JA18-093_Limited_Sources_Brand_Name_Cellcrypt_Redacted.pdf

LIMITED SOURCE JUSTIFICATION

BRAND NAME

Federal Acquisition Regulation (FAR) Part 6 Justification & Approval (J&A), Supporting Procurements under FAR Part 12 and FAR Part 15

Purchase Request Number: DIDMZ80107 Contract Number: To be determined Procurement Title: Cellcrypt Voice over Internet Protocol (VoIP) licenses for the Department of Defense (DoD) Mobility Classified Capability (DMCC) Program Estimated Value:

Statutory Authority: FAR 6.302-1(c)(1)

LIMITED SOURCE JUSTIFICATION

Justification for OTFAOC Number: JA18-093

Upon the basis of the following justification, I, as Procuring Activity Competition Advocate, hereby approve the use of other than full and open competition of the proposed contractual action pursuant to the authority of FAR 6.302-1(c)(1).

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

Defense System Information Agency (DISA)/ Mobility Program Management Office (PMO)/Infrastructure Directorate (ID)1 6906 Cooper Avenue Fort Meade, MD 20755

Contracting Activity:

Defense Information Technology Contracting Organization (DITCO)/PL8414 2300 East Drive, Bldg. 3600 Scott Air Force Base, IL 62225

2. NATURE/DESCRIPTION OF ACTION(S) BEING APPROVED:

This Justification for OTFAOC supports a requirement for the DISA ID1 Mobility PMO to procure licenses for a VoIP application to allow for secure communication with the DMCC next generation classified mobile devices integrated with a hardened solution. The hardening process incorporates the required National Security Agency (NSA) layers of security into the commercial item, along with additional required policy profiles and licenses that provides the defense with a device for approval of use in a classified environment. The license must be compatible with the existing DMCC architecture.

DISA intends to award a firm fixed price Blanket Purchase Agreement (BPA) for Cellcrypt VoIP licenses for the next generation DMCC mobile device(s) offering. The first order issued under the BPA will be funded with fiscal year 2018 Defense Working Capital Funds and appropriated dollars based on the number of VoIP applications procured.

Cellcrypt VoIP licenses for the DoD DMCC Program – JA18-093

Page 2 of 7 Pages

3. DESCRIPTION OF THE SUPPLIES OR SERVICES REQUIRED TO MEET THE

AGENCY’S NEEDS:

The DISA Mobility PMO requires approximately 4,000 VoIP licenses to support the DMCC program utilized by the DoD and non-DoD Mission Partners. The VoIP license is required to be compatible with the current DMCC infrastructure. The DMCC device and architecture configurations ensure interoperability among the DMCC components providing the following capabilities: device integrity, secure browsing, secure email, secure voice, internet protocol security, virtual private network connectivity, policy enforcement, and Mobile Device Management (MDM). The Government has a need for the Cellcrypt VoIP license to allow for secure communication to the secret and top secret mobile devices and is necessary to meet the Information Assurance (IA) requirements in the DMCC architecture.

The period of performance will consist of one base year and four one-year options at an estimated value of . This value is based on the current DMCC secret and top secret users, as well as potential new users of the capability.

4. IDENTIFICATION OF LIMITED SOURCE AUTHORITY AND SUPPORTING

RATIONALE: FAR 6.302-1(c)(1)

5. DEMONSTRATION OF CONTRACTOR’S UNIQUE QUALIFICATIONS:

(a) Description of events. The DISA PMO has the requirement to procure the next generation mobile devices for the DMCC Program offering that will replace the end-of-life classified mobile devices currently in use. The current, end-of-life mobile devices, leverage Cellcrypt VoIP licenses and were part of the original integration effort for the mobile classified pilot. The next generation mobile devices require classified configurations to efficiently manage and maintain the current and approved DoD Information Network configuration. In order to provide secure communication, these mobile devices require several layers of protection for its data in transit. One layer of protection consists of the VoIP application. This brand name limited sources justification will ensure the Mobility PMO can provide the necessary Cellcrypt VoIP licenses required for secure communication on the DMCC devices.

(b) Justification.

(1) Minimum Government requirements. The application must meet the following requirements to achieve secure communication within the DMCC architecture:

a) Ability to update VoIP licenses over-the-air by utilizing the existing Cisco

Unified Communications (call) Manager (CUCM) Session Initiation Protocol (SIP) server, MDM, and utilize a license that does not require the need to re-provision the device.

b) Compatibility with the existing CUCM 10.5.2.

c) Ability to show connection to CUCM as active.

d) Ability to store numbers called and received as well as edit contacts (add, delete, modify) name and numbers.

e) Ability to show inbound calling number and if listed in the contacts, then name and number.

