Redacted_copy.pdf

Air Defense Communication Services 3

Page 1 of 9 Pages

LIMITED SOURCE JUSTIFICATION AND APPROVAL (J&A)

FEDERAL ACQUISITION REGULATION (FAR) PART 8 ACQUISITIONS

Multiple Award Schedule (MAS)/Multiple Award Contract

Orders under MAS/General Services Administration (GSA) Schedules/Federal Supply Schedules

(FSS) FAR 8.405-6

Purchase Request Number: To Be Determined

Contract Number: HC1013-15-A-0004

Task/Delivery Order Number: TBD

Procurement Title: Air Defense Communication Services 3

Estimated Value:

Limited Source Authority: FAR 8.405-6(a)(1)(i)(C)

LIMITED SOURCE JUSTIFICATION

J&A Number:

Upon the basis of the following justification, I, as the Procuring Activity Competition Advocate, hereby approve this limited source justification in accordance with FAR 8.405-6(a)(1)(i)(C).

The acquisition referenced herein is conducted under the authority of the MAS program.

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

a. Requiring Agency:

Continental United States (CONUS) North American Aerospace Defense Command

(NORAD) Region (CONR)

HQ First Air Force-Air Forces Northern (1 AF/AFNORTH)/A6CT

1210 Beacon Beach Road

Tyndall AFB, FL 32403

ALASKAN NORAD REGION (ANR)

611 ACOMS/SCX

10471 20th St., STE 236

Joint Base Elmendorf-Richardson AK 99506-2270

Hawaiian Air Defense Sector (HADS)

169th A CWS

360 Harbor Drive

Wheeler Army Air Field, Mililani HI 96853

b. Contracting Activity:

Defense Information Systems Agency

Defense Information Technology Contracting Organization (DITCO)/PL8223

2300 East Drive

Scott AFB IL 62225-5406

Page 2 of 9 Pages

2. NATURE/DESCRIPTION OF ACTION(S):

This request is to modify blanket purchase agreement (BPA) HC1013-05-A-0004 to have the vendor, General Dynamics Information Technology (GDIT) implement Cyber Security as a new task. Cyber Security is required to be implemented in all systems per governance detailed in

Department of Defense (DoD) Instruction 8501.01 (Risk Management Framework), DoD

Cybersecurity Discipline Implementation Plan, DoD Guidance on Cybersecurity Implementation in Acquisition Programs, Air Force Instruction (AFI) 35-200 (Cybersecurity Program

Management) and AFI 35-210 (United States Air Force (USAF) Certification and Accreditation

Program).

BPA HC1013-05-A-0004 was competitively awarded on September 16, 2015 to GDIT via formal source selection procedures as they were determined to be the best value provider of these services. The contract is a Federal Supply Schedule contract BPA using Firm Fixed Price (FFP) and Cost-Reimbursable (CR) CLINs for maintenance and system changes along with CR CLINs for travel expenses. The contract was awarded with a base period of performance (POP) of

September 16, 2015 to March 31, 2016 and four 1-year options. The contract’s not-to-exceed

(NTE) ceiling was set at as established in the Acquisition Plan that was approved by the

DITCO Head of the Contracting Office on September 15. 2014.

The estimated increase for cyber security is for the lifecycle of the BPA. This contract modification will use fiscal year (FY) 17 through FY19 operations and maintenance

(O&M) funding. The estimated amount for cyber security falls within the original NTE ceiling of the ADCS3 contract. There is no need for an increase to the NTE ceiling with the addition of the cyber security requirement.

ADCS3 supports the mission of maintaining interoperable Command and Control (C2) of aerospace defense, air sovereignty and counter-terrorism for the United States (U.S.), territories and provinces to include those in the Pacific and Caribbean. North American Aerospace

Defense Command (NORAD) and United States Northern Command (USNORTHCOM, or

NORTHCOM) are tasked for North America. Commander, NORAD (CDRNORAD)

/Commander USNORTHCOM requires mission performance on a 365/24/7 basis. The Pacific

Command (PACOM) is tasked for Pacific area air defense 365/24/7. C2 consists of processing data, voice and other sensor and information inputs into capabilities that commanders utilize to direct assets in the prosecution of the mission.

