CSP_JA.pdf

Enclosure 12b, J&A (Part 8) Page 1 of 10 Pages

13Aug2012/v1.4

Purchase Request Number: CMTIA4122090 Contract Number: TBD Task/Delivery Order Number: TBD Procurement Title: DoD Public Key Infrastructure National Security Systems (NSS) Common Services Provider (CSP) Contracting Office: DITCO-Scott Estimated Value: $8,926,181.56 (base plus 2 option years, inclusive) Statutory Authority: Title III of the Federal Property and Administrative, Services Act of 1949 (41 U.S.C. §251, et seq.) and Title 40 U.S.C. §501, Services for Executive Agencies FAR 8.405- 6(a)(1)(i)(B)))

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION (OTFAOC)

LIMITED SOURCES JUSTIFICATION

Justification for OTFAOC Number: JA12-181

Upon the basis of the following justification, I, as Procuring Activity Competition Advocate, hereby approve the use of other than full and open competition of the proposed contractual action pursuant to the authority of Title III of the Federal Property and Administrative, Services Act of 1949 (41 U.S.C. §251, et seq.) and Title 40 U.S.C. §501, Services for Executive Agencies FAR 8.405-6(a)(1)(i)(B) Only one source is capable of providing the supplies or services required at the level of quality required because the supplies or services are unique or highly specialized.

JUSTIFICATION

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

Requiring Activity:

Defense Information Systems Agency Code: PEO-IAN (IA-4) PKI and Identity Services Branch 6914 Cooper Ave Ft Meade, MD 20755-7090

Contracting Activity:

Defense Information Systems Agency

Defense Information Technology Contracting Organization-Scott AFB

ATTN: PL8X

2300 East Drive Scott AFB, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S): (FAR 8.405-6)(c)(2)(ii))

New sole source FFP contract. Vehicle: GSA IT-70. Funding will be O&M Defense Working Capital Funding (DWCF).

Page 2 of 10 Pages

13Aug2012/v1.4

3. DESCRIPTION OF SUPPLIES/SERVICES((FAR 8.405-6)(c)(2)(iii))

In response to WikiLeaks, the Office of Management and Budget (OMB) and the Committee for National Security Systems determined that all federal agencies that operate on the federal classified/secret networks must implement a hardware based PKI solution to protect their information and networks. The objective is to remove anonymity and improve the overall security of the federal secret networks. There is a sense of urgency to have all federal agencies using hardware tokens to access their networks and information as quickly as possible. Since DoD is already well on their way to implementing the DoD PKI SIPRNET token capability, it was decided that DoD would leverage its existing infrastructure to standup a common service provider (CSP) capability to all federal agencies except for Department of State and FBI which already had their own systems. Because DISA is the operator of the DoD PKI, DISA will be the CSP for the federal agencies. The Period of Performance (POP) for this contract is 364 days after contract award plus 2 one year options for a total contract period of 3 years. The CSP is a new item for the DoD PKI and requires a contractor that understands how the SIPR Token Management System is designed and implemented.

These tasks are designed to test, implement and sustain the CSP adhering to Committee of National Security Systems CNSS Policy No. 25 which outlines the requirements for using the National Security System - Public Key Infrastructure (NSS-PKI) to protect information on national security systems. A CSP is being established under the NSS PKI from which Federal partners that do not directly operate a subordinate Certificate Authority (CA) can acquire PKI services. Executive Order (EO) 13587 directs structural reforms to ensure responsible sharing and safeguarding of classified information on computer networks. The EO calls for coordinated interagency development and reliable implementation of policies and minimum standards regarding information security, personnel security, and systems security. Additionally it calls for DISA to implement NSS PKI CSP.

• CSP: The CSP is responsible for operating the infrastructure to provide certificate lifecycle management to participating agencies, including Certification Authority Systems (CAS); providing Registration Authorities (RA) services to support certificate issuance, management, and revocation for small agencies; providing training to participating agencies for operation of their components and trusted roles; providing Tier 2 and Tier 3 help desk support to participating agencies; and providing oversight and support for smart card token procurement and management. At the 6 October 2011 CNSS Committee Meeting, a decision was made that the CSP would be operated by the operational authority for the Department of Defense (DoDPKI), the Defense Information Systems Agency, leveraging their existing NSS PKI processes and procedures.

