Tab 1 - CAST AIP Amended LSJ Final Redacted.pdf

Limited Sources Justification and Approval (J&A)

April 2024 Page 4 of 7April 2024 Page 4 of 7

Option Period 1:

CLIN 1001 - CAST Application Intelligence Platform (Original - fully executed) Period of Performance: 31 May 2025 - 30 May 2026 CLIN 1002 - Support services - CAST Application Intelligence Platform (Original - fully executed) Period of Performance: 31 May 2025 - 30 May 2026 CLIN 1003 - CAST Imaging Term License (Mod P00003 - fully executed) Period of Performance: 31 May 2025 - 30 May 2026 CLIN 1004 - CAST Training and Implementation (New Mod) Period of Performance: date of execution - 30 May 2026

Option Period 2:

CLIN 2001 - CAST Application Intelligence Platform (Base - fully executed) Period of Performance: 31 May 2026 - 30 May 2027 CLIN 2002 - Support services - CAST Application Intelligence Platform (Base - fully executed) Period of Performance: 31 May 2026 - 30 May 2027 CLIN 2003 - CAST Imaging Term License (Mod P00003 - fully executed) Period of Performance: 31 May 2026 - 30 May 2027 CLIN 2004 - CAST Training and Implementation (New Mod) Period of Performance: 31 May 2026 - 30 May 2027

III. Description of supplies/services required to meet agency needs.

AFLCMC/GB4 program management office currently utilizes CAST AIP for application integration, migration, and sustainment within Cloud One. To enhance visualization capabilities for cloud migration and refactoring, a customized Imaging module add-on license is being acquired to supplement the existing legacy CAST AIP license. CAST Imaging automates application analysis, mapping internal components and storing relationships in an updatable knowledge base. This enables architects, technical leaders, developers, and IT management to efficiently address modernization, sustainment, break-fix, architectural planning, and software integrity verification tasks through a visualization map and customizable dashboards. Additionally, Training and Implementation (T&I) Services will be required for ramp up of personnel configuring the scans of Licensee's Named Applications using CAST Imaging. T&I Services are estimated based upon the complexity and diversity of the Named Applications to be analyzed.

The following licenses are required for this modification:

CAST Imaging Term Licenses CAST Training and Implementation (T&I) Services

FAR clause 52.217-6, Option for Increased Quantity will be added to this order to give the Government the ability to increase the quantity of licenses called for in the schedule at the unit price specified.

IV. Identification of the justification/rationale for limiting sources and demonstration of the contractor's unique qualifications to provide the required supply/service.

This procurement requires brand name software and associated support, maintenance, training, and implementation services IAW FAR 8.405-6(b)(1). The GB4 PMO currently utilizes CAST AIP for the integration, migration, and sustainment of mission applications into Cloud One. With the 48 different code languages associated with CAST AIP that can/will be reverse engineered, it is an essential tool, April 2024 Page 5 of 7April 2024 Page 5 of 7 without which it would typically costs millions of dollars to replicate with several different software purchases. CAST AIP supports cloud migration of code to assist with refactoring and sustainment of the programs. CAST AIP with its Imaging module is the only tool that allows for integrated tech debt scores, function points, and that can scan the power builder code within any mission application, while providing the system integrator simplistic details of resolution and improved system and database visibility.

The associated support, maintenance, training, and implementation of the CAST AIP software is also crucial to retaining this essential tool. CAST AIP is the only tool that allows for integrated tech debt scores, function points, and that can scan the power builder code within any mission application, while providing the system integrator simplistic details of resolution. Unlike similar products or competitors in the market, CAST AIP goes beyond just code quality to provide a much broader and deeper understanding of software systems, focusing on overall application health and business impact.

Since AFLCMC/GB4 already has acquired the CAST AIP licenses, CAST Imaging will provide automatic "understanding" on how the software works. This capability will visually map various of code elements and all their relationships into a living knowledge base of the software, internals, helping architects and developers navigate the application and quickly find what the program needs.

CAST Software, Inc. is the original author and owner of the CAST Application Intelligence Platform (AIP) suite of products. This application is only from this company and any CAST products are not available to the US Federal or State Governments from any other source or supplier in the marketplace except on its own GSA Schedule: GS-35F-0649S. No reseller or service provider is authorize to resell nor is any other party certified to deliver CAST AIP training services to the CAST AIP for State and U.S. Federal Governments. Therefore, CAST certifies that no better pricing can be obtained in other marketplaces.

V. Determination by the ordering activity Contracting Officer that the order represents the best value consistent with

FAR 8.404(d).

