JA_HC1028-08-D-2015-0025.pdf

eMass J&A, HC1208-08-D-2015-0025-JA15-057

JUSTIFICATION & APPROVALS FOR FEDERAL ACQUISITION

REGULATION (FAR) SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Schedule/Multiple Award Contract (MAC) Orders under MAC/Fair Opportunity – FAR 16.505, Department of Defense FAR Supplement

216.505-70, Procedures, Guidance, and Information 216.505-70

Purchase Request Number: To be determined Contract Number: HC1028-08-D-2015 Task Order (TO) Number: 0025 Procurement Title: Enterprise Mission Assurance Support Service (eMASS) Contracting Office: Defense Information Systems Agency (DISA)/Defense Information Technology Contracting Organization (DITCO)/Information Technology (IT) Contracting

(PL83)

Estimated Value: $878,754 Statutory Authority: FAR 16.505(b)(2)(i)(B)

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

Number: JA15-057

Upon the basis of the following justification, I, as the Procurement Activity Competition Advocate, hereby approve this exception to fair opportunity pursuant to the authority of FAR 16.505(b)(2)(i)(B).

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

Requiring Agency:

DISA, Infrastructure Development (ID) Office – Cyber Security Branch (ID5) 6914 Cooper Avenue Fort Meade, MD 20755

Contracting Office:

DISA/DITCO/PL83

2300 East Drive, Building 3600 Scott Air Force Base, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION: The purpose of this action is to issue a modification to Booz Allen Hamilton, Incorporated (BAH) on the ENCORE II contract HC1028- 08-D-2015 TO 0025 to increase the level of effort for the implementation of risk management framework (RMF), continuous monitoring, and subsequent migration off of the Vulnerable Management System (VMS). The modification will be issued on a firm fixed price (FFP) basis for the period of March 31, 2015 through December 29, 2015. The effort will be funded with fiscal year 2015 operation and maintenance funds.

3. DESCRIPTION OF SERVICES: The eMASS program requires a modification to implement recent RMF and continuous monitoring guidance to ensure continued compliance with the Federal Information Security Management Act (FISMA).

Historically, the Department of Defense (DoD) Information Assurance Certification and Accreditation Process (DIACAP), signed on November 28, 2007 as DoD Instruction (DoDI) 8510.01, has been the DoD process to ensure information systems apply risk management and meet a minimum set of cybersecurity requirements. On March 12, 2014, the DoD Chief Information Officer (CIO) reissued DoDI 8510.01 as a replacement instruction to supersede DIACAP entitled “Risk Management Framework (RMF) for DoD Information Technology (IT)”. The replacement RMF policy instructs DoD to implement a new organizational and Federal Enterprise risk-based process for Certification and Accreditation (C&A), now referred to as Assessment and Authorization (A&A), and implement continuous monitoring, the assessment of security controls in information systems on an ongoing basis, to the greatest extent possible.

As outlined in the DoD Information Paper issued September 19, 2014, it is DoD’s goal to transition all systems from DIACAP to RMF in the most expeditious time frame possible.

eMASS is the DoD’s recommended tool for information system C&A (now A&A) supporting DoDI 8510.01, and as a result must be modified to implement the newest policy. The RMF transition increases the number of security controls (minimum system security requirements tracked in eMASS) by up to 400% and assessment procedures (procedures for assessing security controls) by up to 1000%. Almost 400 new software requirements related to RMF were captured in the past 12 months.

The DISA ID division is taking the “DISA First” initiative as directed by senior leadership by serving as the proof of concept for all DoD organizations in adopting the RMF. Part of DISA’s roadmap to support continuous monitoring for the DoD is the VMS transition effort, which sunsets the VMS manual vulnerability tracking tool for information systems and implements business processes in DISA’s next-generation RMF/continuous monitoring tools including eMASS. The current eMASS TO for sustainment and enhancement only includes limited support for the RMF and VMS transitions.

In order to support RMF/continuous monitoring, the VMS transition, and the “DISA First” objectives, the contractor shall be responsible for developing eMASS enhancements, which will improve user experience, add automation, support new business processes, and sustain a RMF-capable eMASS identified by the DISA Cyber Defense division. Additional resources are also required to handle operational and deployment inquiries, installation support, proactive security engineering, acceptance testing, and operations and maintenance directly related to the RMF/continuous monitoring transition. The additional tasks requested to be performed in the final option year are within the technical scope of the current TO and the technical requirements remain consistent with the current requirements.