• Participating Agencies: Each participating agency is responsible for providing Trusted Agents (TA) to perform user identity proofing and certificate requests; operating and maintaining authoritative data sources for verifying applicant information to support certificate issuance; installing card readers and middleware software on user workstations; managing card stock; providing Tier 1 help desk support to end users; and distributing cards to end users. Large participating agencies are responsible for providing RA services in addition to TAs. Participating agencies are also responsible for sponsoring

Page 3 of 10 Pages

13Aug2012/v1.4 and supporting their affiliates, including contractors and state/local/tribal government or non-US entities that access agency Secret level networks or information. Participating agencies must establish processes and funding to enable networks and information systems to use PKI as well as providing funding in accordance with their Memorandum of Agreement (MOA) with the CSP.

• NSS PKI Managing Governing Body (MGB): As defined in [CNSSP 25], the MGB is made up of federal government departments and agencies that require or rely on certificates issued by the NSS PKI. The MGB is responsible for approving the Certificate Policy Statement (CPS) of the CSP. The MGB is also responsible for approving any interoperability relationships between the NSS PKI and external PKIs such as those operated by allied and coalition partners. All participating agencies are required to participate in the MGB. In addition, agencies who are operating their own CA under the NSS PKI Root CA also participate in the MGB.

NSS PKI certificate credentials are intended to be part of an overall identity, credential, and access management architecture such as that described in the Federal Identity Credential and Access Management (ICAM) Roadmap. The certificate lifecycle management process leverages identity information from authoritative data sources to validate the entity (both human and devices) obtaining the certificate and Subscriber information contained in the certificate.

Certificates are used to support logical access control decisions and authentication to classified networks and applications through the NSS PKI credential. NSS PKI certificates themselves contain only limited Subscriber information (e.g., for the NSS PKI, a name certificate provides the subject’s name, agency association, affiliation type, and citizenship). Other attributes necessary for access control decisions are not provided by the NSS PKI. However, these authoritative attribute sources should link to the identifier provided by NSS PKI credentials.

The figure below provides a high level overview of the requirements for implementing Identity Credential and Access Management (ICAM). Capabilities that are supported by the NSS PKI and the associated CONOPS are circled and highlighted in red.

Page 4 of 10 Pages

ICAM Functional Representation

4. IDENTIFICATION OF STATUTORY AUTHORITY and DEMONSTRATION OF

CONTRACTOR’S UNIQUE QUALIFICATIONS: Title III of the Federal Property and Administrative, Services Act of 1949 (41 U.S.C. §251, et seq.) and Title 40 U.S.C. §501, Services for Executive Agencies FAR 8.405-6(a)(1)(i)(B))) Only one source is capable of responding due to the unique or highly specialized nature of the supplies or services Tangible Software Inc. 2010 Corporate Ridge, Suite 620 McLean, VA 22102.

Tangible is the only vendor who has the knowledge, experience and skills to make these major modifications to PKI and GDS within the timeframes established by OMB. In the case of PKI, the token management capability and certificate authorities need to be significantly changed to reflect federal naming standards, add addition profiles and configurations for the other federal agencies, and provide the separation of the agencies within the registration and issuance process.

In addition, they must change the registration process to allow the other agencies to feed authoritative information into the system to support the registration and issuance of tokens within each agency. The DoD infrastructure is still being refined and modified as part of the DoD PKI acquisition program so the developer making these changes must be knowledgeable and aware of the impending DoD changes since the federal agencies will be using the same DoD infrastructure. The capability must be delivered and fully tested within 10 months. Only Tangible has the capability to meet these requirements. Tangibles unique PKI skill set is obtained via actual hands on the SIPR Token issuance infrastructure, which is a relatively new functionality for the DOD PKI. Tangible is the only vendor that has performed operations and sustainment for this system. They are the only small business contractor that has the required

REGISTRATION

AND NAMING

PRIVILEGE

MANAGEMENT

CREDENTIAL

MANAGEMENT

ATTRIBUTE

MANAGEMENT

Authentication credential validation

Authorization access based on access policies

Entity identifier identifier attribute schema attribute schema attributes attributes access policies attributes credential

Authentication additional attributes identifier credentials

Page 5 of 10 Pages

13Aug2012/v1.4 expertise to provide the guidance to the Services, Combatant Commands, Agencies and IC that will be provided SIPR Tokens. Failure to provide adequate guidance and customer support implementing the SIPRNet Token would have a direct loss in the overall secure posture of this program.

