GW SimplexGrinnell IAVA/STIG

The Defense Information Systems Agency/Defense Information Technology Contracting Organization intends to negotiate a sole source contract with John Control Fire Protection LP, DBA SimplexGrinell LP. A sole source Justification & Approval document is being coordinated and, upon approval, a copy of it will be posted here on beta.SAM.gov to comply with the public display requirements of FAR 6.305.

The proposed contract action is a requirement to ensure the EMSS Gateway Security system is Security Technical Implementation Guides (STIG), Information Assurance Vulnerability Alert (IAVA), and CVE compliant. The Gateway security system, access control and CCTV, needs to be STIG, IAVA and CVE compliant as required by DoD Regulations and Federal law to ensure the system is aligned with a configuration standard consisting of cybersecurity requirements for the information system. The use of STIGs, IAVAs and CVEs enables a methodology for securing protocols within networks, servers, computers, and logical designs to enhance overall security. These, when implemented, enhance security for software, hardware, physical and logical architectures to further reduce vulnerabilities. The systems must be STIG and IAVA compliant in order to maintain DISA accreditation. All scan findings and CVEs are to be fixed or mitigated. All patches and configuration changes must be tested prior to being installed on a Government production system. The period of performance is for a 12-month base period and four potential 12-month option periods.

At this time, the incumbent contractor Johnson Controls Fire Protection (JCI), doing business as (DBA) SimplexGrinnell, is the only source capable of providing all necessary services. SimplexGrinnell installed the original system which contains proprietary and specialized software. SimplexGrinnell technicians are factory trained and certified on the system's software and are familiar with and have access to proprietary configuration information. The technicians have been properly trained on the software in order to make the correct configuration changes. SimplexGrinnell is the sole developer and maintainer of the application software used in the EMSS Security System (CCURE Access Control and Victor Video Management Systems).

The statutory authority for other than full and open competition is 10 USC 2304 (c) (1), as implemented by FAR 6.302-1(a)(2)(iii), only one responsible source and no other supplies or services will satisfy agency requirements. Companies who believe they can provide this service must indicate their interest in writing within 7 days of this notification and include a detailed capability statement. No reimbursement for any cost connected with providing capability information will be provided. All responsible sources will be considered in evaluating the determination to issue a sole-source contract. Quotations or proposals received in response to this notice cannot be accepted since this synopsis cannot be considered a request for quote or a request for proposal. A solicitation will NOT be posted to beta.SAM.gov due to the sole source nature of the requirement.

The North American Classification System (NAICS) code 561621 will be used for determining company size status.

CONTRACT/PROGRAM BACKGROUND:

Contract Number: HC1019-16-C-2006

Contract Type: Firm Fixed Price

Incumbent and their size and CAGE: SimplexGrinnell LP, Large Business, 49V73

Method of previous acquisition: Sole Source

Period of performance: 26Sep2016 - 25Sep2021

SPECIAL REQUIREMENTS: SCI Clearance.

Points of Contact: jon.d.higgins2.civ@mail.mil