JA Security Engineering 17 Jan 12.pdf

J&A FOR Joint Global Command and Control Systems (GCCS-J) Systems Security Engineering

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION (OTFAOC)

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

Justification for OTFAOC Number: JA12-038

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION

Upon the basis of the following justification, I, as the Procuring Activity Competition Advocate

(PACA), hereby approve the use of other than full and open competition of the proposed contractual action pursuant to the authority of 10 U.S.C. 2304c(b), only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

JUSTIFICATION

1. Agency and Contracting Activity. (FAR 16.505(b)(2)(ii)(B)(1))

Requiring Activity

Defense Information Systems Agency Program Executive Office for Command & Control Capabilities (PEO-C2C) 6914 Cooper Avenue Ft. Meade, MD 20755

Contracting Activity

Defense Information Systems Agency Defense Information Technology Contracting Organization - National Capital Region

(DITCO-NCR)

6914 Cooper Avenue Ft. Meade, MD 20755

2. Nature/Description of Action(s). (FAR 16.505(b)(2)(ii)(B)(2)) The purpose of this action is to award additional work under the current Encore II task order awarded to Science Applications International Corporation (SAIC), HC1028-08-D-2025-VC10, on a sole-source basis for a period of twelve (12) months to ensure critical Joint Global Command and Control Systems (GCCS-J) capabilities meet warfighting demands and requirements. GCCS-J is the designated DoD program of record for all Joint C2 capabilities.

This system was formally to be replaced by the Net-Enabled Command Capability (NECC) system, however funding for this replacement system was subsequently cancelled by Congress (ref. PUBLIC LAW 111-84-OCT. 28, 2009, 123 STAT. 2240, Section 247). Therefore, GCCS-J remains the designated DoD program of record for all Joint C2 capabilities. As a result, the GCCS-J

PMO was placed in a unique situation where it must maintain the deployed system in accordance with the Joint Requirements Oversight Council (JROC) approved “Do No Harm” concept as outlined in JROCM 145-09, 9 September 2009, while also addressing the need to enhance and transition logical capabilities away from local instantiations to the enterprise or use available enterprise services.

The GCCS-J PMO is awaiting the finalization of the Joint C2 Modernization Strategy, which includes, but is not limited to, the finalization of the Analysis of Alternatives by CAPE, OSD finalization the NII reorganization, adoption of the C2 portfolio management, and approval of the modernization strategy. The finalized Joint C2 Modernization Strategy will ultimately drive the acquisition construct currently pending DoD finalization of a variety of decisions, re-organization, policy, and re-defined levels of authority and responsibilities. This sole-source award of additional work is required to allow the Government sufficient time to develop, refine, transition, and competitively recompete the Security Engineering support requirement once the Joint C2 Modernization Strategy has been finalized.

The anticipated contract type is Cost Plus Fixed Fee (CPFF). The estimated cost of this sole source award is $3.2M and it will be funded with Operations & Maintenance Funding. The period of performance will be 1 February 2012 - 31 January 2013. No option periods will be included.

GCCS-J Systems Security Engineering support is currently provided by SAIC via ENCORE II Task Order HC1028-08-D-2025-VC10, which was awarded as a sole-source follow-on. This Task Order will expire on 31 January 2012 and all options, inclusive of FAR 52.217-8 - Option to Extend Services, have been exercised. DISA is currently in the process of developing, refining, and soliciting the recompetition of the Security Engineering support task; however, it is not anticipated that the new support contract will be in place prior to the expiration of the existing Task Order.

3. Description of Supplies/Services. (FAR 16.505(b)(2)(ii)(B)(3)) The Security Engineering requirement for GCCS-J System Engineering & Synchronization

(CC33) provides overall security, security engineering, and Information Assurance technical and administrative support to the GCCS-J PMO for core security software development, security system integration testing and fielding, along with the GCCS-J PMO modernization initiatives.

Although GCCS-J officially entered into sustainment in August 2009, with the termination of the Net-Enabled Command Capability (NECC) program (02 November 2009) the Program Management Organization (PMO) has been charged with three primary areas of responsibility moving forward: (1) sustaining the current operational GCCS-J capabilities, (2) maintaining synchronization across DoD of GCCS-J, joint interfaces and the GCCS FoS, and (3) evolving from the current GCCS-J to a next generation system using state of the art technology with minimal impact to the operators. In addition to covering sustainment and synchronization support for the deployed, operational GCCS-J baselines, the PMO is structuring its contracts and mission to be flexible enough to accommodate this modernization evolution to help ensure that critical capabilities are delivered to the Warfighter in the most timely, efficient manner.

