A07 Limited-Sources Justification - Redacted.pdf

FEDERAL ACQUISITION REGULATION (FAR) PART 8

LIMITED-SOURCES JUSTIFICATION

Procurement Title: Data Center Hosting GSA Contract Number: GS-03F-049GA Contractor: Iron Mountain Information Management, LLC Estimated Value: $ Limited Source Authority: FAR 8.405-6(a)(1)(i)(B)

1. Identification of the agency and contracting activity.

The United States (US) Department of Defense (DoD) Defense Counterintelligence and Security Agency (DCSA) Contracting and Procurement Office (CPO) proposes to enter into a General Services Administration (GSA) Federal Supply Schedule (FSS) task order on a limited source basis for the Office of the Chief Information Officer (OCIO).

a. Requesting Activity/Program Office:

DCSA

OCIO

27130 Telegraph Road Quantico, VA 22134

b. Contracting Activity:

DCSA

CPO

27130 Telegraph Road Quantico, VA 22134

2. The nature and/or description of the action being approved.

This requirement provides for the procurement of data center colocation hosting and services in support of the DCSA OCIO. Specifically, OCIO has the need for a highly specialized, secure facility designed to provide a safe, dependable, and controlled environment for the fast, reliable, and uninterrupted storage, processing, management, and transmission of digital data. Data centers include an extensive array of computing and networking infrastructure, including cables, racks, servers, storage systems, networking equipment, power sources, and coolers. A colocation data center is defined as a data center that houses servers and networking equipment for many different organizations in a shared setting.

The proposed action is for the procurement of Iron Mountain Information Management LLC’s (Iron Mountain) Data Center Hosting (DCH) space located at Boyers, Pennsylvania (PA). The action will enable DCSA/OCIO to have continued Information Technology (IT) hosting services, power, air conditioning, and network connectivity to DCSA's IT equipment, as well as colocation services, cross connection and helping hands support.

This action is for a Firm-Fixed-Price (FFP) order directly to Iron Mountain off its established

GSA FSS, GS-03F-049GA.

The purpose of this document is to obtain the necessary approvals for a Limited Source Justification (LSJ) in accordance with FAR 8.405-6(a)(1)(i)(B), Only one source is capable of providing the supplies or services required at the level of quality required because the supplies or services are unique or highly specialized.

DCSA previously procured the required colocation data center services in September 2021 through an Interagency Agreement (IAA) with the Army Technical Applications Office (TAO).

Army TAO awarded GS-03F-049GA order to Iron Mountain on behalf of DCSA. included a base period plus four (4) 12-month Option Periods, as follows:

Base Period: 27 September 2021 - 26 March 2022 Option Period 1: 27 March 2022 - 26 March 2023 Option Period 2: 27 March 2023 - 26 March 2024 Option Period 3: 27 March 2024 - 26 March 2025 Option Period 4: 27 March 2025 - 26 March 2026

The Army exercised Option Periods 1, 2 and 3. DCSA is currently in Option Period 3, which expires on 26 March 2025.

The DCSA OCIO recently determined that there is a need to expand the current space at Boyers, PA to accommodate critical equipment currently hosted at a data center in Macon, Georgia (GA), managed by the Office of Personnel Management (OPM). The Macon data center is managed by OPM under an IAA between DCSA and OPM with an end date of September 2025. DCSA determined it’s in the agency’s best interest to issue a new order capturing the existing data center space in Boyers, PA, as well as the expansion requirement, directly with a data center provider in the Boyers, PA area for environmental, resiliency, and response-time purposes. The new order includes the new space, with the existing space, rather than amending the scope under the existing order through the Army. The required new space consists of an additional 213 square feet that is adjacent to existing 837 square feet for a total requirement of 1,050 square feet. DCSA determined it in the best interest of the agency and Government to move forward with procuring the data center hosting directly through an internal DCSA contract instead of through an IAA.