Page 3 of 7 Pages

(2) Proposed Brand Name: Cellcrypt VoIP license.

The classified communication industry requires special devices that meet complex security policies. In addition to the limited offerings, the DMCC devices must be compatible with the CUCM 10.5.2 SIP server and MDM, creating an even more unique situation within the classified communications industry. Compatibility with the CUCM 10.5.2 SIP server requires certificate authentication support to be interoperable within the DMCC architecture. During market research efforts, one other VoIP license was identified as potentially being compatible with DISA’s current CUCM. NewTech Solutions, Inc. proposed the use of Cisco Jabber as the VoIP capability for use within the current DMCC architecture. Cisco Jabber was tested for use in early FY18; however, it was concluded that Cisco Jabber was unable to support certificate authentication for the existing CUCM 10.5.2. In order to get Jabber to support certificate authentication it would require the Government update the CUCM to version 11.5. This presents an issue as updates to the call manager will break the authentication of the current devices due to encryption support mismatches. Without certificate authentication, the device and service would be inoperable as it cannot work with the current version and configuration of the Call Manager.

To date, no other alternative VoIP applications have been tested that are able to communicate and support this device configuration and are compatible with the call manager configuration.

The Cellcrypt VoIP license meets all of the Governments’ minimum requirements and is the only VoIP license compatible with the current DMCC’s devices configuration and architecture. The Cellcrypt VoIP license was previously procured under HC1013- 16-C-0003 and HC1013-16-P-0001.

(3) Procurement discussion. The procurement of the Cellcrypt VoIP license is required to meet IA requirements in the DMCC architecture. The call manager configuration of the classified capability on the mobile devices limits the available sources as the application must be compatible with the existing CUCM 10.5.2, and ensure interoperability within the DMCC configuration. An alternative VoIP application would require an upgrade to the current call manager (CUCM 10.5.2) to a newer version which, cannot be supported due to the extensive time required to successfully upgrade and deploy the new call manager, as well as consider the impact to fielded devices and disruption to their secure communications.

(4) Impact. Without execution of the plan indicated in this limited sources justification for brand name, end users of the DMCC service are at future risk of security vulnerabilities. Failure to provide the required VoIP application for next generation devices will hinder DISA’s ability to offer a classified mobility capability in support operations for joint warfighters, national leaders, and coalition partners. These VoIP licenses to use the application are critical to the security of classified communication at the highest levels of the DoD, as well as in strategic field locations, globally.

Page 4 of 7 Pages

6. FEDBIZOPPS ANNOUNCEMENT/POTENTIAL SOURCES:

The Government intends to synopsize this contract action in accordance with FAR Part 5 procedures and attach the justification for OTFAOC. The Government will also request and encourage other manufacturers, as well as offerors, to submit solutions that meet the Government’s baseline requirements for use on the DMCC Program. The Government will continue to conduct market research and review responses from potential sources to promote competition.

7. DETERMINATION OF FAIR AND REASONABLE COST:

The contracting officer will determine whether the proposed price is fair and reasonable prior to award. Other than certified cost and pricing data will be requested from the contractor at the time of solicitation. Evaluation of the supporting price documentation will be analyzed.

Additionally, contractor-proposed pricing will be compared to an Independent Government Cost Estimate and other contracts for similar licenses. Based on this analysis, the contracting officer will determine whether the proposed price is fair and reasonable.

8. MARKET RESEARCH:

The Government posted a Sources Sought Announcement on the Federal Business Opportunities (FBO) website on November 15, 2017, requesting responses by 4:00 p.m. Eastern Time (ET) on November 29, 2017. The Sources Sought was amended on November 28, 2017 to post for HUBZone firms and extended the request for responses to 4:00 p.m. ET on December 1, 2017.

The Sources Sought Announcement was to elicit responses from small and large businesses to gather information on a VoIP application that is compatible with the current DMCC configuration and architecture that can be provided to the DMCC user community. The Government received a total of five responses, four small businesses and one large business under the NAICS 511210. DISA PMO then conducted additional market research and a fifth small business was identified for consideration. The six results are as follows:

Submissions from Mission1st, Ideal Systems Solutions Inc., and RV Global Solutions Inc.

were deemed unable to fulfill the requirement because they did not provide a VoIP application capability that is compatible with the current DMCC Call Manager CUCM 10.5.2 and for use within the DMCC architecture.

The submission from NewTech Solutions Inc. was deemed unable to fulfill the requirement.

