Source Selection Statement CyPrESS .pdf

National Aeronautics and Space Administration

Headquarters Washington, DC 20546-0001

Source Selection Statement

Cybersecurity and Privacy Enterprise Solutions and Services (CyPrESS) Procurement

Solicitation No. 80TECH21R0007

On April 8, 2022, I, along with senior officials from National Aeronautics and Space Administration (NASA) Headquarters (HQ) met with members of the Source Evaluation Board (SEB) to hear their findings based on the evaluation of the proposals for the Cybersecurity and Privacy Enterprise Solutions and Services (CyPrESS) procurement.

PROCUREMENT HISTORY/DESCRIPTION

CyPrESS is a new acquisition to acquire cybersecurity and privacy enterprise solutions and services and related services for NASA’s Office of the Chief Information Officer (OCIO). The resulting contract will provide these services to all NASA Centers and facilities.

On April 13, 2021, NASA released a Draft Request for Proposals (DRFP). On April 19, 2021, an Industry Day was held, which was attended by 488 individuals representing 188 different companies. On June 2, 2021, the final Request for Proposals (RFP) was issued as a full and open competition.

NASA issued a total of seven amendments to the RFP as follows:

Date Amendment to the RFP

Change

06/22/2021 01 Responses to industry questions/changes to the RFP

06/25/2021 02 Responses to industry questions/changes to the RFP

01/21/2022 03 Final Proposal Revision (FPR)/Clause updates

01/24/2022 04 Updated Phase-in start date 01/25/2022 05 Updated the EFSS Box link 01/26/2022 06 Responses to industry questions 02/18/2022 07 Final Proposal Revision (FPR)/Clause updates

The resultant contract will be a Single Award, Cost Plus Award Fee (CPAF) Core and Hybrid Indefinite Delivery, Indefinite-Quantity (IDIQ) with the ability to award CPAF and Firm-Fixed Price (FFP) task orders, as well as a FFP Phase-in.

The North American Industry Classification System (NAICS) code for this acquisition is 541519 – Other Computer Related Services, and the small business size standard is $30M.

PROPOSALS SUBMITTED

In response to the RFP, NASA received nine proposals by the proposal due date of July 12, 2021. Proposals were submitted by the following firms (in alphabetical order):

• Accenture Federal Services, LLC

• ASRC Federal Research and Technology Solutions, LLC (ARTS)

• Boloro

• Booz Allen Hamilton

• COLSA Corporation

• General Dynamics Information Technology, Inc.

• KBR Wyle Services, LLC

• Peerless Technologies

• Peraton, Inc.

After an initial review of all proposals, all but one were considered initially acceptable and included in the formal evaluation process. Specifically, the SEB determined that Boloro’s proposal did not represent a reasonable initial effort to address the essential requirements of the RFP because it contained major deficiencies and omissions, and therefore was deemed unacceptable. On July 26, 2021, the Contracting Officer (CO) notified Boloro that its proposal would not be further evaluated.

EVALUATION CRITERIA/PROCEDURES

As NASA’s Source Selection Authority (SSA) for this procurement, I appointed the SEB, which included a team of technical and business members and consultants from appropriate disciplines, to conduct proposal evaluations.

All proposals were evaluated by the SEB in accordance with Federal Acquisition Regulation (FAR) 15.3 – Source Selection, NASA FAR Supplement (NFS) 1815.3 – Source Selection, and the evaluation criteria included in the RFP.

The CyPrESS RFP set forth the three evaluation factors for award (i.e., Mission Suitability, Cost/Price, and Past Performance) and as stated in Section M.3 of the RFP, their relative importance is as follows:

Mission Suitability and Past Performance when combined are significantly more important than Cost/Price. As individual factors, Mission Suitability is more important than Past Performance, which is more important than Cost/Price.

The RFP establishes that only the Mission Suitability Factor would be point scored in the evaluation process. In accordance with NFS 1815.304-70(b)(1), subfactors were numerically weighted and scored in accordance with the 1,000-point scale provided below:

Missions Suitability Subfactor Points

Subfactor A Technical Approach 500 Subfactor B Management Approach 400 Subfactor C Small Business Utilization (SBU) 100

Total 1000

The SEB carefully reviewed each Offeror’s proposal, identifying and documenting the following findings as applicable: Significant Strengths, Strengths, Weaknesses, Significant Weaknesses, and Deficiencies. The SEB voting members collectively developed a consensus adjectival rating for each of the three subfactors based upon the documented findings. Following the establishment of a consensus adjectival rating, the SEB voting members collectively developed a consensus percentile rating that corresponded with the adjectival rating. Once the percentile rating was established, the numerical score for that subfactor was computed by taking the consensus percentile rating for that subfactor and multiplying it by the maximum points available for that subfactor. This represented the numerical score for a given subfactor. This process was repeated for each of the three Mission Suitability subfactors by Offeror. The final point value for the Mission Suitability factor was then calculated as the sum of the three subfactors’ point values.

