SOLE SOURCE JUSTIFICATION DON SAP.pdf

MEMORANDUM TO THE FILE

Subj: USE OF OTHER THAN FULL AND OPEN COMPETITION FOR AN

ACQUISITION UNDER THE SIMPLIFIED ACQUISITION THRESHOLD

I. BACKGROUND:

1. FAR 13.106-1(b)(1)(i) states for purchases not exceeding the simplified acquisition threshold, Contracting Officers may solicit from one source if the Contracting Officer determines that the circumstances of the contract action deem only one source reasonably available (e.g., urgency, exclusive licensing agreements, brand-name or industrial mobilization).

2. As required by FAR 13.106-3(b)(3)(i), this memorandum explains the absence of competition for this acquisition, as only one source will be solicited for this requirement and the requirement is not expected to exceed the simplified acquisition threshold.

II. DESCRIPTION OF ITEM OR SERVICE:

Marine Corps Tactical Systems Support Activity (MCTSSA) Cyber Team requires a persistent cyber penetration testing training service that can be leveraged for pre-hiring screening, capability assessment from a human capital standpoint, and to support internal cyber competitions such as capture the flag events in support of workforce development and workforce capability assessments. The cyber training service is needed to introduce new employees to basic cyber penetration and exploitation techniques and to further develop experienced members in advance exploitation methods, monitor the overall workforce capability, and to support skill assessments of potential cyber staff candidates. The use of said capability will ensure the development and proficiency of the team’s cyber skills and abilities and to ensure all future cyber staff are qualified and capable of executing their assigned duties. Escalate is hosted and provided by Point3 Security. This subscription is for a base period of one year with two 12-month option periods.

III. THE DETERMINATION FOR USE OF OTHER THAN FULL AND OPEN

COMPETITION IS BASED ON THE FOLLOWING (select all that apply):

A. X ONLY ONE RESPONSIBLE SOURCE (select all that apply):

1. ___ RESTRICTIVE RIGHTS. The source has established proprietary rights, limited rights in data, patent rights, copyrights or secret processes in the item or service required.

Explain what rights are restricted, why the restrictive rights make the required item or service available from only one source, and why another company could not satisfy the Government’s need.

2. X EXCLUSIVE LICENSING AGREEMENTS. The item or service is only available from the Original Equipment Manufacturer (OEM).

This acquisition is restricted to the following source:

Manufacturer/Service Provider: Point3 Federal LLC

Manufacturer/Service Provider Point of Contact: Nicholas Levy, (410) 322-5123, Nick@point3.net

Manufacturer/Service Provider Address: 101 N. Haven St. STE 301, Baltimore, MD

21224-1634

A Notice of Intent to award a sole-source is posted in the Beta.SAM.Gov website under

Request for Quotation (RFQ) M68909-20-Q-7611.

a. The Cyber Team requires a persistent cyber penetration training service to train and sustain perishable cyber skill sets, monitor the workforce’s overall capability, monitor individual staff academic and skill set progression, and to screen potential cyber candidates. The capability shall be sufficiently challenging ranging from basic exploitation topics and challenges to more advanced skill sets covering multiple aspects of system exploitation techniques supported with access to instructors and or mentors to aid students in learning. The service shall provide the capability to monitor each student’s progression and skill set proficiency. The capability shall have an administrative control capability that shall be used to track progress of students, and customize the lessons and challenges exposed to team members of different levels. Furthermore, vendor support is necessary to ensure continuity of service. In addition, the capability shall support internal skill set assessments through capture the flag scenario events.

b. Other vendors, such as Virtual Hacking Labs (VHL)

(https://www.virtualhackinglabs.com/) and PentesterLab PRO

(PLP)(https://pentesterlab.com/pro) were examined to determine their capability to fulfill the needs of the team. VHL does not provide a dedicated lab space, support, a customizable experience, nor an administrative control capability. PLP does not provide a realistic or robust environment, a sufficiently challenging environment, an administrative capability, nor a customizable experience. Other options such as HackTheBox, Hacking-

Lab, and OWASP Hacking Labs were examined and discounted based on similar issues previously mentioned. Point3 is the only option that provides a pre hiring screening service capability, the capability to analyze staff weakness and overall cyber capability gaps across a team, capture the flag competitions to assess and monitor capability readiness, and the ability to track and monitor capability progression in real time along with on line mentor support and chat rooms to aid in the learning experience. Point3 provides a single integrated comprehensive cyber training capability that meets the

MCTSSA requirement.

https://www.virtualhackinglabs.com/ https://pentesterlab.com/pro

3. OTHER REASONS. Other reason not identified above. Provide details on mission impact if requirement is not solicited from only one source.

B. ___ BRAND NAME. Item required must be a brand name product, or feature of a product, particular to one manufacturer. Discuss why you are precluding consideration of a product manufactured by another company. Describe how the particular brand name, product, or feature is essential to the Government’s requirements and why a “brand name or equal” purchase description cannot be used (see FAR 11.104). Describe how market research indicates other companies’ similar products or products lacking the particular feature do not meet, or cannot be modified to meet, the agency’s needs.

C. ___UNUSUAL AND COMPELLING URGENCY. The supplies or services are of such unusual and compelling urgency that the Government would be seriously injured unless the agency is permitted to limit the number of sources from which it solicits bids or proposals.

Urgent requirements are supplies or services that will result in a work stoppage, or are mission critical and the routine processing time would result in injury to the Government. The determination that the procurement for the above item/service is an urgent and compelling requirement is based on the following:

1. Date on which the requirement was first identified:

2. Required delivery date/period of performance:

3. Explanation of why delivery/commencement of services by the date mentioned above is required: Explain the impact to the mission if the date above is not met, any special circumstances or conditions that exist which validate the requirement as “urgent,” estimated production lead time for the item, etc.

4. If appropriate, include any additional pertinent information.

IV. CERTIFICATIONS/APPROVALS:

A. Technical / Requirements Certification: I certify that the facts and representation under my cognizance which are included in this justification are complete and accurate to the best of my knowledge and belief.

___________________ Jimmy M. Clevenger/760-725-2511

Signature Name (Printed) / Phone #

B. Certification/Approval. See FAR 13.501

CERTIFICATION

I certify that statements checked and information provided above are complete and correct to the best of my knowledge. I understand that the processing of this Sole Source Justification precludes the use of full and open competition.

Roy P. Layug, Contract Specialist, MCTSSA

Beverly L. Hobbs, Contracting Officer, MCTSSA