Limited_Sources_Justification_and_Approval.pdf

Limited Sources Justification and Approval (J&A)

FOR OFFICIAL USE ONLY

March 2018 FOR OFFICIAL USE ONLY Page 1 of 6

Contracting Activity: 1 SOCONS/PKA

Purchase Request / Local ID Number: N/A

Program / Project (and PE, if applicable): Amazon Web Services BPA

Program Type (PEO or Other Contracting): Contracting

Authority: Multiple Award Schedule Program (FAR 8.405-6)

Estimated Contract Cost (including options): $3,600,000.00

Is this a Bridge Action as defined in the AF Bridge Action Reduction Plan? Yes No

Description of Limitation:

FAR 8.405-6 requires the ordering activity to justify its action when restricting consideration for orders or Blanket Purchase Agreements (BPAs) exceeding the micro-purchase threshold based on a limited sources justification.

The 492d Special Operations Advanced Capabilities Squadron (492d SOACS) currently requires security information Impact Level 4 Infrastructure as a Service (IaaS) through Amazon Web Services (AWS) for the continuation and growth of a portfolio of serving the warfighter with global access to data and software.

Department of Defense Cloud Computing Security Requirements Guide (CCSRG) defines 6 information impact levels. Impact levels are based on the type of data being hosted in the cloud and outlines security objective considerations. AWS is the only source capable of providing the services required because of the required Federal Risk and Authorization Management Program (FedRAMP) approvals (Level 4 Security) and the IaaS architecture presently designed and authorized to operate are unique and highly specialized.

FedRAMP is a Federal Government program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. FEDRAMP is mandated for use by all Federal Agencies by the Office of Management and Budget (OMB). OMB policy requires Federal departments and agencies to utilize FedRAMP approved Cloud Service Provider (CSP)s and share Agency Authority to Operate (ATO)s with the FedRAMP Secure Repository. Level 4 accommodates Controlled Unclassified Information (CUI) which is the categorical designation that refers to unclassified information that under law or policy requires protection from unauthorized disclosure as established by Executive Order 13556 (November 2010) or other mission critical data.

Though the 492d SOACS currently has a requirement for security information Impact Level 4, there exists a reasonable and anticipated need to obtain security information Impact Level 5 and Level 6 over the next 5 years due to AFSOC's projected cloud portfolio expansion. Amazon GovCloud is approved through level 6 security.

COORDINATION (AFFARS 5306.304(a) )

** To remove a row, click the "X" next to the signature block.

** To restore the row, click the appropriate link to the right: CSO Legal COCO CA SCO PEO AQC AQ Blank-1 Blank-2PM CO

Date

24 May 2018

Project Lead / Program Mgr / Requiring Activity MARCUS WHITE, Capt, USAF

492 SOACS/ACE (850)-994-8575

Signature X

Date

24 May 2018

Contracting Officer

SHATAYA BUTLER

1 SOCONS/PKA (850)-884-3266

Signature X

Date

05 Jun 2018

Local Legal Reviewer

STEPHEN EDWARD SEE, GS-13, DAF

Attorney-Advisor, 1 SOW/JA (850)-884-4584

Signature X

March 2018 FOR OFFICIAL USE ONLY Page 2 of 6

Date

05 Jun 2018

Services Flight Chief

ANGELA MAHER

1 SOCONS/PKA (850)884-1258

Signature X

Date

07 Jun 2018

Chief of the Contracting Office (COCO)

CHRISTOPHER WENTWORTH

1 SOCONS/DBO (850) 884-1250

Signature X

APPROVAL (AFFARS 5306.304(a) ) ** To remove a row, click the "X" next to the signature block.

** To restore the row, click the appropriate link to the right: COCO CO CA SPEPEO Blank

Date

25 Jun 2018

Competition Advocate JASON WHITTLE, Lt. Col.

AFICA/KO (850) 884-3990

Signature X

March 2018 FOR OFFICIAL USE ONLY Page 3 of 6

Remove guidance pages.

I. Contracting Activity.

Department of the Air Force, 1st Special Operations Contracting Squadron/PKA, Hurlburt Field, FL 32544.

Contracting Officer: Shataya Butler (850)884-3266.

II. Nature and/or description of the action being processed.

1 SOCONS intends to solicit, evaluate, and award a five year centralized BPA for Infrastructure as a Service (IaaS) or Cloud services through Amazon Web Service (AWS) on a brand name basis utilizing the General Services Administration's (GSA's) Schedules. FAR 8.4 procedures will be used in executing this requirement.

