TMBCS_JA_Approved_for_posting.pdf

UNITED STATES MARINE CORPS

MARINE CORPS SYSTEMS COMMAND

2200 LESTER STREET

QUANTICO, VIRGINIA 22134-6050

.IN REPLY REFER TO:

CT Code: 028-PEO LS

J&A Number: 18,308.0

JUSTIFICATION AND APPROVAL (J&A)

FOR USE OF OTHER THAN FULL AND OPEN

C O M P E T I T I O N

1. Contracting Activity

Marine Corps Systems Command (MARCORSYSCOM)

Program Executive Officer Land Systems (PEO LS)

Program Manager, Aviation Command and Control and Sensor Netting

(AC2SN)

2200 Lester Street

Quantico, VA 22134-6050

2. Description of the Action Being Approved

The use of other than full and open competition is sought to procure software sustainment and post-production life cycle software support for the Theater Battle Management Core System

(TBMCS) to Lockheed Martin Corporation, 9970 Federal Drive, Colorado Springs, CO 80921-3616.

3. Description of Supplies/Services

TBMCS, is a United States Air Force (USAF) led program with

Joint interest. The USAF serves as the focal point for Joint

Air Warfare Command and Control (C2) and integrating systems for planning, tasking, intelligence-gathering, and execution of the air battle through a single, common interface. TBMCS is the primary system for planning, managing, and executing the air battle, and it feeds real-time, decision-quality information to users at the Joint Forces Air Component Commander (JFACC) and the staff at the Air Operations Command (AOC), and to pilots, navigators, and weapons control officers on the battlefield.

TBMCS links the command and control systems for the USAF, United

States Navy (USN), and United States Marine Corps (USMC), and integrates with ground systems for the United States Army, enabling coordinated, synchronized air battle management. The

TBMCS program is an Acquisition Category III program, post

Milestone C, in sustainment.

WebLogic Server

The proposed contract is procure software sustainment, continued software development, information assurance updates, real-time issue resolution, and post-production life cycle software support for the USMC's TBMCS baseline. Lockheed Martin is uniquely qualified to provide these services due to their extensive experience and intimate knowledge of the complex, integrated nature of the TBMCS software suite, and unique combination of programming languages and compilers required to sustain the TBMCS software baseline.

The TBMCS software baseline consists of over four million lines of code implemented using a complex mix of programing languages

(e.g., Ada, Java 2 Platform Enterprise Edition, C, C++, Perl, Unix Shell Scripts, SQL, Ant, Batch Code, Visual Basic, and

AWK). Additionally, the TBMCS software uses multiple specific compilers and libraries for legacy UNIX applications, including

Sun C++ compiler, Forte Developer 7 c++ 5.4 2002/03/09, Sun C compiler, Forte Developer 7 C 5.4 2002/03/09, KL Group XRT Table v2.2.1, Field vl.1.0, Gear widgets, v2.0.1, etc. The TBMCS operating systems include Solaris 10, Windows 10, Windows Server

2012, and middleware consisting of Oracle 9i/12c, Oracle

12c, Systematic IRIS, and Java Runtime

Environment 1.6, with compatibility to Java 1.6. Lockheed

Martin's experience in developing and sustaining the TBMCS software code using this wide array of programming languages, software tools and operating systems, and the knowledge they have regarding the relationships and interaction that each component has upon TBMCS functionality uniquely positions them as the only source available to provide continued software sustainment services.

The estimated dollar value for this procurement is $30M. The period of performance for the proposed effort is five years after contract award, with one base year and four, one-year option periods. The funding table below is illustrated in millions, per appropriation type and Fiscal Year (FY).

(Estimated Dollar Value in $M)

APPROPRIATION FY19 FY20 FY21 FY22 FY23

OMMC $5.8 $5.9 $6.0 $6.1 $6.2

TOTAL $5.8 $5.9 $6.0 $6.1 $6.2

4. Statutory Authority Permitting Other Than Full and Open

Competition

The Statutory Authority permitting use of other than full and open competition is 10 U.S.C. § 2304(c)(1) as implemented by the

Federal Acquisition Regulation (FAR) 6.302-1, "Only One

Responsible Source and No Other Supplies or Services will

Satisfy Agency Requirements."

5. Rationale Justifying Use of Cited Statutory Authority

Lockheed Martin has unique and extensive knowledge of the complexities associated with the TBMCS software due to their direct involvement in developing and sustaining the software over the past twenty-plus years. The Government considers the software sustainment services provided by Lockheed to be highly specialized services because Lockheed's knowledge and proficiency in sustaining the TBMCS software cannot be readily replicated or replaced. Based on the Government's market research, no other known sources possess the experience or sufficient working knowledge of the TBMCS source code and software functionality to provide these specialized services.

The government estimates that another contractor would require

2-3 years of extensive study and work with the TBMCS software in order to develop a similar but less capable working knowledge.

