JA18-025___S7_CROM_REDACTED_Redacted.pdf

JUSTIFICATION FOR OTHER THAN FULL AND

OPEN COMPETITION (OTFAOC)

Federal Acquisition Regulation (FAR) Part 6 Justification & Approval (J&A), Supporting Procurements under FAR Part 12 and FAR Part 15

Purchase Request Number: Not Applicable Contract Number: GS-35F-0297K Blanket Purchase Agreement: HC101317A0001 Procurement Title: Samsung Galaxy S7 Custom Read-Only-Memory (CROM) Mobile Device Estimated Value:

Statutory Authority: FAR 6.302-1(a)(2)(iii)

JUSTIFICATION FOR OTFAOC

Justification for OTFAOC Number: JA18-025

Upon the basis of the following justification, I, as Procuring Activity Competition Advocate, hereby approve the use of other than full and open competition of the proposed contractual action pursuant to the authority of FAR 6.302-1(a)(2)(iii).

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

Defense System Information Agency (DISA)/ Mobility Program Management Office (PMO)/ID1 6906 Cooper Avenue

Fort Meade, MD 20755

Contracting Activity:

DISA/PL8414

Defense Information Technology Contracting Organization (DITCO)

2300 East Drive, Bldg 3600 Scott Air Force Base, IL 62225

2. NATURE/DESCRIPTION OF ACTION(S):

The DISA PMO has the requirement to procure the next generation classified mobile device for the Department of Defense (DoD) Mobility Classified Capability (DMCC) Program offering that will replace the End-of-Life classified mobile device currently in use. The current classified mobile device is the Samsung Galaxy S4 CROM. The next generation classified mobile device is the Samsung Galaxy S7 with a hardened solution. The hardening process incorporates the required NSA layers of security into the commercial item, which then allows for approval of use in a classified environment. These capabilities, along with additional required policy profiles, provide the defense with a CROM classified device. DISA intends to modify the existing DMCC BPA for Hotspot Devices and Data Service Plans to include the next generation classified mobile device. The purpose of the BPA was to address and mitigate evolving cyber security threats via the procurement of retransmission devices (i.e., hotspots), to be used in

Samsung Galaxy S7 Custom Read-Only-Memory (CROM) Mobile Device-JA18-025

Page 2 of 7 Pages conjunction with the S4 and future DMCC mobile devices for secure communication. This justification will support a modification to the existing DMCC BPA to allow for the incorporation of the next generation classified mobile device with a hardened solution, the Samsung Galaxy S7 CROM, and increase the estimated value by .

The next generation classified mobile device will be negotiated as a firm fixed price line item on the BPA, and customers will procure the device through a Telecommunication Service Request when a device is needed. The BPA has a one-year base period and three one-year option periods; however, the device will only be available for procurement in the option periods (06 February 2018 – 05 February 2021).

3. DESCRIPTION OF SUPPLIES/SERVICES:

The BPA was originally competed utilizing the General Services Administration (GSA) Information Technology Schedule 70, Special Item Number 132-53 for Wireless Services. The BPA procured hotspot devices and data service plans for domestic and international use. Due to the specialized nature of mobile classified communications, a mobile device and a hotspot device is required for operational use. This configuration is different from the commercial offering, where a mobile device only needs a service plan to communicate.

The DMCC program currently provides a mobile device, the Samsung Galaxy S4 CROM. The SAMSUNG Galaxy S4 was part of the pilot initiative for the DMCC program. The S4 device is no longer available for resale and is several Android releases removed. To avoid the increased security risk of using a device that is no longer supported, the DMCC-S program needs to expand the offering to the next generation classified mobile device, which is a device on the Commercial Solutions for Classified (CSfC) Components List.

Given the information above, the Government must upgrade to the next generation classified mobile device, the Samsung Galaxy S7 CROM. The classified configurations are required to efficiently manage and maintain the current and approved DoD Information Network (DODIN) configuration, as well as maintain certification in accordance with the CSfC Mobile Access Capability Package (MACP). The Samsung Galaxy S7 CROM device is necessary to maintain and sustain an existing operational infrastructure, replace end-of-life mobile devices to the current supported version, and preserve the approved CSfC configuration baseline. Hence, the modification to the BPA will add the next generation mobile device, the Samsung Galaxy S7 CROM, for customers to procure new or upgrade their existing devices. The DISA PMO is seeking to include the National Information Assurance Partnership (NIAP) certified mobile device for its Secret and Top Secret end users for the remaining life of the BPA.

4. IDENTIFICATION OF STATUTORY AUTHORITY:

Only one responsible source and no other supplies or services will satisfy agency requirements, FAR 6.302-1(a)(2)(iii).

Page 3 of 7 Pages

5. DEMONSTRATION OF CONTRACTOR’S UNIQUE QUALIFICATIONS:

(a) Description of events.

DISA requires the use of the highly specialized and selective items from the CSfC Components list since they have been validated by NIAP as meeting the additional CSfC mandated required security capabilities necessary to deploy classified communications.

