JA15-082B_Redacted2.pdf

AMENDMENT JUSTIFICATION FOR OTHER THAN FULL AND

OPEN COMPETITION (OTFAOC)

Federal Acquisition Regulation (FAR) Part 6 Justification & Approval (J&A), Supporting

Procurements under FAR Part 12, FAR Subpart 13.501, and FAR Part 15

Purchase Request Number: HC1013-15-R-0012

Contract Number: TBD

Task/Delivery Order Number: NA

Procurement Title: Integration Services for Department of Defense (DoD)

Mobility Classified Capability (DMCC) Integrated

Commercial Solution (ICS) Devices

Contracting Office: Defense Information Technology Contracting Organization

(DITCO)-Scott Systems Section PL8223

Estimated Value:

Statutory Authority: FAR 6.302-1/Defense FAR Supplement (DFARS)

206.302-1

OTFAOC

Justification for OTFAOC Number: JA15-082B

Upon the basis of the following justification, I, as Head of the Contracting Activity, hereby approve the use of OTFAOC of the proposed contractual action pursuant to the authority of FAR

6.302-1/DFARS 206.302-1.

JUSTIFICATION

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

a. Requiring Activity:

Defense Information Systems Agency (DISA), ID/ID7

Mobility Program Management Office (PMO)

6910 Cooper Avenue

Fort Meade, MD 20755-7088

b. Contracting Agency:

DISA/DITCO/PL8223

2300 East Drive

Scott AFB, Illinois 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

Amendment B of this justification for OTFAOC adds additional optional tasks which identify sustainment, support, and provisioning tasks to allow for quick execution in support of the

DMCC program. With major DoD stakeholders utilizing this critical infrastructure to be provided by General Dynamics (GD), the DMCC program includes necessary safeguards to

Integration Services for DMCC ICS Devices-JA15-082

Page 2 of 7 Pages allow for risk mitigation in support of the DoD mission partners. These optional tasks provide for the sustainment, support, and provisioning tasks to account for any future enhancements to the commercial mobile device or to leverage GD’s Firmware-Over-The-Air (FOTA) software, GD’s automated device provisioning capability, and/or sustainment/maintenance and help desk support for all fielded DMCC-Secret (DMCC-S) devices. Program analysis and senior leadership will ultimately determine if these optional tasks are needed while considering availability of funding.

Amendment A to the justification for OTFAOC added an additional 6-month option period.

Amendment A was approved by the Procuring Agency Competition Advocate on June 22, 2015.

The additional option period allows for support coverage for the anticipated lifecycle of this effort. Total option periods have changed from three 6-month options to four 6-month options.

The DoD Mobility PMO has a sole source requirement for GD to integrate and provide sustainment and maintenance support for the most current approved DMCC baseline configuration on up to 3,475 commercial mobile devices. The Mobility PMO provides devices to the contractor for integration. The intent of the DMCC Program is to incorporate commercial solutions to protect classified mobile communications capabilities. The GD device baseline configuration image is the only (NSA) approved device image for use at the enterprise level for

DMCC. GD is the only approved trusted integrator on NSA’s (CSfC) integrator list that can readily support modifications to the existing NSA approved DMCC ICS device baseline image.

This will result in one contract to GD using fiscal year 2016 operation and maintenance funding utilizing firm fixed price and cost plus fixed fee contract line items. Total estimated value of this procurement is $with a base period of performance of 1-year from date of award, plus four, 6-month options, starting February 26, 2016.

This program is mandated by the DoD Commercial Mobile Device Implementation Plan dated

February 2013, which states, "DISA must establish a Program Office for procurement and operation of enterprise Mobile Device Management (MDM) capabilities and Mobility Services by Fiscal Year 2014." In addition, the highest levels of DoD and Federal leadership are anticipating access to the DMCC. To satisfy these requirements, the Continental United States configuration of the DMCC utilizes a private network to provide one of several layers of protection for its data in transit. If the Government is not able to obtain a contract from GD for device integration, maintenance, and sustainment, the Mobility PMO effort will fail to meet mission requirements. This represents a high risk to mission readiness, creates gaps in mobile security, communications, and fails to fulfill the mandated DoD and DMCC operational requirements mentioned above.

