UAM_Redacted.pdf

JUSTIFICATION & APPROVAL (J&A) FOR FEDERAL ACQUISITION

REGULATION (FAR) SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Schedule/Multiple Award Contract (MAC)

Orders under MAC/ Fair Opportunity – Federal Acquisition Regulation (FAR) 16.505, Department of Defense (DoD) FAR Supplement 216.505-70, Procedures, Guidance and

Information 216.505-70

Military Interdepartmental Purchase Request:

Contract Number: To be determined (TBD) Task/Delivery Order Number: TBD Procurement Title: User Activity Monitoring (UAM) Support Estimated Value: $ Authority: FAR 16.505(b)(2)(i)(B)

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

Number:

Upon the basis of the following justification, I, as the Head of the Contracting Activity, hereby approve this exception to fair opportunity pursuant to the authority of FAR 16.505(b)(2)(i)(B).

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

Requiring Agency:

Contracting Office:

Defense Information Systems Agency (DISA) Defense Information Technology Contracting Organization (DITCO)

2. NATURE/DESCRIPTION OF ACTION:

The nature of this action is to award a sole source task order that will consist of one 12-month base period with four 12-month options and, as needed, a 6-month extension in accordance with (IAW) FAR 52.217-8, Option to Extend Services. This award will be to , a large business, against the suite of contracts. The task order will be firm fixed price, with cost reimbursable other direct costs to acquire

UAM software, hardware, support, training, and travel. The period of performance for this award will be July 10, 2017 through July 09, 2022, if all options are exercised.

Operations and maintenance will be used for the base and all options. The estimated cost for the base year is approximately $ . The total estimated lifecycle cost to include the “Option to Extend Services” is approximately $ .

Requirement: – Insider Threat User Activity Monitoring (UAM) Tracking Number:

Page 2 of 7 Pages

3. DESCRIPTION OF SUPPLIES/SERVICES:

The requirement is to obtain a turn-key UAM capability, including on-site system operations and maintenance services, that complies with Department of Defense (DoD) and Office for the Director of National Intelligence (ODNI) directives. As discussed herein, only is capable of providing this UAM capability through its I

UAM is the technical capability to observe and record the actions and activities of an individual, at any time, on any device accessing U.S. Government information in order to detect insider threats and to support authorized investigations. The UAM tool deploys a client to an endpoint (workstations and servers). The client contains software “triggers,” which represent specific user behavior. When the user’s action matches the trigger, the UAM client records the event and returns the specified collected data.

The contractor will provide the following products and services at various points throughout the base year and option years:

• (licenses) and computer hardware to conduct the UAM mission on DOD networks (including Non-classified Internet Protocol Router Network).

• System delivery and installation.

• Security engineering services to complete system security testing to allow for connection to the Government’s classified networks.

• On-site system operations and maintenance services.

• Software and hardware warranty services.

• UAM technical consulting services.

• Computer storage.

Summary of Supplies and Services: requires this commercial off-the-shelf system (including software, hardware, support, training, and travel) to monitor and log anomalous user behavior accessing network and computer systems managed by . The requirement is for an insider threat cybersecurity solution that proactively identifies and supports investigation of user violations to allow government network administrators and security personnel to proactively manage insider threat incidents. A total of approximately end user devices will be configured across multiple networks supporting the and in a phased implementation approach. The solution should contain privacy protection to ensure customers can detect events and individuals that put the enterprise at risk, while also providing privacy protection for users at large. It should contain investigative tools to enable targeting, review, and investigation of events that happened before, during, and after a violation occurs to facilitate root cause analysis of the problem.

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity.

The following applies to the exception to fair opportunity accomplished IAW 16.505(b)(2)(i)(B): Only one awardee is capable of providing the supplies or services

Page 3 of 7 Pages required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(b) Description of the Justification.

(1) The justification is based on need to comply with DoD and the Office of the

Director of National Intelligence (ODNI) UAM standard requirements.

software is the only product that satisfies all federally mandated requirements.