The systems supported by this contract are essential to the National Security of the U.S.. Due to the nature and criticality of the missions supported by ADCS3, including maintaining C2 of airspace defense, air sovereignty, and supporting Homeland Defense/Security and counter-terrorism; the DoD cannot afford any service interruption. Modifications and maintenance of the air defense systems that are employed to defend U.S. airspace are vital to the National Security and of utmost importance to the U.S. Government and the American people.

3. DESCRIPTION OF SUPPLIES/SERVICES:

The ADCS3 contractor is responsible for end-to-end single system management (SSM), day-to-

Page 3 of 9 Pages day maintenance, preventative maintenance, configuration management, testing, sustaining engineering, logistics support, and hardware life cycle status reporting of the communications transport and switching equipment used to move radar data and voice communications from remote radio, radar sites, Air Traffic Control (ATC) and Air Combat Alert (ACA) facilities. The radar data is accepted from the remote site by the contractor, configured for transport on long haul circuits or satellite communications and then accepted by the contractor at the Air Defense

Sectors (ADS) or Air Operations Centers (AOC) where it is configured and forwarded to the radar display/operator C2 system. Voice communications are accepted from the remote radio sites by the contractor, ATC, C2 and ACA facilities and transported by Government or commercial long haul circuits and then accepted by the contractor at the ADSs or AOCs where they are configured, recorded and forwarded to the voice operator consoles. Additionally, the contractor will maintain the voice telephone switch and telephony throughout the ADSs and

AOCs and redistribute radar data and voice communications to Government designated secondary users.

The fixed air defense locations are the CONUS NORAD Region (CONR) Combined Air

Operations Center (CAOC) (CONR CAOC) and the Systems Support Facility, Tyndall AFB

Florida; the Eastern Air Defense Sector (EADS) in Rome, New York; the Western Air Defense

Sector (WADS), Joint Base Lewis-McChord, Tacoma, Washington; ANR CAOC and Alaska

ADS, Joint Base Elmendorf-Richardson, Anchorage Alaska; and Hawaii Air Defense Sector, Hickam AFB, Hawaii.

The contract also requires the contractor to provide an Integrated Test Facility (ITF) for system development and maintenance analysis. The ITF is located at the contractor’s facility. The contractor-provided ITF housing the government furnished equipment (GFE) is climate controlled to support the original equipment manufacturers’ (OEM) specifications. The ITF is a full suite of communications equipment replicating the equipment at government operational facilities and remote locations. The equipment is configured similarly to operational systems for contractor use in system development, maintenance analysis and troubleshooting.

This modification will revise the requirement to make the contractor responsible for cyber security of the ADCS3 systems and subsystems. Cyber security includes, but is not limited to:

incident and vulnerability management, auditing/reporting, implementation and management of the ADCS Enterprise Plan of Actions and Milestones (POA&M ), review and validation of changes to the ADCS baseline to identify cyber security and accreditation risks, attend meetings and consult concerning cyber security related issues, performing steps necessary to obtain and maintain system accreditation as required by the ADCS C2 Authorization Official (AO) using the DoD Information Assurance Certification and Accreditation Process (DIACAP) and/or Risk

Management Framework (RMF), transitioning the current DIACAP Authority to Operate (ATO) to a RMF ATO, and be the Enterprise Information System Security Officer (ISSO) providing direct support to the AFNORTH Information systems Security Manager (ISSM), ADS and AOC

Cyber Security Managers, as needed, for all cyber security matters related to the contract.

The cyber security period of performance (POP) will take place in option years (OY) 2-4 of the

ADCS3 contract. ADCS3 OY2 is April 1, 2017 to March 31, 2018, OY3 is April 1, 2018 to

March 31, 2019 and OY4 is April 1, 2019 to March 31, 2020.

Page 4 of 9 Pages

The estimated life costs of the procurement are

4. IDENTIFICATION OF LIMITED SOURCE AUTHORITY AND DEMONSTRATION OF

CONTRACTOR’S UNIQUE QUALIFICATIONS: FAR 8.405-6(a)(1)(i)(C), in the interest of economy and efficiency, the new work is a logical follow-on to an original Federal Supply

Schedule order provided that the original order was placed in accordance with the applicable

Federal Supply Schedule ordering procedures. The original order or BPA must not have been previously issued under sole-source or limited-sources procedures.

(a) Circumstances Justifying Limiting the Source.

