JA_S3_ATT_Redacted_Redacted.pdf

Page 1 of 7 Pages

JUSTIFICATION FOR OTHER THAN FULL AND

OPEN COMPETITION (OTFAOC)

Federal Acquisition Regulation (FAR) Part 6 Justification & Approval (J&A), Supporting Procurements under FAR Part 12, and FAR Part 15

Purchase Request Number: Not Applicable (N/A) Contract Number: GS-35F-0297K Blanket Purchase Agreement (BPA): HC101317A0001 Procurement Title: The Department of Defense (DoD) Mobility Classified Capability (DMCC) Program Blanket Purchase Agreement (BPA) for Devices and Data Service Plans – Domestic and International Estimated Value:

Statutory Authority: FAR 6.302-1(a)(2)(iii)

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION (OTFAOC)

Justification for OTFAOC Number: N/A

Upon the basis of the following justification, I, as Contracting Officer, hereby approve the use of other than full and open competition of the proposed contractual action pursuant to the authority of FAR 6.302-1(a)(2)(iii), 10 U.S.C. 2304(c)(1).

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

Defense System Information Agency (DISA)/ Mobility Program Management Office (PMO) (PMO)/ID1 6906 Cooper Avenue Fort Meade, MD 20755

Contracting Activity: DISA/PL8414 Defense Information Technology Contracting Organization (DITCO) 2300 East Drive, Bldg. 3600 Scott Air Force Base, IL 62225

2. NATURE/DESCRIPTION OF ACTION(S):

The DISA PMO has the requirement to add a new classified mobile device for the DMCC enterprise offering. The Samsung Galaxy S3 Custom Read Only Memory (CROM) tablet was recently piloted with a small user base and the demand for this capability has significantly increased. This tablet has a larger form factor to aid in email productivity and utilization of Secret Internet Protocol Router Network, which is an improved experience over the current Samsung Galaxy S4 and S7 CROM offering. The devices are put through a “hardening process,” which incorporates the required National Security Agency (NSA) layers of security into the commercial item. The “hardening process” allows the device to be used in a classified environment.

Page 2 of 7 Pages

DISA intends to modify the existing DMCC BPA for Hotspot Devices and Data Service Plans to include the next generation classified mobile device. The purpose of the BPA was to address and mitigate evolving cyber security threats via the procurement of retransmission devices (i.e., hotspots), to be used in conjunction with the S4 and future DMCC mobile devices for secure communication. This justification will support a modification to the existing DMCC BPA to allow for the incorporation of the next generation classified mobile device with a hardened solution, the S3 CROM tablet, and increase the estimated value .

The next generation classified mobile device will be negotiated as a firm fixed price line item on the BPA, and customers will procure the device through a Telecommunication Service Request when a device is needed. The BPA has a one-year base period and three one-year option periods; however, the device will only be available for procurement in the option periods (November 2018 – 05 February 2021).

3. DESCRIPTION OF SUPPLIES/SERVICES:

The DISA Mobility PMO is looking to procure a National Information Assurance Partnership (NIAP) certified tablet solution that can be provided to the classified user community. The device is required to be listed as a Mobile Platform on the Commercial Solutions for Classified (CSfC) components list and compliant with the CSfC Mobile Access Capability Package (MACP). The device is required to have a Qualcomm Snapdragon processor, integrated with Quark security policy and needs to have a Virtual Private Network (VPN) client listed as Internet Protocol Security (IPSec) VPN Client on the CSfC Components List.

Additional required capabilities include:

a. The device must be NIAP certified against the Mobile Device Fundamental Protection Profile, which includes the CSfC Selections Requirements in Table 13: G.2 [USE CASE 2] Enterprise-owned device for specialized, high-security use.

b. The device is required to be listed as a Mobile Platform on the CSfC Components List.

c. The device must be configured to meet the CSfC Transport Layer Security (TLS) End User Device (EUD) and basic EUD requirements in CSfC MACP Table 16: Requirements for End User Devices.

d. The device must be capable of 802.11 Wi-Fi, Wi-Fi Protected Access (WPA)-2, utilize Pre- Shared Key and Media Access Control (MAC) address filtering to connect to an AT&T Unite Explore and Verizon Jetpack AC791L MiFi.

e. The device must be able to support wireless local area network (WLAN) Maximum Transmission Unit (MTU) 1428 bytes.

f. The device shall possess the ability to lockdown features and settings access capability similar to SE Android security settings and/or third Party Application allowed to enact security lockdown settings.

