JnA___Castle_Rock___W56JSR-14-D-0004__DO_0011_REDACTION.pdf

JA Control Number: JA-18-E-228 Contractor: Castle Rock Computers, Inc.

Program/Equipment: WIN-T INC 1/INC 2

JUSTIFICATION REVIEW DOCUMENT

FAR SUBPART 13.5 SIMPLIFIED PROCEDURES FOR CERTAIN COMMERCIAL ITEMS –

SOLE SOURCE JUSTIFICATION AND APPROVAL

Program/Equipment: Warfighter Information Network-Tactical /Castle Rock Computers Inc.’s Simple Network Management Protocol Console (SNMPc)

Authority: Simplified Procedures for Certain Commercial Items, 41 U.S.C. 1901 as implemented by FAR Subpart 13.501 - SIMPLIFIED PROCEDURES FOR CERTAIN

COMMERCIAL ITEMS

Amount: $490,030.42

Prepared by: Rashya Jones 443-861-9044 Software Engineering Center (SEC) Date: 21 Feb 2018 Centralized Acquisition License Management (CALM) Team Email: rashya.jones@outlook.com

Procuring Contracting Officer: DSN: 848-4870 Richard M. Newberg Date Reviewed: 02/21/2018 Supervisory Contract Specialist Email: richard.m.newberg.civ@mail.mil

Technical Representative- WIN-T INC 2:

Joseph Jones DSN: 648-5242 Requirements Planning Officer Date Reviewed:

Email: joseph.m.jones146.civ@mail.mil

Technical Representative- WIN-T INC 1:

Maria Miranda 443-395-5250 Requirements Planning Officer Date Reviewed:

Email: maria.m.miranda9.ctr@mail.mil

Requirements Representative:

Peter Bartley 443-861-8371 SEC CALM Team Lead Date:

Email: peter.h.bartely.civ@mail.mil

Reviews: I have reviewed this justification and find it adequate to support other than full and open competition.

Program Manager INC 1: Rocio Bauer DSN: 648-5184 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Program Manager INC 2: Joseph Jones DSN: 648-5242

XXXXXXXXXXXXXXXXXXXXXXXXXX

FAR SUBPART 13.501 SIMPLIFIED PROCEDURES FOR CERTAIN COMMERCIAL

ITEMS – SOLE SOURCE JUSTIFICATION AND APPROVAL

1. Contracting Activity: Army Contracting Command – Aberdeen Proving Ground Div. E 6565 Surveillance Loop, Building 6001 Aberdeen Proving Ground, Maryland 21005

2. Description of Action: The Software Engineering Center in support of the Program Manager Warfighter Information Network-Tactical (PM WIN-T) program requests approval for a Firm-Fixed-Price (FFP) Delivery Order with Castle Rock Computing, Inc.

(CRC), Cage Code (1NH24) for the procurement of CRC’s Simple Network Management Protocol Console (SNMPc) Enterprise Maintenance, SNMPc Online Maintenance and SNMPc WorkGroup Maintenance software support. The North American Industry Classification System (NAICS) code for this acquisition is 511210 – Software Publisher. This set of requirements are sustainment requirements sent to

SEC CALM.

Periods of Performance (PoP) include:

Base 27 March 2018 - 26 March 2019 Option Year 1 27 March 2019 - 26 March 2020 Option Year 2 27 March 2020 - 26 March 2021 Option Year 3 27 March 2021 - 26 March 2022

This effort will be a delivery order against current Indefinite Delivery Indefinite Quantity (IDIQ) contract number, W56JSR-14-D-0004. Fiscal Year (FY) 2018 Other Procurement-Army (OPA) and Operations and Maintenance Army (OMA) funds appropriate to the fiscal year will be used for the delivery order. The total estimated cost of this contract is $490,030.42. The Government projects an estimated award date on or before 27 March 2018.

An acquisition plan is not required because this procurement does not meet the threshold at Defense Federal Acquisition Regulation Supplement 207.103(d)(i)(B).

3. Description of Supplies/Services: The Government uses CRC’s SNMPc software as a secure distributed network management system that allows real-time monitoring of entire network infrastructure. PM WIN-T Increment 1 projects use SNMPc to instantaneously monitor and manage its integrating communications network with a secure distributed network management system capability. The SNMPc Workgroup is designed for single users to manage up to medium sized networks. The SNMPc Online for web-based application allows visibility across entire network infrastructure. The SNMPc Enterprise as the base system allows for a scalable multi-user environment.