For the Cost/Price factor, the RFP advised Offerors that “[t]he cost/price factor is used to determine what the Offeror’s proposal will likely cost the Government should it be selected for award. It is anticipated that the reasonableness of the proposed price will be determined based on competition.” The RFP further explains that a cost realism analysis will be conducted on the Cost-Type CLINs to ensure that a realistic cost is determined and considered by the Government. Offerors were instructed to refer to FAR 2.101(b) for a definition of “cost realism” and to FAR 15.404-1(d) for a discussion of “probable cost.” As described in FAR 15.404(d)(1), the SEB performed a cost realism analysis by “independently reviewing and evaluating specific elements of each Offeror’s proposed cost estimate to determine whether the estimated proposed cost elements are realistic for the work to be performed; reflect a clear understanding of the requirements; and are consistent with the unique methods of performance and materials described in the Offeror’s technical proposal.” The RFP further explains that “[a] lack of resource realism may adversely affect the Offeror’s Mission Suitability findings and scores and may result in cost realism adjustments under the cost factor.” Similarly, an Offeror’s failure to substantiate the cost of its proposed efficiencies and/or unique methods of performance and materials may adversely affect the Offeror’s Mission Suitability findings and scores and may result in cost realism adjustments under the Cost/Price factor. The proposed Cost/Price, including direct labor, other direct costs, and indirect rates, were assessed to determine reasonableness and cost realism (for the cost-type CLINs). Both the proposed and probable costs reflected each Offeror’s proposed fee amount. Proposed fee was not adjusted in the probable cost assessment. The proposed and probable costs were presented to me as the SSA, along with any issues and risks associated with the proposed costs.

For the Past Performance factor, the RFP advised Offerors that their past performance records would be evaluated for recency, relevancy, and performance regarding each Offeror’s ability to perform the required work. Each Offeror’s contract references were evaluated to determine the degree of relevance based on size, content, and complexity. In evaluating Past Performance, the SEB relied on the Government-wide Contractor Performance Assessment Reporting System (CPARS) database and customer feedback, in addition to the narrative on relevant past/current contracts provided by the Offerors.

The Past Performance factor was not point scored but was assigned an overall level of confidence adjectival rating as defined in NFS 1815.305(a)(2): Very High, High, Moderate, Low, Very Low, or Neutral.

L.27 of the RFP stated that the Government intended to evaluate proposals and award the contract without discussions with Offerors. The RFP also set forth at L.27 that the Government reserved the right to conduct discussions if the CO later determined them to be necessary. After evaluating the proposals, the CO determined that establishing a competitive range was necessary, and I concurred in this determination.

On December 16, 2021, the CO, after coordination with me, determined the following Offerors’ proposals (all factors considered) were the most highly rated and therefore included in the competitive range for this procurement, in alphabetical order:

• Accenture Federal Services, LLC

• Booz Allen Hamilton

• COLSA Corporation

• General Dynamics Information Technology, Inc.

• Peraton, Inc.

On December 27, 2021, these five most highly rated Offerors were notified, and discussions were opened. Also, on December 27, 2021, the other three Offerors were notified that their proposals were not among the most highly rated and revisions to their proposals would not be considered. On January 21, 2022, discussions were officially closed, and Final Proposal Revisions (FPRs) were requested. On February 1, 2022, FPRs were received from the five Offerors in the competitive range. On February 14, 2022, discussions were re-opened with these companies. On February 18, 2022, discussions were officially closed and a second round of FPRs were requested. On February 24, 2022, a second round of FPRs were received.

FINAL EVALUATION FINDINGS

The following is a summary of the final evaluation findings for the three evaluation factors: Mission Suitability, Past Performance and Cost/Price.

Mission Suitability includes three subfactors as follows: Subfactor A, Technical Approach; Subfactor B, Management Approach; and Subfactor C, Small Business Utilization.

Offeror Subfactor A Subfactor B Subfactor C Mission Suitability Points (out of 1,000)

Accenture Federal Services, LLC.

Good Fair Excellent 599

Booz Allen Hamilton

Excellent Good Excellent 827

COLSA

Corporation

Good Good Very Good 708

General Dynamics Information Technology, Inc.