GDS, will require significant changes to the directory structure to reflect the addition of the federal agencies and their directory tree structures. There will also need to be changes made in the directory to prevent publishing of individuals who should not be published for security reasons as well as modifications to the access controls to allow limited federal agency access.

Due to time constraints and complexity of the GDS infrastructure, the government’s determination is that only Tangible can complete this work to meet OMB mandates within the allotted timeframe. Tangible is the vendor that designed and implemented GDS for the DOD.

Their inherent knowledge of the GDS system will enable them to quickly diagnose and correct problems relating to integration and or design of the directory structure for CSP.

Tangible Software Inc. is the current Operations and Sustainment (O&S) contractor for the DOD Public Key Infrastructure (PKI). Tangible Software has over 8 years in assisting the government in the operations, maintenance, lifecycle management, systems engineering, software development and compliance services. Tangible Software is the only contractor with the Subject Matter Expertise (SME), in-depth understanding of the underlying architecture, and engineering theory of Public Key Technology to operate, maintain and enhance the CSP, a program of national significance. Tangible’s team already has the expertise, engineering talent and experience with current instantiations of the SIPR TOKEN and is the only provider that can meet the cost and time constraints required to meet the Executive Order (EO) 13587 for support of the agencies as required under this EO.

Additionally, Tangible is unique in that Tangible provides personnel whose breadth of knowledge and understanding of the X509 standard and interaction of PKI and GDS systems proper provides the experience necessary to operate and sustain the DOD PKI Infrastructure. As shown in market research conducted through DITCO, all vendors that responded to the RFI included little detail when ask to provide information on the actual operation of internal components of PKI operations. As shown on the RFI vendor submittals the vendors responses contained information on Public Key Enablement (PKE). While PKE services the end users of PKI it has very little to do with internal operations of PKI systems proper. To reiterate there were 12 vendors that responded to our RFI out of those twelve vendors eleven have a very limited PKI knowledge base. The remaining vendor was Tangible Software Inc. To be specific, their PKI resource team was able to provide complete details on PKI systems operations.

Tangible was a key element of the PMO team that developed the SIPRNet Analysis of Alternatives (AoA), which supported the development of the SIPRNet Alternate Token and design specifications for the Token Management System (TMS), and were also instrumental in assisting the DOD PKI Program achieve major milestones in implementation of the TMS systems. Tangible supports these tasks today for the DOD, and currently no other small business contractor has the expertise and broad knowledge of the PKI that will be required to ensure the success of the CSP program.

Page 6 of 10 Pages

13Aug2012/v1.4

Tangible has been instrumental in implementing significant performance enhancements to the current operating environment to allow growth within the customer required response times. To accomplish this, Tangible has invested in considerable intellectual capital into these performance enhancements. Due to the expected growth of the SIPR CA, supporting the federated clients there will be an immediate need to make performance enhancements to the overall security posture to meet the anticipated growth demands of the SIPR Token by the Services, Combatant Commands, Agencies and the Intelligence Community (IC)

The SIPR Token is a relatively new functionality for the DOD PKI. Tangible is the only vendor that has performed operations and sustainment for this system. They are the only small business contractor that has the required expertise to provide the guidance to the Services, Combatant Commands, Agencies and IC that will be provided SIPR Tokens. Failure to provide adequate guidance and customer support implementing the SIPRNet Token would have a direct loss in the overall secure posture of this program.

Tangible has a government supplied Integration and Test (I&T) lab in their corporate facility to test and ensure compliance of all security requirements Security Technical Implementation Guide (STIGs), for required sustainment packages, before they are deployed to the Production SIPR environment. The approximate value of the equipment and required software in Tangible’s I&T lab is $1,645,984.00. Even if another vendor with the specific skills and expertise to enhance and sustain the systems had been identified, it would be cost prohibitive for the government to supply duplicate hardware and software in the new vendors’ facility.

Additionally, Government estimates for procurement and setup of such a test and compliance facility would be six months, which would drive further schedules delay and cost increases.

As part of this tasking there is a need to modify the Certificate Revocation List (CRL) distribution and Directory Server to be able to publish the CRL’s and keep the directories current. The current time window for subscriber authentication is unacceptable for the CSP and requires modification. Tangible is the only contractor that has the expertise to modify the Global Directory Services (GDS) to ensure the success of the program. A break in those services provided by Tangible would result in significant risk to the government by inserting another contractor into a program in the middle of an upgrade of the Directory services for the SIPR instantiations. Risk for this break would involve a Denial of Service (DOS) for DoD as a whole.

