GSQ0015AJ0041_CMaaS_TO2A_LSJ_9.12.16_(1).pdf

General Services Administration

Federal Systems Integration and Management Center

LIMITED SOURCES JUSTIFICATION

CEILING INCREASE NEEDED TO COMPLETE CDM INSTALLATION

RELATING TO TASK ORDER 2A DHS COMPONENTS

TASK ORDER GSQ0015AJ0041

The General Services Administration (GSA) makes this Limited Sources Justification (LSJ) for orders pursuant to Federal Acquisition Regulation (FAR) 8.405-6.

i.) Identification of Agency and Contracting Activity:

Agency:

General Services Administration (GSA) Federal Systems Integration and Management Center (FEDSIM) Acting in support of: Department of Homeland Security (DHS) Components Supported by Task Order 2A

Contracting Activity:

GSA FEDSIM Contracting Office 1800 F Street, NW Suite 3100 (QF0B) Washington, D.C. 20405 ii.) Nature and/or Description of Action Being Approved:

Knowledge Consulting Group (KCG) competed for and is currently working all aspects of Task Order (TO) 2A under GSQ0015AJ0041, which provides support to the following DHS components:

1. Customs and Border Protection (CBP)

2. Headquarters (DHS HQ)

3. Federal Emergency Management Agency (FEMA)

4. Federal Law Enforcement Training Center (FLETC)

5. Immigration and Customs Enforcement (ICE)

6. National Protection and Programs Directorate (NPPD)

7. Office of Inspector General (OIG)

8. Science and Technology Directorate (S&T)

9. Transportation Security Administration (TSA)

10. United States Coast Guard (USCG)

11. United States Citizenship and Immigration Services (USCIS)

The objective of TO2A is to design, configure, and operate a Continuous Monitoring as a Service (CMaaS) Solution for the eleven DHS components identified within this TO that complies with applicable standards and demonstrates improved detection and analysis of Information Technology (IT) security events in cooperation with the DHS Continuous Diagnostic Mitigation (CDM) Program Office and the DHS components (as the CDM end users in this TO).In the TO2A solicitation the contractor was provided a High-level IT and network infrastructure summary for each component supported by this TO in Section 9, TO Attachment G - D/A IT/Network Environment Summary Information (TO Para 2.4).

Additionally, the contractor was afforded the opportunity to review more detailed component information in “Reading Rooms” prior to submission of their quote.

Because of the inherent difficulty in providing accurate and exhaustive component information prior to award, the TO solicitation placed offerors on notice that the requirements might change (increase) post-award as a result of the outcome of the contractor’s analysis of the eleven DHS components’ existing infrastructure. Section

2.6.2.1 of the TO directed the contractor to perform an “as is” analysis of each component’s actual infrastructure. The intent of SUBTASK 2.1 was to validate the accuracy of the D/A (hereafter referred to as “component” as TO2A supports components within DHS as opposed to other TO2 task orders which support multiple different departments and agencies ) provided data to ensure the contractor’s solution had sufficient quantities of tools to fill gaps in component tools licensing and to ensure the contractor is able to correctly size and configure any new tools and licensing appropriately to be able to successfully perform the mission of the CDM program.

The terms of the task order dictate that the contractor shall submit Problem Notification Reports (PNR) notifying the FEDSIM CO and FEDSIM COR of any problems during the course of performance, such as potential cost/schedule overruns/impacts and significant technical issues, within one day of the problem being identified. In the event the contractor discovered discrepancies between the actual infrastructure and information provided by components with the solicitation, the contractor was instructed to report these discrepancies in a Problem Notification Report (PNR), KCG submitted the required PNR regarding variances in DHS infrastructure, which identified discrepancies between the IT/Network Environment Summary Information data provided by the DHS components prior to award, and the actual infrastructure found during the discovery phase of performance. The tool variance and corresponding labor for integration services within the base year of the task order constituted an increase of $1,350,847 or 8% to the total value of the task order base year. A modification was executed within the base year which realigned ceiling in order to accommodate the increase resulting from discovery activities, with no change to the total estimated value of the task order.

