J A Cybersecurity_Okta Redacted.pdf

3. DESCRIPTION OF SUPPLIES/SERVICES REQUIRED TO MEET AGENCY’S NEEDS:

Adopt all DoD Risk Management Framework (RMF) requirements to achieve a cybersecurity Authorization to Operate (ATO) at the Assessment and Authorization (A&A) level. As well as, support for the migration from NIST SP 800-53 Rev 4 to NIST SP 800-53 Rev 5. These two components are required to achieve an approved DLA Cybersecurity authorization for the WES solution to operate on the DLA production environments. Additionally, adoption and integration with the DLA provided OKTA solution is required to provide simplicity and alignment with the DLA enterprise approach to multifactor, single sign-on (SSO), CAC authentication requirements.

4. IDENTIFICATION OF STATUTORY AUTHORITY:

The statutory authority permitting other than full and open competition is:

(Check the applicable U.S.C. authority from the listing below)

_X_ 10 U.S.C. 2304(c)(1) or 41 U.S.C. 3304(a)(1), Only one responsible source and no other supplies or services will satisfy agency requirements (FAR 6.302-1, DFARS 206.302-1)

___ 10 U.S.C. 2304(c)(2) or 41 U.S.C. 3304(a)(2), Unusual and compelling urgency (FAR 6.302-2, DFARS 206.302-2))

___ 10 U.S.C. 2304(c)(3) or 41 U.S.C. 3304(a)(3), Industrial mobilization; engineering, developmental, or research capability; or expert services (FAR 6.302-3, DFARS 206.302-3)

___ 10 U.S.C. 2304(c)(4) or 41 U.S.C. 3304(a)(4), International agreement (FAR 6.302-4, DFARS 206.302-4)

___ 10 U.S.C. 2304(c)(5) or 41 U.S.C. 3304(a)(5), Authorized or required by statute (FAR 6.302-5, DFARS 206.302-5)

___ 10 U.S.C. 2304(c)(6) or 41 U.S.C. 3304(a)(6), National security (FAR 6.302-6)

___ 10 U.S.C. 2304(c)(7) or 41 U.S.C. 3304(a)(7), Public Interest (FAR 6.302-7, DFARS 206.302-7)

___ 41 U.S.C. 1901 or 41 U.S.C. 1903, This J&A satisfies the FAR 13.501(a)(1) and (2) regulations to justify a sole source (including brand name) commercial item acquisition or portion of a commercial item acquisition requiring a brand name. Note: Check the above statement applicable if the J&A is for a sole source (including brand name) acquisition for a commercial product or service with an estimated value greater than the Simplified Acquisition Threshold (SAT) but not exceeding $7million (including options)($13million for acquisitions described in FAR 13.500(c)) that is to be awarded using the simplified procedures for certain commercial items prescribed by FAR 13.5.

CUI

___ This J&A satisfies the DFARS 211.104 regulation to justify use of brand name or equal purchase descriptions when using sealed bidding (FAR Part 14), negotiated acquisition procedures (FAR Part 15), or simplified procedures for certain commercial items (FAR Subpart 13.5).

___ This justification satisfies the FAR 8.405-6 regulation to justify when restricting consideration IAW FAR 8.405-6(a) or (b). This acquisition is conducted under the authority of the Multiple-Award Schedule Program. The circumstances (i.e. authority) justifying the action is:

___ An urgent and compelling need exists, and following the procedures would result in unacceptable delays (FAR 8.405-6(a)(1)(i)(A))

___ Only one source is capable of providing the supplies or services required at the level of quality required because the supplies or services are unique or highly specialized (FAR 8.405-6(a)(1)(i)(B))

____ In the interest of economy and efficiency, the new work is a logical follow-on to an original Federal Supply Schedule (FSS) order provided that the original order was placed IAW the applicable FSS ordering procedures (FAR 8.405-6(a)(1)(i)(C))

____ Item(s) peculiar to one manufacturer (FAR 8.405-6(b))

5. DEMONSTRATION OF CONTRACTOR'S UNIQUE QUALIFICATIONS OR NATURE OF

ACQUISITION THAT REQUIRES USE OF THE CITED AUTHORITY:

It would be in the best interest of the government to add this requirement to the current EDC Modernization D.O. This WES solution will not be able to go-live in November 2025 without both the Authorization to Operate and the OKTA integration being complete.

Team ASI has already created the cyber security infrastructure and requirements to be tied into the DLA approved network. Additionally, the ASI contractor is already on-site and vetted for immediate execution of the work.