To explain the risk one must understand the process. Certificate Authorities (CA) generate CRL’s which show the validity of an issued certificate. The CRL’s are retrieved from the CA by a series of automated fetching mechanisms and placed into GDS for content service worldwide.

RCVS retrieves the CRL’s from GDS and processes verification request from end users. The risk comes into play if the vendor does not understand and performs a task that does not allow these mechanisms to function properly. One missed configuration, step or system not properly tuned can potentially spell disaster for the entire DoD as no one would be able to log on to their workstation, server, website, or email system.

Modifications will need to be made to the Joint Enterprise Directory Service (JEDS) to support the directory service for the SIPR token to ensure secure access to the SIPR Token artifacts for reporting to those with the need to know. Tangible is the current operations and sustainment contractor for this program. JEDS will require significant software modification in order to

Page 7 of 10 Pages

13Aug2012/v1.4 support the CSP as the federal community will require different directory service modules. The DOD module for directory service will not work with the CSP. Interjecting another vendor for the JEDS system would create considerable process disruption and result in likely cost and schedule issues as Tangible is the current vendor to support and sustain this directory service for DoD. Tangible designed, built, and implemented the JEDS architecture, which is very complex.

The program does not have sufficient time for another vendor to understand the JEDS design specs and begin work on the CSP portion.

To support the full usage, and meet customer requirements for delivery of the responses to the credentials the contractor must deploy RCVS nodes to the PACOM and EUCOM sites. Again Tangible has the team with the exceptional skills needed to build and deploy the RCVS nodes into the expanded environment to meet the critical operation needs of the CSP. Tangible has the expertise, management structure, lab infrastructure, approved GSA rates, and security cleared SME’s and System Administrators already supporting the PKI O&S program to support the government’s requirements for this effort. The time required to get another contractor cleared, trained, get their staff 8570 certifications would delay the program, increase the government cost, and create an unacceptable conditions for maintain the current security posture of the program and its ability to deliver the necessary and required services to the war fighter. To bring another vendor on board would require significant duplication of effort. The inbound vendor would be required by contract clause to be 8570 trained at the required levels would cost the government at least $25k in classroom training and 6 months in schedule slip. This information was obtained by reviewing courses required cost, scheduled course dates, and the number of individuals that must be trained by the vendor. The facility and personal clearance levels are from a base requirement of secret to Top Secret (TS) Secret Compartmental Information (SCI) the process of obtaining these security clearances could range from a few weeks to several months. Again, this would create schedule and additional cost. According to the CSP CONOP and Plan of Action and Milestones the program only has ten months to issue the first token to federal partners. If the program is forced to use a different vendor it could potentially cause the program to miss the DOD CIO’s mandate while waiting on the vendor to ensure staff compliance.

Tangible is the only source that can meet the government’s needs. As noted above Tangible has refined its knowledge base and techniques that are used to tune GDS and PKI to meet the requirements as the system continues to be enhanced to thwart known and perceived threats to the infrastructure. They will be required to continue to apply these techniques on the SIPR Token Management System scales to meet the emerging needs as new agencies are on provided these services.

5. BEST VALUE DETERMINATION: (FAR 8.405-6)(c)(2)(v))

Tangible is the current vendor for this effort and was awarded the contract through competitive selection. Tangible’s rates are published in their GSA IT 70 schedule and can be used as a guide for reasonable pricing. Additionally, Government estimates derived from on-going work can be used to establish reasonable rates. The contracting officer will make a determination that the anticipated prices are fair and reasonable.

6. MARKET RESEARCH: (FAR 8.405-6)(c)(2)(vi))

Page 8 of 10 Pages

A request for information (RFI) was issued in April 2012 to determine small business market interest and capability in PKI. 12 vendors responded (source list provided). Large businesses were not precluded from responding, but no large business responses were received.

Additionally, the RFI asked the vendors to identify partnership arrangements in the responses.

Analysis was completed in July 2012.

The RFI asked vendors to present their knowledge and experience in several areas key PKI areas.

The areas included PKI operations, PKI technical support areas and hardware and software specific to the DoD PKI program. The analysis by a team of subject matter experts determined that although there is considerable interest in the small business community, there is relatively little expertise in the PKI arena.

