JEFO - SF 1014 Approved 120519.pdf

DEPARTMENT OF THE TREASURY

SF 1014 - JUSTIFICATION FOR AN EXCEPTION

TO FAIR OPPORTUNITY

Treasury Standard Form – 1014 (Rev 5/18)

Prescribed by Treasury: DTAP 1016.505

Tracking No.

1. Identification of the requiring activity and the contracting activity:

Internal Revenue Service – contracting activity is Procurement, OITA, IT Servs & Prime, Modernization Acquisition

2.a Nature and/or description of the action being approved:

The purpose of this justification for exception to fair opportunity is to obtain approval to award a new firm-fixed price contract with Deloitte LLP for the purchase of services described in section 3.a below. The need date for these services is February 1, 2020. The period of performance will be for one-year Base Period, February 1, 2020 – January 31, 2021, and one-year Option Period, February 1, 2021 – January 31, 2022.

2.b Name of the vendor. Deloitte Consulting LLP 2.c Requisition No.: 5000083626 2.d Bridge contract: ☐ X Yes ☐ No 2.e Brand name: ☐ Yes X No 3.a A description of the supplies or services required to meet the agency’s needs:

The objective for this contract is for the Contractor to build on and expand the scope of the current Filing Season Risk Assessment and Filing Season Readiness efforts by creating an enterprise-wide interconnected view of organizational risk. Cybersecurity plans to expand this methodology to address risks across the enterprise and to improve the IRS’ security posture as it modernizes its infrastructure and applications. The expansion involves aggregating, normalizing, enriching, and correlating data across multiple sources to create a decision support environment facilitating a rich user experience for executives and operators to analyze risks tailored to their evolving relationships and context. This tool drives the ability to focus on the security of IRS’s most important filing season infrastructure applications, and therefore the collection of tax dollars, by providing multi-tiered data sets allowing for the discussion and remediation of security vulnerabilities. This process makes it harder for an individual attempting to gain illegal access to taxpayer data by ensuring our infrastructure is not vulnerable and efforts to harden configurations are addressed timely.

3.b Includes IT: x Yes ☐ No PSC: D310 NAICS: 541519 3.c IGCE/Estimated dollar value:

The estimated dollar value of this contract action is a total of $3,999,852.00.

$1,999,926.00 for the Base Year and $1,999,926.00 for the Option Year.

4.a Identification of the exception to fair opportunity being used:

☐ FAR 16.505(b)(2)(i)(A) – The agency need for the supplies or services is so urgent that providing a fair opportunity would result in unacceptable delays.

☐ FAR 16.505(b)(2)(i)(B) – Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

X FAR 16.505(b)(2)(i)(C) – The order must be issued on a sole-source basis in the interest of economy and efficiency because it is a logical follow-on to an order already issued under the contract, provided that all awardees were given a fair opportunity to be considered for the original order.

☐ FAR 16.505(b)(2)(i)(D) – It is necessary to place an order to satisfy a minimum guarantee.

☐ FAR 16.505(b)(2)(i)(E) – For orders exceeding the simplified acquisition threshold, a statute expressly authorizes or requires that the purchase be made from a specified source.

☐ FAR 16.505(a)(4) – The requirement is for an item peculiar to one manufacturer.

4.b Supporting rationale:

Since early 2015, the Cybersecurity Organization and the Deloitte Contracting Team have been collecting, analyzing and developing interdependency data sets to build a complicated, holistic picture of Mission Essential Functions, links, databases, application mapping to business process requirements intertwined with Cybersecurity security vulnerabilities against an everchanging infrastructure support system. These analytical tools take into consideration a multitude of interdependencies in order to drive remediation of security vulnerabilities where Personally Identifiable Information (PII) exists or supports a Federal Directive for Business Continuity and the supporting Treasury Department designated Mission Essential Functions (Process Remittance, Process Returns, Process Refunds). This allows us to provide an overarching IRS Filing Season Cybersecurity Health assessment as it pertains to open vulnerability findings and the impact to Filing Season. Note that each year, there is additional data sets and changes that occur to the enormous infrastructure and get combined with the current compiled datasets to allow for analysis, normalization and forecasting to aid in weekly reporting of security risk management across the enterprise. This data collection effort and the databases that correlate the data points, took over four years to compile where year one began with approximately 60 assets, and in 2019 we are at 210 assets that support the Filing Season where supporting system input and output can be used to provide not only application health but the associated systems that must work together to support the Business Operating Organization in their business processes. This merging of information (Mission Essential Functions, BOD processes, Critical Infrastructure, etc.) is what allows us to focus on IRS’s most important issues coupled with the criticality of the vulnerability. The upstreaming application impact/feeder and downstream application/what is fed by each of these critical assets provides a holistic view of the associated risk. Filing Season and the remediation process occurs year around and reporting takes place on a weekly basis throughout the year.