The GCCS-J PMO is in a unique situation where it must maintain the deployed system in accordance with the Joint Requirements Oversight Council (JROC) approved “Do No Harm” concept as outlined in JROCM 145-09, 9 September 2009, while also addressing the need to enhance and transition logical capabilities away from local instantiations to the enterprise or use available enterprise services. Further, the GCCS-J PMO is a critical component of the Joint C2 Modernization strategy which will ultimately drive the acquisition construct currently pending DoD finalization of a variety of decisions, re-organization, policy, and re-defined levels of authority and responsibilities.

Support provided under the Security Engineering requirement will focus on maintenance of existing security and IA documentation / artifacts to include Security Feature Users Guide (SFUG), Trusted

Facility Manual (TFM), Security Configuration Management Compliance (SCMC), Operating System and Application Security lockdown/hardening products and packaging and configuration of Commercial

Off-The-Shelf (COTS) products. It will also include conducting secure coding assessments and analysis, and development/ maintenance/update of IA compliance tools in addition to support necessary for type accreditations in accordance with (IAW) DoD’s Host-Based Security Systems (HBSS) baseline, Chairman of the Joint Chiefs of Staff Instructions (CJCSI), GCCS-J Security Policy, DoD 8500.2, DoD

8551, DoD 8520 Public Key Infrastructure (PKI) / Public Key Enabling (PKE), Information Assurance

Vulnerability Management (IAVM), and Enterprise Anti-Virus Management.

This will include installation and fielding support, Subject Matter Expert (SME) onsite support for security specific issues, and Tier III help desk support.

4. Identification of Statutory Authority and Demonstration of Contractor’s Unique

Qualifications. (FAR 16.505(b)(2)(ii)(B)(4)) FAR 16.505(b)(2)(i)(B) - Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

The GCCS-J PMO is awaiting overarching GCCS-J program guidance which is pending finalization of the Congressionally directed modernization strategy report detailing the plans for the consolidation and modernization of Joint C2.

SAIC has been supporting the efforts of the GCCS-J Program Office (CC32 specifically) for several years and has been performing all of the services listed in "Section 3 - Description of Supplies/Services" shown above. SAIC has supported the efforts of the largest transition effort with the GCCS-J program office since the declaration of GCCS-J as the DoD Command and Control System of Record. This transition effort provided the SAIC workforce with a wealth of experience with the Government’s product line (which includes over 430 unique software components that are integrated into a server enclave with a discretely unique security architecture), architecture, configuration and geographically dispersed customer base that utilizes the Joint C2 capabilities on a 24/7/365 basis. SAIC has in-depth knowledge of capabilities comprising the entire GCCS-J product line, including installation, configuration and functional expertise. SAIC completely understands the operational and technical environments, which includes vendor operating systems, component Government off-the-Shelf (GOTS), integrated Commercial Off-the-Shelf (COTS), interfaces, unique software bundles, site unique configurations, Combatant Command (COCOM) unique user interfaces, the functional requirements and Warfighter expectations and demands. The highly specialized expertise and services provided by SAIC cannot be fully duplicated prior to the expiration of the current task order on 31 January 2012. In addition, SAIC’s expertise will be crucial over the next twelve (12) months while the GCCS-J program will be fielding new baselines to enhance warfighting capabilities, addressing COTS end of life issues and complying with security polices such that transition to a new provider could be detrimental to the operational capabilities and impact critical warfighting functions.

Although the Market Research discussed below indicates that the recompetition of this requirement may be competitive, this sole-source award of additional work is necessary because the pending OSD guidance will likely drive significant changes to the requirements to be captured in the re-compete. Furthermore, sole-source award of this additional work to SAIC is necessary due to the specialized nature of the current expertise provided. In the event that the recompetition of this requirement results in award to a contractor other than the incumbent, transition support will be required. The current task order will expire on 31 January 2012. As a result, there is insufficient time to facilitate a successful transition period. Disengaging from SAIC without such transition could effectively bring the project to a complete halt for approximately three (3) to five (5) months while a new contractor transitions key personnel, processes, and becomes acclimated with the required services to be performed. The GCCS-J mission and suite of functional in use capabilities requires continuation (with no disruption) of support services currently provided by SAIC and cannot accommodate a potential disruption of support.

Furthermore, the cost savings of not having to pay another contractor for this “ramp up time” would equate to $1,410,000.00 based on historical costs of approximately $470,000.00 p/month.

As a result of SAIC’s long tenure, extensive experience on this program, and the low turnover rate, the contractor has evolved a workforce that is cross-trained in the many different tasks called for under this contract and has become intimate with all aspects of the technical baselines, organizational process and battle rhythms. This highly experienced cross-trained workforce can be redeployed quickly to address and resolve sudden and unexpected areas of concern to the program which will be instrumental as DoD draws down its forces from two (2) theatres.

