JA_Final_Redacted.pdf

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION

Department of Defense Insider Threat Management and Analysis Center

Multi Domain Database Platform Subject Matter Expert

HS0021-18-Q-DITMAC

Control Number: 18-033PR

FOR OFFICIAL USE ONLY

PROCUREMENT SENSITIVE

SOURCE SELECTION SENSITIVE

REFERENCES:

• In accordance with Federal Acquisition Regulation (FAR) subpart 6.303, for acquisitions of commercial items exceeding simplified acquisition threshold the contracting agency is required to prepare a sole source justification using the format at FAR 6.303-2, as provided below.

DOCUMENTATION:

(1) Identification of the agency and the contracting activity.

Requiring Activity:

Defense Security Service (DSS) Defense Insider Threat Management and Analysis Center (DITMAC) 1550 Crystal Drive, Suite 201 Arlington, VA 22202

Contracting Activity:

DSS Office of Acquisitions (AQ) 27130 Telegraph Road Quantico, VA 22134

(2) Nature and/or description of the action being approved.

The purpose of this document is to obtain necessary approvals for a sole source acquisition in accordance with FAR 6.302-1(a)(2)(iii).

Competition is limited to only one responsible source and no other supplies or services will satisfy agency requirements.

The procurement strategy is to issue an open market Request for Quote (RFQ) in accordance with FAR part 12 Acquisition of Commercial Items and FAR subpart 13.5 Simplified Procedures for Certain Commercial Items.

(3) A description of the supplies or services required to meet the agency’s needs (including the estimated value).

The objective of this effort is to acquire subject matter experts (SMEs) required to inform the development, operations and maintenance of the DITMAC Multi-Domain Database Platform (MDDP) to enable the DITMAC to achieve its vital mission as defined by Office of the Under Secretary of Defense for Intelligence (OUSD(I)). The DITMAC has been tasked to provide a unified security risk picture, leveraging sensitive data across multiple, or compartmented, security domains leveraging a single domain solution.

Maintaining data consistency and concurrency across the various domains continues to be a challenge that is further complicated by exponential growth trends in both volume and velocity of data. Most cross domain solutions (CDSs) on the market today are based on one-way replication through data transfer guards that copy data from one network to another. Accessing multiple domains has historically been impeded by both technical and cultural challenges. As a result, most highly secured systems have been designed to restrict access to entire user populations rather than implement data sharing on the basis of mandatory access controls and an individual’s need-to-know.

The DITMAC System of Systems (DSoS) currently provides an enterprise capability to centrally manage and analyze potential insider threat risk indicators submitted by non-Intelligence Community (IC) portions of 39 of the 43 DoD Component. The DoD IC Components will only connect to the insider threat technical architecture and share insider threat reporting via the Top Secret (TS) security domain.

The MDDP will provide a single contiguous repository for DoD Insider Threat related information.

In order to accomplish this task, in addition to the SME service to be provided, the two support elements critical to the acquisition of the MDDP, specific to Oracle NSG, need to be acquired in order for the successful iteration of the DoD MDDP: Oracle Client Assurance (CA) hardware and subscription service and Oracle Cross Domain Security Express (CDSE) hardware and subscription service.

CDSE enables the industry’s first and only certified and accredited multiple domain database. CDSE allows multiple security levels to write labeled data into a single database and provide access to that data based on multiple factor authentication and user attestation.

Multi Domain Database Platform Subject Matter Expert

SOURCE SELECTION SENSITIVE

CDSE eliminates the need for database replication across the networks and data stores on every security level, providing a single source of truth for mission data. CDSE reduces the need for guard technologies to move data between security domains. CDSE is listed on the Unified Cross Domain Services Management Office (UCDSMO) Baseline and is in operational use at multiple US Intelligence Community (IC) sites.

CA enhances and simplifies application security by moving identity management, system authentication and client endpoint assurance to the database, and removing that requirement to assert these factors from each independent application. CA enables the database to query for any number of configurable access requirements, such as user identity, machine identity, location, patch level and security label. CA integrates easily into any of Oracle’s applications as well as custom applications. CA is currently being used operationally within the IC.

This Firm-Fixed-Price (FFP) contract will include a seven month base period, three 12-month option periods, and a six month option to extend services via FAR 52.217-8. The estimated cost for the base period is $978,846.00 and the estimated cost for the total contract (seven month base plus, three 12-month option periods and the six-month option to extend services) is $5,506,725.96.

