JA16-041_Unified_NetOps_Redacted.pdf

JUSTIFICATION & APPROVAL FEDERAL ACQUISITION

REGULATION (FAR) SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Schedule/Multiple Award Contract (MAC)

Orders under MAC/Fair Opportunity – FAR 16.505, Department of Defense FAR Supplement 216.505-70, Procedures, Guidance, and Information 216.505-70

Purchase Request Number: TBD Contract Number: HC1028-08-D-2013 Task Order Number: 0005 Procurement Title: Unified Network Operations (NetOps)/Cyber Situational Awareness (SA)

(UNSA)

Contracting Office: Defense Information Systems Agency (DISA)/Defense Information Technology Contracting Organization (DITCO)/PL8313 Estimated Value: $ Authority: FAR 16.505(b)(2)(i)(B)

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

Number: JA16-041

Upon the basis of the following justification, I, as Procuring Activity Competition Advocate, hereby approve this exception to fair opportunity pursuant to the authority of FAR 16.505(b) (2)(i)(B)

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

DISA Cyber SA and Analytics Division Infrastructure Development (ID) 6 6914 Cooper Ave Fort Meade, Maryland 20755-0549

Contracting Office:

DISA/DITCO PL8313

2300 East Drive Scott Air Force Base, Illinois 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S): The nature of this action is to issue a bridge extension modification for a 3-month base period with one 1-month option period (OP) under contract HC1028-08-D-2013 task order 0005. The current task order expires March 12, 2016, however, an extension is required to continue critical UNSA program support and meet mission requirements while the competition for the follow-on acquisitions are being completed. The proposed period of performance (PoP) for this action is March 13, 2016 – June 12, 2016, with final performance expiration July 12, 2016, if the 1-month option is exercised. The firm fixed price and cost plus fixed fee bridge modification will be issued utilizing fiscal year 2016 operations and maintenance appropriated funds.

Unified NetOps /Cyber Situational Awareness (UNSA)-JA16-041

3. DESCRIPTION OF SERVICES: This task order bridge extension will provide continued capability development and operations support (program management support, security engineering, Assessment and Authorization (A&A), and configuration management) for the Department of Defense (DoD) Cyber Situational Awareness Analytic Cloud (CSAAC) program.

The CSAAC program includes the development and sustainment of analytics, the Big Data Platform (BDP), and the supporting Governance Process development effort.

The services being extended will provide critical, technically focused program support to the Government in the daily management and operation and continued capability development for the DoD CSAAC Program. The CSAAC and BDP is intended to provide Commanders and decision makers at all levels, Combatant Commanders/Services/Agencies/Network Operations centers, United States (US) Cyber Command, US Strategic Command, with an ability to maintain SA across three primary activities of the NetOps. The three primary activities are:

Global Information Grid (GIG) Enterprise Management, GIG Net Assurance, and GIG Content Management. All three activities include relevant, accurate and timely information about the availability, integrity, and confidentiality status of its network connected components, as well as information about how events, incidents, threats, and vulnerabilities occurring within the GIG, impact ongoing and planned missions across all DoD Joint Capability Areas. The analytics through the BDP enable the NetOps and Computer Network Defense (CND) communities to achieve shared SA of the DoD Information Network (DoDIN) system, network and information availability. The primary purpose is to enhance knowledge of the GIG and to improve the quality and timeliness of collaborative decision-making regarding the employment, protection and defense of the GIG. To be useful, much of this GIG SA must be available and shared in near real-time by the relevant decision-makers.

DISA/ID requires operational and technical level expertise consistent with established Government guidelines and standards. These guidelines and standards apply to enterprise information assurance (IA) operations and systems that are needed for: program management, configuration management, vulnerability management, risk scoring and management, and real-time awareness of devices and software inventory within the DoD. Operational support includes providing baseline sustainment to the CSAAC analytics and the BDP baselines as mentioned above. The scope of the UNSA sustainment effort is to provide systems engineering and technical assistance for the continued capability development and sustainment of robust analytic capabilities. This includes, but is not limited to: engineering, testing, deployment, maintenance, IA analysis, A&A support, quality assurance/system evaluation, testing of changes prior to deployment, installation support for security updates, documentation, and system performance analysis to sustain the BDP and analytic capabilities.

The Government program management office (PMO) revised the Performance Work Statement (PWS) to remove requirements and deliverables that are non-essential during this bridge period.

