Redacted_JA17-017A_SMDG_Follow_On_Redacted.pdf

AMENDMENT JUSTIFICATION FOR OTHER THAN FULL AND

OPEN COMPETITION (OTFAOC)

Federal Acquisition Regulation (FAR) Part 6 Justification & Approval (J&A), Supporting Procurements under FAR Part 12, FAR Subpart 13.5, and FAR Part 15

Purchase Request Number: DIDMZ70054 Contract Number: HC101317C0003 Procurement Title: License Agreement and Engineering Support Services for the Secure Mobile Device Gateways (SMDG) Contracting Office: Defense Information Technology Contracting Organization

(DITCO)/PL8223

Estimated Value:

Statutory Authority: FAR 6.302-1(a)(2)(iii)

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION (OTFAOC)

Justification for OTFAOC Number: JA17-017A

Upon the basis of the following justification, I, as the Procuring Activity Competition Advocate (PACA), hereby approve the use of other than full and open competition of the proposed contractual action pursuant to the authority of FAR 6.302-1(a)(2)(iii/10 U.S.C 2304(c)(l). This particular service is essential to the government and it is likely that award to any other source would result in substantial duplication of costs to reconfigure and redesign the gateway, these costs are not expected to be recovered through competition.

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

Requiring Agency: Defense Information Systems Agency (DISA)

Infrastructure Development Directorate (ID7) Mobility Division 6916 Cooper Avenue Ft. Meade, Maryland 20755-7901

Contracting Office: DITCO/PL8223

2300 East Dr., Bldg. 3600 Scott Air Force Base, Illinois 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

This amended justification for OTFAOC adds 3-months of performance time to facilitate the NetOps support transition to the GSM-O contract. The additional period of 3-months allows for support coverage for a seamless transition of this effort. The total option estimated in the lifecycle value has changed from two, one-month options to one, two-month option and three, one-month options. The estimated value has been changed from this increase accurately reflects the estimated lifecycle value with a total increase requested of

Original Justification and Approval (J&A) for OTFAOC supports the requirement for continued engineering and support services to maintain the SMDG. The Government requires the

License Agreement and Engineering Support Services for SMDG-JA17-017A

Page 2 of 10 Pages continued operation of service utilizing the APRIVA MESA VPN and continued use of the Apriva proprietary Command and Control Services (CCS) application. The services provided in support of SMDG are required for the classified mobility services for voice and data until a successful transition from the current proprietary-dependent solution to a future non-proprietary solution is implemented. The resulting stand-alone hybrid contract will be sole sourced to APRIVA Information Security Systems (ISS), LLC (herein APRIVA) which will consist of both Firm-Fixed-Priced (FFP) and Cost Plus Fixed Fee (CPFF) CLINS, using FY17 Operations and Maintenance and Procurement funds (for the purchase of new equipment, as required).

3. DESCRIPTION OF SUPPLIES/SERVICES: The DMCC-Secret gateways provide secure voice and data services to approximately 2,000 DMCC end user devices for worldwide mission essential personnel, as well as, critical DoD Seniors (e.g. Secretary of Defense, Chairman of the Joint Staff, etc.). Any Virtual Private Network (VPN) design supporting the DMCC-Secret effort must be approved by the National Security Agency (NSA) for classified system use and must be compatible with the current SMDG architecture supporting the Commercial Solutions for Classified (CSfC) end user device. A VPN license agreement as well as specialized engineering support for the DMCC-Secret architectures is required to continue services without interruption.

The Government requires Tier III support services and engineering support services for the DoD Mobility PMO. Services shall include a range of technical, SMDG architecture development, Tier III engineering, analytical, planning, acquisition, security, and management functions pertaining to the responsibilities inherent to sustaining the current capabilities of the DMCC- Secret nodes, as well as supporting the Mobility PMO customer driven requirements. The Government requires support services for maintaining security requirements, and conserving Mobile Access Capabilities Package (MACP) compliance. Tier III support shall have access to 24x7 on-site operational personnel to assist with resolution of incidents and concerns.

The period of performance will begin February 1, 2017 for a 1-year base period with two 1-year options with an estimated life cycle cost of

4. IDENTIFICATION OF STATUTORY AUTHORITY: Only one responsible source and no other supplies or services will satisfy agency requirements, 10 U.S.C. 2304(c)(l). (FAR 6.302-

1/DFARS 206.302-1).

