JA Redacted.pdf

LIMITED SOURCE JUSTIFICATION & APPROVAL (J&A)

FEDERAL ACQUISITION REGULATION (FAR) PART 8 ACQUISITIONS

Multiple Award Schedule (MAS)/Multiple Award Contract Orders under MAS/General Services Administration Schedules (GSA)/Federal Supply Schedules

(FSS) FAR 8.405-6

Contract Number: GS-35F-0600X Task Order Number: HC1047-19-F-0070 Purchase Request Number: To be determined Procurement Title: Identity Management (IdM) & Single Sign-On (SSO) Estimated Value:

Statutory and Regulatory Authority: 41 U.S.C. 152(3) and FAR 8.405-6(a)(1)(i)(B)

J&A Number: JA20-156

Upon the basis of the following justification, I, as Procuring Activity Competition Advocate, hereby approve this limited source justification in accordance with FAR 8.405-6(a)(1)(i)(B). The acquisition referenced herein is conducted under the Statutory Authority of the Multiple Award Schedule Program, 41 U.S.C. 152(3).

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

Requiring Agency:

Defense Information Systems Agency (DISA) OC/FE2, Services Division. Attn:

P.O. Box 549, Ft. George Meade, MD 20755

Contracting Office:

Defense Information Systems Agency (DISA)/Defense Information Technology Contracting Organization (DITCO), PL62, Attn:

P.O. Box 549, Ft. George Meade, MD 20755

2. NATURE/DESCRIPTION OF ACTION(S):

a.) Type of Action: Firm Fixed-Price b.) Nature of Action: DISA Services Directorate (SD) has a requirement to provide full life-cycle application management to a suite of internal level applications that serve customers across the agency, known as the DISA Internal Business Application Support. The DISA Internal Business Application Support are primarily comprised of DoD technologies, Government-Off- The-Shelf (GOTS) and Commercial-Off-The-Shelf (COTS) applications.

The majority of the production applications are hosted at DISA Data Centers. The Evaluation Verification Integration Facility (EVIF) and/or Joint Interoperability Test Command (JITC) located at Fort George G. Meade (FGGM) serves as the test and evaluation platform/development workspace for the DISA Internal Business Application Support. The EVIF and/or JITC facilities are used to test Operations & Maintenance (O&M) functions that will be

IdM & SSO-JA20-156

Page 2 of 8 Pages performed on Production DISA Internal Business Application Support to ensure an uneventful Release and Deployment (R&D) of the O&M function.

U.S. Government personnel assigned to the SD Internal Business Applications team are responsible for the full application lifecycle management of the DISA Internal Business Application Support. Support Contractors are required to perform a number of specialized supporting functions. Responsibilities across these functions are clearly delineated as either Contractor or Government functions. As a result, there are numerous touch points between Contractor and Government personnel executing their responsibilities.

This action is a modification to existing Task Order HC1047-19-F-0070 which encompasses the full lifecycle range of Internal Business Application Operation and Maintenance support for DISA Internal Business Application Support. O&M shall include designing, developing, configuring, testing, migrating, operating/maintaining and securing Internal Business Applications. Support ongoing operations. Implement upgrades with government provided hardware and software. This also includes support changes to the hosting facility such as moving applications and databases from DISA Data Center to MilCloud; provide technical support for application development, migration, integration, and sustainment and provide Risk Management Framework (RMF) support. Additionally, the scope of this effort shall include providing IT Internal Application II/III Service Desk Support, Task Order Administration, Developing Updating Documentation, Standard Operating Procedure (SOP) development /enhancement, System Administration, Internal Architecture, Configuration Management, Database Administration, Security Engineering and System Integration across all of DISA Internal Business Application Support platforms. The scope of this support is specific to the Internal Applications listed in Subtask 2 through Subtask 8 and Subtask 11 through Subtask 13.

