J&A_Redacted.pdf

JUSTIFICATION & APPROVAL (J&A) FOR FEDERAL ACQUISITION

REGULATION (FAR) SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Schedule/Multiple Award Contract (MAC)

Orders under MAC/ Fair Opportunity – FAR 16.505, DFARS 216.505-70, PGI 216.505-70

Purchase Request Number: 4BU32-30 Contract Number: HC1028-12-D-0024 Task/Delivery Order Number: 0091 Procurement Title: IA Support, CyberSec Mngt Estimated Value: $102,530 Authority: FAR 16.505(b)(2)(i)(C)

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

Upon the basis of the following justification, I, as the Contracting Officer Representative, hereby approve this exception to fair opportunity pursuant to the authority of FAR 16.505(b)(2)(i)(C).

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

a. Requiring Agency:

DISA/JITC

200I Brainard Road, Building 57305 Fort Huachuca, Arizona, 85670

b. Contracting Office

DISA/DITCO/PL8332

2300 East Drive, Building 3600 Scott Air Force Base, Illinois, 62225

2. NATURE/DESCRIPTION OF ACTION(S): The nature of this action is a cost-plus-fixed-fee (CPFF) task order (TO) against the Testing and Evaluation (T&E) Multiple Support Services (MSS) indefinite-delivery/indefinite-quantity (ID/IQ) contract held by Engility Corporation. This action will ensure that almost five years of Risk Management Framework (RMF) and Enterprise Mission Assurance Support Service (eMASS) knowledge is not lost, and then required to be replicated with another contractor prior to completion of receiving three Authorizations to Operate (ATO) for JITC from DISA’s Authorizing Office. This can continue to serve as the new follow-on becomes available. The award given to the incumbent will allow for a smoother transition to the new TEC contract as it is less likely to have information lost in the transition.

Simply put, without continued services under the current task order contract holder, JITC’s overall ability to perform all duties within the mission is highly jeopardized as the functionality will be taken away. JITC Fort Huachuca’s ATO for the Facility expires 22 March 2018;

Distributed Development Test Enterprise (DDTE) expires 13 June 2018; and Joint Analysis Net-centric Evaluation Testing Toolkit (JANETT) expires 8 March 2018. The current period of performance ends February 3, 2018.

Page 2 of 6 Pages

The requested change to the task order will be approximately 1,920 labor hours and have a period of performance of February 4, 2018 to July 31, 2018. This is mission funded task.

3. DESCRIPTION OF SUPPLIES/SERVICES: The objective of this task is to support JITC Authorizations to Operate (ATO) by providing focused input to system/lab requirements as they change or emerge. The contractor is expected to provide knowledge in system engineering, documentation (drawings, white papers, procedures, etc), and awareness of cyber assurance requirements that would meet requirements for JITC IA Controls of the Risk Management Framework (RMF) as well as any Operational Orders or Directives when presented to the Command for response (data calls).

An Authorization to Operate (ATO) is a formal declaration by an Authorizing Official (AO), formally known as Designated Approving Authority (DAA), which authorizes operation, sometimes with conditions, and explicitly accepts the risk to agency operations. The ATO is signed after a Security Compliance Agent (SCA), formally known as the Certification Agent (CA), certifies that the system has met and passed all requirements to become operational.

eMASS is a web-based Government off-the-shelf (GOTS) solution that automates a broad range of services for comprehensive, fully integrated cybersecurity management, including controls scorecard measurement, dashboard reporting, and the generation of RMF for Department of Defense (DoD) Information Technology (IT) package reports. Strick process control mechanisms for obtaining an ATO are provided to the SCA and AO via eMASS’ integrated suite of authorization capabilities. eMASS and the compelling evidence entered for each strict process control mechanism requires knowledge of the system/facility, policies, procedures, mitigations, and knowledge of what the SCA and AO expect to receive as compelling evidence.

An ATO is required for connectivity to Department of Defense networks. Failure to achieve an ATO would require the JITC Fort Huachuca facility to disconnect from all unclassified and classified networks on the date of expiration of current ATO.

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity. The order must be issued on a sole-source basis in the interest of economy and efficiency because it is a logical follow-on to an order already issued under the contract, provided that all awardees were given a fair opportunity to be considered for the original order.

(b) Description of the Justification. This action requires the authority cited, as the period of performance of the task order will expire prior to completion of RMF Assessment and Accreditation activities that lead to the ATO. The current contractor for this task, Engility Corp., is uniquely qualified to continue the activities as they have been responsible for the program for almost five years, through all phases of eMASS input with documentation development, compelling evidence gathering, responses to strict process controls, response to operational orders, and data calls, and communicating with the SCA. As a

Page 3 of 6 Pages result, they provide highly specialized capabilities and resources that are not available from any other contractor in the timeframe needed. This action will ensure that almost five years of intimate knowledge of the JITC facility is not lost with the current contractor and their completion of JITC’s RMF ATO.

(c) Justification.

(1) Minimum Government requirements. User account access to accreditation databases eMASS and DITPR as well as access to vulnerability tracking tools, namely Assured Compliance Assessment Solution (ACAS), Host-Based Security System (HBSS), Continuous Monitoring and Risk Scoring (CMRS) databases. Such access to the databases is time-consuming and can take one month to get accounts setup properly in order for a new user as DoDI 8570.01-M requirements must be validated, appointment letters signed, and routed to the AO’s office for recognition and assignment with ISSM privileges to such databases.