(4) An identification of the statutory authority permitting other than full and open competition.

Title 10 U.S.C. 2304(c) authorizes the DoD to contract without full and open competition under certain circumstances. For this acquisition, other than full and open competition is permitted per FAR 6.302-1(a)(2)(iii)(A) and (B). FAR 6.302-1(a)(2)(iii) states that “For DoD…services may be deemed to be available only from the original source in the case of a follow-on contracts for the continued provision of highly specialized services when it is likely that award to any other source would result in –

(A) Substantial duplication of cost to the Government that is not expected to be recovered through competition, or

(B) Unacceptable delays in fulfilling the agency’s requirements. (See 10 U.S.C. 2304(d)(1)(B))

Title 10 U.S.C. 2304(d)(1)(B) states “in the case of a follow-on contract for the continued development or production of a major system or highly specialized equipment, or the continued provision of highly specialized services, such property or services may be deemed to be available only from the original source and may be procured through procedures other than competitive procedures when it is likely that award to a source other than the original source would result in—

(i) substantial duplication of cost to the United States which is not expected to be recovered through competition; or

(ii) unacceptable delays in fulfilling the agency’s needs.

With regard to the substantial duplication of cost, the FAR does not define ‘substantial.’ However the widely accepted definition in Webster’s dictionary is ‘of considerable importance, size, or worth.’ Thus far, the DITMAC has invested over $900,000 in Operations and Maintenance and Research, Development, Testing, and Evaluation funding in order to bring this single stream DoD-wide MDDP to fruition. This is 24% of the total value of this follow-on effort. The Contracting Officer (CO) has determined that a quarter of the value of the contract is deemed of considerable size to warrant an original-source follow-on, as that amount of funding would be duplicative in nature and not in the best interest of the Government.

In order to strengthen the data presented above, in conjunction with the Government SME, the CO developed a cost estimate comparison of how much it would cost the Government to redevelop the already developed system in terms of man hours. This estimate is solely developed to establish a baseline for comparison; any other vendor would require the same minimum number of hours to redevelop the MDDP on their individual platforms, as Oracle NSG is the only developer of the MDDP platform in its current state. If another vendor wanted to utilize the current MDDP platform, they would be required to subcontract to Oracle NSG in order to capitalize on the work completed thus far without re-work. The original development cost over $900,000 at an average rate of $334 per hour for approximately 2,694 hours. The market research in paragraph 8 demonstrates that the average hourly rate of the three researched contractors utilizing GSA, is approximately $266.26 1per hour. When you multiply the per hour rate obtain through market research by the amount of man hours required for development, at a minimum the Government is projected to have redevelopment costs in the amount of $717,570.70.

1 The difference in the hourly rates presented of $334 and $266.26 per hour can be attributed to the pass through contract fees associated with previous utilization of the United States Air Force (USAF) under contract with the Georgia Institute of Technology (GIT), task order FA8075-14-D-0018 and the subcontractor pass through fees for GIT subcontracting with Oracle NSG. By procuring the SME services provided by Oracle NSG directly, the Government will be saving a minimum of 25% by removing these fees over the life of this new contract.

Multi Domain Database Platform Subject Matter Expert

SOURCE SELECTION SENSITIVE

This amount of savings is not miniscule and not likely to be overcome by the competition as the rates utilized were competed first on GSA and determined fair and reasonable at that time. While the CO would most certainly request further discounts, it is unlikely that the CO will be able to recover $717,570.70 in discounts through competition. Subsequently, the CO also looked at the cleared labor rates provided by Oracle National Security Group (NSG) whose rates averaged to $192.50 per hour. By moving forward with Oracle NSG, the Government is not only saving the redevelopment costs, they are saving an average of 38.15% over the competitive rates found through market research.