This is a follow-on to BPA FA4417-17-A-0030, competed on a brand name basis under GSA Schedule 70, awarded to Development Consultants Incorporated. Establishment of this BPA is required due to the 492 SOACS's projected requirements which are anticipated to reach the maximum ceiling amount of $450K under BPA FA4417-17-A-0030 by August 2018.

This requirement will utilize GSA Schedule 70.

The estimated period of performance will be a base period plus four option years IAW FAR 8.405-3(d)(2).

BPA price list will be established as Firm Fixed Price.

III. Description of supplies/services required to meet agency needs.

This requirement is for Infrastructure as a Service (IaaS) via Amazon Web Services (AWS). IaaS Services allow AFSOC users to access applications anywhere at any time using desktop and/or mobile devices. The AFSOC cloud requires certain specialized infrastructure to contain the current AFSOC Cloud software portfolio, security configuration, and Authority to Operate (AtO).

All Amazon services listed above are Performance-Based Services. IAW FAR 37.602, a Performance of Work Statement (PWS) has been developed for the requirement. A PWS is appropriate for this requirement because it allows for flexibility with open market pricing by allowing contractors to determine how to achieve the Government's desired results.

Quantities and price of each Amazon Web service will be established at the time of award.

The total estimated value of this five (5) year BPA is $3,600,000.

Base Year: $610,391.40 Option 1: $654,743.40 Option 2: $699,095.40 Option 3: $743,447.40 Option 4: $787,799.40

These estimated prices are based on historical data usage rates obtained through BPA FA4417-17-A-0030, March 2018 FOR OFFICIAL USE ONLY Page 4 of 6

AWS Cloud Services. The prices are noteably higher than the previous BPA due to the rapid expansion of data usage within the AFSOC Cloud.

The following CLINs are included in this BPA:

0001: API Gateway (Hr) 0002: DynamoDB (Hr) 0003: EC2 (Hr) 0004: EFS (Hr) 0005: ElastiCache (Hr) 0006: Kinesis (Hr) 0007: RDS (Hr) 0008: Route 53 (Hr) 0009: SES (Hr) 0010: SNS (Hr) 0011: SQS (Hr) 0012: S3 (Hr) 0013: VPC (Hr) 0014: CloudWatch (Hr) 0015: CloudTrail (Hr) 0016: Config (Hr) 0017: Direct Connect (Hr) 0018: KMS (Hr) 0019: Lambda (Hr) 0020: Support (Hr)

Rates are charged based on the Government's monthly usage of each CLIN above. CLIN quantity for each digital service is measured by "hour" of usage.

IV. Identification of the justification/rationale for limiting sources and demonstration of the contractor's unique qualifications to provide the required supply/service.

FAR 8.405-6 requires an ordering activity to justify its actions when restricting consideration of schedule contractors to fewer than required in 8.405-2. In accordance with FAR 8.405-6(b)(1), "The item is peculiar to one manufacturer."

The 492d SOACS began using AWS' IaaS based on Government security approvals for available Cloud Service providers around 2015. AWS was the only service provider capable of sustaining the Government's requirements at that time. Since then, 492d SOACS invested significant resources while developing war fighter applications within the AWS infrastructure. For instance, 492d SOACS has developed an entire suite of applications and security services that uniquely depend on the interface provided by AWS. To move to another Cloud vendor would require significant time, funding, and resources to acquire the talent, develop the architecture, redesign software applications, and then finally develop, test, and implement a new security infrastructure.

Establishing a presence in a Cloud environment requires the team to possess specific skills of which 492d SOACS already has in place for the AWS environment. 492d SOACS investments in this area to date exceed $2M and any change in IaaS vendor would require an equivalent investment to achieve the status

March 2018 FOR OFFICIAL USE ONLY Page 5 of 6 quo and would result in a setback in providing services to the war fighter by at least one year to architect to the new vendor IaaS.

V. Determination by the ordering activity Contracting Officer that the order represents the best value consistent with FAR 8.404(d).

The Government will make a best value determination based on a comparison of proposed prices received in response to the solicitation. The RFQ along with this Justification & Approval will be posted to GSA's eBuy. A review of the contractor's proposed price list and any documents provided by the vendor will be included in the best value determination. A price fair and reasonable determination will be included in the best value determination.

VI. Description of the market research conducted and the results, or explain why market research was not conducted.

A review was conducted utilizing GSA's Schedule 70, SIN 132 40 on 1 March 2018. There are a total of 56 small businesses, 9 of which responded to our sources sought in May 2017 stating they are capable and interested in providing the required IaaS through AWS. Five of these small businesses provided quotes when the previous BPA was competed.

