Redacted Justification and Approval.pdf

Page 1 of 5 Pages

JUSTIFICATION FOR OTHER THAN FULL AND

OPEN COMPETITION (OTFAOC)

Federal Acquisition Regulation (FAR) Part 6 Justification & Approval (J&A), Supporting Procurements under FAR Part 12, and FAR Part 15

Purchase Request Number: TBD Contract Number: TBD Procurement Title: Implement solution with Federal Information Processing Standards (FIPS) and National Institute of Standards and Technology (NIST)-approved user authentication for Financial Accounting and Budget System (FABS) Estimated Value:

Statutory Authority: 10 U.S.C. 2304(c)(1) and FAR 6.302-1

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION (OTFAOC)

Upon the basis of the following justification, I, as the Contracting Officer, hereby approve the use of other than full and open competition of the proposed contractual action pursuant to the authority of 10 U.S.C. 2304(c)(1) and FAR 6.302-1, Only one responsible source and no other supplies or services will satisfy agency requirements.

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

DISA/Services Development Directorate (SD) Program Management Office (SD2) PO Box 549 Fort Meade, MD 20755

Contracting Activity:

DISA/Defense Information Technology Contracting Organization (DITCO) National Capital Region (NCR)/PL62 PO Box 549 Fort Meade, MD 20755

2. NATURE/DESCRIPTION OF ACTION(S):

The purpose of this action is to award a new firm-fixed price (FFP) sole source contract for a base period of six (6) months. The contract will also include FAR 52.217-8 that allows the Government to extend the term of the contract by up to 6 months for circumstances unforeseen by the Contracting Officer.

3. DESCRIPTION OF SUPPLIES/SERVICES:

FABS manages and tracks the financial aspects (e.g. accounts payable, vendor invoices, vouchers) associated with telecommunication circuits, equipment and services leased from

Page 2 of 5 Pages various carriers/vendors on behalf of the Government through the Defense Working Capital Fund/Telecommunications Services/Enterprise Acquisition Services (DWCF/TS/EAS).

Financial transactions are sent from Contractual Online Procurement System (COPS) to FABS, which generates accounts payable for vendor payment. FABS also supports customer billing indicating monthly recurring charges, non-recurring charges and overhead. Accounts receivables are established to generate billing.

FABS leverages Cincom Task Management System (CTMS), which includes the Entire menu facility. Entire provides an Application Program Interface (API) that the majority of the Defense Information Technology Contracting Organization (DITCO) uses. Entire also provides a user access controls facility and a menu facility. The Entire Security (sign-on control) facility has been found to be inadequate for DITCO’s control of access to the applications. Specifically the requirement for encrypted passwords processed through the Top Secret security system in use at DISA needs to be enabled and supported. The solution to the requirement is to develop an interface with Computer Associates Top-Secret (CATS), for the Entire Menu facility to the approved security package, Top Secret. The solution will use Top Secret to validate the User and User’s Password. This will allow Entire to accept the protected username and password creating a “single sign-on”. The objective is to develop and procure a user authentication capability that:

Meets the needs of the Risk Management Framework (RMF) and National Institute of Standards and Technology (NIST) security requirements.

Develop a method of logging user’s access to Entire and the ability to audit those logs.

Provides a secure method for authenticating users.

Seamlessly interoperates with the existing FABS capability.

Maintains the current Menu Facility with which the DITCO application users are familiar.

4. IDENTIFICATION OF STATUTORY AUTHORITY:

Only one responsible source and no other supplies or services will satisfy agency requirements, 10 U.S.C.2304(c)(1) and FAR 6.302-1/DFARS 206.302-1.

5. DEMONSTRATION OF CONTRACTOR’S UNIQUE QUALIFICATIONS:

(a) Justification.

(1) Minimum Government requirements.

The Governments minimum requirement is to design and implement a FIPS and NIST-approved user authentication solution for FABS. The solution will use Top Secret to validate the User and User’s Password. The objective is to develop and procure a user authentication capability that:

Meets the needs of the Risk Management Framework (RMF) and National Institute of

Standards and Technology (NIST) security requirements.

Page 3 of 5 Pages

Provides a secure method for authenticating users.

Seamlessly interoperates with the existing FABS capability.

Maintains the current Menu Facility with which the DITCO application users are familiar.