3. DESCRIPTION OF SUPPLIES/SERVICES:

The Mobility PMO requires integration and life-cycle support for up to 3,475 ICS devices. GD presently has a secure baseline configuration integrated onto devices that meet NSA’s CSfC process and additional security requirements for DMCC. GD owns the hardened image and has the expertise to provide the required engineering support for the targeted number of 3,475

DMCC ICS devices. DMCC ICS baseline images are signed by GD and comply with NSA

DMCC 2.0 security configurations and interoperability requirements. The contractor-delivered

Page 3 of 7 Pages

DMCC ICS devices will build upon the security of commercially available mobile devices and integrate the mobile devices with CSfC components specifically approved for use as part of the

DMCC architecture. The DMCC ICS device baseline configurations ensure interoperability among the DMCC components providing the following capabilities: device integrity, secure browsing, secure email, secure voice, internet protocol security, virtual private network connectivity, firmware over the air, policy enforcement, and MDM. Future deployment of

DMCC ICS devices must support a higher classification level (i.e., up to Top Secret) in addition to the present Secret offering.

4. IDENTIFICATION OF STATUTORY AUTHORITY:

Only one responsible source and no other supplies or services will satisfy agency requirements, 10 United States Code 2304(c)(1). (FAR 6.302-1/DFARS 206.302-1)

5. DEMONSTRATION OF CONTRACTOR’S UNIQUE QUALIFICATIONS:

The DMCC is a joint effort between DISA and the NSA. The initial DoD DMCC Pilot Program that fielded ~500 secret devices is near end of life. The current DMCC 1.0 deployed devices do not satisfy the National Information Assurance Partnership (NIAP) Mobile Device Fundamentals

Protection Profile (MDF PP) 2.0, and are being replaced with DMCC ICS devices that meet both the NIAP MDF PP and NSA security requirements based on the DMCC architecture. GD is the only approved trusted integrator on NSA’s CSfC integrator list that can readily support modifications to the existing NSA approved DMCC ICS device baseline image since they alone possess the capability to modify and re-sign the DMCC ICS baseline image. DMCC ICS device baseline images are proprietary, signed by GD, and comply with NSA DMCC 2.0 security requirements, configurations, and interoperability requirements.

Description of Events:

In June 2014, NSA used a competitive award of an integration contract to meet the

Mobility PMO’s device needs. In a joint effort between DISA and NSA, the Mobility

PMO has begun receiving 1,000 DMCC ICS devices with the secure baseline image signed by GD. GD has proprietary ownership over the baseline image and the integration process, which received operational approval based on a security risk assessment performed by NSA. Therefore, it is essential for the Government to utilize GD’s approved baseline image and integration process on mobile devices owned by DISA. In addition, past contracting history and experience with the current NSA contract and

DMCC expertise indicates that the transition and ramp up time to assume the incumbent's work would be significant (3-5 months for the ICS device, plus 2-3 months for DMCC-S) in addition to unplanned cost (~$1,200,000).

The Government requires continued lifecycle support for the 1,000 existing DMCC ICS devices that were integrated on the expiring NSA contract. In addition to the 1,000 existing DMCC ICS devices, and 475 commercial mobile devices procured in 2013, another 2,000 commercial mobile devices were procured in 2015 and will need integration and lifecycle support. Without GD’s integration and lifecycle support, the

Page 4 of 7 Pages operational security of the devices will not meet the established security guidelines set forth by NSA and will not be approved for operational use on DoD networks.

For these devices to meet NSA’s approved security standards, they must be modified with the existing NSA approved DMCC ICS device baseline image, currently owned and signed by GD. GD collaborated with multiple vendors to develop a unique device image and provisioning process for DMCC. Because of the methods used within the provisioning process to secure or “lock the phones down,” no other contractor could make modifications to the devices without GD’s direct consent since the integrated image is proprietary to GD.

6. FEDERAL BUSINESS OPPORTUNITIES (FEDBIZOPPS) ANNOUNCEMENT /

POTENTIAL SOURCES:

A sources sought notice was posted on FedBizOpps, April 22, 2015, requesting responses from large and small businesses under North American Industry Classification System Code 541512;

responses were due by 4pm eastern standard time on April 27, 2015.

Three responses to the sources sought posting were received from large businesses, GD, Boeing

Company and AT&T Corp, Government Solutions. Review of the responses from Boeing

Company and AT&T Corp indicated they were not compliant with requirements outlined in the sources sought. Neither company could articulate an existing partnership or agreement with GD that would allow them to legally modify the existing DMCC device baseline image created and signed by GD. Boeing's capability response assumes dependability on GD’s proprietary baseline image. Without having access to GD’s image, Boeing will not have the ability to meet the requirements as specified. AT&T’s capability statement did not address the current ICS device, image, or partnership with GD to support this effort. Access to the DMCC device baseline image is owned and signed by GD. Therefore, without GD-granted access to their proprietary image, it is not clear how AT&T would be able to meet the requirements to continue support for existing devices.

