A03_-_Redacted_J&A.pdf

Control No: JA-Adel-17-208

Contractor: ICF Incorporated LLC.

Service: Cyber Security Service Provider (CSSP) Support Services

JUSTIFICATION REVIEW DOCUMENT

FAR PART 6 JUSTIFICATION AND APPROVAL FOR OTHER THAN

FULL AND OPEN COMPETITION

Service: Cyber Security Service Provider (CSSP) Research and Development

Authority: 10 U.S.C. 2304(c)(1) as implemented by FAR Part 6.302-1 -- Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements.

Amount: $92,849,227.78

Prepared by:

[REDACTED]

Date: 11/14/2016

Contracting Officer: Mr. Daniel P. Dougherty DSN: [REDACTED]

Contracting Officer Date: 01/20/2017 Email: daniel.p.dougherty14.civ@mail.mil

Technical: [REDACTED]

Requirements: [REDACTED]

Reviews: I have reviewed this justification and find it adequate to support other than full and open competition.

Program Manager: [REDACTED] mailto:daniel.p.dougherty14.civ@mail.mil

Legal Counsel: [REDACTED]

Advocate for Competition:

Principal Assistant Responsible for Contracting: [REDACTED]

Department of Army

FAR Part 6 Justification and Approval for Other than Full and Open Competition

1a. Contracting Activity: Adelphi Contracting Division, Army Contracting Command-Aberdeen Proving Ground (Soldier, Chemical, Research & Test), ACC-APG (SCRT), 2800 Powder Mill Road, Adelphi, Maryland 20783-1138

1b. Requiring Agency: The United States (U.S.) Army Research Laboratory (ARL), Computational & Information Sciences Directorate (CISD), Network Sciences Division (NSD), Network Security Branch (RDRL-CIN-D), 2800 Powder Mill Road, Adelphi, Maryland 20783-1138

2. Description of Action: RDRL-CIN-D requests a cost-reimbursement, Cost Plus Fixed-Fee, single award contract with ICF Incorporated, LLC on the basis of other than full and open competition. The Government projects award for May 2017 and fiscal year (FY) 2016 and FY2017 Army Research, Development, Test and Evaluation (RDT&E) and Other RDT&E funds will be used.

_X_ The Principal Assistant Responsible for Contracting approved an acquisition plan in accordance with FAR 16.301-3(a)(2) and/or DFARS 207.103(d)(i)(B) The required acquisition plan in accordance with FAR 16.301-3(a)(2) and/or

DFARS 207.103(d)(i)(B) is currently awaiting Principal Assistant Responsible for Contracting (PARC) approval.

3. Description of Supplies/Services:

This requirement is a follow-on effort to a competitively awarded contract for the Research and Development (R&D) and technical services needed to support the Cyber Security Service Provider (CSSP) and its evolution in the face of an ever-changing cyber threat environment. This work includes research and technical services supporting mission areas defined in Technology Program Agreements with Research, Development and Engineering Command (RDECOM) Centers in Information Assurance (IA) and Computer Network Operations. ARL collaborates with partners in other CSSPs and the Law Enforcement and Counterintelligence Communities in the areas of technology development and computer security research. This effort strives to improve the State-of-the-Art basic and applied research focused on information generation, collection, assurance, distribution, analysis, and exploitation in Cyber Defense. Cyber Defense R&D is reliant on raw data from real-world networks that contain vital evidence of the threats being perpetrated by hostiles against the network. Analysis of the data and the ability to improve attack detection accuracy and timeliness is intrinsically coupled with the agile development of new tools and techniques to combat adversaries.

This ARL cyber defense effort partners with many organizations, some of which use the ARL CSSP services to provide primary or supplementary network defense services.

Some ARL CSSP partners are research partners using ARL-developed cyber defense tools and test-beds, and others are intelligence and law enforcement organizations that leverage ARL technology and share vital information about current threats. The extensive network view is a key enabler to the cyber research and technology enhancement mission. This effort’s initiative is particularly focused on improving capabilities to combat sophisticated cyber adversaries as well as investigating the next generation of Defensive Cyber Operational Tools, Techniques, and Procedures (TTP), Tactical Network Security, Exploring Prospective Sensor Capabilities, Executing Components of the Information Security Continuous Monitoring (ISCM) strategy, Risk Measurement and Monitoring, Improving Adversary Attribution, and Insider Threat Analysis.