Good Very Good Excellent 783

Peraton, Inc. Good Fair Very Good 589

The substance of the SEB’s final evaluation of Mission Suitability is presented below.

Accenture Federal Services, LLC. (Accenture)

Under Subfactor A (Technical Approach), Accenture received an adjectival rating of “Good” with no Significant Strengths, three Strengths, and no Weaknesses, Significant Weaknesses, or Deficiencies.

Accenture received three Strengths for providing: (1) Cost-Effective recommendations to meet NASA’s security data management needs; (2) A risk management approach that would enable decision makers to align security priorities and initiatives and to make risk-based decisions regarding cyber security; and (3) An approach to thorough assessments that reduce the risk and vulnerability to NASA’s data and networks, which ensures an adequate use of resources needed to successfully assess agency Information Technology (IT) and Operational Technology (OT) systems.

Under Subfactor B (Management Approach), Accenture received an adjectival rating of “Fair” with no Significant Strengths, Strengths, or Weaknesses, one Significant Weakness, and no Deficiencies.

Accenture received one Significant Weakness for providing an approach that drastically overstated staffing reductions, which led to an ineffective alignment of resources across the CyPrESS requirement starting in Contract Year 3 throughout the period of performance.

Under Subfactor C (Small Business Utilization), Accenture received an adjectival rating of “Excellent” with one Significant Strength, and no Strengths, Weaknesses, Significant Weaknesses, or Deficiencies.

Accenture received one Significant Strength for demonstrating a very strong commitment to small business through its executed teaming agreements, assignment of high technology requirements to small business partners, well-established corporate-level processes, and its commitment to NASA’s Mentor-Protégé Program.

Booz Allen Hamilton (BAH)

Under Subfactor A (Technical Approach), BAH received an adjectival rating of “Excellent” with one Significant Strength, four Strengths, and no Weaknesses, Significant Weaknesses, or Deficiencies.

BAH received one Significant Strength for providing an approach to respond to an OT incident in Scenario 2, which demonstrated an extremely comprehensive understanding of NASA mission systems, including OT. BAH’s overall Incident Response (IR) approach was a very well-developed process and demonstrated significant competencies in all of the IR lifecycle phases, which includes preparation, identification, containment, eradication, recovery, and post-incident activity.

BAH received four Strengths for providing: (1) An innovative approach to cyber management data solutions such as log aggregation, data management, and data analysis solution; (2) Cost effective recommendations to meet NASA’s security data management needs, which will reduce existing software license costs and save NASA money without losing any current functionality; (3) An approach that ensures consistency in BAH’s methodology and findings across all assessments by utilizing the Offeror’s proposed tool at no additional cost to NASA; and (4) An approach to transformation and innovation that includes the processes necessary to ensure the desired technical outcomes.

Under Subfactor B (Management Approach), BAH received an adjectival rating of “Good” with no Significant Strengths, two Strengths, and no Weaknesses, Significant Weaknesses, or Deficiencies.

BAH received two Strengths for providing: (1) An effective approach (including the recognition of the importance of diversity and inclusion of its workforce) that will improve inclusion throughout NASA and help it reach agency goals and objectives; and (2) An innovative scheduling approach during phase-in to ensure continuity and a smooth transition with incumbent contractors.

Under Subfactor C (Small Business Utilization), BAH received an adjectival rating of “Excellent” with one Significant Strength, and no Strengths, Weaknesses, Significant Weaknesses, or Deficiencies.

BAH received one Significant Strength for demonstrating a very strong commitment to small business through its executed teaming agreements, assignment of high technology requirements to small business partners, the Offeror’s small business outreach and approach to meeting or exceeding small business goals, and its commitment to NASA’s Mentor- Protégé Program.

COLSA Corporation (COLSA)

Under Subfactor A (Technical Approach), COLSA received an adjectival rating of “Good” with no Significant Strengths, five Strengths, and no Weaknesses, Significant Weaknesses, or Deficiencies.

COLSA received five Strengths in the following areas: (1) Its approach for including specific stakeholders during the design phase of security data and event management solution; (2) Its approach for communicating with all cognizant stakeholders during the IR preparation phase;

(3) Addressing human safety concerns on OT systems; (4) Well-defined policies to allow decision-makers to understand and prioritize risks as they relate to external interconnections;

and (5) An innovative approach that will provide a framework to enable NASA decision-makers to make informed risk-based decisions.