NewTech Solutions, Inc. proposed the use of Cisco Jabber as the VoIP capability for use within the current DMCC architecture. After testing, it was concluded that Cisco Jabber was unable to support certificate authentication for the existing CUCM 10.5.2. In order to get Jabber to support certificate authentication it would require the Government update the CUCM to version 11.5.

This presents an issue as updates to the call manager will break the authentication of the current devices due to encryption support mismatches. Without certificate authentication, the device and service would be inoperable as it cannot work with the current version and configuration of the Call Manager.

Cellcrypt, Inc. provided a response that highlighted their ability to provide a VoIP application for classified mobile devices and compatibility with the current Call Manager (CUCM 10.5.2).

Cellcrypt, Inc. is capable of meeting the full requirements.

Page 5 of 7 Pages

Additional market research conducted by the DISA Mobility PMO identified Fed Centric Technologies, LLC as an authorized reseller to provide the Cellcrypt VoIP application, capable of meeting the full requirements.

Market Research also consisted of reviewing the previous contracts, HC1013-16-P-0001 and HC1013-16-C-0003 and collaborating with mobility engineers, DISA leadership, DISA and NSA subject matter experts regarding the nature of the VoIP application and license. All information received supported a brand name approach to fulfill the subject requirement.

As the results described above, there are two small businesses capable of providing the required Cellcrypt VoIP capability; Cellcrypt, Inc. and Fed Centric Technologies, LLC. Establishment of a single award BPA for the brand name Cellcrypt VoIP application is required for secure voice communication on the DMCC devices.

9. ANY OTHER SUPPORTING FACTS: Not Applicable

10. LISTING OF INTERESTED SOURCES:

Cellcrypt, Inc.

Mission1st Ideal Systems Solutions, Inc.

NewTech Solutions, Inc.

RV Global Solutions, Inc.

Fed Centric Technologies, LLC

11. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FULL AND OPEN COMPETITION:

(a) Contractor: Cellcrypt, Inc.

Business size: Small Contract Number: HC1013-16-P-0001 Contract Period: November 1, 2015 through October 31, 2016 Type of Acquisition: Sole Source

Contractor: General Dynamics Mission Systems Inc. (GDMS), formerly GDC4S Subcontractor: Cellcrypt, Inc. provided the VoIP application and licenses under this contract.

Business size: Large Contract Number: HC1013-16-C-0003 Contract Period: March 2, 2016 through March 1, 2019 Type of Acquisition: Sole Source

(b) The Mobility PMO is currently working the next contract action, Mobility Enterprise

Services – Classified (MES-C), for an NSA approved open market system for a non-

Page 6 of 7 Pages proprietary solution. The re-designed architecture with the MES-C requirement may change the need for the Cellcrypt VoIP license.

The Government intends to synopsize the requirement in accordance with FAR Part 5.

Furthermore, the synopsis will remain “active” for the duration of the BPA to allow for other contractors or devices to be considered for use under the DMCC program.

The requirements for the VoIP application for the DMCC Program will be continually monitored, updated, and reassessed as the Government moves forward to remove barriers to competition. The Government will continue to perform market research to determine if market conditions have changed and/or identify other VoIP applications eligible for use under the DMCC program.

12. REFERENCE TO THE APPROVED ACQUISITION PLAN (AP): In accordance with the exceptions under DISA Acquisition Regulation supplement 7.103 (S-91)(1)(i), an AP is not required.

Page 7 of 7 Pages

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Jaime Berrios SIGNATURE: See Separate Signature PDF

TITLE/ORGANIZATION: DMCC-S Lead Engineer

PHONE: (301) 225-2383 DATE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Salvatore Scaglione SIGNATURE: See Separate Signature PDF

TITLE/ORGANIZATION: Branch Chief, ID1

PHONE: (301) 225- 2443 DATE:

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: Angela K. Zang SIGNATURE: See Separate Signature PDF

TITLE/ORGANIZATION: Contracting Officer/DISA/DITCO

PHONE: (618) 229-9435 DATE:

PROCURING ACTIVITY COMPETITION ADVOCATE APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief.

Since this justification does not exceed $13.5M, this review serves as approval and my written determination that the aforementioned FAR circumstances apply.

NAME: Gay Arnold SIGNATURE: See Separate Signature PDF

TITLE/ORGANIZATION: PACA/DISA

PHONE: (618) 229-9517 DATE:

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

Contracting Officer, Angela Zang, 618-229-9435, angela.k.zang.civ@mail.mil mailto:angela.k.zang.civ@mail.mil