JA - Redacted.pdf

J&A No. MCINCR-RCO-22004

JUSTIFICATION AND APPROVAL FOR

ACQUISITION OVER THE SIMPLIFIED ACQUISITION THRESHOLD

1. Contracting Activity

Marine Corps Installations National Capital Region - Regional Contracting Office (MCINCR-RCO), 2010 Henderson Road, MCB Quantico, VA 22134-5000.

2. Description of the Action Being Approved

Marine Corps Intelligence Surveillance Reconnaissance Enterprise (MCISRE) Insider Threat Program (InTP) is requesting the procurement and renewal for one (1) Watchtower License, 360 Hours of Support, and one (1) Dell R650 1U Rack Server to refresh the current server that has reach its end of life.

Watchtower software and hardware will be solicited open market – brand name, utilizing FAR Subpart

13.501 procedures.

3. Description of the Supplies/Services

This requirement is for the renewal of the current licensing subscription for Watchtower Behavorial Analytics System. The licenses/subscriptions are required in order to continue operating the Behavioral Analytics System for the Marine Corps Intelligence Surveillance Reconnaissance (MCISRE) Insider Threat Program (InTP). The MCISRE InTP exists to deter, detect, analyze, respond to, and mitigate indications of insider threat activity. Indications of insider threat activity include, but are not limited to:

Unauthorized Disclosure Malicious Acts Degradation of Service Unauthorized use of protected information Acts of Violence Espionage Inadvertent loss of protected information and equipment Theft of property or resources

This subscription covers the period of 29 April 2022 – 28 April 2027.

CLIN Manufacturer Name and Description Quantity 0001 Arklay, LLC Watchtower License 1

0002 Arklay, LLC Professional Support 12 mths

0003 ArkLay, LLC Dell R650 1U Rack Server 1

4. Statutory Authority Permitting Other Than Full and Open Competition.

The statutory authority permitting other than full and open competition is 10 U.S.C 2304(c)(1), “The property or services needed by the agency are available from only one responsible source or only from a limited number of responsible sources and no other type of property or services will satisfy the needs of the agency” as implemented by the Federal Acquisition Regulation (FAR) 6.302-1(a)(2)(iii)

This document meets the regulatory authority to execute the justification and approval addressed at FAR 13.5.

5. Rationale Justifying Use of Cited Statutory Authority

MCISRE currently uses the Watchtower Behavioral Analytics System to support the MCISRE Insider Threat Program. The Watchtower Behavioral Analytics System allows MCISRE to leverage high-volume and high-complexity collections of data by integrating this data across a variety of information domains in order to support the automated analysis, threat discovery and prioritization, risk prediction and incident management capabilities.

Watchtower Behavioral Analytics System is an integeral part of the MCISRE Insider Threat Program (InTP) Analytical toolset ensuring MCIRE InTP remains in compliance with with the National Insider Threat Task Force (NITTF) minimum standard and Executive Order 13587.

Selection of a different manufacturer would result in an effort that would require reverse engineering, integration, testing and training of the new hardware and/or software. In order to avoid missing critical mission schedules, significant duplication of cost required for reverse engineering, and to avoid additional cost required to newly develop equivalent redundancy, the procurement and continued employment of Watchtower Behavioral Analytics Systems, support and server are required.

The impact on switching from Watchtower to another brand could set the MCIA back about five years from an overall operational perspective due to the capabilities not being tested on the network, integration issues with added new capabilities, and whether or not they would be consistent with our DNI/Executive Branch requirements, basically in order to make sure that the above happened it would cause MCIA to be in a non-operational status which is not acceptable, they need to be in a Full Operating Capability Status at all times. To establish a like product would result in an initial increase in cost of $1.2 million dollars without any enhancement of the current base product.

6. Description of Efforts Made to Solicit Offers from as Many Offerors as Practicable.

On 10 November 2021, RFI - M00264-22-RFI-0205 USMC –Data Aggregation Software, was posted on SAM with an expiration date of 29 November 2021. There were total of 11 responses received. On 07 December 2021 the responses were sent to the Requiring Activity for their technical review.

The technical evaluation report was received on 08 December 2021, the results yielded that there was one capable responder that meets or exceeds the requirement needed, and therefore they are able to provide the product and services consistent with the expectations already in use. The remaining responders represents unacceptable risk to the program, mission, and integration requirements. In addition, trying to implement new capabilities that are untested within the network environment, that have not been integrated with the additional capabilities and/or are not consistent with the DNI/Executive Branch partners can be timely and costly.

The below chart outlines the responder’s and whether they demonstrated capability, the detailed evaluation is located in the market research file):

Respondors Demonstrated Capability Alteryx No Boeing No clearAvenue No CMA Technology No Forcepoint Federal, LLC Yes (Authorized Reseller) KSA Integration No Micro Focus Govt Solutions No

Arklay, LLC Yes (SB – Veteran Owned) RV Global Solutions No Red Hat No Splunk (late) No

In addition, the following market research was also conducted, see below chart:

RESEARCH TYPE ADDITIONAL INFORMATION

a) Personal knowledge in procuring supplies/services of this type

Brief history:

MCISRE, Stacy Starks has personal knowledge in procuring.

Watchtower Software is currently utilized by MCISRE.

b) Contact with knowledgeable persons in Government and industry regarding the commercial nature of this requirement and standard industry practices in this area of supply/services.

Identify those contacted (name and title) and date or timeframe of contact:

- Arkaly, LLC – Fernand Pecot – President; Contacted 03- 04-2019;

Standard industry practices for the Watchtower Software is that it is only sold for 12-month agreements.

-The required software support is available to the general public and therefore deemed commercial in nature.

-On 07 March 2022 – The Contract Specialist reached out to Arklay, LLC to inquire about their contract vehicles and authorized resellers.

c) Review of recent market research results for similar or identical supplies/services.

(Contract history). If this method is used, need to document the method and results of previous market research.

Contract File(s) Number:

FA8075-14-D-0020-0005– ManTech Contract - IDIQ – Air Force IDIQ Contract – contract was awarded via Sole Source based on technical compatibility and was used to provide the software licenses.

d) Review of online resources/databases Identify online resources/databases and when reviewed:

The following online resources/databases were reviewed on 22 January 2020 by Stacy Starks, Technical POC and 02 February 2022 the Contract Specialist also reviewed the following online resources/databases:

UNICOR – yielded zero results;

AbilityOne – yielded zero results.

e) Review of existing Government-wide Acquisition Contracts (GWAC). (GSA, SEWP, NITAAC, DoD ESI, etc.)

Identify GWACs reviewed:

GSA Advantage – yielded no results;

NASA SEWP – yielded no results;

DoD ESI – yeilded no results.

The contract specialist reached out to Arklay, LLC on 07 March 2022 to inquire if they were associated with GSA, Arklay responded that they are not and if there were any resellers, Arklay stated that they do have one authorized reseller, Forcepoint Federal, LLC.

Market research indicates that the required Watchtower Analysis Software is commercial in nature. All mandatory sources of supplies and services were researched.

7. Determination of Fair and Reasonable Cost

The Contracting Officer has determined that the price to the Government of the supplies/services covered by this J&A will represent the best value and will result in the lowest overall cost that meets the Government’s needs.

8. Actions to Remove Barriers to Future Competition.

At this time, MCISRE InTP has no plans to eliminate or replace the use of Watchtower Behavioral Analytics System licenses, however they will continue monitoring the market and conduct continuous market research in an effort to identify any emerging technologies that may satisfy future requirements.

Should such technologies become available, MCISRE InTP will seek competition to the maximum extent practicable.