ID03180010_-_DS_Logon_Limited_Sources_Justification_(FedBizOpps).pdf

ITSS Order ID: ID03180010 GSA, FAS Mid-Atlantic Region

LIMITED-SOURCES JUSTIFICATION

FOR

Defense Manpower Data Center (DMDC)

Department of Defense Self-service Logon Services (DS Logon)

The National Institute of Standards and Technology (NIST)

Modification 02

Note: This document is prepared in accordance with the requirements of FAR 8.405-6(c). The acquisition is conducted under the authority of the Multiple-Award Schedule Program.

1. Identification of Requiring Activity and Contracting Activity:

The requiring activity is the Defense Manpower Data Center (DMDC) located at Seaside, California, and the Mark Center, Alexandria, Virginia. The contracting activity is the GSA Federal Acquisition

Service (FAS), Mid-Atlantic Region - Philadelphia, PA.

This document is hereby identified as a Limited-Sources Justification.

2. Nature and/or Description of Action Being Approved:

The action being approved is a modification to Department of Defense Self-service Logon Services

(DS Logon) order number 47QFMA18F0016 under the Enterprise Services LLC GSA DMDC ITPS

Multiple Award BPA contract GS03Q17DSA0008. The action is necessary to comply with new

National Institute of Standards and Technology (NIST) guidelines.

DS Logon was competitively awarded on 03/22/2018 with a base period of 26 March 2018 through

25 March 2019 with two (2) one-year option periods.

3. Description of Supplies/Services Required To Meet the Agency's Needs:

The National Institute of Standards and Technology (NIST) develop Federal Information Processing

Standards (FIPS) which the Secretary of Commerce approves and with which federal agencies must comply. NIST also provides guidance documents and recommendations through its Special

Publications (SP) 800-series. NIST is now in the process of finalizing 800-63-3: Digital Identity

Guidelines.

In order for DS Logon to stay compliant with new NIST Special Publication 800-63-3 Digital Identity

Guidelines, the DoD CIO requires the following DS Logon services; additional data elements that support NIST policy for Two Factor Authentication (2FA) and One-Time Password (OTP), to increase the ease of usability and enhance the user’s experience (UX) of DSL graphical user interface

(GUI), and to update documentation to support password changes and additional data elements.

This modification has a total estimated firm-fixed price (FFP) of $495,763.65. The modification estimate is for labor only, which consists of prices for the skill level mix with corresponding labor-hour prices and is based on pricing currently being paid under the existing call.

4. Identification of Statutory Authority and Justification/Rationale for Limiting Sources

Demonstrating the Contractor's Unique Qualifications to Provide the Required

Supply/Service:

The authority for this action is FAR 8.405-6(a)(1)(i)(C) – Only one source is capable of providing the supplies or services required at the level of quality required because the supplies or services are unique or highly specialized

Enterprise Services (ES) is currently supporting DS Logon, after competing for the award. As the current contractor supporting this effort, ES is the only source capable of performing the work required to implement this NIST policy change, due to the fact that these policy changes are within scope of the call awarded to ES, and ES is the only contractor permitted access to the code. No other contractor can be given access to the authentication program, applications it runs on, or the code written to develop DS Logon, which would create a security hole and conflict of interest. The

Government cannot allow another contractor to come in and take over the responsibility of the entire

DS Logon authentication program, just to implement this one change that only ES may perform.

Besides the above security issue, the support of DS Logon is the sustainment, enhancement and release management of this identity management program, which includes ensuring DS Logon is compliant with NIST eAuthentication Guidance. ES has been providing this support since the award in March 2018, during which enhancements have been released and scheduled for the rest of the performance period. This NIST policy change will affect all of these upcoming enhancements, as well as the ones already implemented; since this change is the foundation of the authentication process, all releases will either have to be re-coded and/or rescheduled to include the NIST policy change. ES is the only contractor that is directly in the process of coding these enhancements and releases, and, as such, is the only contractor capable of rewriting the existing code for each release in a timely manner, in order to be able to implement the NIST change by the deadline, as well. Another contractor will need to be brought up to speed on ES’ code and integrated into the release management schedule, as well as having to follow ES’ procedures and approvals for writing the code required. Requiring ES to train and approve a different contractor’s work will take a great deal of coordination in a very tight schedule. These NIST policy changes must be fully implemented by February of 2019, which does not give ES enough time integrate another contractor into their process to ensure the work is done properly and in a timely manner.

ES is the only contractor capable of providing the service required to implement the NIST policy change, because ES is the only contractor that has the experience, knowledge, particularly of the new code they recently wrote, and security position to do the work. If this were competed, the Government would not be able to mitigate the security and conflict of interest risks that would occur by bringing in a new contractor for this piece of work that ES is able to perform immediately and with the expertise that only they have in the current environment.

Also, if this requirement were competed, the Government would incur a significant investment in the time and effort it would take to develop an entirely new set of solicitation documentation, issue an

RFQ, review and analyze quotes, prepare award documentation and make the award. In addition, competing this requirement could take months resulting in further delays of implementation.

Enterprise Services LLC has provided acceptable support for this call since March 2018 (no negative feedback has been received thus far from DMDC). Retaining this contractor is necessary to fulfill the

Government’s requirement by complying with NIST Special Publication 800-63-3 Digital Identity

Guidelines for the remainder of performance in the current Base Period.

The reasons above prove that competing this work will have an impact on DMDC’s mission for the maintenance and enhancement of the DS Logon Identity Management program.

5. Determination by the Ordering Activity Contracting Officer that the Order Represents the

Best Value Consistent with FAR 8.404(d):

The assigned GSA ITM will complete a technical evaluation on the contractor’s technical submission. The assigned GSA Contracting Officer will complete the price evaluation. The GSA

ITM will perform a technical evaluation to ensure that the labor mix and number of hours quoted by the contractor are acceptable and commensurate with the work requirement of this Call as well as ensuring that the contractor has adequately responded to all technical requirements. The GSA

Contracting Officer will conduct a price analysis of the contractor’s submitted prices for all labor ensuring that there are no math errors or pricing caveats. Quoted labor rates will also be checked to ensure that they do not exceed the contractor’s current GSA DMDC ITPS BPA contract rates.

In accordance with FAR Subpart 8.4, GSA has already determined the prices to be fair and reasonable at time of award of this Call since they are derived from and reflect the actual prices in the Enterprise Services LLC awarded DMDC ITPS BPA labor category rates and since the rates were also derived from a competitive acquisition. The Contracting Officer has determined that this effort will result in the greatest overall benefit to the Government in response to the requirement, attaining the best value, and fair and reasonable prices.

6. Description of Market Research:

Market Research was conducted in accordance with FAR 10. A review of the technical scope of

Enterprise Services LLC DMDC ITPS BPA contract showed that the contractor offers the required services under its DMDC ITPS BPA contract number GS03Q17DSA0008.

7. Other Facts Supporting the Justification:

None.

8. Actions the Agency May Take to Remove or Overcome Any Barriers that Led to the Restricted Consideration prior to Subsequent Acquisition For the Supplies or Services:

If future expenditures and allowances are granted for continued support during the period of performance of this Call, all efforts will be made by the Government to seek alternate sources of service for the support.

However, it is important to note that many variables will play into this alternative source potential, such as changes in Government priorities within the current operations, and shifting needs.

See next page for certifications and approvals.