JA16-023_MOD_01_SCM_Bridge.pdf

LIMITED SOURCE JUSTIFICATION & APPROVAL (J&A)

FEDERAL ACQUISITION REGULATION (FAR) PART 8 ACQUISITIONS

Multiple Award Schedule (MAS)/Multiple Award Contract (MAC)

Orders under MAS/General Services Administration Schedules (GSA)/Federal Supply Schedules

(FSS) FAR 8.405-6

Purchase Request Number: Operations & Maintenance (O&M) funds Blanket Purchase Agreement (BPA) Number: HC1028-13-A-0013 Order Number: 0004 Procurement Title: Secure Configuration Management (SCM) Development and Sustainment Contracting Office: Defense Information Systems Agency (DISA)/Defense Information Technology Contracting Organization (DITCO)/PL8311 Estimated Value Original J&A: $929,916 Estimated Value Modification (MOD) 01: $1,857,452

LIMITED SOURCE MODIFICATION

J&A Number: JA16-023 MOD 1

Upon the basis of the following justification, I, as Procuring Activity Competition Advocate, hereby approve this limited source justification in accordance with (IAW) FAR 8.405- 6(a)(1)(i)(C). The acquisition referenced herein is conducted under the authority of the MAS Program.

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

DISA Infrastructure Development (ID) Cyber Situational Awareness Analytical Branch

(ID62)

P.O. Box 549 Ft. Meade, MD 20755-0549

Contracting Activity:

DISA/ DITCO PL8311

2300 East Drive Scott AFB, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

MOD 01: This modification is to extend the POP of order HC1028-13-A-0013-0004 for one 2-month base period and one 3-month option period, which will extend the task order through October 15, 2016. This increases the value of the task order by $1,857,452. The initial extension of this task order only included SCM tasks, due to CMRS tasks not being needed during the initial extension period. This extension includes both SCM and CMRS tasks that were part of the originally awarded task order’s PWS. CMRS tasks are needed for this extension in the event the follow-on task order, awarded on May 9, 2016, is protested. The need for

CMRS

HC1028-13-A-0013/0004 SCM Development and Sustainment Extension-JA16-023 tasks under this extension and the additional month of performance account for the difference in the estimated value of the two extensions. The initial 2-month POP of this extension will allow for the additional time needed to award the follow-on contract and allow for transition time between contractors if the incumbent does not receive the award of the follow-on contract. The 3-month optional period of this extension will allow for the time needed to resolve any protests that may occur on the follow-on contract. All CMRS tasks will be optional and only exercised if the follow-on task order is protested.

Original J&A: The nature of this action is to procure a 2-month base and two 1-month firm fixed price (FFP) option periods to extend the period of performance (POP) for task order HC1028-13-A-0013-0004. The POP for the current task order ends January 15, 2016. Fiscal Year (FY) 2016 O&M appropriated funds are available in the amount of $929,916.93 for a 2-month base period and two 1-month option periods. This extension is requested as a logical follow-on to continue program support and meet mission requirements while the competition for the follow-on acquisition is being completed. The intent is to have the follow-on acquisition awarded before the end of the 4-month extension period.

3. DESCRIPTION OF SERVICES: This task order extension will provide continued operations support (program management support, security engineering, Assessment and Authorization (A&A), and configuration management) for the Department of Defense (DoD) SCM suite of tools Continuous Monitoring Risk Scoring (CMRS), Cyber Operational Attribute Management System, Asset Publishing Service (APS), Information Assurance Vulnerability Management (IAVM) System, Operational Attributes Module (OAM), and Digital Policy Management System) while the program offices in DISA’s ID work the follow-on, competitive efforts. The POP of the extension is a 2-month base period with two 1-month option periods (January 16, 2016 – May 15, 2016). The total lifecycle cost of the current task order is $14,810,026.00, including all options, and the final option period expires January 15, 2016. The lifecycle cost of the entire 4-month bridge is $929,916.93, bringing the total lifecycle cost of the task order to $15,739,942.93.

The services being extended will provide critical, technically focused program support to the Government in the daily management and operation for the DoD SCM programs. The SCM portfolio provides for the integration and optimization of enterprise Information Assurance (IA) applications, tools, and data standards to support automated processes used in support of cyber blue force tracking, risk management, near-real time awareness of devices and software inventory and configurations. SCM enables information system monitoring as part of the DoD’s continuous monitoring strategy – supporting the initial data sets of assets, system configurations, and vulnerabilities (Federal Information Security Management reporting requirements). The program leverages inherent SCM capabilities used within combatant commands, services, and agencies (CC/S/A’s) and provides pervasive enterprise capabilities and interfaced automated capabilities based on common data standards (e.g. Security Content Automation Protocol) to enhance CC/S/A’s ability to identify assets, check system configuration compliance against policies and standards, search for potential vulnerabilities, act on known vulnerabilities for known risk posture for system/networks and report status and share information on a need-to-know basis.

