Redacted CyOSST III Justification and Approval Document Signed 31 Mar 19_Redacted.pdf

FOR OFFICIAL USE ONLY

Justification and Approval (J&A) for Other Than Full and Open Competition

I. Contracting Activity.

38 CONS/OL-A

4004 Hilltop Road Tinker AFB OK 73145-2713

II. Nature and/or description of the action being processed.

This action is to establish a follow-on five year contract to purchase Escal Institute of Advanced Technologies (Doing Business AS (D.B.A.) SANS - System Administration, Audit, Network and Security) Course Training Vouchers. The current contract (FA8773-18-A-0001) is a two-year sole-source award to Escal Institute of Advanced Technologies (D.B.A. as SANS) and will expire 07 November 2019. The commercial Cyber security training is part of the Air Force Cyber Command (AFCYBER) Forces Initial Qualification Training (IQn, Mission Qualification Training (MQT), and Continuation Training (CT). AFCYBER Forces provide direct support to the United States Cyber Command (USCC) as part of the Cyber Mission Forces (CMF), Cyber Protection Teams (CPT), Cyber Mission Teams (CMT), National Mission Teams (NMT), Cyber Support Teams (CST), and 24th Air Force (24 AF)/Weapon System (WPS) crew member positions, (IAW AFI 10-1703v1) and current Air Force Space Command and future Air Combat Command (ACC) Supplements.

The proposed contract type is a Blanket Purchase Agreement (BPA) IAW with Federal Acquisition Regulation (FAR)

13.303. A BPA is the desired vehicle as the customer will require vouchers for numerous training courses and training events; however, the exact amounts and delivery requirements throughout the period of performance are unknown. In response to the growth of Cyber Command and the expansion of the joint cyber mission force, the 39 IOS is currently undergoing a Military Construction (MILCON) project, with an expected completion date in fiscal year (FY) 22 . The MILCON project is expected to add nine additional 30-seat classrooms, at Hurlburt Field, to the existing four classrooms. Meanwhile, the 39 IOS/Det 1 in Lackland AFB, TX added four additional 25-seat classrooms in FY 18. To meet its service requirement for the joint cyber mission force, the Air Force Cyber Training Pipeline Requirement (TPR) is expected to increase with MILCON completion to approximately 2200 students per year.

The BPA is for the purchase of SANS Cyber security course training vouchers and commercial Cyber training environment for advanced commercial Cyber Security, with adjoining American National Standards Institute (ANSI) accredited Global Information Assurance Certification (GIA() attempt for each student.

The SANS commercial training meets specific AFCYBER training requirement within IQT, MQT, and CT for AF Cyber Weapons Systems tasked by USCC Cyber Mission Forces, and 24AF/ AFCYBER forces, respectively. Furthermore, to meet ACC Cyber approved syllabi graduation requirements, students must pass the appropriate GIAC certification test.

From a historical perspective, this BPA will be the second in the series which began with an intial two and half year sole-source award to Escal Institute of Advanced Technologies (D.B.A. as SANS). This BPA will continue and expand SANS commercial cyber training into existing Air Force Cyber curriculum to meet growing ACC and United States Cyber Command (USCC) training requirements. A secondary consideration, but not necessarily a requirement, is whether or not the training meets DoD 8570.01-M positional certification requirements for personnel conducting Information Assurance within the DOD workforce. The tr?ining requirements are a subset of the ACC Task Training List (TIL) for each course and Joint Req·uirements that meet USC( Intermediate Cyber Core (ICC) equivalence. The TIL and Joint Requirements are FOR OFFICIAL USE ONLY and are incorporated by reference. They may be made available for review on a need-to-know, with Contracting Officer approval, by contacting the 39 IOS/CCV (Standards and Evaluation).

This effort will be accomplished in accordance with the authority of 10 USC 2304(c)(1 ), as implemented by FAR 6.302-1, and upholds an "only one responsible source" justification. This Justification for Other than Full and Open Competition covers all purchases made under the BPA for one base year with four options years plus a six month extension of services. The proposed ordering period is 08 November 2019 through 07 May 2025. The total estimated value of this requirement for the entire ordering period is $65,876,400.60.

For clarification: SANS and GIA(, while corporately separate companies, both are tied to the Escal Institute and symbiotic in nature. The SANS company conducts the training and the GIAC company provides the independent ANSI certification testing for the training courses taught by SANS. Many of the SANS courses taught, along with the GIAC

March 2018 FOR OFFICIAL USE ONLY Page 3 of 12 certification, are approved in accordance with DoD Directive 8140.01 and DoD 8570.01-M Cyberspace Workforce Management.

Ill. Description of supplies/services required to meet agency needs.

The Government requirement is for the contractor to provide a portfolio of commercially available cyber security courses that the contractor will teach on-site at a Government provided secure facility, on Government provided equipment; all selected courses must be no longer than six (6) consecutive training days and integrate into the existing flow of Government lessons for each course requiring the commercial cyber training. All hands-on practical lab environments must be installed on Government provided network equipment and infrastructure. The contractor must also provide commercial certification testing for the courses, as needed; where practical and possible the certification should line up with DoD 8570.01-M; all testing must be accomplished at Government provided facility sites, using Government provided equipment and networks. In addition to the course hands-on network labs, the contractor must provide and integrate an advanced cyber training environment with challenging scenarios for the students on Government provided equipment and infrastructure at the Government provided facility sites.

The courses, hands-on network labs, the certification tests, and the cyber training environment must be installed on Government owned and operated equipment, as well as, integrate with existing Government owned and operated courses of instruction. Due to limitations within the Air Force Cyber Training Pipeline (AFCTP), the contractor must integrate each commercial courseware material in one (1) week (up to 6 consecutive training days) of the Government provided courses.

