PKI IASS FOE Final and Approval_Redacted.pdf

Justification for an Exception to Fair Opportunity or to Use Brand-Name Restriction

FOR OFFICIAL USE ONLY

November 2018 FOR OFFICIAL USE ONLY Page 2 of 5

SIPRNet Authority to Operate (ATO). The accreditation is obtained by and tied to the prime contractor and cannot be transferred to another contractor. This space is required for Registration Authority (RA) activities and PKI SPO classified discussions and email access.

For reasons discussed above, the Enterprise Information Technology & Cyber Infrastructure Division, Identity Solutions Branch (AFLCMC/HNID) proposes to award a logical follow-on task order to X Technologies, Inc. under General Services Administration's (GSA) One Acquisition Solution for Integrated Services (OASIS), Pool 3, Small Business (SB), Multiple-award, Indefinite Delivery Indefinite Quantity (MA IDIQ) using exception to fair opportunity procedures. The purpose of the proposed task order is for the PKI System Program Office (SPO) to acquire follow-on Information Assurance Support Services (IASS) to implement and sustain the AF components of DoD PKI for the AF and for development of identity solutions. More importantly due to the activities described above, uninterrupted access to the current secret facilities and retention of contractor staff expertise are imperative to successfully execute CAC Modernization/Migration and field DoD PKI Increment 2.

The contract types planned for this effort are Cost-Plus-Fixed-Fee (Sustainment Services) and Cost Reimbursement (Travel and Other Direct Costs).

(3) Description of the supplies/services required to meet the agency's needs:

Under the contemplated contract, X Technologies will continue to provide support services to implement and sustain the AF components of DoD PKI and development of identity solutions. X Technologies was previously awarded a competitive task order FA8307-15-F-0012 for $65M under GSA's OASIS, Pool 3, SB, MA IDIQ contract to accomplish the very same tasks.

X Technologies had the ability to hire and retain all key personnel and the remaining staff from the previous contract.

The current period of performance (PoP) for that task order is 31 May 2020.

Under the proposed logical follow-on task order, X Technologies will provide personnel with extensive expertise in IA and PKI to provide customer support. For this effort personnel must have expertise in certificate generation, CAC issuance, help desk support specifically associated with PKI (to include Tier 3), server configuration, software configuration and test, network configuration and operation, planning, managing risk, operating networks, and the certification and accreditation process to carry out duties. Major tasks include but are not limited to: Registration Authority/Local Registration/Verification Officer, AF help desk, Public Key (PK)/IA Enabling, Deployment/Network Support, Training, Integration/Test, Operational Support, Project Lead/Oversight, Performance Reporting, and Contractor Facility Support. In particular, the key DoD efforts described in Section 2 require extensive expertise with RA, help desk, and network engineering support with respect to PKI and the AF and DoD efforts that have been supported for over four years and will be continuing.

The total estimated value of this Fair Opportunity Exception (FOE) is . Cost estimators used current contract costs to estimate the base year of the new contract and added inflation for the options. The order will be issued in accordance with the terms and conditions of GSA's One Acquisition Solution for Integrated Services (OASIS), Pool 3, SM, MA IDIQ. The anticipated PoP for this order is sixty (60) months from award consisting of one (1) twelve-month base period and four (4) twelve-month option periods. This 60 month PoP is required because of (1) the current and anticipated future schedule slips for DoD Increment 2, (2) the significant increase of requests for support from users and system owners after CAC Modernization/ Migration, and (3) the time required to obtain a government leased facility that will include a SIPRNet area. These are also discussed in sections 2, 4 and 7. Lastly, this effort will utilize 3400 Operations and Maintenance appropriations.

(4) Identification of the exception to fair opportunity and the supporting rationale:

Federal Acquisition Regulation (FAR) 16.505(b)(2)(i) requires a Contracting Officer to give every awardee a fair opportunity to be considered for a delivery-order or task-order exceeding $5K unless one of the statutory exceptions applies. The specific circumstance that justifies restriction for this acquisition is FAR 16.505(b)(2)(i)(C), "The order must be issued on a sole-source basis in the interest of economy and efficiency as a logical follow-on to an order already issued under the contract, provided that all awardees were given a fair opportunity to be considered for the original order".