As such, award to another contractor is likely to result in duplication of cost to the government that is not expected to be recovered though competition. The Government expects unacceptable delays would occur for delivery of required software updates due to the extensive timeframe required for another contractor to become proficient with the software.

Quarterly software updates, beginning 120 days after award, are needed to maintain the TBMCS Authority to Operate (ATO) and to mitigate current and emerging cybersecurity vulnerabilities and threats.

The government's expectation that award to another contractor would result in duplication of cost and unacceptable delays is based upon the USAF TBMCS program's previous experience and attempt to transition TBMCS software sustainment services to another agency. In the 2010 timeframe, the USAF TBMCS program office transitioned TBMCS software sustainment services to the

309th Software Maintenance Group (SMXG); a highly credible and capable CMMI Level 5 certified organization. After nearly 7 years of working with the TBMCS software, with only a few minor updates developed and provided, the USAF determined that the code was too complex to transition to another agency. By 2017, after considerable investments and delays, the USAF adopted the

USMC TBMCS program's latest software build (developed by

Lockheed), and awarded a sole source contract to Lockheed Martin for future software sustainment services. The USAF's difficulties during this period ultimately resulted in the

USMC's decision to depart from the USAF's sustainment approach, and award a competitive contract (only one bid received) for TBMCS software sustainment to Lockheed Martin in 2014. Similar cost duplication/ growth and unacceptable delays would occur if the

USMC were to award the TBMCS software sustainment services to another source.

The TBMCS software, originally developed by Lockheed Martin in the late 1990's, is highly interwoven and requires an intimate understanding of how each element interacts with one another in order to modify or upgrade the software. Cybersecurity related patches or updates applied to one element of the software can impact functionality of other software elements in a manner that is not readily apparent. Lockheed Martin has unique knowledge of the complex, interdependent nature of the TBMCS software through years of engineering experience gained in the development and sustainment of the TBMCS software code.

The USMC software sustainment services also require integration with USAF/ Joint sustainment efforts to maintain backwards and forwards interoperability. TBMCS sustainment support must be accomplished without compromising joint TBMCS performance and functionality, and without compromising the Cybersecurity posture of the system.

This follow-on contract for software sustainment services requires a contractor who possesses a detailed understanding of

These highly specialized services are required to ensure TBMCS continues to meet USMC requirements, requirements to be compatible with Air Force systems, and maintain warfighter capabilities and readiness until its successor, the Command and

Control Air Operations Suite, Command and Control Information

Services, Marine Corps (C2AOS-C2IS MC) system completes fielding, which is planned for FY23.

Perform implementation and testing of the intricacies associated with the TBMCS software in order to perform the following activities:

a) Perform systems engineering, software maintenance, and integration, including test activities, lab support, quality assurance, and developmental test support for legacy applications and engineering integration of web-based applications (first, second generation and third-party software code), service inventories, and deployment in the sustainment of software and software languages associated with TBMCS.

b) Implement cybersecurity software updates and execute cybersecurity policies and directives (DoDI 8500.1, DoDI

8510.01, Federal Information Security Management Act (FISMA) and Marine Corps Enterprise Cybersecurity Manual 018 (ECSM

018)) in relation to the systems architecture across security domains from unclassified to Secret (Sensitive Compartmented

Information (SCI)). Implementation of cybersecurity updates requires a contractor who possesses a thorough understanding of the TBMCS software architecture in order to ensure that the updates do not render the applications or interfaces inoperable.

c) Provide fielded software maintenance including providing a

Tier II, 24-hour Help Desk. Tier II support services provide real-time maintenance, software fixes, documentation, and contingency support to support operational employment of

TBMCS. These services include technical expertise and assistance to respond to time-critical/ mission essential questions and issues related to TBMCS fielded systems, system patches, service packs, real-world contingencies, exercises, and testing. These services require the contractor to provide a secret classified lab, configured to provide the USMC TBMCS fielded baselines, and interoperation with the USAF and USN

TBMCS baselines and associated aviation command and control systems.

d) Maintain Capability Maturity Model Integration (CMMI) Level 3 compliance and ensure work performed by subcontractors is consistent with CMMI Level 3.

e) Perform regression and other testing, and rapidly resolve hardware and software issues resulting from baseline changes in fielded systems (i.e., Information Assurance Vulnerability

Alerts (IAVAs)).

The estimated six month delay associated with attaining certification by the Defense Security Service (DSS) of a new classified lab space would create an unacceptable risk of unsuccessful completion of the contractual requirements. The inability for a vendor to commence work on a software build until after they have a certified Secret Lab space, means the first software build from that vendor could not be delivered until at least 10 months after contract award. The result is a high risk of unsuccessful completion of the contractual requirement to deliver four software maintenance releases per year which jeopardizes the ability of the USMC to maintain the

Authority to Operate for the USMC TBMCS system.