To perform this analysis, the proposed contractor developed a series of databases to aggregate, normalize, enrich, and correlate data across multiple sources. These databases and IRS data are currently housed on the contractor’s equipment at their site. This existing infrastructure needs to be migrated into the IRS, including the use case catalog, tables and queries, and upgraded from multiple databases to a single SQL server database. The analysis must continue while the SQL server database is developed. The proposed contractor is the only entity that has the historical data and an existing workable process to keep the project moving forward. It is this bridging of data sets that is so critical to our ability to understand the underlying cause and effect. This logical follow-on request is needed to continue this work, as starting with a new contractor would put this process and risk management in arears. Additionally, the tracking of and coupling of the enormous, ever changing infrastructure environment, along with the IP mapping and defined removal of assets defined as Filing Season requires past historical data to ensure accuracy and actionable, defined, achievable remediation.

We are attempting to ensure that Filing Season applications are as secure as possible protecting taxpayer data, which is why a contract with Deloitte, who has these tools at their site, is the logical follow-on until we can build them internally in the next couple of years. A new contractor at this time would cause a work stoppage of data analysis until they developed their own database, analysis and reporting processes.

The work began under the competitively awarded ITIL BPA (Contract Number TIRNO-15-Z- 00005 - GSA Schedule Contract Number GS-35F-0617Y – Vendor: Deloitte Consulting LLP).

The work continued under the CADE2 Long Term Integration Support (LTIS) contract (Contract Number TIRNO-11-D-00016-Task Order 2032H5-18-F-00163 – awarded under Fair Opportunity competition from IRS’s TIPPS-4 multiple award contract):

With each task order/option year, the scope of the contract increased. The number of applications analyzed increased from 60 in 2015 to 210 in 2019, and from Filing Season Readiness applications to include Financial Systems, Tax Reform (continued as Filing Season applications starting in late FY2019) and other non-FISMA applications. Data sources also increased to capture as much data as available on the applications.

The vendor developed the basic Access databases and interconnected queries, and the initial data normalization procedures during the first 6 months of the initial contract to produce the original reports showing the analysis. Over the years, the vendor has improved the processes and developed algorithms and use cases to increase the functionality of the technology. All the data (currently 750 GB) and technology currently reside on the vendor’s servers.

A two-year contract is needed due to our budget being severely reduced in Fiscal Year 2020, which will result in extending the Project Schedule/Plan for transferring the IRS data and building the new SQL database on an IRS server while maintaining the required analysis and reporting of Filing Season Readiness and Risk Assessment. As a result of the IT wide budget reduction there will be an impact to the IRS IT partners whom we rely upon to develop the plan, resources and infrastructure to move the data internally.

In the interest of economy and efficiency:

• Deloitte has developed the tools to collect and analyze very complex data. The tools are housed on their equipment (infrastructure)

• Development of the tools to the basic level took 6 months and to the current, advanced level about 3 years. A new vendor would require years to meet the level of service we currently receive.

5. A determination that the anticipated cost to the Government will be fair and reasonable:

The Contracting Officer will determine that the prices are “fair and reasonable” based on the price analysis performed of similar services from vendors on the GSA IT Schedule 70 and through use of the GSA Calculator research tool.

6.a Any other facts supporting this justification:

It has taken about three years to develop algorithms and use cases to aggregate data and build interdependent data sets, gather infrastructure application mapping and cross-reference upstream and downstream impacts, which have resulted in the tools developed by Deloitte to support vulnerability management for the Filing Season.

As a result, a new vendor would need years to get to the point where we are now. We are attempting to ensure that Filing Season applications are as secure as possible protecting taxpayer data, which is why a contract with Deloitte, who has these tools at their site, is the logical follow-on until we can build them internally in the next couple of years.

6.b Attachments: X Yes ☐ No

7. A statement of the actions, if any, the Requiring Activity and Contracting Activity may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies and services is made:

When this contract expires in approximately two years, the Government expects to have all IRS data housed at an IRS site, along with defined database correlation using IRS software.