5. DEMONSTRATION OF CONTRACTOR’S UNIQUE QUALIFICATIONS:

(a) Description of events:

APRIVA’s proprietary VPN design supporting the DMCC-Secret effort is currently the only VPN approved by the NSA for classified system use that is proven compatible with the current SMDG architecture supporting the CSfC end user device, which is essential to the Government’s requirements. At inception, the Apriva MESA VPN was the only approved standards-based IPSEC VPN available. As such, the contractor will be required to provide the APRIVA MESA VPN license agreement which authorizes use of gateway operations and associated SMDG testing facilities. APRIVA's unique network management services are also required to run and maintain the gateways with ease of use. The Tier III support

Page 3 of 10 Pages personnel are required to have end-to-end knowledge of the system design and configuration, as well as specific system components to include all applications, operating systems, system interfaces, and network engineering components.

Due to the proprietary design and implementation of the APRIVA MESA VPN within the gateway infrastructure, a VPN license agreement and specialized engineering support for the DMCC-Secret architectures are required to continue services without interruption. The proposed follow-on effort to the current support contract for SMDG is to ensure continuous services are provided which maintains the DMCC - Secret mobility gateways supporting the

SMDG.

The APRIVA MESA VPN design solution cannot be replaced without significant disruption of service to the DMCC infrastructure and its end users, as well as potentially disturb MACP compliance of the current architecture. Replacing the existing infrastructure is beyond the scope of the Government’s current needs, and would result in a loss of DISA's $43M investment in the existing infrastructure. Awarding to a source other than APRIVA would result in substantial duplication of cost to the Government that is not expected to be recovered through competition.

Also, attempts to prematurely transition services would result in critical mission failure due to the dependencies listed above. Thus, an award to a source other than APRIVA would result in unacceptable delays in fulfilling the Government’s requirements.

(b) Justification:

(1) Minimum Government requirements:

The purpose of this effort is to continue support for SMDG to ensure continuous services are provided to maintain the DMCC - Secret mobility gateways supporting the SMDG, which requires a CSfC VPN device approved by the NSA that is compatible with the existing infrastructure and architecture.

(2) Proposed sole source contractor:

APRIVA

(3) Discussion regarding cause of the sole source situation.

Under HC1013-09-C-2002, APRIVA was awarded the MCEP contract to initially continue engineering and operational services for the SME PED and the supporting MCEP architectures, subsequent contract modifications were later added for DMCC to provide secure/voice over internet protocol support for CSfC approved Smartphone devices. At that time, the proprietary APRIVA MESA VPN dependency was approved for integration within the DMCC infrastructure, and it was the only CSfC approved VPN device available.

Currently, it is essential to the Mobility Program Management Office mission requirements to continue to utilize the APRIVA MESA VPN design, which is currently on the CSfC approved list and supports both Rivest, Shamir, and Adelman (RSA) and Elliptic Curve Cryptography (ECC) algorithms and to

Page 4 of 10 Pages continue engineering support services with APRIVA ISS, LCC in order to maintain MACP compliance, until the imminent future solution of Mobile Enterprise Solution Classified (MES-C) is established by the Government.

The Government has identified the necessary technical specifications that are required to transition to the full and open competitive source selection methodology for the future MES-C solution. The MES-C procurement lead time is currently projected for award no earlier than 1QFY18. A sole source acquisition to transition engineering support services until MES-C is awarded is necessary to maintain current SMDG system compliance with security and mandatory information assurance requirements, and is also essential in maintaining the current Mobile Access Capability Package (MACP) submission as a driven mandate by NSA.

(4) Demonstration of unique source.

The APRIVA MESA VPN design supporting the SMDG is the only VPN approved by NSA for classified system use that is proven compatible with the current SMDG architecture in supporting the CSfC end user device.

(5) Procurement discussion.

The MCEP contract (HC1013-09-C-2002) was awarded with a contract period of performance (PoP) of 5 years (one base year and four 1-year option periods). The final option period was exercised beginning August 1, 2013 and ending July 31, 2014. It was during this time that it was determined that the contract would need to be extended to allow for continued operational support of the MCEP and DMCC gateways. FAR Clause 52.217-8 was exercised with a PoP of August 1, 2014 to January 31, 2015. The contract was then further extended an additional 6 months in support of transitioning to DMCC 2.0 devices, thereby allowing continued operations through July 31, 2015 for a total lifecycle cost of $30M.

Upon expiration of HC1013-09-C-2002, another OTFAOC justification was approved, and contract HC1013-15-C-0008 was awarded to APRIVA to continue services for DMCC-S and decommission the MCEP infrastructure with a PoP of 18 months (1 base year and 1 six month option), expiring January 31, 2017. A sole-source follow-on award to APRIVA is being sought for a minimum of 1-year with two 1-year options.

(6) Impact.