Failure to maintain contractor support provided by SAIC until such time that a new task order can be fully developed, competed, awarded, and transitioned will result in a loss of continuity of services and be detrimental to the GCCS-J program’s ability to provide basic operational support (help desk, Commercial Off-the-Shelf Hardware maintenance, Information Assurance Vulnerability Alerts & Category 1 Problem Investigations PBIs). GCCS-J provides critical situational awareness and joint operational planning to daily Warfighting and crisis action response activities in CENTCOM (support to the Iraq drawdown and Afghanistan conflict) and PACOM (support to the ongoing contingencies in Japan) and to other crises worldwide. Loss of continuity impacts the fielding of the v4.2 releases and release of Global 4.2.0.3 and 4.1.1.2., causing a major slip in vital GCCS-J upgrades for the Warfighter. Delays to fielding these enhancements puts DISA’s Joint Command and Control efforts in jeopardy, which in-turn compromises the Warfighter's ability to command and control military forces on the battlefield and obtain intelligence to conduct Joint operations.

SAIC’s continuous support of the GCCS-J PMO provides a workforce with significant experience with the Government’s product line, architecture, configuration, and customer base.

This experience is essential to rapidly responding to operational needs as well as to maintaining the technical progress and configuration of the GCCS-J baselines. SAIC has developed in-depth technical knowledge of the major baselines which comprise the overall GCCS-J:

• GCCS-J Global version 4.2.x

• GCCS-J JOPES Strategic Server Enclaves: version 4.2.x

• GCCS-J Readiness Strategic Server Enclave version 4.2.x

This technical knowledge includes the configuration, installation, interconnectivity, and operation of each of these major baselines. In addition, SAIC has seven (7) years of experience in how these major baselines interact through specialized data exchange protocols, and what data flows are exchanged between them. The technology underlying these baselines is changing so quickly that capturing that technical knowledge in documentation for turnover to different contractor prior to 31 January 2012 is impractical. That knowledge is available only through hands-on experience as the overall GCCS-J architecture and infrastructure is rapidly evolving towards meeting DISA's net-centricity and Joint Command and Control Architecture goals. This hands-on experience will be accomplished through a transition period from this sole-source award of additional work to the awardee of the recompetition to occur within the next twelve

(12) months.

In addition to the technical knowledge of the software, hardware, connectivity and communications required to successfully provide support for testing and deployment of the major baselines of GCCS-J system, SAIC has developed an extensive operational knowledge of how these major baselines are used by the Warfighter. This unique warfighter viewpoint enables SAIC to efficiently test GCCS-J for technical integration, interoperability and functionality during System Integration Tests (SITs) and their operational knowledge enables SAIC to efficiently test for operational performance GCCS-J during System Acceptance Tests (SATs).

This unique combination of technical and operational knowledge and experience has been demonstrated during recent highly successful SITs and SATs, Operational Testing and positive fielding decisions enabling our program to meet critical milestones, on schedule, and within cost.

In conclusion, it is in the best interest of the Government to issue a sole-source award for this additional work for a period of twelve (12) months to SAIC for the following reasons: DoD is finalizing its overall strategy for Joint C2 (e.g., finalization of the Analysis of Alternatives by CAPE, OSD finalization the NII reorganization, adoption of the C2 portfolio management, approval of the modernization strategy, etc.) remains in flux, GCCS-J PMO will be fielding a new baseline and accompanying capabilities over the next twelve (12) months that cannot be disrupted, a new vendor would require considerable ramp-up and a minimum of three (3) months to acquire a base level of knowledge to provide the GCCS-J with a minimal level of support; the highly specialized expertise of SAIC is impossible to duplicate prior to the expiration of the current task order on 31 January 2012; and not awarding to SAIC would put the operational software that provides C2 capabilities to the Warfighter at risk and jeopardize their ability to fight the Global War on Terrorism as well effectively support the in-process drawdown and reprioritization of US Forces.

5. Cost/Price Fair and Reasonable Determination. (FAR 16.505(b)(ii)(B)(5)

The Contracting Officer will determine a fair and reasonable cost based on the results of cost realism and comparison of the proposed rates to the pre-established rates in the ENCORE II contract and/or rate verification by DCAA.

6. Description of Market Research.

Market research was conducted prior to the issuance of the current Task Order, HC1028-08-D- 2025-VC10. The market research involved internet research on the vendor’s capabilities and past performance information. Market research was also done on vendors who could perform the combined work on other contract vehicles; i.e. GSA, by researching capabilities and scope of work under GSA contracts. Vendors researched had expertise with software development;

however, they lacked significant relevant technical experience with the complexities of the Global Command and Control System as well as little to no past relevant performance experience within programs of this nature (GCCS-J is a highly complex and widely dispersed (over 1000 instances) capability dependant on hardware and software that is partially COTS and partial custom).

