RFQ_Attachment_2_Sole_Source_Letter.pdf

FOR OFFICIAL USE ONLY

JUSTIFICATION AND APPROVAL (J&A) FOR OTHER THAN FULL AND OPEN COMPETITION

SIMPLIFIED ACQUISITION – FAR PART 13

Control Number# EOSD-18-4-042

1. Agency and Contracting Activity:

The Department of Defense, Washington Headquarters Services, Acquisition Directorate, Enterprise Office of the Secretary of Defense Specialized Services Branch has a requirement for Bit Discovery BitLocker Account Licenses for the Defense Digital Services (DDS).

2. Nature and/or Description of the Action Being Approved:

This sole source letter is initiated, on behalf of the DOD Defense Digital Service to award a contract, on a sole-source basis, to Bit Discovery (2010 El Camino Real, Suite 1119, Santa Clara, CA 95050) for up to 10 Bit Discovery BitLocker account licenses of its proprietary software.

3. Description of Supplies/Service:

The Defense Digital Service (DDS) works on fast tempo, high stakes requirements utilizing a small highly specialized team of technology experts who require equally specialized and nimble tools to meet its mission.

DDS Mission

To fulfill this mission, DDS focuses on:

1. Transforming critical services: We are dedicated to measurably improving DoD’s most important software efforts. We help to manage technology projects relying on (1) a user-centered design framework to prioritize a user-centered design framework to prioritize software development work; and (2) modern software development practices to enable iterative development and the ability to rapidly respond to change and feedback.

2. Bringing top technical talent into public service: In support of these goals, we recruit top technologists for term-limited tours of duty with DoD. We will encourage a tradition of public service in the technology industry that will support the ongoing improvement of DoD digital services.

3. Technology policy: Where applicable, we intend to inform and reform DoD technology policy to leverage lessons learned from private sector innovation.

The DDS Approach

To maximize the usefulness of resources and manage the team in a sustainable way, DDS fully supports a smaller number of projects, rather than partially supporting a large number. DDS focuses on projects that advance DoD’s most important initiatives – those that are critical to the well-being of Service members, civilian employees, and core operations of the Department. In addition to those focus areas, DDS engages in tangential issues that arise (e.g., supporting back-end infrastructure, policy considerations, and legal implications). DDS engages with each project during a scoped timeframe, and establishes clear exit criteria for each project in concurrence with the relevant DoD senior and project-level leadership. DDS role may be in the development of new code, product management, advising on code development processes and releases, and hacking or rewriting existing policies or processes that are antiquated, unnecessary, and/or redundant.

DDS engagements typically start with a “micro-sprint” through which a team of 2-3 DDS Digital Service Experts spends 1-2 days evaluating a problem set to determine whether it meets DDS project criteria. If the project meets the aforementioned criteria, DDS will send a team of 4-6 DDS Digital Service Experts to conduct an on-site “discovery sprint” study (typically 2 weeks) of the problem. The discovery sprint findings are then shared with DoD Leadership and the relevant stakeholders and, if there is a fit and opportunity for impact, DDS will launch a longer 3-6 month engagement to implement some, or all, of the recommendations presented. For more on the overall DDS approach to projects and software development best practice, please reference the Digital Service Playbook (https://playbook.cio.gov/). DDS involvement in each of these projects is expected to save substantial resources for the Department and have a significant impact on the Department's ability to serve the warfighter and contribute to security across the globe.

DDS relies heavily on cloud-based tools and products currently being developed in private sector Industry.

Specifically, DDS requires the capability provided by Bit Discovery to efficiently navigate and rationalize the DoD infrastructure, through the procurement of 10 Bit Discovery licenses for a 12-month base and three 12-month option years that will allow for us to first find assets in order potentially find and fix issues with them.

The Requirement

In order for DDS to fulfill its mission, it relies heavily on cloud-based tools and products currently being developed in private sector Industry. Specifically, DDS requires the capability provided by Bit Discovery to efficiently navigate and rationalize the DoD infrastructure, through the procurement of 10 Bit Discovery licenses for a 12-month base and three 12-month option years that will allow for DDS to first find assets in order potentially find and fix issues with them.

Bit Discovery meets DDS’ immediate requirement of a secure, multifunctional and collaborative tool that facilities network discovery for Top Level and Sub-Domain statuses of DoD assets. Additionally, as organizations as large and complex as the DoD continue to grow, they tend to lose track of their online assets. Organizations continue to become more disconnected and as service members rotate through an organization, continuity is not always adequately passed on and thus assets can be difficult to track at an Enterprise level.