Without execution of the plan indicated in this J&A, the DMCC-Secret gateways supporting worldwide mission essential personnel will be halted due to an expired APRIVA MESA VPN license agreement. Furthermore, failure to execute would result in significant loss of the allocated funds ($43 million) which have been expended in the engineering and operations for this effort to date and could cause potential duplication of costs for the Government which may not be recouped. It is in the best interest of the Government at this time for DISA to continue the support provided by APRIVA and maintain the classified support provided to senior DoD officials through the SMDG services.

Page 5 of 10 Pages

6. FEDERAL BUSINESS OPPORTUNITIES (FEDBIZOPPS)

ANNOUNCEMENT/POTENTIAL SOURCES: A Request For Information (RFI) was posted to FedBizOpps on June 21, 2016 requesting information from industry to demonstrate capability of providing operational support for the existing DMCC-Secret Gateways in the following areas:

24x7 service desk technical and customer support service, on-boarding and de-boarding devices, network operations, and security and management. A subsequent Sources Sought notice was posted to FedBizOpps on August 02, 2016 seeking information on potential sources that are capable of providing end-to-end engineering and operational support for the existing DMCC- Secret Gateways, a key component to the proprietary solution provided by APRIVA.

The Government intends to post a pre-solicitation notice, as well as the solicitation, to FedBizOpps.

7. DETERMINATION OF FAIR AND REASONABLE COST: The contracting officer (KO) will determine whether APRIVA's proposed price is fair and reasonable before award. Other than certified cost and pricing data will be requested from the contractor at the time of solicitation. Evaluation of the supporting price documentation will be analyzed. Additionally, contractor-proposed pricing will be compared to an Independent Government Cost Estimate and other contracts for similar services. Based on this analysis, the KO will determine whether the proposed price is fair and reasonable.

8. MARKET RESEARCH: Market research was conducted July 2015 through October 2016 and consisted of reviewing previous contracts HC1013-07-P-2321, HC1013-09-C-2002, and HC1013-15-C-0008; soliciting information and/or sources for competition on FedBizOpps;

collaborating with DISA engineers and subject matter experts, DISA leadership, NSA subject matter experts, and Top Secret Gateway technical subject matter experts regarding the proprietary nature of APRIVA’s Mesa VPN as it supports the SMDG. The PMO determined network operations were not APRIVA reliant and these services could potentially be performed by another source.

The RFI posted in June 2016 attempted to remove the network operations support from the previously sole sourced contract and identify any potential sources. The RFI yielded a total of four responses, one of which was from the incumbent contractor, APRIVA ISS, LLC. Of the responses, only three provided sufficient information demonstrating their present capability of fulfilling the requirement of providing network operations at the magnitude identified in the RFI.

APRIVA ISS, LLC, Mission1st Group, Inc., and AT&T Government Solutions, Inc. were identified as potential sources capable of providing the network operations. The fourth response received from PaRaBaL, Inc., a small business, did not address the RFI sufficiently and as such, the Government determined they were not a potential source.

The Sources Sought posted to FedBizOpps in August 2016 identified the SMDG requirement as it is currently being procured today. The Sources Sought posting provided clarification that an agreement and/or partnership would need to be established with APRIVA ISS, LLC in order to provide the complete solution as identified. Responses were received from the incumbent contractor, APRIVA ISS, LLC and from IPKeys Technologies, LLC. After a thorough review of

Page 6 of 10 Pages the responses, the Government determined that IPKeys Technologies, LLC provided insufficient information demonstrating they were capable of providing the necessary services identified in the Sources Sought. Market research indicated other companies did not possess the necessary partnership or agreement with the incumbent contractor, APRIVA, to provide the proprietary components and/or applications; as such, it has been determined APRIVA is the only source capable of providing services as discussed above.

While conducting market research, the PMO identified an existing contract vehicle, DISA’s Global Information Grid (GIG) Services Management – Operations (GSM-O) indefinite delivery/indefinite quantity (ID/IQ), which provides network operations. The DISA GSM-O ID/IQ contract, HC1028-12-D-0021, provides network assurance, information assurance, network security, operations support, provisioning, and other related support to the GIG.

Support covers both locations and is 24x7x365. The GSM-O ID/IQ contract delivers services and products that satisfy the DoD GIG customers’ needs while simultaneously advancing DISA’s strategic vision objective of Network Operations optimization. Since 2012, DISA has been realigning network operation services to the GSM-O ID/IQ that had previously been procured under various contracts. As such, the PMO has determined, with the coordination of the Office of Small Business, the network operations previously procured under the SMDG contract will be transitioned to the GSM-O ID/IQ. The transition of network operations from the SMDG contract to the GSM-O ID/IQ will begin in early calendar year 2017.

