LSJ_-_Redacted.pdf

Limited Source Justification Chief Financial Officer (CFO)

Credit Monitoring and Identity Protection Services (CM IPS) Program Credit Monitoring and Identity Protection Services Bridge

1. Contracting activity:

This Limited Source Justification supports a procurement action to be conducted under the authority of the Multiple Award Schedule Program (FAR 8.401). The procurement action is generated by the Office of Personnel Management’s (OPM), Office of Procurement Operations

(OPO).

2. Nature and/or description of the action being approved:

The U.S. Office of Personnel Management (OPM), through the Credit Monitoring and Identity Protection Services (CM IPS) Program, is responsible for providing credit monitoring and identity protection services to approximately 22.1 million current, former, and prospective Federal employees, contractors, and others in response to the 2015 personnel records and background investigation records cybersecurity incidents.

In 2015, OPM discovered two separate but related cybersecurity incidents that impacted the data of approximately 22.1 million individuals. First, OPM discovered malicious cyber activity on its network that affected the personnel data of approximately 4.2 million current and former Federal government employees. Second, OPM discovered malicious cyber activity on its network that affected the background investigation records of approximately 21.5 million individuals, primarily current, former, and prospective Federal employees and contractors. All but approximately 600,000 individuals who were impacted by the personnel records incident were also impacted by the background investigation records incident. This means that approximately

3.6 million individuals who were impacted by the personnel records incident were also impacted by the background investigation records incident.

Currently, OPM administers two (2) separate BPA Calls, N0002415F2123 (background investigation records) and OPM1017F0001 (personnel records) that provide identity protection services and credit monitoring to those impacted by the cybersecurity incidents. The same contractor, ID Experts, provides services under the BPA Calls, which are both set to expire on December 31, 2018. The personnel records BPA Call contains FAR Clause 52.217-8; therefore, OPM has the option to continue services for an additional six (6) months until June 30, 2019. It is OPM’s intent to exercise the option to continue services for an additional six (6) months until June 30, 2019 via FAR Clause 52.217-8.

This document provides justification for acquiring the Congressionally mandated services via a sole source bridge contract to the current contractor for those impacted by the 2015 background investigation records cybersecurity incident. OPM intends to award the bridge effort to align the terms of service between both BPA Calls. In addition, this action will provide adequate time to transition all requirements, activities and services from both award vehicles into the new consolidated contract. OPM is actively working on a recompete procurement that combines both BPA Calls into one requirement. The subject competitive procurement will be issued against GSA’s IPS BPA in accordance with the Office of Management and Budget’s (OMB) Memorandum M-16-14.

Credit Monitoring and Identity Protection Services (CM IPS) Program Credit Monitoring and Identity Protection Services Bridge

3. Supplies or services required to meet the agency’s needs (including the estimated value):

The BPA Call resulting from the subject justification will provide the following services 1.)

Project Management Services; 2) Notification Support Services; 3) Website Services; 4) Call Center Services; 5) Identity Support Services; 6) Identity Theft Insurance; 7) Identity Restoration Services; and 9) Offline Mailed Alternative Services. In addition, Transition-Out Services, which will be an optional CLIN if needed.

The bridge effort will have a period of performance of six (6) months starting on January 1, 2019 to June 30, 2019.

The projected expenditure for this bridge action, if all options are exercised, based upon the Independent Government Cost Estimate (IGCE) is approximately .

Requisition is pending, but will be provided in the full amount required. Below is a breakdown of the anticipated Independent Government Cost Estimate (IGCE) line items.

BASE SERVICES

Services Cost

TOTAL BASE SERVICES

TRANSITION-OUT SERVICES DURING OPTION PERIOD (OPTIONAL)

Services TYPE

TOTAL DURING TRANSITION-OUT SERVICES

TRANSITION-OUT SERVICES AFTER OPTION PERIOD (OPTIONAL)

Services Cost

TOTAL AFTER TRANSITION-OUT SERVICES

Credit Monitoring and Identity Protection Services (CM IPS) Program Credit Monitoring and Identity Protection Services Bridge

TOTAL SERVICES IF ALL OPTIONS EXERCISED

TOTAL

4. Identification of the statutory authority and supporting rationale

The authority for establishing the sole source resulting from this justification is FAR 8.405- 6(a)(1)(i)(B): Only one source is capable of providing the supplies or services required at the level of quality required because the supplies or services are unique or highly specialized. The bridge effort will be issued in accordance with the Office of Management and Budget (OMB) Memorandum M-16-14, in which OMB mandates federal agencies to, “with limited exceptions agencies address their requirements by using the government-wide blanket purchase agreements (BPAs) for Identity Monitoring Data Breach Response and Protection Services awarded by the General Services Administration (GSA)”.

