MEDCOM_JA_MIPR0010707145_REDACTED.pdf

JUSTIFICATION FOR OTHER THAN FULL AND

OPEN COMPETITION (OTFAOC)

Federal Acquisition Regulation (FAR) Part 6 Justification & Approval (J&A), Supporting Procurements under FAR Part 12, FAR Subpart 13.501, and FAR Part 15

Purchase Request Number: MIPR0010707145 Contract Number: To Be Determined (TBD) Task/Delivery Order Number: TBD Procurement Title: Microsoft Windows Server 2003 Service Pack 2 (SP2) Operating System (OS) Custom Support Agreement (CSA) Contracting Office: Defense Information Systems Agency (DISA)/Defense Information Technology Contracting Organization (DITCO) Statutory Authority: 10 U.S.C.§2304 (c)(1) and FAR 6.302-1

JUSTIFICATION FOR OTFAOC

Upon the basis of the following justification, I, as Procuring Activity Competition Advocate (PACA), hereby approve the use of other than full and open competition of the proposed contractual action, pursuant to the statutory authority of 10 U.S.C.§2304 (c)(1). The regulatory authority that applies to the requirement is FAR Part 6.302-1, only one responsible source and no other supplies or services will satisfy agency requirements.

JUSTIFICATION

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

a. Requiring Agency:

Army, Medical Command (MEDCOM), Chief Information Office (CIO)/G-6 3630 Stanley Road Fort Sam Houston, Texas 78234

a. Contracting Office:

DISA/DITCO/PL83

2300 East Drive, Building 3600 Scott Air Force Base, Illinois 62225

2. NATURE/DESCRIPTION OF ACTION(S):

a. The nature of this action is to procure extended support of Microsoft Windows Server 2003 SP2 for Army MEDCOM as a CSA. On July 14, 2015, Microsoft will end public support for Windows Server 2003 SP2, so this CSA will allow for the continued support of Microsoft Windows Server 2003 SP2 in the form of patches and hotfixes. This requirement will be awarded as a firm-fixed-price contract to the original equipment manufacturer (OEM) and sole source provider, Microsoft Corporation, using open market procedures.

b. The period of performance will be from July 15, 2015 through July 14, 2016. The applicable North American Industry Classification System code is 541519, Other Computer- Related Services, with a sales size standard of $27.5 million. Fiscal year 2015 Army funds will be used to fund this effort and is provided under a Military Interdepartmental Purchase Request.

3. DESCRIPTION OF SUPPLIES/SERVICES:

a. The objective of this agreement is to provide continuous support to the Army for Microsoft Windows Server 2003 SP2 OS licenses for one more year. The CSA will provide the Army with necessary patches and hotfixes on 320 servers, while the Army works to migrate off Windows Server 2003 SP2 over the next year. This procurement will ensure the Army has continued extended support to avoid security vulnerabilities on the existing licenses to include security updates for vulnerabilities rated “critical”; however, fees apply for security hotfixes rated “important.” Non-security hotfixes are not available.

b. This acquisition will continue to provide Microsoft Windows Server 2003 SP2 OS support for the Army MEDCOM enterprise, to include, but not limited to, the Military Treatment Facilities, Army Medical Information Technology (IT) Center, and any testing facility certified as a test center and approved to conduct developmental testing. The coverage of this requirement applies to all continental United States (CONUS) and outside CONUS.

Included in these categories are military, civilian, and contractor personnel. The scope of the proposed CSA is to provide continued coverage for the 320 Army MEDCOM servers still running Windows Server 2003 SP2. The CSA will provide continuous support and technical assistance on Windows Server 2003 SP2, due to Microsoft’s termination of public support on July 14, 2015.

c. The following is a description and estimated value of the required support:

Description Quantity

Custom Support - Windows Server 2003 SP2

Important Security Updates – Flat Fee 1

4. IDENTIFICATION OF STATUTORY AUTHORITY:

This acquisition is conducted under the statutory authority of 10 U.S.C§2304(c)(1) and the regulatory authority of FAR 6.302-1/ Defense FAR Supplement 206.302-1, only one responsible source and no other supplies or services will satisfy agency requirements. The support is peculiar to a specific brand name. Only Microsoft can satisfy the requirement.

5. DEMONSTRATION OF CONTRACTOR’S UNIQUE QUALIFICATIONS:

a. Description of events:

(1) Microsoft has ended more than 11 years of support for Windows Server 2003 SP2 OS, leaving organizations to choose between migrating to newer technology or endure outdated OSs and potential network security vulnerabilities. According to Microsoft, technical assistance for Windows Server 2003 SP2 will no longer be commercially available, including automatic updates that help protect personal computers (PCs) and Microsoft Security Essentials for downloads on Windows Server 2003 SP2. Currently, installed Microsoft Security Essentials will continue receiving anti-malware signature updates for a limited time, but this does not mean that PCs will be secure in the absence of security updates to help protect the PC.

