JA26-048 JA Redacted 05192026.pdf

CUI

Page 1 of 7 Pages

Controlled By: DISA/PSD/PS8311 CUI Category: PROCURE Distribution/Dissemination Control: FEDCON POC: tara.l.horstmann.civ@mail.mil

CUI

JUSTIFICATION & APPROVAL (J&A) FOR FEDERAL ACQUISITION

REGULATION (FAR) SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Schedule/Multiple Award Contract (MAC)

Orders under MAC/ Fair Opportunity – FAR 16.507-6(b)

Purchase Request Number: N/A Contract Number: HC1047-18-D-2004 Task/Delivery Order Number: HC102824F2000 Procurement Title: Public Key Infrastructure (PKI) Modernization

Statutory and Regulatory Authority: 10 U.S.C. 3204(a) and FAR 16.507-6(b)(3)

Exception to Fair Opportunity Number: JA26-048

Upon the basis of the following justification, I, as Procuring Activity Competition Advocate, hereby approve this exception to fair opportunity pursuant to the authority of FAR 16.507- 6(b)(3).

1. REQUIRING AGENCY AND CONTRACTING ACTIVITY:

Requesting Agency:

Defense Information Systems Agency (DISA)/PAE Cyber (ID21) 6910 Cooper Ave.

Fort Meade, MD 20755

Contracting Activity:

DISA/Defense Information Technology Contracting Organization (DITCO)/PS8311 2300 East Drive Scott Air Force Base, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S): The nature of this action is to modify contract HC1047-18-D-2004 task order HC102824F2000. This J&A is to include additional enhancement and support requirements which are necessary for the success of the PKI Modernization program. This task order is a hybrid of firm fixed price (FFP) and cost-plus fixed fee (CPFF) labor which was competitively awarded in March 2024 for a one-year base period with four, one-year option periods and a life cycle value of $78,644,249, inclusive of a 35% surge in the amount of $20,677,758.

Public Key Infrastructure (PKI) Modernization

Page 3 of 7 Pages

CUI

establish additional surge. For this action, an additional 35% surge capability, calculated against the total PQC acceleration costs, were calculated into the total cost of this action. This additional surge is anticipated to address any emergent requirements during task execution without disrupting the critical path.

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity. The order must be issued on a sole-source basis in the interest of economy and efficiency because it is a logical follow-on to an order already issued under the contract, provided that all awardees were given a fair opportunity to be considered for the original order.

(b) Justification.

(1) Description of the Justification and discussion regarding cause of the sole source situation. This level of effort increase is a logical action to the existing task order, as the work being performed under this modification is inherently related to the services already being provided. An increase to the existing order ensures continuity and consistency, as PKI systems require specialized techniques and capabilities.

The PKI Modernization task order already governs the evolution of the platform;

since the DoW CIO’s PQC mandate applies to the entire operational environment, this work is a logical extension of that effort. Incorporating the PQC upgrade under the existing modernization contract, is the most direct path to mitigate risk and ensure a cohesive, secure transition.

(2) Minimum Government requirements. The Government requires achieving full transition to exclusive CNSA 2.0 by 2030 or earlier. To meet this timeline, migration efforts must begin in the third quarter of 2026 and must be tailored to uniquely skip standard migration steps to meet this revised timeline.

(3) Proposed sole source contractor and demonstration of unique source. Issuing the modification to the existing task order is in the best interest of economy and efficiency because it is a logical follow-on to the work already awarded under the task order. The current contractor, BAH, is already deeply integrated into all modernization tasks required for the PKI program. Due to the change in timeline, as directed by DoW CIO, and the existing Red Hat infrastructure within the PKI platform, a unique effort is required specifically from BAH to modernize the platform by migrating directly from current Red Hat Enterprise Linux (RHEL) 7 and RHEL 8 platforms to RHEL 10 which is the initial PQC compliant operating system.

Additionally, the BAH and RedHat partnership is critical to build the new PQC compliant Certification Authority/Directory Server applications and integrate current GOTS code. To achieve this unique migration path, the engineering and consulting

Page 4 of 7 Pages

CUI

expertise from BAH and subcontractor Red Hat is critical to ensure success.

Transitioning to a new contractor would require significant time and resources to onboard, train new personnel, and overcome the learning curve on significant GOTS code repositories, which would disrupt ongoing operations and lead to inefficiencies.

The proposed contractor possesses unique qualifications that make them the only contractor to support the requirements within the timeframe and budget of the PKI program. Their in-depth understanding of the PKI program and specialized expertise in handling similar projects underscore their capability to deliver the required services effectively.

(4) Procurement discussion. The PQC migration is an additional security related modernization effort dictated by the DoW CIO to mitigate an evolving quantum threat to the DoW. This level of effort increase ensures interoperability will be maintained with the accelerated timeline as dictated by DoW CIO (reference DoW memo:

Preparing for Migration to Post Quantum Cryptography, November 18, 2025). Work beyond what was originally proposed must be initiated now to be PQC compliant by 2030 or earlier as opposed to the previous requirement of being compliant by 2035.

Due to this accelerated timeline an unconventional deployment method is required.

The existing PKI platform utilizes Red Hat platforms and products, which is currently running on RHEL 7 and RHEL 8. The program requires a ‘leapfrog’ deployment from RHEL 7/8 directly to RHEL 10 due to being the first PQC capable operating system.

Additionally, new PQC compliant Certification Authority/Directory Server applications will need to be deployed and integrated into current GOTS code. Due to this unconventional deployment method, an integrated approach among the PKI modernization prime contractor, BAH, and its subcontractor for associated PKI platforms and products, Red Hat, is required to complete this work. Other vendors do not have access to Red Hat source code, APIs, or internal workings of Red Hat tools.

