CUI Source Selection Sensitive Information See FAR 2.101 and 3.104

CNSSI No. 1253 (Security Categorization and Control Selection): Requires the implementation of ABAC. The solution must enforce access to data based on a combination of real-time attributes, including the user's clearance, their physical location, and the accreditation of the system they are using. This “multi-attribute gating” is a core feature not found in standard access control systems.

DoD Zero Trust Architecture & DoD Instruction 8510.01 (RMF): The solution must align with DoD Zero Trust principles by providing automated data labeling and tagging.

It must be engineered to support the DoD Risk Management Framework (RMF) baseline to achieve an ATO for systems handling SAP data.

NSA CSfC Data at Rest (DAR) Requirements: The application must utilize

NSA/Central Security Service (CSS)-approved cryptographic algorithms to protect data at rest, ensuring it meets the stringent standards for cryptographic security set by the

NSA.

These combined requirements for dynamic marking, multi-attribute access control, and adherence to specific cryptographic standards create a unique capability need that must be fulfilled by a single, integrated solution. Based on market research and capability assessments, ManTech International Corporation is the sole developer, manufacturer, and provider of the Sentris® software, which is uniquely designed to meet these specific mandates. ManTech does not utilize distributors or resellers for this proprietary software. Therefore, ManTech is the only responsible source capable of providing the required product.

6. Efforts to Obtain Competition: In addition to the Requiring Activity’s (RA) market research canvasing the commercial market for Software-as-a-Service (SaaS) platform and resources, they also conducted a Request for Information (RFI) number 583302 through the Army Computer Hardware, Enterprise Software Solutions (CHESS) and numbers) 392273 Groups B, C and D, and 392274 Group A, through NASA Solutions for Enterprise-Wide Procurement (SEWP). The CHESS RFI returned no responses. The SEWP RFI 392274 returned two responses. The Contracting Officer and RA reviewed both responses for technical acceptability. The RA prepared detailed technical evaluations on both responses and determined neither to be technically acceptable, noting they fail to satisfy the Government’s mandatory minimum requirements.

7. Fair and Reasonable Cost Determination: The price will be determined fair and reasonable in accordance with price analysis and/or comparison with the Independent Government Cost Estimate (IGCE) techniques identified in FAR 15.404-1 price analysis. A memorandum detailing the Fair and Reasonable Price Determination will be included in the contract documentation.

8. Market Research Conducted: Market research was conducted to identify sources capable of meeting the stringent requirements for securing SAP data as defined by DoDM 5205.07, CNSSI 1253, and NSA CSfC guidelines. The research focused on identifying commercial off-the-shelf

CUI Source Selection Sensitive Information See FAR 2.101 and 3.104

(COTS) products that provide a comprehensive solution for automated data marking, ABAC, and NSA-compliant cryptography for data at rest. While various vendors offer solutions for data classification or access control, the research performed concluded that no alternative product possesses the dynamic, multi-attribute gating and marking capabilities essential for SAP-level security compliance. Currently, only ManTech's Sentris® provides the necessary integrated and automated solution that meets all of the government’s minimum technical requirements.

9. Other Supporting Facts: The justification for this sole-source acquisition is further supported by the following operational realities and risk factors inherent in managing SAP environments:

a. Mitigation of Human Error and Data Spillage: Standard network security relies on static folder permissions and user diligence, which are prone to human error and are a leading cause of data spillage in highly sensitive environments. The required software automates security policy enforcement at the data level, dynamically applying markings and access controls without user intervention. This significantly reduces the risk of accidental unauthorized disclosure and the severe national security consequences that could result from a data spill.

b. Seamless Integration and Operational Continuity: The solution is engineered to integrate directly into existing, commonly used government applications, including Microsoft Office, Outlook, and SharePoint. This integration is critical for operational continuity, as it allows personnel to maintain established workflows without disruption while ensuring security policies are enforced transparently in the background. Introducing an alternative solution would require significant re-engineering, extensive user retraining, and a lengthy and costly re-accreditation process for the entire IT infrastructure.

c. Inadequacy of Standard Operating Systems: Standard operating systems and directory services (e.g., Windows, Active Directory) are incapable of meeting the multi-attribute access control requirements mandated by CNSSI 1253 for SAP data. These systems cannot simultaneously adjudicate access based on a user's clearance, physical location, and network terminal accreditation in real-time. The required capability must be provided by a specialized overlay solution. The ManTech Sentris® platform is purpose-built to provide this essential security overlay.

These factors underscore that the requirement is not merely for a software product, but for a specific, proven capability to mitigate significant operational and security risks that cannot be addressed by any other available means.