USCA15BPAC1020_LSJ_Extension.pdf

AO 370C (12/18)

JUDICIARY PROCUREMENT PROGRAM

LIMITED SOURCES JUSTIFICATION (LSJ)

This acquisition is being conducted under the GSA Multiple Award Schedule Program (See FAR 8.401)

1. Agency name, contracting activity and requesting office (provide identification of judiciary organization requesting the procurement, i.e., Administrative Office of the US Courts, department, office OR court unit or federal public defender organization)

Administrative Office of the US Courts, Procurement Management Division (PMD) in support of the Department of Technology Services (DTS), Information Technology Security Office (ITSO).

2. Nature and description of the action and the estimated dollar value of proposed procurement

ITSO requires Systems Security Testing Services for up to an additional one year period. This year of services is estimated at .

This requirement will be a modification (mod) to Axxum's current order (USCA15BPAC1020) under Axxum's Security Penetration and Validation Testing Blanket Purchase Agreement (BPA), USCA15B0007. USCA15BPAC1020 expires on 08/16/2020 and this mod will add two 6-month options to that order, potentially extending the period of performance to 08/16/2021.

3. Description of supplies/services required to meet judiciary needs

ITSO requires contract labor for up to 1 year for System Security Testing in support of the Judiciary Systems Security Testing (JSST) and National Systems Security Assessments (NSSA) branches within the Security Policy and Assessments (SPA) division of ITSO. These branches within ITSO-SPA provide continuous assessment services for a wide variety of applications and systems in use throughout the Judiciary. The services these branches provide is critical to making sure that vulnerabilities and security issues are identified in a timely manner before these systems and applications go into the production environment. A failure or lapse in these assessments may result in various systems and applications going into the Judiciary's production environment with vulnerabilities and security risks that may be exploited by bad actors. To mitigate this risk, ITSO-SPA requires contractor support for up to one additional year to carry out the actual testing and assessment services to support this critical assessment service.

4. Basis for limiting sources/Authority

Brand Name/Items peculiar to one manufacturer - FAR 8.405-6(b) and Guide Vol. 14 § 310.50.66

An urgent and compelling need exists and following competition procedures would result in unacceptable delays - FAR 8.405-6(a)(1)(i)(A) and Guide Vol. 14 § 310.50.63(a)(1)

Only one source can provide the supplies or services required at the level of quality required because the supplies or services are unique or highly specialized - FAR 8.405-

6(a)(1)(i)(B) and Guide Vol. 14 § 310.50.63(a)(2))

In the interest of economy and efficiency, the new work is a logical follow-on to an original FSS order provided that the original order was placed in accordance with the applicable FSS ordering procedures. The original order or BPA must not have been previously issued under sole-source or limited-sources procedures - FAR 8.405-6(a)(1)(i)(C) and Guide Vol. 14 § 310.50.63(a)(3)

AO 370C (12/18)

JUDICIARY PROCUREMENT PROGRAM

LIMITED SOURCES JUSTIFICATION (LSJ)

This acquisition is being conducted under the GSA Multiple Award Schedule Program (See FAR 8.401)

5. Supporting rationale (explanation of the unique nature of products/services being procured, contractor's unique qualifications, or other factors supporting use of the authority cited)

Please see the LSJ Addendum for the supporting rationale.

6. Description of market research conducted among schedule holders and the results, or explanation why market research was not conducted

Market research was not conducted for this specific mod as the mod is a logical follow on to an order that was placed off a BPA created from Axxum's GSA schedule. There is no other vendor that can provide this logical follow on service.

With the above said, the AO is currently conducting extensive market research as it relates to the upcoming recompete for the services Axxum is currently providing so as to maximize competition.

7. Actions, if any, the judiciary may take to remove or overcome any barriers that led to restricted consideration before any subsequent acquisition for the supplies and services is made

As mentioned above, the AO is currently carrying out market research and taking action to remove any barriers or incumbent advantage for the re-compete so that all vendors have a level playing field to compete for the new contract at the end of this logical follow-on work. The AO is also structuring the follow-on mod with a more limited time period with two 6-month options. In the event the testing issues regarding and the increased volume of testing are addressed in the first 6-month period, the AO may not exercise the additional 6-month option period and shall transition the work to the winner of the re-compete of these services.

8. Confirm that the Contracting Officer has sought a price reduction consistent with Guide Vol. 14 § 310.50.40(c) (Required for purchases exceeding the GSA Simplified Acquisition Threshold ($150,000)

The Contracting Officer shall seek a price reduction during negotiations of the follow-on modification.