In addition, the FAR does not define ‘delay’ or ‘unacceptable.’ However, the widely accepted definition of ‘unacceptable’ is not acceptable, not pleasing, or welcome and the definition of ‘delay’ is: a period of time by which something is late or postponed. If this requirement was to be fulfilled via competition, the DSS will have to stop work on version 3.x of the system that the entire DoD is anticipating being in place and functional no later than Quarter II of Fiscal Year (FY) 2019. This means that the developmental work will need to be completed no later than November of 2018 in order to give the DSS Office of the Chief Information Officer (OCIO) adequate time to accredit the system. The user interface and business rules of the system in v3.x is what we now know as the DsoS. It becomes an element of the platform as we implement the MDDP of which, the MDDS (Multi-Domain Database System) is a sub-component. The Government’s technical experts estimate that each month of stoppage will result in a minimum of 1.5 months of delay in getting the system fielded (loss of expertise, forcing a ramp-down of development and a subsequent ramp-up). The Government technical SME has estimated that as a competitive requirement of this magnitude, the resultant delay would be equal to one year, one month, and two weeks in production and deployment alone, on top of the nine months it would take to compete this requirement.

Resulting in an overall one year, 10 months, and two week delay potentially, disrupting the entire effort due to the loss of technological expertise in the interim and resulting in a disruption of critical technology that the DoD requires to mitigate the internal and external threats to the United States by not having the MDDP in place. While the Office of Acquisitions would take the appropriate steps to expedite the requirement through the contractual phase, it would not overcome the barrier of the loss of time waiting for the new requirement to be put in place, nor would it recover the loss in intellectual stability required to keep this project moving forward at the rate necessitated by the DoD requiring full functionality by the second quarter of FY 2019.

This requirement meets the stipulations in 6.302-1(a)(2)(iii)(A) and (B) set forth above.

(5) A demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the authority cited.

The Oracle America, Incorporated developed the unique technology including the software and hardware required to enable direct access to the same data from multiple security domains for the IC and only makes this technology available to IC members. In January 2017, the Under Secretary of Defense for Intelligence named the Director of the DSS as the head of a Defense Intelligence Component, specifically the counterintelligence element of DSS. Organizationally, the DITMAC falls under the intelligence component and as such, now qualifies for access to MDDP capabilities.

Oracle America, Inc.’s MDDP solution enhances the DITMAC’s analytic and operational activities by allowing data to be accessed seamlessly across multiple security domains which are transparent to the front-end applications and the users from the 43 Department of Defense (DoD) Components. The expertise of the Oracle SMEs will position the DITMAC to establish a single source of truth related to insider threats across the entirety of the DoD which operates on multiple security domains. The ability to establish seamless connectivity between the DoD IC and non-IC DoD Components is a key element in DITMAC’s ability to achieve full operating capability (FOC).

Accessing the MDDP capabilities via an integration partner would cost the government more time and money:

1. Any Oracle integration partner will mark-up the software and hardware required to develop, operate and maintain the

MDDP capability. Oracle America, Inc. offers the required and supporting software and hardware at a deep discount to the IC members.

2. No Oracle integration partner has the subject matter expertise in house required to architect, design, develop, implement, and accredit the MDDP capabilities. Oracle has been brought in to other efforts across the IC as a sub under the prime developer with an additional mark-up over the direct rates available to the government.

3. Not leveraging direct SME support to MDDP development from the beginning would cause delays as any prime developer without Oracle SME support, experiments with ways to leverage the MDDP capabilities, instead of developing to meet the

Multi Domain Database Platform Subject Matter Expert

SOURCE SELECTION SENSITIVE

Government’s requirement. Oracle experts were the ones who originally developed and continue to improve the MDDP capabilities, and have directly or via sub-contract relationship supported every implementation.

The direct Oracle America, Inc. support would be tailored to maximize the benefit to the government through each phase of architecting, designing, developing, implementing, and accrediting the DITMAC’s MDDP capabilities. This SME support would complement existing platform development efforts as one of seven separate companies cooperating on the platform development, including:

1. Novetta

2. TDKC (via AFRL)

3. Northrop Grumman (via AAG)

4. Mehra (via GTRI funded by DNI/PM-ISE)

5. Deloitte (funded by DNI/NITTF)

6. Filius (Funded by DNI/NITTF)

7. Oracle

One of the greatest benefits to the government to working directly with Oracle America, Inc. is their expertise with making this highly specific technology stack work in an open architecture and modular design. The open architecture and modular design features will enable the government to open future development above and interacting with the platform to full and open competition. To get the platform to that point, we have to spend more time and highly specialized effort to ensure it minimally has the following features:

