JA19-154_CSC_JA_-_Final_Redacted.pdf

JUSTIFICATION & APPROVAL (J&A) FOR FEDERAL ACQUISITION

REGULATION (FAR) SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Schedule/Multiple Award Contract (MAC)

Orders under MAC/ Fair Opportunity – FAR 16.505, Department of Defense (DoD) FAR Supplement (DFARS) 216.505-70, Procedures, Guidance and Information (PGI) 216.505-70

Purchase Request Number: HC108598615 Contract Number: HC1028-18-D-0006 Task Order Number: HC1028-19-F-6101 Procurement Title: Cyber Security Consolidation (CSC) Estimated Value:

Statutory and Regulatory Authority: 10 United States Code (U.S.C.) 2304c(b) and FAR 16.505(b)(2)(i)(B)

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

Number: JA19-154

Upon the basis of the following justification, I, as the Head of the Contracting Activity, hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C.

2304c(b) and Regulatory Authority of FAR 16.505(b)(2)(i)(B).

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

Joint Service Provider (JSP) 1155 Defense Pentagon Washington, DC 22209

Contracting Activity:

Defense Information Systems Agency (DISA)/Defense Information Technology Contracting Organization (DITCO) PL8311

2300 East Drive Scott Air Force Base, Illinois 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S): The Department of Health and Human Services (HHS) Program Support Center (PSC) advised in June 2018 that it is no longer able to support DoD acquisitions because doing so would be noncompliant with the requirements of FAR 17.703(a) and the Fiscal Year (FY) 2008 National Defense Authorization Act (NDAA). As a result, HHS must immediately stop all support for the CSC program. In spite of the foregoing, the program’s services cannot lapse or degrade without jeopardizing sensitive information and national security. As such, JSP will transfer contracting support to DISA/DITCO, which will subsequently award a sole-source task order to the incumbent contractor to continue the CSC program. The period of performance (PoP) for the task order includes a base period estimated to start August 30, 2019 and end on February 24, 2020 and three, 12-month option periods. The task order will be funded with Operations and Maintenance (O&M) funds, and will consist of

Cyber Security Consolidation – JA19-154 firm-fixed-price line items for labor and cost-reimbursable line items for travel and other direct costs.

3. DESCRIPTION OF SUPPLIES/SERVICES: The CSC task order provides services and functions required to assure the information security posture for DoD Information Technology (IT) services. The scope of the CSC tasks include the following: program management, compliance, vulnerability management, assessment and authorization, audit support, risk assessment, vulnerability assessment, training, and information system security officers’ support.

The PoP is comprised of a base period estimated to start August 30, 2019 and end on February 24, 2020 and three, 12-month option periods with an estimated value of Additionally, FAR 52.237-3 (Continuity of Services) and FAR 52.217-8 (Option to Extend Services) will be included in the order with an estimated value of for a total potential lifecycle value of

Included within the base year will be a “rapid response” surge line item to support JSP, in the event of a cyber incident that will be effective upon award of the task order (estimated by August 30, 2019). The primary services for the remainder of task order will begin September 27, 2019 and carry through the base PoP end date of February 24, 2020. The remaining three option years will also include a line item for “rapid response” in addition to the primary services.

Base Period: Date of Award (estimated by August 30, 2019) – February 24, 2020 Option Period One: February 25, 2020 – February 24, 2021 Option Period Two: February 25, 2021 – February 24, 2022 Option Period Three: February 25, 2022 – February 24, 2023

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity. FAR 16.505(b)(2)(i)(B) – Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(b) Description of the Justification. Following is a timeline of events that led to the need for this sole-source action under the authority of this J&A.

May 24, 2018: HHS PSC issued the following task order to fulfill the CSC requirement: HHSN316201200008W.

June 14, 2019: HHS PSC notified the DoD that it could no longer certify that it is compliant with the DoD procurement requirements of Section 801 of the FY 2008 NDAA. For this reason, the PSC immediately ceased all contractual support on acquisitions supporting the DoD and terminated its assisted acquisition program for non-HHS agencies.

July 9, 2019: HHS PSC informed DISA that it could not transfer any affected contracts to the DoD despite any requests to do so. Further, HHS PSC advised that it would either allow the contracts to lapse by their own terms or terminate the contracts. The current contract’s base period is due to expire on February 24, 2020.

July 15, 2019: JSP determined that, due to the criticality, nature, and scope of the CSC task order, JSP’s mission would suffer degradation if there is a lapse in contract performance. Therefore, it was determined that JSP requires approval of a sole source award to the incumbent and within the parameters of the HHS PSC task order to maintain continuity for the program, execute anticipated tasks by the contractor, and avoid a critical break in service.

(c) Justification.

(1) Minimum Government requirements. Services must continue at their current level in order to support the JSP functional area. These services include, program management, compliance, vulnerability management, assessment and authorization, audit support, risk assessment, vulnerability assessment, training, and information system security officers support.

(2) Proposed sole source contractor. Booz Allen Hamilton (BAH) (CAGE code: 17038)

(3) Discussion regarding cause of the sole source situation. Section 801 of the FY 2008 NDAA requires non-DoD agencies to verify that they comply with DoD procurement requirements for acquisitions executed on behalf of the DoD. HHS PSC abruptly withdrew its certification on June 14, 2019 and is no longer supporting any DoD acquisitions. PSC will either allow the affected contracts to lapse by their own terms or terminate the contracts. Moreover, PSC will not to transfer any of the affected contracts to the DoD thereby preventing DITCO from assuming contract administration of the existing contract.