ID requires operational and technical level expertise consistent with established Government guidelines and standards with respect to enterprise IA operations and systems needed for program management, configuration management, vulnerability management, risk scoring and management, and real-time awareness of devices and software inventory within the DoD.

Operational support includes providing baseline sustainment to the SCM portfolio systems as mentioned above. The scope of the SCM sustainment effort is to provide systems engineering and technical assistance for the continued sustainment of robust SCM capabilities. This includes, but is not limited to, maintenance, IA analysis, A&A support, quality assurance/system evaluation, testing of changes prior to deployment, installation support for any security updates, documentation, and system performance analysis to sustain SCM capabilities.

MOD 01: This modification increases the bridge effort to a total of nine months with a lifecycle cost of $2,787,368, bringing the total lifecycle cost of the task order to $17,597,394.

4. IDENTIFICATION OF LIMITED SOURCE AUTHORITY AND DEMONSTRATION

OF CONTRACTOR’S UNIQUE QUALIFICATIONS

(a) Circumstances Justifying Limiting the Source. IAW FAR 8.405-6 (a)(1)(i)(C), in the interest of economy and efficiency, this work is a logical follow-on to an original FSS BPA order that was placed IAW the applicable FSS ordering procedures. The original BPA was not previously issued under sole-source or limited-source procedures.

(b) Description of the Justification. Since June 2013, Foxhole has been the sole technical support contractor for these requirements under BPA HC1028-13-A-0013, task order 0004.

They meet all of the current requirements for support and are positioned to continue providing their current level of support. During the extension period, the contractor will provide baseline sustainment to the SCM portfolio systems as mentioned above. The scope of the SCM sustainment effort is to provide systems engineering and technical assistance for the continued sustainment of robust SCM capabilities. This includes, but is not limited to, maintenance, IA analysis, A&A support, quality assurance/system evaluation, testing of changes prior to deployment, installation support for any security updates, documentation, and system performance analysis to sustain SCM capabilities.

(c) Justification. The United States Cyber Command (USCYBERCOM) will lose the ability to evaluate and mandate enterprise patching if the capabilities are not continued.

USCYBERCOM also uses the IAVM system to address vulnerabilities determined to be sufficiently important to warrant deliberate notification, direct action to mitigate the vulnerability, and, for the most critical vulnerabilities, monitor compliance with those actions. A break in service would create a void in enterprise vulnerability assessment. Both Assured Compliance Assessment Solution (ACAS) and CMRS will degrade in accuracy over time if service is broken. The Office of the Secretary of Defense (OSD) will lose patching compliance metrics reported through the Secretary of Defense’s Cyber Security Scorecard. In addition, Operational Attributes Module (OAM) and Asset Publishing Service (APS) support is required to fix any new bugs or Category I (CAT I) vulnerabilities. The risks faced if this task order is not extended include the following: (1) compliance support for FRAGO 1 to USCYBERCOM

Task Order 14-0305 - Secretary of Defense’s Cyber Security Scorecard effort (Feb 2016); (2) support for new Host Based Security System (HBSS) electronic Policy Orchestrator (ePO) 5.3.1 compliant versions of APS and OAM; and (3) tier III help desk support/customer support for Security Technical Implementation Guide and IAVM compliance reporting.

(1) Minimum Government Requirements. At a minimum, the contractor will provide operational support to include providing baseline sustainment to the SCM portfolio systems as mentioned above. The scope of the SCM sustainment effort is to provide systems engineering and technical assistance for the continued sustainment of robust SCM capabilities. This includes, but is not limited to, maintenance, IA analysis, A&A support, quality assurance/system evaluation, testing of changes prior to deployment, installation support for any security updates, documentation, and system performance analysis to sustain SCM capabilities.

(2) Proposed Sole Source Contractor. Foxhole Technologies, the current contractor, has been instrumental in supporting DoD’s SCM suite of systems since 2013. The estimated cost for the bridge is $929,916.93, derived from the independent Government cost estimate based on current market rates for the Mission Assurance Engineering BPA (MA Engineering BPA). This initial work was competed using the MA Engineering BPA.

