System 1 LSJ POP Extension 08-20-20 - redacted.pdf

Limited Sources Justification Task Order Number: DE-DT0012292

1 | P a g e

U.S. Department of Energy

Office of Headquarters Procurement Services Office of the Chief Information Officer

I. IDENTIFICATION OF THE AGENCY AND THE CONTRACTING ACTIVITY,

AND SPECIFIC IDENTIFICATION OF THE DOCUMENT AS A “LIMITED

SOURCES JUSTIFICATION”

This requirement is being issued by the U.S. Department of Energy (DOE), Office of Headquarters Procurement Services located in Washington, DC on behalf of the Office of the Chief Information Officer (OCIO).

This DOE Limited Sources Justification (LSJ) is issued pursuant to Federal Acquisition Regulation (FAR) 8.405-6(a)(1)(i)(B) “Only one source is capable of providing the supplies or services required at the level of quality required because the supplies or services are unique or highly specialized”. The DOE intends to noncompetitively issue a four (4) month Task Order extension with a two (2) month option period with System 1, Inc. (System 1) under Task Order DE-DT0012292. Task Order DE-DT0012292 was issued non-competitively as a bridge Task Order to provide for the continuation of Assessment and Authorization (A&A) services to the Government, including requirements for the OCIO and numerous Headquarters (HQ) based stakeholders including the Office of Management (MA), Office of the Chief Financial Officer (CF), Energy Information Administration (EIA), and the National Nuclear Security Administration (NNSA). This extension will provide for continued A&A support services until a follow-on competitive award is made. .

II. NATURE AND/OR DESCRIPTION OF THE ACTION BEING APPROVED

The current period of performance for the Task Order is from September 29, 2016 through August 28, 2020. The current value of the Task Order is $17,556,012.53. The DOE may extend the current Task Order by a total of six (6) months if the Government exercises the two (2) month option period. The initial period of performance for the extension period will be for four (4) months from August 29, 2020 through December 28, 2020. If the Government decides to exercise the two (2) month option, the period of performance will be extended by an additional two (2) months from December 29, 2020 through February 28, 2021.

III. A DESCRIPTION OF THE SUPPLIES OR SERVICES REQUIRED TO MEET

THE AGENCY’S NEEDS (INCLUDING THE ESTIMATED VALUE)

The current Task Order provides mission critical A&A support services at the major DOE Headquarters facilities and operating locations in the Washington, DC area. The purpose of

2 | P a g e the A&A Task Order is for cybersecurity improvement support, including Assessment and Authorization for IT systems. Under this proposed action, the scope of work will not be modified. The estimated ceiling increase for the six (6) month extension is projected to be $3,110,500.50. The total value of the Task Order will increase from $17,556,012.53 by $3,110,500.50 to $20,666,513.03 with the proposed extension.

IV. THE AUTHORITY AND SUPPORTING RATIONALE AND, IF APPLICABLE, A

DEMONSTRATION OF THE PROPOSED CONTRACTOR’S UNIQUE

QUALIFICATIONS TO PROVIDE THE REQUIRED SUPPLY OR SERVICE

Orders placed under Federal Supply Schedules (FSS) are exempt from the competition requirements in FAR Part 6. However, an ordering activity must justify its action when restricting consideration/competition of FSS contractors. The applicable authority is FAR 8.405-6(a)(1)(i)(B) “Only one source is capable of providing the supplies or services required at the level of quality required because the supplies or services are unique or highly specialized”.

System 1 is the incumbent contractor and it provides trained, available, and qualified personnel to support cyber security improvements related to DOE information technology systems. The incumbent contractor is currently the only contractor at this time that can address the potential threats to the DOE environment and possesses working knowledge of the DOE IT infrastructure in the time frame required. System 1 is currently the only source capable of providing the services required at the level of quality required immediately and in the time frame required. Awarding to a new contractor, at this stage in the performance term, would include transitioning and on boarding to new contractor personnel that would cause further delays in meeting mission requirements.

The DOE requires additional time to conduct a competition for a follow-on award. Without an extension starting on August 29, 2020, the Government is at risk of jeopardizing national security. System 1 is currently working on tasks that are classified in nature. An attempt to issue a Task Order with another entity at this time to perform A&A Support Services, while conducting a competition, is impracticable and would jeopardize national security. As the incumbent contractor, System 1 is currently the only uniquely qualified contractor that can provide A&A services without an interruption in services.

V. A DETERMINATION BY THE ORDERING ACTIVITY CONTRACTING

OFFICER THAT THE ORDER REPRESENTS THE BEST VALUE

CONSISTENT WITH FAR 8.404(D)

System 1’s quote will be evaluated in accordance with the labor category rates published in GSA schedule GS-35F-0571V. The rates published in GS-35F-0571V are already considered fair and reasonable under 8.404(d) and the contracting officer will request further discounts.