All applications/tools are internal. None of the toolsets listed below are external facing:

Task 2 – DISA’s Internal Business Application Operations and Maintenance

• Subtask 1 - Systems and Database Administration Support

• Subtask 2 – DISA Financial Management System (DFMS) Application Support

• Subtask 3 - Knowledge Tree (KT) Application and Database Maintenance Support

• Subtask 4 - RMC Application Support for Financial Dashboard and Financial Statement

Reporting (FSR)

• Subtask 5 – IBM Cognos Table Manager 1 (TM1)

• Subtask 6 – TeamMate

• Subtask 7- iComplaints

• Subtask 8 - Conference Room Online Scheduling (CROSS)

• Subtask 9 – Configuration Management (CM)

• Subtask 10 – Troubleshooting / Technical Intranet Service Desk Support

• Subtask 11 – Single Sign-On (SSO)

• Subtask 12 – Identity Management (IdM) Support

• Subtask 13 – DISA.mil Website c.) Period of Performance (POP): September 16, 2020 – September 15, 2021 d.) Type of Funding: Defense Working Capital Funds, Operating Funds

Page 3 of 8 Pages e.) Year of Funding: Fiscal Year 2020 (FY20)

3. DESCRIPTION OF SUPPLIES/SERVICES:

The purpose for this action is to increase Optional Tasks 11 & 12 on task order HC1047-19-F- 0070 only in option year (OY) 1. This will allow the Government to obtain the services required to continue to support Operations & Maintenance activities of the existing IdM and SSO environments on DISANet. It will also provide the necessary resources to design, build, integrate, test, implement, and maintain all aspects of the Identity management and Single Sign- On classified and unclassified solutions on DoDNet. All solutions should support integration with existing and future state tools and capabilities, such as Privileged Access Management (PAM), ServiceNow, Corporate Management Information System (CMIS), Active Directory (AD), Enterprise Security Posture System/System Access Management (ESPS/SAM), and Intranet Services Directory Services (ISDS), etc. The SSO solution for the classified DoDNet architecture should support cross-domain integration and should mimic the current IdM unclassified environment in development, test and production.

The contractor shall develop, build, integrate, test, implement, operate and maintain a solution to on-board the 4th Estate Agencies. Not all of the Defense Agency and Field Activity’s (DAFA’s) have Human Resource (HR) systems, therefore, the system will require resources available to support ingest of data for both HR and non-HR agencies. The contractor will need resources available to support these efforts real-time, or near real-time, in order to avoid delays with on-boarding and migration to DoDNet.

4. IDENTIFICATION OF LIMITED SOURCE AUTHORITY AND DEMONSTRATION OF

CONTRACTOR’S UNIQUE QUALIFICATIONS:

(a) Circumstances Justifying Limiting the Source:

The order must be issued on a sole-source basis due to the fact that only one source is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(b) Description of the Justification:

A task order, HC1047-19-F-0070, was awarded to Computer World Services (CWS) to support Identity Management and Single Sign-On. The current task order in place is for the contractor to provide the necessary design, build, integration, test, implementation, and O&M services required for the successful accomplishment of the requirements and tasks set forth herein. CWS is the existing contractor and is the only source which possesses the technical knowledge and baseline for the in place system. The current contract does not include the specific timelines and levels of support needed for actions to be completed. This modification will specifically detail the updates and changes to the core systems required with specified levels of service and timelines. Timelines are to allow for concurrent development, testing and integration of approved Courses of Action. CWS is the only source with the core technical skill set and experience with existing systems to be fully successful during OY 1. Due to the timelines that

Page 4 of 8 Pages will be incorporated into the contract, only CWS can meet the Government’s schedule requirements and awarding to a different vendor would put the government at risk of mission failure due to the critical nature of the Identity Management and SSO tools sets to the growing DoDNet that it currently serves. Timeliness of delivery of these requirements is critical to the Agency’s delivery of services and any delay introduced by re-staffing and training of the Development teams introduces an un-acceptable risk to the planned operations of the DoDNet.

(c) Justification:

(1) Minimum Government requirements:

The agency minimum requirements for equipment to support SSO:

• The Contractor shall perform the O&M activities required to ensure the availability of the

DISA IT Enterprise unclassified and classified SSO and its integration with the applications and services. At least one staff member performing O&M support tasks.

• Additional resources required to develop, build, test, and implement the classified solution. Project management, Configuration Management, Systems Architect resources are required per the IGCE for all development and integration activities.

• In addition to all subtasks identified in the PWS, the contractor shall develop, build, test, implement, operate and maintain a Single sign-on (SSO) solution for the classified DoDNet architecture.

• The contractor shall provide the contract management, technical and functional activities for the program management of the PWS. This includes productivity and management methods such as quality assurance, progress/status reporting, and program reviews. The contractor shall provide the centralized administrative, clerical, documentation and related functions.

The agency minimum requirements for equipment to support IdM:

• The Contractor shall perform the O&M activities required to ensure the availability of the

DISA IdM service.

• The contractor shall develop, integrate, configure and document the privileged access management (PAM) system for DoDNet.