FAR 8.405-6(a)(1)(i)(C), in the interest of economy and efficiency, the new work is a logical follow-on to an original Federal Supply Schedule order provided that the original order was placed in accordance with the applicable Federal Supply Schedule ordering procedures. The original order or BPA must not have been previously issued under sole-source or limited-sources procedures.

(b) Description of the Justification.

It was determined during the development of the ADCS3 requirements that because the

ADCS3 systems and subsystems aren’t connected to the DoD Information Network

(DoDIN), the Non-classified Internet Protocol Router Network (NIPRNET) and the Secret

Internet Protocol Router Network (SIPRNET) the decision to not include a requirement for cyber security was acceptable.

However, the telecommunications industry is quickly moving away from supporting Time

Delay Multiplexing (TDM) to Unified Communications (UC). The Nortel/Avaya

CS1000M phone switches systems installed at ANR, the CONR AOC, EADS, WADS and the ITF are all TDM systems that need to be replaced by UC systems. In addition, all of the circuits ADCS3 uses for transport or connections to non-ADCS systems are converting from serial to Internet Protocol (IP). All of the TDM and serial connections are no longer supported and are incompatible with current cyber security governance standards described in paragraph 2.

(c) Justification.

(1) Minimum Government Requirements. The minimum government requirements for cyber security are: incident and vulnerability management, auditing/reporting, Page 5 of 9 Pages implementation and management of the ADCS Enterprise POA&M, review and validation of changes to the ADCS baseline to identify cyber security and accreditation risks, attend meetings and consult concerning cyber security related issues, performing steps necessary to obtain and maintain system accreditation as required by the ADCS C2 Authorization

Official (AO) using the DIACAP and/or RMF, transitioning the current DIACAP ATO to a

RMF ATO, and be the Enterprise Information System Security Officer (ISSO) providing direct support to the AFNORTH Information Systems Security Manager (ISSM), ADS and

AOC Cyber Security Managers, as needed, for all cyber security matters related to the contract.

(2) Proposed Sole Source Contractor. The proposed sole source contractor is GDIT. The

ADCS3 contract requires that GDIT provide SSM of all ADCS systems and subsystems.

GDIT is also required to maintain Operational Availability (Ao) of .9999 for CONUS systems and subsystems and Ao of .99999 for ANR. GDIT has an engineering team that has detailed knowledge of all of the systems and subsystems and is the only vendor capable of providing cyber security for ADCS without a significant cost or delay to the

Government. If a separate contract was awarded for ADCS3 cyber security, along with testing the cyber security changes recommended by the other vendor neither GDIT nor the other vendor could be held accountable for the Ao. This could severely degrade Ao, endangering the “no fail” mission of ADCS.

(3) Discussion regarding cause of the limited source situation. In order for another vendor to provide cyber security for ADCS systems and subsystems the Government would have to set up a duplicate ITF to provide needed systems for testing and establish another contractor’s Program Management Office (PMO) for the other vendor to test required cyber security changes and fixes prior to implementing in the ADCS3 system. The reason for the additional PMO is that the cyber security requirement requires more than just cyber security personnel. The requirement also includes at a minimum, a project manager, administrative support and engineers. The estimated cost is at least $3,764,700.00 for cyber security to be provided by another vendor. The estimated labor cost was derived by averaging GSA schedule rates. The estimated ITF hardware cost is based on the costs of the current systems that the Government purchased for the ITF. These costs for cyber security support and another vendor were not budgeted for and are not available in the current budget climate. If it were possible to find the money for another ITF and PMO, it would take at least a year to stand up another ITF as systems, equipment would have to be purchased, and the other vendor would have to integrate the additional ITF into the current

ADCS3 systems. Even though all system and subsystem specifications would be provided, another vendor would start with little or no knowledge of the ADCS3 system. It would take at least six months of the additional year for another vendor to gain a minimal understanding of the ADCS systems and subsystems. In addition, GDIT as the SSM for

ADCS3, would have to perform additional testing to ensure that the changes required by cyber security provided by another vendor would not impact the Ao of the ADCS3 system or subsystem.