1. Network and Data Level Access Controls

2. Separation of Duties

3. Single Source of Truth

4. Scalable Network/Security Domain Support

5. UCDSMO Active Baseline

6. Identity Management Integration

7. Reduced Long Term Operations and Maintenance Complexity

8. Rapid Deployment

9. Security Accreditations

10. Auditing

11. System Security Plan

12. Disaster Recovery and Continuity of Operations (COOP)

13. Dev system on Virtual Machines (VM)

It is imperative that the DITMAC’s MDDP system operation is a stable and flexible platform, designed on an open architecture, hosting a single set of information, and with access from multiple security domains. This is paramount to the adoption and long term acceptance across the DoD. The adoption and long term acceptance of the new platform with Oracle America, Inc.’s help, will save the government tens of millions of dollars by the Components not seeking alternate solutions. If done correctly, there is also an explicitly expressed interest by the NITTF on behalf of the Executive Branch Departments and Agencies they represent, to adopt this new platform for use government-wide.

The Government has a responsibility to preserve the data integrity of the platform, via the original vendor, in order to prevent the loss of personnel data through multiple replications, in which any other contractor than the original source for development would have to perform to make the system compatible with their individual, proprietary platforms. When a multi-domain data system is put into place, tens of thousands, if not millions of code, are written. When the Government decides to compete highly specialized, technical items of this nature, the preponderance of evidence suggests that systems with contractor turn over fail within the first year and the Government ends up losing the funding invested. This can be attributed to the primary fact that contractors do not leave themselves enough time to sift through the lines of code to determine what could be changed and what should not be changed, losing precious time in the ever changing landscape of information technology. By pursuing the customized code in development of the MDDP via Oracle NSG to be built on an open architecture, the Government is ensured of full and open capabilities in the future. (See paragraph 11 below)

Multi Domain Database Platform Subject Matter Expert

SOURCE SELECTION SENSITIVE

(6) A description of efforts made to ensure that offers are solicited from as many potential sources as is practicable, including whether a notice was or will be publicized as required by Subpart 5.2 and, if not, which exception under 5.202 applies.

The Contracting Officer will follow the procedures in FAR 5.201 and FAR 6.305 in ensuring a Synopsis and the Justification required by 6.303-1 are properly completed. An open market (RFQ will be issued to Oracle America, Inc. in accordance with FAR part 12 Acquisition of Commercial Items and FAR subpart 13.5 Simplified Procedures for Certain Commercial Items.

(7) A determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

In determining a fair and reasonable price, the Contracting Officer will evaluate a more detailed breakdown from the formal Independent Government Cost Estimate (IGCE). The detailed estimate provides a breakdown of what the Government believes is the potential labor categories, estimated labor rates and the estimated fixed yearly price for providing the required services. The estimated labor will be compared to established pricing on other Government contracts, such as the General Services Administration’s (GSA) Federal Supply Schedule (FSS) for the same labor categories and/or similar labor categories.

FAR 8.404(d) states that “… Services offered on the schedule are priced either at hourly rates, or at a fixed price for performance of a specific task (e.g., installation, maintenance, and repair). GSA has determined the prices of supplies and fixed-price services, and rates for services offered at hourly rates, to be fair and reasonable for the purpose of establishing the schedule contract. GSA's determination does not relieve the ordering activity contracting officer from the responsibility of making a determination of fair and reasonable pricing for individual orders, BPAs, and orders under BPAs, using the proposal analysis techniques at 15.404-1. The complexity and circumstances of each acquisition should determine the level of detail of the analysis required.”

Leveraging DSS’ current use of the vendor services, along with open market price comparison, the contracting officer is confident in obtaining the best value for DSS.

(8) A description of the market research conducted (see Part 10) and the results or a statement of the reason market research was not conducted.

Oracle NSG is the only vendor capable of providing the expertise required for this effort described herein. The requiring activity reached out to Oracle NSG’s parent company to see if the same expertise could be obtained through another avenue such as Oracle Federal, another subsidy of Oracle, or any other potential contractors. Due to the highly specialized nature of the requirement, the only avenues of obtaining the MDDP SMEs for this project is through contracting directly with Oracle NSG or contracting with another company that will subcontract to Oracle NSG.

