JOFOC SANS Final _Redacted.pdf

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION

10 U.S.C. § 3204

Pursuant to the requirements of the Competition in Contracting Act (CICA) as implemented by the Federal Acquisition Regulation (FAR) Subpart 6.3, the following facts and rationale justify the use of such authority:

1. Agency and Contracting Activity.

The Department of Homeland Security, United States Coast Guard (USCG), Office of Contract Operations (CG-912) prepared this justification for other than full and open competition. CG-912 proposes to enter into a contract on a basis other than full and open competition and allow Department of Homeland Security (DHS) Components to place independent orders.

2. Nature and/or Description of the Action being Approved.

(a) Nature of the action: USCG intends to procure on a sole source basis, Role-Based Cyberspace Certification and Competency (RC3) Training Program Services utilizing an Indefinite Delivery Vehicle (IDV). The USCG will own the requirement and has invited DHS components to utilize the IDV until DHS awards their own IDV in FY26.

(b) Name and address of the contractor: The ESCAL Institute of Advanced Technologies, Inc/SANS Institute, NA37S3SKQW65/1HTA8, 11200 Rockville Pike, Suite 200, North Bethesda, MD 20852

(c) Type of action: Firm Fixed-Price, Single Award, Indefinite-Delivery Indefinite Quantity (IDIQ) Contract.

(d) Estimated total value (including options): Provide breakdown as shown below:

Period Price

TOTAL

$24,193,428

Note: Existing Award ID: 24322623F0187 against IDV 24361822D0001 expires 09/24/2024.

(e) Type of funding: Operations and Support funds

(f) Year of funding: Fiscal Year 2024

(g) Solicitation number: 70Z02324R79110001

(h) Background information about the requirement: Certification and knowledge requirements for the Cyberspace workforce were introduced in December 2005 through DoD Manual 8570.01-M, establishing the Information Assurance Workforce Improvement Program for all members working primarily in cyberspace rolls. DoD Directive 8140.01, Instruction 8140.02, and Manual 8140.03 establish policy, assign responsibilities, and provide guidance for the identification, tracking, data collection, and reporting requirements of DoD Cyberspace Workforce Framework (DCWF) work roles. The DCWF, a derivative of the National Institute of Standards and Technology (NIST) National Initiative for Cybersecurity Education (NICE) Framework, is the authoritative reference for the identification, tracking, and reporting of DoD cyberspace positions and the foundation for developing enterprise baseline cyberspace workforce qualifications.

In accordance with the Commandant’s priority to cultivate a mission ready total workforce, CG-791 has been working to professionalize the Cyberspace workforce by providing access to an online learning platform, since June 2019. CG-791 assumed oversight of the Coast Guard Information Assurance (IA) Professional Certification Voucher Program from the Office of Cybersecurity Program Management (CG-62) in January 2019.

Prior to utilizing the OPM (USA Learning) Indefinite Delivery Vehicle (IDV) 24361822D0001, the Coast Guard and DHS ordered small quantities directly through SANS. The Coast Guard also ordered SANS (and non-SANS courses) from the ULTIMATE KNOWLEDGE CORPORATION through the Dept of the Navy purchase orders and Inter Agency Agreements. However, SANS stated the following in response to RFI Notice ID 70Z02324RFID791: “No other company is authorized to produce SANS training or GIAC certifications in support of this effort. In our experience, the Government will likely receive responses from businesses, large and small, who assert that they are able to resell SANS courses or GIAC certification exams; we have no such reseller/distributor agreement in place with any company for this effort. Students attempting to attend a course or take certification exam will be denied if it has been resold or if someone attempts to register on behalf of someone else. Additionally, other companies may assert their employed instructors may teach SANS courses; we have no such agreement in place with any other company”.

3. Description of Supplies/Services.

(a) The USCG requires support to prepare members of the Cyberspace workforce to pass industry certification exams, to meet mandated continuing education requirements, and for professional development in accordance with Department of Defense (DoD) policy and USCG COMDTINST 2620.2B. DCWF describes the work performed by the full spectrum of the cyber workforce and serves as the DoD and Coast Guard cyberspace coding structure for authoritative manpower and personnel systems.

(b) The USCG requirement involves procuring a comprehensive portfolio of commercially available cyber security courses for both on-site and virtual instruction.

Additionally, the contractor must offer certification testing aligned with DoD 8140, CG CYBER Job Qualification Requirement (JQR), and Competency Coding. The curriculum content and the number of courses may evolve over time to meet the changing demands of CSSP Analyst, Infrastructure Support, and Incident Responder roles as outlined in CYBER policy 2620.2B.

(c) Currently, the government is estimating 950 vouchers (to include in-person attendance), 250 re-test vouchers, and renewals at 500 across the USCG enterprise.

No additional travel costs are required since the students will be using virtual, in-person and city paired testing facilities for the duration of their courses and testing.

(d) The following Global Information Assurance Certifications (GIAC) are required by USCG and DoD policy:

GCIA

GCIH

GSEC

GCFA

GFACT

GCFE

GPEN

GSLC

GDSA

GCSA

GCIA

GRTP

GWAPT

GCTD

4. Identification of Statutory Authority Permitting Other Than Full and Open Competition.

The statutory authority permitting other than full and open competition is 10 U.S.C. § 3204(a) implemented by the FAR Subpart 6.302-1 entitled “Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements.”

