DOEHRS-IH_Sole_Sole_Source_Justification_AUG13_v6_(2).pdf

Justification and Approval for Other Than Full and Open Competition Justification

1. Contracting Activity: Contract Operations Division- Falls Church 7700 Arlington Blvd Falls Church, Virginia 22042

2. Description of Action: This is a firm-fixed price, sole source procurement action for services to provide support for the Defense Occupational and Environmental Health Readiness System – Industrial Hygiene (DOEHRS-IH) resolution current Information Assurance / Security related Hewlett Packard (HP) Fortify Findings in existing custom-developed Industrial Hygiene and Environmental Health software code and resolve existing System Incident Reports (SIRs) in existing custom-developed Environmental Health software code.

DOEHRS-IH is a complex system requiring a detailed understanding of multi-tiered enterprise application, which supports deployment as a web-based application and as a mobile application. DOEHRS software architecture is based on the J2EE technology stack, core J2EE design patterns, logical tiers defined in J2EE blueprints, and core Java/J2EE frameworks such as Apache Struts and Oracle TopLink. Additionally, several software frameworks were developed to support core DOEHRS functionality such as Master Schedule, Surveys, and Samples. Since its initial production release, new functionality has been incrementally designed, developed, and integrated into the DOEHRS software application. The design of the new functionality follows the DOEHRS software architecture principles. In many cases, core DOEHRS software frameworks have been adapted and extended to enable support for the new functionality, while continuing to support existing functionality.

Developing new functionality into the DOEHRS software application continues to be increasingly more complex. DOEHRS software provides solutions for complex functionality and algorithms supporting the Industrial Hygiene and Environmental Health domain areas. DOEHRS software includes a Data Warehouse to support reporting requirements and supports external system interfaces for authentication, single-sign-on (SSO), and updating DoD personnel records. As of the last release, the DOEHRS software application consists of approximately 25 business domain areas supported by more than 2.5 million lines of code, including approximately 9000 Java classes and 2500 Java Server Pages (JSPs). The size of the DOEHRS source code, along with the number of software frameworks and technologies utilized to support DOEHRS functional requirements, requires DOEHRS software engineers to have extensive technical skills and an in-depth knowledge of the DOEHRS implementation standards. Additionally, DOEHRS software engineers are expected to follow the DOEHRS software development methodology and meet DOEHRS implementation standards.

Resolution of security findings from static analysis tools, such as Fortify, within the DOEHRS software application can be equally or more complex than introducing new functionality. As previously mentioned, the DOEHRS software architecture is based on core Java/J2EE frameworks and DOEHRS software frameworks which precede many of the current industry standards and best practices for secure programming. Refactoring the DOEHRS software architecture to introduce secure programming practices and concepts is extremely complex, requires extensive DOEHRS experience, and introduces risk to existing functionality.

Funding source is DHP.

3. Description of Services:

DOEHRS-IH is a custom developed complex, multi component system which includes a web application, highly configured mobile application, and a data warehouse. DOEHRS- IH was developed to meet DoD-unique requirements to establish a database for longitudinal exposure recordkeeping and reporting to support occupational and environmental health surveillance (OEHS), public health surveillance, health risk management, and medical surveillance; and to provide this data in support of medical treatment, occupational and environmental illness evaluations, disability determinations, and claims adjudication. DOEHRS-IH is used to complete the collection and analysis of threat exposures for designated event areas in all phases of military operations and as a result of actual or perceived natural disasters, hazardous material releases, chemical/biological/nuclear accidents which may affect DoD-affiliated personnel.

There are no equivalent commercial, off-the-shelf software (COTS) products available from any vendor. There is no equivalent commercial vendor who has the complete understanding of the current custom-developed application. The findings and SIRs must be resolved by the vendor who has identified the findings and SIRs.

This DOEHRS-IH effort focuses on two areas

Resolution of Fortify Findings:

DOEHRS-IH is mandated by existing public laws and Department of Defense (DoD) Instructions and Directives to resolve Information Assurance and Security vulnerabilities in existing software code. Defense Health Services Solutions (DHSS) has identified HP Fortify as the tool required to be utilized to identify Information Assurance / Security vulnerabilities in existing DOEHRS-IH custom developed complex software code.

If DOEHRS-IH Fortify findings remain unresolved, then it is impossible to sustain DOEHRS-IH's system accreditation and Authority to Operate and DOEHRS-IH will not be allowed to continue to provide services mandated by multiple laws and directives. As a result, the resolution of the findings in the DOEHRS-IH legacy source code must be defined and implemented to withstand the DoD information assurance requirements.

To ensure the findings are fixed accurately and expeditiously, the current vendor is the only vendor who is knowledgeable of the current complex code and who will be able to complete this effort within the allotted time of the contract. Additionally, all of the resolutions must withstand the stringent information assurance and security standards imposed by the DoD. The requirement for the vendor to have the knowledge to understand and analyze the components of the existing source code, the behaviors of the DOEHRS-IH source code, and determine the viable solution to correct these intrinsic vulnerabilities is critical.

The National Defense Authorization Act (NDAA) includes a focus on software security entitled Section 932, Strategy on Computer Software Assurance. The NDAA serves as the first cyber security law and requires the DoD to develop a strategy for assuring the security of software applications.