(2) The DoD requirements are defined in the Committee on National Security Systems Directive (CNSSD) No. 504, (U) Directive on Protecting National Security Systems from Insider Threat, September 30, 2016. Annexes A and B define the technical requirements that only can provide.

(3) The ODNI requirements are defined in Intelligence Community Standard (ICS)

Number 500-27. (U) Collection and Sharing of Audit Data, June 2, 2011, Section D4 and Appendix B, defines specific technical requirements that only can provide through the software.

(c) Justification.

(1) Minimum Government requirements.

Presidential Memorandum National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs, November 21, 2012, tasks the Executive Branch to implement user behavior monitoring on Government networks to identify insider threats. The CNSSD 504 and ICS 500-27 define minimum UAM operational and technical requirements.

(2) Proposed sole source contractor.

The sole source contractor is The key small and large business opportunity impediment is that through its affiliate , is the single provider to the Federal Government. It does not allow other companies to market or resell the product. does have third party relationships for its commercial product, but they do not satisfy the Government’s UAM requirements.

There are small businesses which do provide operations and analysis only, however is the only contractor that can make available the product and operate on DOD networks. It is because of relationship with that allows to be the sole source for the Government and UAM requirement.

requires a system that is compliant with regard to DISA Security Technical Implementation Guide and the information assurance controls required for certification and accreditation on the Secret Internet Protocol Router network (SIPRNET) and Joint Worldwide Intelligence Communications System (JWICS).

The solution currently has authority to operate on SIPRNET and JWICS as

Page 4 of 7 Pages well as numerous other classified and unclassified networks. Currently, each DoD service (Army, Air Force, Navy, and Marine Corps) uses the product on their respective classified networks. does not allow resellers for the product. No other contractors have the product and are certified to operate on DoD’s networks at this time.

(3) Discussion regarding cause of the sole source situation.

The UAM is a new requirement for where only one source is available that can satisfy all requirements. That source is . product has demonstrated its unique capabilities which satisfy the requirements of CNSSD 504 and ICS 500-27 by providing a system that detects and monitors insider threats on DoDs networks. CNSSD 504, ICS 500-27, and ODNI minimum standards are federally mandated requirements for combating insider threats and there is no other contractor that can provide the I product and operate on DOD networks other than

(4) Demonstration of unique source.

The government’s sources sought issued on FBO.gov confirmed that there is only one commercial product available that can satisfy all of UAM requirements on DoD networks. Based on the responses received from the sources sought, there are multiple commercial products that satisfy some of the requirements and there was even one product that could satisfy all but one of the requirements. However, it does not have certification to operate on DOD networks. offers the one product, , which can satisfy all of requirements and does have certification to operate on DoD networks.

(5) Procurement discussion.

The Federal Government originated the UAM requirement through a mandate to meet CNSSD 504 dated September 30, 2016 and ICS 500-27. The commercial market is just now gaining interest in the capability for its own security needs. There is only one company providing UAM products focused on the Government’s unique UAM requirement. is not the only agency that is required to meet CNSSD 504 and ICS 500-27. DISA recently granted a similar J&A for UAM to in September of 2016. The J&A concluded that is the only contractor that could provide the same service for UAM. All DoD components use product because of its unique capabilities in successfully satisfying the intelligence communities UAM requirements. Federal agencies have also previously funded to enhance the product, addressing their unique network security concerns. As such, these improvements are incorporated as standard features, available to all customers. The software is the only capable product for the Insider Threat UAM requirement at this time. does not allow resellers for the product.

(6) Impact.

There are no other contractors that can provide the I product and that are certified on DoD networks. Therefore, would be deficient in responding in a

Page 5 of 7 Pages timely fashion to the mandatory CNSSD 504 dated September 30, 2016 and ICS 500- 27 UAM government requirements. The bullets below identify the impacts of such scenarios:

• Not DoD Certified: would have to spend time (approximately six months or more) and resources to attempt to certify a new tool for the network. would also not be guaranteed the tool would achieve certification. During the time spent to certify the tool, would spend Government time and resources as well as continuing to expose its classified networks to insider threats, which is not an option.