(2) The Army has published guidance in preparation for the Windows Server 2003 SP2 support end-of-life. The United States 2nd Army/Army Cyber Command directed all Army organizations that currently own and operate servers and desktop OSs on the non-secure and Secret Internet Protocol Router Networks to migrate to supported OSs defined in Operations Order 2013-111, Reducing Computer Systems Vulnerability on the Land Warrior Network (LWN) in order to prevent vulnerabilities, standardize network resources, increase flexibility, and achieve effective defense in depth across the LWN. Although Army organizations have begun migration to an approved Windows baseline, not all were able to achieve compliance by the deadline. The Army requires continued support in order to maintain operational effectiveness and prevent security threats while transitioning to newer OSs. Therefore, the Army is executing a single year contract to assist those that were not able to migrate.

b. Justification:

(1) Minimum government requirements: This minimum requirement is to provide a CSA for extended support on 320 Windows Server 2003 SP2 OS licenses for the Army.

(2) Proposed sole source contractor: Microsoft Corporation. Only Microsoft, the OEM, can distribute patches and hotfixes for Windows Server 2003 SP2 OS.

(3) Discussion regarding cause of the sole source situation: Microsoft Corporation maintains strict control over its proprietary source code and has not licensed any other contractor to have access to this information or to work on the software products.

Currently, the Army has invested over $1 billion in Microsoft software, which is used extensively throughout the Army and all other organizations where the Army is the executive agent. The use of Microsoft software ranges from the office environment (desktops and laptops) to the tactical mission systems. Microsoft, the OEM, is the only provider of source code modifications to their product.

(4) Demonstration of unique source: Microsoft is the only entity that will create patches and resolve hotfix situations for Windows Server 2003 SP2. Microsoft maintains strict control over its proprietary source code and does not license any other contractor to work on the software products. Therefore, Microsoft Corporation is the only source to provide direct and unique access to the Microsoft patches, trouble-shooting, and hotfix-type issues.

(5) Procurement discussion: The Microsoft CSA for Windows Server 2003 SP2 is required for the Army. After 11 years, Microsoft Corporation has announced public support on Windows Server 2003 SP2 will retire. Since the Army will require continued support of Windows Server 2003 SP2, a CSA with Microsoft is needed.

(6) Impact: Microsoft software is essential for the government to meet requirements. The lack of support for devices still using Windows Server 2003 SP2 will prevent the Army from downloading necessary patches, which will create major security issues and cause a direct mission impact to the warfighter. This will cause the Army to be more vulnerable to security threats, since patches and hotfixes are no longer publicly available for Windows Server 2003 SP2.

6. FEDERAL BUSINESS OPPORTUNITIES (FBO) ANNOUNCEMENT/POTENTIAL

SOURCES:

A notice of proposed contract action will be synopsized on the FBO website with the intention to award a sole source contract to Microsoft Corporation. A copy of the redacted J&A will be posted with the synopsis. A sources-sought notice was published to FBO on June 5, 2015, prior to the issuance of the solicitation or contract award, as required by FAR 5.2.

7. DETERMINATION OF FAIR AND REASONABLE COST:

The government will perform an evaluation of the offeror’s proposal and proposed costs to ensure the costs are fair and reasonable, based on published price list or published market prices for the same or similar items and the independent government cost estimate pricing for the required support renewal. The Contracting Officer will also determine the pricing information valid for comparative purposes. Certified cost or pricing data is not required for this acquisition, in accordance with FAR 15.403-1(b)(3).

8. MARKET RESEARCH:

a. Market research was conducted by the Army CIO/G6 team from March 2015 to present.

Market research included gathering data from previous acquisitions by contacting the current contract provider (Microsoft), gathering data from the internet, reviewing catalogs and other contractor literature, holding exchanges with Microsoft, reviewing publications of external information from technology research firms, reviewing existing DISA-wide contract vehicles, and determining potential sources. The purpose of the market research was to verify that possible resellers were not available. Web searches identified that Microsoft, the OEM, is the only source capable of providing the patches and hotfixes. Microsoft will be required to provide 100% of the product and technical services required to execute the CSA. Market research also revealed that the Microsoft Server 2003 SP2 software support is commercially available to properly support the operating environment. It is not available on existing government contract vehicles, to include Enterprise Software Initiative, General Services

Administration, and National Aeronautics and Space Administration Solutions for Enterprise- Wide Procurement.

b. Based on the results of market research, a solicitation will be issued to Microsoft Corporation, a large business, soliciting an open market quote for the continued software support.

9. ANY OTHER SUPPORTING FACTS:

None.

10. LISTING OF INTERESTED SOURCES:

Microsoft Corporation.

11. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME

BARRIERS THAT LED TO THE EXCEPTION TO FULL AND OPEN COMPETITION.

a. Procurement History: The 320 Windows Server 2003 SP2 licenses were originally procured around 2008 through various contracts.

b. It is deemed that only this Microsoft software support would be able to function with the current products that are already in place. If Microsoft Corporation elects to surrender their legal ownership, copyright, and/or intellectual property software rights and move toward a complete open-source solution, then DISA will seek open competition. Regardless, the government will continue to search the marketplace, and alternative software solutions will continually be researched to determine if they will function with currently used products. If the government determines that Microsoft software is no longer required or other software meets the government’s needs, then the government will seek full and open competition for the required functionality. If similar requirements arise, every effort will be made to compete to the maximum extent practicable.