On September 26, 2019, the CSC program will exhaust its funds and PSC will not further apply funds to the task order; thus all services must transition under this task order by September 27, 2019. The JSP program’s mission essential services will cease unless a sole source contract action is executed immediately. It is not feasible to compete the program’s requirement without causing a significant lapse in mission essential services nor could another company perform the program’s minimum requirements immediately following PSC’s termination of the program’s task order.

As such, the approval of this action will ensure the requirements and scope of work provided under the HHS PSC task order can continue as anticipated without degradation to the JSP mission. Additionally, considering HHS PSC is unable to make changes to the existing task order for the Government to include coverage for cyber incidents and “rapid response” surge activity, the PoP of this order will begin upon award for the “rapid response” line item to mitigate risks of potential surge activity that may occur prior to the remainder of the requirements transitioning under this task order.

(4) Demonstration of unique source. The incumbent’s staff possesses the knowledge, skills, capabilities, certification, clearance, and experience required to continue the program without a break or degradation in mission essential services. Given specific mission essential requirements, the incumbent is the only contractor that is capable of immediately performing the necessary services for the DoD.

(5) Procurement discussion. The resulting task order with DITCO will be for the remaining PoP that would have otherwise been provided by the HHS PSC task order;

therefore, maintaining the same realm of competition considered prior to the HHS PSC award. Since PSC will be letting the incumbent’s contract lapse and the contractor is immediately able to shift to supporting the resultant award associated with this contract action, it would minimize any associated transition costs for the Government and successor contractor. In addition, another contractor would not be positioned to leverage investments made to date to most efficiently meet the objectives of the task order for the anticipated PoP.

(6) Impact. Any break in or degradation of services will significantly degrade the DoD’s ability to defend the Pentagon and its networks from cyber-attacks. Affected networks could include the Secretary of Defense, Joint Chiefs of Staff, and numerous other mission critical operations that directly impact the warfighter and day-to-day operations of the Pentagon. Without this critical support, the Pentagon and larger DoD IT could be infiltrated and exploited, resulting in significant consequences and potentially risk loss of life.

5. PRICE FAIR AND REASONABLE DETERMINATION: A determination that the price is fair and reasonable will be based on a comparison of the incumbent’s proposal to the independent government cost estimate and publicized labor rates and categories necessary to perform the program, as well as other historical pricing for similar services. The contracting officer will also review and compare the labor rates to the ENCORE III contract labor rates, which were previously found to be fair and reasonable in a competitive environment.

6. MARKET RESEARCH: JSP conducted comprehensive market research as part of its acquisition of CSC services. This market research included a review of the acquisition history of the previous contract, existing DISA-wide and DoD Multiple Award Contract (MAC) vehicles, Federal Supply Schedules, and intra/inter agency contract vehicles.

The DoD identified several suites of contracts that offer cyber security services, the General Services Administration (GSA) IT-70 Government Wide Acquisition Contract (GWAC), the GSA 8(a) STARS II GWAC, and the DISA ENCORE III MAC. BAH is the program’s incumbent and an awardee under the DISA ENCORE III MAC. However, the incumbent BAH is the only source capable of meeting the Government’s immediate need. It is not feasible to compete the requirement without causing a significant lapse in or degradation of mission essential service nor could another company perform the program’s minimum requirements immediately following PSC’s termination of its contract. It is critical to transition institutional knowledge from the incumbent to any successor company to continue the concepts and processes of the CSC program. In consideration of the foregoing, a sole-source contract/task order issued to BAH under the DISA ENCORE III MAC is the prudent approach of ensuring JSP’s mission is not degraded due to HHS PSC discontinuing its administration of the current task order.

7. ANY OTHER SUPPORTING FACTS: JSP is the IT service provider for the DoD in the national capital region. JSP provides support for over 50,000 users, including senior DoD officials, Presidential appointees, senior executive service leaders, and flag and general officers.

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History.

Contract Number: HHSN316201200008W Task Order: HHSP233201800097W Contractor: BAH PoP: May 25, 2018 – February 24, 2023 Competitive Status: Fair Opportunity Competition

(b) To overcome future barriers to competition, DISA/DITCO is preparing a fair opportunity competitive follow-on requirement. The follow-on is expected to be competed, solicited, and awarded by February 2023.

9. REFERENCE TO THE APPROVED ACQUISITION PLAN (AP): Streamlined AP was approved by the Chief of the Contracting Office on August 21, 2019.

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance, which are included in the J&A, are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE: See Signature Page

TITLE/ORGANIZATION: Contracting Officer’s Representative (COR), JSP – Business Resource Center

PHONE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance, which are included in the J&A, are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE: See Signature Page

TITLE/ORGANIZATION: IT Specialist Supervisor, JP8 Business Resource Center

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE: See Signature Page

TITLE/ORGANIZATION: Contracting Officer/DITCO/PL8311

HEAD OF THE CONTRACTING ACTIVITY (HCA) APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief.

Since this justification does not exceed $93M, this review serves as approval.

NAME: SIGNATURE: See Signature Page

TITLE/ORGANIZATION: HCA/DITCO

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO