LSJ - SNCC - 2.10.2022_Final (1).pdf

LIMITED SOURCES JUSTIFICATION (LSJ)

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION (JOFOC)

Version Control Date: October 7, 2015

Date: February 3, 2022

MEMORANDUM TO: Domonique Malone, Contracting Officer, Office of Administration

FROM: Bill Szyperski, Contracting Officer Representative, Office of the

Chief Information Officer

SUBJECT:

☒ LIMITED SOURCES JUSTIFICATION (LSJ)

☐ JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION

(JOFOC)

REFERENCE: GLobal INfrastructure and Development Acquisition (GLINDA)

Systems, Network, and Related Cross-Cutting Services (SNCC)

“Source Selection Information – see FAR 2.101 and 3.104”

1. Nature and/or description of the action being approved.

a. Acquisition purpose and objectives.

The Nuclear Regulatory Commission (NRC) Office of the Chief Information Officer (OCIO) requires a noncompetitive modification to GSA Federal Supply Schedule Contract No. GS-35F-0018Y, Blanket Purchase Agreement (BPA) No. NRC-HQ-10- 17-A-0008, BPA Call No. 31310018F0052 (“Systems, Network, and Related Cross- Cutting Services (SNCC) BPA Call”) with TekSynap Corporation. The purpose of this noncompetitive modification is to extend the period of performance by four years from 5/31/22 to 11/30/2025 and increase the BPA Call ceiling.

b. Project background.

The NRC awarded the Global Infrastructure and Development Acquisition (GLINDA) BPAs on June 5, 2017 to six vendors: ActioNet (NRC-HQ-10-17-A-0003), CGI Federal (NRC-HQ-10-17-A-0004), Vistronix (NRC-HQ-10-17-A-0005), G2SF (NRC- HQ-10-17-A-0006), Leidos (NRC-HQ-10-17-A-0007), and TekSynap (NRC-HQ-10- 17-A-0008). The GLINDA BPA provides a variety of professional services including, seat services, network services, data center/cloud services, mobility services, end user support, and application operations and maintenance services. The GLINDA BPA period of performance ends March 29, 2023.

The NRC competitively awarded four infrastructure support BPA Calls including:

• Mobility Services. The NRC competitively awarded the Mobility Services BPA Call to G2SF, LLC. on September 29, 2017. The Mobility Services BPA Call provides an integrated set of mobility support services including, daily mobility operations and support, as well as mobility infrastructure and engineering support. The Mobility Services BPA Call period of performance ends September 28, 2022.

• Security Operations Center (SOC): The NRC competitively awarded the SOC BPA Call to CGI Federal on September 29, 2017. The SOC BPA Call defends the NRC against unauthorized activity within its computer networks, including detecting, monitoring, and analyzing suspicious activity as well as supporting the agency’s response to malicious activity and contributing to restoration activities. The SOC BPA Call also provides the structure for the agency’s users to report potential or suspected cybersecurity incidents. The SOC BPA Call services encompass all agency IT systems and data, including websites, servers, databases, applications, networks, data centers, and endpoints. The SOC BPA Call period of performance ends September 28, 2022.

• End User Computing (EUC): The NRC competitively awarded the EUC BPA Call to Leidos on April 9, 2018. The EUC BPA provides an integrated set of end-user computing services including, end-user management and deployment and help desk services. In addition, the EUC BPA Call provides delivery management, project and product management, service catalog administration, end-user management and deployment, account management, service and network management and deployment, hardware and software management and deployment, technology refresh and device sanitation. The EUC BPA Call period of performance ends April 8, 2023.

• Systems, Network, and Related Cross-Cutting Support (SNCC): The NRC competitively awarded the SNCC BPA Call to TekSynap on June 12, 2018.

The SNCC contract period of performance started on March 1, 2019. The SNCC BPA Call provides an integrated set of infrastructure and IT operations support services to include System and Database Administration, Compute and Storage, Release and Deployment, Network, Identity, Credential and Access Management (ICAM), Data Center Operations, Disaster Recovery (DR) and Continuity of Operations (COOP), Security Engineering, Cloud Facilitation, and Cross-Cutting project support. The SNCC period of performance ends May 31, 2023.