The SQL database and associated reporting abilities will be at a level that either the IRS or a new contractor can take over the responsibilities with an acceptable knowledge transfer period.

8. Certifications and Approvals:

8.a Program Office Certification (Requiring Activity). I hereby certify that any supporting information and data provided (e.g., the Government’s minimum needs or requirements, or other rationale for the limited sources) and which form the basis for this justification for an exception to fair opportunity, are accurate and complete to the best of my knowledge and belief.

Name: Mary Woods Date: 11/19/2019

Signature:

8.b Contracting Officer Certification and Approval. I certify this justification for an exception to fair opportunity is accurate and complete to the best of my knowledge and belief.

Therefore, unless additional approvals are required as prescribed below, as the authorized contracting officer for this acquisition, I hereby approve the processing of this requirement based on the authority specified in 4.a above.

Name: Shontae Harley Date: 11/26/2019

Signature:

6. Additional Reviews and Approvals (As applicable):

9.a Bureau Chief Information Officer or Authorized Designee (for IT requirements that are over $5 million, but not exceeding $68 million) (Contracting Activity). I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief, and representative of the Government’s need. Therefore, I hereby consent to the approval of this justification. (Note: The Bureau CIO may delegate their authority for proposed contracts over $5 million, but not exceeding $13.5 million to the Associate Bureau CIO(s).)

Name: Date:

Signature:

Mary J. Woods

9.b Advocate for Competition (if over $700,000, but not exceeding $13.5 million) (Contracting Activity). I have reviewed this justification for an exception to fair opportunity and find it to be accurate and complete to the best of my knowledge and belief. Therefore, unless additional approvals are required as prescribed below, as the ordering activity’s Advocate for competition, I hereby approve this justification based on the authority specified in 4.a above.

Name: Date:

Signature:

9.c Head of the Procuring Activity or Authorized Designee (if over $13.5 million, but not exceeding $68 million) (Contracting Activity). I have reviewed this justification for an exception to fair opportunity and find it to be accurate and complete to the best of my knowledge and belief. Therefore, unless additional approvals are required as prescribed below, as the head of the procuring activity or authorized designee, I hereby approve this justification based on the authority specified in 4.a above.

Name: Date:

Signature:

9.d Treasury Chief Information Officer (for IT requirements that are over $68 million). I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief, and representative of the Government’s need. Therefore, I hereby consent to the approval of this justification.

Name: Date:

Signature:

9.e Senior Procurement Executive (if over $68 million) (Contracting Activity). I have reviewed this justification for an exception to fair opportunity and find it to be accurate and complete to the best of my knowledge and belief. Therefore, as the senior procurement executive, I hereby approve this justification based on the authority specified in 4.a above.

Name: Date:

Signature:

INSTRUCTIONS FOR

SF-1014- JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

I. General Instructions. Each Justification for an Exception to Fair Opportunity shall contain sufficient information and data to justify the proposed action, thereby be able to stand on its own.

This type of detail is critical in order to enable a reviewer and/or approver to clearly understand the requirement and the rationale for supporting the justification. Simply copying and pasting information from a vendor’s website or marketing literature fails to support the use of such justification. Market research performed by the Requiring Activity and Contracting Activity should be used to support this document.

Given the majority of the information and data necessary to support this type of action resides with the Requiring Activity, they are the primary party responsible for completing this form.

However, the Requiring Activity shall seek assistance and input from the Contracting Activity/Contracting Officer (preferably in advance of submission of the procurement request).

It is also recommended the justification is not signed by the Requiring Activity until such time the Contracting Officer has had an opportunity to review, make necessary revisions and to include other necessary information or data to support the justification.

For Brand-name acquisitions keep in mind the justification is to cover only the portion of the acquisition which is brand-name and that that the document approval requirements only apply to that portion. However, it does not mean that details regarding the overarching requirement (i.e.

in the instance where the brand name is only a portion of an overall requirement) aren’t to be included in the document.

In the event of conflict between this form and applicable regulatory coverage (i.e. FAR and DTAR), the more stringent requirement shall be followed.

If the requirement involves classified or sensitive information ensure the proper steps are taken to protect the information (e.g. labeling and marking).

Prior to distribution for signature: (i) retain only those signature blocks applicable to the dollar value of the items covered by this justification, (ii) delete all green text (which are examples), and (iii) consider converting the document to .pdf to support electronic signature and ease of retention.