DCSA’s DCH requirements are as follows:

• Compliance: Federal Information Security Modernization Act (FISMA) High Compliant

Federal Facility Security Level 3

• Security: Federal Information Processing Standard (FIPS) 199 High Risk Requirements and Tier III data center standards in accordance with Uptime Institute’s guidelines

• Facility: Colocation data center facility within 50 miles of its Boyers, PA office

3. A description of the supplies or services required to meet the agency’s needs (including estimated value).

Description of the Requirement: DCSA OCIO requires the renewal of existing data center space and expansion upon the existing space within Iron Mountain’s Boyers, PA facility. The Contractor shall provide IT hosting services, power, and network connectivity to DCSA’s IT equipment. Network connectivity will be provided by DCSA; however, the Contractor shall provide direct connectivity between DCSA’s current data center and the data center hosting services environment. DCSA will maintain access to and operational control of its operations within the data center hosting services environment. The requirements are as follows:

Table 1 - Requirement

Description GSA FSS Item Monthly Federal Colocation Services –

WPA1 - 160.00 kW FISMA High - 100% Renewable Energy Federal

Cage/Suite with 160 kW Maximum Electrical Consumption

DC10

Monthly Federal Colocation 5 kW Expansion

- WPA1 (160.00 - 320.00 kW)

WPA1 - Expansion - 5kW increment

DC11

Cross Connect Cross Connections: Iron Mountain provided connectivity between DCSA's Cage and Carrier Meet-Me – Rooms Recurring Charge

DC68

Helping Hands – Non-Recurring Charge DC76

Total Estimated Cost: $

Period of Performance: One (1) twelve (12)-month base period plus 1 12-month option, as follows:

Base: 27 March 2025 – 26 March 2026 Option I: 27 March 2026 – 26 March 2027

4. Identification of Authority.

In accordance with 8.405-6(a)(1)(i)(B), only one source can provide the supplies or services required at the level required because the supplies or services are unique or highly specialized. DCSA market research identifies Iron Mountain as the only available source capable of providing the required data center hosting in accordance with DCSA’s basic requirement criteria.

5. A demonstration that the proposed contractor’s unique qualifications to provide the required supplies or service.

DCSA has an immediate need to renew its existing data center hosting environment, capable of accommodating up to 32 racks of equipment with a total power draw of 160 kilowatt (kW).

DCSA requires the capability to expand to 320kW if necessary to meet future needs, and requires a dedicated, contiguous, and secure caged environment that is constructed from floor to ceiling around the DCSA identified computing equipment space. DCSA servers and IT equipment currently hosted in Iron Mountain’s Boyers, PA facility must be maintained. This requirement will renew and expand the current DCH services at Iron Mountain in Boyers, PA, which is a Tier III DCH environment that meets Federal Information Processing Standard 199 requirements for IT systems.

Iron Mountain is the only data center colocation facility within a fifty (50) mile radius of DCSA’s Boyers, PA office, Zip Code 16018, that also meets required Federal security controls compliance and criteria. DCSA requires a colocation data center facility within 50 miles of its Boyers, PA office due to the necessary connectivity between the current and expanded operations in terms of data communications and support personnel. DCSA is required to maintain access and operational control of data center operations, and onsite support is required to ensure power and cooling are maintained. Additionally, maintaining data center hosting within 50 miles of DCSA’s Boyers, PA office is required to minimize DCSA staff response times to outages within a one (1) hour timeframe, and enable accessibility given that regular on-site support from DCSA is needed. Furthermore, DCSA’s planned Recovery Time Objective (RTO) is 1 hour, which equates to 50 miles, in which business operations are restored or resources are again available for use after a disaster.

DCSA employees who work out of the office in Boyers, PA need the ability to access the network servers and storage within a limited distance of 50 miles, which corresponds to a maximum of 1 hour to respond in person in case of network and/or power outages.

Iron Mountain is only vendor that can meet all of DCSA’s requirements for compliance and security. Specifically, DSCA requires a colocation center that meets the following criteria:

• Certified Telecommunications Industry Association (TIA) Tier III identified by

Technology Institute IA-942 (TIA’s American National Standards Institute (ANSI)/TIA- 942 Standard)

• National Institute of Standards and Technology (NIST) Certified

• Federal Risk and Authorization Management Program (FedRamp) certified

• Federal Information Security Modernization Act (FISMA) High Compliant

Iron Mountain is a FISMA compliant Data Center that meets federal facility security level 3.

Iron Mountain’s data center complies with FISMA High Accredited NIST 800-53A independent controls/auditing and NIST 800-53 security controls. These controls support development of secure and resilient federal information systems. Compliance with NIST guidelines is a major component of FISMA compliance, which provides agencies with the information they need to maintain a high level of security and eliminate vulnerabilities in a timely and cost effective manner. Potential penalties for Government agencies that fail to comply with FISMA include censure by Congress, reduction in Federal funding and reputational damage.

Iron Mountain’s facility is in compliance with FIPS 199 high risk requirements, meeting Tier III data center standards in accordance with Uptime Institute’s guidelines. Specifically, Iron Mountain is a Tier III DCH environment that is ISO 20000-1:2011 certified and FIPS 199 compliant to ensure superior value in the design, delivery and improvement of IT services.

