JA19-106_Acropolis_Bridge_no_sig_Redacted.pdf

JUSTIFICATION & APPROVAL (J&A) FOR FEDERAL ACQUISITION

REGULATION (FAR) SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Schedule/Multiple Award Contract (MAC) Orders under MAC/ Fair Opportunity – FAR 16.505, Department of Defense FAR Supplement

216.505-70, Procedures, Guidance and Information 216.505-70

Purchase Request Number: HC108919CDD6604 Contract Number: HC1028-08-D-2023 Task Order (TO) Number: 0064 Procurement Title: Acropolis and Sensor Operations Estimated Value:

Authority: FAR 16.505(b)(2)(i)(C)

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

Number: JA19-106

Upon the basis of the following justification, I, as the Head of the Contracting Activity, hereby approve this exception to fair opportunity pursuant to the authority of FAR 16.505(b)(2)(i)(C).

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

Defense Information Systems Agency (DISA)/Development and Business Center/Cybersecurity Infrastructure Branch/ID66 6910 Cooper Avenue Fort Meade, Maryland 20755

Contracting Activity:

DISA/Defense Information Technology Contracting Organization (DITCO)/PL8311 2300 East Drive, Building 3600 Scott Air Force Base, Illinois 62225

2. NATURE/DESCRIPTION OF ACTION(S): This bridge modification action is to extend the current Acropolis and Sensor Operations program support, until the follow-on acquisition can be awarded. The period of performance (PoP) for the bridge extension is a six-month base period with two, six-month option periods, June 1, 2019 through November 30, 2020. The estimated price of the firm fixed price requirement is . Fiscal Year (FY) 2019 and FY 2020 Defense Working Capital Funds appropriations will be used to fund this action.

3. DESCRIPTION OF SUPPLIES/SERVICES: The services are for the critical Acropolis and Sensor Operations program which provides technical, engineering, operational, sustainment, and management functions. The Acropolis program provides a secure, consolidated and integrated Defensive Cyber Operations (DCO) and global situational awareness environment for cybersecurity analysts within the Department of Defense (DoD) to protect and defend the DoD checked in erro checked in erro

Acropolis and Sensor Operations, HC1028-08-D-2023-0064, JA19-106

Information Network (DODIN). Northrop Grumman currently provides the services under HC1028-08-D-2023, TO 0064. The bridge will ensure that continuity of Acropolis and Sensor Operations and sustainment support is in place until the follow-on is awarded. The PoP for the bridge is a six-month base period with two, six-month option periods, June 1, 2019 through November 30, 2020. The total estimated value for the bridge PoP is .

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity. The order must be issued on a sole-source basis in the interest of economy and efficiency because it is a logical follow-on to an order already issued under the contract, provided that all awardees were given a fair opportunity to be considered for the original order.

(b) Description of the Justification. The current TO PoP ends on May 31, 2019. All six months of the option to extend services, FAR 52.217-8, have been utilized. Efforts are ongoing to pursue a competitive follow-on, which will provide support to the Acropolis program. The award process has been delayed due to requirement definition changes including new work, re-architecture of current work, and transition to a hybrid cloud architecture. Such changes have included transition to a different architecture based on new operational requirements and new work from the National Security Agency.

Additional changes are also necessary for structuring the Acropolis core and non-core work. As a result of the necessary requirement changes, award could not be made by May 31, 2019, the current TO date of expiration. The six-month bridge could minimally provide the acquisition time necessary for competing a follow-on effort. The options to extend performance for two additional times of six months is included to provide continuation of services in the event of extensive evaluations, need for three-months of transition, or a protest of the follow-on effort. In the current DoD network environment, loss of Acropolis program support will cause critical failures in DISA’s ability to protect and defend the nation from a cyber-attack. The bridge extension mitigates cyber-attack risks to the DODIN and DISA impacting over 7,000 cybersecurity users across DoD and prevents work stoppage and loss of Tier II sustainment support for numerous hosted programs. It is unreasonable to assume any contractor awarded this effort would be able to immediately comprehend, adapt, manage, and execute Acropolis operations and sustainment support with any semblance of success in the amount of time required.

Three months is required for transition of Acropolis under normal circumstances with overlapping of contracts to allow for transition. Without an overlap of the current effort and the bridge or follow-on effort, transitioning of a new contractor would take several more months and required direct Government oversight and management. Under the bridge extension, the contractor will be responsible for maintaining sustainment support of the current Acropolis and Sensor Operations system to ensure that it remains operational and secure until the follow-on effort can be awarded. Given the limited duration of this bridge effort, introducing a new contractor as an alternative solution would entail hiring trained personnel and close Government management and oversight to ensure adequate support for the Acropolis and Sensor Operations. Such action would checked in erro result in unacceptable program delays and costs to the Government. It is not in the Government’s best interest to provide continued coverage under any other terms than the proposed logical follow-on extension to the current TO and contractor. It is unreasonable to assume any contractor awarded this bridge effort would be able to provide the necessary level of Acropolis program support with any semblance of success in the amount of time allowed. Northrop Grumman understands the requirements and currently possesses the requisite expertise for continued successful performance. The scope of requirements to be provided under the bridge remain unchanged from the requirements provided under the current TO.

(c) Justification.

(1) Minimum Government requirements. The contractor will provide Acropolis operations and sustainment support at its current level in order to support the DoD starting June 1, 2019 immediately following the current PoP. This includes maintaining current integrity, security, and interoperability of the current system until support can be transitioned to the awardee of the follow-on effort. At a minimum, the six-month base period is required to allow for procurement of the follow-on effort; the two six-month option periods will be used if further award delays are encountered, to include transition and protest if applicable.