The current DoD Information Environment is a complex layering of multiple networks and information systems that are often subjected to threats from state and non-state cyber actors looking to achieve a variety of political, economic, or military objectives.

Vulnerable data systems present sophisticated cyber adversaries with an opportunity to strike the United States and its interests. In recent times, the use of cyberattacks against Government Agencies has increased exponentially, in a Government Accountability Office (GAO) survey (GAO-16-501) of 24 selected Federal Agencies, the GAO found that the number of reported incidents of cyberattacks against federal information systems increased from 5,503 to 77,183 between Fiscal Years (FY) 2006 and 2015 – an increase of approximately 1,300 percent. Given the sensitive nature of the information that these information systems hold, successful cyberattacks could pose a significant risk to the national security of the United States. As such, it is important that the Government takes steps in order to further mitigate cyber risks. Thus, given the Government’s growing dependency on cyberspace, R&D in cyber defense, which allows for the Department to move towards a more agile and defendable posture, is an integral part of the DoD Cyber Strategy.

RDRL-CIN’s core mission is to develop a fundamental understanding of cyberspace to enhance current cyber defense and operational capabilities through State-of-the-Art basic and applied research focused on information generation, collection, assurance, distribution, analysis, and exploitation. The DoD Cyber Strategy, the Cybersecurity Act of 2012, The Executive Office of the President, Office of Management and Budget Directive; Enhancing the Security of Federal Information and Information Systems, (OMB M-14-03) directive, as well as other Federal mandates, directives, and instructions pertaining to cyber, is aligned with this mission. In 2007, to meet the growing demands of Defensive Cyber Operations (DCO) R&D, ARL began the CSSP Program in order to access and aggregate the quality and quantity of data needed to conduct cyber security defense R&D. DoD Instruction (DoDI) 8530.01 (formerly issued as DoDI O-8530.2), mandates that organizations that are identified as providers of CSSP shall be certified and accredited in accordance with the DoD Evaluation Scoring Metrics (ESM).

Additionally, this instruction mandates that Agencies and contractors unable to provision these cyber defense capabilities themselves, must be aligned to an accredited CSSP. In addition to the ARL, there are 22 other CSSPs within the DoD that perform similar activities. However, unlike the ARL CSSP, these organizations do not include the R&D mission component as part of their standard offering.

Period of Performance: Base Year: May 15 2017 to May 14 2018

Option Year One (1): May 15 2018 to May 14 2019 Option Year Two (2): May 15 2019 to May 14 2020

Total Contract Value: Base: [REDACTED] Option Yr 1: [REDACTED] Option Yr 2: [REDACTED]

Total : $92,849,227.78

The total contract value was derived from historic costs, and were determined by reviewing the costs on existing support agreements and utilizing cost-models that estimate the required “level-of-effort” required to support current and projected CSSP subscribers.

4. Authority Cited: 10 U.S.C. 2304(c)(1), as implemented by FAR 6.302-1, Only one responsible source and no other supplies or services will satisfy agency requirements.

5. Reason for Authority Cited:

The CSSP R&D effort is primarily focused on improving capabilities to combat sophisticated U.S. Government cyber adversaries, investigating next-generation network security, exploring and refining existing and prospective sensor capabilities, and cyber defense sensing and information fusion capabilities to advance operations, development, and training initiatives within cyberspace security operations. The Contractor currently performing in this capacity, ICF Incorporated, LLC. (hereafter “ICF”), is the sole vendor who has the combination of the first-hand institutional knowledge and unique capabilities to operate and advance a previously built toolset and framework in addition to providing R&D support services that further enhances CSSP technologies and analytics due to being the original source of these highly specialized services for this follow-on effort. This effort uniquely derives its strength from the close synergistic bond between the technical support services of ICF coupled with their investigative, research-grounded development to answer complex DoD subscribers’ operational necessities. Based on market research (see section 8), ICF is the only contractor able to perform the required two (2) tasks, R&D and CSSP support services required to execute the ARL cybersecurity research mission that eliminates the critical risks to the Government and the entire subscriber base. These two (2) tasks (the R&D and CSSP support services) are inseparable in our execution of the CSSP support.

Awarding to a contractor other than ICF for this follow-on requirement would result in unacceptable delays in meeting the mission, immediately leading to an unrecoverable interruption of the research support services mission as well as ARL’s accreditation as a CSSP; critically and immediately increasing the exploitability risks to the Department and the CSSP subscribers. This impact would cost inestimable millions in un-resourced and unplanned financial harm to the subscribers across the DoD and Federal agencies based on replacement of the entire infrastructure with commercial products. The degradation of research services support and coverage by ICF would impact operations leading to potentially unprecedented network damage to the most diverse set of Government organizations, hindering operational and warfighting missions, peacetime support, and critical research efforts.

