JA for Insider Threat Tool_RedactionsApplied.pdf

Navy Marine Corps Acquisition Regulation Supplement MARCH 2026 (Change 26-03)

CUI//SP-PROCURE//DL ONLY

ANNEX 1 – JUSTIFICATION AND APPROVAL

UNITED STATES MARINE CORPS

MARINE CORPS INSTALLATIONS COMMAND

3000 MARINE CORPS PENTAGON

WASHINGTON, DC 20350-3000

MCICOM-JA-26-007

JUSTIFICATION AND APPROVAL

FOR USE OF OTHER THAN FULL AND OPEN COMPETITION

1. Contracting Activity.

Marine Corps Installations Command (MCICOM) Headquarters (HQ) Contracting; Arlington, VA

2. Description of the Action Being Approved.

Award of a contract on a sole source basis for User Activity Monitoring (UAM) from Everfox, LLC (Everfox).

3. Description of Supplies/Services.

The Secretary of War (SecWar) approved an Operations Security (OPSEC) Campaign directing the Department of War Chief Information Officer (DoW CIO), in conjunction with the Under Secretary of War for Intelligence and Security (USW I&S) and the DoW General Counsel to establish a UAM pilot. The goal of the activity is to understand the extent of unauthorized disclosures and exfiltration of information using DoW networks. The UAM tool comprises the continuous and full-time observation and logging of unclassified computer activity by DoW personnel.

Services and Agencies are required to participate and independently resource the DoW designated tool set outlined in the “ENHANCED MONITORING PILOT AT THE PENTAGON RESERVATION CONCEPT OF OPERATIONS (CONOPS), NOV 2020.” On 30 September 2021, MCICOM executed a Task Order (M9549421F0010) with Forcepoint Federal LLC (now Everfox, LLC) to implement the UAM capability the Marine Corps.

UAM is a structured, consistent, and continuous collection and reporting process at the device level for identifying, assessing, deciding upon responses to, and acting upon specific analysis of employee threat behaviors. The purpose of UAM is to gather detailed and substantive content about behavioral activity, which may be indicative of an insider threat. The USMC is required to maintain a UAM capability that contains the following technical ability to collect user activity data:

Controlled by: DON, USMC, I&L HCA Controlled by: MCICOM HQ Contracting CUI Category(ies): PROCURE Limited Dissemination Control: DL ONLY POC: MCICOM Contracting sarah.law.civ Cross-Out sarah.law.civ Cross-Out

Federal and Do W Insider Threat policies require UAM on unclassified networks in suppo1i of Insider Threat. This UAM platfo1m operates exclusively on the unclassified network. Logging, monitoring, and auditing of infonnation system activities can lead to early discove1y and Initigation of behavior indicative of an insider threat. As such, the UAM platfo1m includes consideration of potential acts of violence against organizational resources, including suicidal ideation. The cunent platfo1m consists of three modules:

1.) User Activity Monitoring (UAM) 2.) Behavior Analytics Platfo1m 3.) Case Management System

These three modules perfonn different functions associated with Prevention, Assistance, and Response to insider threats. This action is a continuation of the work previously completed. It includes the expansion, maintenance, and enhancement of the cmTent platfo1m.

Estimated Dollar Value

User Activi Monitorin Federal Insider Threat Services

Total

FY26-31

Total

$36,722,942.02

4. Statut01y Authority Pe1mitting Other Than Full and Open Competition.

10 U.S.C. 3204(a)(l), (as implemented by FAR 6.103-1) - Only one responsible source and no other supplies or services will satisfy agency requirements.

5. Rationale Justifying Use of Cited Statut01y Authority.

Historically, Everfox has architected, tested, and deployed the foundational infrastrnctme for the Marine Corps' Insider Threat (InT) monitoring capability, which comprises three highly integrated platfo1ms. CmTently, the UAM module and the Case Management System (CMS) are fully operational. The third module, the Behavioral Analytics Platfonn, has been constructed and is actively undergoing Security Technical Implementation Guide (STIG) remediation to resolve identified network findings. This rigorous remediation is a mandato1y prerequisite to achieving compliance with Do W secmity mandates and Marine Corps Ente1prise Network (MCEN) standards.

