GSQ0916BH0070 022 Exeption Fair Opportunity 6month Extension_Redacted.pdf

EXCEPTION TO FAIR OPPORTUNITY

IAW FAR PART FAR 16.505(b)(2)(i)(A)

ACQUISITION ID: 47QFPA16K011

PIID GSQ0916BH0070/Client Order ID: ID09160027

47QFPA16K011 Exception to Fair Opportunity – FOR OFFICIAL USE ONLY - Page 1

The U.S. General Services Administration (GSA) makes this Exception to

Fair Opportunity pursuant to the Federal Acquisition Regulation (FAR)

16.505(b)(2)(i)(A) and in accordance with the prescribed format at 16.505

(b)(2)(ii)(B).

1. Identification of the agency and contracting activity

CONTRACTING ACTIVITY:

U.S. General Services Administration (GSA)

Federal Acquisition Service (FAS)

Assisted Acquisition Service (AAS)

50 United Nations Plaza

2nd Floor North

San Francisco, CA 94102

REQUIRING AGENCY:

U.S. General Services Administration (GSA)

Federal Acquisition Service (FAS)

Assisted Acquisition Services (AAS)

Acting in support of:

Defense Manpower Data Center (DMDC) Seaside, CA 93955-6771

2. Nature and/or description of the action being approved

This Exception to Fair Opportunity is made against task order GSQ0916BH0070 under GSA contract GS-06F-0600Z for Cyber Security and Information Assurance

(CyberIA) Support Services for the Defense Manpower Data Center (DMDC). This task order was awarded to Alliant Information Technologies, LLC (AIT) on

September 23, 2016 and included a 12 month Base period plus four (4) 12 month

Options. The overall period of performance is from September 23, 2016 through

September 22, 2021 and included FAR 52.217-8, Option to Extend Services;

however the 52.217-8 clause was not evaluated at the time of award.

The primary purpose of this action is to incorporate the value of the FAR 52.217-8 clause into the task order through this justification. This clause is used when “the

Government may require continued performance of any services within the limits

DocuSign Envelope ID: 042A76E5-2A2B-42EC-8D81-3B6AD7CB6EA5

47QFPA16K011 Exception to Fair Opportunity – FOR OFFICIAL USE ONLY - Page 2 and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months.”

The Government’s intent is to exercise the option available with FAR 52-217-8, Option to Extend Services with an initial 45 day extension period and to also include three (3) Optional 30 day extension periods, and an additional Optional 45 day extension totaling up to 6 months in accordance with the clause.

The contract type for this task order is a hybrid containing firm fixed price (CLIN

X001), labor hour (CLINS X003 - X006) and Other Direct Costs (ODCs) (CLIN

X002). The extension of this task order will provide continued support for CLINS

X001 and X006 only. The extension will not include the ODC and Optional CLINs

X003-X005. CLIN X001 is for Firm-Fixed Price services related only to Tasks 1-6 of the Performance Work Statement (PWS) and CLIN X006 Labor Hour type that is needed for sustainment of DMDC operational solutions that are provided under

CLIN X001.

3. Description of the supplies/services required (including the estimated value)

Although this task order supports multiple DMDC programs, PWS Tasks 1 through

6 under CLIN X001 and the sustainment portion under Task 10 for CLIN X006 are for the Cybersecurity Support Services and solutions identified below:

Task 1: PROVIDE CYBERSECURITY PROJECT MANAGEMENT SUPPORT

SERVICES

Task 2: CONDUCT CYBER SECURITY ENGINEERING & ARCHITECTURE

Task 3: CONDUCT AUDITING & ASSESSMENT FUNCTIONS (A&A)

Task 4: CONDUCT SCANNING, MONITORING, ANALYSIS & RESPONSE

Task 5: CONDUCT INCIDENT MANAGEMENT & RESPONSE

Task 6: CONDUCT CYBERSECURITY COMPLIANCE SUPPORT FUNCTION

Task 10: CONDUCT FUTURE PROJECT MIGRATION AND SUSTAINMENT

The extension of this task order will provide DMDC continued support for protection of critical infrastructure, assurance of agency information and operations that protect and defend information and information systems by ensuring confidentiality, integrity, accountability, restoration, authentication, nonrepudiation, protection, detection, monitoring and event react capabilities.

47QFPA16K011 Exception to Fair Opportunity – FOR OFFICIAL USE ONLY - Page 3

The work under this task order for cyber security provides support that spans the entire spectrum of existing and future technical environments, hardware and software systems, and applications lifecycle in support of both its Unclassified Non-secure Internet Protocol Router Network (NIPRNET) and Classified Secure

Internet Protocol Router Network (SIPRNET) environments.

The total period of performance of the task order extension is six (6) months, from

September 23, 2021 through March 22, 2021, if the additional periods are exercised.

The total estimated value of a 6 month extension is . Calculated separately, the estimated value for each sub-period is:

Initial 45 day extension period, ;

Optional 30 day extension period, ;

Optional 30 day extension period, ;

Optional 30 day extension period, ;

Optional 45 day extension period, ;

Total estimated value for 6 months, .

4. Identification of the exception to fair opportunity (see 16.505(b)(2)(i)(A)) and the supporting rationale, including a demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the exception cited.

Statutory Authority

The action is to be conducted under the authority of Federal Acquisition Regulation

(FAR) Subpart 16.5—Indefinite-Delivery Contracts, in accordance with the

Exceptions to the fair opportunity procedure 16.505(b)(2)(i)(A) – The agency need for the supplies or services is so urgent that providing a fair opportunity would result in unacceptable delays.