A search was conducted on 30 Mar 18 on DoD ESI website to determine if there were any current DoD software agreements for IaaS. It was found that DoD ESI currently has focus placed on Software as a Service (SaaS). There are currently no Master Service Agreements with IaaS providers for use.

A search was conducted on 22 Mar 18 on NETCENTS to determine if NETCENTS could meet the needs of the Government under this acquisition. A search on the NETCENTS 2 products and pricing data revealed no cloud computing products.

A Sources Sought was posted to GSA this year on 16 Apr 18 for a period of 11 days. The Sources Sought closed on 27 Apr 18. A total of 8 vendors responded indicating they could perform the services as stated in the PWS.

Additionally, an email was sent to NETCENTS-2 Customer Support (netcents@us.af.mil) at Maxwell AFB, Gunter Annex AL requesting confirmation that NETCENTS cannot perform AWS services.

AFLCMC/HICI - NETCENTS responded on 27 Apr 18 stating "Netcents-2 does not work with Amazon for any cloud services." The email further states that we should submit our "PWS to [the] NetOps and Infrastructure vendors through AFWAY."

On 30 Apr 18, and IAW NETCENTS recommendations, a Sources Sought was posted on AFWAY for a period of 7 days. The Sources Sought included the draft PWS. On 7 May 2018, the Sources Sought closed with zero responses received.

VII. Other facts supporting the justification.

Changing IaaS midstream would require re-investment in time, personnel, and therefore compete with other critical requirements that require time and resource from all supporting agencies (e.g. 492d SOACS engineers and Information assurance personnel). The 492d has expended many man-hours (over 3 years of effort) acquiring special familiarization with the AWS architecture, understanding security requirements, and customizing 492d SOACS' specialized software for the war fighter. The continued ability to match this level of tailored infrastructure services would otherwise have to come as substantial additional cost of time and money with significant delays.

Another significant risk area in changing IaaS vendor is security and approval to operate. A information

March 2018 FOR OFFICIAL USE ONLY Page 6 of 6

Impact Level 4 authority to operate (ATO) has been achieved for the 492d SOACS AWS cloud based on current AWS architecture (AFSOC developed over the last year) and known AWS and 492d SOACS architecture vulnerabilities. Changing to another IaaS vendor would change the current security posture and invalidate the current ATO that would require a minimum of 6 months of coordination (based on previous ATO development efforts) and lead to unacceptable mission capability downtime. All agency involvement to re-accomplish this work prevents their work in other needed areas. There is no guarantee any other selected (IaaS) vendor would result in approval to operate without significant efforts, cost, or risk.

Moving to another Level 4 Security IaaS vendor would cause unacceptable delays as outlined above. 492d SOACS would waste millions of dollars in past investments and spend millions of dollars more to re-engineer a software portfolio customized to the AWS environment, re-engineer the cloud security and monitoring framework, re-issue the ATO, and re-certify the engineering team. A brief summary of the time costs alone is as follows:

1. SKILL SET CERTIFICATION: minimum 1 year hands-on experience and 1 month dedicated study for each of 15 engineers for recertification

2. AGENCY SKILL SET: All supporting agencies must update skill sets (functional administrators, IA professionals, contract oversight, and AFSOC IT Enterprise Leadership)

3. SECURITY: 1500 man-hours to establish specific new IaaS security designs and procedures.

4. EFFICIENCY: 2600 man-hours to reacquire velocity on another IaaS

5. IaaS MIGRATION: 1250 man-hours to migrate 492d SOACS software to another IaaS

6. NEW IaaS ATO: 1000 man-hours ATO Package development; 300 hours package approval

7. System availability: Warfighter systems in the 492d SOACS cloud would be shut down for six months to one year

VIII. Actions the agency may take to remove or overcome any barriers that led to the restricted consideration before any subsequent acquisition for the supplies or services.

1 SOCONS and the 492d SOACS will continue to conduct market research to identify any new brands that can provide the required services without a significant increase in cost to the Government. While this research will be ongoing, there is little to no expectation that this restricted consideration will abate in the foreseeable future due to the resources, manpower, and infrastructure invested in the AWS brand name. Market research results will be documented before the exercise of each Option Period under this requirement to ensure that no other brand name can satisfy this requirement. In the event that market research reveals other brands, the Government will employ every means necessary to seek out alternatives, provided those alternatives offer the best value to the Government in terms of price, performance capability, and compatibility with the AFSOC Cloud infrastructure.

