Justification_ITC_HCA-_FPKIMA_9-24-18_posted.pdf

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

Federal Public Key Infrastructure Management Authority (FPKIMA)

1. Identification of the Agency and the Contracting Activity

a. Federal agency and contracting activity:

General Services Administration (GSA) / Federal Acquisition Service

(FAS) / Information Technology Category (ITC)

IT (Non-Multiple Award Schedules (MAS)) Acquisition Operations

Contracting Officer: Deborah Aubert

Mailing Address: 1800 F Street, NW, Washington, DC 20405

E-mail Address: deborah.aubert@gsa.gov

Telephone Number: 703-306-6634

b. Project Office Information

Contracting Officer Representative (COR): Jeffrey Voiner, Mailing address: 1800 F Street, NW, Washington, DC 20405

E-mail Address: jeffrey.voiner@gsa.gov

Telephone Number: 571-970-7006

2. Nature and/or Description of the Action Being Approved

Issue a contract extension to the current Federal Public Key Infrastructure

Management Authority (FPKIMA) task order for operational support and technical advisory support to the Federal Public Key Infrastructure (FPKI) , IAW FAR

16.505 (b)(2)(i)(C).

a. Program Background

i. The E-Government Act of 2002 assigned the Administrator of GSA the responsibility for establishing and maintaining the Federal Bridge

Certification Authority (FBCA), an interoperability mechanism that brokers trust across disparate public key infrastructures.

ii. The FPKI Policy Authority (PA) is an interagency governance body under the purview of the Federal Chief Information Officer’s (CIO)

Council Identity, Credential, and Access Management (ICAM) subcommittee to develop policies and procedures required to build trust across the PKI systems of the Federal Government and between federal agencies and outside bodies.

iii. The FPKI Management Authority (MA) is an organization designated by the FPKI PA to administer and manage the Federal PKI Architecture including the Federal Bridge Certificate Authority (FBCA), and associated PKI architecture components in accordance with FPKI PA policies and requirements which support cyber security and identity management solutions.

iv. Responsibility for FPKIMA functions were initially assigned to the GSA

Federal Technology Service (now FAS) in 2001. GSA Order ADM

5440.607 (10/2007) transferred responsibility for the FPKIMA (then

FPKI "Operational Authority") functions, positions, authorities, equipment and other resources from FAS to OGP

v. Homeland Security Presidential Directive 12 (HSPD-12), signed 8/2002, mandated government-wide secure identity credentials. FIPS 201, the

Personal Identity Verification (PIV) Standard, requires the use of the

Federal PKI Architecture for rapid secure electronic verification of identity. All PIV cards must contain digital PKI credentials that are validated through the Federal PKI Architecture.

vi. The PIV-Interoperable (PIV-I) Policy Document (v1.1), issued through the CIO Council in July 2010, authorized the issuance of PIV interoperable cards by nonfederal issuers. Many communities are pursuing the issuance of PIV-I cards for their communities and for business with the Federal Government. PIV-I Cards are required to have digital PKI credentials validated through the Federal PKI

Architecture.

vii. The FPKIMA is designated a GSA High Value Asset, critical to the

Federal Identity, Credential and Access Management program.

b. Acquisition Purpose and Objectives

The purpose of this acquisition is to provide maintenance support for the systems and software. Support includes core functions such as: platform management, security management, relationship management, community, and program coordination.

The objectives of this acquisition are:

Provide maintenance support on the current FPKI system to ensure continuity of operations and reduce the risk of interruptions in service to

Federal Agency customers and FPKI partners.

Provide maintenance support for the systems, software, and interfaces currently operating to allow sufficient time to fully compete a follow-on service suitable to the Federal Government’s strategic requirements.

Implementation, operation, and maintenance of the Federal PKI

Architecture consisting of five (5) CAs in accordance with Federal policies and procedures, including Federal Information Security Management Act

(FISMA), Federal Information Processing Standard (FIPS)-200, FISP-201, FPKI Certificate Policies, and GSA policies and procedures.

Technical and operational support for transition of the FPKIMA to/from other providers or the Government as may be required.

Delivery of highly-available CA certificate status information (CA certificates, cross-certificates, certificate revocation lists (CRLs), authority revocation lists (ARLs)) to the public as appropriate.

Technical advisory support to the FPKIMA, supporting meetings and briefings as needed.