The NRC strategically staggered the award of the infrastructure support BPA Calls to decrease operational risk and ensure uninterrupted infrastructure services to the agency during transition from the Information Technology Infrastructure and Support Services (ITISS) contract to the GLINDA BPA Calls. All four GLINDA infrastructure support BPA Calls were successfully transitioned from the single provider Information Technology Infrastructure and Support Services (ITISS) contract to the respective GLINDA BPA Call without interruption of service or degradation to the quality of services provided.

c. Name and address of the proposed contractor(s).

TekSynap Corporation 1900 Oracle Way, Suite 800 Reston, VA 20190

2. A description of the supplies or services required to meet the agency’s needs (including the estimated value).

a. Project title.

Systems, Network, and Related Cross-Cutting Services (SNCC)

b. Project description.

The SNCC BPA Call provides support for infrastructure lifecycle development, integration, administration, and ongoing support required by the NRC, including planning, development, integration, configuration, deployment, testing, administration, maintenance and refresh of both existing and future Information Technology (IT) infrastructure systems and supporting components. The SNCC BPA Call includes the following infrastructure services:

Cross-Cutting Services

The SNCC contractor provides overall contract Program Management which establishes and documents the management and oversight mechanisms to standardize, automate, and address the planning and delivery processes for day-to-day operations and projects. These cross-cutting services include executing business and technical planning, operational and project processes, and related technical business activities including financial and asset tracking. Cross-Cutting Services also includes system and network planning support, delivery support, project management, reporting and deliverables management, data storage device sanitation services, and tier 3 (escalated) event and issue support.

System and Database Administration

The SNCC contractor closely collaborates with application teams, facilities operations, NRC management, cloud facilitation team, and other stakeholders to support ongoing systems and database administration. System and database administration includes dedicated and shared instance operating system and on-premise and cloud-based database-level support, related server and database security support, and back-up and recovery process management. System and Database Administration includes system administration services, system security support, database support, and backup and recovery services.

Compute and Storage Management

The SNCC contractor provides a variety of services to maintain the current compute and storage capacities as well as support the NRC’s use of public cloud Infrastructure and platform services. Compute and Storage Management includes architectural and resource planning support, on premise and cloud-based compute and storage administration, periodic system refresh, and compute and storage related infrastructure maintenance.

Release and Deployment Management

The SNCC contractor provides support for the NRC’s software development and systems/application lifecycle processes as well as infrastructure modifications in support of NRC’s development and testing processes, environments, and related tools. Release and Deployment Management includes environment planning and maintenance support, as well as, workstation and server maintenance and management, through patching, version updates, maintenance, provisioning, and de-provisioning.

Network Management

The SNCC contractor provides technical network management expertise to NRC.

Specifically, the SNCC contractor assumes responsibility for NRC’s successful utilization of NRC provided network assets and related resources, currently used across its facilities to support the NRC. The SNCC contractor provides a variety of services to monitor, maintain, and administer the NRC’s network. Network Management includes network architecture design and management, network administration, periodic network system refresh, network related infrastructure management and maintenance, network engineering support and remote access management.

Identify, Credential, and Access Management (ICAM)

The SNCC contractor provides ongoing technical expertise for the agency’s ICAM mechanisms that identify, authenticate, and authorize individuals and technical services to enable appropriate access to resources in a standardized and interoperable manner. ICAM services include over-arching ICAM support services, identity management, credential management and access management services.

Data Center Operational Support

The SNCC contractor provides ongoing physical and related logistical support for the NRC’s data center facilities. These services encompass physical access control, environmental management, media management, media transfer coordination, and operational monitoring. Data Center Operational support includes physical access management, physical environment conditioning and power management, tape and back-up logistics, and operational monitoring.

Disaster Recovery (DR) and Continuity of Operations (COOP) Management

The SNCC contractor provides services over a broad range of DR and COOP planning and testing activities as well as support for the fail-over and restoration of IT systems, services, and data if an event occurs requiring plan activation for one or more systems or environments. DR and COOP management includes DR coordination, planning, testing and optimization, operations, fail-over and restoration of NRC’s IT services.

