JnA FAR Part 16 SIVM Extension redacted for FBO.pdf

SECTION I: Introduction

The Transportation Security Administration (TSA), Contracting and Procurement (C&P) and Information Technology (IT), Information Assurance and Cybersecurity Division (IAD) proposes to enter into a contract extension on task order number, HSTS03-17-J-CIO451 on a basis other than full and open competition.

The procurement request numbers are 2120200CIO203 and 2120200SVP153; C&Ps Justification and Approval (J&A) tracking number is JA-2020-03-0478.

Per FAR 16.505, this acquisition is conducted under a multiple award contract.

SECTION II: Description of Action Being Approved This effort is to continue IAD providing enterprise-wide security oversight, guidance, reviews, and evaluations for the TSA IT infrastructure security services necessary to protect and maintain the availability, integrity and confidentiality of TSA information technology enterprise from malicious cyber-attacks. This extension is required in order that IAD continue to have the ability to ensure the continued execution of TSA’s IT/IAD mission while combating the ever evolving cyber threats, challenges, and agency obligations to comply with the Department of Homeland Security (DHS), Office of Management and Budget (OMB), and other federally driven IT Security laws, regulations and policies.

(a) TSA intends to procure on a sole source basis, an extension of task order number HSTS03-17-J-CIO451 for

Secure Infrastructure and Vulnerability Management Services (SIVM), in order to meet the TSA security mission mandated by the Aviation and Transportation Security Act (ATSA), and Federal Information Security Modernization Act (FISMA 2014). The proposed period of performance of this extension will be 8-months beginning on May 20, 2020 until January 19, 2021. Additionally, there will be one 2-month option period to be used only as a contingency. The total period of performance for these extensions if all options are used will be May 20, 2020 through March 19, 2021.

(b) The contractor is Dynamic Security Concepts, Inc. (DSCi), 1037 Morningside Mays Landing, NJ 08330-1937

(c) The contract type is Firm Fixed Price (FFP).

(d) The estimated total value, of this J&A includes the initial 8-month extension and one 2-month option period, is $12,131,363.73, which is shown in Table 1.

Table1: Total Estimated Value

Period Months Total Extension 8 mo $ 9,811,146.50 Extension – Option Period 1 2 mo $ 2,320,217.22 Total $12,131,363.73

The period of performance includes a 120-day transition out period necessary to provide continuous, uninterrupted infrastructure security services of TSA IT enterprise. A no-cost termination for convenience will also be included in the extension in the event the total period of performance is not required.

FAR Part 16 Justification Exception to Fair Opportunity

(e) The type of funding is appropriated funds and fee funds. Appropriated funds are coming from IAD and fee funds are coming from Enrollment Services Vetting Program (ESVP).

(f) Fiscal Year 2020/2021 funds will be used.

(g) The extension of services does not change the scope of technical work to be performed; however, the number of taskings/transactions coming from ESVP has increased. The Contracting Officer (CO) intends to verify a continuation of services at the same firm fixed price monthly amount billed under the current option year with consideration for normal escalation and the increase for ESVP.

(h) Background: In late FY18 the TSA Administrator published his strategy that identified priorities and goals designed to further enhance transportation security. The IT Cybersecurity Division working with the SIVM contractor DSCi, supported these new cybersecurity requirements by shortening Option Year 3 from nine to six months in order to afford increased contractor resources to be able to support the additional testing requirements that directly impact TSA’s aviation and IT security mission. Additionally, IAD’s personnel incurred even more enterprise wide cybersecurity oversight requirements that created significant modifications to IAD’s testing schedule to accommodate security engagements, such as:

• A security evaluation of the Known Crew Member (KCM)system; an IT system not maintained by the TSA and therefore not a typical asset requiring security testing by the TSA. However, in order to ensure TSA’s mission of airline security, the TSA Chief Information Security officer (CISO) required that this IT system receive security testing & evaluation performed by the TSA.

• The requirement from DHS that Components remove all IT assets from the DHS datacenter 2 (DC2). This requirement has caused numerous applications that had been hosted within that datacenter to be migrated to different IT hosting platforms. This change in hosting platforms necessitated IAD to perform additional security testing & evaluation engagements of those applications to ensure no cybersecurity issues were introduced due to the change in hosting platform.