Under Subfactor B (Management Approach), COLSA received an adjectival rating of “Good” with no Significant Strengths, three Strengths, one Weakness, and no Significant Weaknesses or Deficiencies.

COLSA received three Strengths for providing: (1) A transition approach that will ensure no gap in services when requirements transfer from existing contracts onto the CyPrESS contract; (2) A transparent risk management approach, which will allow for proactive strategies and mitigation efforts as well as ensure that Cybersecurity and Privacy Division (CSPD) leadership will have timely, accurate, and standardized risk information to better enable risk-based decision-making; and (3) A transparent task order approach, which will increase the chance of mission success and ensure the requirements transitioning throughout the Mission Support Future Architecture Program (MAP) process receive quick and efficient responses.

COLSA received one Weakness for proposing an ineffective alignment of resources across the CyPrESS requirement in two of the contract years.

Under Subfactor C (Small Business Utilization), COLSA received an adjectival rating of “Excellent” with one Significant Strength, and no Strengths, Weaknesses, Significant Weaknesses, or Deficiencies.

COLSA received one Significant Strength for demonstrating a very strong commitment to small business through its executed teaming agreements, assignment of high technology requirements to small business partners, and the Offeror’s small business outreach.

General Dynamics Information Technology, Inc. (GDIT)

Under Subfactor A (Technical Approach), GDIT received an adjectival rating of “Good” with no Significant Strengths, three Strengths, and no Weaknesses, Significant Weaknesses, or Deficiencies.

GDIT received three Strengths in the following areas: (1) Its cost effective recommendation to pairing a proposed tool with existing software, which provides a holistic risk picture for system stakeholders; (2) GDIT’s approach to mitigating cyber incidents during the IR preparation phase that will lessen the risk of future attacks to NASA, while shortening the response time to mitigate incidents; and (3) Its approach to introducing new devices to the

NASA network, which reduces both GDIT’s and NASA’s duplicative efforts, and prevents unauthorized hardware from operating on the NASA network.

Under Subfactor B (Management Approach), GDIT received an adjectival rating of “Very Good” with one Significant Strength, four Strengths, one Weakness, and no Significant Weaknesses or Deficiencies.

GDIT received one Significant Strength for providing an incentivized “top down” approach to valuing diversity and fostering inclusion where the focus starts with senior leadership, which will enable NASA to reach its goals and improve inclusion throughout the Agency.

GDIT received four Strengths for providing: (1) An approach to controlling costs throughout the life of the contract and transitioning CPAF work to FFP work; (2) A Phase-in approach that ensures uninterrupted services throughout the CyPrESS transition; (3) A multifaceted approach to retaining critical skills; and (4) A transparent task order approach, which will increase the chance of mission success and ensure the requirements transitioning throughout the MAP process receive quick and efficient responses.

GDIT received one Weakness for proposing an ineffective alignment of resources across the CyPrESS requirement starting in Contract Year 3 throughout the period of performance.

Under Subfactor C (Small Business Utilization), GDIT received an adjectival rating of “Excellent” with one Significant Strength, and no Strengths, Weaknesses, Significant Weaknesses, or Deficiencies.

GDIT received one Significant Strength for demonstrating a very strong commitment to small business through its executed teaming agreements, assignment of high technology requirements to small business partners, GDIT’s small business outreach, and its commitment to NASA’s Mentor-Protégé Program.

Peraton Inc. (Peraton)

Under Subfactor A (Technical Approach), Peraton received an adjectival rating of “Good” with no Significant Strengths, three Strengths, two Weaknesses, and no Significant Weaknesses or Deficiencies.

Peraton received three Strengths for providing: (1) An approach to coordinating with the appropriate NASA stakeholders during the design and development phases of scenario 1; (2) A cost-effective tool to allow NASA to descale/reduce enterprise license costs; and (3) An approach to notifying stakeholders of end-of-life software.

Peraton received two Weaknesses for providing: (1) An ineffective approach to collect and develop lessons learned; and (2) An ineffective approach that would require a substantial amount of travel to support Assessment & Authorization (A&A) activities.

Under Subfactor B (Management Approach), Peraton received an adjectival rating of “Fair” with no Significant Strengths, one Strength, no Weaknesses, one Significant Weakness, and no Deficiencies.

Peraton received one Strength for providing an approach to Diversity, Equity, and Inclusion (DE&I) that will help NASA reach its goals and improve inclusion throughout the Agency.

Peraton received one Significant Weakness for providing an approach that drastically overstated staffing reductions, which led to an ineffective alignment of resources across the CyPrESS requirement starting in Contract Year 2 throughout the period of performance.