Due to the increase in quantities of tools resulting from discovery as described above, as well as product substitutions that occurred in the base period of the task order (which are described later in this document in the supporting rationale), an increase of $919,121 is needed to the CDM Product and Product Maintenance CLINs in the out years of the task order to ensure that the products purchased within the base period are properly supported.

Additionally, due to substantial delays experienced within the base year of the task order and that were primarily Government-caused; the labor CLINs in the out years of the task order must be increased by $8,183,366 in order to ensure that the CMaaS solution is successfully implemented within the remaining period of performance, assuming the exercise of all option years. Collectively, these amounts for tools and labor constitute an increase of $9,102,487 or 31% to the current task order value of $29,054,775.

iii.) A Complete Description of Supplies/Services Required to Meet Agency’s Need:

TO2 services and tools required include:

• Task 1: Provide Program Management: This includes the management and oversight of all activities performed by contractor personnel, including subcontractors, to satisfy the requirements identified in the Statement of Work

(SOW).

• Task 2: CMaaS Solution Technical Planning: Provide the proposed approach to implementing CDM Phase 1 of the CMaaS Solution. Integrate CDM methods into a sufficiently detailed plan to ensure successful implementation.

• Task 3: Support CDM Dashboards. Install, configure, and maintain each release of the DHS-provided CDM Dashboard for use by the components. Provide quality assurance and technical testing of each release of the delivered CDM Dashboard;

CDM Dashboard technical services; and CDM Dashboard Tier Two Help Desk support.

• Task 4: Provision the CMaaS Solution. Procure and deliver CDM tools and sensors as identified in the Bill of Materials (BOM). Identify, procure, and deliver any ancillary IT hardware or software as needed. Prepare a Resource Requirements document for any Government-furnished equipment (GFE).

• Task 5: Configure and Customize the CMaaS Solution. Install, configure, and customize the CMaaS Solution, including tools, sensors, and any ancillary IT hardware and/or software. Design the Solution for minimal network performance impact.

• Task 6: Maintain Data on Desired State for CMaaS Solution. Work with DHS and the components and incorporate desired state information in the CMaaS Solution.

Desired States are system or process configuration rules, e.g., “if software product X is present, setting Z should have value Y”; “if software X is present, it should have the following patch levels”; and so on.

• Task 7: Operate the CMaaS Solution. Operate the configured CMaaS Solution, including the installed suite of CDM tools and sensors. Provide Tier Two and Three Help Desk for the CMaaS Solution. Prepare a plan for production operations;

perform production operations; prepare a plan to transition operations to each component and the components’ IT support contractors. Transition operations to each component and their respective support contractors. Perform system administration.

• Task 8: Integrate CMaaS Solution with component Legacy Applications. Make use of existing component IT security tools; integrate these tools with tools and sensors provided under this TO. Exchange data between the CMaaS Solution and component legacy applications.

• Task 9: Operate Data Feeds Between the CMaaS Solution and CDM Dashboards.

• Task 10: Provide Governance Support and CDM Program and CMaaS Solution

Training.

• Task 11: Conduct Testing. Support IV&V activities performed by other parties and support system authorization to operate (ATO).

iv.) The Authority and Supporting Rationale:

The acquisition is conducted under the authority of the Multiple-Award Schedule Program. Consideration of schedule contractors will be restricted in accordance with:

o FAR 8.405-6(a)(1)(i)(A) - An urgent and compelling need exists, and following the procedures would result in unacceptable delays.

As discovery activities were underway in the base year of the task order, KCG submitted multiple PNRs between September of 2015 and April of 2016, all of which alerted the Government to significant problems arising from Government-caused delays and extenuating circumstances that were beyond the contractor’s control. These significant problems included the following:

1) The Office of Personnel Management’s e-QIP application was down for an extended period of time, which caused significant delays in DHS making suitability determinations for KCG staff, thereby hampering progress on a range of critical task order activities.

2) The KCG technical solution that was accepted during source selection required the DHS management enclaves to be hosted on top of the DHS Infrastructure as a service solution (Infrastructure as a Service or IaaS). The IaaS environment was being procured and set up on behalf of DHS through a third-party vendor outside of this task order and that procurement was delayed for months. The availability of this service is on the critical path in the implementation of KCG’s solution and therefore delayed activities that were crucial to KCG’s ability to stay on their originally proposed schedule.

