Tab A3 Justification_for_Other_Than_Full_and_Open_DCO_SANS_FINAL_Redacted.pdf

RCO MCIWEST

J&A No. 21-002 18 February 2021

JUSTIFICATION FOR USE OF OTHER THAN FULL AND OPEN COMPETITION

UNDER FAR PART 13.5 SIMPLIFIED PROCEDURES FOR CERTAIN COMMERCIAL ITEMS

I. BACKGROUND:

1. FAR 13.106-1(b)(2) states for purchases exceeding the simplified acquisition threshold the requirements at 13.501(a) apply to sole-source (including brand-name) acquisitions of commercial items conducted pursuant to Subpart 13.5.

2. This document constitutes justification and approval for other than full and open competition and Brand Name for the acquisition described herein, in accordance with FAR 13.501(a)(1)(ii) and under the authority of 41 U.S.C. §1901.

II. CONTRACTING ACTIVITY

U.S. Marine Corps, Regional Contracting Office (RCO), Marine Corps Installation West – Marine Corps Base, Camp Pendleton (MCIWEST-MCB CAMPEN), CA 92055.

III. DESCRIPTION OF ITEM OR SERVICE:

This procurement is for ESCAL Institute of Advance Technologies, Inc. (doing business as SANS Institute) training courses and certification. The 9th Communication Battalion (9th Comm) and the Defensive Cyber Operations Company (DCO) are responsible for administering, managing and facilitating the Cyber Workforce Improvement Program (CWIP). The CWIP is DCO’s development program designed to develop a highly skilled Information Assurance Work Force (IAWF) with a common understanding of the cyber security concepts, principles and applications for each Department of Defense (DOD) category, level and function to enhance protection and availability of I Marine Expeditionary Force Information Group (I MIG) information, information systems and networks. The CWIP establishes baseline skills among personnel performing Information Assurance (IA), Computer Network Defense Services Provider (CND SP), Information Assurance System Architect and Engineer (IASAE), Certification and Accreditation (C&A) and other IA related functions within the I MIG domain. The SANS Security training courses required to support the I MIG CWIP include the following:

AUD507: Auditing & Monitoring Networks, Perimeters & Systems AUD566: Implementing and Auditing the Critical Security Controls - In-Depth FOR498: Battlefield Forensics & Data Acquisition FOR500: Windows Forensic Analysis FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics FOR518: Mac and iOS Forensic Analysis and Incident Response FOR526: Advanced Memory Forensics & Threat Detection FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response FOR578: Cyber Threat Intelligence

UNITED STATES MARINE CORPS

MARINE CORPS INSTALLATIONS WEST-MARINE CORPS BASE

BOX 555010

CAMP PENDLETON, CALIFORNIA 92055-5010

FOR585: Smartphone Forensic Analysis In-Depth FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques ICS410: ICS/SCADA Security Essentials ICS456: Essentials for NERC Critical Infrastructure Protection ICS515: ICS Active Defense and Incident Response LEG523: Law of Data Security and Investigations MGT414: SANS Training Program for CISSP® Certification MGT415: A Practical Introduction to Cyber Security Risk Management MGT433: SANS Security Awareness: How to Build, Maintain, and Measure a Mature Awareness Program MGT512: Security Leadership Essentials for Managers MGT514: Security Strategic Planning, Policy, and Leadership MGT516: Managing Security Vulnerabilities: Enterprise and Cloud MGT525: IT Project Management, Effective Communication, and PMP® Exam Prep SEC301: Introduction to Cyber Security SEC401: Security Essentials Bootcamp Style SEC402: Cybersecurity Writing: Hack the Reader SEC440: Critical Security Controls: Planning, Implementing, and Auditing SEC450: Blue Team Fundamentals: Security Operations and Analysis SEC455: SIEM Design & Implementation SEC460: Enterprise Threat and Vulnerability Assessment SEC487: Open-Source Intelligence (OSINT) Gathering and Analysis SEC501: Advanced Security Essentials - Enterprise Defender SEC503: Intrusion Detection In-Depth SEC504: Hacker Tools, Techniques, Exploits, and Incident Handling SEC505: Securing Windows and PowerShell Automation SEC506: Securing Linux/Unix SEC511: Continuous Monitoring and Security Operations SEC530: Defensible Security Architecture and Engineering SEC534: Secure DevOps: A Practical Introduction SEC540: Cloud Security and DevOps Automation SEC542: Web App Penetration Testing and Ethical Hacking SEC545: Cloud Security Architecture and Operations SEC555: SIEM with Tactical Analytics SEC560: Network Penetration Testing and Ethical Hacking SEC564: Red Team Exercises and Adversary Emulation SEC566: Implementing and Auditing the Critical Security Controls - In-Depth SEC573: Automating Information Security with Python SEC575: Mobile Device Security and Ethical Hacking SEC580: Metasploit Kung Fu for Enterprise Pen Testing SEC588: Cloud Penetration Testing SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses SEC617: Wireless Penetration Testing and Ethical Hacking SEC642: Advanced Web App Penetration Testing, Ethical Hacking, and Exploitation Techniques

SEC660: Advanced Penetration Testing, Exploit Writing, and Ethical Hacking SEC699: Purple Team Tactics - Adversary Emulation for Breach Prevention & Detection SEC760: Advanced Exploit Development for Penetration Testers

This requirement utilizes the product service description code (PSC) of U008 Education /Training. The total estimated value of the contract is $1,998,760.00, (12 month base, 4 option years and a 6-month option in accordance with the FAR Clause 52.217-8, Option to Extend Services, if exercised). The North American Industry Classification System (NAICS) code selected is 611430, (Professional and Management Development Training), with a size standard of $11,000,000.00.