Based on the aforementioned reasons the use of a sole source follow on contract to support this effort is in the best interest of the Government to avoid the substantial duplication of costs that would be incurred and the programmatic schedule risk associated if another source were used from the competitive process of awarding a new contract.

6. Description of Efforts Made to Solicit Offers from as Many

Offerors as Practicable

In accordance with FAR 5.201, on 18 December 2017, the government released RFI M67854-18-I-0022 to industry, in accordance with Federal Acquisition Regulation (FAR) Part 10, to determine industry's capability to provide TBMCS software sustainment and post production life cycle software support.

Three companies responded to the Government's TBMCS RFI;

Lockheed Martin Corporation; 22nd Century Technologies, Incorporated; and DKW Communications, Incorporated. The results of the Government team review and analyses of the RFI responses identified Lockheed Martin Corporation as the only source able to provide TBMCS software sustainment and post production life cycle software support. The other two companies did not adequately address the criteria cited in the RFI, resulting in a lack of identified capability regarding cybersecurity support and potential adverse cost, schedule and performance impacts to the program.

The TBMCS program incorporates software developed by Lockheed

Martin under a previously competitively awarded contract. Based

Defense Information Systems Agency (DISA) Security Technical

Implementation Guide (STIG) using approved DISA STIG Tools, Technical Change Notification Orders (TCNOs), and Group

Policy Objects (GPO) upgrades).

on the Government's analysis of the three vendor responses to the published Request For Information (RFI), Lockheed Martin

Corporation is the only known source qualified to provide the required TBMCS software sustainment and post production life cycle software support based on its inherent knowledge, expertise, and capability to maintain the TBMCS software that it developed. Awarding the sustainment effort to either of the other vendors that responded to the RFI, would create a high risk of unsuccessful completion of the contractual requirement to deliver four software maintenance releases per year because the Market Research Report indicates neither of them possessed all of the capabilities necessary to meet all requirements cited in the RFI.

Furthermore, Lockheed Martin Corporation is the current provider of TBMCS software sustainment activities for both the U.S. Air

Force and U. S. Marine Corps, and has been responsible for developing, modifying, and sustaining the TBMCS software for the

Marine Corps since the initial competitively awarded contract in

1995. Lockheed Martin Corporation is the only contractor who can provide the support for USMC-unique requirements, while ensuring that the joint TBMCS software baseline is maintained without unacceptable delays. In order to adequately support the requirements for a Mission Critical IT system that supports the

Joint Air Battle Plan, quarterly software updates are required.

Delivery of the first build is required no later than 120 days after contract award.

The RFI requested vendors to describe their ability to deliver the first software build within 120 days after contract award.

Lockheed Martin was the only vendor that stated in their response to the RFI that they could meet the requirement to deliver the first software build within 120 days of contract award. The inability of the other respondents to provide the first of four required quarterly software releases within 120 days creates an unacceptable level of risk to the maintenance of the cyber security posture and the Authority to Operate for the

TBMCS. In addition, it indicates a much higher risk of unsuccessful completion of the contractual requirement to deliver four software maintenance releases per year.

Lastly, Lockheed Martin was the only vendor that confirmed in their response to the RFI, that they currently maintain a classified lab.

The Government's RFI analysis referenced herein was captured in the market research assessment report and provided to the

Contracting Officer and Program Manager, resulting in a Market

Research memorandum signed by the Program Manager on 09 March

2018.

7. Determination of Fair and Reasonable Cost

In accordance with FAR 15.402, the Contracting Officer will ensure that all supplies and services are procured at a fair and reasonable price. The Contractor will be required to submit a formal proposal with certified cost and pricing data and sufficient information to support the accuracy and reliability of their estimate. An analysis of the proposal will be performed by the technical analysts from the G/ATOR Program Management Office (PMO) and contract specialists, with the assistance of Defense Contract

Management Agency (DCMA) and Defense Contract Audit Agency (DCAA) auditors as needed. The Contracting Officer will analyze the various cost elements that are presented in the proposal, as well as review the actuals from previous procurements, if applicable.

The Contracting Officer will use Government expertise, including

DCMA, DCAA, and other Government resources, to evaluate the proposal's material, labor, subcontractor and ODC positions.

Furthermore, the Government will also utilize the Program Office's

Independent Cost Estimate as part of the evaluation of their proposal to validate the fair and reasonable price. As discussed in this paragraph, the Contracting Officer will use cost and price analysis as the basis for negotiating a fair and reasonable price for the supplies/support covered by this J&A.

8. Actions to Remove Barriers to Future Competition

For reasons set forth in paragraph five (5), Program Executive

Officer Land Systems (PEO LS) has no plans to compete the TBMCS follow on effort. If another potential source emerges, PEO LS will assess whether competition for future requirements is feasible. Any future actions will be reviewed by PEO LS to offer competition to the greatest extent possible.