CUI//SP-PROCURE//DL ONLY

CUI//SP-PROCURE//DL ONLY

Crucially, Everfox has already navigated the complex Risk Management Framework (RMF) process to secure the requisite Authorizations to Operate (ATOs) for the two operational platforms.

Because these ATOs are inextricably linked to Everfox’s proprietary architecture, transitioning to an alternate vendor at this critical juncture would effectively nullify the existing authorizations. An architectural change would mandate a complete restart of the RMF authorization process from inception. Based on historical RMF timelines and the complexity of InT systems, a complete restart would introduce an unacceptable operational delay estimated at five to seven years. Such a delay would critically degrade the Marine Corps' InT detection and mitigation capabilities, creating an unacceptable vulnerability in our security posture. Therefore, retaining Everfox is the only viable method to maintain system continuity, achieve Full Operational Capability (FOC) of the Behavioral Analytics Platform, and avoid a catastrophic degradation of this mission-critical program.

While the system is currently provisioned to support users, it requires continuous sustainment (e.g., vulnerability management, patching, version updates) and scalable expansion to encompass user community. The core functionality of this system relies exclusively upon Everfox’s proprietary software. To illustrate the magnitude of this proprietary dependence, approximately $36,722,942.02 contract value is allocated directly to these proprietary licenses.

Procuring these requirements through third-party resellers or non-publishers introduces unacceptable risk to the Government. Specifically, the Government would lack direct privity of contract with the Original Equipment Manufacturer (OEM), Everfox. This lack of privity creates severe programmatic risks, including delayed implementation of critical security enhancements, restricted access to alter backend infrastructure or source code, and the introduction of excessive pass-through charges. Furthermore, utilizing a reseller creates a high risk of violating the 51 percent Limitation on Subcontracting requirement and poses a severe supply chain continuity risk should the prime-subcontractor relationship dissolve. Ultimately, attempting to compete this requirement would result in a substantial duplication of cost to the Government—driven by the need to rip-and-replace the proprietary foundational architecture and retrain the workforce—that is not expected to be recovered through competition.

In conclusion, the continued utilization of the incumbent vendor, Everfox, is imperative to ensure the uninterrupted operation, integrity, and regulatory compliance of the Marine Corps Insider Threat Program, which is a statutory mandate. Award to any other source would result in unacceptable delays in fulfilling the agency's requirements and a substantial duplication of cost, firmly justifying a sole-source award pursuant to 10 U.S.C. 3204(a)(1) as implemented by FAR 6.103-1.

6. Description of Efforts Made to Solicit Offers from as Many Offerors as Practicable.

The Government performed market research on potential sources through the issuance of a sources sought notice (M9549426R0019 was issued on: 19 May to 29 May 2026). As a result, 17 responses were received. None of the capability statements provided sufficient evidence of an integrated solution that would build on the Everfox (incumbent’s) solution. A summary of the narrative is as follows:

Duplication of Contract Costs: The PWS explicitly states that the Everfox platform is "mostly fielded" and requires sustainment and STIG remediation. Several vendors represent OEMs of

CUI//SP-PROCURE//DL ONLY

alternative solutions. Selecting an alternative OEM would require a "rip-and-replace" approach.

This introduces the risk of duplicating contract costs, as the Government would abandon sunk costs in the existing Everfox deployment and pay new licensing, deployment, and accreditation (ATO) costs for a new platform. This would lead to a significant delay in fielding a new system rather than continuous expansion of the existing system.

