JEFO IACS (v4).pdf

Justification for Exception to Fair Opportunity

JEFO No. FY20-00332

JEFO No.: FY20-00332

Date: September 22, 2020 PR Number: RUIO-20-S0043

1. Agency and Contracting Activity.

The Department of Homeland Security (DHS), Office of Procurement Operations (OPO), Information Technology Acquisition Center (ITAC) prepared this justification for an exception to fair opportunity.

2. Nature and/or description of the action being approved.

DHS/OPO intends to award a sole source task order without considering other awardees under the General Services Administration (GSA) Alliant 2 Indefinite Delivery Indefinite Quantity

Contract (IDIQ) 47QTCK18D0035 pursuant to FAR 16.505(b)(2)(ii)(B).

3. A description of the supplies or services required to meet the agency’s need (including the estimated value).

In September of 2012, following completion of a competitive acquisition for a Governance, Risk, and Compliance solution, the Department of Homeland Security (DHS) purchased and deployed an enterprise risk management application suite named Xacta IA Manager (XIAM) and implemented the applications as part of the Information Assurance Compliance System

(IACS) and the Classified Information Assurance Compliance System (CIACS) to automate security authorization and risk reporting. The IACS and CIACS operate as the systems of record for DHS information systems security authorization and weakness remediation management and are therefore mandated for use by all DHS Components per DHS Policy

4300A for sensitive but unclassified systems or DHS Policy 4300B for national security systems. The IACS and CIACS provide DHS the ability to manage and support Federal

Information Security Management Act (FISMA) and DHS risk management and reporting requirements. The IACS and CIACS also provides a means for tracking the effectiveness of

IT security programs across the Agency. Since implementing XIAM within IACS and CIACS in 2012, DHS has upgraded some XIAM applications to newer Telos Xacta IA products.

Hereinafter Xacta IA products implemented within IACS and CIACS shall be referred to as

XIAM. The Telos Corporation is the developer of the XIAM application suite and has proprietary rights to this software code and database schemas.

This procurement supports the need for on-site technical support capable of providing application engineer level support and annual maintenance subscriptions of the XIAM applications. At the time of this procurement, Telos is the only vendor able to provide application engineer level technical support with access to and knowledge of the Telos proprietary software code and database schemas. Telos is also the only vendor able to provide the application maintenance subscriptions for the XIAM application suite.

The task order will include a one-year maintenance subscription for Xacta 360 with perpetual software license for unlimited projects/systems (CLIN 0003), a 6 month base period of performance for onsite support services for Xiam from date to date (CLIN 0001), and 6 month option period for the onsite support services for Xiam from date to date (CLIN 0002). The estimated value for this effort is $1,388,728.80.

Base and Optional (CLINs) estimated value:

CLIN 0001: $619,328.40

CLIN 0002 (Optional): $619,328.40

CLIN 0003: $150,072.00

4. Identify the exception to fair opportunity and supporting rationale, including a demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the exception cited.

FAR 16.505(b)(2)(i)(B) Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

Telos is the developer and manufacturer of Xacta Information Assurance Management

(XIAM) application suite. Telos is the only vendor with application engineering level access to the proprietary software code and database schemas. No other vendors are authorized to provide annual maintenance for these products.

The Telos XIAM suite is developed and maintained solely by the Telos Corporation; Telos does not utilize any other vendors to provide this support. Each member of the Telos team is specially trained on the XIAM software suite and has a direct reach back capability to the

XIAM Subject Matter Experts and development team. As the manufacturer of the tool, Telos staff is competent in the custom development of advanced Security Authorization (SA) artifacts such as the System Security Plans, POA&M Reports, and Security Assessment

Reports using the XIAM Extensible Publishing to reflect DHS specific formats. Telos, as the manufacturer of XIAM is the sole developer of workflow templates for customers using Xacta and has built a team of experienced staff that can efficiently develop and deliver workflow and regulatory changes such as NIST 800-53 Rev 4 and FEDRAMP updates. Further, Telos has experienced Database Administrators with access to the proprietary software code and schemas of the XIAM products. The administrators are proficient in designing interfaces and integrations with existing databases, for advanced reporting purposes, while no other vendor has these capabilities. These capabilities are all essential during critical software upgrades, workflow updates, and the development of software enhancements to meet evolving DHS and component’s needs. Telos personnel also have working relationships with the teams supporting XIAM implementations at several other customer sites to leverage lessons learned and best practices.

The Telos team is able to quickly provide surge support when necessary during transitional periods (e.g. transition of all FISMA systems from NIST 800-53 Rev 3 to Rev 4. This was demonstrated when Telos provided a member of the development team full time for a period of six months to assist with the IACS migration from Trusted Agent FISMA to XIAM. The

Telos team designed and deployed a custom migration utility to automate the transition, and the IACS migration was successfully completed within the required timeframe. In addition, Telos has a regulation content team fully dedicated to maintaining the NIST 800-53 control set within XIAM and align this to the DHS 4300A and 4300B and assist with regulation upgrades when necessary.

The Telos software suite tool supports all of DHS’ required compliance documents as well as

Section 508 reporting needs. DHS and other Federal Agencies are preparing for the release of

NIST Special Publications 800-53 rev 5 and 800-53a rev 5. Adapting workflows and documentation to expected changes in a timely manner will require software specific application engineer level support.

5. Determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

The contracting officer has determined that issuing the proposed Task Order to Telos for XIAM software services represents the best value and will result in the lowest overall cost, considering price and administrative costs, to meet the Government’s needs. This task order will be placed in accordance with FAR 16.505 Ordering procedures.

The General Services Administration (GSA) has already negotiated fair and reasonable pricing on the Alliant 2 IDIQ contract. Discounts to the IDIQ contract rates will be requested.

Additionally, during evaluations, the ordering activity will consider the level of effort and the mix of labor proposed to perform the specific tasks being ordered in order to determine that the total price is reasonable. The contractor’s labor mix and level of effort will also be compared to the Government’s Independent Government Cost Estimate (IGCE). In addition, the prices will be compared to prior prices paid for the same or similar services and supplies.

6. Any other facts supporting the justification.

None.

7. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made.

Since the award of the base contract in 2012, there have been three prior sole source awards to

Telos. DHS currently is reviewing alternatives to the Telos XIAM Suite. Potential alternatives under review include the transfer of the information and processes accomplished by XIAM to existing Government software applications, the use of competitive contracting procedures for a revised requirement, the use of other authorized methods available to the

Government, the elimination of the requirement, or some combination thereof. Once the review is complete and an alternative is selected, DHS will transfer the information and processes accomplished by XIAM to the other application(s). XIAM as it is currently deployed in DHS will be retired once research, validation of the requirements, an alternative is identified, and the alternative is implemented such that it will not impose information security risks to DHS.

8. DHS intends to post this requirement on beta.SAM.gov pursuant to FAR 16.505(b)(2)(ii)(D).

9. Technical/Requirements Personnel Certification:

Pursuant to FAR 16.505(b)(2)(ii)(B)(9), I certify that this requirement mees the Government’s minimum needs and that the supporting data, which form a basis for the justification, are accurate and complete.

Kimberly Joy

Technical Representative/COR

COR Supervisor

10. Certification:

Pursuant to FAR 16.505(b)(2)(ii)(B)(8), I certify that this justification is accurate and complete to the best of my knowledge and belief.

Randy Dreyer

Contracting Officer

11. Approval:

Pursuant to FAR 16.505(b)(2)(ii)(B)(10), I hereby determine that the circumstance in FAR

16.505(b)(2)(i)(B) applies.

Juan Arratia

Procuring Activity Advocate for Competition