One of the cyber security requirements is the ability to apply patches to fix current and future cyber security vulnerabilities at the fixed and remote locations. All of connectivity

Page 6 of 9 Pages between the fixed locations and remote locations is hardwired infrastructure that can’t be changed. The Government can’t provide remote access to another vendor because of the hardwired infrastructure. The way to resolve this would be to send the other vendor on temporary duty (TDY) to all of the remote locations to apply the change. It would cost approximately per year to send another vendor TDY to apply just one patch for all 210 of the CONR sites and all 22 of the Alaska sites. This cost would get multiplied by the number of patches per year per remote location (there are multiple patches per year) and could exceed per year with just four patches.

The use of another vendor would result in unacceptable delays. The mission impact of these delays is an increased risk because of the inability to secure the ADCS enterprise leaving it vulnerable to cyber-attacks that could result in an un-recoverable loss in the ability of an ADS or AOC to direct assets in the execution of the mission. In addition, the airspace defense and air sovereignty missions are constantly growing and the additional year it will take by another contractor to implement cyber security into new capabilities will make it increasingly difficult to meet mission requirements.

(4) Demonstration of limited source. The modification resulting from this action was synopsized on the Federal Business Opportunities (FedBizOpps) website. A notice for

FedBizOpps was posted on November 1, 2016 to advise interested parties that they could submit a proposal for ADCS3 Cyber Security. No interested parties responded in writing to this notice.

(5) Procurement discussion. In addition to providing SSM for ADCS3 and maintaining Ao for CONUS and ANR systems, GDIT is in the process of implementing 23 call orders within the next 12 months. Most of these call orders are replacing hardware that is end-of-life. The hardware items require cyber security analysis, application of Security Technical

Implementation Guidelines (STIGs) and cyber security patches. The Government is ultimately responsible to meet the mandatory cyber security governance standards described in paragraph 2. GDIT’s assistance is needed to ensure there is no impact to the

ADCS3 mission of maintaining interoperable C2.

The ADCS support has been provided since 2001 by GDIT. Following the receipt and evaluation of competitive proposals for each prior requirement, GDIT was determined to be the best value to the Government for both ADCS and ADCS2.

(6) Impact. There are multiple threat actors (either countries or individuals) trying to cyber-attack U.S. defense systems 365/24/7. Having two separate vendors performing cyber security provides threat actors another vulnerability to exploit. In addition, having a separate vendor providing cyber security would make it extremely difficult for either the separate vendor or GDIT to detect a cyber-attack or determine if a problem with an ADCS system or subsystem is the result of a cyber-attack or some other type of problem, endangering the “no fail” mission of ADCS3.

Page 7 of 9 Pages

5. BEST VALUE DETERMINATION:

The contracting officer (KO), with the assistance of a PL42 Cost/Price analyst, will use a variety of cost and price analysis techniques cited in FAR 15.404-1(b) (2) to determine fair and reasonable cost. At a minimum, the following will be used: Price Analysis utilizing pre-priced

CLINs on the current ADCS3 contract for labor hour rates; comparison of previous Government contract prices with the proposed prices for the same service; a comparison of proposed prices with the Independent Government Cost Estimate (IGCE); an analysis of all pricing information provided by the offeror (i.e. data other than cost and pricing data), independent price analysis and

Defense Contract Audit Agency (DCAA) rate checks.

6. MARKET RESEARCH: The modification resulting from this action was synopsized on the

FedBizOpps website. A notice was posted on November 1, 2016 in FedBizOpps to advise interested parties that they could submit a proposal for ADCS3 Cyber Security. No interested parties responded in writing to this notice.

Both ADCS3 and the predecessor ADCS2 and ADCS contracts were awarded based on receipt of competitive proposals. Prior to preparing this request to implement Cyber Security, the market was checked for additional companies that could fulfill this requirement. No other companies were identified that could implement this additional support in the required timeframe.

Cyber Security is required to be implemented in all systems per governance previously identified in Section 2. The alternative of not implementing cyber security in ADCS3 is not acceptable as that would expose the system to potential threats. Not implementing cyber security would also jeopardize ADCS3 in supporting the mission of maintaining interoperable C2 of aerospace defense, air sovereignty and counter-terrorism for the United States, territories and provinces to include those in the Pacific and Caribbean.

Prior to the release of the ADCS4 Request for Proposals RFP, market research will be conducted to determine companies that can provide support for ADCS4. The cyber security requirement will be included in the competitive ADCS4 requirement.

