redacted_ms_ja.docx

Microsoft CSA for Windows XP SP3, Windows Server 2003 SP2 and SQL Server 2005 SP4

JUSTIFICATION FOR OTHER THAN FULL AND

OPEN COMPETITION (OTFAOC)

Federal Acquisition Regulation (FAR) Part 6 Justification, Supporting Procurements under FAR Part 12, FAR Subpart 13.501, and FAR Part 15

Purchase Request Number: To be determined (TBD) Contract Number: TBD Task/Delivery Order Number: TBD Procurement Title: Microsoft Custom Support Agreement (CSA) for Windows XP SP3, Windows Server 2003 SP2 and SQL Server 2005 SP4 Contracting Office: Defense Information Systems Agency (DISA)/ Defense Information Technology Contracting Organization (DITCO)/PL8321 Estimated Value: REDACTED Statutory Authority: 10 U.S.C.§2304 (c)(1)

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION (OTFAOC)

Justification for OTFAOC Number:

Upon the basis of the following justification, I, as the Procuring Activity Competition Advocate, hereby approve the use of other than full and open competition of the proposed contractual action pursuant to the statutory authority of 10 U.S.C.§2304 (c)(1). The regulatory authority that applies to the requirement is FAR Part 6.302-1, only one responsible source and no other supplies or services will satisfy agency requirements.

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

a. Requiring Agency:

United States Army Chief Information Office (CIO/G6) 107 Army Pentagon Washington, District of Columbia 20310-0107

b. Contracting Office:

DISA/DITCO/PL8321

2300 East Drive, Building 3600 Scott Air Force Base, Illinois 62225-5403

2. NATURE/DESCRIPTION OF ACTION(S):

a. The nature of this action is to procure extended software license support for Microsoft Windows XP SP3, Windows Server 2003 SP2, and SQL Server 2005 SP4 as an Army-wide CSA. Microsoft ended public support for Windows XP SP3 on April 8, 2014, Windows Server 2003 SP2 on July 14, 2015, and SQL Server 2005 SP4 on April 12, 2016. This CSA will allow for continued support in the form of patches and hot fixes. It will provide the Army with extended support for one year on 1,922 devices. This requirement will be awarded as a firm fixed price contract to the original equipment manufacturer (OEM) and sole source provider, Microsoft Corporation, using open market procedures.

b. The period of performance will be for one year, estimated to begin on July 1, 2016 through June 30, 2017. Fiscal Year 2016 funds are provided under Military Interdepartmental Purchase Request 10892808. The applicable North American Industry Classification System code is 511210, Software Publishers, with sales size standard of $38,500,000. The estimated cost of this acquisition is REDACTED.

3. DESCRIPTION OF SUPPLIES/SERVICES:

a. The objective of this CSA is to provide continuous support to the entire Army enterprise for Microsoft Windows XP SP3, Windows Server 2003 SP2, and SQL Server 2005 SP4 software licenses for one year. The CSA will provide the Army with necessary patches and hot fixes on over 1,922 devices, while the Army works to migrate off these Microsoft products. The CSA will ensure the Army has continued extended support to avoid security vulnerabilities on the existing licenses to include security updates for vulnerabilities rated “critical”; however, fees apply for security hot fixes rated “important”. Non-security hot fixes are not available.

b. This acquisition will continue to provide support for the Army enterprise, to include, but not limited to, Army Service Component Commands, Direct Reporting Units, Army Reserve Commands, Army National Guard, and any joint organizations where the Army is the Executive Agent defined by the Office of the Administrative Assistant to the Secretary of the Army. The coverage of this requirement applies to all Continental United States (CONUS) and Outside CONUS. Included in these categories are military, civilian, and contractor personnel. The scope of the proposed CSA is to provide 100 percent of continued coverage for all Army devices still running Windows XP SP3, Windows Server 2003 SP2, and SQL Server 2005 SP4.

c. The following is a description and estimated value of the required support:

4. IDENTIFICATION OF STATUTORY AUTHORITY:

This acquisition is conducted under the statutory authority of 10 U.S.C§2304(c)(1) and the regulatory authority of FAR 6.302-1/ Defense FAR Supplement 206.302-1, only one responsible source and no other supplies or services will satisfy agency requirements. The support is peculiar to a specific brand name. Only Microsoft can satisfy the requirement.