The estimated life cycle cost for this effort is $878,754.

The period of performance: March 31, 2015 - December 29, 2015

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to fair opportunity: Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies ordered are unique or highly specialized.

(b) Description of the Justification: The current eMASS TO was awarded to BAH on

December 30, 2010, following a fair opportunity competition using the ENCORE II suite of contracts. All 26 ENCORE II contractors were given an opportunity to submit a proposal for the original award. Three proposals were received in response to the request for proposals. The proposed modification request is an enhancement for the automation capability of the ongoing work to comply with DoD Information Assurance (IA) directives. The eMASS program was developed to provide an automated C&A service using shared information to deliver improved functionalities over all core IA processes, beginning with the core service of C&A, by interconnecting multiple IA-related data transactions via a common data service using a Service Oriented Architecture. The system draws in summary data about security postures of systems and organizations and aggregates it at the enterprise level. The system uses web services to access and represent data from all instances to provide an overall DoD IA posture. The proposed modification serves to ensure compliance with the recently replaced RMF policy issued by DoD

CIO.

(c) Justification:

(1) Minimum Government requirements.

The minimum requirement is to enhance the automation capability of the eMASS tool as required by the RMF DoDI 8510.01 dated March 12, 2014. Enhanced automation will allow eMASS users to save time in the A&A process. This includes enhancements that will allow enclaves (networks, hosting facilities, etc.) and information systems within those boundaries to establish hierarchical relationships (multiple parent systems) to automate security control compliance reducing duplication of effort and resulting in efficiencies that will save DISA and other DoD organizations time in preparing and assessing security authorization packages.

(2) Proposed sole source contractor.

The proposed contractor is BAH, 8283 Greensboro Drive, McLean, Virginia 22102-3830. BAH received the award of the existing task order HC1028-08-D-2015/0025 through fair opportunity under the ENCORE II suite of contracts. BAH is providing the expertise DISA needs to complete the current set of DoDI 8510.01 specific requirements. DISA ID5 has made a significant investment to date in the eMASS program with the current contractor, and the proposed requirement follows the progression of the program. If award for this effort is made to a new contractor, estimated transition costs would equate to approximately $3.2M as well as time lost in the estimated 5,000 labor hours required to bring the new contractor up to speed with the program to where it is performing to date. Award of the RMF/continuous monitoring requirement to a different contractor would also cause unacceptable delays in fulfilling the Government’s requirements. Any delay or interruption in services will impact usability of the tool by both DISA and DoD counterparts.

(3) Discussion regarding cause of the sole source situation.

BAH has accumulated significant technical expertise and unique knowledge of the eMASS program and its requirements during the performance of this initial effort. The proposed requirements are enhancements integrally related to the existing eMASS sustainment and enhancement software development lifecycle. The proposed requirement for enhancement is not severable from the eMASS program. If the enhancement were to be satisfied via competition, the result would be multiple contractors performing heavily related and interdependent software development activities on the same portions of the code base; and would subsequently introduce the need for increased program oversight, configuration management, and software quality/testing. These integration risks and accountability challenges would introduce risk of failure to meet delivery milestones to the DoD for eMASS support of the RMF transition, as major version releases are currently slated in June 2015 and December 2015. Given the critical nature of delivering these capabilities, it is in the best interest for the current contractor to begin working these tasks immediately.

(4) Demonstration of unique source.

BAH possesses the intimate knowledge and experience with the eMASS environment to begin implementation of the RMF/continuous monitory requirement immediately upon award of the modification. The nature of eMASS requires a contractor with the working knowledge the current DISA ID5, business processes, and service organizations to effectively design, develop, and deploy capabilities rapidly across DoD. Though there are other contractors familiar with the DISA ID5, business processes, and service organizations, the proposed requirement is not severable from the existing tasks being performed by BAH thus another contractor could not effectively perform without losing accountability for the program and incurring significant transition periods and costs.

(5) Procurement discussion.