The current Dematic IQ system within the EDC is owned and proprietary to Dematic. A third party would not be able to integrate processes into the existing framework, which ultimately would require re-work, additional funding, and would not align to the overall schedule and critical path.

6. SYNOPSIS ANNOUNCEMENT/POTENTIAL SOURCES:

A notice of the Government’s intent to issue a sole source modification as required by FAR

5.201 and in accordance with procedures at FAR 6.302-1(d) will be performed prior to issuance of the modification.

Additionally, notice will be given of the Government's intent to increase the Ceiling Price of the LMIS Pool 1 - Enterprise Facility Modernization, IDIQ Contract SP3300-20-D-0021.

7. DETERMINATION OF FAIR AND REASONABLE COST:

To determine whether the contractor’s proposed price is fair and reasonable, the Contract Specialist and Contracting Officer will review the proposed price against the current market pricing information for the same or similar services available.

8. DESCRIPTION OF MARKET RESEARCH:

One estimating method was used in the development of the IGCE.

The IGCE was developed based on the scope of cybersecurity work and contract deliverables identified in the request for proposal (RFP), as well as historical knowledge of the type of personnel needed. The identified labor categories were selected from current JETS LCAT designations, and the hourly pricing estimates are based upon JETS 2.0 (75th Percentile) rates.

9. OTHER SUPPORTING FACTS:

Include any other facts supporting the use of other than full and open competition, such as:

___ Explanation of why technical data packages, specifications, engineering descriptions, statements of work, or purchase descriptions suitable for full and open competition have not been developed or are not available.

___ When FAR 6.302-1, only one responsible source, is cited for follow-on acquisitions as described in FAR 6.302-1(a)(2)(ii), an estimate of the cost to the Government that would be duplicated and how the estimate was derived.

___ When FAR 6.302-1, only one responsible source, is cited, as described in DFARS 206.302(d) and DFARS PGI 206.303-2(b)(i)(A), include the results of the request for information (RFI)/Sources Sought Notice posted IAW DFARS PGI 206.302-1 (unless the requirement to post has been waived).

_X__ When FAR 6.302-1, only one responsible source, is cited, as described in FAR 6.302- 1(c)(1)(B), indicate that the use of such descriptions (brand-name description or other purchase description to specify a particular brand-name, product, or feature of a product, peculiar to one manufacturer) in the acquisition or portion of an acquisition is essential to the Government's requirements, thereby precluding consideration of a product manufactured by another company.

___ When FAR 6.302-2, unusual and compelling urgency, is cited, provide data, estimated cost, or other rationale as to the extent and nature of the harm to the Government.

___ When FAR 6.302-6, national security, is cited, describe how disclosure of the Government's needs would compromise the national security (e.g., would violate security requirements). This authority must not be used merely because the acquisition is classified, or merely because access to classified matter will be necessary to submit a proposal or to perform the contract.

_ For non-competitive follow-on acquisitions of supplies or services previously awarded on a non-competitive basis, include a copy of the previous justification to assist the approval authority in determining whether the planned actions to remove any barriers to competition cited on the previous justification were completed.

___ For a sole-source 8(a) contract over $100 million, include such other matters as the head of the agency concerned shall specify for purposes of this section.

_X__ Other facts supporting the justification:

10. LISTING OF SOURCES, IF ANY, THAT EXPRESSED, IN WRITING, AN

INTEREST IN THE ACQUISITION:

No sources have expressed interest in writing in the acquisition at this time.

11. ACTIONS THE AGENCY MAY TAKE TO REMOVE/OVERCOME BARRIERS

BEFORE ANY SUBSEQUENT ACQUISITION FOR THE SUPPLIES/SERVICES IS

REQUIRED/MADE:

Continue to have the DLA J61 Cybersecurity directorate and assigned ISSM fully engaged in the program. The changes were driven as a result of changing guidelines within J61, updates in DoD NIST SP 800-53 policy documentation. The OKTA integration was driven to align with new DLA enterprise directions and newly capability. As these changes are both driven by DLA and DoD level requirements, no changes are anticipated. The DLA J6 government team will remain abreast of all new DLA and DoD changes, and ensure this solution maintains compliance, and coordinates with the vendor as quickly as the information is vetted and provided as formal guidance.

12. STATEMENT OF DELIVERY REQUIREMENTS:

Award and execution of statement of work must align with current DLA Cybersecurity requirements and the requirements for the contract PoP extentsion that supports a

Failure to award and execute task NLT September 2025 puts the overall schedule at risk.