(2) Proposed sole source contractor. This contractor, Engility Corp., has supported the ISSM/IAM tasks for almost five years as the accreditation process migrated from DIACAP to RMF. Continuing performance with the current contractor provides the government substantial benefits as the work is an extension of what they are currently performing. Substituting contractors for the work at this phase of accreditation will be detrimental by adding unnecessary delays and increasing costs. This is due to the amount of time already invested in the effort, resulting in their unique and highly specialized knowledge of JITC’s infrastructure and design that we must meet to satisfy Risk Executive Office’s SCA and AO. JITC FHU currently encompasses approximately 38 distinct systems/labs located on the compound with separate missions and configurations that define them as JITC Core or Zones A, B, C, D, by DISA Enclave Test and Development STIG. All classifications of strategic and tactical, local and distributed testing, are facilitated and utilized in both operational and test operational environments. The system/lab environments are constantly evolving to the next new technology, making the need to provide focused effort essential to JITC agility.

(3) Discussion regarding cause of the sole source situation. The reason for this sole source situation is that Engility has completed the majority of the RMF ATO activity on the task order, and requires further work until the ATO is granted. Engility can provide the Government highly specialized knowledge of the RMS in eMASS and they are best suited to adapt quickly to any strict process compliance requirements that may be required by the SCA or AO. It is impractical to create a new task order and engage another contractor and expect to receive ATOs upon expiration of current.Additional time with the incumbent will ensure information loss is minimized as it transitions to

TEC.

(4) Demonstration of unique source. The choice of sole source to Engility is that they are the only source at this time. Uniquely qualified with all of JITC facility documentation and evidence and have access to the necessary databases.

(5) Procurement discussion. This award is required to ensure timely completion of activities and ensure that JITC FHU completes the package submission for ATO. The period of time needed as previously described is approximately 6 months: February 4, 2018 to July 31, 2018. Engility has been indispensable in making support for this

Page 4 of 6 Pages critical task effective and successful. Engility is the only qualified contractor capable of providing continued service and is currently in place, with proper security clearances, and has the capability to support this task without interruption.

(6) Impact. Failure to award will result in JITC not being able to submit a fully compliant RMF package in eMASS to obtain an Authorization to Operate from the AO. The detrimental effect to the mission for this task would be the shutdown of JITC’s facility connections to unclassified and classified networks and activities that allow testing within isolated/standalone zoned networks. The logical action is to issue the award to continue work with Engility. If the requirement were to be re-competed, it would delay obtaining the task for up to four months, based on the historical evidence of the time required to get fully qualified contract personnel functional. It could take as much as two additional months, with maximum stakeholder support, to transition to cybersecurity personnel with adequate knowledge and understanding of the JITC facility’s infrastructure and internal systems. Additional time is needed because the TEC contract is currently under protest, though anticipated to be used in upcoming months. The additional time will allow Engility to transition the information and knowledge to the TEC contract holder without the increased risk of loss of information. Selecting another contractor would increase costs due to the time required to familiarize the contractor with JITC FHU system capabilities and operational test requisites needed to adequately support cyber compliance and security.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION: During source selection of solicitation number HC1028-12-D-0024-0091, a cost/price evaluation was conducted in accordance with FAR 15.404. The contract prices were determined to be reasonable. The proposed cost/prices for the extension will be compared to the current contract prices as well as the Independent Government Estimate in order to determine fair and reasonableness in accordance with FAR 16.505(b)(2)(ii)(B)(5)/

6. MARKET RESEARCH: In accordance with FAR Part 10.002, market research has been conducted to identify all qualified sources and results thereof. The initial research was completed from 2012 to 2013 at the basic Test and Evaluation Mission Support Services (T&E MSS) contract level, and annually thereafter at the task order level in accordance with FAR 10.002(b)(1). The formal market analysis included review of contractors found on General Services Administration (GSA) Schedule 70, and analysis of historical contract costs. As a result of the review, it was determined that the only way to avoid the loss of invested resources and additional costs to the Government is to modify the existing task order to accomplish this expanded effort this is within scope of the original PWS. Market research has always identified that all prime T&E MSS contractors can complete the scope of work; however, Engility Corp.

competitively won this task order award and is the only contractor that can complete the work within the requirement timelines mentioned above.

7. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY: (16.505(b)(2)(ii)(B)(7).

(a) Procurement History.

Page 5 of 6 Pages

Contract Number: HC1028-12-D-0024-0091 Contractor: Engility/TASC Corporation Contract Period: 4 February 2013 – 3 February 2018 Total Contract Value: $1,452,398.27 (original TEP; Base + all options) Contract Type: CPFF Objective: The purpose of this tasking is to provide support for IA/Cybersecurity ISSM Support.

(b) No related prior award was accomplished with the need for a brand-name exception to fair opportunity, limited-sources, and/or any other exception to full and open competition justification.

The requested award will be for estimated $102,730.

8. REFERENCE TO THE APPROVED ACQUISITION PLAN (AP): In accordance with the exceptions under DISA Acquisition Regulations Supplement 7.103 (S-91)(1)(viii), an AP is not required.

Page 6 of 6 Pages

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: David J. Price SIGNATURE:

TITLE/ORGANIZATION: COR/DISA/JITC/JT3B

PHONE: 520-538-4278 DATE: January 5, 2018

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: David J. Price SIGNATURE:

TITLE/ORGANIZATION: COR/DISA/JITC/JT3B

PHONE: 520-538-4278 DATE: January 5, 2018

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: Stephanie R. McCarthy SIGNATURE:

TITLE/ORGANIZATION: Contracting Officer, DISA/DITCO PL8332

PHONE: 618-229-9360 DATE: January 5, 2018

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

Ms. Melissa LaSure JITC ISSM and COR

(520) 538-4274; DSN 879-4274

melissa.e.lasure.civ@mail.mil