The bridge will not address strategic Cyber SA support such as, Continuity of Operations, planning, architecture, and community outreach planning. The bridge will also not support continued sustainment/operational planning. Finally, training will be discontinued during the bridge period. All of these activities will resume, as per the PWS, for the newly awarded CSAAC and BDP efforts.

Gay.Arnold Typewritten Text

The PoP for the expiring task order is outlined below:

Base year: September 13, 2011 – September 12, 2012 Option year (OY) 1: September 13, 2012 – September 12, 2013 OY2: September 13, 2013 – September 12, 2014 OY3: September 13, 2014 – September 12, 2015 OY4: eliminated OP 5 as FAR 52.217-8 extension: September 13, 2015 – March 12, 2016 OP 6: Bridge Period: March 13, 2016 – June 12, 2016 OP 7: Bridge Period: June 13, 2016 – July 12, 2016

The total lifecycle cost of the current task order inclusive of all exercised options is $ .

The lifecycle cost of the entire four-month bridge extension (transition included), if the 1-month option is exercised, is $ , resulting in a total lifecycle cost of $ 0.

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity. Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(b) Description of the Justification. The request is an extension of services previously competitively awarded to ManTech Advanced Systems International. Although the Government is competing two follow-on requirements for fair opportunity procurements, unexpected delays have prevented award prior to expiration of the current task order.

Infrastructure data acquisition and integration management are brand new concepts still being defined and growing rapidly, resulting in delays of requirements definition for inclusion to the recompete efforts. To that end, the totality of evolving operational and stakeholder demands and complexity of requirements caused delay in completion of acquisition activities for this contract award. The current UNSA task order expires on March 12, 2016. The BDP infrastructure continues to support large data feeds and key analytics mainly used by DISA Cyber Defenders. The BDP supports stakeholder integration by updating and distributing a baseline that is accredited for use on other networks. Without the support of the BDP infrastructure, there will be a significant impact to operational activities.

BDP provides advanced technology that supports departmental objectives such as Joint Information Environment. Additionally, the BDP infrastructure is the platform for the CSAAC. These analytics are provided to support and defend cyber networks, and provide SA which is key to the defense of the DoDIN. Cyber SA provides the ability for vital enterprise services (i.e. Defense Enterprise Email and Defense Collaborative Services (DCS)). CND capabilities, to include threat identification, threat mitigation, data sharing, and the ability to countermeasure active threats (i.e. Fight by Indicator, Signature Repository) would be impacted significantly. Additionally, there are over 1,400 active users across the DoD relying on the cyber analytics to continue to defend the network that would be affected.

As the contractor currently performing the UNSA support, ManTech is the only capable source to continue to provide the same services without interruption and without any unacceptable degradation to quality and the systems. ManTech understands the requirements and currently possesses the requisite expertise and relevant experience. Moreover, ManTech already has skilled, trained staff in place that is required to perform technical support.

Transition of the institutional knowledge from the incumbent is key to carrying the UNSA concepts and processes forward to a new vendor. Any other contractor would, at a minimum, have to first understand the scope of the CSAAC analytics and BDP system’s highly technical requirements, recruit personnel with specialized qualifications, and be cleared to support the effort before technical support services could continue. To satisfy the transition of knowledge, the Government has included a 1-month optional contract line item number for continued expertise through transition of support from the incumbent to the awardee(s) of the recompete efforts.

(c) Justification.

(1) Minimum Government Requirements. At a minimum, the contractor will provide operational support to include providing baseline sustainment to the CSAAC Analytics and BDP. The scope of this effort is to provide current systems engineering and technical assistance for the continued development and sustainment of the capabilities. This includes operations support by way of program management support, security engineering, assessment and authorization, and configuration management.

(2) Proposed sole source contractor. ManTech Advanced Systems International, the current contractor, has been instrumental in supporting DoD’s CSAAC analytic and BDP capabilities since 2011. The current task order is under a 6-month extension in accordance with FAR 52.217-8. The extension expires on March 12, 2016. As the contractor currently performing the UNSA support, ManTech is the only capable source to continue to provide the same services starting March 13, 2016 without any degradation to quality and the systems. They already have skilled, trained staff in place that is required to perform technical support. Moreover, transition with the institutional knowledge from the incumbent is key to carrying the UNSA concepts and processes forward. An unsupported baseline for any length of time would be devastating to the CND capabilities, such as threat identification, threat mitigation, data sharing, and the ability to countermeasure active threats. The estimated cost for the bridge is $ (including transition), derived from the Independent Government Cost Estimate based on current market rates for the ENCORE II contract. This initial work was competed using the ENCORE II vehicle.

