JA19-086_SWS_JA_OTFAOC_(831914373).pdf

JUSTIFICATION FOR OTHER THAN FULL AND

OPEN COMPETITION (OTFAOC)

Federal Acquisition Regulation (FAR) Part 6 Justification & Approval (J&A), Supporting Procurements under FAR Part 15

Purchase Request Number: 831914373 Contract Number: To be determined Procurement Title: Secure Web Services (SWS) Estimated Value: $61,783,168 ($48,577,486 base plus options + $13,205,682 option in accordance with (IAW) FAR 52.217-8, Option to Extend Services) Statutory Authority: FAR 6.302-3(a)(2)(ii) and 10 U.S.C 2304(c)(3).

JUSTIFICATION FOR OTFAOC

Justification for OTFAOC Number: JA19-086

Upon the basis of the following justification, I, as Head of Contracting Activity, hereby approve the use of other than full and open competition of the proposed contractual action, pursuant to the authority of 6.302-3, Industrial Mobilization; Engineering, Developmental, or Research Capability; or Expert Services.

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

Defense Information System Agency (DISA)/Center for Operations (OC)/National Leadership Command Capabilities (NLCC)/NLCC Compartmented Enterprise Services Office (IMC) 6914 Cooper Avenue Fort Meade, Maryland 20755-7088

Contracting Activity:

DISA/Defense Information Technology Contracting Organization (DITCO) PL8333 2300 East Drive, Building 3600 Scott Air Force Base, Illinois 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S): The nature of this requirement is to procure a cost-plus-fixed-fee (CPFF) sole source services contract to Georgia Tech Research Institute, hereinafter “GTRI”, an educational nonprofit, applied research division of the Georgia Institute of Technology. The period of performance (PoP) for the contract is a 12-month base period with two (2) 6-month option periods. The estimated lifecycle value for this contract, to include all option periods, is $48,577,486. Fiscal year (FY) 2019 Operations and Maintenance funds and Research, Development, Test, and Evaluation funds will be used to fund the base period of this effort.

PoP Estimated Cost Base Period April 28, 2019 – April 27, 2020 $19,416,453 First 6-month Option April 28, 2020 – October 27, 2020 $13,205,682

Secure Web Services-JA19-086

Page 2 of 8 Pages

Second 6-month Option October 28, 2020 – April 27, 2021 $13,205,682 Six percent Surge $2,749,669 6-month Extension

(IAW FAR 52.217-8)

April 28, 2021 – October 27, 2021 $13,205,682

Total $61,783,168

3. DESCRIPTION OF SUPPLIES/SERVICES: The Government has a need for continued development and deployment of the Secure Integration Cloud (SIC), the Joint Access Database Environment (JADE), and the encompassing system architecture known as Secure Web Services (SWS). These systems and architecture allow for data sharing, communication, and collaboration via existing classified compartmented information networks. The Government has a need for research, development, operations, and engineering support to deliver, maintain, and continually improve the state-of-the-art information systems supporting the Office of the Secretary of Defense Special Access Program (SAP) community. The contract will also include FAR 52.217-8 that authorizes the Government to unilaterally extend the term of the contract by up to six months.

4. IDENTIFICATION OF STATUTORY AUTHORITY:

Industrial mobilization; engineering, developmental, or research capability; or expert services, 10 U.S.C. 2304(c)(3). FAR 6.302-3/Defense Federal Acquisition Regulation Supplement 206.302- 3.

5. DEMONSTRATION OF CONTRACTOR’S UNIQUE QUALIFICATIONS: GTRI has been instrumental in researching and addressing solutions that have increased the efficiency of essential engineering and technological capabilities. Continuing GTRI, a nonprofit research institution, is required to maintain essential capability for engineering, research, and developmental work for this critical national security system. GTRI is uniquely qualified because they possess specific expertise and capabilities to meet the Government’s objectives and are a nonprofit educational research institution and University Affiliated Research Center (UARC). GTRI’s expertise and capabilities are required by the Government to maintain the increased emphasis and time sensitive needs of Department of Defense (DoD) and Intelligence Community cybersecurity requirement of developmental and fielded systems.