Due to critical program events described in Section 2, and as a result of its current PKI IASS experience described in Section 3, X Technologies, at this time, is the only source capable of fulfilling this requirement. At this key stage of implementation and work continuing into late CY20, if CAC Modernization and DoD PKI Increment 2 are not executed by a contractor staff who are

November 2018 FOR OFFICIAL USE ONLY Page 3 of 5 intimately familiar with these efforts, a high risk exists that would cause severe mission disruption across the AF. This risk is increased with higher consequences if access to secret facilities is interrupted for any amount of time.

A significant increase in Help Desk calls from users and system owners requesting support is anticipated between May - September 2020 and could continue until all AF users obtain a new modernized CAC three years later. It is critical for contract staff to already have extensive background knowledge of and experience with these efforts, and have processes already in place to quickly design solutions to restore mission capabilities. AF cannot risk losing contractor subject matter experts (SMEs), Registration Authorities (RAs), Help Desk (e.g. Tier 3), and Engineers who have been working CAC Modernization the last four years. X Technologies has processes and staff in place to ensure timely responses for customers to minimize downtime for critical systems. Therefore, award to any other source at this time would result in substantial retraining, adaptation of process, and duplication of cost to the Government that would not be expected to be recovered through competition resulting in unacceptable delays in fulfilling the agency's mission requirements. The CAC modernization will have completed less than 30 days before contract renewal and identification of systems that did not properly prepare will still be occurring. Without the existing SME support, delays in identification, as well as resolution, will occur. Additionally, the DoD PKI Increment 2 testing and fielding events are expected to continue through summer CY20. Without the SME support, AF will not have experienced personnel during AF testing to identify discrepancies found during testing and resolve those new discrepancies, as well as, ones that have not been resolved before current renewal.

Significant time is required for contractor personnel to become proficient with AF and DoD PKI and with PKI in general. RAs require at least two months for training, certification, and approval to perform their duties. Another three to four months performing their duties are required before they can proficiently work alone so new RAs cannot immediately support the DoD efforts. There for training, but the 6-8 months required for an RA to be able to perform the duties required for CAC Modernization/Migration or DoD PKI Increment 2 would amount to . There are no other AF RAs. This contract provides all RAs to support the entire AF. So, the more significant impact is the schedule delays that would occur if the RAs cannot perform these duties for the first 6-8 months of the contract. For example, the delays to the AF would result in systems being down because RAs could not issue certificates, or could not issue the certificates in the time required for the systems to be operational. Engineers require at least a year hands-on experience with AF and DoD PKI to proficiently support DoD PKI Increment 2 and CAC Modernization/Migration, so new engineers cannot immediately support the AF and DoD efforts. There is no training that can be provided for this very specialized work . At this late stage of these efforts, Engineering personnel will not have the background to work on them if they are new to the program.

Moreover, the current contract is being executed in the Government funded, Contractor leased X Technologies facility that was required and approved for execution of this contract. This facility not only houses the X Technologies IASS contract staff, the other PKI SPO personnel are housed there as well which all totals

. The PKI SPO mission requires an accredited space and network for processing and storage of secret collateral information. X Technologies has already completed phase 1 and has obtained accreditation for a cleared area for the processing and storage of this information. Phase 2 for accreditation of the SIPRNet is already in progress and is expected to be completed by June 2020. Although the facility lease can be transferred to a new prime contractor, accreditation of the area and SIPRNet cannot be. This results in starting over with a 9-14 month process and

At the time the Government funded, Contractor leased facility was approved and added to the contract, neither the Government nor the Contractor was aware of the SIPRNet accreditation limitations/requirements. This became known as the accreditation process progressed.

Because SIPRNet in the Contractor leased facility is not accredited, the RAs supporting the PKI SPO are currently working in a Government leased facility (previous work place of the PKI SPO, not an X Technologies leased facility).