To ensure PQC migrations continue without delay, this modification further increases the surge value of the task order. Since unconventional deployment methods will be utilized, it is unknown what other associated tasks or issues may be uncovered, resulting in increased labor efforts. Incorporating additional surge now allows a streamlined contract action authorizing and incorporating unknown tasks associated with PQC migration.

To achieve a transition to exclusive CNSA 2.0 by 2030 or earlier, the work must begin immediately, and BAH engineering and consulting support is required due to the platforms already in place and heavily integrated within the PKI platform. The proposed sole-source modification to the PKI Modernization task order is justified based on the logical follow-on nature of the order, the interest of economy and efficiency, the contractor’s unique qualifications, and the fair opportunity given to all awardees during the original contract award progress.

Page 5 of 7 Pages

CUI

(5) Impact. The PKI portfolio is the mechanism for providing the DoW certificates that support mission critical DoW applications. PKI satisfies the DoW’s Information Assurance requirement for confidentiality and authentication of network transactions, identification and verification of data integrity, and non-repudiation of communications or transactions. As such, is it critical for the PKI portfolio to continue to meet all requirements as dictated by the DoW CIO. If the PKI portfolio does not meet CIO directives, the DoW is at risk for a lapse of certificates utilized by all DoW military, civilian, and contactor personnel, which would lead to an inability to authenticate users to DoW systems. Some of the detrimental effects would include system access denial as users would experience authentication failures to government systems and applications, encrypted emails cannot be sent or decrypted, and digital signatures would become invalid. Additionally, failure to accelerate PQC deployment will place DoW communications, data, and weapon systems at risk as adversarial quantum computing capabilities advance and are able to break today’s PKI baseline.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION: A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the Independent Government Cost Estimate and publicized labor rates and categories necessary to perform the program, as well as other historical pricing for similar services. The contracting office will also review and compare the labor rates to the SETI contract labor rates utilized by the contractor for the initial task order award, which were previously found to be fair and reasonable in a competitive environment.

6. MARKET RESEARCH: Market research was conducted to identify all qualified sources that could potentially meet the Government’s requirements for PKI PQC migration. This research was conducted to ensure that all viable alternatives were considered before deciding to proceed with a sole-source task order modification. Since contract award, BAH has been the prime contractor modernizing the PKI platform. As this work is in process and not yet complete, BAH is the sole contractor with access and knowledge of the partially complete platform modernization efforts. In addition, the components within the PKI platform that require the ‘leapfrog’ migration to meet the CSNA 2.0 revised deadline are primarily Red Hat products with proprietary code requiring BAH’s integrated support with Red Hat engineering and consulting subject matter expertise. As a result, this requirement is identified as requiring sole source support from BAH to satisfy the integral support required by BAH and Red Hat.

7. ANY OTHER SUPPORTING FACTS: None

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History.

(1) Contract Number: HC104718D2004 / HC102824F2000

Contractor: BAH

Page 6 of 7 Pages

CUI

Competitive Status: Full and Open competition on SETI Full and Open Suite, awarded on March 15, 2024

(2) Summary of task order modifications to date:

Mod # Summary of Action Date Lifecycle cost change P00001 Incremental funding April 17, 2024 N/A P00002 Administrative Update May 2, 2024 N/A P00003 Exercise CLIN 0008 August 26, 2024 N/A P00004 Incremental funding November 12, 2024 N/A P00005 Exercise OY1 March 25, 2024 N/A P00006 Incremental funding April 16, 2025 N/A P00007 Incremental Funding April 22, 2025 N/A P00008 Incremental funding June 3, 2025 N/A P00009 De-obligate base year funds June 27, 2025 N/A P00010 LOE increase (surge) July 16, 2025 N/A (surge) P00011 Revised PWS July 23, 2025 N/A P00012 Administrative Update August 19, 2025 N/A P00013 Incremental funds August 27, 2025 N/A P00014 Realign Base year funds September 3, 2025 N/A P00015 Incremental funds September 26, 2025 N/A P00016 Incremental funds October 28, 2025 N/A P00017 Incremental funds December 16, 2025 N/A P00018 Incremental funds February 2, 2026 N/A P00019 Incremental funds February 24, 2026 N/A P00020 Exercise OY2 March 26, 2026 N/A P00021 Incremental Funds April 8, 2026 N/A

(b) An exception to fair opportunity has not previously been accomplished for this requirement.

Upon expiration of this task order, it is anticipated that the requirement will be re-competed via full and open competition or fair opportunity.

Page 7 of 7 Pages

CUI

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Tim Wilson SIGNATURE/DATE:

TITLE/ORGANIZATION: DISA / PAE Cyber / ID21 PKI

PHONE: 667-891-5880

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Michael Merrick SIGNATURE/DATE:

TITLE/ORGANIZATION: DISA / PAE Cyber / ID21 PKI Program

PHONE: 667-891-6971

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: TARA HORSTMANN SIGNATURE/DATE:

TITLE/ORGANIZATION: Chief, DISA Sponsored IT Services

PHONE: 667-891-5369

PROCURING ACTIVITY COMPETITION ADVOCATE (PACA) APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief. Since this justification does not exceed $20M, this review serves as approval and my written determination that the aforementioned FAR circumstances apply.

NAME: ANDREA HORSTMANN SIGNATURE/DATE

TITLE/ORGANIZATION: Procuring Activity Competition Advocate

PHONE: 667-890-0841

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

Rachel Arentsen, 667-891-2971, rachel.l.arentsen.civ@mail.mil