MOD 01: This modification increases the estimated cost of the bridge by $1,857,452 from $929,916 to $2,787,368.

(3) Discussion Regarding Cause of the Limited Source Situation. ID requires an extension to the task order because finalization of the requirements for the long-term, successor contract could not be completed until September 2015. The sole-source situation was caused by changing Government requirements at the highest levels of the DoD. When this occurred, the requirements for the new acquisitions were in final review by ID leadership. Concurrently, the state of the cyber security efforts across DoD were changing based on threats to the DoD network infrastructure. To address these threats, the Secretary of Defense (SECDEF) and the DoD CIO determined a course of action to provide more accurate and on-demand situational awareness to assess and address these new threats. More specifically, the SECDEF and DoD CIO needed a way to produce situational awareness of the security threats on the DoD network infrastructure, and the SCM suite of capabilities were chosen to provide this situational awareness based on the availability of the technologies and capabilities that they provide to DISA and the DoD. These emerging requirements caused a change to the requirements for the SCM systems' follow-on acquisitions. The result was a 3-month delay in finalizing the performance requirements of these efforts, causing the competitive acquisition timeline to be delayed and thus necessitating this logical follow-on to the original order.

(4) Discussion Regarding the Cause of the Limited Source Situation. The technical support services that Foxhole Technologies provides are not unique. The previously conducted market research, which was conducted from December 9, 2014 through

January 13, 2015 and included a sources sought announcement which was verified and updated January 2016, has identified other sources capable of providing the required support services. Those sources are currently being solicited for the new competitive acquisition that is expected is expected to be awarded between March and May of 2016. Foxhole remains uniquely postured to support SCM efforts without interruption. Foxhole understands the requirements and currently possesses the requisite expertise and relevant experience. Any other contractor would, at a minimum, have to first understand the scope of the SCM systems’ highly technical requirements, recruit personnel with specialized qualifications, and be cleared to support the effort before technical support services could continue. This would result in unacceptable delays to the continued support efforts of the SCM systems. The time delay would be 6-8 weeks to get the new contractor on board and transitioned.

The transition includes getting a new vendor familiarized with the current operations of the SCM systems and processing vendor credentials to get Government-furnished equipment and system access to the new vendor. Although this transition time was initially accounted for in the Agency’s advance planning, the unanticipated delays described in the last paragraph that could lead multiple transitions between contractors in a short 2-4 month timeframe was not reasonably expected by the Agency. Furthermore, as a new competitive acquisition has commenced and is expected to be awarded between March and May of 2016, it would not be logical or efficient for the Agency to compete this short 2- to 4-month bridge contract. The potential multiple transitions between contractors in a short time frame of approximately 2 to 4 months would result in multiple setbacks for the Agency. The most efficient strategy for the Agency is to use a logical follow-on to continue support until a follow-on competitive procurement can take place.

(5) Procurement Discussion. This task order was competed and the follow-on is also being competed. This action simply extends the current task order until the competitive follow-on is complete. The Request for Quotes has been issued for the follow-on.

(6) Impact. The USCYBERCOM would lose the ability to evaluate and mandate enterprise patching if the capabilities are not continued, and a break in service would cripple the ability to identify and eliminate network vulnerabilities in a timely manner. Without this capability, it will place our networks at risk and has the potential to impact the support required by the DoD. Also, both ACAS and CMRS would degrade in accuracy over time if service is broken, and the OSD would lose the patching awareness necessary to avoid vulnerabilities that would open our DoD networks to attack.

5. BEST VALUE DETERMINATION: A review of all pricing options has been examined, and it has been determined that the contract extension represents the best value IAW FAR 8.404(d). By extending the current task order using the procedures in Part 8, the ordering activity has concluded that the order represents the best value (as defined in FAR 2.101) and results in the lowest overall cost alternative (considering price, special features, administrative costs, etc.) to meet the Government’s needs. Services offered on the schedule are priced at hourly rates. Foxhole’s labor rates are based on their GSA Schedule 70 rates which were determined to be fair and reasonable. Additionally, the requirement was competed as part of the MA Engineering BPA as well as at task order award, and Foxhole’s quoted rates were discounted from their GSA rates. The contracting officer will evaluate the labor mix, labor categories, and labor hours proposed by Foxhole in comparison to the level of effort and complexity of the requirement outlined in the PWS and will compare rates for similar services to determine whether the prices are fair and reasonable.