Other PKI SPO personnel also use SIPRNet in the Government leased facility on a daily basis. The facilities are about two blocks away from each other. By September 2020, it is projected that this Government leased facility will no longer be available for the RA's use. The Government organization with the lease is moving to another location about 13 miles away and all tenants must vacate this space. This will happen regardless of who the follow-on contractor will be.

If the follow-on contract is awarded to a contractor other than X Technologies and the SIPRNet accreditation process in the facility currently leased by X Technologies must start over again, SIPRNet will not be accredited and available

November 2018 FOR OFFICIAL USE ONLY Page 4 of 5 before the RAs and other PKI SPO personnel must vacate their current facility. AF-wide RA SIPRNet activities will be completely stopped. RAs will be unable to issue approximately certificates annually for devices, SIPRNet tokens, and VIP/ALT tokens which will result in AF users and system administrators experiencing severe mission failure and denial of service to critical AF assets when they cannot authenticate to classified systems, applications, and websites. Additionally, RAs must interact with the other PKI Government and Contractor SPO personnel on a daily basis, many times face to face.

Without access to the current Government leased facility or one within close proximity, delays in answering urgent taskers, loss of collaboration among teams, and increase in lost productivity due to reduced access to the network will occur. Consequently, award to any other source would result in the SIPRNet accreditation process starting all over resulting in substantial duplication of cost to the Government that would not be expected to be recovered through competition and unacceptable delays in fulfilling the agency's requirements.

(5) Contracting Officer's determination that the anticipated cost to the Government will be fair and reasonable:

The Government will perform a thorough cost/price analysis of the Contractor's proposal. As required by FAR Part 15, cost or pricing data will be obtained when no exception applies. The Contracting Officer (CO) is working with the Program Management Office (PMO), Defense Contract Management Agency (DCMA) and Defense Contract Audit Agency (DCAA), as appropriate, and will conduct a thorough technical and cost/price analysis. A determination of price fair and reasonable pricing as required by statue and regulation, will be made by the CO.

(6) Other facts supporting the justification:

None.

(7) Actions the agency may take to remove or overcome any barriers to increasing fair opportunity before any subsequent acquisition for the supplies or services:

Market research was conducted in accordance with FAR Part 10. A Request for Information (RFI) entitled, "PKI Information Assurance Support Services", was released to vendors under U.S. General Services Administration's (GSA) GSA OASIS Small Business Multiple Award ID/IQ Pool 3 and the NETCENTS Network Operations (NETOps) and Infrastructure Small Business contracts. Scope determinations were requested from GSA Oasis and NETCENTS NETOps (Mandatory Source) and both determinations were in scope of their contracts.

Respondents were requested to respond to the notice by submitting a capability statement that included the following information: 1) inform the Government of the business size standard particular to the NAICS 541330, 2) suggestions on contract type (CPFF, FFP, T&M, etc), and 3) company overview and experience to perform the tasks in the RFI. The Government received five responses from the GSA OASIS Pool 3 RFI and six responses from the NETCENTS NETOps RFI. One company replied to both.

Market research revealed that there are multiple vendors that appear to have some of the experience needed to perform this effort. However, for reasons discussed in Section 4 above, only X Technologies has the ability to satisfy all requirements within the needed time-frame. The Government will continue to monitor market information to determine whether other sources for the same or similar services can meet the needs for future procurements. The risks associated with the DoD PKI PMO's CAC Modernization and Increment 2 implementation will no longer be a factor at the end of this follow-on order. Additionally, by the time this order ends in 2025, it is expected that the Identity Solutions Branch, that includes PKI, will have a Government facility with a SIPRNet area that a new contractor's RAs can work until the new contractor can obtain accreditation for the cleared area and the SIPRNet. So, it is anticipated that full-and-open competition will be available in the future.

(8) Program Manager's certification that supporting data is accurate and complete:

As evidenced by my signature below, I certify that any supporting data contained herein, which is my responsibility, is both accurate and complete.