IAW FAR 8.404(d), the Contracting Officer has determined that this order represents best value to the Government becase the CAST AIP products required are brand name specific. Further, the original equipment manufacturer does not utilze resellers. Instead the OEM maintains their GSA MAS for sales to the Government. IAW FAR 8.405-6(b)(3) this amended justification will be posted along with the original RFQ posting in eBuy.

VI. Description of the market research conducted and the results, or explain why market research was not conducted.

There are comparable product(s) on the market research conducted within the past 18 months dated 13 May 2024. There are similar capabilities in the market, such as SonarQube with Sonargraph integration.

However none provide the level of enhanced architectural mapping and technical debt visibility that is needed to meet GB4 portfolio requirements. Compared to other products CAST AIP with the add-on Imaging module provides:

Sophisticated Data Flow Analysis: CAST solves the critical problem of detecting complex vulnerabilities like SQL injection and cross-site scripting (XSS) that plague modern applications. Its deep data flow analysis meticulously traces data dependencies across multiple tiers, providing unparalleled visibility that outperforms simpler static analysis techniques.

April 2024 Page 6 of 7

Customizable Rules and Quality Models: Only CAST provides the granular control necessary to fully customize analysis rules and quality models, ensuring alignment with specific coding standards and unique project requirements. This unparalleled level of customizability unlocks a deeper, more targeted analysis that is simply unattainable with one solution other than CAST.

Broader Technology Coverage: While other tools offer limited support for modern languages, CAST AIP uniquely encompasses a vast technology landscape, including critical legacy languages like COBOL and mainframe environments. Quantifiably, CAST AIP boasts support for a wider array of languages than many competitors, making it the only solution for organizations managing a diverse and complex technology portfolio.

Architectural Analysis: CAST goes beyond code-level analysis to provide insights into the overall architecture of the application. This helps identify architectural flaws that can impact performance, scalability, and maintainability.

Technical Debt Measurement: For organizations that demand a clear understanding of the business impact of technical debt, only CAST AIP provides a comprehensive assessment, including detailed cost-to-fix analysis. This unrivaled visibility enables strategic prioritization of remediation efforts and data-driven software development decisions that are simply impossible to achieve with alternative approaches.

Impact Analysis for Change Management: CAST AIP provides impact analysis capabilities, allowing developers to understand the potential impact of changes to the codebase. This helps to reduce the risk of introducing new defects and improve the overall quality of the software. This is a qualitative advantage based on the breadth of dependencies tracked

While other comparable products on the markets provide some of these capabilities, none provide all these capabilities in a single solution. This would mean that using a different product than CAST AIP with Imaging module would result in either reduced capability or multiple contracts, which would increase costs and complications. Based on these comparisons, CAST AIP with the add-on Imaging module is the only tool that will provide the depth of analysis we need to effectively manage our application architecture and proactively address technical debt, ultimately reducing risk and improving maintainability.

VII. Other facts supporting the justification.

CAST Software, Inc. is the original author and owner of the CAST AIP suite of products. The CAST AIP is a software application, available only from CAST Software, Inc. CAST Software, Inc. provided additional documentation on 1 May '24 to confirm that the CAST AIP software is not available to the US Federal or State governments from any other source or supplier in the marketplace. CAST Software, Inc. has no standing authorization with any other entity to act on its behalf for: the selling of the CAST AIP Licenses (Trial or otherwise), provision of software maintenance and upgrades; or in the delivery of training services in support of the CAST Application Intelligence Platform to the U.S. Federal Government.

VIII. Actions the agency may take to remove or overcome any barriers that led to the restricted consideration before any subsequent acquisition for the supplies or services.

To foster a competitive environment for future acquisitions, the GB4 program management office is committed to addressing the specific factors that previously restricted competition. This involves a

April 2024 Page 7 of 7 thorough analysis of the prior acquisition, coupled with proactive industry engagement in order to develop effective competition strategies. The Capability Delivery Manager (CDM), in collaboration with the contracting team, will continuously monitor the market through various research methods which includes online research, vendor exchanges, and participation in local IT conferences. These efforts aim to identify potential new and existing vendors offering products that align with our specifications and can contribute to a robust and competitive landscape. While current market research has not yet identified alternative capabilities that offer schedule improvements, cost savings, enhanced work efficiency, or complete resolution of existing software limitations, the agency remains dedicated to exploring all available options to optimize future acquisitions.

IX. Certification by the Contracting Officer.

As evidenced by my signature above, I have determined this document to be both accurate and complete to the best of my knowledge and belief.

X. Certification by the technical/requirements personnel.

As evidenced by my signature above, I certify that any supporting data contained herein, which is my responsibility, is both accurate and complete.