Security Engineering Support

The SNCC contractor provides software/system engineering services in support of the NRC’s Security Operations Center (SOC) functions. The scope of this support area does not include SOC monitoring, threat analysis, incident response, and other similar cybersecurity services and instead focuses on security architecture, effective engineering of security systems, and the continued maintenance and support of the tools and technologies upon which effective cybersecurity services are provided.

Security Engineering includes security architecture and engineering, engineering change requests and security reviews, security tool configuration and maintenance, administration of agency log management and security information and event management system, security authorization support, data retention and storage requirements, continuity of operations for NRC’s network defense and monitoring systems, proactive vulnerability and compliance scanning, and project management for new and ongoing security engineering projects and initiatives.

Cloud Facilitation Services

The SNCC contractor assists the NRC in the planning, deployment, migration, and ongoing management of cloud Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) capabilities (collectively referred to as ‘Cloud Facilitation Services’) across the NRC’s information technology (IT) portfolio. The SNCC contractor provides the NRC with a tightly integrated set of services that facilitates the use of public, private, and hybrid cloud services through an aggregated service portfolio that is continuously managed, automated, and secure, resulting in the delivery of enhanced services that optimize performance while minimizing cost. Cloud Facilitation Services includes start-up services, cross-cutting facilitation, service delivery management, engineering and exit services.

c. Acquisition Information.

• Requirement type:

☐ Research & development (R&D) ☐ R&D support services ☐ Support services (non-R&D) ☐ Supplies/equipment ☒ Information Technology (IT) or Electronic and Information Technology

(EIT)

☐ Construction ☐ Architect-engineer (A-E) services

☐ Design-build ☐ Other (specify): ____________________

• Type of action.

☐ New requirement ☒ Follow-on ☐ Other (specify): ______________________

• Proposed contract/order type.

☒ Firm-fixed-price ☐ Other fixed-price (specify, e.g., fixed-price award-fee, fixed-price incentive-fee): __________ ☐ Cost-plus-fixed-fee ☐ Other cost reimbursement (specify, e.g., cost-plus-award-fee, cost-plus-incentive-fee): ___________ ☐ Time and materials ☒ Labor Hours ☐ Indefinite delivery (specify whether indefinite quantity, definite quantity, or requirements): ___________

• Statement of Work Type ☐ Completion ☐ Level of Effort ☒ Performance Based

• Requisition number.

APP-22-OCIO-0038

ZEROREQ-OCIO-22-0016

• Total estimated dollar value and performance/delivery period.

The estimated dollar value of the ceiling increase is $54.1M. The modification will also add one 18-month Base Period and one 12-month Option Period for a total BPA Call period of performance of June 1, 2023 to November 30, 2025.

Identification of the Authority

☒ This acquisition is conducted under Federal Acquisition Regulation (FAR) 8.405-6.

☐ Urgent and compelling need exists ☐ Only one source is capable of providing the supplies or services

(i.e., peculiar item, brand name item) ☒ Logical follow-on

☐ This acquisition is conducted under FAR 13.106-1(b).

☐ This acquisition is conducted under FAR 6.302- __.

☐ 6.302-1 Only one responsible source and no other supplies or services will satisfy agency requirements ☐ 6.302-2 Unusual and compelling urgency ☐ 6.302-3 Industrial mobilization; engineering, developmental, or research capability; or expert services ☐ 6.302-4 International agreement ☐ 6.302-5 Authorized or required by statute ☐ 6.302-6 National security ☐ 6.302-7 Public interest

☐ This acquisition is conducted using Simplified Procedures for Certain Commercial Items pursuant to FAR 13.500.

☐ This acquisition is conducted using Simplified Procedures for Certain Commercial Items pursuant to FAR 13.500(c).

3. A demonstration of the proposed contractor(s) unique qualifications to provide the required supply or service.

The SNCC BPA Call is the agency’s largest, most highly comprehensive, complex, and mission critical IT services contract. A non-competitive modification to extend the SNCC BPA Call will allow the NRC to: (1) meet the time constraints of several critical ongoing infrastructure requirements that are presently being performed by TekSynap to migrate, update and increase cyber security posture of several IT systems; (2) eliminate the need for the corporate support cost that would be required to transition services in FY23; and (3) allow the agency to maintain a stable infrastructure while the NRC completes and transitions several other competitive GLINDA BPA Calls.