Estimated Dollar Value

Title Period of Performance Description Estimated Amount

Base Period FY 2021 01 May 2021 - 31 April 2022 SANS Training $499,690.00

Option YR 1 FY 2022 01 May 2022 - 31 April 2023 SANS Training $499,690.00

Option YR 2 FY 2023 01 May 2023 - 31 April 2024 SANS Training $499,690.00

Option YR 3 FY 2024 01 May 2024 - 31 April 2025 SANS Training $499,690.00

Based on the above, the total estimate (inclusive of options) for the requirement is $1,998,760.00

IV. THE DETERMINATION FOR USE OF OTHER THAN FULL AND OPEN COMPETITION IS

BASED ON THE FOLLOWING:

A. X ONLY ONE RESPONSIBLE SOURCE (select all that apply):

1. X RESTRICTIVE RIGHTS. The source has established proprietary rights, limited rights in data, patent rights, copyrights or secret processes in the item or service required.

SANS Institute is the sole propriety owner of the memberships, site licenses, pre-assessments, test vouchers, and all other materials related to the Global Information Assurance Certification (GIAC) and their association. In accordance with DoDD 8140.01 and DoD 8570.01-M, personnel performing Information Assurance (IA) functions must obtain one of the certifications required for their position, category/specialty and level to fulfill the IA baseline certification requirement. GIAC offers 15 different IA certifications that meet the requirement for 13 out of 14 work roles as defined in DoDD 8140.01 and DoD8570.01-M. SANS is the only vendor that provides one platform for all of the training required for 17XX Marines awaiting school to effectively perform their duties in accordance with the DCO-IDM COE. No other commercial vendors offer all of the classes needed to prepare 17XX Marines to execute the Defensive Cyberspace Operations Internal Defensive Measures Concept of Employment (DCO-IDM COE) except SANS. Utilization of other like training sessions would require additional time and increased funding not expected to be recovered through competition, as multiple vendors and programs would need to be utilized.

The potential impacts associated with deviating from currently used SANS training products include interoperability issues in trying to go from one training module to another, the cost and time impacts of using several different vendors to get what one vendor can offer, as well as different quality standards across vendors. SANS training is in the best interest of the Marine Corps to avoid a lapse in certification among the DCO team. SANS is the only GIAC Certified vendor in the current market place that can offer the official SANS Curriculum and SANS Certified Instructors to deliver training on any SANS class, including all GIAC preparation courses.

2. X EXCLUSIVE LICENSING AGREEMENTS. The item or service is only available from the Original Equipment Manufacturer (OEM), or there is only one authorized distributor or technical representative for the OEM.

SANS training products must be purchased directly from SANS. SANS has the exclusive licensing rights and copyright protection to produce, sell, and deliver GIAC training products and services. There are no agents or dealers authorized to request this product. SANS retains the rights to their proprietary services.

B. _X_ BRAND NAME Item required must be a brand name, product, or feature of a product, particular to one manufacturer.

SANS training and GIAC certification are brand name and sole source products, manufactured, sold, and delivered to the Government exclusively by SANS. SANS training is the most up to date and relevant technical information being taught that will assist our 17XX Marines to conduct functions/tasks in the DCO-IDM COE, NAVMC 3500.124 Cyberspace T&R Manual, as well as meet DoDD 8140.01 Cybersecurity Workforce Management Program requirements.

V. DESCRIPTION OF EFFORTS MADE TO SOLICIT OFFERS FROM AS MANY OFFERORS AS

POSSIBLE:

A. A description of efforts made to ensure that offers are solicited from as many potential sources as is practicable, including whether a notice was or will be publicized as required by Subpart

5.2 and, if not, which exception under 5.202 applies.

Pursuant to FAR Part 10 and DFARS Part 210, market research was conducted to include Small Business Dynamic Search, Interagency Contracting Directory, AbilityOne, and Unicor.

The research did not provide sources that were capable of fulfilling the requirement.

A Request for Information (RFI) was posted for 7 days on www.beta.sam.gov (Contract Opportunities) on January 14, 2021. Only one business responded to the posting. Cyberworld Institute responded with a capabilities statement, which was submitted to the requiring activity for review. The review determined the company did not meet the training requirements, as Cybeworld Institute only provides exam preparation and not actual exam certification and were also missing several courses in the planned pipeline, such as SEC504 GIAC Certified Incident Handling, which is required for analysts to reach the required level of certification.

B. A determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/05.htm#P55_9235 http://www.beta.sam.gov/

Fair and reasonableness of the price will be based on an analysis of prior similar contracts, market research conducted on 07 January 2021 in the Market Research Memorandum.

C. A description of the actions taken to remove barriers to future competition.

For the reasons set forth in Paragraph IV, the activity has no plans at this time to eliminate the use of brand name and/or proprietary specifications and standards from future solicitations for the types of supplies/services covered by this document; however, this will be reassessed during follow-on acquisition planning.

CERTIFICATIONS AND APPROVAL

TECHNICAL/REQUIREMENTS CERTIFICATION:

I certify that the supporting data under my cognizance, which is included in this justification, are accurate and complete to the best of my knowledge and belief.

I certify that this Justification is accurate and complete to the best of my knowledge and belief.

Competition Advocate Approval Upon the basis of the above justification, I hereby approve, as the Competition Advocate for the Regional Contracting Office located at Camp Pendleton CA the solicitation of the proposed procurement described herein using other than full and open competition, pursuant to the authority of 41 U.S.C. §1901, as implemented by FAR 13.501(a)(2)(ii), Simplified Procedures for Certain Commercial Items -- Special Documentation Requirements.

JUSTIFICATION FOR USE OF OTHER THAN FULL AND OPEN COMPETITION