate the findings resulting from the cyber security inspections.

In September 2017, the NRC informed NEI that an assessment of the cyber security rule, associated guidance and licensee’s implementation would be conducted once the NRC completed approximately one third of the full implementation inspections. NSIR is currently conducting the assessment and expects to complete the assessment and provide recommendations to the NRC Commissioners for consideration no later than December 31, 2019.

The conclusion of the assessment may result in recommendations from the NRC Commissioners or staff for future rulemaking and/or revisions to guidance documents and/or changes to the NRC cyber security inspection program.

Additionally, extending the task order to December 2020 will allow the Contractor to provide the Advanced Cyber Security training course, which is anticipated to be required from March 10, 2020 to March 19, 2020 at the NRC’s Technical Training Center in Chattanooga, Tennessee.

The course will provide the tools to enable NRC inspectors to effectively assess the implementation of NRC cyber security requirements at nuclear power plants. The course is required for Cyber Security inspector’s qualification in accordance with Inspection Manual Chapter 1245, Appendix C14.

c. Name and address of the proposed contractor(s).

Oasis Systems, LLC 24 Hartwell Avenue Lexington, MA 02421

2. A Description of the supplies or services required to meet the agency’s needs (including estimated value).

See Section 1 above

3. The authority and supporting rationale (see 8.405-6(a)(1)(i) and (b)(1)) and, if applicable, a demonstration of the proposed contractor’s unique qualifications to provide the required supply or service.

Only one source is capable of providing the supplies or services

4. Description of the proposed contractor(s) unique qualifications to provide the required supply or service.

1. Oasis has significant experience under the task order that it gained from being contracted to conduct 58 percent of the full implementation inspections for nuclear power plants on behalf of the NRC in 2017, 2018 and to date in 2019.

2. Oasis was instrumental in the development of RG 5.71 - they supported the regional inspectors on all of the Interim Cyber Security Inspections and have taught the Advanced Cyber Security Course on behalf of the NRC for four years.

3. Oasis personnel possess site access authorization that grants them access to all the power reactor sites for 5 years. The site access authorization process take several months for contractor personnel to request and obtain, and if the NRC were to contract with a different source other than Oasis to complete the work described in Section 1 of this document may cause unacceptable delays. Furthermore, Oasis personnel possess all the clearances, requisite training, and skills to conduct the cyber security inspections. Completing the requisite training can take several months because there are often few or no available vacancies in the courses when one comes on board. The site access authorization, inspector qualification training and the requisite knowledge of the systems used by the nuclear power plants can take up to a year for contractor personnel to obtain.

If a new contractor was selected to begin work after the current task order with Oasis expires on October 31, 2019, the completion of the Full Implementation inspections would be delayed and additional costs would be incurred by the NRC. Having Oasis conduct the remaining full implementation inspections ensures that the remaining NRC nuclear power plant licensees will be inspected in a methodology that is consistent with the inspections received by the other NRC nuclear https://acquisition.gov/content/part-8-required-sources-supplies-and-services#i1117840 power plant licensees and that the issues identified will be adjudicated in a similar fashion without an unacceptable delay or increase to public safety. Additionally, with the requested task, the Technical Training Center will be able to offer the Advanced Cyber Security Course planned for March 2020 without having to rework the course with another contractor. As a result, NRC cyber inspectors who require the training to maintain their inspector qualifications will not experience any delays to maintain critical, mandatory certification credentials.

5. A determination by the ordering activity contracting officer that the order represents the best value consistent with 8.404(d).

GSA already determined the fixed hourly rates in Contract No. GS35F0229K to be fair and reasonable. In addition, the contracting officer will ensure that the of proposed labor categories and associated hourly rates for the extension period are appropriate for the work to be performed to determine whether the total increase to ceiling price is fair and reasonable.

6. A description of the market research conducted among schedule holders and the results or a statement of the reason market research was not conducted.

For the reasons cited in section 4 above, no market research was conducted for this request.

However, appropriate market research will be conducted and documented before any acquisition to replace the extended task order is conducted.

7. Other factors supporting the justification, if any.

At the completion of the remaining Milestone 8 inspections, the NRC will make decisions about the future of the NRC’s cyber security program and how it will fit into the NRC’s Reactor Oversight Program. An assessment is currently underway with the intent of reporting the results of the assessment to the NRC Commissioners by December 31, 2019. With so many factors left to be assessed at this time, developing the requirements for a new procurement is premature at this time.

8. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the restricted consideration before any subsequent acquisition for the supplies or services is made.

The Acquisition Management Division will closely scrutinize future requests for renewal of Nuclear Security & Incident Response (NSIR) Cyber Security Regulatory Program and Development Support (CSRPDS) and will ensure that any restrictions to competition are adequately justified and to ensure that any restrictions to competition are adequately documented and supported.

https://acquisition.gov/content/part-8-required-sources-supplies-and-services#i1117401

9. Certifications

By signing below, the COR certifies that the justification is accurate and complete to the best of his or her knowledge and belief.

Contracting Officer Representative

Shyrl Coker

This is to certify that the justification for the proposed acquisition has been reviewed and that, to the best of my knowledge and belief, the information and/or data provided to support the rationale and recommendation for approval is accurate and complete.

Contracting Officer

Jessica Chu

CONCUR:

Branch Chief

Joseph L. Widdup

APPROVAL:

Acting Head of Contracting Activity

Monique B. Williams