Furthermore, for the CSSP, the loss of operational data would critically impact the current and future R&D missions and development of cutting-edge cybersecurity defense technologies supporting DoD. Since this program is at the forefront of innovation amongst DoD CSSPs, technological advents in cyber within the DoD will be deleteriously affected. No other DoD CSSP is postured or possesses the capability to rapidly adopt or transition any existing, new, or emergent customers within the constraints of the DoD initiatives. A transition to a new contractor other than ICF, would lead to subject matter expert (SME) departures with no overlap training or integration periods due to steep learning curve of the GOTS systems, and would cripple the existent and emergent CSSP requirements and subsequently the cybersecurity R&D efforts on behalf of DoD directives as well as the operational implementation of critical cybersecurity defense technologies identified above.

Based upon the Government’s expertise, historical knowledge stretching 10+ years of this program and understanding of the mission space and current commercial capabilities, it is estimated that it would take approximately 12-18 months or longer to transition a new, unfamiliar contractor with Commercial Off The Shelf (COTS) experiences and basic skills to meet Government-based applications in CSSP analysts and operational skills utilizing the developed Government Off The Shelf (GOTS) analytics and technology; thus, resulting in unacceptable delays in meeting this ongoing, critical mission requirement. Breaking the transition timeline down, when considering the distributed and geographically dispersed nature of the infrastructure, it will take two to three (2-3) months to merely transition control of the infrastructure. It will take another nine to twelve (9-12) months for the new staff to achieve journeyman proficiency with the GOTS infrastructure based on current analyst training schedules with the incumbent, and ultimately upwards of another year to achieve true expertise. In the very near term, the shortfall in the initial period of performance would deleteriously impact ARL’s ability to sustain a high level of cyber defensive services and critically jeopardize our covered Federal Government and Department of DoD agencies. Without direct and uninterrupted contractor support in this arena, the real time cyberattacks would be accomplished without identification, notifications, response and recovery. Systems would be allowed to exist at a lower security posture without notice, increasing the realistic opportunities to compromise them without interception. Looking further out, this delay in capabilities would have a ripple affect across the entire DoD.

Since inception, ARL has leveraged direct operational experience and knowledge of ICF.

Early analysis of COTS technologies identified shortfalls in commercial approaches and their inability to meet Government operations and R&D requirements for cyber defense missions. ICF proposed the creation and development of an innovative framework of attack sensing and warning capabilities that allow for rapid technology research, design and integration, innovative in design and execution then, as well as today. This concept, led by the ICF team, resulted in a unique, in-house developed, GOTS cyber awareness capability, starting with a few early adopters for testing, to coverage for over 500 subscribers today. [REDACTED]. ARL is critically reliant on ICF’s extensive technical expertise in coding, configuring, deploying, and managing this complex and government-proprietary sensing platform to sustain and continue development of this framework. To date no other vendors have accessed or subscribed to this platform other than those working inside ARL or its authorized subscribers other than ICF.

ICF is the sole developer and sustainer of the ARL CSSP GOTS attack sensing and warning solution. They are uniquely qualified to continue uninterrupted support to the GOTS development, management and operation of the 10+ years of integrated frameworks designed for plug-and-play of new tools against emerging threats and enabling defensive analysis. ICF is the only vendor that has the internal insight, institutional knowledge and history to expand development along with access to the mission and operations for the creation of additional tools planned to support the cybersecurity defense research services mission and RDRL-CIN-D research tenants. In addition, ICF is the sole vendor who can provide uninterrupted support to continue modernizing the framework and methodology used to support cyber security defense research and operations.

Furthermore, ARL, with direct support from ICF, is solely responsible in leading a two (2) year, Joint Staff initiative and the Department efforts to develop and test tools, techniques, and procedures (TTPs) coupled with groundbreaking, advanced analytics and technology that enables tactical-level operators to plan, detect, and respond to cyber insider threat activity leveraging GOTS developed technology. This capability was identified as a Presidential Directive (per Presidential Memorandum-National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs, dated 21 Nov 2012) and an instrumental capability to confront national defense information exposure vulnerabilities. Termination or delays in this initiative alone, which was added as new work to the existing contract (W911QX-14-F-0020-P00011), will significantly damage development opportunities to enable [REDACTED] as well as delay any deployment of a strategic capability to identify and respond to a well-known, high-risk, identifiable threat. DoD estimated that this effort could potentially recoup or lead to a cost avoidance estimates in the millions of dollars in current [REDACTED] program development based on the average overall system price of deploying an enterprise-wide COTS product today.