NIAP is used by the Mobility PMO to validate device security for both unclassified and classified communication capabilities. Unclassified communication capability requires devices to be NIAP certified without the additional CSfC certification requirement and a Security Technical Implementation Guide (STIG) approved in order to be listed on the DoD Approved Products List (APL) for connecting to the Unclassified DoDIN. Wherein the classified communication capability requires devices to be NIAP certified with the additional CSfC certification requirement and be listed on the CSfC Components List1 for connecting to the Classified DoDIN. Hence, there are additional security layers required in advance of the CSfC listing. The additional CSfC requirements within the NIAP certification are those required features and capabilities that further restrict access to the device and its components; thus, further “hardening” the security boundary to prevent security breaches.

Previously for the DMCC offering, the Samsung Galaxy S4 with the Android Operating System (OS), was procured for use. A subsequent contract was awarded to convert the S4 device to the approved DMCC baseline configuration at the NSA secret classification level. The Samsung S4 device has been moved to the Archived Components list in August 2017. Products included on the Archived Components List are no longer approved for use in new CSfC solution registrations. DISA’s Secure Mobile Device Gateway (SMDG) was successfully registered as a CSfC solution in December 2017; as such, DISA is required to transition to products on the current CSfC Components List.

The Samsung Galaxy S7 CROM, an approved CSfC mobile platform, minimizes the increased security risk of using an end-of-life device that is no longer supported and is several Android releases removed.

(b) Justification.

(1) Minimum Government requirements. As noted above, a mobile device must meet specific CSfC security selections which are contained within the NIAP Mobile Device Fundamentals version 3.1 Protection profile in Table 9: High-Security Template which is contained in Appendix F.2: "USE CASE 2 Enterprise-owned device for specialized, high-security use” which lists the 40 CSfC evaluation requirements and associated actions which are required for a classified device. Additionally, the S7 devices must be further locked down in accordance with the CSfC MACP, Table 16, Requirements for End User Devices. To do so requires the use of a Security Enhanced Android (SE Android) application to be installed on the S7. However, the devices must be modified by Samsung to allow the SELinux policies to be managed

1 https://www.nsa.gov/resources/everyone/csfc/components-list/ https://www.nsa.gov/resources/everyone/csfc/components-list/

Page 4 of 7 Pages by the SE Android application which is not required for an unclassified device. Thus the DMCC-S device cannot be an unclassified Android device that is on the market or listed on the Approved Products List (APL) since it must be specifically tested to meet the CSfC NIAP selections and additionally be modified to allow an SE Android application to be installed to manage SE Android polices on the device itself. To pick another device that has not already been CSfC certified and configured to "unlock" SE Android would require a minimum of 6 months and $350K to go through NIAP and an additional 3-4 months for developing new SELinux policy selections.

(2) Proposed sole source contractor. AT&T Mobility, LLC has the capability to deliver the Samsung, Galaxy S7 CROM, SM-G930UZKNXAA model required for use under the DMCC service offering. Due to the unique nature of the procurement terms and conditions set forth by Samsung, AT&T Mobility LLC is the only authorized reseller identified in market research that will assume the financial risk and accept Samsung’s terms and conditions.

(3) Discussion regarding cause of the sole source situation. The Samsung S7 is currently a CSfC solution and the Mobility PMO is required to use devices that are CSfC certified devices. The current DMCC device, Samsung Galaxy S4, was placed on the ‘Archive List’ in August 2017. This means the program must transition to a supported model (ex. Samsung Galaxy S7) within two years of the Samsung S4 device moving to the ‘Archive List’. With almost 2,000 Secret and Top Secret users, there is an urgent need to start exchanging out the End of Life S4 CROM device with the next generation S7 CROM device to ensure there is no loss in coverage. Samsung limits the number of resellers who can offer the Samsung S7 CROM device, which further limits competition. The current BPA contractor, AT&T Mobility LLC, is poised to offer the devices to the Government as their firm was competitively awarded the DMCC BPA for hotspots and data plans.

(4) Demonstration of unique source. The current BPA contractor, AT&T Mobility LLC, is poised to offer the devices to the Government as one of their current business lines is the resale of mobile devices. AT&T Mobility, LLC currently provides the required accompanying hotspots and data plans for the DMCC user; as such, they have the ability to provide a complete DMCC capability: CROM device, hotspot and data plan.

AT&T Mobility, LLC, an authorized Samsung reseller, is the only authorized reseller willing to accept the terms and conditions posed by Samsung for the Samsung S7

CROM.

(5) Procurement discussion. Procurement of the brand name/model next generation device is required to meet increasing demand for the DMCC service and to mitigate any security vulnerabilities with the current outdated technology. Procuring equipment/software for the classified tablet that has not been processed through NIAP Certification and CSfC compliance would result in significant cost, resources, and schedule delays to the Government, let alone the impacts in maintaining the annual NSA CSfC Registration approval.