IX. Certification by the Contracting Officer.

As evidenced by my signature above, I have determined this document to be both accurate and complete to the best of my knowledge and belief.

X. Certification by the technical/requirements personnel.

As evidenced by my (our) signature(s) above, I (we) certify that any supporting data contained herein, which is my (our) responsibility, is both accurate and complete.

March 2018 Page of Authority: Multiple Award Schedule Program (FAR 8.405-6) Is this a Bridge Action as defined in the AF Bridge Action Reduction Plan?

COORDINATION (AFFARS 5306.304(a)) ** To remove a row, click the "X" next to the signature block.

** To restore the row, click the appropriate link to the right:

APPROVAL (AFFARS 5306.304(a)) ** To remove a row, click the "X" next to the signature block.

** To restore the row, click the appropriate link to the right:

( See guidance at the end of this document for completing the following sections. ) I. Contracting Activity.

II. Nature and/or description of the action being processed.

III. Description of supplies/services required to meet agency needs.

IV. Identification of the justification/rationale for limiting sources and demonstration of the contractor's unique qualifications to provide the required supply/service.

V. Determination by the ordering activity Contracting Officer that the order represents the best value consistent with FAR 8.404(d).

VI. Description of the market research conducted and the results, or explain why market research was not conducted.

VII. Other facts supporting the justification.

VIII. Actions the agency may take to remove or overcome any barriers that led to the restricted consideration before any subsequent acquisition for the supplies or services.

IX. Certification by the Contracting Officer.

X. Certification by the technical/requirements personnel.

GUIDANCE

I. Contracting Activity.

Fully identify the contracting activity responsible for the proposed contracting action. Include the name/phone number of the Contracting Officer. Specifically identify as a “Limited Sources” Justification. Identify purchase request number, if applicable.

II. Nature and/or description of the action being processed.

State whether the action is a new order or by modification to an existing order. Identify the GSA schedule number, the Blanket Purchase Agreement (BPA) number, the order number for the current action, and the Contactor(s). Indicate the Period of Performance (PoP). Also identify the type of the order/line items on the order (e.g. Firm Fixed Price, Labor Hour, etc).

III. Description of the supplies/services required to meet agency needs.

Specifically describe the supplies and/or services to be acquired including the price and quantity of each item in the order and state the total estimated value of the order. For services, state whether the services are performance-based and, if not, provide rationale for not being performance based. Also state the delivery/performance schedule/period for the items under the order.

IV. Identification of the justification/rationale for limiting sources and demonstration of the contractor's unique qualifications to provide the required supply/service.

This section is normally the most detailed part of the justification. To assist you in preparing this justification, an introductory sentence and the four circumstances of FAR 8.405-6 that justify restricting the number of schedule holders are provided below. Select the appropriate cite, then provide, in narrative form, a detailed explanation supporting the specific circumstance cited for limiting the number of schedule holders.

(Introductory sentence) FAR 8.405-6 requires an ordering activity to justify its actions when restricting consideration of schedule contractors to fewer than required in FAR 8.405-1 or 8.405-2.

After selecting the appropriate cite, next select one of the four sentences below and provide a detailed explanation supporting the specific circumstance cited.

FAR 8.405-6(a)(1)(i)(B), “Only one source is capable of responding due to the unique or specialized nature of the work”. (Provide a detailed justification with supporting documentation, as evidence of the “unique or highly specialized” nature of the procurement. The user/customer typically provides this supporting information. Recommend attaching supporting documentation to the back of the document. General statements are not acceptable.)

FAR 8.405-6(a)(1)(i)(C), “The new work is a logical follow-on to an original Federal Supply Schedule order provided that the original order was placed in accordance with the applicable Federal Supply Schedule ordering procedures.” The original order was not issued under sole source or limited source procedures. (Provide details on the previously competed order and explain how this order is a logical follow-on to that order. Explain fully the connection between the previous work/order and the current one. The user/customer typically provides this supporting information. General statements are not acceptable.)

FAR 8.405-6(a)(1)(i)(A), “An urgent and compelling need exists, and following the ordering procedures would result in unacceptable delays.” (Provide a detailed justification with supporting documentation that explains the exact urgency of the requirement and the schedule impact if time were to be taken to follow FSS ordering procedures. The user/customer typically provides this supporting information. Recommend attaching supporting documentation to the back of the document. General statements of urgency are not acceptable.)