5. DEMONSTRATION OF CONTRACTOR’S UNIQUE QUALIFICATIONS:

a. Description of events:

1. Microsoft has ended support for Windows XP SP3 Operating System (OS), Windows Server 2003 SP2, and SQL Server 2005 SP4, leaving organizations to choose between migrating to newer technology or endure outdated OSs and servers, which could result in potential network security vulnerabilities. According to Microsoft, technical assistance for Windows XP SP3, Windows Server 2003 SP2, and SQL Server 2005 SP4 will no longer be available, including automatic updates that help protect personal computers (PCs), servers, and Microsoft Security Essentials for downloads. Currently installed Microsoft Security Essentials will continue receiving anti-malware signature updates for a limited time, but this does not mean that PCs will be secure in the absence of security updates to help protect the PC.

2. The Army published guidance in preparation for the Windows XP SP3 OS, Windows Server 2003 SP2, and SQL Server 2005 SP4 for the end of life support. The United States Army Cyber Command/2nd Army directed all Army organizations that currently own and operate servers and desktop OSs on the Non-Secure and Secret Internet Protocol Router Networks to migrate to supported OSs defined in Operations Order 2013-111. Although Army organizations have begun migration to an approved Windows baseline, not all were able to achieve compliance by the deadline. The Army requires continued support in order to maintain operational effectiveness and prevent security threats while transitioning to newer OSs and servers. Therefore, the Army is executing a single year contract to assist those organizations that were not able to migrate.

b. Justification:

1. Minimum Government requirements. This requirement is to provide a CSA for extended support on Windows XP SP3, Windows Server 2003 SP2, and SQL Server 2005 SP4 licenses for the Army. Since Microsoft, the OEM, discontinued public support on the Windows XP, Windows Server 2003, and SQL Server 2005 products, the Army requires continued support on more than 1,922 devices in order to maintain operational effectiveness and prevent security threats while transitioning to newer OSs and servers.

2. Proposed sole source contractor. Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052-8300. Only Microsoft, the OEM, can distribute patches and hot fixes for Windows XP SP3, Windows Server 2003 SP2, and SQL Server 2005 SP4.

3. Discussion regarding cause of the sole source situation. The sole source situation is a result of Microsoft’s strict control over its proprietary source code. Microsoft has not licensed other contractors to have access to this information or to work on these retired software products. Currently, the Army has invested over $1 billion in Microsoft software, which is used extensively throughout the Army and all other organizations where the Army is the Executive Agent. The use of Microsoft software ranges from the office environment (desktops and laptops) to the tactical mission systems. Microsoft is the only provider of source code modifications to their product.

4. Demonstration of unique source. Microsoft is the only entity that will create patches and resolve hot fix situations for Microsoft Windows XP SP3, Windows Server 2003 SP2, and SQL Server 2005 SP4. Microsoft maintains strict control over its proprietary source code and does not license any other contractor to work on the software products. Therefore, Microsoft Corporation is the only source to provide direct and unique access to the Microsoft patches, trouble-shooting, and hot fix type issues.

5. Procurement discussion. The Microsoft CSA for Windows XP SP3, Windows Server 2003 SP2, and SQL Server 2005 SP4 is required by the Army. Microsoft announced public support on Windows XP SP3, Windows Server 2003 SP2, and SQL Server 2005 SP4 has been retired. The Army requires continued support through a CSA with Microsoft Corporation by June 30, 2016.

6. Impact. Microsoft software is essential for the Government to meet its’ requirements. The lack of support for devices still using Windows XP SP3, Windows Server 2003 SP2, and SQL Server 2005 SP4 will prevent the Army from downloading necessary patches, which will create major security issues and cause a direct mission impact to the warfighter. A lack of support will cause the Army to be more vulnerable to security threats, since patches and hot fixes are no longer publicly available for Windows XP SP3, Windows Server 2003 SP2, and SQL Server 2005 SP4.

