Cred_Mon_Limited_Source_Justification_JG.pdf

FEDERAL SUPPLY SCHEDULE LIMITED-SOURCES JUSTIFICATION

Acquisition Title: Credit Monitoring Services Agency: Centers for Medicare & Medicaid Services (CMS) Acquisition Year: 2018 Author: Jabaar Gray/Amir Al-Kourainy

2. Description of Action:

Nature

• __X__ New Requirement

• ____ Follow-On Order

• ____ Modification of Existing Purchase Order / Contract Number

Contract Type

• __X__ Firm-Fixed Price

• ____ Time and Materials

• ____ Cost Plus Fixed Fee (CPFF)

• __12 month (October 23, 2018 to October 22, 2019)__ Term

• ____ Completion

• ____ Cost Plus Award Fee (CPAF)

• ____ Other: ___________

Projected Cost / Price: __$987,000_______ Funding Source (s):___CMS______

Name of Proposed Contractor(s):

Identify Theft Guard Solutions, Inc.

10300 SW Greenburg Rd, Suite 570 Portland, OR, 9722-35416

3. Description of Supplies or Services:

The estimated value of the proposed action, including all options, is $987,000.00.

In response to a data breach that impacted an estimated 75,000-90,000 consumers using Healthcare.gov, CMS contracted with Identity Theft Guards Solutions, Inc. to provide the following services to the consumers who were impacted:

• consumer notification by mail;

• dedicated toll free number;

• call center services;

• dedicated website;

• “full package” credit monitoring;

• identity monitoring;

• identity restoration; and

• identity theft insurance (in the amount of up to $5 million with a $0 deductible).

The period of performance for this contract is 12 months.

4. Authority:

__X__:ORDER AGAINST FSS: Authority of the Multiple Award Schedule Program, Title III of the Federal Property and Administrative Services Act of 1949 (41 U.S.C. 251, et seq.); Title 40 U.S.C. 501, Services for Executive Agencies; and Section 803 of the National Defense Authorization Act of 2002 (PL 107-107) and implemented by FAR 8.405-6. Mark the applicable exception and for each discuss how the cited authority applies in accordance with FAR 8.405-6(c)(2)(iv).

__X__: An urgent and compelling need exists, and following the procedures would result in unacceptable delays (FAR 8.405-6(a)(1)(i)(A));

CMS detected anomalous system activity in the Direct Enrollment pathway for agents and brokers. The Direct Enrollment pathway allows agents and brokers to assist consumers with applications for coverage in the Federally Facilitated Exchange (FFE). Nefarious actors accessed personal information of approximately 75,000 and up to 90,000 individuals’ files, a small fraction of consumer records present on the FFE.

CMS had to act urgently to address this data breach. The failure of CMS to act in a timely and expeditious manner would cause harm to the consumers who were impacted by this data breach. CMS needed to provide credit monitoring to consumers as quickly as possible, as any delays may threaten the financial security of the impacted consumers. Delays may also result in legal risk to CMS, as CMS is responsible for overseeing the FFS and has a fiduciary obligation to the impacted consumers to ensure that their identify is protected from unauthorized disclosure. Due to these exigent circumstances, CMS did not compete this requirement and awarded it to the identified contractor on a sole source basis. The period of performance of this task order contract is twelve (12) months

____: Only one source is capable of providing the supplies or services required at the level or quality required because the supplies or services are unique or highly specialized (FAR 8.405-6(a)(i)(B)); or

____: In the interest of economy and efficiency, the new work is a logical follow-on to an original Federal Supply Schedule order provided that the original order was placed in accordance with the applicable Federal Supply Schedule ordering procedures. The original order or BPA must not have been previously issued under sole-source or limited sources procedures (FAR 8.405-6(a)(1)(i)(C)); or https://www.acquisition.gov/sites/default/files/current/far/html/Subpart%208_4.html

____: An item peculiar to one manufacturer can be a particular brand name, product, or a feature of a product, peculiar to one manufacturer). A brand name item, whether available on one or more schedule contracts, is an item peculiar to one manufacturer. (FAR 8.405-6(b);

5. Market Research:

The Office of Management and Budget (OMB) issued Memo M-16-14 on July 1, 2016 which required Federal agencies to use the Identity Monitoring Data Breach Response and Protection Services awarded by the General Services Administration (GSA), referred to as the "IPS BPAs."

CMS reviewed all three vendors on IPS BPA price list that specialized in identity protection and other related services. Primarily relying on internet research, CMS reviewed the service offerings of each BPA holder including each’s ability to provide call center services, website services, website accessibility (508 compliance), record retention, and past experience. CMS used the contractor’s website and information sourced from neutral third parties to access the abilities of each vendor.

CMS selected Identity Theft Guard Solutions, Inc. as the source to provide the urgently required credit monitoring services.

6. Actions to Increase Competition:

To mitigate any potential impacts to consumers when a data incident occurs, CMS needs to move as quickly and efficiently as possible. Future needs for credit monitoring service will be competed under the IPS BPA, as expeditiously as possible. In addition, should CMS require theservices on this current order for more than 12 months, CMS will competitively award a BPA call under the IPS BPA for the services.

7. Any other facts supporting the justification:

All facts have been previously stated.

https://www.acquisition.gov/sites/default/files/current/far/html/Subpart%208_4.html

Contracting Officer Representative (COR) / Date

Program/Project Manager (P/PM) / Date

Best Value Determination. By my signature below, after review of the relevant documents, I have determined that the order subject to this Limited-Sources Justification represents the best value for the Government as set forth in FAR 8.404(d), and constitutes a fair and reasonable price. The basis for my determination is as follows:

The Contracting Officer compared the pricing quoted for the services to the pricing provided in the IPS BPA price list (which the GSA has already determined to be competitive and fair and reasonable). The contractor provided further discounts off of their GSA schedule list pricing for the services. Therefore, based on price analysis comparing the quoted pricing to the GSA IPS BPA list pricing, the Contracting Officer determined that the quoted pricing was fair and reasonable.

Approvals:

1. Program Office Certification: This is to certify that portions of this justification have been developed by the undersigned program office personnel, including supporting information and/or data verifying the Government’s minimum needs, schedule requirements and other rationale, which form the basis for this Limited Source Justification.

2. Contracting Officer Certification: This is to certify that the justification for the proposed acquisition has been reviewed and that to the best of my knowledge and belief, the information and/or data provided to support the rationale and recommendation for approval, is accurate and complete.

Contracting Officer / Date

OAGM Approvals

I hereby confirm the circumstances described above apply and approve the Limited Source Justification.

OAGM Division Director / Date

OAGM Group Director / Date

3. Head of Contracting Authority (HCA) Approval I hereby confirm the circumstances described above apply and approve the Limited Source Justification.

HCA Name / Date

H1E9 Typewritten Text For: Melissa Starinsky