3) The task order requires the contractor’s technical approach and corresponding schedule to align with the DHS Software Engineering Lifecycle (SELC) process, which identifies different phases of the SELC that the contractor must successfully complete prior to proceeding to a subsequent phase. A pilot deployment of KCG’s solution within the DHS environment is a mandatory part of the Production Readiness Review, a critical milestone in the SELC. Requests to Initiate Purchase (RIP) for procuring the products necessary for the pilot deployment of TO2A required delivery information (i.e. DHS shipping address and DHS Points of Contact who will be accepting the products). This information was not provided to the KCG team for an extended period of time, thereby delaying these products from being purchased for months and preventing the PRR from being scheduled. For every day the RIPs were not approved and the pilot products had not been purchased, there was a one-for-one schedule delay experienced. The provision of this critical information resulted in a four month-long delay, and became available only near the end of the task order base year, providing KCG just enough time to procure all necessary products. As a result, PRR was forced to be pushed into option year 1, which had a cascading impact to the schedule for all remaining critical SELC milestones that must occur after PRR in order for the contractor to fully implement its solution.

4) The KCG TO2A solution initially used the McAfee Vulnerability Manager as the tool to deliver Vulnerability Management capability as required by the task order. In December 2015, McAfee (now known as Intel Security) announced that the MVM product would be End-of-Life and no longer sold as of January 2016. The team had to identify a replacement product for MVM to deliver VUL capabilities that will be supported throughout the life of the contract. This process took well over a month to complete, resulting in an alternative product being selected for the replacement of MVM and had further impacts to schedule due to integration and testing of the product into the KCG architectural baseline.

5) The KCG 2A CMaaS solution could not directly connect to monitor assets on the planned host network for The National Cybersecurity Protection System (NCPS) (referred commonly as the Mission Operating Environment). This is a separate and distinct network segment operating autonomously for the DHS OneNet network that hosts (among other applications) the CDM Federal Dashboard and it is not directly accessible by the enterprise CMaaS solution hosted within the DHS DC1 Datacenter on Infrastructure as a Service. The solution development and design required additional engineering time, hardware costs, and changes to configuration, security settings, and potential system boundary impacts.

The set of problems identified above have dealt a major blow to the original schedule baseline which KCG was working against, and have now moved the projected dates for critical task order activities necessary to pass DHS SELC milestones far beyond the base year of the task order. However, KCG has diligently worked through the numerous complexities and issues they encountered in the base year, and now has a path forward to complete the deployment of their solution to all 11 DHS components supported by this task order. With the proposed increase identified earlier in this justification, the contractor currently projects that the complete deployment and integration of its solution, marking full transition to operations, will be realized by the end of December 2017. It is critical that the ceiling increase is executed as soon as possible, as the contractor’s proposed strategy to augment its staff by an increased number of Full Time Employees (FTEs) across the critical functional areas of engineering, deployment management, governance support, communications management and ISSO support assumes this necessary ramp-up in staffing will occur in September of 2016. The level of effort and associated labor ceiling currently reflected in task order option years one and two is not sufficient to sustain contractor performance of critical activities associated with these functional areas. The originally proposed level of effort in the task order option years was predicated on the vast majority of tasks involving technical planning and deployment being completed in the base year, with a reduced level of effort in each subsequent option year, reflecting a transition to a steady-state and a corresponding level of effort for operations and maintenance related activities. Any additional delay would be unacceptable and pose a severe threat to the successful completion of the project, as the next critical SELC milestone is set to occur in early October of 2016. If this milestone is missed due to lack of sufficient contractor resources, the entire schedule for deployment of the solution will slip. The last option year of the task order expires in early June of 2018 and the project cannot afford any further delays based on the contractor’s new schedule baseline for completion.