(a) Description of events. This justification is to sole source the SWS engineering and integration activities to GTRI. GTRI has performed as a leader and subject matter expert in the Department of Defense SAP community for over 15 years. In this capacity, GTRI is the only provider of highly secure and highly compartmented databases and web applications capable of meeting the stringent cybersecurity requirements of the DoD Joint SAP Implementation Guide and National Institute of Standards and Technology 800-53 Intelligence Overlay B/C. Award to any other source would result in unacceptable delays in fulfilling the agency’s requirement. GTRI’s subject matter expertise and existing cleared, trained, and certified engineers are required to achieve DISA’s execution objectives and timelines to execute the secure development of the new Amazon architecture for SWS, the secure integration of JADE shared data to the Defense Industrial Base, and multi-level access control upgrades to the SIC Enterprise Search capability, as well as developing, prototyping, and researching new technologies.

Page 3 of 8 Pages

The SAP community has a disparate collection of closed information technology (IT) systems that, by design, do not interoperate. These IT systems were acquired to support and implement a compartmented security structure whose challenges to their interoperability are generally rooted in culture and process, not technological capability.

Continued duplication of compartmented IT systems is no longer a sustainable acquisition approach in an era of constrained budgets and demand a call for consolidation, increased efficiencies and collaboration, and improved cybersecurity posture. The SWS system and architecture are the cornerstone of addressing the concept of operations challenges facing the DoD SAP community, and GTRI is critical to ensuring this strategy is executed securely and in compliance with SAP and intelligence community cybersecurity standards.

(b) Justification.

(1) Minimum Government requirements. The Government requires services in order to support the DISA NLCC mission. This service requires extensive engineering and technical knowledge and experience to sustain the development and deployment of the SIC, JADE, encompassing system architect known as SWS.

(2) Proposed sole source contractor. GTRI, a nonprofit institution, is the proposed sole source contractor. GTRI has been providing SWS services since the inception of SWS program in 2012. GTRI is uniquely qualified to fulfill these contracts requirements due to their status as a UARC, extensive past and present subject matter expertise knowledge of the program’s highly complex systems, highly qualified cybersecurity engineers trained in the SAP and intelligence community requirements, and possession of a full existing infrastructure to support these systems and networks.

GTRI’s designation by the Director of Defense Research and Engineering as a UARC exemplifies its status as a core asset to the DoD. A UARC is a university-affiliated, not-for-profit organization that maintains a strategic relationship with DoD. This relationship has the following characteristics (per DoD UARC Management Plan dated July 26, 2010):

(1) Responsiveness to evolving sponsor requirements

(2) Comprehensive knowledge of sponsor requirements and problems

(3) Broad access to information, including proprietary data

(4) Broad corporate knowledge

(5) Independence and objectivity

(6) Current operational experience

(7) Freedom from real and/or perceived conflicts of interest

These seven GTRI UARC attributes coupled with their extensive system knowledge and infrastructure, make GTRI uniquely qualified to meet the demanding requirements of this task order.

(3) Discussion regarding cause of the sole source situation. The development, and deployment of the SIC, the JADE and the encompassing system architecture known as

Page 4 of 8 Pages

SWS, is complex and highly dependent on the experience of GTRI due to their unique knowledge of cybersecurity engineering for highly secure systems meeting SAP and intelligence community requirements. GTRI has proven subject matter expertise, with over 20-plus years of developing and running similar of highly secure systems. While SWS is a non-proprietary Government-owned system, GTRI has performed all design, development, and implementation of system capabilities since inception in 2012. The corporate knowledge required to perform is exclusive to GTRI.

The cause of the sole source situation is the complexity of the mission requirements driven by rapidly evolving nation state threats on our Nation’s critical secure network infrastructure. Awarding to anyone other than GTRI would not keep pace with the program office’s complex requirements to deploy, sustain, and defend against evolving threats leveraging rapid technology insertion and subject matter expertise resident at GTRI. In order to maintain the development of the SWS, the services of GTRI are required.

(4) Demonstration of unique source. GTRI has consistently delivered mission critical capabilities to DoD critical infrastructure sponsors through engineering, prototyping, and rapid technology insertion over the past 20 years. During this period, GTRI has methodically built a core knowledge base of subject matter experts and network infrastructure that meet the demanding pace of countering nation state threats to our national security infrastructure.

Specifically for SWS, GTRI has cultivated highly specific subject matter expertise experience over the last seven years, architecting and engineering a fully custom and secure database infrastructure. GTRI has proven to be experts at technology insertion that complies with Joint SAP Implementation Guide (JSIG) Revision 4 without breaking the current operational system, which no other contractor has successfully delivered for SWS. As the primary developer since program inception in 2012, GTRI has demonstrated the ability to insert highly complex and secure technology into the operational system, while minimizing any system downtown. No other contractor has demonstrated the necessary rigorous development and subject matter expertise to maintain and continue the development of the SWS.