Section 932 is comprehensive in scope. It stipulates that the DoD’s software security strategy must encompass the entire software life cycle, including development, acquisition, testing, production, certification and accreditation (C&A), and C&A renewals. The DoD must also address the demand to remediate legacy systems and to monitor and defend running applications against ongoing cyber-attacks. Additionally, the law requires the use of automated scanning tools, for example HP Fortify, that are more proficient than manual analysis at identifying and fixing vulnerabilities during development, testing, and production.

Environmental Health SIR Resolution:

DOEHRS-IH has a significant number of long-standing Environmental Health SIRs. The SIRs require expertise in not only the current complex software code but also requires expertise in Environmental Health as outlined in DoDI 6055.05, Occupational and Environmental Health; DODI 6055.1, DoD Safety and Occupational Health (SOH) Program; and DoDD 4715.1E, Environment, Safety, and Occupational Health (ESOH).

Additionally, a number of public laws mandate the DoD to collect occupational and environmental health exposures, including Occupational Safety and Health Act (OSHA) of 1970 as implemented in EO 12196; 29 CFR 1960.

DOEHRS-IH is deployed throughout the Military Health System at 130 Army, 55 Navy, and 202 Air Force CONUS and OCONUS locations.

Estimated value of contract for the one year is $1,058,758.10 with a period of performance from 1 OCT 2013 to 30 SEP 2014. Additional unfunded contract line items (CLINs) exist on this contract but at this time, no additional funding is available to execute these options.

4. Authority Cited:

FAR Clause 6.302-1 (b) (1) (i)

5. Reason for Authority Cited: -- The current vendor, Northrop Grumman Information Technology, Inc., has had over 11 years of experience developing the current DOEHRS- IH system. Northrop Grumman Information Technology, Inc. has successfully completed over 15 task orders and contracts in this time period and provides an exceptional knowledge base of understanding of the code that makes up DOEHRS-IH and the scientific and technical basis for Industrial Hygiene and Environmental Health.

As these two tasks, resolving Fortify Findings and resolving Environmental Health SIRs, require extensive knowledge of the current baseline source code for the system; an understanding of Industrial Health and Environmental Health business practices; and the requirement to execute this effort in 12 months, DHSS strongly recommends this sole source award be made.

6. Efforts to Obtain Competition: There are no efforts to obtain competition for this acquisition. Notice required in FAR 5.201 will be published, and proposals received will be considered.

7. Actions to Increase Competition: The requiring activity will continue to conduct market research for this type of service. If additional sources are found, they will be included in any subsequent competitive acquisitions.

8. Market Research: A random sampling of small and large businesses was conducted to evaluate capabilities against the tasks required. It was determined that due to the unique requirements and complex code that only one vendor, Northrop Grumman Information Technology, Inc., has the expertise, technical knowledge, and experience to perform the tasks required and to meet the DOEHRS IH Program’s minimum technical needs.

9. Interested Sources: To date, no other sources have written to express an interest.

Notice required by FAR 5.201 will be published, and any proposal received will be considered.

10. Other Facts: The current vendor, Northrop Grumman Information Technology, Inc., has successfully executed multiple contracts with the Military Health System since 2002 through all phases of the DoD Acquisition process, including prior to Milestone C, support through Milestone C, the deployment of all DOEHRS-IH components to all three Services, and support into the current phase of Operations and Support. Northrop Grumman Information Technology Inc. possesses the comprehensive understanding of the complex Industrial Hygiene and Environmental Health business practices implemented under all of the DOEHRS-IH components (Web, Mobile, and Data Warehouse), as well as the system architecture, configuration of the Defense Information Systems Agency (DISA) servers, intricate system functionality, and approved DOEHRS-IH plans, processes, and procedures, resulting in continuity of support and high fidelity throughout the DOEHRS-IH application.

11. Technical Certification:

I certify that the supporting data under my cognizance which are included in the justification are accurate and complete to the best of my knowledge and belief.

Typed Name: Brenda Jones Date: __28 AUG 2013___________

Title:

Deputy Director, Health Surveillance DOEHRS Technical Manager Signature: _________________

12. Requirements Certification:

I certify that the supporting data under my cognizance which are included in the justification are accurate and complete to the best of my knowledge and belief.

Typed Name: Brenda Jones Date: __28 AUG 2013_________

Title:

Deputy Director, Health Surveillance DOEHRS Technical Manager Signature: __________________

13. Fair and Reasonable Cost Determination:

I hereby determine that the anticipated cost to the Government for this contract action will be fair and reasonable. An Independent Government Cost Estimate for the contract services was prepared based on historical costs associated with contract W74V8H-04-D- 0018, which previously provided the similar services. The basis of fair and reasonable pricing will be historical pricing. The Government will not require cost or pricing data IAW FAR 15.403-1(c)(3).

Typed Name: Adrian Gavins Date: ____________________

Title: Contracting Officer Signature: ________________

14. Special Competition Advocate: I have reviewed this justification and approval.

Typed Name: Genesta Bolton Date: _________________________ Title: Special Competition Advocate

Signature: _____________________