JA_MFR_redacted.pdf

Memo for Record Justification and Approval Subject: CMTFS015R270

The following paragraphs, in accordance with Federal Acquisition Regulation Part 13.106- 1(b)(1)(i), are provided to support Brand Name limited source justification for proposed orders exceeding the micro-purchase threshold, but not exceeding the simplified acquisition threshold.

The Defense Information Systems Agency (DISA), Fifth Estate Center (FEC) is requesting Cryptzone Compliance Sheriff software license, software support, training and consultant services. The period of performance will be one year from date of award. The total estimated lifecycle price is $91,218. Fiscal year 2015 Defense Working Capital funds have been provided via Form 9 CMTFS015R270. The applicable North American Industrial Classification Code is 541519, other computer Related Services, with a size standard of $27.5 million dollars.

This acquisition includes the following: Purchase of seven (7) Cryptzone Compliance Sheriff On-Line Video Training, one (1) Cryptzone Compliance Sheriff Enterprise License, one (1) Cryptzone Compliance Sheriff Enterprise Perpetual License with software support, and thirty

(30) hours of Technical Support for Cryptzone Compliance Sheriff Enterprise License supporting the mission requirements of DISA’s Risk Management Executive (RME)’s Risk Analysis Branch (RE63).

Recently, there have been reports of Personally Identifiable Information (PII) and classified content posted to DoD public facing websites and SharePoint in folders/containers open to all users for viewing. DISA has been working the reported issues to get content quarantined and resolved and has the responsibility to ensure that users are placing appropriate access controls and / or restrictions on such information. The DoD Enterprise Portal Service (DEPS) is a managed service that provides a content collaboration capability to mission partners and is accredited for PII content; however, mission partners are required to declare content during the onboarding process. Maintaining the access controls and investigating inappropriately permissioned material (PII, Operation Security (OPSEC), etc.) is strictly the responsibility of the mission partner which they acknowledge during the onboarding process.

The required Cryptzone Compliance Sheriff software will provide ability for mission partners to scan content and take action as necessary. This tool will allow for scans to be conducted both to the public facing footprint and the internal DEPS SharePoint that can identify concerns that need further review. The RE6 team will be able to utilize the test capability of the Compliance Sheriff software to test content in the production environment prior to publishing. Compliance Sheriff is a server-based application that validates website and application content against US and international privacy standards including Privacy Acts, Gramm-Leach-Billey Act, Children’s Online Privacy Protection, European Union Privacy Directive, Health Insurance Portability and Accountability Act, Federal Information Security Management Act, Payment Card Industry Data Security Standard, as well as Web accessibility (Section 508), spelling, broken links and allows for custom organizational policies for accessibility and privacy compliance. This tool will be used as a detective method to identify violations of public displayed content, PII, and other content violations. As the software scans and identifies areas of risk or detects specific policy violations, Compliance Sheriff will monitor DEPS for brand integrity and site quality issues including: missing keywords, inconsistent logos, broken links, typos, changed pages, and site up/down feature. The automatic website and brand quality monitoring features of the software will allow scanning for broken links, slow-loading pages, changed content and website down time. Detailed reports will be available to assist developers in pinpointing defects and fixing content. These reports can also be set up to automatically post to the server allowing for collaborative problem solving.

Compliance Sheriff was approved for use in 2012 by the JWRAC as part of an effort by the Office of the Under Secretary of Defense (Intelligence) to minimize OPSEC and PII violations on DoD assets and was found to have a low tool risk based on its intended purpose. No other software has been approved for use by the JWRAC. Only the Cryptzone Compliance Sheriff software licenses, software support, training and consultant services will meet the government’s requirements. No other product can provide the comprehensive set of security tools required to meet the needs of DISA and DISA mission partners in accordance with (IAW) applicable U.S.

and U.S. DoD guidance. These security tools are crucial to the day to day operations of DISA and ensuring OPSEC and PII violations are minimized. The required Cryptzone software, support, training, and consultant services are proprietary and can only be provided by Cryptzone, the original equipment manufacturer, or its authorized resellers.

Failure to procure the required Cryptzone Compliance Sheriff software licenses, software support, training, and consultant services would result in operating inefficiencies such as the ability to test content prior to publishing to the public and scan for classified and/or Essential Elements of Friendly Information (EEFI), jeopardize the organization’s ability to secure PII/OPSEC, and effect day to day operations by having to conduct manual search’s for these informational elements which exacerbates an already full scan schedule for DISA and DISA mission partners. In addition, without an effective means to search DEPS and our DoD public facing web presence, DISA runs the risk of a repeat of the Office of Personnel Management (OPM) security incident.

Market research revealed that the Cyrptzone Compliance software, support, training, and services could be provided by Cryptzone, the OEM, (small business) and two authorized resellers: Adaptive Cyber (small business) and Taurean (small business). As there are two or more small businesses able to provide the required software, support, training, and consultant services, it is recommended that this requirement be set aside for small business on the open market. A request for quote will be issued to FedBizOpps requesting quotes from Cryptzone and their small business authorized resellers.

Based on the documentation provided a determination is made that this justification is accurate and complete to the best of my knowledge and belief.

Prepared by: Concur:

Michael Morris Kimberly M. Hampel Contract Specialist Contracting Officer Date: September 21, 2015 Date: September 22, 2015