In addition to contractor delays in performance due to the existing steep learning curve in current GOTS and frameworks, support services provided by ICF in R&D are critical to further enhance ARL’s technologies and analytics. ARL continues to operate in a contested battlespace, where the barrier to entry is low and oftentimes unchallenged.

ARL recognizes that mission success is defined by ARL’s CSSP ability to pre-emptively disrupt, degrade, or deny adversaries, both internal and external, unimpeded access to the information and capabilities of the DoD Information Network (DoDIN). ARL must sustain operations and defenses before, during, and after an attack by reducing the attack surface, continually improving defensive cyberspace operations, and effectively commanding and controlling Cyber. Without CSSP services, DoD CSSP customers cannot connect to a DoDIN, thus disrupting their ability to execute their mandated mission. Many of these DoD CSSP subscribers provide direct Warfighter support and any interruption in these CSSP services would lead to adverse effects.

Based on the aforementioned, the only source capable of fulfilling this critical follow-on requirement is ICF due to being the original source of this follow-on effort with the unique qualifications in both the knowledge of the previously built toolset and framework in addition to the required R&D capabilities that further enhance CSSP technologies and analytics. An award to any other source would result in unacceptable delays in fulfilling the effort and risk mission failure.

6. Efforts to Obtain Competition:

On 15 November 2016 a Sources Sought Notice W911QX-17-R-0006 was posted to the FedBizOps (FBO) website to gain knowledge of interest, capabilities, and qualifications of various members of the industry. The Sources Sought posting announced an Industry Day which was subsequently held at the Adelphi Laboratory Center on 13 December 2016. Interested vendors were provided the opportunity to review the contract requirement presentation led by Project Manager (PM), [REDACTED]. Thereafter, interested sources were offered a one-on-one session to brief the acquisition team on their firm’s capabilities against the requirement. These sessions were offered on a first come-first serve basis and were limited to fifteen (15) slots. However, after the Government presentation was complete, only ten (10) vendors decided to move forward with their on-on-one session. A technical evaluation of the one-on-one sessions determined the ten (10) vendors were not able to fulfill the requirement based on lack of CSSP capabilities and/or R&D cyber defense aptitude. Furthermore, all attendees (and non-attendees) were given additional time after the presentation slides were published to FBO, to tailor their capabilities and past experience based on information learned from the presentation. In response, 39 capability statements were received and reviewed. The review determined that all 38 responses, other than ICF were incapable of meeting the requirement. The sources sought announcement included “defensive cyber operations knowledge...” Most of the offerings submitted for evaluation provided no identifiable or specific capability to the requirement of operating or managing a holistic enterprise-level CSSPs or defensive cyber operations that offered an opportunity for evaluation against the request. It was unrealistic to extrapolate their capabilities to an acceptable understanding of this infrastructure and systems at a global level in support of the mission. Many offerings included only small subsets of the comprehensive CSSP program, or were indicative of niche-market support below this echelon. Several opportunities for R&D capabilities were presented, however, their context was to elicit support for integrating or expanding their capability, but not of performance within our

CSSP.

Efforts to obtain subcontracting competition will be achieved by a small business subcontracting plan which will require ICF to discuss their proposal’s small business participation in terms of total contract dollars (both prime contractor and subcontracting dollars). The Small Business subcontracting plan will be evaluated by the Small Business Specialist (SBS) and the contracting officer (KO) prior to award to ensure the Prime Contractor is making an adequate effort to identify and award subcontracting efforts to Small Business firms. The small business subcontracting plan will be reviewed by the KO, with assistance from the Small Business Office. The final acceptable small business subcontracting plan will be incorporated into the award. The KO, along with assistance from the SBS, will monitor the awardee’s progress towards meeting their small business subcontracting goals as reflected in their accepted small business subcontracting plan that was incorporated into their award. In accordance with NDAA 1653(a)(3), subcontracting performance will be monitored during contract performance.