• Multiple Tools: This approach would introduce significant risk that there could be gaps in compatibility between tools and functionality. This scenario would introduce the need to conduct multiple procurements, one for the systems integrator and a separate one for the various COTS products, which increases performance risk to unacceptable levels. This is because it is likely a systems integrator will not have experience with the multiple tools and the compatibility, and/or performance gaps amongst them.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION:

The contracting officer will obtain data other than certified cost or pricing data, IAW FAR 15.403-3 and will use comparative pricing from the previous DISA/DITCO acquisition for the same software to determine fair and reasonableness.

6. MARKET RESEARCH:

Market research was conducted to see if there was another turn-key product on the market that could satisfy UAM requirements mandated by CNSSD 504 (dated September 30, 2016) and ICS 500-27. A Sources Sought Announcement (SSA) was posted to FBO.gov on January 12, 2017, with responses due by February 3, 2017. This posting included requirements for a UAM solution. In response to the SSA, received responses from industry. These responses were mainly from small business, with a few from large business. The responses indicated that there are only a few products out there that can satisfy some of requirements.

Many responses indicated that their solution would use multiple products to be able to satisfy requirements. In addition, many of the responses were to integrate another entity’s product, which would result in the bifurcation of the acquisition between the system integration and the acquisition of the product itself. Such a bifurcation would introduce significantly high performance risk.

The responses confirmed that there is only one solution out there that meets all the requirements (including being certified for use on DoD networks) with one product and one acquisition. That product is I , provided by It was determined that is the only product that can meet the federally mandated requirements of CNSSD 504 and ICS 500-27 and other federally mandated requirements.

Page 6 of 7 Pages

7. ANY OTHER SUPPORTING FACTS:

Not applicable.

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY

(a) Procurement History.

- Insider Threat UAM is a new requirement for .

- HC1028-16-F-0853, September 29, 2106. Sole source to under suite of contracts, base plus four one-year options. UAM team collaborated with DOD organizations executing their UAM mission and found all were using the product. Internal Government discussions to identify alternative solutions did not result in any viable alternatives. In 2015, the contracted with Carnegie Mellon’s Software Engineering Institute for technical insider threat consulting services. They were tasked to support the insider threat to include UAM, future planning efforts. The institute’s final report concluded that was the only commercially available tool that satisfies DoD requirements. This is still the case according to the market research completed for UAM as of February 2017.

- HC1028-08-D-2024, September 29, 2011. Sole source to under the ENCORE II suite of contracts, base plus four one-year options.

- HC1028-08-D-2014-0007, September 30, 2010. Sole source, one-year task order to large business). was a subcontractor to and provided the product for the UAM capability.

(b) Propose Actions to Promote Full and Open Competition.

anticipates additional UAM solutions will become available that can be certified for DoD networks and satisfy requirements. Prior to the exercise of any option period provided for in this J&A, the and contracting officer will conduct market research (e.g., issue a Sources Sought) to determine the availability of competition and small business participation. Based on the results of market research, the contracting officer may determine it is in the best interests of the Government to (1) re-compete the requirement prior to exercising all option periods and/or (2) divide the requirement into one acquisition for the UAM solution and another acquisition for the operations and maintenance of that solution, promoting the use of small business and/or competition for UAM.

9. REFERENCE TO THE APPROVED ACQUISITION PLAN (AP):

In accordance with DARS 7.103 (S-91)(h), an AP is not required.

Page 7 of 7 Pages

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

TITLE/ORGANIZATION:

Provider

PHONE: DATE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

TITLE/ORGANIZATION:

PHONE: DATE:

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

TITLE/ORGANIZATION:

PHONE: DATE:

HEAD OF THE CONTRACTING ACTIVITY APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief. Since this justification does not exceed $93M, this review serves as approval.

NAME: SIGNATURE:

TITLE/ORGANIZATION: Head of Contracting Activity/DISA/DITCO

PHONE: DATE:

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO:

Gay.Arnold Typewritten Text

Gay.Arnold Typewritten Text See Signature Page

Gay.Arnold Typewritten Text