LSJ_PR-OMS-20-00551_Redacted_1.pdf

LIMITED SOURCES JUSTIFICATION FOR FEDERAL SUPPLY SCHEDULE

PROGRAM

UNDER FAR 8.405-6(a)(1)(i)(B)

Procurement Request Number: PR-OMS-20-00551

1. Identification of the agency and the contracting activity.

This limited source justification is for the U.S. Environmental Protection Agency (EPA), Office of Mission Support (OMS), Office of Information Security and Privacy (OISP).

The contracting activity processing this justification is the U.S. EPA, Office of Acquisition Solutions (OAS), Information Technology Acquisition Division (ITAD) located in Research Triangle Park, NC (RTP).

2. Nature and/or description of the action being approved.

EPA intends to award a single delivery order on a limited source basis via a GSA Federal Supply Schedule (FSS) for a Xacta 360 Unlimited Software License and maintenance.

The government anticipates awarding a firm fixed price (FFP) order for this action.

3. A complete description of the supplies and/or services required to meet the agency’s needs.

OISP requires a continuous risk assessment and reporting tool to meet the Federal Information Security Modernization Act (FISMA) requirement to follow the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF) Special Publication (SP) 800-37. This SP requires that Information Technology (IT) systems go through an Assessment and Authorization (A&A) process. Telos Xacta 360 gives the EPA the ability to automate their A&A process. Additionally, Xacta 360 enables security professionals to effectively manage risk on a day-to-day basis through continuous assessment and ongoing authorization of their on-premises and cloud computing environment.

Xacta 360 was first procured for the agency in 2009. As IT systems have increased, the need for additional risk assessment and reporting tool software licenses has increased. Delivery order 68HERD19F0193 for additional licenses was placed in September of 2019. The need has since increased which has led to a change in the requirement to become more efficient and cost effective for the agency. This new order will be for an unlimited license and maintenance to cover the continuous increase in IT systems and prevent the need for additional orders.

The total estimated value of this requirement is for a 12-month base period and one (1) 12-month option period. The total period of performance is expected to be 24 months.

4. An identification of the LSJ rationale, and if applicable, a demonstration of the contractor’s unique qualifications to provide the required supply or service.

The EPA intends to procure brand name Telos Xacta 360 software in accordance with FAR 8.405-6(a)(1)(i)(B) – Only one source is capable of providing the supplies or services required at the level of quality required because the supplies or services are unique or highly specialized. Xacta 360 is the only risk assessment and reporting software that will meet the needs of OISP. Xacta 360 offers the following features required by OISP that meet the EPA’s mission:

Adaptable application that can automate our customers processes and requirements

Has flexibility to implement NIST 800-37/53/53A, Federal Information Processing Standard (FIPS) 199/200 and the Department of Defense (DOD) and the Intelligence Community’s A&A processes and requirements selection

Flexible publishing output of all required documents (Microsoft Word or PDF) Patented risk algorithm and leading Government sector A&A solution Unique compliance campaign manager for gathering test results for non-technical controls Comprehensive and dedicated SmartView dashboard reporting capabilities

The results of the market research indicate other companies’ similar products lack the particular feature(s) required and do not meet, or cannot be modified to meet, the needs of OISP. Specifically, none of the other products offered the same adaptability and flexibility as Telos Xacta 360. Additionally, no other products offer continuous risk assessment and analysis of IT asset information from a variety of systems.

5. A determination by the ordering activity Contracting Officer that the order represents the best value consistent with FAR 8.404(d) and FAR 8.405-2(d).

This limited source requirement will be procured via Telos Corporation’s GSA schedule 70 contract, GS-35F-162DA, under Special Item Number (SIN) 132-32. In accordance with FAR 8.404(d), GSA has already determined the prices of supplies and fixed-price services, and rates for services offered at hourly rates, under schedule contracts to be fair and reasonable. Therefore, ordering activities are not required to make a separate determination of fair and reasonable pricing. Additionally, proposed pricing shall be in accordance with Telos Corporation’s published GSA pricing.

6. A description of the market research conducted among schedule holders, and the results of the research, or a statement why market research was not conducted. A statement must be made that the supplies and services are available from the FSS.

Market research was conducted through internet searches, consulting with colleagues who have procured these licenses from Telos Corporation and a search of EPA mandated and optional sources. Internet searches did not reveal other vendors capable of providing a risk assessment software that would meet the needs of OISP. The available EPA mandatory sources to include strategic sourcing vehicles do not offer risk assessment software and are unable to meet this requirement. Additionally, no other GSA vendors were identified with the unique capabilities of providing these types of software licenses.

GSA Schedule 70 SIN 132-32, Term Software License, was identified as the source for these licenses.

It was initially identified that the NASA SEWP V Government Wide Contract Vehicle (GWAC) had 21 resellers of Telos Corporation which would allow for a brand name requirement that could be competed amongst the 21 vendors. A Request for Information (RFI), # 154129, was issued on 5/29/2020 to all Small Businesses on NASA SEWP to determine if optional maintenance periods were available for this requirement. The RFI closed on 6/2/2020 with no responses. After reaching out to authorized resellers on the GWAC, we were informed that they could not provide this product and, therefore, did not respond. Telos Corporation has verified that this product, Xacta 360 Unlimited, must be purchased directly through them. The prior order for this software, 68HERD19F0193, was procured as sole source directly through Telos Corporation’s GSA schedule contract.

Based on this market research, the determination was made that this action be issued under FAR Subpart 8.405-6(b) as a limited source requirement.

7. Any other facts supporting the limited source justification.

There are no other facts supporting the limited source justification.

8. A statement of the actions, if any, the agency will take to remove or overcome any barriers that led to restricted consideration before any subsequent acquisition for supplies and services is made.

The EPA will continue to perform market research annually when the software renewal is due. During market research, the Government will continue to look for other risk assessment and reporting tools that are able to meet the requirement and the EPA’s mission. If another tool becomes available, the EPA will compare the software and determine if replacing their current risk assessment tool would be effective and cost efficient for the agency.

9. Technical/Requirements Personnel Certification.

Pursuant to FAR 8.405-6(c)(2)(x), I certify that this requirement meets the Government’s minimum need and that the supporting data, which form a basis for the justification, are accurate and complete.

Torina Anderson

Torina Anderson Date Contracting Officer’s Representative

June 9, 2020___________________ Torina Anderson

10. Contracting Officer Certification.

Pursuant to FAR 8.405-6(c)(2)(ix), I certify that this justification is accurate and complete to the best of my knowledge and belief and hereby determine that the circumstances for a limited source justification exist.

Christopher S. Davis Date Contracting Officer COTS Software, Maintenance & Services Team Leader

Digitally signed by CHRISTOPHER DAVIS DN: c=US, o=U.S. Government, ou=Environmental Protection Agency, cn=CHRISTOPHER DAVIS, 0.9.2342.19200300.100.1.1=68001003640366 Date: 2020.06.09 09:26:22 -04'00'