7. Actions to Increase Competition:

In efforts to increase competition, ARL has taken initiatives to transition the ISCM framework towards a DoD standard. The ISCM is a recent Government-owned capability that was developed by ICF through a research concept and piloted in recent months and is estimated to take between eighteen months to two (2) years for DoD approval. This ISCM standard that only ICF has institutional knowledge, would allow other agencies and industry to receive this framework which will provide tools, tactics and procedures. The dissemination of this framework will greatly reduce and ultimately eliminate the current 12- 18 month learning curve down to two (2) months to meet Government-based applications in CSSP analysts and operational skills utilizing the developed GOTS analytics and technology. With these tools from the ISCM becoming readily available to industry within the next two years, it will allow for the subsequent follow-on to this sole source action to become a competitive procurement with an estimated award date of 16 May 2020. ARL has made a practice of researching and surveying the industry for capabilities in technical areas of interest to the Army in the area of cyber warfare and will once again pursue industry to ascertain their updated capabilities against this framework as it is transitioned.

8. Market Research:

Market research and evaluation was conducted between March 2016 and December 2016 by [REDACTED] an Electronics Technician for the Network Sciences Division’s (NSD) Network Security Branch (RDRL-CIN-D) within the ARL’s Computational and Information Sciences Directorate (CISD) and designated Contracting Officer’s Representative (COR) for Contract W911QX-14-F- 0020, with over thirty years of experience.

The following avenues of market research were utilized: discussing requirements with SMEs, reviewing previously conducted market research for similar and complimentary cyber support services, discussing with other CSSPs, attending conference, holding an Industry Day at the ARL’s Adelphi Laboratory Center (ALC), and holding one-on-one discussions with interested Contractors.

[REDACTED] consulted the following SMEs: [REDACTED], Acting Branch Chief of the Network Security Branch (RDRL-CIN-D) within CISD’s NSD; [REDACTED], Branch Chief of the Tactical Network Assurance Branch (RDRL-CIN-T) within CISD’s NSD;

[REDACTED] the U.S. ARL Information Assurance Manager; and by [REDACTED], Branch Chief of RDRL-CIN-S, Director of the U.S. ARL CSSP, Functional Manager of the High Performance Computing (HPC) CSSP, and ARL CISD Security Control Assessor Validator (SCA-V). As the director of the ARL CSSP, [REDACTED] has kept abreast of the latest capabilities and capacities of Army and DoD CSSPs due to the collaborative nature of cyber defense. Some of these CSSPs include the Navy Cyber Defense Operations Command (NCDOC), DISA CSSP, and the U.S. Army Cyber Command (ARCYBER) CSSP. In addition, [REDACTED] has also attended several DoD CSSP Working Groups, in which CSSP operations, business models, strategies, standardization and ISCM are discussed by all DoD CSSP organizations.

In accordance with Defense Federal Acquisition Regulation Supplement (DFARS) 205.205-71, DFARS 206.302-1(d), and DFARS Procedures, Guidance and Information (PGI) 206.302-1(d), a Sources Sought Synopsis was posted to Federal Business Opportunities on 14 November 2016. As part of the Sources Sought Synopsis, an Industry Day was held on 13 December 2016 at the ALC to gauge Industry interest and assess technical capabilities. At the Industry Day, presentation slides describing the scope of RDRL-CIN’s requirements were presented by [REDACTED]. In addition, ten

(10) companies that responded to the Sources Sought Synopsis, were afforded the opportunity to have 20 minute “one-on-one” meetings to discuss capabilities with representatives from RDRL-CIN, ARL’s Chief Counsel’s Office, Adelphi Contracting Division of ACC-APG, and an ARL Small Business Office. Furthermore, Capability Briefings and Questions from all interested Contractors were due by 16 December 2016.

A total of 73 contractors expressed interest in regards to the Industry Day outlined in the sources sought synopsis and 39 contractors ultimately submitted capability briefings.

The Market Research Capability Statements and Market Research One-on-One Sessions attachments to the Market Research document discusses all 39 capabilities statements received and the one-on-one sessions in detail. Due to the large interest received, the market research for the purpose of this justification addresses the four (4) most potential sources that submitted offerings that were most comprehensive in addressing the CSSP requirements but still fail to meet the requirement. Summary follows:

1. [REDACTED]: Provided information on their background and capabilities in research and engineering heavily reliant on cited use of [REDACTED] developed COTS solutions as solution sets. These technologies are not a core piece of the ARL CSSP and would require the purchase, replacement, and integration of technology around the world just to cover one

(1) cyber defense aspect of the CSSP. Proposal cites extremely limited information on the offering (one column) of operational experience in supporting global CSSP operations. The approach of the COTS integration from the current GOTS would lead to unacceptable delays [REDACTED] to overhaul the current infrastructure.