The fields within this form are fluid and will change based upon input, therefore individuals completing this form need to be mindful of formatting prior to converting the document to pdf and submitting it for signature.

II. Field specific instructions.

1. Identification of the requiring activity and the contracting activity. Provide the name of the name of the actual requiring activity (e.g. Treasury’s Washington, DC Office – Central IT Division). Provide the name of the contracting agency and the name of the actual contracting activity (e.g. BFS’ West Virginia Office – Contracting Division for IT).

2. Nature and/or description of the action being approved. Describe the type of action being issued (e.g. new award, contract modification or brand name). Identify the contemplated contract type (e.g. firm fixed price). If known, include period of performance. Also, when processing a class justification, include the effective period the justification will be in effect.

If modifying a contract or order thereby requiring a justification or a modification to the initial justification then ensure to include the contract no., task/delivery order number (if applicable), proposed contract modification number, nature of why the modification is required and, if applicable, a copy of the initial justification.

If brand name, ensure to mention this justification is covering only the portion of the acquisition which is brand-name.

Section 2.b Name of vendor. If applicable, insert the name of proposed vendor. If not applicable, enter “Not applicable”.

Section 2.c Requisition Number. If known, include the requisition number. If not applicable, enter “Not applicable”.

Section 2.d Bridge contract. Check the applicable box. See DTAP 1017.70 for a definition of bridge contract and other requirements.

Section 2.e Brand name. Check the applicable box.

3.a A description of the supplies or services required to meet the agency’s needs. Provide a clear, concise description of the supplies or services to be procured. Include a statement regarding the delivery schedule and/or the period of performance, inclusive of all option periods and award terms. If applicable, state the associated contract line or subline items the supplies or services are being procured against. For supplies, include details such quantity and a brief description of the items (e.g. twelve (12) laptops).

For brand name, provide the name of the brand, model number and other specific details associated with the brand name item(s) being procured; name(s) of known sources that can provide the brand name.

For modification describe the purpose of modification, including details such as proposed extension to the period of performance as well as the purpose of and type of the contract.

3.b Includes IT. Check the applicable box. If, yes is selected then include the NAICS and PSC

3.c IGCE/Estimated dollar value. Provide the IGCE/estimated dollar value of the anticipated award, inclusive of all options, award terms and any other monetary incentives. If applicable, provide separately for each option, award term and other monetary incentive a general description (e.g. option period 1 – April x, 201x through March x, 201x) and the associated individual dollar amount. These separate dollar amounts should add up to the total estimated dollar value; however if there is a difference then provide a discussion as to why they don’t.

For brand name also provide the IGCE/ estimated dollar value of the portion of the order, inclusive of all options, award terms and other monetary incentives, that is brand name.

For modifications provide the IGCE/estimated dollar value of the proposed modification, the current total dollar value of the contract.

4.a Identification of the exception to fair opportunity being used. Check the applicable exception being used for this justification.

4.b Supporting rationale. Provide a clear and concise description of the rationale for the use of the authority being cited above, including a demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the exception cited. The following provides additional insight for purposes of completing this field:

• FAR 16.505(b)(2)(i)(A) Describe the nature or circumstances of the urgency surrounding the agency’s need; how any follow-on work will be competed or how such urgency will be mitigated in the future; describe the extent and impact of the unacceptable delay (e.g.

quantitative data, dollars that would be lost, the impact to schedule) if fair opportunity was provided. Provide supporting rationale and a concise description of the extent, nature, and impact of the potential harm to the Government.

• FAR 16.505(b)(2)(i)(B) Describe what makes this contractor the only responsible source.

For example, (i) does the proposed contractor have facilities or equipment that are specialized or unique that are vital to the effort?; (ii) Is the proposed contractor the only one that can meet critical schedule(s) required by the Government?; (iii) Does the proposed contractor have prior experience or expertise of a highly specialized nature that is vital to the effort?; (iv) Does the contractor have an exclusive licensing agreement?. Fully explain why any other supply or service provided by another vendor will not satisfy the Government’s need. Also, describe any type of market survey and analysis efforts conducted to support this conclusion.

• FAR 16.505(b)(2)(i)(C) If the logical follow-on exception is used, the rationale shall describe why the relationship between the initial order and the follow-on is logical (e.g., in terms of scope, period of performance, or value). Provide the estimated cost and/or time savings that will result from the non-competitive award, and explain the basis for the estimate.