Below provides more detailed information that supports the agency’s position that in the interest of economy and efficiency, the requirements that will be performed during the extension period are a logical follow-on to the SNCC BPA Call that was competitively placed in accordance with the applicable Federal Supply Schedule ordering procedures. Also, if the requirements outlined below and the current SNCC BPA Call were split between TekSynap and another vendor, it could result in unacceptable delays in fulfilling the agency’s critical requirements and meeting critical project deadlines, resulting in increased risk and vulnerabilities to the agencies IT environment, as well as a duplication of costs.

a. Critical ongoing infrastructure requirements to migrate, update and increase the cyber security posture of several IT systems is considered logical follow-on work in accordance with FAR 8.405-6(a)(1)(C).

TekSynap is currently leading critical ongoing infrastructure requirements to migrate, update, and increase cyber security posture of several IT systems.

These projects, listed below, are not expected to be completed by May 31, 2023, when the current SNCC period of performance ends. Awarding and transitioning these projects to another vendor before their completion is not feasible.

TekSynap is the most familiar with the operational considerations and current technical challenges for these vital projects. As such, TekSynap is the only vendor that can ensure that NRC meets mandated deadlines and avoids unacceptable delays for these projects. If these projects were transitioned to another vendor, there would be a substantial duplication of costs to the Government that are not expected to be recovered through competition.

Cybersecurity:

On August 27, 2021, the Office of Management and Budget (OMB) issued memo M-21-31 to improve the Federal Government’s investigative and remediation capabilities related to cybersecurity incidents. That memo addresses the requirements of Executive Order 14028, Improving the Nation’s Cybersecurity.

In addition, that memo establishes requirements for agencies to increase the sharing, as needed and appropriate, of federal information system logs for detection, investigation, and remediation of cyber threats. M-21-31 outlines a maturity model for event log management and requires agencies to immediately begin efforts to increase performance in accordance with the requirements of the memo. The NRC has 12 months to reach maturity level EL1, 18 months to reach maturity level EL2, and 24 months to reach maturity level EL3. In order to meet the requirements to obtain each maturity level within the respective timeframes, the NRC must immediately start evaluations and begin enhanced logging efforts.

These new logging requirements are an expansion of functions currently performed by the SNCC contractor. This effort will increase the current level of effort by $4M over the next 36 months ($1.5M to reach EL1, $827K to reach EL2, $539K to reach EL3 and $1.1M to maintain EL3), to accommodate these new OMB requirements. This estimated date of project completion is November 2024.

TekSynap is the only vendor that can ensure that NRC meets the mandated deadlines and avoids unacceptable delays for this OMB Executive Order. If this project was transitioned to another vendor, there would be a substantial duplication of costs to the Government for the new vendor to get up to speed on the NRC’s current security posture and the cost associated with this extra time is not expected to be recovered through competition.

Server Migration:

In May 2021, the NRC initiated the server operating system migration project to ensure NRC’s servers are up to date with the latest operating systems. This project is critical to ensure the NRC’s IT security posture and protect NRC’s IT system data. The work currently being performed by TekSynap under the SNCC BPA Call is a critical component of the NRC’s server migration efforts. Under this BPA Call, TekSynap is currently leading the effort to successfully migrate all NRC’s data to the latest server operating systems prior to the server operating system end of support, which is scheduled for October 2023. In addition, the NRC’s servers must be migrated to the latest server operating system to support the NRC’s efforts to migrate NRC systems to the cloud, which is in alignment with the Cloud Smart Initiative. Due to the complexity of this project, it is not expected to be completed until October 2023.

While another vendor could eventually provide similar support, there could be up to a nine-month delay to transition services between vendors, obtain security clearances for the new vendor, and bring the new vendor up to speed on the NRC’s data center, security processes, procedures, and numerous ongoing long-term projects. The NRC has strict deadlines to meet with moving systems to the cloud and moving out of the NRC data center. In addition to the time constraints, the NRC faces funding challenges and has limited resources to support the migration to the cloud due to NEIMA mandates on corporate support offices. Any delay in the schedule or duplication of effort would result in increased costs.