The following is a list of the various software licenses support required and the number of users for each type of support. Similarly, the following Programs will also use this product: WIN-T INC 1 Single Shelter Switch version 4 (SSSv4), Tactical Network Management System (TNMS), Signal Modernization (SigMod) and Enroute Mission Command Capability (EMC2).

Description Quantity SNMPC Enterprise License +

Maintenance 33 each

SNMPc Enterprise Maintenance 30 each SNMPC Online License + Maintenance 33 each

SNMPc Online Maintenance 30 each SNMPC Workgroup License +

Maintenance 34 each

SNMPc WorkGroup Maintenance 935 each SNMPC Remote Access Extension

License 33 each

The total estimated price for this effort is $490,030.42.

Delivery Order Period of Performance:

Base 27 March 2018 - 26 March 2019 Option Year 1 27 March 2019 - 26 March 2020 Option Year 2 27 March 2020 - 26 March 2021 Option Year 3 27 March 2021 - 26 March 2022

4. Authority Cited: Simplified Acquisition Procedures for Certain Commercial Items, 41 U.S.C. 1901(a)(2) as implemented by FAR Subpart 13.501(a)(2).

Only One Responsible Source

5. Reason for Authority Cited:

(a) Castle Rock Computing, Inc. 12930 Saratoga Avenue, Saratoga, California 95070 is the developer and proprietary owner of the SNMPc software. The use of a sole source description in this acquisition is essential to PM WIN-T’s requirements, thereby precluding consideration of a product manufactured by another company. The SNMPc software licenses are perpetual software licenses. However, in order to operate the software within the Army program, it must be covered by an active software maintenance support application.

CRC’s SNMPc software was chosen for incorporation into the WIN-T software baseline and changing the software baseline to incorporate another product would not be a trivial effort. WIN-T Systems Engineers evaluated several products to perform network monitoring and reporting. The government determined that the CRC SNMPc software was the only product to meet the functionality/performance requirements and the solution was found to be the most economical and lowest price solution for the government. CRC SNMPc products have been in the WIN-T software baseline since 2004 and replacing the product would require updating the software in over ten thousand vehicles and nodes.

The CRC SNMPc software licenses currently utilized by WIN-T are non-license locked and have been customized by CRC to specifically meet WIN-T requirements and provide additional features and functionality not available in the standard commercial versions, such as: updating the software to meet a DoD security directive to remove password 'copy/paste' feature; adding a multicast tool to support SSH connections to Cisco and Juniper devices; adding the ability to import Army LDIF/ADAM files; adding support for Army IP address spreadsheet import and node listings; creating a Network Setup Wizard, adding Army specific icons; creating an XML based Radio Configuration tool; adding support for unlimited network polling agents; and adding unlimited manager-of-manager levels. The customized Army-only version is not made available to resellers by CRC and consequently is sole source from CRC.

The cause of the sole source situation is the creation of an Army-only version of CRC SNMPc products. CRC sells their standard line of COTS SNMP products through a channel of commercial resellers. However, as WIN-T requirements for new security enhancements and capabilities evolved, CRC began developing product enhancements and additional features for their SNMPc line of products specific to the needs of the WIN-T system. These Army-only part numbers are not made available on the commercial open market and only sold exclusively through CRC to the Army. ***

CRC has included additional product enhancements and features to their SNMPc line of products specific to the needs of the WIN-T system. These enhancements and features are not incorporated within the commercially available products sold through open market competition and are sold to the Army exclusively with specific Army-version part numbers through CRC. Should the WIN-T program attempt to procure the non-Army, fully commercial version of CRC through open market competition, the necessary product enhancements and features that have improved the WIN-T systems will be unavailable resulting in diminished capabilities to the warfighter. The commercial part numbers will not be compliant with DOD security directives to remove password copy/paste functionality from the software applications.