(3) Discussion regarding cause of the sole source situation. The CSAAC and BDP efforts are currently being solicited on a competitive basis. As a result of delays in procurement of the recompete actions, a bridge is required to maintain all essential support currently provided under the existing task order. The 6-month extension under FAR 52.217-8 will be exhausted and continued support is still necessary to ensure uninterrupted support.

(4) Demonstration of unique source. ManTech is uniquely postured to support the UNSA efforts without loss of time and work stoppage starting March 13, 2016. ManTech understands the requirements and currently possesses the requisite expertise and relevant experience. Any other contractor would, at a minimum, have to first understand the scope of the CSAAC analytics and BDP system’s highly technical requirements, recruit personnel with specialized qualifications, and be cleared to support the effort before technical support services could continue. This would result in unacceptable delays to the continued support efforts of these systems, in addition to the time delay of four weeks to get the new contractor on board and transitioned. The bridge request extension of four months, including the time to transition, is necessary to complete the award of both follow-on requirements, CSAAC and BDP.

(5) Procurement Discussion. This action extends the current task order until the competitive follow-ons are complete. The Request for Quotes have been issued for both follow-on requirements, CSAAC (November 10, 2015) and BDP (December 9, 2015).

The milestones for the follow-on requirements have been jointly agreed upon by the contracting officers and the ID PMO as realistic and firm to ensure adequate evaluations and awards. The projected need for continued performance from March 13, 2016, through July 12, 2016 (if options are exercised), is determined necessary to complete the new awards and transition purposes.

(6) Impact. Analytics for CND and SA are key to the defense of the DoDIN. Cyber SA provides availability data for key Enterprise Services such as email and DCS. CND capabilities include threat identification, threat mitigation, data sharing and the ability to countermeasure active threats which are key drivers to defend the DoD networks across the DoDIN. There are also impacts associated with CND and SA which are critical in defending the DoDIN. Such impacts regarding the developments and releasing of analytic capabilities will be significantly delayed. The aforementioned delays will have a major impact and have a ripple effect on the Joint Regional Security Stack use case development, aligning with BDP infrastructure, and reporting mechanisms. Support for potential outages or bug fixes could potentially also be impacted without support (a mandatory 30-day fix). Ultimately, this will affect the 1,482 users and 169 capabilities and their ability to immediately react and support active threats.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION: The exact cost will be determined fair and reasonable at time of task order modification. Certified cost and pricing will be received and used in cost analysis and negotiations. Upon completion of negotiations, a certificate of current cost and pricing data will be obtained.

6. MARKET RESEARCH: ManTech is the only contractor at this time with the intimate knowledge and technical personnel capabilities to support the requirement in the timeframe necessary for uninterrupted support. Market research was conducted for the follow-on efforts. A sources sought notice was published on FBO.gov from December 9, 2014, through January 13, 2015. Based on the results of the sources sought and historical knowledge of the current contract, it was determined the follow-on efforts could be competitively solicited allowing fair opportunity under General Services Administration vehicle. The Government is currently re-competing the requirement as two separate procurements based on the market research findings;

however, as a result of the delay in the acquisition schedule and necessary transition to new contractors, it is not currently feasible to award the subject task order to another contractor.

7. ANY OTHER SUPPORTING FACTS: None

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement history. The UNSA task order was previously competed under fair opportunity (large business) on the ENCORE II suite of contracts. ManTech was awarded the task order (HC1028-08-D-2013-0005) on September 13, 2011 with a period of performance consisting of a one-year base period and four 1-year options. In September of 2015, and in accordance with FAR 52.217-8, the task order was extended.

Final performance expires March 12, 2016.

(b) An exception to fair opportunity or full and open competition has not been accomplished for any prior procurement for this requirement. The requirements covered under the UNSA contract are currently being re-competed.

9. REFERENCE TO THE APPROVED ACQUISITION PLAN (AP): A written AP was signed May 2, 2011 for the current task order and modified on March 3, 2016 for this requested bridge extension.