GTRI engineers are experts at conducting applied research focused on emerging threats and countermeasures, secure information systems, network vulnerability, and mission assurance within the cyber domain. Providing support to DoD research laboratories, the intelligence community, and industry, GTRI’s engineers and scientists are experts in the fields of malicious software, cyber situational awareness, information operations, vulnerability analysis, incident response, electronic discovery, and information security program development. GTRI is nationally recognized for the design, development, and deployment of enterprise information systems requiring state-of-the-art database, platform and internet security. These applications are accredited by the DoD to PL3 and PL4 standards for operation in secure environments.

Page 5 of 8 Pages

GTRI is a multi-disciplined, defense oriented, scientific, and technical research and development institution. GTRI’s capabilities are necessary to meet this requirement. GTRI has provided critically needed scientific and technological research, such as malware analysis, communications, information, technology, and system sustainability not otherwise available from any existing Government agency or private firm.

GTRI is uniquely qualified to meet the task order requirements, based upon its past and current performance with DISA NLCC and similar Government customers.

GTRI is the only contractor that possesses the necessary combination of technical expertise, prior experience with DISA NLCC, and knowledge of the people and organizations with whom the DoD secure information system community must interact on a daily basis. The capability of GTRI to provide the requisite experience while maintaining continuity of operations on critical engineering efforts makes them uniquely qualified to meet the United States Government requirements for this effort.

Alternative sources without GTRI experience would present a significant risk, resulting in possible damage to national secure network infrastructure.

(5) Procurement discussion. GTRI has been the sole contractor for SWS since inception.

They have seven years of knowledge and experience, specifically on the complex SWS system. The corporate knowledge required to perform is exclusive to GTRI.

The current contract executed by Washington Headquarters Service, the existing procurement office, is a bridge contract for four months and expires on April 27, 2019. The NLCC office was previously aligned with the Joint Service Provider (JSP).

Last year, the office received directions to move the compartmented SAP IT function out of JSP and into NLCC. Due to the time required to transition to another contractor (which includes transfer of knowledge and expertise, and the substantial duplication of cost), a competitive acquisition will not satisfy the Government’s need in the time required. In addition, it presents a significant risk to the operation of the program by severely derailing timelines on current engineering efforts. These timelines would not be met by any other source than GTRI.

(6) Impact. GTRI is the only source that can fulfill the Government’s requirement. GTRI holds the historical knowledge and the expertise allowing for immediate support for scheduling, metric development, and strategy alignment in order to align to DISA’s priorities. Any contractor aside from GTRI would not be able to meet this requirement. This is especially detrimental to the current needs, under the direction of DoD Chief Information Officer, to engage in projects supporting the deployment of Windows 10. Maintaining GTRI as the provided of the required service will also prevent the loss of highly skilled employees.

6. FEDBIZOPPS ANNOUNCEMENT/POTENTIAL SOURCES: In review of the market research completed by Washington Headquarters Services for the current SWS bridge contract, a posting to the Federal Business Opportunities (FBO) website was issued for 15 days, seeking potential sources. The notice was issued on November 30, 2018 and closed on December 15, 2018. The Government did not receive any inquiries related to the posting.

Page 6 of 8 Pages

A synopsis, as required by FAR 5.201, will not be posted on FBO as this contract meets FAR exception 5.202(10). Specifically, FAR 6.302-3 applies to this requirement since the services being requested will help maintain an “essential engineering, research, or development capability to be provided by an educational or other nonprofit institution or a federally funded research and development center.” A redacted J&A will be posted with the solicitation when posted to FBO.

This justification will be made publicly available IAW FAR 6.305(a) within 14 calendar days after contract award.

7. DETERMINATION OF FAIR AND REASONABLE COST: In coordination with DITCO’s Cost and Pricing Branch (PL842) and the technical evaluation team, the contracting officer will make a determination on whether the cost/price is fair and reasonable. In order to do so, a price analysis (to include comparison of prices obtained through historical data, market research, and comparison to the Independent Government Cost Estimate and existing labor rates) will be utilized. The contracting officer and contract specialist (in conjunction with the cost/price analyst) will ensure that the resulting negotiated price is fair and reasonable to the Government.