Full details are included in the market research report which supports a sole source acquisition approach for engineering support services and an APRIVA MESA VPN license agreement to fulfill the requirements listed above.

9. ANY OTHER SUPPORTING FACTS: Not Applicable

10. LISTING OF INTERESTED SOURCES:

The following sources provided responses to the RFI and Sources Sought posted to FedBizOpps:

APRIVA ISS, LLC, 8501 N. Scottsdale Road, Suite 100, Scottsdale, Arizona 65253 AT&T Government Solutions, Inc. 3033 Chain Bridge Road, Oakton Virginia 22124 IPKeys Technologies, LLC, 10 Center Street Suite 201, Stafford, VA 22556

Mission1st Group, Inc. 155 Village Boulevard, Suite 203, Princeton, NJ 08540-5765 PaRaBaL, Inc. 8 Market Place, Suite 402, Baltimore, MD 21202

APRIVA was the only source capable of providing the services as described within this document.

11. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FULL AND OPEN COMPETITION:

Page 7 of 10 Pages

(a) Procurement History.

APRIVA ISS, LLC was awarded the Multi-Carrier Entry Point (MCEP) contract (HC1013-09-C-2002) on August 1, 2009. While HC1013-09-C-2002 initially provided support services for the Secure Mobile Environment (SME) Portable Electronic Device (PED) and the MCEP architectures, subsequent contract modifications were later added for the DMCC-Secret gateways in order to provide secure/voice over internet protocol support for CSfC approved Smartphone devices. Additionally, the proprietary APRIVA MESA VPN dependency was fused within the DMCC infrastructure at that time, as it was the only CSfC approved VPN device available.

The contract was valued at $23 million and had a one-year base period and four one-year option periods. In May 2014, an OTFAOC justification pursuant FAR 52.217-8 was approved to extend the period of performance from July 31, 2014 until January 31, 2015. In January 2015, a bridge J&A was approved for approximately $4 million to continue service under HC1013-09-C-2002 until July 31, 2015.

Upon expiration of HC1013-09-C-2002, another OTFAOC justification was approved, and contract HC1013-15-C-0008 was awarded to APRIVA ISS LLC to continue services for DMCC-Secret and to decommission the MCEP infrastructure. Market research was conducted in calendar year 2016 to determine if other sources were capable of providing engineering support services and/or operational support services for the DMCC-Secret gateways. However, it was understood that, due to critical dependencies, a sole source license agreement with APRIVA ISS, LLC would be required in order to operate the APRIVA MESA VPN. A Request for Information (RFI) and a Sources Sought, were posted to the Federal Business Opportunities website seeking information from capable sources. Limited responses were received in both instances, with no other company demonstrating the capability of completing the entire scope of work. However, a small business firm, Mission 1st Group, Inc. and a large business firm, AT&T Government Solutions, Inc. did provide responses demonstrating their technical expertise and capability in providing network operation support as a standalone requirement. The program office also explored existing Government contracts for specific tasks identified in the SMDG requirement and identified the DISA GSM-O ID/IQ contract vehicle, HC1028- 12-D-0021, which provides network assurance, information assurance, network security, operations support, provisioning, and other related support to the GIG. HC1028-12-D- 0021 was competed as a full and open competition, and was subsequently awarded to Lockheed Martin Corporation. It was determined that the SMDG gateway network operations support services requirement fell in scope for this vehicle. The GSM-O ID/IQ delivers services and products that not only satisfies the DoD GIG customers’ needs but also simultaneously advances DISA’s strategic vision objective of Network Operations optimization. Since 2012, DISA has been realigning network operation services to the GSM-O ID/IQ that had previously been procured under various contracts. This recent market research has validated the Government’s desire to dissolve the SMDG sole source acquisition strategy by separating the network operations requirement from the sole source acquisition and splitting the current SMDG contract into two smaller procurements.

Page 8 of 10 Pages

(b) To eliminate this dependency in the future, the Government team is currently working the next contract action which will include an open source system requirement that is NSA approved, as well as the design and schedule for a pending MACP 2.0 compliant gateway convergence plan to consolidate the existing DMCC-Secret gateways with the TS solution which would provide for better efficiency in both cost and operations. Current technology trends and market research show positive results that the Government will be able to contract for a non-proprietary solution as part of the future follow-on solution or successfully converge secret and TS into one CSfC compliant solution.

NSA has developed a long anticipated update to MACP that has established clear requirements for receiving NSA risk assessments through registration in NSA's CSfC.

