JA18-058_Quark_Kernel_Justification_for_OTFAOC_Redacted.pdf

For the best experience, open this PDF portfolio in

Acrobat X or Adobe Reader X, or later.

Get Adobe Reader Now!

http://www.adobe.com/go/reader

Page 1 of 6 Pages

JUSTIFICATION FOR OTHER THAN FULL AND

OPEN COMPETITION (OTFAOC)

Federal Acquisition Regulation (FAR) Part 6 Justification & Approval (J&A), Supporting Procurements under FAR Part 12 and FAR Part 15

Purchase Request Number: To be determined (TBD) Blanket Purchase Agreement Number: TBD Procurement Title: Quark Security, Inc. Kernel Level Security Configuration Policy for the Department of Defense (DoD) Mobility Classified Capability (DMCC) Program Estimated Value:

Statutory Authority: FAR 6.302-1(a)(2)(iii)

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION (OTFAOC)

Justification for OTFAOC Number: JA18-058

Upon the basis of the following justification, I, as Procuring Activity Competition Advocate, hereby approve the use of other than full and open competition of the proposed contractual action pursuant to the authority of FAR 6.302-1(a)(2)(iii).

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

Defense System Information Agency (DISA)/ Mobility Program Management Office (PMO)/Infrastructure Directorate (ID)1 6906 Cooper Avenue Fort Meade, MD 20755

Contracting Activity:

Defense Information Technology Contracting Organization (DITCO)/PL8414 2300 East Drive, Bldg 3600 Scott Air Force Base, IL 62225

2. NATURE/DESCRIPTION OF ACTION(S):

This Justification for OTFAOC supports a requirement for the DISA ID1 Mobility PMO to procure kernel level security configuration policies (kernel policies) for the next generation classified mobile devices and tablets integrated with a hardened solution. The hardening process incorporates the required National Security Agency (NSA) layers of security into the commercial item, along with additional required policy profiles that provides the defense with a device for approval of use in a classified environment. The layer of security provided by the kernel policies aids in secure communication with the DMCC next generation classified mobile devices and tablets.

DISA intends to award a firm fixed price Blanket Purchase Agreement (BPA) to Quark Security, Inc. (Quark) to procure the required kernel policies for the next generation DMCC device and tablet offering. The BPA will be funded with fiscal year 2018 Defense Working Capital Funds and appropriated dollars based on the number of kernel policies procured.

Page 2 of 6 Pages

Quark Security, Inc. Kernel Level Security Configuration Policy for the DMCC Program-

JA18-058

3. DESCRIPTION OF SUPPLIES/SERVICES:

The DISA Mobility PMO requires approximately 4,000 kernel policies to support the DMCC Program utilized by the DoD and other non-DOD Mission Partners. The DMCC device configurations ensure interoperability among the DMCC components providing the following capabilities: device integrity, secure browsing, secure email, secure voice, internet protocol security, virtual private network connectivity, policy enforcement, and Mobile Device Management (MDM). The kernel policies will allow for secure communication to the secret and top secret next generation mobile devices and tablets, and are necessary to meet the Information Assurance (IA) requirements in the DMCC architecture.

The period of performance will consist of a one-year base period and four one-year options at an estimated value of . This value is based on the current DMCC secret users, top secret users and new users.

4. IDENTIFICATION OF STATUTORY AUTHORITY:

Only one responsible source and no other supplies or services will satisfy agency requirements, 10 U.S.C.2304(c)(1). (FAR 6.302-1(a)(2)(iii)/DFARS 206.302-1).

5. DEMONSTRATION OF CONTRACTOR’S UNIQUE QUALIFICATIONS:

(a) Description of events. The DISA PMO has the requirement to procure the next generation classified mobile devices and tablets for the DMCC Program offering that will replace the end-of-life classified mobile devices and tablets currently in use and not available for resale. The next generation devices and tablets require classified configurations to efficiently manage and maintain the current and approved DoD Information Network configuration, as well as maintain certification in accordance with the Customer Solutions for Classified (CSfC) Mobile Access Capability Package. In order to provide secure communication, these next generation devices and tablets require several layers of protection for its data in transit. One layer of protection consists of the kernel policy, which is responsible for security of the devices. This justification for OTFAOC will ensure the Mobility PMO can provide the kernel policies required for secure communication on the DMCC devices.

(b) Justification.

(1) Minimum Government requirements. As noted above, the kernel policies are necessary to meet IA requirements in the DMCC architecture. The kernel policies are used to enhance security, further enhancing the protection level of the device and tablet. The kernel policies must be compatible with Security Enhanced Linux (SELinux)/Android and interact with the Android Operating System (OS) at the lowest level. Additionally, the kernel policies must be compatible with devices and tablets on the CSfC components list, as well as the Mobile Iron MDM, Samsung Knox server and Samsung Enterprise Mobility Management (EMM) server. The kernel policies must be able to disable key hardware features early in the system bootloader process and whitelist applications for use on the devices.

(2) Proposed sole source contractor. Quark meets all of the requirements. Quark has developed kernel policies that are compatible with the DMCC’s devices and infrastructure, and that also meet the stringent security requirements. Quark previously provided this effort as a subcontractor on HC1013-16- P-0003 and HC1013-16-C-003.