3 | P a g e

VI. A DESCRIPTION OF THE MARKET RESEARCH CONDUCTED AMONG

SCHEDULE HOLDERS AND THE RESULTS OR A STATEMENT OF THE

REASON MARKET RESEARCH WAS NOT CONDUCTED

The market research conducted was to determine if the A&A requirement can be addressed under the CIO Business Support Services (CBOSS) Blanket Purchase Agreement. The Government requested that the prime contractor to CBOSS (Accenture) provide a mitigation plan to address any potential conflicts of interest that may occur if Accenture were to perform the A&A services. The mitigation plan submitted by Accenture on January 23, 2020 did not properly address any potential conflicts of interest. The Government decided that CBOSS would not be a viable vehicle to use due to potential conflicts of interest.

DOE also explored whether the Department of Justice (DOJ) could support this requirement via an inter-agency agreement. The Office of Headquarters Procurement Services (MA-64) and the OCIO conducted regular conference calls with the DOJ in March/April 2020 to inquire about using their “Cybersecurity Program Management” (CPM) multiple award blanket purchase agreement (BPA). The CPM BPA consists of 14 vendors’ total, including 12 vendors that are other than small and 2 Serviced Disabled Veteran Owned Small Businesses (SDVOSB). The CPM BPA allows for both full and open competition and set-asides for SDVOSB’s. Since DOE has historically received these services from a small business, DOE, at its discretion, prefers to set aside this requirement for small business vendors. However, since there are only 2 SDVOSBs in the CMP pool, and DOE prefers to expand the pool of competition for small business concerns, DOE concluded that the CMP multiple award BPA would not be a viable vehicle for this requirement.

DOE also examined the General Services Administration (GSA) IT Schedule 70 “Highly Adaptive Cybersecurity Services” (HACS) SIN 132-45 to determine if GSA would be a viable option to satisfy this requirement. The HACS SIN includes proactive and reactive cybersecurity services that improve the customer’s enterprise-level security position. The scope of this category encompasses a wide range of fields that include, but are not limited to, Risk Management Framework (RMF) services, information assurance (IA), virus detection, network management, situational awareness and incident response, secure web hosting, and backup and security services. Information Assurance is a specialty in IT security that will be required in the performance work statement (PWS) of any follow-on award. The PWS also puts an emphasis on risk assessments, which information assurance vendors provide.

GSA merged SIN 132-45 HACS into SIN 54151 HACS in spring/summer 2020 as part of GSA’s Multiple Award Schedule (MAS) consolidation. SIN 54151 includes a wide range of fields such as, the seven-step Risk Management Framework services, information assurance, virus detection, network management, situational awareness and incident response, secure web hosting, and backup security services and Security Operations Center (SOC) services.

The newly created SIN 54151 contains 58 Service-Disabled Veteran Owned Small Business (SDVOSBs). The OCIO reviewed the 58 SDVOSB vendors and believes that there are enough competent vendors in this group to provide adequate competition for information assurance services.

4 | P a g e

VII. ANY OTHER FACTS SUPPORTING THIS JUSTIFICATION

None.

VIII. A STATEMENT OF THE ACTIONS, IF ANY, THE AGENCY MAY TAKE TO

REMOVE OR OVERCOME ANY BARRIERS THAT LED TO THE

RESTRICTED CONSIDERATION BEFORE ANY SUBSEQUENT

ACQUISITION FOR THE SUPPLIES OR SERVICES IS MADE

DOE is in the process of conducting a competition for A&A work. Therefore, future restricted considerations are not anticipated.

IX. EVIDENCE THAT ANY SUPPORTING DATA THAT IS THE

RESPONSIBILITY OF TECHNICAL OR REQUIREMENTS PERSONNEL (E.G.,

VERIFYING THE GOVERNMENT’S MINIMUM NEEDS OR REQUIREMENTS

OR OTHER RATIONALE FOR LIMITED SOURCES) AND WHICH FORM A

BASIS FOR THE JUSTIFICATION HAVE BEEN CERTIFIED AS COMPLETE

AND ACCURATE BY THE TECHNICAL OR REQUIREMENTS PERSONNEL

Given the extreme importance of Cyber Security to the Department of Energy and the sensitivity of DOE’s data including nuclear information, it is vital for operations to continue. As confirmed by the signatures below, the parties hereby certify that the facts and representations included in this justification are accurate and complete to the best of their knowledge and beliefs.

5 | P a g e

CERTIFICATION

Acquisition Initiator:

The acquisition initiator certify that the information contained in this Limited Source Justification is accurate and complete to the best of the acquisition initiator’s knowledge and belief:

Joseph Peters Date Contracting Officer Representative, IM-13 Office of the Chief Information Officer

Contracting Officer:

The Contracting Officer certifies that the justification is accurate and complete to the best of the Contracting Officer’s knowledge and belief.

Maria Vant Hof, Date Contracting Officer, MA-641.1 Office of Headquarters Procurement Services

REMAINDER OF PAGE INTENTIONALLY LEFT BLANK

6 | P a g e

LSJ Signature Page

Janella Davis Date Division A Manager Office of Headquarters Procurement Services, MA-64

Deborah Black Date Procuring Activity Competition Advocate Office of Headquarters Procurement Services, MA-64