• Significant changes in the proposed direction for the migration of TSA’s primary Human Capital support system: HR Access. Due to proposed changes to the IT architecture, the need to provide security assurance for TSA Personally Identifiable Information (PII) data being transitioned from a contractor-hosted datacenter to a TSA-hosted datacenter, and ad-hoc security evaluations required of IT system components, an influx of unanticipated testing engagements was required to be supported.

The shortening of the Period of Performance of Option Year 3, increase in tempo causing IAD’s testing schedule changes to accommodate security engagements, coupled with some IT project schedules experiencing delays, has caused a ripple effect where the current DSCi contract would end prior to the completion of all the projects that DSCi has been supporting.

SECTION III: Description of Supplies or Services The Contractor will continue support the delivery of IT security services necessary to protect and maintain the availability, integrity and confidentiality of the TSA information and information systems allowing the continued connection of existing TSA IT systems and the integration of new leading edge technologies into the TSA enterprise.

SECTION IV: Identification of the Exception to Fair Opportunity Rationale

FAR 16.505 (b)(2)(i)(A) The agency need for the supplies or services is so urgent that providing a fair opportunity would result in unacceptable delays.

FAR 16.505 (b)(2)(i)(B) Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized

FAR 16.505 (b)(2)(i)(C) The order must be issued on a sole-source basis in the interest of economy and efficiency because it is a logical follow-on to an order already issued under the contract, provided that all awardees were given a fair opportunity to be considered for the original order

FAR 16.505 (b)(2)(i)(D) It is necessary to place an order to satisfy a minimum guarantee

FAR 16.505 (b)(2)(i)(E) For orders exceeding the simplified acquisition threshold, a statute expressly authorizes that the purchase can be made from a specified source.

Original Order Number: HSTS03-17-J-CIO451________________________

SECTION V: Description of Fair Opportunity Exception Rationale The shortening of the Period of Performance of Option Year 3, to accommodate the increase in tempo for IAD’s testing schedule, decreased the time to complete award of the follow-on competitive procurement, providing for sufficient transition time. IT and C&P considered competing a procurement action based on using requirements from the prior competition but determined the risk of two contractor transitions within an 18-month period to be unaffordable given reduced IT funding in FY20 and FY21.

Considering the current Cyber threats to public and private information systems and the devastating impact a security intrusion could have to TSA critical IT network infrastructure at this time, TSA cannot accept the risk associated with a lapse in service or a new contractor with no Transition-In period of performance. Without immediate SIVM support, could pose a threat to the TSA mission if left unmanaged. Without the additional SIVM and cybersecurity support resources, will be leaving the agency unable to address security vulnerabilities, and meet obligations to comply with the DHS, OMB, and other federally driven IT Security laws, regulations and policies. This extension is required in order to provide continuous, uninterrupted cybersecurity infrastructure and vulnerability support services in protecting the TSA IT infrastructure.

The escalating nature of cybersecurity requirements, threats have intensified and new programs across TSA has more than doubled from the original contract estimates of cybersecurity services requirements. Without the ability to increase ceiling of the contract, the only viable option was to shorten the period of performance and increase the tasking’s within the available funding.

Additionally, the Administrator’s priorities and strategic vision to improve security and safeguard the transportation system has continued to put an additional emphasis and expanded need for IT security support services. TSA has awarded new contracts in the last year supporting TSA Pre check, Human Capital Modernization, and accelerating deployment of Credential Authentication Technology (CAT) and Computed Tomography (CT) units to the airports.

However, all of these projects would suffer significant delays and have an adverse effect on TSA operations if the SIVM task order was to lapse. Specifically;

• TSA would be unable to comply with the TSA Administrator’s priority for increasing the number of vendors supporting TSA’s Pre-Check vetting services in an effort to expand and expedite TSA’s Pre-Check services to the traveling public. Specifically, the IT networks of these potential vendors must be evaluated to ensure the cybersecurity protections are sufficient to protect the personal information of the flying public and to provide the TSA assurance in the confidentiality, integrity, and accuracy of data provided by the vendors in support of Pre-Check services. Without this security validation, new Pre-Check vendors cannot be used.