Furthermore, market research has been conducted for the recompetition of the Security Engineering task via the issuance of a Request for Information (RFI) on 14 October 2011 and subsequent assessment of the respondent’s technical capabilities. The results of current market research identified that a competitive market exists for the required services; however, due to the delay in issuance of Joint C2 Modernization Strategy, the GCCS-J PMO is unable to develop, refine, compete, award, and transition these services prior to 31 January 2012. As a result, it is necessary to issue a sole source award for twelve (12) months to SAIC. Without this twelve (12) month sole-source award, there would be an unacceptable gap in support services to the GCCS-J program.

7. Any Other Supporting Facts. (FAR 16.505(b)(2)(ii)(B)(6)) The Deployment and Sustainment requirement was initially competed amongst NexGen Large Businesses contract holders, resulting in the award of Task Order DCA100-02-D-4008/0004 to SAIC for one-year 14 Dec 02 – 9 Jan 04. SAIC was later awarded follow-on one-year Cost Plus Award Fee (CPAF) Task Orders:

DCA100-02-D-4008/0022 (24 Dec 03 to 29 Jan 05) DCA100-02-D-4008/0035 (04 Feb 05 to 31 Mar 06) DCA100-02-D-4008/0047 (16 Mar 06 to 14 Mar 07) DCA100-02-D-4008/0052 (01 Mar 07 to 31 Mar 08) DCA100-02-D-4008/0056 (01 Apr 08 to 17 Jun 09)

More recently, the requirement was competed amongst ENCORE II contract holders, resulting in the award of a one-year Cost Plus Fixed Fee (CPFF) with Performance Incentive Task Order HC1028-08-D-2025/VC05 to SAIC with a follow-on one-year CPFF with Performance Incentive Task Order HC1028-08-D-2025/VC10. A sole-source Justification & Approval was approved for each of the follow-on efforts cited above.

8. Actions Taken to Remove Barriers to Competition. (FAR 16.505(b)(2)(ii)(B)(7))

The Government is in the process of developing a competitive strategy to address required support after this extension. The Government will leverage its findings from the RFIs and combine that with modernization strategy for Joint C2 which will allow for potential greater competition. Based upon market research and the refinement of the Government’s requirements along with an updated acquisition strategy is the Government has a reasonable expectation that a competitive market will exist for these services in the recompetition.

a. Procurement History:

(1) Deployment and Sustainment services are currently provided by SAIC on task order HC1028-08-D-2025-VC10.

(2) The current task order is Cost Plus Fixed-Fee with Performance Incentives

(CPFF-PI).

(3) The current task order was issued as a sole-source follow-on to task order

HC1028-08-D-2025-VC05.

b. The current task order will expire on 31 January 2012 and all options, inclusive of

FAR 52.217-8 - Option to Extend Services, have been exercised.

c. A notice will be published to FedBizOpps as required by FAR 5.301 within 14 days of award of this sole source action for a minimum of 30 days.

9. Reference to the Approved Acquisition Plan (AP)/Program Plan (PP).

This effort does not meet the threshold requirement for an approved Acquisition Plan.

TECHNICAL CERTIFICATION: "I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief." (FAR 16.505(b)(2)(ii)(B)(9)).

NAME: Richard Bartoletti____________ SIGNATURE: _//SIGNED//______________________

TITLE: Computer Scientist___________ DATE: 10 Jan 12________

REQUIREMENTS CERTIFICATION: "I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.” (FAR 16.505(b)(2)(ii)(B)(9)).

NAME: Justin Fertick___________ SIGNATURE: __//SIGNED//_____________________

TITLE: Prog Control Deputy_______ DATE: 10 Jan 12

CONTRACTING OFFICER CERTIFICATION: “I certify that this justification is accurate and complete to the best of my knowledge and belief.” (FAR 16.505(b)(2)(ii)(C)(1)).

NAME: Christopher A. Gray_________ SIGNATURE: __//SIGNED//_____________________

TITLE: Contracting Officer__________ DATE: 10 Jan 12

PROCURING ACTIVITY COMPETITION ADVOCATE APPROVAL

“I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief. Since this justification does not exceed $12.5M, this review serves as approval.”

APPROVED BY: (FAR 16.505(b)(2)(ii)(C)(2))

Signature: //SIGNED//

ANN M. VAUGHN, Procuring Activity Competiton Advocate, PLA Printed/Typed Name and Title Organization Phone Date 13 Jan 12