Based on the current contract costs and published labor categories and rates for similar services, the contracting officer has adequate information to ensure that the costs to the Government will be fair and reasonable. The contracting officer will determine whether the order represents the best value to the Government by conducting both a technical review and fair and reasonable price determination. A price reduction will be sought IAW FAR 8.405-4.

6. MARKET RESEARCH: A sources sought notice was published on FBO.gov from December 9, 2014 through January 13, 2015. A total of 64 contractors responded to the sources sought. Based on the results of the sources sought and historical knowledge of the current contract, the market research has demonstrated the commercial small business market possesses the required capability and capacity to satisfy the requirements of this effort. Although market research has found other qualified contractors, there is not time to compete this bridge without causing a break in service on the existing support and sustainment of SCM capabilities. The program office is competing the follow-on requirement on the Mission Assurance Software Development Support Services (MASOFTBPA), which is a small business set-aside that utilizes GSA’s Information Technology-70 multiple award schedules.

7. ANY OTHER SUPPORTING FACTS. None.

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE BARRIERS THAT LED TO

THE RESTRICTED CONSIDERATION: The current task order, HC1028-13-A-0013-0004, was competed as a FFP task order. This request is to extend that task order for 2 months with two 1-month options until a new contract is awarded and a transition occurs between the incumbent and the awardee. Prior to the current task order, this effort was performed on task orders HC1028-13-A-0013-0001 and HC1028-13-A-0013-0002.

MOD 01: This modification extends the bridge by an additional 2-month base period and one 3-month option period.

a) Procurement History. The requirement was awarded using full and open competitive procedures under the MA Engineering BPA.

HC1028-13-A-0013-0001 (DoD SCM Operations and Sustainment Support);

awarded July 15, 2013 to October15, 2014; $3,775,518.20

HC1028-13-A-0013-0002 (DoD SCM Code Enhancement Support); awarded July 22, 2013 to October 21, 2014; $8,168,754.60

HC1028-13-A-0013-0004 (SCM Development and Sustainment); awarded October 16, 2014 through January 15, 2016; $14,810,026.00

b) The SCM suite of tools is currently in a recompete situation. Market research was completed to support a full and open competition utilizing the MASOFTBPA. There are six offerors on the MASOFTBPA, all of which are capable of performing the requirements of the SCM and CMRS follow-on efforts. This justification is only to support the brief period between the end of the current task order and the award of the follow-on task orders.

9. REFERENCE TO THE APPROVED ACQUISITION PLAN (AP) PROGRAM PLAN

(PP): IAW the exceptions under DARS 7.103 (S-91)(h) an AP is not required.

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

WILSON.JASON.C.129

Digitally signed by WILSON.JASON.C.1298082582

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

Digitally signed by DUGROO.MARK.E.1257362767 DN: c=US, o=U.S. Government, ou=DoD, ou=PKI, ou=DISA, cn=DUGROO.MARK.E.1257362767 Date: 2016.05.13 12:12:22 -04'00'

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

WILKENS.MATTH

Digitally signed by

WILKENS.MATTHEW.K.1387648522

DN: c=US, o=U.S. Government, ou=DoD, ou=PKI, ou=DISA, cn=WILKENS.MATTHEW.K.1387648522 Date: 2016.05.13 11:22:38 -05'00'

PROCURING ACTIVITY COMPETITION ADVOCATE APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief.

Since this justification does not exceed $13.5M, this review serves as approval and my written determination that the aforementioned FAR circumstances apply.

NAME: Gay Arnold SIGNATURE:

TITLE: PACA/DISA/DITCO DATE: May 13, 2016

ALL QUESTIONS REGARDING THIS MODIFICATION TO THE JUSTIFICATION ARE

TO BE REFERRED TO Matthew Wilkens, 618-229-9456, matthew.k.wilkens.civ@mail.mil.

DUGROO.MARK.E.12

NAME: Jason Wilson SIGNATURE:

DN: c=US, o=U.S. Government, ou=DoD, ou=PKI, 8082582 ou=DISA, cn=WILSON.JASON.C.1298082582 Date: 2016.05.13 12:10:22 -04'00'

TITLE:

Project Manager, SCM

DATE:

May 13, 2016

NAME: Mark Dugroo SIGNATURE: 57362767

Branch Chief, ID5

NAME: MATTHEW K. WILKENS SIGNATURE: EW.K.1387648522

CONTRACTING OFFICER

mailto:matthew.k.wilkens.civ@mail.mil