1.5.1-SSJ_Redacted.pdf

OFFICE OF ACQUISITION MANAGEMENT

ICE Acquisition Manual 3006.301-90

SOLE SOURCE JUSTIFICATION: SIMPLIFIED PROCEDURES FOR CERTAIN

COMMERCIAL ITEMS EXCEEDING SAT, INCLUDING BRAND NAME

J&A-26-0061

Pursuant to the requirements under the authority of simplified procedures for commercial items at 41 U.S.C. 1901 as implemented by Federal Acquisition Regulation (FAR) 12.102, FAR Class Deviation 25-21, Rev. 1 for FAR Part 120F

1 and consistent with the content requirements of FAR 6.303-2.

1. Agency and Contracting Activity.

The Department of Homeland Security (DHS), Immigration and Customs Enforcement (ICE), Office of Acquisition Management (OAQ), proposes to enter a contract on behalf of Homeland Security Investigations (HSI) Cyber Crimes Center (C3) on a basis of other than full and open competition.

2. Nature and/or description of the action being approved.

(a) Type of action: New, Firm Fixed Price (FFP) Purchase Order

(b) Amount the current J&A is justifying: $

(c) Brief Description: OAQ intends to procure, on a sole source basis, commercially available training that will provide certification to cybersecurity professionals using simplified acquisition procedures. The vendor listed below is the only developer of this software and training.

The Escal Institute of Advanced Technologies, Inc dba SANS Institute 11200 Rockville Pike, Suite 200 Rockville, MD 20852

3. Description of Supplies/Services. Describe the supplies or services to be acquired.

Provide the estimated total value (including options, if any).

C3 has a requirement to procure new trainee certification in the Treasury Computer Forensics Training Program. The HSI Computer Forensics Program (CFP) provides these certifications support the Computer Forensics Agents and Analysts (CFAs) from HSI, the U.S. Secret Service (USSS), and Internal Revenue Service (IRS).

This requirement procures the following classroom instructions, training and exam vouchers, and managed services:

1 FAR Class Deviation 25-21, Rev. 1 for FAR Part 12 was issued as part of the Revolutionary FAR Overhaul (RFO), which was implemented in response to Executive Order 14275, Restoring Common Sense to Federal Procurement, signed April 15, 2025. Any subsequent citations to FAR Part 12 in this document will be cited as “RFO FAR” for brevity, and are referring specifically to FAR Class Deviation 25-21, Rev. 1 for FAR Part 12.

SOLE SOURCE JUSTIFICATION: SIMPLIFIED PROCEDURES FOR CERTAIN

COMMERCIAL ITEMS EXCEEDING SAT, INCLUDING BRAND NAME

C3 has a requirement to procure new trainee certification in TCFTP. SANS Institute is a teaching organization that provides certification programs to cybersecurity professionals. No other evaluated competitor can provide commercially available training products that are compatible with meet the HSI needs. The Certified Information Systems Security Professional (CISSP) certification, granted by ISC2, is primarily focused on cybersecurity principles and practices, and does not address the foundational skills required for basic computer evidence recovery needed by HSI CFP. The Computer Technology Industry Association (CompTIA) training is designed for IT professionals and offers a solid foundation for those pursuing the CFA program, but it does not specifically address the instructional needs for basic computer evidence recovery.

The training made available to the HSI workforce by SANS Institute include SANs In-Person Training Events, SANS OnDemand (Online Training), SANS Live Online Training, SANS Mentor, SANS Self-study, SANS Private Training/Netwars/Cyber Range Access, Community SANS, SANS Summits, GIAC Exams Practice Exams, Extensions, Retakes, Bundles, Challenge and Certification Renewals, access to SANS Technology Institute and Cyber Talent Assessments.

Because C3 already routinely utilizes SANS for other cyber learning and instruction, using SANS for BCERT is imperative to maintain continuity and familiarity for C3 personnel to avoid unnecessary costs and delays in training. SANS also provides internationally recognized industry standards and certifications as well as provided the basis for the Network Intrusion Programs of close Federal Partners of HSI. These industry-recognized certifications will allow the HSI CFP practices and procedures to remain consistent with other Federal partners. The SANS training is compatible with all the equipment and the programs currently used during law enforcement investigations and forensics examinations.

SANS certifications are both managed and utilized by C3 for law enforcement purposes within the HSI required critical training mission as well as supporting other federal, state, local, and international law enforcement partners because the SANS certifications are the only solution that has proven capabilities and greatest industry-wide acceptance for CFAs.