The purpose of this procurement is to continue to provide credit monitoring and identity protection services in order to comply with the Congressional mandate. Under the Consolidated Appropriations Act of 2017, Public Law 115-31, OPM is mandated to provide services to those individuals impacted by the 2015 cybersecurity incidents for a period of not less than 10 years and includes not less than $5 million in identity theft insurance. The mandated coverage extension will cover individuals through Fiscal Year 2026. Therefore, in order to move both BPA Calls into a consolidated competitive procurement, OPM needs to issue the subject bridge effort to align with the FAR 52.217-8 extension of the other BPA Call. The extension is also needed to allow for transition-out services if there is a service provider change. A contract of this magnitude requires extensive transition plans as approximately 22.1 million people were impacted by both 2015 cybersecurity incidents. The Government cannot have a lapse in service, and the background investigation records BPA Call originally awarded by the Department of Defense (DoD) Naval Sea Systems Command (NAVSEA) did not contain any transition-out services. As a result, this bridge effort will extend the period of performance to match that of the personnel records BPA and will include optional transition-out services which may be exercised if a new vendor wins the competitive procurement. OPM plans to release the competitive procurement in September 2018 and will work concurrently on the bridge effort at the same time.

As the incumbent, ID Experts has the necessary experience, personnel and qualifications to continue to perform services while the new award is being processed. Failure to continue performance of the services would be disruptive to OPM and the approximately 22.1 million impacted population. Therefore it is necessary to issue a bridge effort to ID Experts as authorized by FAR 8.405-6(a)(1)(i)(B).

5. Determination by the contracting officer that the anticipated order will represent the best value:

Based on the nature of the requirement, the solicitation will be issued to a single source.

Competition will not be sought in accordance with FAR 8.405-6(a)(1)(i)(B). In order to determine that the anticipated Call will represent the best value, the contracting officer and requesting activity will review the current BPA Calls that were competitively awarded for the same services and the vendors IPS BPA pricing. A bridge contract is a continuation of current services; therefore OPM will analyze the current prices being paid under the most recent

Credit Monitoring and Identity Protection Services (CM IPS) Program Credit Monitoring and Identity Protection Services Bridge performance periods of both BPA Calls. In accordance with FAR 8.404(d), GSA has already determined the prices of supplies and fixed-price services, under schedule contracts to be fair and reasonable. The Identity Protection Services BPA was awarded using the vendors GSA Schedule Contract. As a result, OPM will confirm that the vendor’s bridge pricing is equal to or less than their established GSA rates. Additionally, the vendor will be requested to provide any discounts available beyond their published GSA prices. Pricing will be evaluated to determine if it is fair and reasonable to successfully accomplish the subject requirements.

6. Description of the market research conducted and the results or statement of the reason market research was not conducted:

Market Research was not conducted for the bridge effort because the incumbent contractor is the only source able to provide the requested services in order to fulfill the requirements. No other vendor would be able to successfully satisfy all the requirements within the Performance Work Statement (PWS) without a transition period. In order to remain in compliance with the Congressional mandate, there can be no lapse in the identity protection services and credit monitoring coverage offered by the Government. A new vendor would not be able to onboard the approximately 22.1 million individuals impacted by the 2015 cybersecurity incidents on January 1, 2019. Therefore, an incumbent contractor would be the only source capable of fulfilling the requirements at the start of the 6-month extension period.

Market Research was conducted for the competitive recompete procurement. Formal Request for Information (RFIs) were posted to both GSA’s eBuy and FedBizOpps on January 27, 2018. The market research showed that vendors either didn’t have extension experience transitioning in and out of these types of services or they proposed a transition plan that would involve transferring information between vendors. Any kind of information transfer of this magnitude would take significant time to execute. As a result, OPM needs to allow an adequate amount of time to properly transition the subject services.

In accordance with FAR 8.405-6 (a)(2)(i), a Limited Source Justification (LSJ) will be published at the Government Point of Entry (GPE) FedBizOpps (http://www.fedbizopps.gov).

7. Other facts supporting the justification.

None.

8. Statement of actions, if any, the agency may take to remove or overcome any barriers that led to the restricted consideration before any subsequent acquisition for the supplies or services is made:

This limited source justification seeks approval to award a sole source bridge BPA Call to the incumbent contractor for support in accordance with the accompanying Performance Work Statement (PWS) as authorized by FAR 8.405-6(a)(1)(i)(B). ID Experts is the incumbent contractor and the only contractor capable of fulfilling the Government’s need for a 6-month extension and transition period. As previously stated, OPM is also currently working on a consolidated competitive recompete procurement, which will include both transition in and out services.

Credit Monitoring and Identity Protection Services (CM IPS) Program Credit Monitoring and Identity Protection Services Bridge

9. Certifications/Reviews/Approvals:

Contracting Officer

I hereby certify that the information provided herein to support this Limited Source Justification is complete and accurate to the best of my knowledge and belief.

Signature: Date: ___________________________ Typed Name:

Contracting Officer

Technical Personnel Certification

I hereby certify that the information herein that forms the basis for this Limited Source Justification is certified as complete and accurate

Signature Date:____________________________ Typed Name:

Program Office

Signature: Date: ___________________________ Typed Name:

Chief Financial Officer (CFO)

Approval:

Signature: Date:____________________________ Typed Name:

Senior Procurement Executive Office of Procurement Operations

09/27/2018

09/27/2018

09/27/2018

09/28/2018