J and A Redacted.pdf

JUSTIFICATION & APPROVAL (J&A) FOR OTHER THAN FULL AND

OPEN COMPETITION (OTFAOC)

Contract Number: HHSN316201200092W Task/Delivery Order Number: HC1047-22-F-0206 Modification No. 3 Procurement Title: Defense Contract Management Agency (DCMA) Cybersecurity Services Support Bridge Modification Estimated Value:

Statutory Authority: 10 U.S.C. 3204(a)(1) and FAR 6.302-1

Justification for OTFAOC Number: JA23-095

Upon the basis of the following justification, I, as Procuring Activity Competition Advocate, hereby approve the use of other than full and open competition of the proposed contractual action pursuant to the authority of FAR 6.302-1, Only One Responsible Source and No other Supplies Will Satisfy Agency Requirements.

1. REQUIRING AGENCY AND CONTRACTING ACTIVITY:

Requiring Agency:

DCMA

Information Technology (IT) 3901 A Avenue, Building 10500 Fort Lee, VA 23801-1809

Contracting Activity:

Defense Information Systems Agency (DISA)/Defense Information Technology Contracting Organization (DITCO), PL64 P.O. Box 549 Fort George Meade, MD 20755

2. NATURE/DESCRIPTION OF ACTION(S): This J&A supports the action to issue a bridge modification to extend the current period of performance (PoP) by six (6) months to prevent an unacceptable break in service. The required services are to provide continued labor support to achieve the tactical and strategic cybersecurity goals of the Department of Defense (DoD) and DCMA. Fiscal Year (FY) 2023 Operations and Maintenance (O&M) appropriated funds are available for this effort. This extension will ensure continued support during the protest period of the follow-on task order.

3. DESCRIPTION OF SUPPLIES/SERVICES: Continuity of services is required for labor support to the DoD and DCMA. The task order provides services, that include Cybersecurity Management, Compliance, and Engineering support including services and support related to cybersecurity, including Program Management, Enterprise Risk Management, Compliance Auditing, Plan of Action and Milestone (POA&M) Management, Privacy, Cyberspace Operations Management, Systems Access Controls and Management, Training, Policy, Cyber incident analysis & investigations, forensic analysis & investigations, Engineering, Vulnerability Assessment Management, and Insider Threat Support.

JA23-095 DCMA Cybersecurity Services Support Bridge Modification

Page 2 of 5 Pages

This task order currently has an expiration date of 08 September 2023. This effort was re-competed as a small business set-aside acquisition on National Institutes of Health Acquisition and Assessment Center (NITAAC) Chief Information Officer–Solutions and Partners 3 (CIO- SP3). On 22 August 2023, the follow-on contract 47QTCA18D002A task order HC1047-23-F- 4060, was awarded; however, a Government Accountability Office (GAO) bid protest was submitted on 28 August 2023. The bid protest was submitted in a timely manner and triggered an automatic suspension of performance of the follow-on task order pending resolution of the protest in accordance with FAR 33.103(f)(3). The six-month extension of the current task order will allow for continued support of this vital program during the protest period, while retaining the ability to provide a consistent level of effort for the DCMA and its stakeholders without a break in service.

The estimated cost of support for this extension is which includes all labor categories for the FAR 52.217-8 PoP of the existing task order HC1047-22-F-0206.

4. IDENTIFICATION OF STATUTORY AUTHORITY: Only one responsible source and no other supplies or services will satisfy agency requirements, 10 U.S.C. 2304(c)(1), FAR 6.302-1, and Defense Federal Acquisition Regulation Supplement 206.302-1.

5. DEMONSTRATION OF CONTRACTOR’S UNIQUE QUALIFICATIONS:

(a) Description of events. The current task order, NITAAC contract HHSN316201200092W, task order HC1047-22-F-0206, was awarded on 18 September 2018 and is due to expire on 8 September 2023. The follow-on task order was re-competed on NITAAC under solicitation number 1562894. Award of contract 47QTCA18D002A task order HC1047- 23-F-4060 was made on 22 August 2023. A GAO level award protest was received on 28 August 2023. Thereafter, a stop-work order was issued by the Contracting Officer (KO), Won Chung, on 29 August 2023.

(b) Justification.

(1) Minimum Government Requirements. DCMA and its stakeholders all depend on daily services currently rendered by incumbent contractor Ryan Consulting Group.

Inc., such as vulnerability assessment and analysis; vulnerability management;

malware protection; continuous monitoring; cyber incident handling, DoD Information Network / DCMA User Activity Monitoring (UAM) for the DoD/DCMS Inside Threat Program; Cyber Threat Intelligence (CTI), Attack Sensing and Warning (AS&W); Software Assurance; Penetration Testing; Risk Management Framework (RMF) activities; and ensuring compliance with Federal, DoD and DCMA policies. Failure to support mission partner and other stakeholders will negatively impact the DoD and DISA Cybersecurity program.