If normal schedule procedures were to be followed and a new procurement were to be conducted, TO2A would fail with absolute certainty. Conducting a new competition for the work associated with the increase proposed in this justification would be futile, as the level of effort is only a fraction of the total effort it would take for a new contractor to successfully complete all of the mandatory tasks required by the task order. Re-competing the entire effort would require a series of contract actions which would initially involve a termination for convenience of the current effort, and a new acquisition starting from scratch. Given the complexity of the requirements and FEDSIM’s experience with award of the current task order, this would take no less than six months. The impact to DHS would be catastrophic from all standpoints, as they would be at least one year away from implementing the standardized cybersecurity capabilities and automated FISMA compliance reporting required by OMB mandates and internal DHS policy. New funding would need to be secured by DHS to repeat the acquisition and also to fund a new task order, under which an incoming contractor’s efforts would be entirely redundant. Additionally, considering that DHS has responsibility for overseeing and assisting Government-wide and agency-specific efforts to provide risk-based and cost-effective cybersecurity, per Office of Management and Budget (OMB) Memorandum 10-28 and M-14-03 via the CDM program, the political ramifications of incurring such delays would cause serious harm to the program and DHS PMO as the lead entity responsible for implementing the very services and capabilities being acquired under this task order across all agencies in the Federal civilian.gov networks. There is no follow-on procurement anticipated at the end of this task order, as the full operations of the solution designed and implemented by KCG will be fully transitioned to DHS staff.

v.) Determination by the Ordering Activity Contracting Officer that the Order Represents the Best Value Consistent with FAR 8.404(d):

Based on the data gathered, the Contracting Officer (CO) has determined that, after considering the LOE and the mix of skills available for the tasks needed, that the proposed value of the increase represents a reasonable total price and will be the best value for the agency.

The prices on TO2A were evaluated at the time of award in June 2015. The CO determined then that those prices were fair and reasonable using three price analysis methods:

comparison of competitive pricing, comparison to published pricing on the BPA, and comparison to the Government’s estimate.

The prices for both products/tools and labor were significantly discounted on TO2A and the proposed prices for this action are discounted at similar levels. The additional products do not increase the quantities of products and tools to levels that would warrant additional volume discounting. The labor mix consists of categories already established within the TO and at the specified rates, which were negotiated at time of award. The proposed increase in the level of effort to successfully complete the project has been evaluated by both technical experts at DHS and the FEDSIM CO, both of whom concur with the contractor’s proposed increase in LOE across pertinent task areas of the TO.

Synopsizing the solicitation is not required due to FAR 5.202(a)(11). The proposed contract action is made under the terms of an existing contract that was previously synopsized in sufficient detail to comply with the requirements of 5.207 with respect to the current proposed contract action.

vi.) Description of the Market Research Conducted Among Schedule Holders and the Results of the Research:

Market research was not conducted because the adjustment was part of the TO defining process.

vii.) Any Other Facts Supporting the Justification (if any):

All relevant facts have been identified and discussed elsewhere in this justification.

viii.) Statement of the Actions the Agency May Take to Remove or Overcome any Barriers that Led to the Restricted Consideration Before Any Subsequent Acquisition for the Supplies or Services is Made:

None. As stated in Section IV of this document, there is no follow-on procurement anticipated at the end of this task order, as the full operations of the solution designed and implemented by KCG will be transitioned to DHS staff.

ix.) Contracting Officer Certification that the Justification is Accurate and Complete to the Best of the Contracting Officer’s Knowledge and Belief:

I hereby certify that this justification is accurate and complete to the best of my knowledge, and determine on the basis of the findings above that the limited sources approach is in accordance with the requirements and is in the best interest of the Government.

Brendan McDonough Contracting Officer FEDSIM Acquisition, Civilian Sector x.) Evidence that any Supporting Data that is the Responsibility of Technical or Requirements Personnel and Which Form a Basis for the Justification Have Been Certified as Complete and Accurate by the Technical and Requirements Personnel (If Any):

None.

xi.) Written Determination by Approving Officials Identifying the Circumstance that Applies

I hereby certify that this justification is accurate and complete to the best of my knowledge, and determine on the basis of the findings above that the task order ceiling increase is in accordance with the requirements and is in the best interest of the Government.

Tom Howder AAS Head of Contracting Activity