Best value for the logical follow-on work shall be determined in accordance with FAR 8.404(b). The BPA's pricing was established in accordance with FAR 8.404(b) and the CO has verified that the BPA pricing is less than Axxum's GSA FSS rates, and the current order that will be modded has pricing that is equal to or less than Axxum's BPA pricing. The modification to USCA15BPAC1020 for the logical follow-on work shall only include pricing that is less than or equal to Axxum's BPA rates and any pricing added to the order shall be evaluated to make sure the pricing is fair and reasonable and the pricing is in accordance with FAR 8.404(b).

Certifications and Signatures:

To the best of my knowledge and belief, I hereby certify that the technical information provided in the above justification is accurate and complete.

Judiciary Procurement Program Limited Sources Justification (LSJ)

Addendum

Section 5 – Supporting Rationale:

In the interest of economy and efficiency, the work under this modification would be a logical follow-on to the work already being performed under USCA15BPAC1020, that was awarded off of Axxum’s BPA, USCA15B0007, that was awarded off their GSA Federal Supply Schedule (FSS), GS-35F-0189V. Axxum’s GSA FSS contract is currently active until January 25, 2024.

Axxum’s BPA was not sole sourced nor was it competed under limited source procedures.

Axxum’s BPA and current order were placed in accordance with the applicable FSS ordering procedures. For the following reasons, a logical follow on order per FAR 8.405-6(a)(1)(C) would be justified.

ITSO-SPA provides security testing and assessment services to all of the court units and national program offices (NPOs) in the federal judiciary. Contract labor provides security testing of systems in a pre-production and production environments. The results of these tests identify levels of security risk to systems, program offices, court units, and the Judicary as a whole.

The current vendor providing these services, Axxum, has a unique understanding of national and court developed applications. The current contract USCA15BPAC1020 expires on 08/16/2020.

Before Axxum's current order expires, the JSST branch will be engaged in ongoing pre-production testing of the system that is scheduled to begin on 07/29/2020 and the assessment will not be completed before Axxum's current contract ends.

is one of the most widely used and relied upon applications throughout the Judiciary and is used by most if not all court units in the Federal Judiciary. Being able to seamlessly work with the program office to get new versions of approved and available is critical to the Judiciary's day-to-day operations and the mission of this branch of government. During the period of the logical follow-on work, the NSSA branch will also be in the middle of 3 NPO assessments: .

The AO is currently working on a re-compete for the services currently provided by Axxum but it does not make sense to replace Axxum mid-assessment. A change in vendor during an assessment would require a complete restart of the assessment. Nor does it make sense for a new vendor to be thrown into assessing one of the Judiciary's most critical systems after onboarding.

For and other court unit and NPO systems, delays to the pre-production testing would have a negative effect on the go-live and promised go-live dates as the testing dates are scheduled well in advance due to the number of factors that need to be aligned to allow for such testing. Such delays would result in the system owners having to make a choice between delaying release and incurring schedule and other performance costs or releasing the system into production without knowledge of any vulnerabilities and security risks they need to address. Due to the critical nature of and other systems currently planned for assessment, the Judiciary cannot take the risk of allowing these critical systems to enter production with potential security risks, nor can they push off the assessment process and delay the projects.

Judiciary Procurement Program Limited Sources Justification (LSJ)

Addendum

The logical solution is to mod the current order to allow for the logical follow on work so that Axxum may carry out the current assessments that are planned without any delay, disruption or lapse of services so that and other NPO systems may be properly assessed and tested.

There is also another reason that a logical follow-on mod makes sense. While testing and assessments for the various SPA offices has continued during the current pandemic situation, the volume of requests for testing has dropped and there has been a request to push back testing schedules as various court units and NPOs adjusted to the current situation. Based on current timelines for when things may go back to a more normal level of operations, the SPA branch is anticipating an increase in new testing requests along with an increase in the backlog of work that was pushed off previously. This work is expected over the coming months into the end of the year. SPA typically operates on a 14-business day queue and the flow of work is continuous, though the overall volume of work is expected to increase.

SPA’s concern is similar to the issue with the system issues discussed above, as it is likely the work volume may increase under Axxum's current contract in late July and early August but then if Axxum were to be replaced by a new vendor all of the assessments would need to be restarted once the new vendor onboarded. System owners would again be left with difficult decisions in determining whether to delay production releases or take security risks by foregoing assessments. In addition, some of the systems coming up for testing require these security assessments before the organizations can transfer ownership of systems to other organizations. This would result in additional impacts to various organizations as they would be left with systems that they had not anticipated owning or controlling while entering a new fiscal year.

In the interest of efficiency and economy, not to mention the best interest and security posture of the Judiciary, a logical follow on mod to Axxum’s current order makes the most sense.