• FAR 16.505(b)(2)(i)(D) If the satisfy a minimum guarantee exception is used, specify the amount of that guarantee, and, if applicable, the amount that has been ordered to date.

Discuss why the minimum was not otherwise met and any actions the Government took to meet that minimum.

• FAR 16.505(b)(2)(i)(E) If the statute exception is used, cite the statute along the specific language from the statute and how it applies to this order.

• FAR 16.505(a)(4) State the brand name product’s unique attributes (be specific and use technical terms, if necessary), provide an explanation of the proposed brand name item(s) unique qualifications and why no other similar product will suffice, including why other companies’ similar products lacking the particular feature do not meet, or cannot be modified to meet, the agency’s needs; why (if applicable) the nature of the acquisition requires the use of the brand name product. Provide an estimate of the cost and/or delay the Government would incur if other than the brand name item is used for this requirement.

Do not simply take information from a vendor’s website or other such marketing information to use as the basis as to why they are unique. Also, describe any type of market survey and analysis efforts conducted to support this conclusion.

5. A determination that the anticipated cost to the government will be fair and reasonable.

Provide a clear and complete description of the contracting officer’s determination that the anticipated cost or pricing the Government will be fair and reasonable. This might include things, such as consideration of commercial pricelists or prior acquisition history.

6.a Any other facts supporting this justification. Additional examples beyond those provided in the form itself are:

• If the justification is based on an urgent and compelling need, there may be additional data or estimated costs that further support the extent and nature of the harm to the government in delay in award will cause or

• If the justification is based on a need to purchase a patented or copyrighted product that has not been licensed for resale obtain some type of documentation from the vendor demonstrating they are intellectual property holder and there are no authorized resellers.

6.b Attachments. Check the applicable box. Examples of attachments might be a copy of the IGCE, certification from the vendor stating they are other only authorized reseller of the particular item or are the patent holder of the item.

7. A statement of the actions, if any, the Requiring Activity and Contracting Activity may take to remove or overcome any barriers that led to restricted consideration before any subsequent acquisition for the supplies and services is made. Describe actions taken, or that may be taken, to remove or overcome any barriers to competition before any subsequent acquisitions for the supplies or services required (e.g. overcoming challenges to restrictive data markings, data rights, preparation of a performance based work statement). If planning or in the midst of a competition, include information regarding this action (e.g. estimated date when the competitive procurement will occur or award to be made). Refer to the language in green text for an example.

8. and 9. Certifications, Reviews and Approvals. Each review must be preceded by lower level approval(s), e.g., over $68 million all approvals are required. IN NO CASE SHALL AN

INDIVIDUAL SIGN MORE THAN ONE APPROVAL LEVEL.

For justifications that include the purchase of Information Technology (IT) the following apply:

• The IT signature reflects only the portion of the acquisition that is IT. This can be important when dealing with an acquisition where IT does not represent the predominate value of the acquisition (i.e. therefore it is not assigned an IT PSC code (see the Treasury IT Acquisition Tracker).

• The Bureau Chief Information Officer (CIO) may delegate their authority for proposed contracts over $5 million, but not exceeding $13.5 million to Associate Bureau CIO(s).

Refer to the Bureau supplement to the DTAP to determine if the Bureau CIO has indeed delegated their authority.

FAR 16.505(b)(2)(ii)(C) uses the terms “head of the procuring activity” which has the same meaning as head of the contracting activity (HCA).

https://thegreen.treas.gov/do/ope/ITAcqTracker/Pages/Treasury-IT-Acquisition-Tracker---Home.aspx https://thegreen.treas.gov/do/ope/ITAcqTracker/Pages/Treasury-IT-Acquisition-Tracker---Home.aspx https://thegreen.treas.gov/do/ope/ITAcqTracker/Pages/Treasury-IT-Acquisition-Tracker---Home.aspx https://thegreen.treas.gov/do/ope/ITAcqTracker/Pages/Treasury-IT-Acquisition-Tracker---Home.aspx

A supplemental justification is required if any of the following revisions occur between approval of the original justification and actual award of the contract or modification of the award: an increase in dollar value beyond the authority approved in the justification; a change in the competitive strategy that further reduces competition; or any type of change in requirement that affects the basis of the justification.

Additional. Tracking No.: This field is completed as prescribed by Bureau procedures.