Under Subfactor C (Small Business Utilization), Peraton received an adjectival rating of “Very Good” with one Significant Strength, and no Strengths, Weaknesses, Significant Weaknesses, or Deficiencies.

Peraton received one Significant Strength for demonstrating a very strong commitment to small business through its executed teaming agreements, the Offeror’s small business outreach, and its commitment to NASA’s Mentor-Protégé Program.

PAST PERFORMANCE EVALUATION

In evaluating the Past Performance of the Offerors, the SEB concluded:

Accenture was assigned an Overall Past Performance Level of Confidence Rating of Very High based on the combination of Very Relevant overall Relevancy and Very High Overall Performance.

BAH was assigned an Overall Past Performance Level of Confidence Rating of Very High based on the combination of Very Relevant overall Relevancy and Very High Overall Performance.

COLSA was assigned an Overall Past Performance Level of Confidence Rating of Very High based on the combination of Very Relevant overall Relevancy and Very High Overall Performance.

GDIT was assigned an Overall Past Performance Level of Confidence Rating of Very High based on the combination of Very Relevant overall Relevancy and Very High Overall Performance.

Peraton was assigned an Overall Past Performance Level of Confidence Rating of Very High based on the combination of Very Relevant overall Relevancy and Very High Overall Performance.

COST/PRICE EVALUATION

Accenture: The SEB evaluated Accenture’s total proposed Cost/Price and the SEB adjusted WYEs starting in Contract Year (CY) 3, which resulted in an upward probable cost adjustment.

BAH: The SEB evaluated BAH’s total proposed Cost/Price and did not make any probable cost adjustments.

COLSA: The SEB evaluated COLSA’s total proposed Cost/Price, and the SEB adjusted WYEs starting in CY 8, which resulted in an upward probable cost adjustment.

GDIT: The SEB evaluated GDIT’s total proposed Cost/Price, and the SEB adjusted WYEs starting in CY 3, which resulted in an upward probable cost adjustment.

Peraton: The SEB evaluated Peraton’s total proposed Cost/Price, and the SEB adjusted WYEs starting in CY 2 and corrected the application of G&A in accordance with its narrative, which resulted in an upward probable cost adjustment.

The order of the Offerors’ probable Cost/Price (listed in order of highest to lowest) is:

1. Accenture had the highest probable Cost/Price, which was significantly higher than all other Offerors.

2. BAH had a proposed and probable Cost/Price of $608,314,642.

3. GDIT

4. COLSA

5. Peraton had the lowest total probable Cost/Price.

SELECTION DECISION

As the SSA for this procurement, I met with the CyPrESS SEB along with several ex-officio members, to receive the SEB’s findings.

I determined that the findings presented by the SEB, as documented in its presentation, were detailed and consistent with the evaluation criteria in the CyPrESS RFP and provided a clear description of the merits of each proposal. I discussed with the SEB its rationale for its findings, adjectival ratings, and scores for the Mission Suitability subfactors, and also discussed the rationale for the evaluation of Cost/Price and Past Performance. I determined that the SEB’s findings were reasonable and valid for the purpose of making a selection decision.

In determining which proposal offered the best value to NASA, I referred to the relative order of importance of the three evaluation factors for award as specified in the RFP, Section M.3:

Mission Suitability and Past Performance when combined are significantly more important than Cost/Price. As individual factors, Mission Suitability is more important than Past Performance, which is more important than Cost/Price.

I based my selection on the comparative assessment of each proposal against each of the RFP evaluation factors to determine which proposal represented the best value to the Government.

Under Subfactor A, Technical Approach (the highest weighted subfactor), I identified a major discriminator in that BAH earned significantly higher ratings than all other Offerors.

Specifically, BAH set itself apart from the other Offerors since it was the only Offeror to receive an “Excellent” rating under Subfactor A, as well as the only Offeror to earn a Significant Strength under this subfactor. All other Offerors earned “Good” ratings for Subfactor A.