If the source is not limited to CRC SNMPc products, WIN-T fielding will be delayed and the need to perform Engineering Change Proposals (ECPs) to insert a similar suite of products into the software baseline will be required. This process would cost over $2 million, not including replacement licenses, and delay fielding of WIN-T systems up to one year, as well as prevent the warfighter from leveraging the networking capabilities provided by WIN-T both at-the-halt and on-the-move.

CRC has worked with PM WIN-T to develop a “Military site licensing” version of the commercial SNMPc products which alleviates the need for a different license key for every workstation, as is required for use of the Commercial-Off-The-Shelf (COTS) version of this software. Tracking every workstation license key for update and renewal purposes would be an excessively cumbersome task for the Army. Replacement of the SNMPc products from the PM WIN-T software baseline would result in extensive developmental efforts to re-engineer the PM WIN-T’s software components, followed by production and certification testing efforts. This would result in substantial delays of 12- 18 months in fielding PM WIN-T software. Additionally, this would result in duplication of cost of at least $17.2M that would not be recovered through completion. Failure to acquire the software licenses and associated maintenance will result in an inability to field software required for the PM WIN-T until new network management products are completely tested and the software is recertified by the Joint Technical Integration Center. This would reduce the availability of valuable intelligence information to battlefield commanders, which could result in serious injury or loss of life to Warfighters.

The additional time and cost to re-engineer the PM WIN-T baseline is estimated at 18 months and $17.2M. These duplicative cost will not be recouped through competition.

[K = thousand, M = million]

Re-engineering Cost Calculator

Engineering 10.922 M Configuration Management 0.86 M Engineering Verification & Validation 1.72 M Information Assurance 0.688 M Integration 0.688 M Independent Verification & Validation 0.86 M

IAVA 0.688 M

DAMI GE Certification 0.43 M Fielding and Support 0.344 M

Total Estimated Cost of Re-Engineering effort 17.2 M

(b) Alternatives. There are other products that offer SNMP monitoring and management, however WIN-T Increment 1 is fully fielded with CRC’s SNMPc and WIN- T Increment 2 has purchased SNMPc for 20 of 56 Brigades projected to be fielded.

Releasing a Name Brand or Equal Solicitation would be a wasted effort since PM WIN-T has no current desire or funding to purchase new licenses and perform the non-recurring engineering associated with changing the WIN-T software baselines if a similar product were selected. If this occurred, it's likely that units fielded with WIN-T may purchase the CRC software on their own as they did in the early 2000s when HP Openview and What's Up Gold were provided for NetOps monitoring and management.

Units would purchase and deploy Solarwinds and Castle Rock products on their own since they weren't happy with the solutions provided by PM WIN-T. Without CRC SNMPc maintenance, we would not obtain major version updates and security patches, which could jeopardize the ATOs of WIN-T systems if a vulnerability is found that cannot be mitigated.

CRC has included additional product enhancements and features to their ARMY version of SNMP products specific to the needs of the WIN-T system. These enhancements and features are not incorporated within the commercially available products sold through open market competition and are sold to the Army exclusively with specific Army-version part numbers through CRC. Should the WIN-T program attempt to procure the non-Army, fully commercial version of CRC through open market competition, the necessary product enhancements and features that have improved the WIN-T systems will be unavailable resulting in diminished capabilities to the warfighter.

This Military version eliminates the need for a different license key for every workstation, as is required for use of the Commercial-Off-The-Shelf (COTS) versions of this software; has enhanced up to date security features required by Army regulations to be used on Army systems and internet applications; and has a few interface capabilities that are only required for interoperability on ARMY programs. The commercial part numbers will also not be compliant with DOD directives to remove password copy/paste functionality from software.

6. Efforts to Obtain Competition: The Contracting Officer will publish the notices required by FAR 5.201 and any bids or proposals received will be considered.

a. Effective Competition: Based on the information in paragraph 5 above, this is a Sole Source requirement, effective competition is not feasible.

b. Subcontracting Competition: This is a sole source proprietary commercial-off-the-shelf product line and CRC wants to keep the product line proprietary.

7. Actions to Increase Competition: SEC CALM performs market research on all new requirements each year to verify who owns the licenses and software support rights, who can supply the product(s) to the Army and if there are any alternate sources of supply or COTS products.

CRC has confirmed that the requirement(s) are commercial-off-the-shelf products that can only be purchased directly from CRC and that CRC does not use authorized resellers.