• The security authorizations for two of TSA’s major mission-focused IT systems (Secure Flight and Mission Scheduler Notification System (MSNS)) would not be completed in time to renew their Authority to Operate (ATO). If the security testing and evaluation for these IT systems aren’t completed on time, it could require that these systems be temporarily disabled which would cause major service disruptions to the TSA’s primary security mechanisms for the flying public.

• The security accreditation for the new TSA HQ facility would not be completed in time to meet the migration dates for HQ personnel to transition to the new HQ facility. Without the security accreditation, no IT networking equipment would be permitted for operation at the new HQ facility. In turn, this would likely require the TSA to extend its existing lease for the current HQ facility causing additional, and potentially significant, financial cost to the TSA.

This contract extension is required in order to overcome the challenges imposed by the requirements to perform unforeseen security testing engagements of new systems (such as KCM), and to account for last minute slippage of implementation dates for major IT project implementations (like the new TSA HQ). This extension is critical to allow TSA to successfully execute a competitive award of the follow on contract. This new contract is being structured with increased level of effort, allowing for the addition of fee-funds to support new TSA credentialing programs and flexibility in the ability to accommodate for new technologies and tasks within the technical scope as they emerge during the life of the contract.

This proven performance and extensive knowledge positions DSCi as a cost efficient, low risk and high performance choice to execute these TSA IT cybersecurity requirements. Although another contractor could acquire the same or similar knowledge of the complex TSA IT systems and infrastructure, no other contractor can fulfill the immediate need as required and TSA cannot afford the time to support a new contractor learning curve. A transition to a new contractor to support these tasks would require at least four (4) months of performance in order to learn and understand the complex TSA IT infrastructure, how it operates, and where vulnerabilities might exist. Without a contract extension, there will not be a sufficient transition period (and knowledge transfer) and a potential lapse in service. This is compounded in the anticipated delays in personnel security approvals during onboarding and ramp up in services (TSA Personnel Security (PerSec) office timeline of roughly four (4) months to successfully adjudicate personnel being on boarded under the required security clearance requirements for the follow-on awardee).

Given the noted ramifications, it is imperative TSA sustain uninterrupted contract services to avoid unacceptable project delays. Extending the current contract with DSCi will provide the TSA with the greatest likelihood for timely completion of the noted TSA critical projects and avoids interruption to scheduled security practices that protect the integrity, confidentiality and availability of TSA information systems.

SECTION VI: Contracting Officer’s Determination that the Order Represents the Best Value The Contracting Officer shall, through negotiation, process and pricing determine that pricing of the extension to the DSCi task order under the DHS contract is to be fair and reasonable before the contractor is authorized to incur any expense toward supporting the proposed requirements needed. Further, the CO anticipates price(s) will be based on historical firm-fixed pricing utilizing the current task order’s monthly burn rate.

SECTION VII: Market Research Description The current task order award HSTS03-17-J-CIO451 was made off of the DHS Enterprise Acquisition Gateway for Leading- Edge Solutions II (EAGLE II) multiple award contract vehicle one of the DHS strategic sourcing vehicles that are mandatory for use, mandated by DHS Directive 060-01. No further market research was performed for this extension for the following reasons:

• This current and ongoing requirement with a necessity for this extension with the current contractor providing services under this task order. This request is to continue critical services only until a new contract is awarded and transition is completed.

• The current task order, to which this extension will be applied, had market research performed leading up to the award; and

• The market research for the current task order still holds true for this extension, specifically:

o DHS Directive 060-01 still mandates use of EAGLE II;

o Extending the current task order would not exceed the expiration dates available within EAGLE II;

(September 2021) o DSCi remains capable of providing support under EAGLE II Functional Category 3; and o DSCi continues to provide contractor support within the required EAGLE II Labor Categories necessary to meet the requirements identified within this extension.

SECTION VIII: Other Facts Supporting the Fair Opportunity Exception Justification This requirement supports the secure implementation of technologies for critical TSA projects.