However, to date, there are no MACP compliant gateway architectures available. As such, APRIVA, as a CSfC Trusted Integrator and the PMO have undertaken the effort to achieve compliance at the SMDG Secret gateways utilizing the current infrastructure, which includes a system design that has integrated the proprietary dependency of the APRIVA MESA VPN within the architecture.

The Mobility Program Office intends to mitigate the remaining proprietary dependencies on this technology during future acquisitions by the following actions:

• The Government will consider any source that has received an authority to operate by the Defense Information Assurance Security Accreditation Working Group and given a certificate of security accreditation by the DISA Designated Accrediting Authority that is also CSfC compliant.

• The Government team is preparing to release an RFI for the next contract action, MES-C, which will include a CSfC complaint, non-proprietary, open source system requirement, as well as the design and schedule for mass user transition plan to a follow

on. Projected to award no earlier than 1QFY18.

• The Mobility Program Office architected CSfC complaint Top Secret (TS) design (once deployed) may be leveraged as a follow on gateway replacement for DMCC- Secret. Or (upon the release of MACP 2.0 projected in FY17) MACP 2.0 is anticipated to provide for multi-level security capability that will allow for gateway convergence and a single CSfC compliant stack architecture that would provide capability for both Secret and TS security enclaves.

However, until such time, the proprietary APRIVA MESA VPN design supporting the SMDG is the only VPN approved by NSA for classified system use that is also proven compatible with the current SMDG architecture in supporting the CSfC end user device.

12. REFERENCE TO THE APPROVED ACQUISITION PLAN (AP): The streamlined AP has been accomplished IAW DARS 7.103(e).

License Agreement and Engineering Support Services for SMDG Template v1, last updated 13 Oct 2016

Page 1 of 2 Pages

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

TITLE/ORGANIZATION:

PHONE: DATE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

TITLE/ORGANIZATION:

PHONE: DATE:

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

TITLE/ORGANIZATION:

PHONE: DATE:

PROCURING ACTIVITY COMPETITION ADVOCATE APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief.

Since this justification does not exceed $13.5M, this review serves as approval and my written determination that the aforementioned FAR circumstances apply.

NAME: SIGNATURE:

TITLE/ORGANIZATION:

PHONE: DATE:

Salvatore Scaglione

DMCC-S PM

301-225-2443 25 November 2016 janeanne.holten Typewritten Text janeanne.holten Typewritten Text Jacob Marcellus janeanne.holten Typewritten Text janeanne.holten Typewritten Text janeanne.holten Typewritten Text janeanne.holten Typewritten Text Acting Portfolio Manager, Mobility janeanne.holten Typewritten Text 301-225-8710 janeanne.holten Typewritten Text janeanne.holten Typewritten Text janeanne.holten Typewritten Text

(ID7)

janeanne.holten Typewritten Text janeanne.holten Typewritten Text janeanne.holten Typewritten Text

(ID7)

janeanne.holten Typewritten Text janeanne.holten Typewritten Text janeanne.holten Typewritten Text janeanne.holten Typewritten Text janeanne.holten Typewritten Text janeanne.holten Typewritten Text janeanne.holten Typewritten Text janeanne.holten Typewritten Text janeanne.holten Typewritten Text janeanne.holten Typewritten Text JaneAnne M. Holten janeanne.holten Typewritten Text

DISA/DITCO/PL8223

janeanne.holten Typewritten Text janeanne.holten Typewritten Text janeanne.holten Typewritten Text 29 November 2016 janeanne.holten Typewritten Text janeanne.holten Typewritten Text janeanne.holten Typewritten Text 618-229-9282 janeanne.holten Typewritten Text janeanne.holten Typewritten Text janeanne.holten Typewritten Text janeanne.holten Typewritten Text 29 November 2016

Gay.Arnold Typewritten Text

JA17-017A

Gay.Arnold Typewritten Text

Gay.Arnold Typewritten Text

Gay.Arnold Typewritten Text

Gay.Arnold Typewritten Text

Gay.Arnold Typewritten Text

Gay.Arnold Typewritten Text Gay Arnold

Gay.Arnold Typewritten Text

Gay.Arnold Typewritten Text

PACA/DISA

Gay.Arnold Typewritten Text 618-229-9517

Gay.Arnold Typewritten Text January 30, 2017

License Agreement and Engineering Support Services for SMDG Template v1, last updated 13 Oct 2016

Page 2 of 2 Pages

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

JaneAnne Holten, 618-229-9282, janeanne.m.holten.civ@mail.mil; Katie Koerkenmeier, 618- 229-9513, kathryn.koerkenmeier.civ@mail.mil.