2. [REDACTED].: Provided current information on their background and experiences in hardware-based, embedded and wireless technologies R&D. Historical offerings covered a range of support areas, including specifically reverse engineering, tool development, tactical support, analytical services, and Incident response and security operation center support. Proposal cites limited information or offering of operational experience in global CSSP operations being currently conducted or supported.

3. [REDACTED]: Provided information on their background and they have some experience and product line in CSSP services, with several Independent Research and Development programs that may enhance operations at some future integration time.

These technologies are not a core capability of the ARL CSSP or DoD subscribers and would require the company to adapt their capabilities as well as require ARL to purchase, replace, or integrate of over 500 sensors around the world and a big data platform with an extended integration timeline just to cover two cyber defense operations. The approach of integrating to [REDACTED] cyber sensing capabilities from the current GOTS [REDACTED] to overhaul the current infrastructure.

4. [REDACTED]: Provided information on their background and capabilities in advanced analytics and designing and delivering threat analysis capabilities; both heavily reliant on their COTS solution. This technology is not a core piece of the ARL CSSP and would require the purchase, replacement, and integration of over 500 sensors around the world just to cover one DCO aspect of the CSSP. Offering provides experiences with Federal and Government efforts, but limited DoD exposure except for a very-defined IT architecture and Systems Design, Implementation, and Support contract capability. Proposal cites some experience in supporting government CSSP operations in the Federal government, but not as a CSSP provider. The approach of the COTS integration from the current GOTS [REDACTED] to overhaul the current infrastructure.

In conclusion, market research of the primary potential sources, the greatest risk and challenge remains that no source other than ICF, is postured, nor expressed capability, experience or interest, to onboard and manage ARL’s GOTS infrastructure and research services support, or offered an qualifiable understanding of ARL’s GOTS Attack Sensing & Warning (AS&W) capabilities or emergent research and development capabilities.

These four (4) major companies have cited their experience in deploying their capabilities, with their products, to understandably support their customers which are extremely reliant on their COTS infrastructure and devices as the foundation for that support to CSSP operation. Their capabilities, like ARL’s, are purposefully built to support their operations and their customers efficiently, however this requirement is to develop and model a framework solution that is not reliant on one single capability. The approach to acquire and deploy COTS products today is operationally and fiscally unacceptable, due to cited requirements that would require us to change our global fabric of our CSSP infrastructure to adopt to meet one CSSP capability. All lacked sufficient details and a comprehensive understanding of holistic CSSP support mission areas inclusive of all activities needed to manage, continue development, operate and defend in this global environment. The offered approaches are technically impossible to achieve in the short timespan needed to maintain operational capability and coverage on day one or within a proposed transition timeline. Reliance on commercial capabilities alone in this space prevents rapid adaption and redesign options necessary to defend this environment. None of the offerings in this area proposed solutions that afford ARL the opportunity, or provided a use-case, to drastically change our capabilities or our operating environment.

After extensive market research and evaluation, it was determined that ICF remains the only capable source with the requisite knowledge and experience that can meet the government’s requirements.

9. Interested Sources:

On 17 January 2017, after the completion of the review of the respondents from the Industry Day, Synopsis W911QX-17-R-0006 was posted to FBO to notify the public of the Government’s intent to sole source as well as to notify any potential sources who believe to be capable of meeting the Government’s requirements. In response to the synopsis, four (4) companies expressed interest, [REDACTED] Technical review of responses provided are as follows:

[REDACTED]- The seven (7) page offering submitted for evaluation provided information on their background with niche-market data research and challenges of data analytics, log ingesting, and data tagging as key efforts. The offeror identified specific support to [REDACTED] and other project that are integrating technological solutions for research. While the response to the sole source announcement includes "team has significant defensive cyber operations knowledge...” the offering submitted for evaluation provided no identifiable or specific capability to the requirement of operating or managing enterprise-level CSSPs or defensive cyber operations that offered an opportunity for evaluation against the request. The government cannot speculate on an offerors capabilities or intent. The offeror cites access to and experience with ARL's internal systems, but upon verification it was confirmed this access is limited to individuals with user-level understanding and use of these systems, and is unrealistic to extrapolate this to SME understanding or integration of our infrastructure and systems at a global level in support of the mission. [REDACTED]

[REDACTED]- The twenty-one (21) page offering submitted for evaluation provided information on their background, with specific information to provide accreditation and certification support as well as compliance and risk management, support to designing resilience into systems, and expertise in IA/Cyber Compliance. ARL acknowledges these aspects are part of a holistic cyber defense strategy, but operationally this is only one (1) metric of performance for a CSSP. The specificity in a single area of CSSP operations (rather than a whole) would estimate that extensive training and transition would be necessary and lead to an unacceptable delay [REDACTED] to fully transition this Contractor to meet the current requirement.