(2) Proposed sole source contractor.

The proposed sole source contractor is Cincom, which is a large business. This requirement will be procured with a sole source contract due to the unique technical parameters involved. Cincom is the original equipment manufacturer (OEM) for Cincom software applications. Cincom owns all proprietary rights to the source code and is the only contractor that is capable of providing the required software support.

No other vendor can legally obtain access to the software, nor can they make duplicate copies, since it is protected by copyright and patent laws. The impact to schedule, cost, and performance will be minimal by awarding this effort as sole source to Cincom. They will be able to meet the customer’s requirement by having access and the ability to update any proprietary source code.

(3) Discussion regarding cause of the sole source situation.

FABS is an older legacy mainframe application that has been in use for many years.

A third-party audit was recently conducted to review security measures on the DISA’s FABS. The audit concluded that the previous acceptable security measures are now non-compliant. The Government requires FABS to be brought into compliance. A single integrated procurement solution, which is built upon and with Cincom’s proprietary Total software, and is a key element of satisfying the solution for the audit finding. This effort will encompass security and support tasks for the FABS environments. FABS security platform operating environment includes the brand name Cincom software. Cincom software is fully implemented and integrated into DISA’s architecture and has been for more than fifteen years. There are no similar products on the market that can offer the same functions as the ones currently available from Cincom software. The software licensing, support, and purchase of the additional proprietary software products are available from only Cincom, and no other type of software will satisfy the Agency requirements. Cincom owns all proprietary rights to the source code and has no authorized resellers. Cincom is the only vendor that is able to meet the customer’s requirement by having access and the ability to update any proprietary source code. In addition, it is not economically feasible to deviate from the currently installed proprietary environment.

(4) Impact. Failure to complete the FABS security requirements will adversely impact DISA’s ability to achieve a secure, compliant environment for the FABS user. The application’s Authority to Operate (ATO) will be in jeopardy if this security finding is not successfully remediated. . Failure would undoubtedly hurt ongoing operations and support to the warfighter and DISA’s ability to meet DoD directives.

Page 4 of 5 Pages

6. FEDBIZOPPS ANNOUNCEMENT/POTENTIAL SOURCES:

(a) A synopsis for this action will be published on the Contract Opportunities website, as required by the FAR 5.201(b)1(i). The synopsis will completely identify the Government's minimum mandatory requirements. DISA does not anticipate any other qualified sources; however, should any responses be received, they will be evaluated to determine if they are fully responsive to the Government's stated minimum requirements and will be considered by DISA prior to proceeding with an award. This proposed procurement is the only known approach to license and maintain the proprietary software.

7. DETERMINATION OF FAIR AND REASONABLE COST:

A determination will be made by the contracting officer that the order represents the best value to the Government, as defined in FAR 2.101, and results in the lowest overall cost alternative (considering price, special features, and administrative costs) that meets the Government’s needs.

The contracting officer will determine that the resulting contract prices will be fair and reasonable, based on comparison with previous contracts. The contracting officer will also determine the pricing information valid for comparative purposes. Certified cost and price data is not required for this commercial item acquisition, in accordance with FAR 15.403-1(b)(3). The contracting officer will determine whether the price is fair and reasonable based on:

a. Comparison of the proposed prices to historical and existing prices paid for the same or similar items.

b. Comparison with competitive published price list and published market prices of the same commodities.

c. Comparison of proposed prices with the independent Government cost estimate.

8. MARKET RESEARCH:

Based on current market research conducted from December 2019 to January 2020, it has been determined that only that Cincom, can fully support the Governments need. This requirement is for proprietary product support and no competitor functional replacement products exist in the market at this time to meet the Government's need. The Government will continue to conduct market research to determine if there are changes in the market place that would enable future competitive actions, i.e. there are similar products and/or product support in the marketplace that provides the same functionality, the original equipment manufacturer releases ownership rights of product, or it is economically feasible to procure a new system.

9. Upon the basis of the following justification, I, as the Contracting Officer, hereby approve this sole source justification for the proposed contract action pursuant to the authority cited above as the particular service is essential to the Government's requirements, and market research indicates other companies' products or services do not meet, or cannot be modified to meet, the agency's needs. Based on the justification provided by SD2, a determination has been made to issue a sole source solicitation for the above described requirement.