Supporting Rationale

In , DMDC will undergo a cybersecurity inspection of its on-premises and remotely managed data centers. Failure of this inspection could result in the disconnection of all systems and services hosted in these data centers from the

Department of Defense network.

47QFPA16K011 Exception to Fair Opportunity – FOR OFFICIAL USE ONLY - Page 4

The mission essential cybersecurity services being provided under this extension serve to protect the Government from costly cyber breaches. In the current cyber environment, any break in service would be unacceptable and will have severe monetary and operational consequences. It is estimated that the average cost per cyber incident is approximately . Due to the pandemic, a large percentage of DMDC employees currently work remotely, which increases the average cost per cyber incident. If DMDC did not have these essential services and a breach occurred or the inspection failed and systems had to be disconnected, service members may be left unable to access medical benefits/entitlements, pharmacy services, and medical care. Aside from health protection risks, any disconnect of these systems could open the DoD to civil lawsuits related to healthcare benefits/entitlements, introducing an additional avoidable financial risk for the Government.

GSA has issued solicitation #RFQ1517475 for the follow-on cybersecurity support.

This competition is scheduled to award September 23, 2021, however any break in service or knowledge gap due to delays in transition and onboarding, protests, or any other acquisition challenges would be catastrophic to the DMDC mission.

Contractor Qualifications

An extension issued to Alliant Information Technologies, LLC (AIT) has been determined to be the only short term procurement solution that is able to provide inspection support in , sustainment of DMDC operational solutions, and continuity of service through the transition to another contract. In addition, because this existing contract does not provide direct support of all new DMDC cybersecurity requirements that will be needed due to the impending inspection, support from AIT for the legacy data centers is paramount in providing the continuity of support while the new contractor prepares for new cybersecurity upgrade requirements and the broader scope of support. In the event an award cannot be made, the Government may need to extend the services for up to 6 months due to the risks outlined above.

47QFPA16K011 Exception to Fair Opportunity – FOR OFFICIAL USE ONLY - Page 5

AIT, is the only company postured to provide continuity of service and sustainment for the highly specialized DMDC effort. AIT has been the primary provider of cybersecurity services to the DMDC enterprise since 2016, providing cybersecurity support to DMDC’s legacy data centers and user base and is uniquely qualified to manage and maintain the DMDC Cybersecurity program.

AIT has developed, implemented, and supported the processes, procedures and systems that will be reviewed during this inspection. No other vendor could feasibly onboard personnel and establish the level of support required to support this audit between the end of the current Period of Performance (September 23, 2021) and the inspection start date It is in the best interest of the Government to have AIT continue supporting and sustaining the legacy infrastructure, to include DMDC deployed and operational solutions subject to inspection, at least through the conclusion of the inspection, and possibly through the period needed to remediate the findings within the legacy data centers.

5. A determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

GSA has already determined AIT’s current rates to be fair and reasonable at the exercise of the Option Term 4. In accordance with the requirements for FAR clause

52.217-8, the price for any extensions will be at half of the current term’s price.

6. Description of the market research conducted and the results or a statement of the reason market research was not conducted

Due to this justification supporting an extension under FAR clause 52.217-8, no additional market research was conducted for this action as a modification for the extension will be issued to the incumbent contractor for this task order based on the rationale described herein.

For the long term solution, a competitive follow-on acquisition is in process with

GSA. Market Research for the follow-on requirement was and suitable sources were identified and competition is expected. The follow-on competitive requirement will be awarded under the newly formed Highly Adaptive Cybersecurity Services

(HACS) SIN 54151 NAICS vehicle. Contractors under the vehicle chosen will need to be proficient in the use and maintenance of DoD and industry standard cybersecurity tools.

7. Any other facts supporting the justification

47QFPA16K011 Exception to Fair Opportunity – FOR OFFICIAL USE ONLY - Page 6

None

8. Statement of action to remove barriers to competition that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made.

This exception to fair opportunity action serves only as an interim solution to provide the continuity of mission critical services until the new procurement can be awarded and any support required for the DMDC inspection can be provided. The performance period is limited to six-months, with an initial 45 day option. The initial 45 day period will ensure continued cybersecurity support through an upcoming cybersecurity audit. Further optional periods of performance will be in place to ensure no breaks in service while the competitive, long-term contract for continued support is awarded.

9. Client Agency Representation and Technical Certification

I hereby certify that the technical facts and representation under my cognizance which are in this justification document which are in this justification document which form a basis for this justification are accurate and complete to the best of my knowledge and belief.

Donna Naulivou Date

Director, Cybersecurity Division

Defense Manpower Data Center

10. GSA Project Manager’s Certification

I hereby certify that the facts and representation under my cognizance which are included in this justification document and which form a basis for this justification are accurate and complete to the best of my knowledge and belief.

DocuSign Envelope ID: 042A76E5-2A2B-42EC-8D81-3B6AD7CB6EA5

9/16/2021

47QFPA16K011 Exception to Fair Opportunity – FOR OFFICIAL USE ONLY - Page 8

U.S. General Services Administration

REVIEWED BY:

Joel Fada Date

Assisted Acquisition Services Director

Contracting Division (9FQA)

U.S. General Services Administration

Competition Advocate Approval

APPROVED BY:

I have reviewed this Justification for an Exception to Fair Opportunity and find it to be accurate and complete to the best of my knowledge and belief. Since this justification does not exceed $13.5M, this review serves as approval.

Jacqueline Sullo Date

Competition Advocate

Acquisition Oversight Division

U.S. General Services Administration

DocuSign Envelope ID: 042A76E5-2A2B-42EC-8D81-3B6AD7CB6EA5