1.5.1_JEFO ICAM-US Bridge_Clean_20210622_Redacted.pdf

CISAM 3016.505-90(b)(4) Justification for Exception to Fair Opportunity

Exceeding the SAT pursuant to FAR 16.505(b)(2)(ii)(B)

JEFO No: Page 1 of 4 Rev: 10/22/2020

JEFO Number: PR Number:

1. Agency and Contracting Activity.

The Department of Homeland Security, U.S. Citizenship and Immigration Services (USCIS), Office of Contracting, proposes to award a task order on behalf of the USCIS, Office of Information Technology (OIT), Information Security Division (ISD), pursuant to Federal Acquisition Regulation (FAR) 16.505(b)(2), Exception to the fair opportunity process.

2. Nature and/or description of the action being approved.

USCIS intends to award a task order to Sevatec Inc., hereinafter referred to as Sevatec, under its GSA Alliant 2 contract, contract number HSHQDC-13-D-E2075. Sevatec is the incumbent contractor currently providing support under task order HSHQDC-13-D-E2075/HSSCCG-17-J- 00112 for Identity, Credential and Access Management Unified-Services (ICAM-US) support services.

3. Description of Supplies/Services.

As part of the response to the recent cyber event that effected the entire United States Federal Government, and for USCIS to comply with the Cybersecurity and Infrastructure Security Agency’s (CISA) Emergency Directive 21-01, Sevatec is assisting USCIS in improving its cybersecurity posture through the development and implementation of a cyber hygiene methodology and governance framework that secures the integrity of authentication paths, identities, and privileges in response to known tactics, techniques, and procedures (TTP) and indicators of compromise (IOC). USCIS is required to complete applicable steps identified in the CISA Emergency Directive 21-01.

Key tasks for this response include:

Automating and scheduling of frequent rotation of credentials, keys, tokens, and certificates

Designing and implementing digital and automated guardrails to limit and control privileged access with Just-in-Time administration and Just-in-Time provisioning

Designing and implementing automated access control audits and alerts to support continuous implementation of least privilege and notification of potentially suspicious activity

Implementing multi-factor authentication for all users and accounts and augmenting authentication factors for specific use cases with elevated right

JEFO No: Page 2 of 4

Given the specialized nature and urgency of this response, USCIS requires the continuation of services in support of the ICAM-US information technology program including systems engineering, and other professional services for the ongoing maintenance of the existing ICAM- US applications and technical environment, as well as the design, development, integration, testing, and delivery of incremental functional releases of the USCIS ICAM environment in accordance with Agile and DevOps best practices and the government-approved design and schedule.

The period of performance for the proposed action will include a 2-months Base Period, one 8-months Option Period, and one 2-months Option Period as listed below. The estimated total dollar value is

Base Period: 9/26/2021-11/25/2021 Option Period 1: 11/26/2021-7/25/2022 Option Period 2: 7/26/2022-9/25/2022

4. Statutory exception and supporting rationale.

The applicable statutory FAR citation and basis for using an exception to fair opportunity process is:

FAR 16.505(b)(2)(i)(C). The order must be issued on a sole-source basis in the interest of economy and efficiency because it is a logical follow-on to an order already issued under the contract, provided that all awardees were given a fair opportunity to be considered for the original order.

Rationale:

Currently, Sevatec performs ICAM-US services under the HSSCCG-17-J-00112 task order with the POP end date of 09/25/2021. As described in greater detail below, the ICAM-US work is paramount to agency continuity of operations. With the increased threat landscape and the requirement to enhance the agencies cyber-hygiene (per CISA Emergency Directive 21-01), it is imperative that continuity of operations exists in order to respond to the threat landscape and ensure all services requested, are both critical and required in order to continue providing the right individual access to the right resources, at the right time, for the right reason. Sevatec, as the current provider of ICAM-US services, is providing satisfactory performance. Due to the nature of the work it is not a viable solution to introduce a new contractor at this time as this would disrupt services being provided and leave our systems unprotected and vulnerable from cyber attacks. The ICAM-US task order was modified in March of 2021 with the addition of Advanced Identity Governance Services that facilitated the advancement of the USCIS Cybersecurity posture through the development and implementation of a cyber hygiene methodologies and a governance framework. It is imperative that the incumbent contractor continues and maintains these vital services currently being satisfactorily performed on the ICAM-US task order for a twelve (12) month logical follow-on task order from

JEFO No: Page 3 of 4

9/26/2021 – 9/25/2022. The extension of twelve (12) months will allow time for Sevatec to continue the improvements to USCIS’ cybersecurity posture as part of the response to the recent cyber event as described in detail in section 3 above and successfully transition-in the successor task order. The task order is being issued on a sole-source basis in the interest of economy and efficiency because it is a logical follow-on to an order already issued under the contract, where all awardees were given a fair opportunity to be considered for the original order.

A competitive recompete, which will procure these important required services is currently in- process with a planned award in a third quarter of the Fiscal Year 2022 as noted in section 6 below.

5. Determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

The Contracting Officer anticipates the proposed price will be consistent with the Alliant 2 Unrestricted Government-Wide Acquisition Contracts (GWAC) contract held by Sevatec that includes maximum/ceiling rates. In addition, historical pricing information is available for all services to be provided, which are the basis for the Independent Government Cost Estimate.

Pricing will be evaluated for reasonableness in accordance with one or more analysis techniques identified in FAR Subpart 15.4. The Contracting Officer may request other than certified cost and pricing data if determined to be necessary in the assessment of fair and reasonable pricing.

Prior to award, the contracting officer will be able to determine that issuing the proposed task order via the Alliant 2 GWAC represents the best value and that the proposed price is fair and reasonable for award.

6. Any other facts supporting the justification.

The ICAM program is one of the first lines of defense for the USCIS network and systems.

In the last year, USCIS has fended off several known cyber attacks. The ICAM program is comprised of several core components protecting access to the network and systems in the areas of user authorization, authentication, privileged access management, secret key management in hardware, and device certificate management. Together these components represent a comprehensive and innovative approach to addressing the needs of an every-changing environment and world.

The ICAM Program is working with the Office of Contracting in order to re-compete this requirement with an expected award date in the third quarter of Fiscal Year 2022.