(2) Proposed sole source contractor. Northrop Grumman, the current contractor, has been instrumental in supporting Acropolis operations and sustainment requirements over the life cycle of the current TO. Northrop Grumman is the only capable source to continue to provide the same services starting June 1, 2019, without degradation to the Acropolis and Sensor Operations program. The contractor has skilled, trained staff in place to successfully provide the program support required.

Moreover, transition with the institutional knowledge from the incumbent is key to carrying the Acropolis and Sensor Operations program concepts and processes going forward. Northrop Grumman is currently working with knowledge that leverages economies and efficiencies for the Agency. It is approximated that a minimum six-month lead-time would be required for requirements package development, solicitation, evaluation, and award of a competitive effort for continued support. Further, any short-term successor would require a minimum of three months for the awardee to understand the scope, scale, and complexity of the Acropolis and Sensor Operations program. A competitive bridge award to another source would result in unacceptable delays in continuation of services. Sufficient time to award this bridge competitively is not available. An unsupported baseline for any length of time would be devastating to the Acropolis program. Lost support will cause critical failures in DODIN cybersecurity and DISA’s ability to protect and defend the DODIN. As a result, a determination was made that there is a significant benefit to the Government by having the incumbent contractor continue work for the bridge under the competitively awarded TO.

(3) Discussion regarding cause of the sole source situation. This effort is currently working through the acquisition strategy as a result of restructuring the Acropolis core and non-core work. The follow-on has required definition changes including new work, re-architecture of current work, and transition to a hybrid cloud architecture. The six-month extension under FAR 52.217-8 has been exhausted;

however, the support that Northrop Grumman provides for Acropolis to the DoD is critical and a break in service could prove to be detrimental to the entire DoD.

Therefore, a bridge extending services to the current contractor, Northrop Grumman, is necessary.

(4) Demonstration of unique source. Northrop Grumman is uniquely postured to provide the Acropolis operations and sustainment services without loss of time and work stoppage starting June 1, 2019. Northrop Grumman understands the requirements and currently possesses the requisite expertise and relevant experience. Any other contractor would, at a minimum, have to first understand the scope, scale, and complexity of the Acropolis program and its application across the DODIN. This is in addition to recruiting personnel with specialized qualifications and training, working clearances for contractor personnel operating in a Government Sensitive Compartmented Information Facility, and completing the lengthy onboarding process necessary to support the effort before technical support services could continue (i.e., in-processing, establishment of user credentials and accounts). This would cause unacceptable delays to the continued support efforts.

(5) Procurement discussion. The nature, scope, and criticality of the Acropolis operations and sustainment provided by Northrop Grumman remain constant. Any lapses or delays would result in mission failure of the Acropolis program. Critical architecture upgrades for continued operation are crucial to provide DODIN cyber protection, as well as a DoD mandated support through location changes to the computing centers. This continued Acropolis program support is essential beyond May 31, 2019 and prior to award of the follow-on effort. These tasks cannot be accomplished without a continuation of the Acropolis TO. Northrop Grumman has successfully provided the services listed within the scope of the Acropolis and Sensor Operations TO for the entire awarded period. It is a logical follow-on to the initial order and in the Government’s best interest for Northrop Grumman to continue to provide these services until DISA/DITCO can execute a competitive follow-on effort that aligns with the scope required and current policies and regulations.

(6) Impact. A bridge award to any other contractor that does not have the institutional knowledge, expertise, and unique skill sets would potentially place a significant burden on the Acropolis environment and the Government. Failure to maintain the level of support provided by Northrop Grumman until a follow-on can be awarded and transitioned will result in a loss of continuity of services and will be significantly detrimental to DISA’s ability to protect and defend the DODIN and the nation from cyber-attacks. As stated above, Acropolis is the DoD’s secure, consolidated, and integrated DCO and global situational awareness environment for cybersecurity analysts within the DoD. Analysts utilize the Acropolis environment to protect and defend the DODIN. Acropolis and the cyber data and tools that reside within it are critical to the protection and defense of the nation. The failure to provide support for the Acropolis would result in the rapid decline of capability, leaving the DODIN vulnerable to cyber exploitation. In the current DODIN environment, loss of Acropolis support will cause critical failures in cybersecurity, and degrade DISA’s ability to successfully protect and defend.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION: A price evaluation will be accomplished to determine price fair and reasonable at TO modification. The contracting officer will use established ENCORE II fixed price labor rates on Northrop Grumman’s basic contract, historical data on the current TO, and comparison to the independent Government cost estimate to the price proposal.

6. MARKET RESEARCH: As a result of the restructuring of the Acropolis core and non-core work, the acquisition planning is in development until the requirements are defined. Based on the acquisition strategy status, it is not currently feasible to award the subject TO to another contractor in sufficient time to avoid a bridge. The Government has determined that the current level of support can only be provided by the incumbent, who has been the sole technical support contractor. Northrop Grumman is the only source that can successfully continue providing the level of support required without risk of a substantial break in support of the Acropolis and Sensor Operations effort.

7. ANY OTHER SUPPORTING FACTS: None.

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History. The Acropolis and Sensor Operations TO was previously competed providing fair opportunity under the ENCORE II multiple award contract vehicle. Northrop Grumman, a large business, was awarded the TO (HC1028-08-D- 2023-0064) on December 1, 2014 with a PoP consisting of a 1-year base period and three, 1-year option periods. In December 2018, and in accordance with FAR 52.217-8, the TO was extended for a 6-month period. Final performance expires May 31, 2019.

(b) An exception to fair opportunity or full and open competition has not been accomplished for any prior procurement for this requirement. The requirements covered under the Acropolis effort are currently being recompeted.

9. REFERENCE TO THE APPROVED ACQUISITION PLAN (AP): A streamlined AP was approved June 25, 2014 by head of the contracting office. The streamlined AP was modified for this bridge action.