Implementation of ISO 20000-1:2011 is an international IT service management ITSM standard that enables organizations to align processes with industry best practice.

Additionally, it has FIPS 199 impact assessment, which establishes 3 potential levels of impact: low, moderate, and high, relevant to securing Federal information and information systems for each of the three stated security objectives: confidentiality, integrity and availability.

Based on the location proximity to the DCSA Boyers, PA site and Federal security control requirements, Iron Mountain is the only source capable of meeting OCIO’s data center hosting requirement. While several other facilities offer data center colocation services, Iron Mountain is the only source who maintains the required Federal security controls and also provides the data center colocation services required within the geographic area needed.

6. A determination by the Contracting Officer that the order represents the best value (FAR 8.404(d)).

The Contracting Officer has determined that issuing an order against the FSS represents the best value to the Government resulting in the overall lowest cost alternative, considering price and special features necessary to meet the Government’s requirements. This determination is made on the basis that the requirement is available via GSA FSS, which will decrease the administrative time/burden, that the Contractor’s proposed pricing is fair and reasonable, and that the Government will seek further discounts.

Per FAR subpart 8.4, GSA has already determined the GSA Schedule prices to be fair and reasonable; however, the Contracting Officer will conduct price analysis using one or more methods, including but not limited to, comparison of pricing to historical prices paid and comparison with competitive published price lists. The Contracting Officer will make a separate fair and reasonable determination as well as requesting additional discounts in accordance with FAR 8.405-2 and DFARS 208.404, Use of Federal Supply Schedules, and DoD Class Deviation 2014-O0011- Determination of Fair and Reasonable Prices When Using Federal Supply Schedule Contracts, dated March 13, 2014.

Based on the justification to continue with its current need for data center hosting, the market research conducted, and significant discounts anticipated, as well as implementation of the streamlined procedures under FAR part 8, DCSA has determined that issuing a task order to Iron Mountain against GSA contract GS-03F-049GA represents the best value to the Government at the lowest potential price.

7. A description of the market research conducted.

In October 2024 the OCIO Program Office conducted market research by initially identifying data centers within the DSCA requirement of a 50-mile range of Boyers, PA. In doing so, DCSA conducted internet searches and reviewed GSA. While GSA resulted in three (3) vendors ( , and Iron Mountain) who provide access to data center colocation services, two (2) of the vendors ( ) data center hosting capability is either provided by a third-party data center and/or the data centers do not fall within the 50-mile location proximity required. Internet searches resulted in four (4) colocation facilities within a 50-mile radius; however, of the 4 facilities, Iron Mountain is the only facility that also meets all of DCSA’s required criteria for security controls. The table below provides a breakdown of the four vendors reviewed within a 50-mile radius, and which criteria they do/do not meet.

Table 1 – Vendor Compliance

Vendor Colocation Tier III Certified

NIST

certified FedRAMP

FISMA

High Compliant

Distance from Boyers

Iron Mountain Yes Yes Yes Yes Yes 0 Yes No Yes No Yes Yes Yes Yes No No Yes No No No No

Based on the results of this market research, the proposed contracting action to Iron Mountain under contract GS-03F-049GA is the only contract that can fulfill this requirement.

8. Any other facts supporting this justification.

None.

9. A statement of the actions, if any, the agency may take to remove or overcome any barriers to competition before any subsequent acquisition for the supplies or services required, if subsequent acquisitions are anticipated.

DCSA will continue to regularly assess the market by contacting knowledgeable individuals in Government and industry including DCSA partners and other United States Government agencies to identify any additional sources that may have the necessary capabilities to meet DCSA’s minimum requirements. DCSA will continue to conduct market research to ascertain if changes occur in the marketplace that would enable future actions to be competed.

CERTIFICATION

I certify that the facts and representations under my cognizance which are included in this justification, and which form a basis for this justification are complete and accurate.

Chief- Program/Portfolio Management, Programs & Execution Office of the Chief Information Officer Defense Counterintelligence and Security Agency

Contracting Officer:

I certify that this justification is accurate and complete to the best of my knowledge and belief.

Contracting Officer Defense Counterintelligence and Security Agency (DCSA) Contracting and Procurement Office (CPO)

APPROVAL

Competition Advocate:

This review serves as concurrence and my written determination that the aforementioned circumstances apply in accordance with 8.405-6(a)(1)(B).

Competition Advocate Defense Counterintelligence and Security Agency