SAP CI Justification 22-050 Redacted.pdf

Source Selection Information – See FAR 2.101 and 3.104 currently available. This type of funding is appropriate for the acquisition of the required software licenses and maintenance support (as a product) since the unit pricing for all items is less than the investment threshold of

4. Statutory Authority Permitting Sole Source.

The statutory authority permitting this sole source action is 41 U.S.C. 1901, Simplified acquisition procedures - a sole source acquisition using simplified acquisition procedures for the acquisition of commercial items, as implemented by FAR 13.501(a).

5. Rationale Justifying Use of Cited Statutory Authority.

The sole source action includes the procurement of brand-name Micro Focus Fortify application security assessment software (SW) licenses and corresponding maintenance support (as a product) to include patches, security fixes, minor updates and upgrades which are deemed essential for the testing, certification, and accreditation (C&A) of the JS, J-7 JJDT’s web-applications and web-services. JS J7 DD JT develops and maintains a dynamic joint training environment that offers a mix of live, virtual, and constructive models and simulations distributed over an integrated network of training sites. JS J7 DD JT’s Modeling and Simulations (M&S) systems are core enablers for this dynamic joint training environment. JS J7 DD JT routinely develops, tests, certifies, and accredits web-enabled software applications and services to support these M&S systems. JS J7 DD JT is required to conduct software assurance (SWA) for their in-house developed applications. Micro Focus Fortify Scan Central software is a SWA tool JS J7 DD JT uses to detect security vulnerabilities in an application’s source code. Micro Focus Fortify Scan Central is the Configuration Control Board (CCB) approved software for this requirement.

Joint Staff J7 currently utilizes the Micro Focus Fortify product suite as an existing, integral and integrated part of its cybersecurity program for validating the cybersecurity posture of Deputy Director of Joint Training (DDJT) developed capabilities. Without the requisite Micro Focus Fortify software licenses and maintenance support (as a product), Joint Training Synthetic Environment products and future releases of those products will not meet DoD information assurance certification and accreditation standards to attain Authority to Operate (ATO) on defense networks and systems. Only Micro Focus, sole proprietor of the Fortify software code, can provide software support, updates and upgrades to meet DoD standards for software net worthiness certification.

Purchase of alternative products, not CCB approved, would require a major re-engineering effort, significant cybersecurity process modifications, and 100% staff re-training, diverting manpower and resources away from the core JS J7 mission to develop and enable trained, ready, and adaptable joint forces. This would also impact all JS J7 software development programs and necessitate developer manpower from at least 10 separate program teams. Each development team would have to establish a new cybersecurity baseline under a new product for 100% of their application code, versus the current incremental changes to an already established baseline using the Micro Focus Fortify software suite of products. Changing to a different solution would significantly disrupt the operational tempo of JS J-7 JJDT’s joint training environment and M&S systems and introduce excessive increased costs.

Source Selection Information – See FAR 2.101 and 3.104

The required brand name software licenses and corresponding maintenance support (as a product) are essential to the Government’s needs, and no other companies’ products can meet or can be modified to meet JS’ needs. Accordingly, only Micro Focus and their authorized resellers can provide the required software licenses and maintenance support (as a product).

6. Description of Efforts Made to Solicit Offers from as Many Offerors as Practicable, including a Description of Market Research, if applicable, and a List of Interested Sources, if any.

The requiring activity and contracting office conducted market research based on the requirement for software and support fully compatible with the existing JS J7 DD JT infrastructure. The market research determined that, due to the proprietary nature of the Micro Focus software, no other products or maintenance support would be compatible with Micro Focus products, and cannot be integrated with Micro Focus products without degrading the existing JS J7 DD JT infrastructure. Thus, for the reasons cited herein, the required brand name items are essential to the government's needs, and no other companies' products can meet or can be modified to meet the agency's needs. Market research efforts yielded the identification of three sources, all of which are Micro Focus authorized resellers:

Reseller/Vendor Address Business Type

Cage Point of Contact

Carahsoft 11493 Sunset Hills Rd. Suite 100 Reston, VA 20190

SB 1P3C5 Liam Redden Phone: (703) 889-9727

OSI Federal Technologies Inc.

4500 Daly Drive, Suite 100 Chantilly, VA 20151

SB 0EKL1/

7Q1J7

Nick Bustle Phone: (703) 994-7415

V3 Gate 555 Middle Creek Pkwy Suite 120 Colorado Springs, CO 80921

SDVOSB 4Y8H0 CJ Corey Phone: (703) 283-9242

7. Determination of Fair and Reasonable Cost.

The Contracting Officer has determined that the anticipated cost to the Government of the supplies/services covered by this Justification will be fair and reasonable.

8. Actions to Remove Barriers to Future Competition.

For the reasons set forth in Paragraph 5, NFLC Norfolk Contracting Department, Philadelphia Office has no plans at this time to compete future contacts for the types of supplies covered by this document.

If another potential source emerges, NFLC Norfolk Contracting Department, Philadelphia Office will assess whether competition for future requirements is feasible.

9. Contracting Point of Contact. The point of contact at the Fleet Logistics Center Norfolk, Contracting Department Philadelphia Office is Kevin Brennan, Code 290.1, (215) 697-9727;

kevin.m.brennan21.civ@us.navy.mil.