Deciding to award to another contractor, compete this sole enhancement function, or recompete the entire eMASS requirement at this time would undoubtedly prevent scheduled users from receiving mission critical support. Awarding to any other source at this time would prove to duplicate costs for the government and prohibit the mission from being fulfilled. The DoD transition timeline requires immediate implementation of RMF automation and software support in order to provide C&A coverage for the shortened DIACAP accreditations to be initiated in September 2015. Increased software support allows DoD to transition to meet critical DoD CIO cyber objectives. Additionally, the VMS transition scheduled for September 2015 is a high priority DISA objective to stop VMS hosting and software maintenance on a legacy program to align with DISA Secure Configuration Management (SCM) continuous monitoring support objectives. Subsequently, RMF enhancements and VMS transition capabilities in eMASS are needed as quickly as possible.

The current contractor already has an existing lab infrastructure for software development, testing, and integration including eMASS and SCM programs. Competing the proposed eMASS enhancements would require another contractor to onboard and integrate with existing software development lifecycles resulting in increased risk, cost, and time to completion which are unacceptable to DoD CIO’s transition timeline for RMF. Sole sourcing these enhancements allows the ability to leverage existing infrastructure and software development lifecycles to save money for the eMASS program as well as meet timeline objectives for RMF and the VMS transition. The estimated cost of $878k compares favorably to the estimated $3.2M cost to onboarding and transition to a new contractor, complete integration testing, and perform configuration management necessary for introducing a subset of eMASS enhancements from a new contractor within the same code base.

(6) Impact.

Without additional support to implement the RMF, continuous monitoring, and VMS transition in eMASS, DISA and the 30+ DoD organizations using eMASS will realize cost impacts in the form of time. DoD CIO has released a transition timeline with milestones from September 19, 2014, into 2018 for the DoD. Delays and ramp up caused by competitive award to a new contractor would likely result in an inability to completely support the eMASS user base in the transition from DIACAP to RMF and subject DoD organizations to delays in performing A&A using RMF.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION: The contracting officer will determine whether the cost is fair and reasonable using historical data, cost/price analysis, and comparison to the Independent Government Cost Estimate and basic contract rates. The contractor will be required to provide a certificate of current cost and pricing data upon completion of negotiations.

6. MARKET RESEARCH: Market research was conducted on December 1, 2014, by searching the U.S. General Services Administration web portal for all businesses (as classified under the North American Industry Classification System code 541511). The keyword search included support for RMF, continuous monitoring, and VMS requirements. Searches of all businesses providing custom development, web services development, and IA web services were performed.

The searches returned zero businesses that specialized in these particular services in order to support the eMASS custom web services development. The results of these searches verified that there are currently no business contractors that can adequately support these very precise requirements.

Market research also included gathering data from previous acquisitions, gathering data from the internet, reviewing existing DISA-wide contract vehicles, and determining potential sources.

Market research determined that to sustain the current operational code baseline, only the identified government off the shelf development strategy will satisfy the requirement. Without this development, DISA and other DoD agencies will fail to meet critical DIACAP to RMF transition deadlines established by DoD CIO.

7. ANY OTHER SUPPORTING FACTS: DISA is responsible for the primary support of eMASS enterprise service. Over the lifecycle of this TO, the eMASS capability has gained significant interest across the entire DoD. This enterprise solution to automate A&A through RMF has become the choice of many combatant commands, services and agencies. This service proves to be valued not only within DISA but also for the wider DoD community.

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement history: The current TO (HC1028-08-D-2015-0025) was competed as a fair opportunity requirement among all 26 ENCORE II contract holders and awarded to BAH on December 20, 2010, with a life cycle value of $13,556,789. The period of performance was December 30, 2010 – December 29, 2011, with four one-year options. The fourth and final option period was exercised for the period December 30, 2014 through December 29, 2015.

(b) Actions proposed to remove barriers fair opportunity competition. Two J&As have been approved to date, as a result of growth in the user community and expanding requirements for support. During the acquisition planning phase for the recompete, market research will be conducted to determine the appropriate acquisition strategy for performance beyond the final expiration of eMASS. If the Government should determine that other contractors can support these requirements at that time, the Government will seek competition for the required functionality. The recompete action will account for surge of additional tasks over the life cycle in order to account for changes to the eMASS capability that may occur in the future.

9. REFERENCE TO THE APPROVED ACQUISITION PLAN (AP): An AP is not required for this effort.