Implementation, operation, and maintenance of the FPKIMA “pre-production” testing environment, closely mirroring the operational

FPKIMA.

Implementation, operation, and maintenance of the Community

Interoperability Test Environment (CITE), which is provided to support stakeholder and other interoperability testing, as needed. Support additional enhanced services (such as a validation service) as may be requested by the FPKIMA.

3. Description of the Supplies or Services Required to Meet the Agency’s

Needs (including the estimated value)

a. Project Title: Federal Public Key Infrastructure Management Authority

(FPKIMA)

b. Contractor: SRA International

c. Project Description: This project will provide GSA with maintenance support on the current FPKI system to ensure continuity of operations and reduce the risk of interruptions in service to Federal Agency customers and FPKI partners

d. Requirement Type: Provide continuous technical operations of the

Federal Public Key Infrastructure (FPKI)

e. Type of Action: This is extension of work currently being performed by

SRA International

f. Proposed Contract/Order Type: Combination of firm-fixed price and time-and-materials

g. GSA Alliant contract number and task order number: GS00Q09BGD055 /

GSQ0013AH1022, PDN: TP00008362

h. The extension to the task order is six months for FAR 52.217-8 Option to

Extend Services Clause and three months for FAR 52.237-3 Continuity of

Services Clause. The period of performance is from October 1, 2018 through June 30, 2019. Both options will be exercised in 30 day increments, as needed. The Estimated Modification Amount is

$2,716,862.708

Funds Obligated to Date; 22,499,076.77

Extension Amount Requested: $2,716,862.70

Total $24,209,180.19

4. Identification of the Exception to Fair Opportunity (see 16.505(b)(2)

Relationship of Initial Order to Logical Follow On

a. Acquisition Authority

This acquisition is conducted under the authority of FAR 16.505 (b)(2)(i)(C). The extension to the order must be issued on a sole-source basis in the interest of economy and efficiency because it is a logical follow-on to an order already issued under the contract, provided that all awardees were given a fair opportunity to be considered for the original order.

GSA intends to exercise the six-month option in the task order per Clause

52.217-8, Option to Extend Services. Although continued performance is within the limits and at the rates specified in the contract, and can only be adjusted as a result of revisions to prevailing labor rates provided by the Secretary of Labor, competition is limited because prices for the extension were not evaluated during the initial competition.

b. Relationship of Initial Order to Logical Follow On

This is a logical follow-on exception because the relationship between the initial order and the follow-on is logical in terms of scope and value: in other words, the

Government requires more of the same services that are being provided under the current task order. The scope of the current task order is complex, unique in nature and has high levels of security requirements involved.

FPKIMA uses a digital certificate security method and technology to authenticate users and data, protect the integrity of transmitted data, and ensure technical non-repudiation and confidentiality. The FPKI is a trusted environment that must be protected at a level for a highly sensitive system.

Given the technical complexity of the requirement, it would be more efficient and cost-effective to continue with SRA for the few months needed until the recompete of the entire task order has been awarded. Conversely, it would be inefficient to try to compete the short-term stop-gap extension. The recompete is intended to be awarded within the next six months.

The FPKI must remain operational because of the significant financial harm to the Government as well as GSA if there were operational disruptions in service to agency participants. GSA is providing HSPD-12 services to 90+ agencies, boards, and commissions across Government and these participants rely on the operations of the FPKI to protect the security of their IT networks and physical facilities and for conducting online business transactions.

If the FPKI services are not available, the downstream effect could result in a critical impact to each of these participants. The catastrophic impact will be felt across all federal agencies and business partners. Some of the downstream impacts would be:

i. A substantial cost to reconfigure Federal Architectures because trust would be eliminated and secure communication physical access would be threatened.

ii. The Office of the Secretary of Defense has issued DoDI 8520.02

(Public Key Infrastructure and Public Key) mandating a DoD-wide implementation of the use of PKI for all DoD information systems, applications and over 3.6 million common access cards. DODI

8520.02 requires all business partners to cross-certified with the

FPKI Bridge before authorizing a DOD certificate to business partners. DOD is cross-certified with the FPKI Bridge Certification

Authority, which acts as a bridge for secure communication with other Federal Agencies and DOD major Business Partners, such, as Boeing, Lockheed Martin and others. If the FPKI services become unavailable, DOD will no longer be able to have a federated secured communication and certification validation with other federal agencies and business partners. The resulting cost could amount to millions of dollars because of downtime for critical military support systems. Additionally, over 800,000 DoD business partners will not have secure means for communicating with DoD.

iii. Federal certificates providing trust for Share Service Provides would no longer be valid. Over 1.6 million Federal PIV cards would be rendered unauthorized, wasting over $6M the Government has spent to date on the cards. The $6M figure is for the card only. This cost does not include the number of man-hours and stoppage in work.

iv. The cost associated with revoking invalid certificates because of disruption in service could potentially amount to millions of dollars for the federal agencies. There is also cost associated with reissuing PIVs when the system is restored.