Regarding Mission Suitability Subfactor A, Technical Approach, I noted that BAH is the only Offeror to have received an “Excellent” rating in this subfactor (the most heavily weighted one) with one Significant Strength, four Strengths, and no Weaknesses or Significant Weaknesses. I noted that BAH received its Significant Strength its response to the Operational Technology (OT) incident in scenario 2, which demonstrates BAH’s extremely comprehensive understanding of NASA’s mission systems. Based on its response to scenario 2, the SEB concluded that BAH’s overall IR approach was very well-developed and that its process to IR demonstrated significant competencies in all IR lifecycle phases, including preparation, identification, containment, eradication, recovery, and post-incident activity. The SEB concluded that BAH’s approach to Scenario 2 demonstrates its comprehensive understanding of the requirement and its extremely effective and efficient approach to mitigating an ongoing incident, conducting incident response actions on OT systems, and collecting and developing lessons learned. In addition, BAH received four Strengths for providing: (1) An innovative approach to cyber management data solutions as the log aggregation, data management, and data analysis solution; (2) A cost-effective recommendations to meet NASA’s security data management needs to reduce existing software license costs without losing current functionality; (3) An approach to assessments that ensures consistency in its methodology and findings across all assessments by using its proposed tool at no additional cost to NASA; and (4) An approach to transformation and innovation that include processes necessary to ensure the desired technical outcomes for the CSPD with an emphasis on innovation in the management process. These proposed features will contribute toward exceeding or greatly exceeding the contract requirements in a manner that provides additional value to the Government.

I noted that the other four Offerors all received “Good” ratings under Subfactor A, which is two ratings below BAH’s “Excellent” rating. First, I noted that COLSA received a “Good” rating with no Significant Strengths, five Strengths, and no Weaknesses or Significant Weaknesses. COLSA earned five Strengths for: 1) Its approach to include specific stakeholders during the design phase of security data and event management solution; (2) COLSA’s approach to communication with all cognizant stakeholders during the IR preparation phase; (3) Addressing human safety concerns on OT systems; (4) Well-defined policies to allow decision-makers to understand and prioritize risks as they relate to external interconnections; and (5) COLSA’s innovative approach to providing a framework that will enable NASA decision- makers to arrive at informed risk based decisions. While I noted that these Strengths will enhance the potential for successful contract performance, I also noticed that COLSA did not receive any Significant Strengths in Subfactor A.

Second, I noted that GDIT received a “Good” rating with no Significant Strengths, three (3) Strengths, and no Weaknesses or Significant Weaknesses. I noted that GDIT received three Strengths for providing: (1) A cost-effective recommendation to pairing a proposed tool with existing software that provide a holistic risk picture for system stakeholders; (2) An approach to mitigating cyber incidents during IR Preparation phase; and (3) An approach to introduce new devices that reduces duplicative efforts and prevents unauthorized hardware from operating on the NASA network. While I noted that these Strengths will enhance the potential for successful contract performance, I also noticed that GDIT did not receive any Significant Strengths in Subfactor A.

Third, I noted that Accenture received a “Good” rating with no Significant Strengths, three Strengths, and no Weaknesses or Significant Weaknesses. I noted that Accenture received three Strengths for providing: (1) Cost-effective recommendations to meet NASA’s security data management needs; (2) A risk management approach that will enable decision makers to align security priorities and initiatives and to make risk-based decisions regarding cybersecurity; and (3) An approach to perform thorough assessments that reduce the risk and vulnerability to NASA’s data and networks, which ensures adequate use of resources needed to successfully assess NASA’s IT and OT systems. While I noted that Accenture’s Strengths will enhance the potential for successful contract performance, I also noticed that Accenture did not receive any Significant Strengths in Subfactor A.

Fourth, I noted that Peraton received a “Good” rating with no Significant Strengths, three Strengths, two Weaknesses, and no Significant Weaknesses. I noted that Peraton received three Strengths for: 1) Its coordination with the appropriate NASA stakeholders during the design and development phases of scenario 1; (2) Providing a cost-effective tool to allow NASA to descale/reduce enterprise license costs; and (3) Providing an approach to notifying stakeholders of end-of-life software. While I acknowledge that Peraton’s Strengths will enhance the potential for successful contract performance, I have determined that its two Weaknesses for providing: (1) An ineffective approach to collect and develop lessons learned; and (2) An ineffective approach that would require a substantial amount of travel to support Assessment & Authorization (A&A) activities detracted from its overall response to Subfactor A. Furthermore, Peraton did not receive any Significant Strengths in this subfactor.

Overall, for Subfactor A, Technical Approach, I have determined that there is a clear and distinct advantage in favor of BAH with its “Excellent” rating as compared to the “Good” ratings earned by COLSA, GDIT, Accenture, and Peraton. In comparing the proposals of BAH to the other four Offerors, I identified a meaningful discriminator with BAH’s Significant Strength, which is described above. I have concluded that BAH’s approach to Scenario 2 demonstrates a comprehensive understanding and an extremely effective and efficient approach to mitigate the ongoing incident, conduct incident response actions on OT systems, and collect and develop lessons learned, which greatly enhances the potential for successful contract performance. In addition to this Significant Strength, BAH had four Strengths described herein. These Strengths will further enhance the potential for successful contract performance. By comparison, none of the other Offerors received any Significant Strengths for Subfactor A. Therefore, overall, for Subfactor A, I conclude that the advantages of BAH’s proposal (particularly its Significant Strength) coupled with no Weaknesses or Significant Weaknesses, significantly outweighs the merits of the other four proposals.