• The contractor shall develop, integrate, configure and document the integration with the

DoDNet IT Service Management capability; ServiceNow.

• The contractor shall develop and implement integration with Enterprise Security Posture

System / System Access Management Dashboard (ESPS/SAM).

• The contractor shall develop, build, test, implement, operate and maintain a solution that allows users/systems administrators to request non-standard requests, such as the ability to utilize username and password versus CAC/PIV for a specified duration, i.e. five days between the hours of 8am -5pm.

• The contractor should provide continued build, test, operate and maintain support for the SecurityIQ/File Access Management solution.

• The contractor shall work with the DISA team to identify the requirements and use cases for the DoDNet integrations with Service Now, SAM, ISDS, and other tools. In collecting, documenting and analyzing these requirements. The contractor shall employ proven requirements gathering techniques (e.g. end-user interviews) and validate

Page 5 of 8 Pages gathered requirements with the objective of capturing all critical factors of the requirement.

• The contractor shall provide System Owners the IdM CNDSP and DoDNet common controls and artifacts, update the eMass system and provide current ACAS scan results to the System Owner that will support the Accreditation & Approval (A&A) process.

• The contractor shall provide, as requested, training and knowledge transfer to DISA and System Owners of non-IdM related systems.

• The contractor shall develop IdM to meet customer requirements and enhancements to continue to meet any DISA and DODNet new IdM requirements. The contractor shall obtain DISA’s approval of final IdM new development and enhancement prior to implementation. The contractor shall develop a detailed plan for all new development or enhancements that details the technical approach. The contractor shall coordinate system enhancement activities with all relevant DISA directorates.

This modification will specifically detail the updates and changes to the core systems required with specified levels of service and timelines. Timelines are to allow for concurrent development, testing and integration of approved Courses of Action. The SSO and IdM architectures must be implemented, accredited and operational within the first six months in order to support the DoDNet migrations for the first DAFA agency. Any delay in implementation will incur a day-to-day schedule slip and delay in DoDNet migrations and/or an increase in resources required to manually onboard users.

(2) Proposed sole source contractor:

The order must be issued on a sole-source basis due to the fact that only one source is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized. The current contract with CWS was awarded on September 16, 2019. Exercising Option 1 tasks 11 & 12 allows the Government to obtain all the services necessary to have the IdM and SSO classified and unclassified solutions built and ready for users on DoDNet prior to start of the migrations. If the Government does not use the current contract under CWS to obtain the solutions, the Government risks major delays in the design, integration, testing, and implementation with current solutions that was put in place by the contractors with Government approval. The critical nature of the requirements details that they need to be delivered as soon as possible during the first six months of OY1. No other source can meet support the schedule requirements, due to onboarding, training and familiarization time which would make meeting the immediate needs impossible. Therefore, the environment will not be ready for use in support of the DoDNet migrations causing delays in on-boarding, access and identity management for HR and non-HR agencies.

The OY 1 increase is based on the requirements to support the Defense Enclave Services (DES) migration of DISA and the 4th Estate Agencies to DoDNet. The SSO unclassified and IdM efforts are part of the current effort CWS is currently performing. Soliciting other vendors will hinder the fulfillment of the classified and unclassified IdM and SSO of this contract. If the contractors fail to implement the classified SSO solution and enhancements, IdM enhancements, and new requirements for DoDNet, the Government will not be able to effectively onboard the users to the DoDNet. Soliciting contractors other than CWS will require knowledge transfer which will incur major delays in the schedule while the new contractor gets up-to-speed on the

Page 6 of 8 Pages current architecture and new requirements. Migration of the first DAFA is scheduled to begin October 2020, and changing vendors would be a hardship on the governments existing DISANet modernization and the rollout of the DoDNet.

(3) Discussion regarding cause of the limited source situation:

Due to the time limitation and the requirements available on the current Task Order, CWS is the only source able to design, integrate, build, test, operate and maintain the SSO and IdM solutions on DoDNet. CWS is the only source with the core technical skill set and experience with existing systems to be fully successful during OY 1. Due to the timelines that will be incorporated into the contract, only CWS can meet the Government’s schedule requirements and awarding to a different vendor would put the government at risk of mission failure due to the critical nature of the Identity Management and SSO tools sets to the growing DoDNet that it currently serves. Timeliness of delivery of these requirements is critical to the Agency’s delivery of services and any delay introduced by re-staffing and training of the Development teams introduces an un-acceptable risk to the planned operations of the DoDNet.