Page 5 of 7 Pages

(6) Impact. Without execution of the plan indicated in this J&A, end users of the DMCC service are at future risk of security vulnerabilities. Failure to provide the next generation device will hinder DISA’s ability to offer a classified mobility capability in support operations for joint warfighters, national leaders, and coalition partners.

These devices are critical to the security of classified communication at the highest levels of the DoD, as well as, in strategic field locations, globally.

6. FEDBIZOPPS ANNOUNCEMENT/POTENTIAL SOURCES:

The Government intends to synopsize this contract action in accordance with FAR Part 5 procedures and attach the J&A. The Government will also request and encourage other manufacturers, as well as offerors, to submit solutions that can be used for the DMCC program.

We will continue to conduct market research and review responses from potential sources to promote competition.

7. DETERMINATION OF FAIR AND REASONABLE COST:

The Contracting Officer will determine whether the proposed price is fair and reasonable before contract modification. Other than certified cost and pricing data will be requested from the contractor with their price submission. Evaluation of the supporting price documentation will be analyzed. Additionally, contractor-proposed pricing will be compared to an Independent Government Cost Estimate and other contracts for similar products. Based on this analysis, the Contracting Officer will determine whether the proposed price is fair and reasonable.

8. MARKET RESEARCH:

Given the need for a NIAP approved and CSfC certified device, the Government is limited to the mobile platforms identified on the CSfC Components List. DISA is limited in the selection of devices that are available to meet the CSfC and NIAP requirements for classified devices. The Samsung Galaxy S7, is a commercial item, but must be modified by Samsung to “unlock” the device to allow an SE Android application to be installed to manage SELinux policies to meet the previously mentioned security requirements. Through coordination with NSA, this is the only device that has been tested and approved to be used on the DMCC Program due to its unique ability to be “locked down” through customization. The manufacturer of the device does not allow all of authorized resellers to resell this device. DISA conducted market research by contacting wireless providers who resell Samsung products and Samsung small businesses resellers who were identified as potential sources for DISA’s previously procured classified tablet pilot. The specific brand name/model required for the DMCC program has limited quantities and additional requirements imposed by the manufacturer further reduces the number of sources willing or able to provide the brand name device. Based on the efforts described above, a sole source acquisition for the classified device is required. AT&T Mobility LLC, is the only firm willing to burden the risk, on behalf of the Government, in procuring the brand name device.

DISA intends to synopsize the contract action and request additional sources and/or solutions be submitted for further consideration.

Page 6 of 7 Pages

9. ANY OTHER SUPPORTING FACTS: Not Applicable.

10. LISTING OF INTERESTED SOURCES:

Market research was conducted from June 2017 through December 2017 with the leading wireless providers, as well as small business resellers for Samsung. AT&T Mobility LLC and New Tech Solutions, Inc. were the only firms identified as interested sources; however, AT&T was the only source willing to bear the risk of the terms and conditions in delivering the devices.

New Tech Solutions, Inc. was not willing to accept the risk associated with the procurement of Samsung devices. A notice of proposed contract action will be published to FedBizOpps along with this J&A.

11. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FULL AND OPEN COMPETITION:

(a) Procurement History. Not Applicable

(b) The Government will continue to search the market place to identify any future devices and/or sources that can offer a NIAP certified/approved CSfC configuration mobile device. In the event that equipment cannot be purchased using the vehicle discussed in the analysis, an open market contracting strategy will be explored. The Government intends to synopsize the requirement in accordance with FAR Part 5; furthermore, the synopsis will remain “active” for the duration of the BPA to allow for other contractors or devices to be considered for use under the DMCC program.

(c) The requirements for the classified device capability will be continually monitored, updated, and reassessed as the Government moves forward to remove barriers to competition. The Government will continue to perform market research to determine if market conditions have changed and/or identify other CSfC devices eligible for use under the DMCC program.

12. REFERENCE TO THE APPROVED ACQUISITION PLAN (AP): In accordance with the exceptions under DISA Acquisition Regulation supplement 7.103 (S-91)(1)(i), an AP is not required.

Page 7 of 7 Pages

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Greg Youst SIGNATURE: See Signature Page

TITLE/ORGANIZATION: DISA/BD

PHONE: (301) 225-9501 DATE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Rebecca Brooks SIGNATURE: See Signature Page

TITLE/ORGANIZATION: DISA/ID

PHONE: (301) 225-4597 DATE:

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: JaneAnne Holten SIGNATURE: See Signature Page

TITLE/ORGANIZATION: DISA/DITCO PSD

PHONE: (618) 229-9282 DATE:

PROCURING ACTIVITY COMPETITION ADVOCATE APPROVAL (PACA): I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief. Since this justification does not exceed $13.5M, this review serves as approval and my written determination that the aforementioned FAR circumstances apply.

NAME: Gay Arnold SIGNATURE: See Signature Page

TITLE/ORGANIZATION: PACA/DISA

PHONE: (618) 229-9517 DATE:

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

JaneAnne Holten, 618-229-9282 or janeanne.m.holten.civ@mail.mil.

mailto:janeanne.m.holten.civ@mail.mil