In response to the sources sought notice posted on April 22, 2015, GD submitted a capability statement on May 1, 2015. GD has access to the DMCC device baseline image and possesses the ability to sign updates as required for modifications to the baseline image. This unique access makes them the only respondent capable of maintaining support for the existing devices.

In addition, GD can make minor modifications to the baseline images, allowing them to address the devices at different classification levels. This unique ability allows flexibility and critical timelines to be met.

As of April 29, 2015, only two of the sources sought respondents, AT&T Corp, Government

Solutions, and GD, are approved trusted integrators on the NSA CSfC integrator list. It is a

DMCC requirement for the integrator to be on the list, which gives the Government a level of assurance that the contractor has sufficient knowledge and expertise required to integrate commercially available components for classified communications based on NSA guidelines.

Page 5 of 7 Pages

Subsequent inquiries with GD to vet possible partnerships with other companies produced a negative response.

7. DETERMINATION OF FAIR AND REASONABLE COST:

The contracting officer will determine whether GD’s proposed price is fair and reasonable before award. Other than certified cost and pricing data will be requested from the contractor at the time of solicitation. Evaluation of the supporting price documentation will be analyzed.

Additionally, contractor-proposed pricing will be compared to an Independent Government Cost

Estimate and other contracts for similar services. Based on this analysis, the contracting officer will determine whether the proposed price is fair and reasonable.

8. MARKET RESEARCH:

Market research consisted of reviewing H98230-14-C-0596 (the current NSA contract), posting and analyzing of sources sought notice on April 22, 2015 to FedBizOpps, and collaborating with mobility engineers, DISA leadership, DISA, and NSA subject matter experts regarding the proprietary nature of the GD DMCC baseline configuration for ICS devices. All information received supported a sole source approach for the current period of performance to fulfill the subject requirement.

9. ANY OTHER SUPPORTING FACTS: None.

10. LISTING OF INTERESTED SOURCES:

(a) Boeing Company 7700 Boston Boulevard, Springfield, Virginia 22153

(b) AT&T Corp, Government Solutions 7125 Columbia Gateway, Columbia, Maryland

21046

(c) General Dynamics C4 Systems Inc., 8201 E McDowell Road, Scottsdale, Arizona 85257

11. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FULL AND OPEN COMPETITION:

(a) Procurement History.

(1) H98230-14-C-0596 awarded to General Dynamics C4 Systems Inc. as full and open competition.

The current support needed by the DoD PMO is tied to the ICS device and the approved

DMCC device baseline image created and signed by GD. The devices that are associated with the image are expected to reach their end of life by the end of this procurement action. As additional integrators and devices are certified by NSA and added to the CSfC list, it is anticipated that there will be potential for competition on follow-on contracting actions.

The Mobility PMO is currently developing a next generation device contract. This contract will be a full and open competition that will replace the current ICS devices and

Page 6 of 7 Pages integration services, thus removing any future need to integrate the current ICS devices past the scope of this contract.

12. REFERENCE TO THE APPROVED ACQUISITION PLAN (AP): In accordance with the exceptions under DARS 7.103 (S-91)(h), an AP is not required.

Page 7 of 7 Pages

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance, which are included in the J&A, are accurate and complete to the best of my knowledge and belief.

NAME: Salvatore Scaglione SIGNATURE:

TITLE/ORGANIZATION: DISA/ID73

PHONE: DATE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance, which are included in the J&A, are accurate and complete to the best of my knowledge and belief.

NAME: Salvatore Scaglione SIGNATURE:

TITLE/ORGANIZATION: DISA/ID73

PHONE: 301-225-2443 DATE:

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: Arthur L. Kruse SIGNATURE:

TITLE/ORGANIZATION:

HEAD OF THE CONTRACTING ACTIVITY APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief. Since this justification for OTFAOC does not exceed $93M, this review serves as approval.

NAME: Douglas W. Packard SIGNATURE:

TITLE/ORGANIZATION: Procurement Services Executive

Chief, Defense Information Technology

Contracting Organization

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

Angela K. Zang, Contract Specialist, angela.k.zang.civ@mail.mil, telephone 618-229-9435.

mailto:angela.k.zang.civ@mail.mil