Page 3 of 7 Pages

g. The device is required to be in the tablet format and must have a minimum screen size requirement of 9 inches or larger.

h. The device is required to be Security Technical Implementation Guides (STIG) configured according to mobile Operating System (OS) STIG, which can be found on the DISA Information Assurance Support Environment web site at:

https://iase.disa.mil/stigs/mobility/Pages/index.aspx.

i. The device is required to be managed and compatible with a Mobile Device Manager (MDM) (e.g. MobileIron).

j. The device is required to have web browser capable of supporting the Internet Engineering Task Force standard TLS version 1.2 and use installed DoD public key infrastructure (PKI) certificates for authentication to connect to Exchange Outlook Web DMCC-S Next Generation Classified Tablet-JA17-116 Access and DoD streaming Unified Video Dissemination System (UVDS) that uses the Hypertext Transfer Protocol (HTTP) Live Streaming Protocol.

k. The device is required to have a VPN client listed as IPSec VPN Client on the CSfC Components List.

l. The device shall have a Qualcomm Snapdragon processor.

m. The device shall be able to be implemented and integrated with Quark security policy for supporting the classified voice capability.

The Samsung S3 CROM tablet, Part Number: SM-T820NZKUCUS, has been NIAP certified and is listed as a Mobile Platform on the CSfC Components List.

Due to the specialized nature of mobile classified communications, a mobile device (phone or tablet) and a hotspot device are required for operational use. The classified configurations are required to efficiently manage and maintain the current and approved DoD Information Network (DODIN) configuration, as well as maintain certification in accordance with the CSfC MACP.

This configuration is different from the commercial offering, where a mobile device only needs a service plan to communicate.

4. IDENTIFICATION OF STATUTORY AUTHORITY:

Only one responsible source and no other supplies or services will satisfy agency requirements, FAR 6.302-1(a)(2)(iii).

5. DEMONSTRATION OF CONTRACTOR’S UNIQUE QUALIFICATIONS:

(a) Description of events.

DISA requires the use of the highly specialized and selective items from the CSfC Components List since they have been validated by NIAP as meeting the additional CSfC mandated required security capabilities necessary to deploy classified communications. The Mobility PMO

Page 4 of 7 Pages completed the pilot for the S3 CROM devices in 2018. Due to the success of the pilot, combined with the increased demand for the device, necessitates the device to be included as a DMCC-S offering.

The device requires the use of a retransmission device and data service plan, much like the other DMCC-S device offerings. The BPA was modified to add the Samsung Galaxy S7 CROM device in January 2018 as authorized via JA18-025, and the Mobility PMO is requesting the BPA be modified now to add the S3 CROM device.

(b) Justification.

(1) Minimum Government requirements. The S3 CROM device must meet specific CSfC security selections and be locked down in accordance with the CSfC MACP for DMCC-S use.

(2) Proposed sole source contractor. AT&T Mobility, LLC has the capability to deliver the S3 CROM, SM-G9 SM-T820NZKUCUS model required for use under the DMCC service offering. Due to the unique nature of the procurement terms and conditions and the Government’s requirement to deliver on demand, AT&T Mobility, LLC is the only authorized reseller identified in market research to meet this requirement.

(3) Discussion regarding cause of the sole source situation. The S3 CROM is currently a CSfC solution and the Mobility PMO is required to use devices that are CSfC certified. Although the S3 CROM was previously procured through small businesses for the DMCC pilot program, this requirement is to deliver on demand and as needed.

The previous requirement was for a firm quantity of devices. The current BPA contractor, AT&T Mobility, LLC, is poised to offer the devices to the Government as one of their current business lines is the resale of mobile devices. AT&T Mobility, LLC currently provides the required accompanying hotspots and data plans as well as the S7 CROM device for the DMCC user; as such, they have the ability to provide a complete DMCC capability.

(4) Impact. Without execution of the plan indicated in this J&A, the end user of the

DMCC service will not be able to procure an S3 CROM tablet. The additional benefits of having a tablet include a larger form factor for reading email and SIPRNet activities. These devices are critical to the security of classified communication at the highest levels of the DoD as well as, in strategic field locations, globally.