The number and content of the required courses is subject to change as the cyber curricula evolves. Currently, the FTU is· placing the applicable commercial training course inside the Network Warfare Bridge Course (NWBC), the Cyber Warfare Operations (CWO) course, and the Air Force Cyber Defense course (ACD). Within each of these courses, the FTU integrates one commercial cyber training course lasting 6 consecutive training days (or business days). All testing occurs at the FTU. The cyber training environment is installed on FTU equipment, networks and infrastructure; open to all students and staff.

The AFCTP responds to Cyber Operator training needs from the AF, Joint Forces, Combatant C<?mmands, and various Governmental Departments and Agencies with advanced accredited training. The Cyberspace Domain is based on commercially developed technology; therefore, the CyOSST Ill curriculum is specifically designed for highly specialized Cyber Weapon Systems Operators and trainers assigned to the 24 AF/AFCYBER and United State Cyber Command (USCC) Cyber Mission Force (CMF). Those trainees receive cutting edge, unique and innovative commercially based advanced Cyber security training in the latest Cyber offensive and defensive tactics, techniques, and procedures necessary to defend US cyber domain from cyber threats. Moreover, the CyOSST Ill contract permits the flexibility to support other AF Cyber organizations that have no other means to contract additional �pecific training requirements for their certified personnel that combat and protect our interests in Cyberspace.

Through initial market research, the Government has identified that SANS is the only vendor who is commercially offering such cutting edge cyberspace training which meets AFCYBER Cyber curricula. As a result, the AFCYBER needs are met by purchasing on-site training classes and vouchers from SANS for SANS courses (3-5 different courses are currently used for students and staff; this requirement is subject to change), GIA( certification attempts and retests (provided by SANS), and purchasing licensed access to the SANS NetWars/CyberCity Cyber Simulation Training Environments (both Continuous and Tournament versions).

All SANS on-site training courses are scheduled through the 39 105' Contract Officer Representative and registrar to align with the AF Cyberspace operations FTU IQT class schedules plus other AF cyber courses and are purchased, as required; SANS provides appropriately cleared instructors when possible to teach the courses.

Currently, the Government estimates 11,140 vouchers, 1114 re-test vouchers (e.g. plan for a 10% failure rate requiring additional tests for student retesting), access to the licensed continuous SANS Cyber Simulation Training Environment for five years as listed below. Also, an additional 100 "NetWars/ CyberCity" licenses per year for the tournament versions. No additional travel costs are required since the students are already TDY to the FTU or other AF cyber course location.

March 2018 FOR OFFICIAL USE ONLY Page 4 of 12 o www.lSC2.org o www.globalknowledge.com o www.dtic.mil o www.lSACA.org o www.CompTia.org o www.Trainingcamp.com o www.CEDSolutions.com o www.offensivesecurity.com o www.cyberworldinstitute.com di1\ \r.i:J

Each of the sources above (.i.e. except SANS/GIAC} would require each student to travel in order to attend specific courses and take the examination. In order to meet the ACC TIL requirements from the vendors listed above, the six day SANS courses certification replacement would require multiple courses, taught by multiple vendors and an additional 14 days TDY (two weeks} to complete. Finally, the burden of multiple vendor courses will incur extra cost for the additional Temporary Duty extension and vendor costs for student courses and certification examinations.

Currently, there are no expectations that two or more of the above listed sources could satisfy the 39 IOS or other AF cyber course requirements. Services cannot be provided by the AbilityOne program (www.abilityone.gov} at this time.

This acquisition will require a synopsis IAW FAR 5.201.

VII. Determination by the Contracting Officer that the anticipated cost to the Government will be fair and reasonable.

The anticipated contract will be a sole source award to SANS. In depth price analysis will be performed to ensure that the offeror's price is fair and reasonable .

. The anticipated price will be considered fair and reasonable based on comparison of proposed prices to historical prices paid by the Government for the same classes, comparison with a published price list, comparison of proposed price with the IGCE, and analysis of data other than certified cost and pricing data provided by the offeror IAW FAR 15.404.

VIII. Description of the market research conducted and the results, or a statement of the reasons market research was not conducted.

Market Research has been conducted for a long term competitive solution via FBO by issuing a Sources Sought (SS} to search out other interested or qualified parties.

A SS was posted to FBO on 29 March 2018 for 16 days. The SS closed on 20 April 2018, with three vendors (i.e. SANS, CRISP LLC, and Xtreme Solutions} meeting the deadline. Overall, seventeen (17} interested vendors responded to the

SS, which included some vendors that were not registered for the appropriate NAICS code of 541519.

The SS was modified on 25 April 2018, by adding the Market Research Questionnaire (MRQ} which had 400 items requesting information on resources, capabilities, course capabilities requirements, familiarization with AF certifications, accreditation, data, tools, technology, vendor product, and course feedback. The Questionnaire deadline was 25 May 2018 at 4pm.

On 23 May 2018, the contracting officer pushed a reminder to all seventeen interested vendors stating the MRQ deadline was quickly approaching on 25 May 2018. By the close of business on 25 May 2018, the contracting officer had received only one completed MRQ, the ESCAL Institute (SANS}.

On 5 June 2018, the contracting officer sent an email to all interested vendors asking for their rationale on why they

March 2018 FOR OFFICIAL USE ONLY Page 9 of 12 of my knowledge and belief.

XIII. Certification by the technical/requirements personnel.

As evidenced by my (our) signature(s) above, I (we) certify that any supporting data contained herein, which is my (our) responsibility, is both accurate and complete.

March 2018 FOR OFFICIAL USE ONLY Page 12 of 12