(4) Procurement discussion:

The Government is under a schedule requirement. The SSO and IdM architectures must be implemented, accredited and operational within the first six months in order to support the DoDNet migrations for the first DAFA agency. Any delay in implementation will incur a day-to-day schedule slip and delay in DoDNet migrations and/or an increase in resources required to manually onboard users.

CWS is the only source that is able to meet the Government’s schedule requirements. Bringing in a new source would incur schedule delays due to the onboarding time. Due to the nature of the work, adding additional resources would not work to make up the time lost at the start of the contract. Therefore, other sources could not meet the timelines required to serve the critical mission.

(5) Impact. Failure to increase the level of effort for OY1 via executing the Optional Tasks 11 & 12 of the current contract will adversely impact DISA’s schedule for fully implementing a classified SSO and IdM solution on DoDNet. Introduction of an alternative solution from another manufacturer would have an adverse impact on DISA’s ability to provide a fully functional classified SSO and IdM (both classified & unclassified) solution on DoDNet in a timely manner for all DISA users and DAFAs.

5. BEST VALUE DETERMINATION: The Contracting Officer will make a determination that prices are fair and reasonable. The Contracting Officer will determine whether the proposed price of the equipment is fair and reasonable based upon comparison of proposed prices to the previously evaluated Independent Government Cost Estimate (IGCE), and available historical data for similar products. In addition, a determination will be made that the order represents the best value to the Government and results in the lowest overall cost alternative to meet the Government’s needs.

GSA has already determined that prices of supplies, fixed price services, and rates for services offered at hourly rates are fair and reasonable for the purpose of establishing the schedule

Page 7 of 8 Pages contract. However, the Contracting Officer is still required to make a determination of fair and reasonable pricing for individual orders, BPAs, and orders under BPAs, using the proposal analysis techniques at FAR 15.404-1. The complexity and circumstances of the acquisition should determine the level of detail and analysis IAW FAR 8.404(d) for acquisitions under FAR 8.405-2(d).

6. MARKET RESEARCH:

The market research for the original task order award was conducted in June 2018 for all contact requirements including the Optional Task 11 for SSO services and the Optional Task 12 for IdM services. Contracted rates were researched and compared to average awarded rates utilizing the General Services Administration (GSA) CALC online web tool in July 2020. Based on current market research, dated July 2020, it has been determined that only the aforementioned, CWS, can fully support the Government’s required needs and based on the current schedule. The Government will continue to conduct market research to determine if there are changes in the market place that would enable future competitive actions, i.e. there are similar products and/or product support in the marketplace that provide the same functionality, the original equipment manufacturer releases ownership rights of product, or it is economically feasible to procure a new system.

7. ANY OTHER SUPPORTING FACTS: None

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE BARRIERS THAT LED TO THE

RESTRICTED CONSIDERATION:

(a) Procurement history. Contract Number: GS-35F-0600X, Task/Delivery Order: HC1047- 19-F-0070, awarded September 16, 2019. The task order was competed on the GSA IT-70 contract vehicle as a Historically Underutilized Business Zone (HUBZone) set aside. All HUBZone small businesses on the GSA IT-70 contract vehicle were eligible to compete and bid on the requirements; which included Optional Tasks for SSO and IdM. This modification request is executing the Optional Task 11 and Optional Task 12 and expanding upon the originally awarded subtasks.

The Government decided to use HC1047-19-F-0070 Task Order as the order has available Optional Tasks for SSO and IdM which fit the Government’s needs. The Government is seeking to increase the current OY 1 by an additional $ to cover the required cost of design, integration, build, test, implementation, and operations & maintenance of the classified SSO solution and IdM solutions on DoDNet.

Page 8 of 8 Pages

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE: See separate signature page

TITLE/ORGANIZATION: Chief Network Engineer, OC/FE26

PHONE: DATE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE: See separate signature page

TITLE/ORGANIZATION: Division Chief, OC/FE2

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE: See separate signature page

TITLE/ORGANIZATION:

PROCURING ACTIVITY COMPETITION ADVOCATE (PACA) APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief. Since this justification does not exceed $13.5M, this review serves as approval and my written determination that the aforementioned FAR circumstances apply.

NAME: SIGNATURE: See separate signature page

TITLE/ORGANIZATION: PACA/DISA

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

William K. Selsor, 301-225-4529, William.k.selsor.civ@mail.mil.