Cloud Smart Strategy and Data Center Consolidation:

OMB released the Cloud Smart Strategy in 2018, which provided specific guidance on cloud adoption to include security, procurement, and the necessary workforce skills to foster cloud adoption and implementation. In support of the Cloud Smart initiative, NRC has been working to transition IT systems from the 3WFN data center to the cloud. The NRC has carefully scheduled the migration of all NRC’s IT systems over a five-year period to reduce risk and ensure a smooth transition to the cloud. TekSynap has begun the migration of NRC’s IT systems to the cloud and has transitioned 10 systems to date. The NRC plans to transition approximately 15 systems per year to the cloud over the next four years. Each system being migrated to the cloud has unique components and requires a unique migration approach which is being planned and vetted by the current cloud facilitation team. In addition to meeting Cloud Smart Strategy requirements, the Nuclear Energy Innovation and Modernization Act (NEIMA) requires NRC to budget reduced corporate support costs. The NRC is working to shrink its footprint and release the 3WFN building in 2025, which is where the NRC’s data center is currently located. To close the 3WFN data center, careful planning and coordination is required to transition NRC’s IT systems to the cloud as quickly and efficiently as possible. Any system that is unable to transition to the cloud will need to be moved from the 3WFN data center to a new data center in OWFN/TWFN. The NRC plans to have most of the NRC’s IT systems transitioned to the cloud by 2025. Migrating NRC systems to the cloud will allow the NRC to avoid additional data center refresh costs, which are estimated at approximately $7M.

Any changes to the vendor providing these services would cause delay in NRC plans to have most of the NRC’s IT systems transitioned to the cloud by 2025. A new Contractor would have to become familiar with the NRC’s environments, applications and existing migration strategies for each system. Additionally, any changes in strategy by the new vendor would require development of revised plans and approvals which would cause additional migration delays.

Projects Delayed in FY20 Due to COVID-19 Public Health Emergency:

In March 2020, the agency and country experienced the COVID-19 Public Health Emergency (PHE). As a result of the PHE, TekSynap had to put several critical projects on hold because (1) onsite support was not possible due to PHE, and (2) we diverted their resources to supporting new enhanced telework requirements.

For example, the network refresh, teleconference upgrade, compute and storage migration, and Wi-Fi implementation efforts were all delayed because the NRC facilities were closed for regular daily functions for an extended period and contractors were not able to perform their duties that required them to be onsite and/or travel to Regional Offices.

As stated above, TekSynap diverted their resources to support the following new enhanced telework requirements that resulted from the PHE:

Increasing Internet bandwidth at HQ and Region 4 Implementing split tunneling to reduce HQ network traffic Transitioning from Skype to MS Teams Deploying the SCCM Cloud Management Gateway Configuration to allow remote workstations to bypass the HQ network when performing workstation updates

Providing daily infrastructure utilization reports and graphs throughout each day and presenting IT infrastructure status at daily morning meetings

Adjusting password reset, PIV card enforcement and PIV renewal requirements to work within the non-contact constraints

Upgrading VPN, Netscalers, perimeter firewalls and routers Adjusting endpoint security scanning Installing Nessus agents for vulnerability scanning.

As of November 2021, TekSynap has been able to start the implementation of several of these critical projects, however, they will not be completed by the end of the period of performance. These critical projects are necessary to increase the cyber security posture of the NRC’s IT infrastructure.

b. Reduce FY24 Corporate Cost - Nuclear Energy Innovation and Modernization Act (NEIMA)

The Nuclear Energy Innovation and Modernization Act (NEIMA) puts limits on NRC’s corporate support costs which would be needed to transition such a large contract vehicle. The estimated transition cost for the SNCC BPA Call is approximately $1.7M due to its large and complex technical scope. The transition costs associated with the transition of the SNCC contract were to occur in FY24;

however, the period of performance of the SNCC BPA Call was reduced. Given the reduction in the period of performance, transition will now occur in FY23. The FY23 budget has already been formulated and the transition costs will need to be accounted for with shortfall funding. In addition to the SNCC transition costs occurring in FY23, we had already planned for FY23 transition costs for the GLINDA SOC and GLINDA Mobility BPA Calls. Given current NEIMA restrictions on corporate support funding, transitioning the SNCC contract earlier than anticipated will result in unnecessary financial strain in addition to the technical constraints we will encounter transitioning the SNCC contract in FY23.