8. MARKET RESEARCH: The NLCC program office conducted market research during the period of October 1, 2018 to January 15, 2019. The acquisition history for these services was reviewed. The Small Business Administration, General Services Administration (GSA) IT Schedule 70, GSA Government-wide Acquisition Contracts (One Acquisition Solution for Integrated Services, Professional Services Schedule), and commercial web sites were utilized to identify if there are any small businesses or Historically Underutilized Business Zone contractors with similar or identical capabilities.

Market research determined that only GTRI is capable to support the ongoing efforts of the NLCC program office. GTRI is the only UARC and company building web applications to the cybersecurity requirements in the SAP community today. GTRI holds the historical knowledge and expertise, allowing for immediate support for scheduling, metric development, and strategy alignment in order to align with DISA’s priorities. The Government will continue to conduct market research to determine if there are changes in the marketplace that would enable future competitive actions. On April 12, 2019, a waiver was approved by the Head of the Contracting Activity to post a RFI or SS notice on FBO IAW DISA Acquisition Regulation Supplement

(DARS) 206.302-1.

9. ANY OTHER SUPPORTING FACTS: None.

10. LISTING OF INTERESTED SOURCES:

Georgia Tech Research Institute 505 10th Street Atlanta, Georgia 30318

11. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FULL AND OPEN COMPETITION:

(a) Procurement History.

Page 7 of 8 Pages

GTRI has been providing SWS support for DISA NLCC since 2012. The contracting history is as follows:

Contract Number: HQ0034-19-C-0012 Order Type: CPFF Base Period: December 31, 2018 – February 27, 2019 Option Period: February 28, 2019 – April 27, 2019 Contractor: GTRI Business Type: Other than Small Business Acquisition Method: Sole Source

Contract Order Number: HQ0034-18-C-0012 Order Type: CPFF Base: December 24, 2017 – June 23, 2018 Option: June 24, 2018 – December 23, 2018 Contractor: GTRI Business Type: Other than Small Business Acquisition Method: Sole Source

Contract Order Number: HQ0034-15-C-0046 Order Type: CPFF POP (including all options): June 11, 2015 – December 23, 2017 Contractor: GTRI Business Type: Other than Small Business Acquisition Method: Sole Source

(b) The current and previous awards were sole source awards to GTRI, executed by

Washington Headquarters Services. However, this acquisition is being structured with a PoP of a 12-month base year and two 6-month option periods to allow the Government adequate time to complete additional market research in the near future, to determine if other contractors are available to compete the requirement. By breaking the second year into two 6-month options, the Government is positioning itself to potentially move to another competitive contract sooner should further market research indicate additional capabilities exist.

(c) Previous and current acquisitions were sole source awards. There has not been a prior award for this requirement accomplished without the need for exception to fair opportunity, limited-sources, and/or exception to full and open competition justification.

12. REFERENCE TO THE APPROVED ACQUISITION PLAN (AP): IAW DARS 7.103(S-

90)(3), a written Streamlined Acquisition Plan (AP) has been accomplished.

Page 8 of 8 Pages

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance, which are included in the J&A, are accurate and complete, to the best of my knowledge and belief.

NAME: Jessica Snyder SIGNATURE: See separate PDF

TITLE/ORGANIZATION: DISA OC IMC

PHONE: 703-695-4568 DATE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance, which are included in the J&A, are accurate and complete to the best of my knowledge and belief.

NAME: Karalyn M. Jackow SIGNATURE: See separate PDF

TITLE/ORGANIZATION: DISA OC IMC

PHONE: 301-225-5812 DATE:

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: Jessica L. Bathon SIGNATURE: See separate PDF

TITLE/ORGANIZATION: DISA/DITCO/PL8333

PHONE: 618-418-6761 DATE:

HEAD OF THE CONTRACTING ACTIVITY APPROVAL: I have reviewed this justification and find it to be accurate and complete, to the best of my knowledge and belief. Since this justification does not exceed $93M, this review serves as approval.

NAME: Victoria L. Nemmers SIGNATURE: See separate PDF

TITLE/ORGANIZATION: Head of Contracting Activity

PHONE: 301-225-4120 DATE:

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

Jessica L. Bathon, jessica.l.bathon.civ@mail.mil.

mailto:jessica.l.bathon.civ@mail.mil