8. Market Research: Market research was performed by the technical experts from the SEC CALM team during the month of February 2018 with the intent to increase competition by finding alternative products, by increasing the number of authorized distributors, by increasing participation by small businesses, small disadvantaged small business, HUBZONE, Service Disabled Veteran Owned, and Woman Owned Small Businesses and or to find companies that could provide CSC’s commercial SNMPc products or alternative COTS software products.

SEC CALM reviewed Federal Service Schedule contracts, Government wide acquisition contracts, multi-agency contracts, and any other procurement instruments intended for use by multiple agencies, including blanket purchase agreements (BPAs) under Federal Supply Schedule contracts for potential sources or alternates to CRC’s SNMPc.

Searches for the CRC SNMPc on the Army Computer Hardware Enterprise Software Solutions (CHESS) (Ref # 231200) website resulted in a Statement of Non-Availability, Number 216730745, dated 20 February 2018 being issued for this requirement.

On 14 February 2018, Requests for Information (RFI) were submitted to the General Services Administration (GSA) Advantage (RFI # 1266224) and the National Aeronautics and Space Administration (NASA) Solutions for Enterprise Wide Procurement (SEWP) (RFQ #82209) websites requesting price and availability for SNMPc Workgroup; SNMPc Online for web-based application; and SNMPc Enterprise as the base system from any vendor or alternate COTS products developed by other companies. No responses were received to the postings on either of the websites.

Additional market research was performed by ACC-APG SEC CALM in the month of July, 2017. On July 19, 2017, Requests for Information (RFI) were submitted to the General Services Administration (GSA) Advantage (RFI #12144898) and the National Aeronautics and Space Administration (NASA) Solutions for Enterprise Wide Procurement (SEWP) (RFQ# 66486) websites requesting price and availability of CRC’s products or alternate COTS applications from other companies. No responses were received to the postings on either of the websites.

ACC-APG did post a redacted justifications on FedBizOps after the award W56JSR-17- P0020 in September 2017. No responses were received.

ACC-APG posted a sources sought on FedBizOps seeking price and availability of SNMPc Workgroup; SNMPc Online for web-based application; and SNMPc Enterprise as the base system in early February 2018 for 10 business days for another new requirement package with different delivery dates to be awarded on IDIQ W56JSR-14- D-0004 Delivery Order 0010 in early March 2018. To date there have been no responses.

CRC was contacted for pricing and a list of authorized resellers for its software. CRC provided a letter dated 15 February 2018 stating, “Please accept this letter as confirmation that the ‘Military’ version of SNMPc is only available for purchase directly from Castle Rock Computing Inc.” This Military version eliminates the need for a different license key for every workstation, as is required for use of the Commercial-Off- The-Shelf (COTS) version of this software. The SEC CALM team has determined that the CRC software maintenance is still a COTS product / service. This requirement has been acquired through sole source acquisitions since at least 2006. A redacted justification from PO W56JSR-17-P-0020 was posted on FedBizOps and no replies have been received.

The SEC CALM team has determined that the CRC software maintenance is still a COTS product / service. This requirement has been acquired through sole source acquisitions since at least 2006. Redacted justifications from previous contracts have been post on FedBizOps and no replies have been received.

Based on the research above, no other alternate software developers have shown an interest in providing CSC’s SNMPc product line.

Further investigation into alternate COTS software products was done and the following web based article was found http://www.infoworld.com/article/2609445/data-center/snmp--no-one-likes-it--yet-no-one-cares-to-replace-it.html on July 27, 2017.

“Tools like NetConf (Network Configuration Protocol) and YANG exist as alternatives to SNMP, but they're relatively new and so far largely ignored. NetConf, an XML-based network management protocol first developed in 2006, allows for content, operations, and RPC data to be sent and received from compatible software via BEEP, SSL, SSH, and console connections. As an example, you could construct an XML request for a router to return its current running configuration, which would be delivered via XML, or you could issue commands to the device via other XML-based communication. YANG is a language designed to model the data for NetConf and provide for a more human-readable interface. Between the two, we see a new method for controlling networked devices that is an improvement to managing those devices via SNMP.