Overall, the SNCC BPA Call period of performance was reduced by 18 months due to level of effort increases that occurred after award, in addition to delays associated with a GAO protest of the award. As a result, the total period of performance (not including the transition period) is only approximately 3 years, 8 months and resulted in over $900k in transition cost. This period of performance is significantly shorter than similar IT Infrastructure contract vehicles which on average have at minimum 5 year and a maximum of a 10-year period of performance. Due to the limits on NRC’s corporate support costs, the NRC needs to not only prevent immediately paying SNCC transition cost in FY23, but also to maximize on the over $900k in corporate cost recently expended during the SNCC transition that occurred in FY19.

c. Maintain a stable operational environment during the competition and transition of several other competitive GLINDA BPA Calls.

TekSynap provides vital infrastructure services required to maintain NRC’s day to day IT operations, which allows the NRC to meet its mission. It is critical to ensure a stable operational environment during the recompete, award and transition of our other infrastructure support contracts, specifically the SOC and Mobility BPA Calls, and EUC BPA Calls that will occur in FY22 and FY23.

Currently, the SOC and Mobility BPA Calls will complete transition (if there are no acquisition delays) at the same time the SNCC BPA Call is scheduled to start transition. Transitioning the SNCC contract so soon after the transition (or during the transition) of the EUC, SOC and Mobility BPA Calls will increase operational risk since it takes time to transition the organizational knowledge, clear resources through the NRC’s security process, and to thoroughly familiarize new vendors with all the OCIO service areas. If the SOC and Mobility BPA Calls are transitioned to new vendors, the NRC must ensure a stable infrastructure environment during and immediately after transition.

3. Description of the efforts made to ensure that offers are solicited from as many potential sources as practicable. Indicate whether a FedBizOpps notice was or will be publicized as required by FAR Subpart 5.2 and, if not, which exception under FAR 5.202 applies.

N/A

4. Description of the efforts made by the Contracting Officer (CO) to determine that the cost/price of the contract/order is fair and reasonable consistent with FAR 8.404(d) or 15.406-2.

The Contracting Officer (CO) will request a quotation from the Contractor for extension of the SNCC BPA Call. The quotation will utilize TekSynap’s established BPA Call labor categories and fixed hourly rates that have already been determined to be fair and reasonable. The CO will also request that the COR evaluate the level of effort and the mix of labor proposed to perform specific tasks being ordered via the modification. The CO will only execute the modification after determining that the quotation is fair and reasonable and therefore, represents the best value to the NRC.

5. Description of the market research conducted (see FAR Part 10) and the results, or a statement of the reasons market research was not conducted.

Market research was not conducted. The NRC could competitively award this additional work under the GLINDA BPAs or otherwise but doing so would not be practicable because this work is a logical follow-on to the work performed by TekSynap under BPA Call NRC-HQ-10-17-A-0008/31310018F0052.

6. Other factors supporting the justification, if any.

N/A

7. List sources, if any, that have expressed an interest in the acquisition.

None

8. If applicable, describe the actions the agency may take to remove or overcome any barriers that led to the restricted consideration before any subsequent acquisition for the supplies or services is made.

AMD will closely scrutinize any subsequent significant requests for modification to the SNCC BPA call to determine whether they are adequately documented and reviewed by appropriate approval officials.

9. Certifications

This is to certify that the justification is accurate and complete to the best of my knowledge and belief.

Contracting Officer Representative

Bill Szyperski Date

This is to certify that the justification is accurate and complete to the best of the contracting officer’s knowledge and belief.

Contracting Officer

Domonique Malone Date

APPROVAL:

Competition Advocate

Nicole Stevenson Date

Head of Contracting Activity

Eleni Jernell Date