6. FEDBIZOPPS ANNOUNCEMENT/POTENTIAL SOURCES:

The Government intends to synopsize this contract action in accordance with FAR Part 5 procedures and attach the J&A. The Government will also request and encourage other manufacturers, as well as offerors, to submit solutions that can be used for the DMCC program.

The Government will continue to conduct market research and review responses from potential sources to promote competition.

7. DETERMINATION OF FAIR AND REASONABLE COST:

Page 5 of 7 Pages

The Contracting Officer will determine whether the proposed price is fair and reasonable before contract modification. Other than certified cost and pricing data will be requested from the contractor with their price submission. Evaluation of the supporting price documentation will be analyzed. Additionally, contractor-proposed pricing will be compared to an Independent Government Cost Estimate and other contracts for similar products. Based on this analysis, the Contracting Officer will determine whether the proposed price is fair and reasonable.

8. MARKET RESEARCH:

Given the need for a NIAP approved and CSfC certified device, the Government is limited to the mobile platforms identified on the CSfC Components List. Through coordination with NSA, this is the only tablet device that has been tested and approved to be used on the DMCC Program due to its unique ability to be “locked down” through customization. The manufacturer of the device does not allow all of authorized resellers to resell this device.

DISA conduced market research by posting a Sources Sought Announcement Federal Business Opportunities (FBO) website on April 2, 2018, to identify authorized resellers for Samsung products and Samsung small businesses resellers. The Government received a total of six responses, five small businesses and one large business. AT&T Mobility, LLC and New Tech Solutions, Inc. were the only firms identified as capable sources; however, AT&T Mobility, LLC was the only source deemed capable in delivering the devices on an as-needed reoccurring basis.

Based on the efforts described above, a sole source acquisition for the classified device via modification to the existing DMCC BPA is required. A notice of proposed contract action will be published to FedBizOpps along with this J&A.

9. ANY OTHER SUPPORTING FACTS: N/A

10. LISTING OF INTERESTED SOURCES:

Ideal Systems Solutions, Inc.

New Tech Solutions, Inc.

Defensor Dynamics AT&T Mobility, LLC GovSmart, Inc.

Aviate Enterprises, Inc.

11. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FULL AND OPEN COMPETITION:

(a) Procurement History.

Contractor Name: CounterTrade Products, Inc.

Socio-economic status: Small Business Contract Number and Value: HC101318F0004/$1,008,000.00 Delivery: February 2018 Acquisition Method: 100% Small Business set-aside for contract holders in Groups B, C, and D on NASA SEWP

Page 6 of 7 Pages

Contractor Name: New Tech Solutions, Inc.

Socio-economic status: Small Business Contract Number and Value: HC101318F0131/$141,750.00 Delivery: May 2018 Acquisition Method: 100% Small Business set-aside for contract holders in Groups B, C, and D on NASA SEWP

(b) The Government will continue to search the market place to identify any future devices and/or sources that can offer a NIAP certified/approved CSfC configuration mobile tablet. In the event that equipment cannot be purchased using the vehicle discussed in the analysis, an open market contracting strategy will be explored. The Government intends to synopsize the requirement in accordance with FAR Part 5; furthermore, the synopsis will remain “active” for the duration of the BPA to allow for other contractors or devices to be considered for use under the DMCC program.

(c) The requirements for the classified device capability will be continually monitored, updated, and reassessed as the Government moves forward to remove barriers to competition. The Government will continue to perform market research to determine if market conditions have changed and/or identify other CSfC devices eligible for use under the DMCC program.

12. REFERENCE TO THE APPROVED ACQUISITION PLAN (AP): In accordance with the exceptions under DISA Acquisition Regulation supplement 7.103 (S-91)(1)(i), an AP is not required.

Page 7 of 7 Pages

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Becki Brooks SIGNATURE: See Signature Page

TITLE/ORGANIZATION: DMCC-S PM/ID1

PHONE: 301-225-4597 DATE: 11/2/2018

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Lily Scheve SIGNATURE: See Signature Page

TITLE/ORGANIZATION: Acquisition Analyst/ID1

PHONE: 301-225-5362 DATE: 11/1/2018

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: Angela Zang SIGNATURE: See Signature Page

TITLE/ORGANIZATION: Contracting Officer/DITCO

PHONE: 618-418-6435 DATE: 11/2/2018

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

Angela Zang, Contracting Officer, 618-418-6435, angela.k.zang.civ@mail.mil