Currently, the Military Services and 4th Estate Agencies rely upon legacy, labor intensive, and ineffective methods and tools residing upon dated infrastructure to track their IT assets such as end-point hosts, servers, webservers, and Class-C IP ranges. Using the aforementioned tools such as HBSS, ACAS, and SCCM gives the military assets owners less than a 90% (at best) certainty of what’s truly in their vast IT architecture. This also may not represent what is forward facing and web accessible. When DDS works with the military services to help troubled programs, they must rely this inaccurate data which can often cause delays in development until accurate https://playbook.cio.gov/ information is identified. Bit Discovery shortens this discovery time significantly. Using the BETA version of Bit Discovery, DDS was able to uncover:

• 600K+ “Army.mil” subdomains

• 200K+ “Navy.mil” subdomains

• 80K+ “AF.mil” subdomains

• 2M+ other online assets associate with the .Mil domain

By using the BETA version of Bit Discovery, this will gives us a better ability to manage our assets across the .mil space so that the DoD can understand where our domains are located. To date there is no comprehensive list of the .mil domains nor a tool that allowed the DoD to generate that list. This prevented us from adequately tracking and managing activities, as well as providing services to help troubled programs that had to rely on inaccurate data. That often causes delays in development until accurate information is identified. Bit Discovery shortens this discovery time significantly because of its depth and breadth of domain information.

The total estimated dollar value of this procurement for the initial base quantity is $55,000 and a purchase order value of $220,000. DDS has FY18 to FY21 Operations and Maintenance (O&M) funding to support this requirement.

Line Item Description

Number of Account Licenses

Estimated Unit Price

Subtotal Line Item

Bit Discovery - Year 1 10 $5,500.00 $55,000.00 Bit Discovery - Year 2 10 $5,500.00 $55,000.00 Bit Discovery - Year 3 10 $5,500.00 $55,000.00 Bit Discovery - Year 4 10 $5,500.00 $55,000.00

Grand Total 40 $220,000.00

4. Identification of Statutory Authority Permitting Other Than Full and Open Competition:

The statutory authority permitting other than full and open competition is 41 U.S.C. 253(g)(1)(A) as implemented by FAR 13.106-1(b)(1) – soliciting from a single source, for purchases not exceeding the simplified acquisition threshold.

5. Demonstration that the Contractor’s Unique Qualifications or the Nature of the Acquisition Requires the Use of the Authority Cited:

Based on the Government’s current market research, including input from numerous technical advisors, Bit Discovery meets the unique needs of DDS to rapidly support DoD missions. Bit Discovery knows every bit of the Internet, making website discovery and portfolio management quick and easy. Bit Discovery illuminates every little bit of the Internet so that our customers are aware of all of the websites they own. Using snapshots of the internet, Bit Discovery organizes massive amounts of information and distills it down to simple and elegant portfolio tracking. Bit Discovery’s website portfolio is an indispensable solution. Awareness of unknown or unauthorized websites is their first step in addressing what could be a critical business issue. Maintaining the security and efficiency of a business requires keeping track of the websites they own, formerly a 24/7 job. Bit Discovery keeps searching even when a customer can’t, bringing immediate alerts if anything in a businesses’ portfolio changes. When a customer arrives to take a look, everything they need to know about the website is there waiting for them.

Specifically, Bit Discovery is the only service that facilitates automatically monitoring a large subset of subdomains and technologies all at once. Their inventory includes at least 2 million .mil subdomains and includes data for the entire internet starting from 2014 to present. As such DDS requires an easy-to-use, well organized, and centralized portfolio of the unclassified websites of organizations, which can be instantly created and automatically updated. Bit Discovery fills this current mission gap and would aide in the development of multiple DDS and military projects. This service allows DDS to maintain visibility over thousands of DoD domains. To date there does not exist an exhaustive and continuously up to date list of what domains are hosted under the .mil TLD (top level domain) and this service gives us insight into what applications, technology stacks, and IPs are open to the public. Knowing what is publicly accessible gives us the insight needed to get better at securing those assets.

6. Efforts to Obtain Competition:

This Justification and Approval will be posted with the Request to Quote to Federal Business Opportunities website in accordance with FAR 5.207(c)(16). If any responsible sources submit capability statements, WHS/AD and DDS will evaluate these submitted capabilities to help determine the appropriate acquisition strategy for future procurements.

7. Determination by the Contracting Officer that the Anticipated Cost to the Government Will be Fair and Reasonable:

The Contracting Officer will ensure that the resulting contract is fair and reasonable per FAR 15.404-1(b)(2)(ii).

The price will be determined fair and reasonable via the comparison of proposed price to historical prices paid, whether by the Government or other than the Government, for the same or similar items.

8. Description of Market Research Conducted.

DDS conducted in-depth market research to determine whether Bit Discovery meets its requirements. DDS vetted several tools through their websites, brief demos, and spoke with industry leading Digital Service Experts. Further market research was conducted via Google, SBA’s Dynamic Small Business, GSA Advantage and FPDS NG to determine if resellers of the Bit Discovery Bitlocker licenses existed. This market research resulted in no resellers of this product in the market.

9. A listing of the sources, if any, that expressed, in writing, an interest in the acquisition.

N/A

10. A statement of the actions, if any, the agency may take to remove or overcome any barriers to competition before any subsequent acquisition for the supplies or services required.

WHS/AD and DDS will continue to take action to remove or overcome any barriers to competition by evaluating any capability statements submitted in response to the Notice of Intent and continue to conduct market research to discover any reseller companies that can meet the salient characteristics of Bit Discovery.

11. TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

DATE

Director for Defense Digital Service

OSD/DDS

12. CONTRACTING OFFICER'S CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief (FAR 13.106-1(b)(1) and 41 U.S.C 253(f)(1)(A)):

DATE

Contracting Officer

WHS/AD