[REDACTED]- This offeror did not provide a response in the initial opportunity to respond to the government. The two (2) page response to the intent to sole source notification lacks specific technical or management capabilities that could be evaluated against a global enterprise CSSP approach as requested. Operating at a command or installation level is crucial to the success of any organization, but that experience doesn't extrapolate to the size, complexity and scale of a global CSSP and would require an extensive transition to scale up to an acceptable operating capacity and lead to an unacceptable delay [REDACTED].

[REDACTED] - This offeror did not provide a response as requested in the initial opportunity to respond to the government. This offeror provided historical information on developed capabilities and opportunities that span the breadth of CSSP support for a myriad of customers with a myriad of past performance indicators. The offeror cites support capabilities to organizations subordinate to the level of requested support required for ARL operations. The offeror cites legacy support capabilities, i.e.

"Conducted negotiations and service integration with a Tier II Computer Network Defense Service Provider (CNDSP), Army Research Lab Center for Intrusion Monitoring and Prevention (ARL CIMP)" – a term of reference unused for nearly a decade. The reference potentially indicates reliance on an historical approach and technology that was difficult to evaluate against when compared to those currently in use by ARL. The offeror cites access to and experience with ARL's internal systems, but upon verification this access is limited to individuals with user-level understanding and use of these systems, and is unrealistic to extrapolate this to SME understanding or integration of our infrastructure and systems at a global level in support of the mission.

This offeror has provided support services to IA/CND efforts and niche components of CSSP operations inside other TIER II or TIER III providers within DoD, or other subordinate agency or organization level, but no clear distinguished holistic or overarching capability presented making an assessment of the offering difficult in meeting the requirements of operating an enterprise-level, global CSSP or defensive cyber operations as a sole or principal offeror. [REDACTED]

10. Other Facts:

a. Procurement History: Contract:

W911QX-14-F-0020 Contractor:

ICF International, Inc. Award Date: 14 May 2014

Competitive Status: Full and Open Competition Authority: FAR 16.5 – Indefinite-Delivery Contracts

In W911QX-14-F-0020, ARL acquired CSSP Services, formerly known as Computer Network Defense Service Provider (CNDSP), ARL Agent of Certification Authority (ACA), ARL IAM Office and Cyber Network Science Research Support Services through the use of the National Institutes of Health Technology Acquisition and Assessment Center, Chief Information Officer Solutions and Partners 3 Innovations (NITAAC CIO-SP3) suite of contracts held by the National Institutes of Health (NIH).

All fifty-four (54) NITAAC CIO-SP3 contract holders were given fair opportunity to be considered for the original order in accordance with FAR 16.505 and the 2008 Memorandum of Agreement (MoA) between the DoD and NIH, which establishes the procedures for utilizing NIH Government-Wide Acquisition Contracts (GWACs) by the DoD. A Directed Task Order was issued on 14 May 2014 to ICF International, Inc.

NITAAC is designated by the OMB to administer GWACs for information technology (IT).

In particular, the CIO-SP3 IDIQ GWAC provides custom commercial and noncommercial IT solutions and services in the following task areas: IT services for Biomedical Research, Health Studies, and Healthcare; Chief Information Officer Support;

Imaging; Outsourcing; IT Operations and Maintenance; Integration Services; Critical Infrastructure Protection and Information Assurance; Digital Government; Enterprise Resource Planning; and Software Development.

Additionally, a MoA between the DoD and NIH pertaining to the use of NIH GWACs has been in effect since 15 April 2008; the MoA establishes procedures for the use of NIH’s GWACs by DoD agencies and the framework to improve efficiencies by leverage resources and capabilities within each agency.

A New Work Modification was issued as MOD P00011 to address a new research thrust that arose as a result of the research conducted under Contract W911QX-14-F-0020.