Without the continuation of the current cybersecurity services support from Ryan Consulting Group, Inc., the following DCMA cybersecurity functions will be negatively impacted and will result in unacceptable delays and cybersecurity breaches:

Page 3 of 5 Pages

(2) Proposed sole source contractor. Ryan Consulting Group, Inc. is the current task order holder providing DCMA the necessary cybersecurity enterprise information and cyber infrastructure and maintaining DCMA’s cyber network. Ryan Consulting Group, Inc. currently has personnel with the necessary qualifications to continue to meet the DCMA’s needs for cybersecurity services support. Ryan Consulting Group, Inc. is currently providing the technical expertise and support in sustaining DCMA’s online business tools ensuring availability, reliability, integrity, and security of DCMA IT systems hosted in DCMA and DISA data centers. "Due to bid protest, Ryan Consulting Group, Inc, is the only source that can fulfill this requirement without risk of a substantial break inn service/support to (insert mission partner names as applicable). GAO's stay of award for new requirement makes this necessary for DCMA’s work. Ryan Consulting Group, Inc. is providing technical support of enterprise cybersecurity level components of DCMA’s Cybersecurity Service Operations (CSO) and DISA hosted systems, to include DCMA’s identity protection, access and authorization, security compliance risk management framework support, and security architecture program & projects support. These services provide mission essential support for our DCMA Business Applications including migration cyber support to DISA services. These mission critical services ensure that DCMA to provide Department of Defense (DOD) and its acquisition partners uninterrupted access to acquisition data for 225,000 contracts, valued at more than $3.5 trillion, in 15,000 contractor locations worldwide. Again, due to the bid protest filed by Delviom, LLC., Ryan Consulting Group. Inc. is the only source that can supply the needed services during this period without a break in service.

Page 4 of 5 Pages

(3) This extension is necessary due to a protest filed in response to the award of the follow-on contract 47QTCA18D002A task order HC1047-23-F-4060. If a bid protest had not been received, this extension would not be necessary.

6. CONTRACT OPPORTUNITIES ANNOUNCEMENT/POTENTIAL SOURCES: This modification is a bridge extension of the existing task order until the protest of the follow-on task order can be resolved. Solicitation number 642268309 for the follow-on task order was posted on General Services Administration (GSA) Multiple Award Schedule (MAS) on 4 August 2023 as a small business set-aside. Twenty-one proposals were received, and award was made on 22 August 2023.

7. DETERMINATION OF FAIR AND REASONABLE COST: During source selection of solicitation number 642268309, a cost/price evaluation was conducted in accordance with FAR

15.404. The task order prices were determined to be complete, fair, and reasonable. The proposed cost/prices for the extension will be compared to the current task order prices as well as the Independent Government Cost Estimate and the proposed prices for the follow-on effort in order to determine fair and reasonableness. For this extension, Ryan Consulting has agreed to use the same pricing as the as the last six months of the period of performance, which were already deemed fair and reasonable.

8. MARKET RESEARCH: This is an extension to the existing task order to ensure continued support until the protest and transition period of the follow-on task order, HC1047-23-F-4060, are complete. Market research was conducted for the follow-on task order which was conducted within the last 12 months. The market research identified potential sources which enabled the follow-on task order to be conducted as an open market small business set-aside.

9. ANY OTHER SUPPORTING FACTS: None

10. LISTING OF INTERESTED SOURCES: Not applicable

11. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FULL AND OPEN COMPETITION.

(a) Current Task Order: HC1047-22-F-0206.

(b) Status: Expires 08 September 2023. Competitive Small Business Set-Aside Source

Selection completed for follow-on. Award announced 22 August 2023. Stop-work order was issued on 29 August 2023 due to a bid protest.

Page 5 of 5 Pages

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE: See separate signature page

TITLE/ORGANIZATION:

PHONE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE: See separate signature page

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE: See separate signature page

PROCURING ACTIVITY COMPETITION ADVOCATE APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief.

Since this justification does not exceed $15M, this review serves as approval.

NAME: SIGNATURE: See separate signature page

TITLE/ORGANIZATION:

PHONE:

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

Michael E. Pirone, Contract Specialist, 301-225-3918, michael.e.pirone.civ@mail.mil, or Won Chung, 301-225-4053, won.s.chung2.civ@mail.mil.

mailto:michael.e.pirone.civ@mail.mil mailto:won.s.chung2.civ@mail.mil