Under Subfactor B, Management Approach, which is less important than Subfactor A, I determined that GDIT has a slight advantage over BAH and COLSA with a “Very Good” rating, in that GDIT received one Significant Strength in Subfactor B. BAH and COLSA both received “Good” ratings and did not receive any Significant Strengths in this subfactor.

Accenture and Peraton both received “Fair” ratings in Subfactor B, so they were not as competitive under this subfactor as the other three Offerors.

For Mission Suitability Subfactor B, Management Approach, I acknowledge that Accenture and Peraton received “Fair” ratings. They did not receive any Significant Strengths and also each had one Significant Weakness. While Peraton received only one Strength, Accenture had no Strengths. Therefore, I do not consider Accenture or Peraton to be among the most competitive in this subfactor. Accordingly, I focused my comparative assessment among GDIT, BAH, and COLSA.

I noted that GDIT was the only Offeror to receive an overall “Very Good” rating due to its earning one Significant Strength for providing an incentivized “top down” approach to valuing diversity and fostering inclusion where its focus begins with senior leadership. This proposed method will strongly enhance contract performance by enabling NASA to reach agency goals and improve inclusion. GDIT was also assessed four Strengths for: (1) its cost controls throughout the life of the contract and transition from CPAF work to FFP work; (2) its Phase-in approach, which ensures uninterrupted services throughout the transition of the services onto the consolidated CyPrESS contract; (3) its multifaceted approach to retaining critical skills; and (4) A transparent task order approach, which will increase the chance of mission success and ensure the requirements transitioning throughout the MAP process receive quick and efficient responses.. These Strengths will further enhance the potential for successful contract performance. However, GDIT also received one Weakness for providing an ineffective alignment of resources across the CyPrESS requirement starting in Contract Year 3 throughout the period of performance. I have concluded that this Weakness detracts from GDIT’s overall response to Subfactor B.

For Subfactor B, Management Approach, BAH received an overall “Good” rating due to its two assigned Strengths for: (1) An effective approach (including the recognition of the importance of diversity and inclusion of its workforce) that will improve inclusion throughout the Agency and help NASA reach agency goals and objectives; and (2) An innovative scheduling approach during Phase-in to ensure continuity and a smooth transition with the incumbent contractors. COLSA received an overall “Good” rating due to its three earned Strengths for its approach to: (1) Transition, which will ensure no gap in services when the services are transferred from existing contracts and consolidated onto the CyPrESS contract; (2) A transparent risk management approach, which will allow for proactive strategies and mitigation efforts as well as ensure that CSPD leadership will have timely, accurate, and standardized risk information to better enable risk-based decision-making; and

(3) A transparent task order approach, which will increase the chance of mission success and ensure the requirements transitioning throughout the Mission Support Future Architecture Program (MAP) process receive quick and efficient responses.. However, COLSA also received one Weakness for providing an ineffective alignment of resources across the CyPrESS requirement in two of the contract years, which I have concluded detracts from its overall response to Subfactor B.

Overall, for Subfactor B, Management Approach, I have concluded that there is a slight advantage in favor of GDIT with its “Very Good” rating as compared to COLSA and BAH’s “Good” ratings. Although GDIT has a slight advantage over COLSA and BAH, I have determined that GDIT’s Significant Strength did not set it far apart from COLSA or BAH, especially since BAH earned a Strength for a similar aspect of its proposal (see BAH Strength #1 above), and GDIT’s Weaknesses is weighted more heavily than COLSA’s since it impacted approximately six years of contract performance as compared to approximately two years for COLSA. Furthermore, GDIT’s and COLSA’s Weaknesses detracted from their overall Management Approaches, whereas BAH received no Weaknesses for its Management Approach.

Under Subfactor C, Small Business Utilization, which is the least important subfactor, Accenture, BAH, and GDIT all received “Excellent” ratings. I was not able to identify any significant differentiators among these three Offerors under this subfactor. Additionally, these three Offerors had a slight advantage over COLSA and Peraton, which were each rated “Very Good” under this subfactor.