The responses indicate a range of ability within the PKI technical area. Some vendors demonstrated an understanding of PKI concepts but could not demonstrate adequate operational background and experience. Other vendors demonstrated competence in one or two areas, but did not possess sufficient capability across the entire spectrum of capabilities. As shown in market research conducted through DITCO, all vendors that responded to the RFI included little detail when ask to provide information on the actual operation of internal components of PKI operations. As shown on the RFI vendor submittals the vendors responses contained information on Public Key Enablement (PKE). While PKE services the end users of PKI it has very little to do with internal operations of PKI systems proper. To reiterate there were 12 vendors that responded to our RFI out of those twelve vendors eleven have a very limited PKI knowledge base. The remaining vendor was Tangible Software Inc. To be specific, Tangibles submittal provided the information requested in the RFI. Tangible resource team was able to provide complete details on PKI systems operations.

7. ANY OTHER SUPPORTING FACTS. (FAR 8.405-6)(c)(2)(vii))

The Government cost for duplicative effort would be approximately $6M. That is based on the hardware and labor costs to establish an additional, redundant I&T lab to support CSP development. Additionally, there may be additional operations costs to other federal departments and agencies to mitigate or otherwise work around the security issues meant to be mitigated by the EO. It is not possible for DISA to estimate those additional costs.

List of interested parties to this requirement (besides the DoD and DISA):

The Office of the President Office of Management and Budget Department of Justice Department of Commerce Department of Homeland Security Department of Energy

CIA/DNI

Page 9 of 10 Pages

13Aug2012/v1.4

8. ACTIONS TAKEN TO REMOVE BARRIERS TO COMPETITION:

(FAR 8.405-6)(c)(2)(viii))

Tangible Software, Inc. has been supporting DISA PKI operations and sustainment for several years. Prior to being an 8(a) set-aside program, PKI operations and sustainment was a large business program, for which Tangible was a sub-contractor. In researching market maturity and opportunities, several 8(a) vendors indicated interest in competing for the contract; however, when the full requirements were released through the solicitation, only one vendor, Tangible, responded.

This action is a one-time requirement. Future needs will be re-assessed when the current CSP is in place and functional. DISA will continue to refine the requirements, research market trends and identify opportunities to promote competition. DISA will include the CSP requirement into the PKI operations and sustainment contract once the initial project is completed. This will allow interests vendors to provide proposals to support and sustain for follow on contracts. The initial contract to design and implement CSP requires a specialized skill set to deliver on schedule as required by DOD CIO mandate. To be specific the support and sustain aspect of the CSP requires a PKI skill set; however, the requirement is reduced after the initial system has been designed and deployed. The follow on contract to support and sustain this system will be full and open competition for those vendors that show the knowledge and skill sets required to operate and sustain PKI.

9. REFERENCE TO THE APPROVED ACQUISITION PLAN (AP) PROGRAM PLAN

(PP): (DARS 8.405-6(c)(2)(S-91) & FAR 7.1) An acquisition plan is not required for this effort.

Page 10 of 10 Pages

13Aug2012/v1.4

TECHNICAL CERTIFICATION: "I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief." ((FAR 8.405-6)(c)(2)(x))

NAME: _Martin Jones _ SIGNATURE: _ _

TITLE: _ IA41 PKI Branch Chief _______ DATE: _08/22/2012______

REQUIREMENTS CERTIFICATION: "I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.” (FAR 8.405-6(c)(2)(x)).

NAME: ____Linderman Burkhart__ SIGNATURE: ____ ___

TITLE: __IA4 Division Chief_____ DATE: __08/22/2012______

CONTRACTING OFFICER CERTIFICATION: Include the following determination:

“I certify that this justification is accurate and complete to the best of my knowledge and belief.”

(FAR 8.405-6(c)(2)(ix) and FAR 8.405-6 (d)(1)).

NAME: ______Anne Keller_____ SIGNATURE: _______ __ (Print/Type)

TITLE: ___Contracting Officer______ DATE: ___08/30/2012_____

PROCURING ACTIVITY COMPETITON ADVOCATE APPROVAL

“I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief. Since this justification does not exceed $12.5M, this review serves as approval.”

APPROVED BY: (FAR 8.405-6 (d)(2))

NAME: _Ann M. Vaughn__ SIGNATURE: _ _

TITLE: Competition-Advocate___ DATE: _5 Sep 2012

ALL QUESTIONS REGARDING THIS JUSTIFICATION FOR OTFAOC ARE TO BE

REFERRED TO THE CONTRACTING OFFICER (Tricia Singler 618-229-9378)