Limited market research was then conducted solely to determine the competitive nature of the labor category pricing as the procurement method was determined early in this acquisition. In order for this acquisition to be competed (as stated in paragraph 4 above), the Government would assume the unacceptable risk of delay in deployment by 1.5x for every month of delay. At a minimum, this would result in one year, 10 months, and two weeks delay in the deployment of the MDDP. (See paragraph 4)

The Government utilized a cross reference of similar labor rates for Cross Domain Database (CDD) Senior Configuration SMEs from the General Services Administration (GSA) Scheduled 70 General Purpose Commercial Information Technology Equipment, Software, and Service contract vehicle, under Special Item Number 132 51 Information Technology Professional Services. The vendors researched included Booz Allen Hamilton (Contract Number: GS-35F-386DA), Northrop Grumman Technology Services (Contract Number: GS- 35F-0165Y) and Raytheon Company (Contract Number: GS-35F-204GA). Below is a chart of the cross comparison of labor categories and the visual representation that going directly to Oracle NSG is in the best interest of the Government from a fiscal responsibility perspective as the rate provided by Oracle NSG are, on average, 38.15% lower than the competitive rates obtained from GSA.

(9) Any other facts supporting the use of other than full and open competition, such as:

The MDDP is the DoD’s response to inside and outside threats against those that wish to harm the United States. If we were to compete this, any potential vendor would have to be cleared prior to accessing the critical code. As this new MDDP system is a high value target for foreign adversaries, the procurement action lead time would exponentially increase as each vendor would have to be individually vetted before allowing access to the code. Then each vendor would have to arrange for travel to Quantico, VA to a controlled access http://www.arnet.gov/far/current/html/Subpart%205_2.html#wp1107980 http://www.arnet.gov/far/current/html/Subpart%205_2.html#wp1107990 http://www.arnet.gov/far/current/html/FARTOCP10.html#wp266706

Multi Domain Database Platform Subject Matter Expert

SOURCE SELECTION SENSITIVE

suite in order to read through the millions of lines of code in order to adequately and accurately quote for this effort. Alternatively, the current Oracle NSG SMEs do not have to sift through the coding because Oracle NSG is the one that developed the coding. There is no 'discovery' to estimate a timeline or ramp up to learn the system they are going to be SMEs on.

Finally, as this project is not finalized, the code for the MDDP is proprietary to Oracle NSG until such time it is complete when it will become the property of the United States Government. As such, only Oracle NSG SMEs are able to actually advise on this effort.

Therefore, either the DITMAC can contract directly with Oracle NSG or let a contract of which is subcontracted to Oracle NSG.

(10) A listing of the sources, if any, that expressed, in writing, an interest in the acquisition.

Nothing to add to this section that has not already been articulated within this justification document.

(11) A statement of the actions, if any, the agency may take to remove or overcome any barriers to competition before any subsequent acquisition for the supplies or services required.

This requirement is for the technical publication(s) and technical expertise to develop a platform that will be utilized across the entire DoD and potentially, the Federal Government. This newly designed platform will connect SIPR, NIPR, JWICS, and commercial data streams into a multi-domain database to advance the analytics and inject direct data feeds. Once the platform has been derived and stabilized across the Federal Government by a single vendor, competition will be open to customize the system per the needs/requirements of other Federal agencies.

The platform itself will continue to require advice from Oracle NSG, at a far reduced level to maintain adequate levels of operation and maintenance. The capabilities that interact with the platform will be available for full and open competition. The new open architecture that Oracle NSG is helping construct, will allow the Government to go to the market for analytic capabilities, updates to the user interface, or complete replacement of the user interface and business rules. The new architecture changes those elements from being hard coded in Oracle, to being a plug-in into a stable database schema utilizing full and open competition to remove, or overcome, barriers to competition for the “add-ons.”

Multi Domain Database Platform Subject Matter Expert

SOURCE SELECTION SENSITIVE

CERTIFICATION

I certify that the facts and representations under my cognizance which are included in this justification and which form a basis for this justification are complete and accurate.

Requiring Activity/Program Management Office Certification

Printed Name: Mark A. Nehmer

Title Assistant Director, Enterprise Tools and Architecture Org. Code: DSS-DITMAC

Signature: ________________________

Contracting Officer Certification

I hereby determine that the anticipated cost for this contract action will be fair and reasonable. I certify that this J&A is accurate and complete to the best of my knowledge and belief.

Printed Name: Renée S. Stahl

Title Contracting Officer Organization Code DSS-AQ

Signature_________________________

Activity Competition Advocate ($700,000 - $13,500,000)

Printed Name Tara L. Petersen

Title Chief, Office of Acquisitions Organization Code DSS-AQ

Signature_______________________