Within Mission Suitability Subfactor C, Small Business Utilization, I acknowledge that Accenture, BAH, and GDIT each received an overall “Excellent” rating for this Subfactor, all earning one Significant Strength for their impressive level of commitment to NASA’s small business programs. I noted that COLSA and Peraton each received a lesser “Very Good” rating; therefore, I did not consider these Offerors to be among the most competitive in this subfactor. While I acknowledge that COLSA and Peraton each received Significant Strengths for their level of commitment to NASA’s small business programs, these Significant Strengths were not as comprehensive as the ones earned by Accenture, GDIT, and BAH;

therefore, they were not assigned “Excellent” adjectival ratings for this subfactor. I have concluded that Accenture’s, GDIT’s, and BAH’s small business approaches were all comparable to each other with no distinct advantage among these three Offerors under Subfactor C.

For the Mission Suitability factor overall, the most important evaluation factor for award, I have determined that under Subfactor A, Technical Approach, the highest weighted subfactor, BAH offered the strongest proposal and was superior to all other Offerors. Under Subfactor B, Management Approach, the second most highly weighted subfactor, while GDIT received a “Very Good” as compared to BAH’s “Good” rating, BAH’s superior Technical Approach (Subfactor A) far outweighs the slight competitive advantage GDIT earned under Management Approach (Subfactor B). Furthermore, apart from GDIT, no other Offeror held any advantage over BAH under Subfactor B. Under Subfactor C, Small Business Utilization, the lowest weighted subfactor, while the three highest-rated Offerors (i.e., Accenture, BAH, and GDIT) had a slight competitive advantage over COLSA and Peraton, these three Offerors do not have any competitive advantages over each other.

For the Past Performance factor, I noted that all five Offerors received overall Very High Level of Confidence Ratings based on the combination of Very Relevant overall Relevancy and Very High Overall Performance. Based upon these ratings, the Government has a very high level of confidence that all Offerors will successfully perform the required effort.

Therefore, the evaluation results in this factor did not serve as a discriminator in my selection decision.

For the Cost/Price factor, I noted that Accenture had the highest probable Cost/Price, which was significantly higher than all other Offerors. Peraton had the lowest total probable Cost/Price, which was slightly lower than COLSA’s and GDIT’s total probable cost/price, and very slightly lower than BAH’s total proposed and probable cost of $608,314,642. BAH offered the second highest proposed and probable cost/price.

In making my selection decision, I referred to the relative order of importance of the three evaluation factors as specified in the RFP. Under Mission Suitability, the most important factor, I determined that in Subfactor A, Technical Approach, the most heavily weighted subfactor, BAH offered the strongest proposal and was superior to all Offerors. Under Subfactor B, Management Approach, I determined that while GDIT received a “Very Good” as compared to BAH’s “Good” rating, BAH’s superior Technical Approach far outweighs the slight advantage GDIT earned under Management Approach. Furthermore, apart from GDIT, no other Offerors had any advantage over BAH under this subfactor. Under Subfactor C, Small Business Utilization, I determined that while the three highest rated Offerors (i.e., Accenture, BAH, and GDIT) had a slight advantage over COLSA and Peraton, these three Offerors do not have any competitive advantages over each other. For Past Performance, the second most important evaluation factor, all Offerors received Very High Level of Confidence ratings; therefore, this was not a discriminating factor in my award decision.

Next, I focused on Cost/Price, which is the least important evaluation factor. I compared BAH’s proposed and probable cost to the Offeror with the next highest rating in the Mission Suitability factor, namely GDIT, and noted that BAH’s probable cost is only very slightly higher. I concluded that BAH’s advantage in the Mission Suitability factor, especially in Subfactor A, Technical Approach, far outweighs GDIT’s slight Cost/Price advantage. Also, I note that as set forth in the RFP, Mission Suitability and Past Performance, when combined, are more important than Cost/Price. Since BAH has the superior Mission Suitability proposal (as a result of its “Excellent” ratings in both Subfactors A and C) coupled with the highest possible Past Performance rating, it is worth paying the additional price to receive the additional benefits offered by BAH’s proposal. That is, along with this very slight Price/Cost premium, NASA will obtain both a technically superior solution to the CyPrESS requirements and a very high level of confidence that BAH will successfully perform this effort.

For the above-stated reasons, Booz Allen Hamilton’s proposal offers the best value to the Government. Therefore, I select Booz Allen Hamilton for award of the Cybersecurity and Privacy Enterprise Solutions and Services (CyPrESS) contract.

Jeffrey M. Seaton Date Source Selection Authority