This is a requirement within the standardized CFA Training/Certification/Currency Program.

6. Description of efforts made to ensure that offers are solicited from as many potential sources as is practicable.

A notice of intent to solicit from a single source was posted on SAM.gov on January 30, 2026, with a closing date of February 4, 2026. No parties expressed interest.

OAQ intends to make this justification publicly available pursuant to FAR 6.301, FAR Class Deviation 25-11, Rev. 1 for FAR Part 61F

2 on SAM.gov 14 days after award, along with the award notice.

2 FAR Class Deviation 25-11, Rev. 1 for FAR Part 6 was issued as part of the Revolutionary FAR Overhaul (RFO), which was implemented in response to Executive Order 14275, Restoring Common Sense to Federal Procurement, SOLE SOURCE JUSTIFICATION: SIMPLIFIED PROCEDURES FOR CERTAIN

COMMERCIAL ITEMS EXCEEDING SAT, INCLUDING BRAND NAME

7. Determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

The Contracting Officer determined that the anticipated price(s) will be fair and reasonable based on market research and historical pricing found on similar previous purchases. The Contracting Officer may base the determination on: market research, comparison of the proposed price with prices found reasonable on previous purchases; current price lists, catalogs, advertisements, comparison with similar items in a related industry; the Contracting Officer’s personal knowledge of the item being purchased, comparison to an independent Government estimate; and/or any other reasonable basis to determine that the price at the time of award represents the overall best value for the Government and is fair and reasonable.

8. Description of market research.

Market research was conducted by HSI C3 between November 2025 – February 2026.

Market research confirmed that while certifications such as CISSP are primarily focused on cybersecurity principles and practices and CompTIA training is designed for IT professionals and provides a strong foundation for those pursuing the CFA program, neither specifically address the instructional needs for basic computer evidence recovery in criminal investigations. As a result, these certifications do not provide the targeted skills required for law enforcement investigations and forensic examinations, which could impact the agency’s ability to efficiently recover and preserve digital evidence critical to prosecutorial outcomes.

It was determined that The Escal Institute of Advanced Technologies (SANS Institute) has sole proprietary rights to their training and products that cannot be provided by any authorized resellers or distributors. SANS Institute provided a sole source letter stating SANS courses are only taught by SANS certified instructors and only SANS has the exclusive right to produce official SANS curriculum and deliver SANS training.

The Coast Guard single-award IDIQ, 70Z02324D79100001, awarded to SANS Institute, was researched as a potential contract vehicle to utilize. However, it was determined that the required "Long Course" and “Managed Services” is not included on the IDIQ. Therefore, the IDIQ cannot be used, and this requirement must be procured as a sole source Purchase Order.

Additionally, a notice of intent to solicit from a single source was posted to SAM.gov on January 30, 2026, with a closing date of February 4, 2026. No parties expressed interest.

9. Any other facts supporting the justification.

Not Applicable.

signed April 15, 2025. Any subsequent citations to FAR Part 6 in this document will be cited as “RFO FAR” for brevity, and are referring specifically to FAR Class Deviation 25-11, Rev. 1 for FAR Part 6.

SOLE SOURCE JUSTIFICATION: SIMPLIFIED PROCEDURES FOR CERTAIN

COMMERCIAL ITEMS EXCEEDING SAT, INCLUDING BRAND NAME

10. A listing of the sources, if any that expressed, in writing, an interest in the acquisition.

The Escal Institute of Advanced Technologies (SANS Institute).

11. A statement of the actions, if any, the agency may take to remove or overcome any barriers to competition before any subsequent acquisition for supplies or services required.

HSI C3 will continue to monitor the market for new entrants and products into the field that can meet this requirement.

12. DHS intends to post the requirement pursuant to RFO FAR 12.202 and RFO FAR 6.301.

13. Technical/Requirements Personnel Certification.

I certify this requirement meets the Government’s minimum need and that the supporting data, which forms a basis for this justification, is complete and accurate.

Kimberly Wright-Whitson Date Contracting Officer Representative

14. Contracting Officer’s Certification.

I certify that the data supporting the recommended use of other than full and open competition is accurate and complete to the best of my knowledge and belief.

Michelle Levine Date Contracting Officer

MICHELLE E LEVINE

Digitally signed by MICHELLE E

LEVINE

Date: 2026.02.09 06:20:56 -06'00'