6. FEDERAL BUSINESS OPPORTUNITIES (FBO) ANNOUNCEMENT/POTENTIAL SOURCES:

This requirement was not advertised via Request for Information (RFI) or Sources Sought Notice (SSN) because of the proprietary requirements. A determination and findings for waiver from using a RFI or SS was signed by Mr. Douglas Packard, Head of the Contracting Activity, on June 28, 2016. The Army requires a sole source award to Microsoft Corporation for a CSA to support Windows XP SP3, Windows Server 2003 SP2, and SQL Server 2005 SP4. A synopsis of the proposed contract action will be published to the FBO website as required by FAR 5.202.

7. DETERMINATION OF FAIR AND REASONABLE COST:

The Government will perform an evaluation of the offeror’s proposal and proposed costs to ensure the costs are fair and reasonable. The Contracting Officer will determine that the resulting contract’s costs or prices will be fair and reasonable based on comparison with the cost or prices outlined below. The Contracting Officer will also determine the pricing information valid for comparative purposes. Certified cost or pricing data is not required for this acquisition, in accordance with FAR 15.403-1(b)(3). Proposal pricing of the sole source provider will be compared with the following pricing information: published price list or published market prices for the same or similar items and the independent government cost estimate pricing for the required support renewal.

8. MARKET RESEARCH:

a. Market research was conducted by the Army CIO/G6 team from June 30, 2015 to present. Market research included gathering data from previous acquisitions by contacting the current contract provider (Microsoft), gathering data from the internet, reviewing catalogs and other contractor literature, holding exchanges with Microsoft, reviewing publications of external information from technology research firms, reviewing existing DISA-wide contract vehicles, and determining potential sources. The purpose of the market research was to verify that possible resellers were not available. Web searches identified that Microsoft, the OEM, is the only source capable of providing the patches and hotfixes. Microsoft will be required to provide 100 percent of the product and technical support required to execute the CSA. Market research also revealed that the Windows XP SP3, Windows Server 2003 SP2, and SQL Server 2005 SP4 software support is commercially available to properly support the operating environment. It is not available on existing government contract vehicles, to include the Department of Defense Enterprise Software Initiative, General Services Administration, and National Aeronautics and Space Administration Solutions for Enterprise-Wide Procurement.

b. Based on the results of market research, a solicitation will be issued to Microsoft Corporation, a large business, soliciting an open market quote for the continued software support.

9. ANY OTHER SUPPORTING FACTS:

None.

10. LISTING OF INTERESTED SOURCES:

To date, no vendors other than Microsoft Corporation are an interested source. However, any responses to the FBO announcement will be considered prior to proceeding with an award.

11. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS THAT LED TO THE EXCEPTION TO FULL AND OPEN COMPETITION.

a. Procurement History:

REDACTED

b. Microsoft, the OEM, is the only entity that can release patches and hotfixes for extended coverage on Windows XP SP3, Windows Server 2003 SP2, and SQL Server 2005 SP4. If the Government requires functionality change, then the Government will seek full and open competition.

12. REFERENCE TO THE APPROVED ACQUISITION PLAN (AP):

In accordance with the exceptions under DISA Acquisition Regulation Supplement 7.103 (S-91)(h), an AP is not required.

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance, which are included in the J&A, are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

TITLE/ORGANIZATION:

PHONE: DATE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance, which are included in the J&A, are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

TITLE/ORGANIZATION: Chief, Enterprise Licensing Division HQDA/CIO/G-6 Policy & Resources

PHONE: DATE:

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete, to the best of my knowledge and belief.

NAME: SIGNATURE:

TITLE/ORGANIZATION: Contracting Officer/DITCO

PHONE DATE:

PROCURING ACTIVITY COMPETITION ADVOCATE APPROVAL: I have reviewed this justification and find it to be accurate and complete, to the best of my knowledge and belief. Since this justification does not exceed $13.5M, this review serves as approval and my written determination that the aforementioned FAR circumstances apply.

NAME: SIGNATURE:

TITLE/ORGANIZATION: Procuring Activity Competition Advocate/DITCO

PHONE: DATE:

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

Page 1 of 7 Pages