The Federal PKI provides the trust anchor to six Share Shared Service providers that support 25 Executive Branches and business partners. In addition, the

Federal PKI established the chain of trust for over 5,500,000 million PIV cards holders and a near-infinite number of applications required for Federal day-to-day business. This chain of trust equates to more than 1.14B certificate validation requests per month from the FPKIMA Platform Management Repository

Services.

The FPKI is an important part of the FISMA assessment and authorization (A&A) process and our Nation’s security posture overall. FPKI services can help

Federal agencies comply with various NIST Special Publication 800-53 security controls. In general, the FPKI provides a high level of trust and risk mitigation. In addition, the FPKI is a critical piece of the Federal IT infrastructure, as evidenced by its inclusion in FISMA reporting metrics now being developed. Accordingly, it is vital to all agencies for trusted communication and the subsequent impact those communications have on mission function.

The complexity of the PKI technology, the limited experienced personnel pool, and the need to create a contract vehicle designed to accommodate a ubiquitous technology and policy environment have delayed anticipated award for the five-year contract until the third quarter of 2018. Contract design and acquisition planning activities and market research to determine optimum acquisition vehicles and adequate skilled sources have pushed the solicitation schedule into

2018.

5. Determination by the Contracting Officer that the anticipated cost to the

Government will be fair and reasonable

The Alliant GWAC provides loaded hourly labor rates for Time-and-Material

(T&M) and Labor Hours (LH) contract types.. The extension to the awarded task order will continue the combination of firm-fixed price and time-and-materials, inclusive of the Alliant GWAC negotiated mix of labor, labor rates, and level of effort billed monthly on the current task order. The current FPKIMA task order was competitively awarded using the best value tradeoff. Based on the current negotiated prices, the anticipated cost to the Government for the extension is anticipated to be fair and reasonable.

6. Additional Supporting Facts

The importance of the Federal Public Key Infrastructure is evident in the nature of the service it provides (electronic identity authentication services to buildings and information technology systems); the all-encompassing nature of its membership ( all Federal Agencies and related state, industry and academic partners); and the level of implementation (sheer number and complexity of the actual system linkages within its customers systems and security processes).

Operations must be maintained without disruption for this governmentwide system.

GSA is entrusted with the ongoing operation of this critical infrastructure for the

Federal Government and cannot allow operations to be interrupted. The downstream impact of a failure or interruption of services is very significant and the currently mapped system linkages suggest that such an event(s) would have large negative impacts to many Federal Agencies and partners mission critical operations.

The primary reason for pursuing this strategy is to reduce risk to the Federal agencies and partners. The greatest risk identified by the FPKIMA is that the

FPKI will not be able to support validation of credentials, especially HSPD-12 credentials used for logical and physical access by all Federal agencies, upon the close and interruption of the current contract.

FPKI helps achieve the Federal Government’s business process objectives that include: (a) strong digital signature; (b) legally-recognized technical non-repudiation; (c) strong authentication in place of weaker mechanisms such as userid/password; (d) strong encryption of data at rest and in motion; (e) trusted interoperability between disparate systems; (f) single sign-on; and (g) secure tunneling.

7. Statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made.

Full and open competition for this extension to the order is not being obtained in the interest of economy and efficiency. The additional work is an extension to an

Alliant GWAC task order that was originally placed in accordance with fair opportunity. This extension is for a limited amount of time in order to continue critical services while the new requirement is being competed.

GSA intends to recompete the Federal Public Key Infrastructure Management

Authority against the Alliant Government-wide Acquisition Contract (GWAC) with the anticipation of an award within the next six months. The new recompete will provide the services needed for a base year plus four option years. All contractors will be provided a fair opportunity to be considered in accordance with FAR 16.505(b)(1). . The task order will be a combination of both firm-fixed price and time-and-material.