Service providers other than DSCi would be required to re-perform all of DSCi’s work in order to ensure their staff have the requisite knowledge of the IT environments of these projects. Re-performance of these preparatory activities, further exacerbated by the need to perform contract transition activities (which would include vetting by PerSec, obtaining of TSA network credentials, and administrative access to the above project IT environments), would prevent successful completion of IAD’s support for these critical projects to meet required deadlines for these projects supporting functions which are mission-critical to the TSA.

Furthermore, the cumulative pressure of TSA’s critical projects listed in Table 2 is greater than the sum of its parts. All seven critical projects are subject to their own unique scheduling pressures. Schedule or resource changes in any one critical project impacts IAD’s capacity to provide support to the other critical projects. The current service provider has proven through the duration of the current contract to have the flexibility and adaptability to accommodate fluid schedules to bring the talent necessary to bear on the challenges at hand. Any interruption to the currently available talent, or the management of that talent, increases risk to all of the IT-dependent critical projects in Table 2.

SECTION IX: Actions Taken to Remove Barriers to Competition While IAD’s current critical testing tasks require the retention of the existing contractor for successful completion, IAD is preparing for a competitive follow-on procurement to obtain SIVM services to begin after this contract extension. This will provide IAD with the means of succeeding at the current testing requirements and allow the new awardee to provide IAD with support for subsequent tasks.

The new Request for Proposal (RFP) will be released in June 2020 with award date in November 2020. The period of performance for the follow-on procurement is anticipated to begin in the first month of the Second Quarter of Fiscal Year 2021, after transition. Additionally, IAD will be arranging testing tasks that will be scheduled beyond the dates of this extension to enable full execution by the awardee of the follow-on procurement. IAD is currently planning on leveraging the CIO-SP3 Small Business (Task Area 7 – Critical Infrastructure Protection and Information Assurance) vehicle for award of the follow-on procurement.

High-level milestones for the follow-on competitive procurement are as follows:

Activity Target End Date

PSR 5/25/2020

SRB 6/8/2020

Acquisition Plan (Appendix Z) 6/8/2020

RFP 6/15/2020

Proposal Due date 7/9/2020 Evaluations 7/23/2020 Pre BCM - HCA Approval 8/19/2020 Revised Proposal Due 9/10/2020 Evaluations/Consensus/SSA 10/9/2020 Post BCM - HCA Approval 11/6/2020 Congressional Notification (5 day period ends 11/13/2020)

11/13/2020

Award *** Target is 2 months before deadline for transition of services 11/16/2020

IAD and C&P have determined that the above timeline is so tight that additional Option Periods were required to be added to the extension in order to ensure adequate time for a follow-on awardee to perform transition services with the incumbent, adjudicate all personnel through the TSA Personnel Security Office for the required security clearance, while maintaining current operations under the existing contract. The milestones above are the intended milestones for the follow-on award but are subject to fluctuate for a number of reasons outside of the Contracting Officer’s control. As such the additional one 2-month Option Period assures IAD that sufficient safeguards have been put in place with the timeline of this extension J&A to support the ongoing and future procurement activities that are running parallel to each other.

SECTION X: Contracting Officer Certification I certify that this information is accurate and complete to the best of my knowledge and belief.

Marlene Kratz

Name (Printed) Signature Date SECTION XI: Technical or Requirements Personnel Certification I certify that this requirement meets the Government’s minimum need and that the supporting data, which forms a basis for this justification, is complete and accurate.

Carey Inman

SECTION XII: Concurrence and Approval The required levels of concurrence and approval of this Limited Sourced Justification depend on the estimated total value of the procurement. Concurrence and approval must be obtained for that level and each previous level.

Estimated Procurement Value:

$2,000 and greater for Construction

$2,500 and greater for Services $10,000 and greater for Supplies

Concurrence:

Program Manager:

David Hentz

Name (Printed) Signature Date Acquisition Official Approval:

Contracting Officer:

Marlene Kratz

Estimated Procurement Value: Greater than $250,000

Division Director:

Mary F. Hallam

Estimated Procurement Value: Greater than $700,000

TSA Competition Advocate:

Marvin Grubbs

Estimated Procurement Value: Greater than $13,500,000

Head of Contracting Activity:

H. Katrina Brisbon