The problem is that NetConf was never intended to be a replacement for SNMP;

members of the IETF NetConf working group stated exactly that. The fact that it can perform most or all of the same tasks as SNMP is largely immaterial if it's not geared toward eventually supplanting SNMP itself. If anything, NetConf is aiming more toward replacing the command-line interface than anything else. Even in that regard, it's not widely used or supported. Only a handful of vendors provide NetConf support, and even though that includes Cisco, the support is generally subpar, most likely due to lack of interest.” NetConf is aimed toward replacing the command-line interface. Members of the IETF NetConf working group stated that NetConf was never intended to be a replacement for SNMP software. It can perform most or all of the same tasks as SNMP.

At present NetConf is not fully comparable to SNMP. Another issue is that NetConf software is not well support as only a handful of vendors provide support and the support is generally considered to be subpar.

For the above reasons, NetConf is not an acceptable CRC SNMPc alternative COTS software application for the Army.

9. Interested Sources: To date, no other sources have written to express interest in the acquisition beyond the vendor listed in paragraph 8.

10. Other Facts:

a. Procurement History:

Contract Number Contractor Award Date Extent Competed/Authority W56JSR-17-P-0020 Castle Rock Aug 2017 Sole Source/FAR 6.302-1 W56JSR-14-D-0004 0008 Castle Rock Aug 2017 Sole Source/FAR 6.302-1 W56JSR-14-D-0004 Castle Rock Aug 2014 Sole Source/FAR 6.302-1 W15P7T-13-D-E041 Castle Rock Sept 2013 Sole Source/FAR 6.302-1 W15P7T-12-D-C942 Castle Rock Sept 2012 Sole Source/FAR 6.302-1 W909MY-11-C-0091 Castle Rock Sept 2011 Sole Source/FAR 6.302-1 W909MY-08-D-0003 Castle Rock June 2008 Sole Source/FAR 6.302-1 W909MY-07-P-0018 Castle Rock Aug 2007 Sole Source/FAR 6.302-1 W909MY-06-P-0046 Castle Rock Sept 2006 Sole Source/FAR 6.302-1

b. Market research from contract W56JSR-14-D-0004 0007:

The Software Service Support (S3), Centralized Acquisition and License Management (CALM) team conducted market research for the procurement of Castle Rock Maintenance during the month of March 2014. This market research consisted of the following activities: 1. Reviewed the U.S. Army Computer Hardware Enterprise Software & Solutions (CHESS) and the Enterprise Software Initiative (ESI) website. No results for CRC SNMPc Workgroup license and maintenance, CRC SNMPc Online license and maintenance, CRC SNMPc Enterprise license and maintenance, or CRC SNMPc Remote Access Extension license were found on either catalogue. CHESS provided approved Statement of Non Availability (SoNA) (#216653245).

- Coordinated with the manufacturer of the software product to determine if there are authorized resellers and requested a listing of all known resellers. It was determined that the product is only sold through the manufacturer and a quote was requested.

- Surveyed NASA SEWP, the Enterprise Software Initiative (ESI), and GSA

Advantage for the maintenance items. A query of CHESS and GSA Advantage, and NASA SEWP yielded no listings for the software.

11. Technical Certification: I certify that the supporting data under my cognizance that are included in this justification are accurate and complete to the best of my knowledge and belief.

Technical Certification- WIN-T INC 1:

XXXXXXXXXXXXXXXXXXXXXXXX

Technical Certification- WIN-T INC 2:

XXXXXXXXXXXXXXXXXXXXXXXX

12. Requirements Certification: I certify that the supporting data under my cognizance that are included in this justification are accurate and complete to the best of my knowledge and belief.

XXXXXXXXXXXXXXXXXXXX

Team Lead

13. Fair and Reasonable Cost Determination: I hereby determine that the anticipated cost or price to the Government for this contract action will be fair and reasonable.

This determination will be made using the following: (XXX) Price Analysis: ( ) Cost Analysis; ( ) IGCE; ( ) audit ( ) other

As a part of this basis, certified cost or pricing data is not required because the item and / or services being acquired are considered commercial.

XXXXXXXXXXXXXXXXXXX

Contracting Officer

14. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

XXXXXXXXXXXXXXXXXX

Contracting Officer

Acquisitions under the $700,000.00 threshold do not require legal and competition advocate review and can be approved by the Contracting Officer.