Privity of Contract and Licensing: The Sources Sought specifically requires respondents to be the OEM (Everfox) or an authorized reseller. If a third-party integrator wins the contract but lacks a formal reseller agreement with Everfox, the Government may face privity of contract issues. Without direct privity or an authorized channel, the Government risks losing access to Tier-3 OEM support, software updates, and liability protections.

Scope Alignment Risk and CNSSD Compliance: Some solutions focus on human-behavior observation rather than the comprehensive IT and endpoint monitoring (keystroke logging, file shadowing, Cisco switch management) mandated by the Committee on National Security Systems Directive 504 (CNSSD 504) and the PWS. This does not meet requirements of the PWS or the instructions with the sources sought. Other solutions are not fully compliant with CNSSD

504. The CNSSD 504 requires an organization to implement robust UAM and analytic capabilities to detect, deter, and mitigate insider threats on National Security Systems (NSS). The core technical attributes of a system compliant with CNSSD 504 include:

Several of the systems do not meet the full functionality requirements necessary to be considered compliant with the directive.

Conclusion: As the incumbent OEM, Everfox is the sole vendor capable of delivering the required proprietary software while avoiding duplicated costs, compliance risks, and the lack of direct privity.

7. Determination of Fair and Reasonable Cost. The Contracting Officer has determined the anticipated cost to the Government of the supplies and services covered by this J&A will be fair and reasonable. In accordance with FAR 15.404-1(b)(2), the Government will ensure a fair and reasonable price by comparing the contractor's proposed prices to historical prices paid by the Government for the same proprietary services under the existing task order, M95494-21-F-0010.

This predecessor task order serves as a highly valid basis for comparison under FAR 15.404-

CUI//SP-PROCURE//DL ONLY

1(b)(2)(i) because it contains similar terms and conditions and represents a verified market-tested price. The Contracting Officer will adjust this historical baseline using a validated inflation index to cross-reference the contractor's proposed rates and ensure they align with proposed rates.

Additionally, the Independent Government Cost Estimate (IGCE) will also be used as a basis for comparison IAW FAR 15.404-1(b)(5). Technical experts will review the proposal to confirm the pricing accurately represents tasking within the Performance Work Statement (PWS), and the final price reasonableness determination will be formally documented in Business Clearance Memorandum (BCM) prior to award.

8. Actions to Remove Barriers to Future Competition.

For the reasons set forth in Paragraph 5, MCICOM the core of this requirement is the sustainment and expansion of Everfox's proprietary software architecture. The Government has determined that it is not feasible to separate the services (such as system maintenance and help desk support) from the proprietary software licenses. Therefore, MCICOM has no plans at this time to compete future contracts for this requirement. If the Government’s requirements change, or another potential source emerges, MCICOM will reassess the feasibility of competition.

MCICOM-JA-26-007

CERTIFICATIONS AND APPROVAL

TECHNICAL/REQUIREMENTS CERTIFICATION

I certify that the facts and representations under my cognizance which are included in this Justification and its supporting acquisition planning documents, except as noted herein are complete and accurate to the best of my knowledge and belief.

Technical Cognizance:

Requirements Cognizance:

LEGAL SUFFICIENCY REVIEW

I have determined this Justification is legally sufficient.

CONTRACTING OFFICER CERTIFICATION

CUI//SP-PROCURE//DL ONLY

I certify that this Justification is accurate and complete to the best of my knowledge and belief.

DIRECTOR OF CONTRACTS APPROVAL

Upon the basis of the above justification, I hereby approve, as the Director of Contracts, the solicitation of the proposed procurement(s) described herein using other than full and open competition, pursuant to the authority of 10 U.S.C. 3204(a)(1).

CUI//SP-PROCURE//DL ONLY

Distribution List for DL ONLY Limited Dissemination Control MCICOM HQ Contracting Personnel

LB Personnel

Procurement Team Personnel (to include but not limited to: Legal, Customers/Requirements Owners, Source Selection Personnel, Small Business Representatives)

Any other individual designated by the KO sarah.law.civ Cross-Out