7. ANY OTHER SUPPORTING FACTS:

The Air Defense and Homeland Defense/Security missions have constantly grown ever since the

September 11, 2001 terrorist attacks. These additional C2 requirements and responsibilities are necessary under the ADCS3 contract to defend the U.S. against terrorist activities. GDIT has responded rapidly in support of the national emergencies operating as the SSM and ensuring there is no impact to Ao. Their knowledge of current ADCS3 architecture and operational requirements expedited the meeting of mission mandates in critical months and years that followed, and helped to forge the way ahead. Their continued support under this contract is essential.

Page 8 of 9 Pages

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FULL AND OPEN COMPETITION:

(a) Procurement History:

1. Contract HC1013-09-D-2000, was competitively awarded May 1, 2009 to GDIT for

ADCS2, using full and open competition and best value tradeoff. Two offerors submitted proposals. At the time of contract award, the NTE ceiling was for a one-year base period and four one-year option periods. The period of performance was increased to add a fifth one-year option period until April 30, 2015 and a ceiling increase to to complete the Mission Voice Platform (MVP) project. The MVP project was for the system-wide replacement of the existing voice console system that reached the end of its service life in 2013. The addition of the MVP was accomplished via a justification for other than full and open competition that was approved by the DISA

Head of the Contracting Activity on June 6, 2012. The government exercised the Option to Extend Services clause, FAR 52.217-8, to complete MVP installation at all sites. This resulted in performance ending on October 31, 2015.

2. Contract No. DCA200-01-D-5006 was competitively awarded on July 6, 2001 to General

Dynamics Government Systems Corporation Network Systems (now GDIT) to provide management, maintenance, and repair and logistics support of existing ADCS communications systems and subsystems within two NORAD Regions, the CONR and

ANR. Two offerors submitted proposals. The contract was awarded with a base period of July 6, 2001 through June 30, 2002, with four 1-year option periods. All option years were exercised. The original ceiling of this contract was .

The events of September 11, 2001 and the subsequent additional national security requirements caused increases in the number of facilities covered under DCA200-01-D-

5006, necessitating multiple contract modifications to increase the final ceiling amount to and an extension to the period of performance to April 30, 2009.

(b) Follow-On Procurement.

The follow-on acquisition identified as ADCS4, for which efforts have not started, will be procured via full and open competition. The award of a FSS contract BPA using FFP and Cost-Reimbursable CLINs for maintenance and call orders for system changes is anticipated. The final decision on the contract vehicle to use will be based on extensive market research by the customer, DITCO contract specialist, DITCO Small and

Disadvantaged Business Utilization Specialist and the DITCO KO. The estimated date of award for the follow-on requirement is April 1, 2021.

9. REFERENCE TO THE APPROVED ACQUISITION PLAN (AP)

The initial AP was approved on September 15, 2014 by the DITCO Scott Head of the

Contracting Office. An amendment to the AP to add Cyber Security is being routed simultaneously as this Limited Source J&A.

Page 9 of 9 Pages

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Michael Weller SIGNATURE:

TITLE/ORGANIZATION: ADCS3 Air Combat Command Contracting Officer Representative

AFNORTH/A6XR

PHONE: 850-283-8586; DSN 523-8586 DATE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Michael Weller SIGNATURE:

TITLE/ORGANIZATION: ADCS3 Air Combat Command Contracting Officer Representative

AFNORTH/A6XR

PHONE: DATE:

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: Arthur L. Kruse SIGNATURE:

TITLE/ORGANIZATION: Contracting Officer, DISA/DITCO/PL8223

PHONE: 618-229-9773 DATE:

PROCURING ACTIVITY COMPETITION ADVOCATE APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief.

Since this justification does not exceed $13.5M, this review serves as approval and my written determination that the aforementioned FAR circumstances apply.

NAME: Gay D. Arnold SIGNATURE:

TITLE/ORGANIZATION: Procuring Activity Competition Advocate/Procurement Services

Directorate

PHONE: 618-229-9517/DSN 779-9517 DATE:

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

Arthur Kruse, Contracting Officer, 618-229-9773, arthur.l.kruse.civ@mail.mil or Kathryn

Koerkenmeier, Contract Specialist, 618-229-9513, kathryn.v.koerkenmeier.civ@mail.mil mailto:arthur.l.kruse.civ@mail.mil mailto:kathryn.v.koerkenmeier.civ@mail.mil