5. Identification of Exception to the Buy American Act. Not Applicable

6. Demonstration that the Proposed Contractor’s Unique Qualifications or the Nature of the Acquisition Require Use of the Authority Cited.

In accordance with section 4 of this justification, it has been determined that SANS Institute is the only provider capable of delivering specialized cybersecurity training for USCG Cyberspace workforce. The unique nature of this acquisition is driven from the USCG and DoD policy regarding the certification standard, mandated continuing education requirements, and professional development of USCG Cyberspace workforce. In addition, GIAC is the highest standard of Cyber Security Certifications in the industry and is required by USCG and DoD policy that all Cyberspace workforces obtain these certifications. It was identified through market research that SANS Institute is the only provider of GIAC courses. The technical expertise and specialized knowledge offered by SANS Institute in cybersecurity training are not adequately captured by standard technical data packages, specifications, or purchase descriptions. SANS's training programs address the unique challenges and requirements of USCG Cyberspace workforce, making them the only provider for this specific training.

Furthermore, not approving this justification would have significant mission impacts.

Without access to specialized cybersecurity training from SANS, USCG Cyberspace workforce would lack the skills to defend against cyber threats, endangering national security and reduce the USCG's operational readiness.

7. Description of Efforts Made to Ensure that Offers are Solicited from as Many Potential Sources as is Practicable.

(a) RFI Notice ID 70Z02324RFID791 was posted to sam.gov January 23, 2024, with offers due by February 7, 2024. The RFI published a list of GIACs training and certification exam vouchers to be made available to USCG Cyberspace workforce.

(b) RFI responses indicated that SANS is the only source that provides GIAC training and exam vouchers required by USCG and DoD policy. Although the 17 vendors expressed interest in the requirement, it was determined that only SANS Institute had the experiences and capabilities to meet our requirements.

(c) The current Interagency Agreement (IAA) utilizing the Indefinite-Delivery Vehicle (IDV): 24361822D0001 with the Office of Personnel Management (OPM) was considered, but it is not a viable option for this requirement because OPM charges a ¼ FTE Project Manager fee (CLIN 00007) for technical support of managing the contract. OPM established this 3-year IDV with SANS on a sole source basis citing FAR 6.302-1- “Only One Responsible Source”. CG-791 and CG- 9123 are willing and able to manage a contract with SANS and determined not to continue paying another federal government agency for these services.

8. Determination by the Contracting Officer that the Anticipated Cost to the

Government will be Fair and Reasonable.

The anticipated price is expected to be fair and reasonable because SANS is a commercial entity and the USCG will compare proposed prices to historical prices paid by the Government for the same classes. The Contracting Officer also anticipates a comparison with a published price list, comparison of proposed price with the IGCE, and analysis of data other than certified cost and pricing data provided by the offeror IAW

FAR 15.404.

9. Description of Market Research.

Market research was conducted to identify cybersecurity training services availability, focusing on identifying providers meeting United States Coast Guard requirements.

Techniques included internet searches, RFI Notice ID 70Z02324RFID791 posted to sam.gov Jan 23, 2024, industry publication review, and stakeholder consultation. This research, completed from 01/01/2024 - 04/19/2024 confirmed SANS Institute's capability as the only available provider. Based on this assessment, including SANS Institute's pricing information, the contracting officer determined the anticipated cost will be at a fair and reasonable price, ensuring access to quality training for USCG personnel.

10. Any Other Facts Supporting the Use of Other Than Full and Open Competition.

Market Research identified that multiple agencies have awarded contracts with SANS Institute on a sole source basis citing FAR 6.302-1- “Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements”. Those agencies include U.S. Department of Air Force, OPM, and Department of Energy (DOE). Furthermore, SANS Institute does not have any agreements or authorized resellers for SANS training and GIAC certifications. The evaluation/certification programs are proprietary to SANS. The student exercise/mission training environment is also proprietary to SANS.

11. A Listing of the Sources, if Any, that Expressed, in Writing, an Interest in the

Acquisition.

17 businesses including SANS expressed interest in the Request for Information (RFI), Notice ID 70Z02324RFID791, posted to sam.gov Jan 23, 2024. 14 of the respondents were small businesses under NAICS 611420 - Computer Training. The Market Research Report signed by the Contracting Officer summarizes each vendors response and their incapability of fulfilling the requirement.

12. A Statement of the Actions, if Any, the Agency May Take to Remove or Overcome Any Barriers to Competition Before Any Subsequent Acquisition for Supplies or Services Required.

Through market research, the Government determined that only one vendor, SANS/GIAC, was currently capable of providing the required certification and training environment to meet the agencies need. Additional research indicated that other commercial companies do not offer all the required courses to the appropriate level of learning or capabilities to meet the 8140 requirements. When approached by the Government, these companies were not willing to change their courses since this would cause a significant increase in cost.

The Government will conduct additional/continued market research for the curriculum, assessment/certification, and student exercise/mission training requirements. The additional market research will include an RFI. The Government will discuss the requirement with the contractors interested in this requirement on a need-to-know basis to determine what curriculum might be created to meet the Government's training needs.

In addition, the Government will continue to work with CGCYBER on customizing Government owned solutions to support the student exercise/mission training environment.