Page 3 of 6 Pages

(3) Discussion regarding cause of the sole source situation. The classified communication industry requires special devices that meet complex security policies such as CSfC certification and validation by National Information Assurance Partnership (NIAP). In addition to the limited offerings, the DMCC devices must be compatible with SELinux/Android OS, Mobile Iron MDM, Samsung Knox server and Samsung EMM server, creating an even more unique situation within the classified communications industry. Only Quark has kernel policies that meet the required security policies and are also compatible with all of the DMCC devices and infrastructure, including SELinux/Android OS, Mobile Iron MDM, Samsung Knox server and Samsung EMM server.

(4) Demonstration of unique source. Quark is the only known vendor that has the ability to provide kernel policies for classified mobile devices, compatibility with the SELinux/Android and has the ability to interact with the Android OS at the lowest level. A sources sought was posted and responses were received and reviewed. Quark is the only known source.

(5) Procurement discussion. The sole source BPA to Quark for the procurement of the kernel policies is required to meet the IA requirements in the DMCC architecture.

There are no alternative security policies that will communicate and support the DMCC device configuration with the required security layers of NSA and that are compatible with the SELinux/Android OS.

(6) Impact. Without execution of the plan indicated in this justification for OTFAOC, end users of the DMCC service are at future risk of security vulnerabilities. Failure to provide the required kernel policies for next generation devices will hinder DISA’s ability to offer a classified mobility capability in support of operations for joint warfighters, national leaders, and coalition partners. These kernel policies are critical to the security of classified communication at the highest levels of the DoD, as well as in strategic field locations, globally.

6. FEDBIZOPPS ANNOUNCEMENT/POTENTIAL SOURCES:

The Government intends to synopsize this contract action in accordance with FAR Part 5 procedures and attach the justification for OTFAOC. The Government will also request and encourage other manufacturers, as well as offerors, to submit solutions that meet the Government’s baseline requirements for use on the DMCC Program. The Government will continue to conduct market research and review responses from potential sources to promote competition.

7. DETERMINATION OF FAIR AND REASONABLE COST:

The Contracting Officer will determine whether Quark’s proposed price is fair and reasonable before BPA award. Other than certified cost and pricing data will be requested from the contractor with their price submission. Evaluation of the supporting price documentation will be analyzed. Additionally, contractor-proposed pricing will be compared to an Independent Government Cost Estimate and other contracts for similar products, as well as previous procurements for this item. Based on this analysis, the Contracting Officer will determine whether the proposed price is fair and reasonable.

Page 4 of 6 Pages

8. MARKET RESEARCH:

The Government posted a Sources Sought Announcement on the Federal Business Opportunities website on December 1, 2017 to elicit responses from HUBZone and small and large businesses on a kernel policy compatible with the DMCC architecture. The Government received a total of eight responses, seven small businesses and one large business. Seven responses (one large and six small businesses) did not fulfill the Government’s requirement as the kernel policy provided was not compatible with SELinux/Android OS or the responses did not address the kernel policy requirement.

Additionally, market research consisted of reviewing the previous contracts, HC1013-16-P-0003 and HC1013-16-C-0003, collaborating with mobility engineers, DISA leadership, DISA and NSA subject matter experts regarding the nature of the kernel policy. All information received supported a sole source approach to fulfill the subject requirement.

Based on the efforts described above, a sole source acquisition to Quark for the kernel policy is required. Quark was deemed the only responder that highlighted their ability to provide kernel policy for classified mobile devices, compatibility with the SELinux/Android and has the ability to interact with the Android OS at the lowest level. Quark was the only vendor that met the Government’s full requirement.

9. ANY OTHER SUPPORTING FACTS:

Not Applicable.

10. LISTING OF INTERESTED SOURCES:

The following firms responded to the Sources Sought Announcement:

Contractor Name Meet

Requirement Agile Corporation No

Star Lab Corporation No Dark Horse Technologies No

Quark Security, Inc. Yes Blue Tech Inc. No

Axxera Inc. No Archarithms, Inc. No VDA Labs, LLC No

11. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FULL AND OPEN COMPETITION:

(a) Procurement History.

Contractor: General Dynamics C4 Systems Inc. (GDC4S) Subcontractor: Quark provided the kernel policies under this contract.

Business size: Large Contract Number: HC1013-16-P-0003 Dollar value:

Page 5 of 6 Pages

Contract Period: December 1, 2015 through November 30, 2016 Type of Acquisition: Sole Source

Contractor: General Dynamics Mission Systems Inc. (GDMS), formerly GDC4S Subcontractor: Quark provided the kernel policies under this contract.

Business size: Large Contract Number: HC1013-16-C-0003 Dollar value of Quark support:

Contract Period: March 2, 2016 through March 1, 2019 Type of Acquisition: Sole Source

b. The Government will continue to search the market place to identify any future devices and/or sources that can offer a kernel policy for the DMCC Program. In the event that kernel policies cannot be purchased using the vehicle discussed in the analysis, an open market contracting strategy will be explored. The Government intends to synopsize the requirement in accordance with FAR Part 5. Furthermore, the synopsis will remain “active” for the duration of the BPA to allow for other contractors or devices to be considered for use under the DMCC program.

The requirements for the kernel level security policy for the DMCC Program will be continually monitored, updated, and reassessed as the Government moves forward to remove barriers to competition. The Government will continue to perform market research to determine if market conditions have changed and/or identify other kernel policies eligible for use under the DMCC program.

12. REFERENCE TO THE APPROVED ACQUISITION PLAN (AP): In accordance with the exceptions under DISA Acquisition Regulation supplement 7.103 (S-91)(1)(i), an AP is not required.

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION (OTFAOC)

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION (OTFAOC)