FAR 8.405-6(b)(1), “The item is peculiar to one manufacturer. A brand name item, whether available on one or more schedule contracts, is an item peculiar to one manufacturer.” (Brand name specifications should not be used unless the particular brand name, product or feature is essential to the Government's requirements. Therefore, explain why the particular brand item is essential to the Government's requirements, and why other companies' similar items, or products lacking the particular feature, do not meet, or cannot meet, or cannot be modified to meet, the agency's need. The user/customer typically provides this supporting information. General statements are not acceptable.)

V. Determination by the ordering activity Contracting Officer that the order represents the best value consistent with FAR 8.404(d).

This section needs to be tailored based upon whether the order is for supplies/services not requiring a statement of work (FAR 8.405-1) or if the order is for services requiring a statement of work (FAR 8.405-2).

For FAR 8.405-1 orders the best value determination needs to be based upon the supply or service offered under MAS contracts by surveying at least three schedule contractors through the GSA Advantage! on-line shopping service, or by reviewing the catalogs or price lists of at least three schedule contractors. The ordering Contracting Officer's review of the Contractor's price list(s) and any price reductions sought is also required. (Contracting Officer should seek additional price discounts/concessions based on the specific order requirements on all orders over the micro-purchase threshold.) In addition to price, when determining best value, the ordering activity may consider, among other factors, past performance, special features of the supply or service required for effective program performance, trade-in considerations, probable life of the item selected as compared with that of a comparable item, warranty considerations, maintenance availability, environmental and energy efficiency considerations, and delivery terms.

When an order contains brand name specifications, the Contracting Officer shall post the Request for Quote (RFQ) along with the basis of the justification as required by FAR 8.405-6(b)(3).

For FAR 8.405-2 orders for services requiring a statement of work, FAR 8.405-2(d) requires that an evaluation be performed based on the criteria provided to the schedule contractors. Therefore, the justification must address how the FAR 8.404(d) requirement for an evaluation of the proposed level of effort and mix of labor will be conducted and include a statement that the Contracting Officer will perform a price reasonableness determination as part of the best value determination.

VI. Description of the market research conducted and the results, or explain why market research was not conducted.

Discuss market research that was conducted among schedule holders and the market research results that led to the conclusion to go sole source or to limit the number of schedule holders to be solicited. The narrative in this section should provide a high level of confidence that the requirements of 8.405-1 and 8.405-2 could not be met. If no market research was conducted, state so and provide the rationale.

VII. Other facts supporting the justification.

When FAR 8.405-6(a)(1)(i)(C) is cited for an follow-on acquisition as the basis for the justification, include an estimate of the cost that would be duplicated and the basis and derivation of the estimate, or provide details on why a delay to solicit additional schedule holders would be unacceptable.

Provide any other facts supporting the Limited Sources Justification.

VIII. Actions the agency may take to remove or overcome any barriers that led to the restricted consideration before any subsequent acquisition for the supplies or services.

Describe all efforts to be taken to remove or overcome any barriers that preclude the agency from meeting the requirements of FAR 8.405-1and FAR 8.405-2 before any subsequent acquisition for the supplies or services is made. If no actions are planned, so state and provide reasons.

IX. Certification by the Contracting Officer.

The contracting officer's signature on the signature page evidences that he/she has determined this document to be both accurate and complete to the best of his/her knowledge and belief.

X. Certification by the technical/requirements personnel

As evidenced by their signatures on the signature page, the technical/requirements personnel have certified that any supporting data contained herein which is their responsibility is both accurate and complete.

9.0.0.2.20120627.2.874785

492 SOACS/ACE (850)-994-8575

Name: SHATAYA BUTLER

1 SOCONS/PKA (850)-884-3266

Name: [ Name ] [ Office Symbol / Phone Number ] Name: STEPHEN EDWARD SEE, GS-13, DAF Attorney-Advisor, 1 SOW/JA (850)-884-4584 Name: [ Name ] [ Office Symbol / Phone Number ] Name: [ Name ] [ Office Symbol / Phone Number ] Name: [ Name ] [ Office Symbol / Phone Number ] Name: [ Name ] [ Office Symbol / Phone Number ] Name: [ Name ] [ Office Symbol / Phone Number ] Name: [ Name ] [ Office Symbol / Phone Number ] Name: [ Name ] [ Office Symbol / Phone Number ] Name: [ Name ] [ Office Symbol / Phone Number ] Name: [ Name ] [ Office Symbol / Phone Number ] Name: [ Name ] [ Office Symbol / Phone Number ] Name: [ Name ] [ Office Symbol / Phone Number ]