The research centered on large amounts of disparate data from multiple sources that can be normalized and displayed together to form a risk-based cyber situational awareness picture. After developing a unique capability of being able to create a Comprehensive Cyber Situational Awareness Picture, ARL needed to develop Tools, Techniques, and Procedures (TTPs) in order to share this unique capability with other CSSPs across the DoD which will ultimately help bridge the gap between the R&D elements of Cyber Security and their Operational counterparts. Under this modification, the Contractor developed and refined TTPs in the following thrusts: (1) Computer Network Defense; (2) Risk Management Framework; (3) Network Operations; and (4) Information Resource Management in accordance with Department of Defense Instruction 8530.01, Cybersecurity Activities Support to DoD Information Network Operations, 7 Mar 2016.

Contract: W911QX-12-F-0052

Contractor: ICF International, Inc.

Award Date: 14 September 2012

Authority: FAR 16.505(b)(2)(i)(C)

MOD P00010 was issued to extend the contract PoP by six (6) months from 15 September 2013 to 14 March 2014, with two (2) one (1) month options from 15 March 2014 to 14 April 2014, and from 15 April 2014 to 14 May 2014, respectively. This extension was required due to a change in the Contracting Officer's Representative (COR), furloughs, and changes from the initially planned type of contract and contract security requirements. An Exception to Fair Opportunity was approved to extend this contract for six (6) months with two (2) additional one (1) month options under the authority of FAR 16.505(b)(2)(i)(C) to allow time to post a solicitation and complete the proposal evaluation and award process.

Contract: W911QX-07-F-0023 Contractor: Jacob and Sundstrom Award Date: 21 December 2006

Authority: FAR 16.5 – Indefinite-Delivery Contracts

W911QX-07-F-0023 was awarded to Jacob and Sundstrom (J&S) on 21 December 2006 as a Time & Materials (T&M) contract under General Services Administration (GSA) contract number GS-35F-4997G in the amount of $24,074,068.20. The PoP originally began on 21 December 2006 extending through 20 December 2011.

MOD P00043 - On 30 December 2011, pursuant to FAR 52.243-3 Changes Clause, MOD P00043 was issued to change the contract type of all CLINs new CLINs beginning with CLIN 0017 from T&M to Firm Fixed Price - Level of Effort (FFP-LOE) to be compliant with procedures set forth under 16.601(c) in the Army Contracting Command - Aberdeen Proving Grounds (CC SOP 715-1). MOD P00043 also extended the PoP for Seven (7) months, consisting of a five (5) month base period with two (2) one (1) month options which extended the PoP from 31 December 2011 until 31 July 2012, and also increased the ceiling of the contract by $9,166,599.00, from $43,286,806.64 to $52,453,405.64. This extension was to allow time to complete a procurement package for a competitive follow-on contract.

MOD P00053 was processed on 28 August 2012 to extend the PoP for two (2) weeks from 31 August 2012 to 14 September 2012 under the authority of FAR 16.505(b)(2)(i)(C) which provides for exceptions to fair opportunity when making a delivery order (or adding new work to an existing one) in the interest of economy and efficiency for a logical follow on effort.

11. Technical Certification: I certify that the supporting data under my cognizance which are included in the justification are accurate and complete to the best of my knowledge and belief.

Signer’s Title: Branch Chief

12. Requirements Certification: I certify that the supporting data under my cognizance which are included in the justification are accurate and complete to the best of my knowledge and belief.

Signer’s Title: Branch Chief

13. Fair and Reasonable Cost Determination: I hereby determine that the anticipated cost or price to the Government for this contract action will be fair and reasonable.

This determination will be made using the following:

_X_ Cost analysis _X_ Price analysis Should cost

_X_ IGCE

_X_ Audit: Indirect Rate Review Other:

As a part of this basis, certified cost or pricing data:

_X_ Will be required.

Will not be required and the following exception applies (FAR 15.403):

Prices that will be agreed upon are based on adequate price competition.

Prices that will be agreed upon are based on prices set by law or regulation.

A commercial item is being acquired.

A waiver has been granted by the head of the contracting activity (HCA) in accordance with DFARS PGI 215.403-1.

The contract action is a modification to a contract or subcontract for commercial item(s).

The estimated cost of the contract action is less than the threshold for certified cost or pricing data.

14. Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Approval

Based on the foregoing justification, I hereby approve the procurement of CSSP R&D Services in the amount of $92,849,227.78 on an other than full and open competition basis pursuant to the authority of 10 U.S.C.2304(c)(1) subject to availability of funds, and provided that the services or supplies herein described have otherwise been authorized for acquisition.

Date: ________________ _________________________

Principal Assistant Responsible for Contracting