LSJ_Exceeding_SAT-redacted_Redacted.pdf

U.S. Department of Homeland Security Sole Source Justification (SSJ) Federal Emergency Management Agency (FEMA) February 2026

SSJ Template > SAT 2- 1 - SSJ No: 26-133

Sole Source Justification (SSJ) For orders or BPAs exceeding the Simplified Acquisition Threshold

SSJ No.: 26-133

This acquisition is conducted under the authority of the Multiple-Award Schedule Program, 41 U.S.C. 152(3), Competitive Procedures, and 40 U.S.C. 501, Services for Executive Agencies.1

Pursuant to the Federal Acquisition Regulations (FAR) 8.4, FAR Class Deviation 25-20 and in accordance with the requirements of RFO 8.4, the justification for the use of the authority under GSAM 538.7104-3 is justified by the following facts and rationale required under RFO 8.4 and

HSAM 3008.401-71.

1. Identification of the agency, contracting activity, and specific identification of the document as a “Sole Source Justification.”

The Department of Homeland Security (DHS), Federal Emergency Management Agency (FEMA), Resilience (RSL) proposes an award pursuant to HSAM 3008.401-71, Sole source justifications, and GSAM 538.7104-3, Sole source justifications.

2. Nature of the action being approved:

(a) FEMA intends to procure Customer and Data Service (CDS) support services for the

National Flood Insurance Program (NFIP).

(b) IBM, 6710 Rockledge Drive, Bethesda, MD 20817.

(c) Contract type: Firm Fixed Price

(d) Estimated total value (including options). Provide breakdown as shown below:

Period Unit Price Total

Base

6 mo.

Varied

$15,325,444.37

Option 1 3 mo. Varied $5,006,788.26 Option 2 3 mo. Varied

Total $3,671,873.77 $24,004,106.40

1 In this document, citations to RFO Part 6, RFO Part 8, RFO Part 25, and HSAR Part 3006 are citations specifically to Federal Acquisition Regulation (FAR) Class Deviation 25-11 for FAR Part 6, FAR Class Deviation 25-20 for FAR Part 8, FAR Class Deviation 26-09, Revision 1, for FAR Part 25, and Homeland Security Acquisition Regulation (HSAR) Class Deviation 25-01 for HSAR Part 3006, which were issued as part of the Revolutionary FAR Overhaul (RFO), which was implemented in response to Executive Order 14275, Restoring Common Sense to Federal Procurement, signed April 15, 2025.

SSJ Template > SAT 2- 2 -

This action is a follow-on to the existing CDS support currently being provided under:

HHS GWAC IDIQ Contract No.: HHSN316201200030W Task Order No.: 70FA6023F00000039 Current Period of Performance End Date: July 7, 2026

All available extension mechanisms, including FAR 52.217-8, Option to Extend Services, and FAR 52.217-9, Option to Extend the Term of the Contract, have been fully exercised on the existing task order. No further extensions are available under that vehicle.

The proposed order is structured as a 6-month base period with two 3-month option periods, solely to provide a limited and controlled continuity bridge while FEMA completes transition to a competitively awarded operations and maintenance (O&M) solution.

The base period is intended to cover the time necessary to implement the planned FEMA OCIO IT O&M contract and associated BPA or an alternative competitive vehicle.

The 3-month option periods are contingency periods that will be exercised only if the outcome of the BPA protest, or the implementation of an alternative competitive vehicle, requires additional time beyond the initial base period to complete the transition.

Options will be exercised only to the extent necessary to complete an orderly transition to the follow-on competitive solution, consistent with the Government’s intent to minimize the duration of this sole source bridge.

3. A description of the supplies or services required to meet the agency’s needs.

This requirement is to procure a sole source MAS order for continued operations and maintenance and related services for the FEMA NFIP Risk MAP IT Customer and Data Services (CDS) system. The order will ensure uninterrupted delivery of statutorily mandated NFIP flood hazard data and continuity of customer-facing services, including:

1. Operation and Maintenance of the Risk MAP IT environment o Risk Mapping, Assessment, and Planning (Risk MAP) Risk Analysis and

Management (RAM) Cloud system o Cybersecurity operations, including continuous monitoring, patching, vulnerability remediation, and incident response for the RAM Cloud environment

2. FEMA Mapping and Insurance eXchange (FMIX) Contact Center Operations o Operation of the FMIX contact center, which serves as the primary NFIP customer contact point and is relied upon during disaster response o Handling of public inquiries related to flood maps, flood insurance requirements, and NFIP policies

3. Engineering Library and Letter of Map Change (LOMC) Clearinghouse Operations o Management of engineering data and records supporting NFIP flood hazard determinations o Processing of LOMC requests and associated data management activities

SSJ Template > SAT 2- 3 -

4. Risk MAP/NFIP Flood Data Management o Management, validation, and publication of NFIP flood hazard data and products o Maintenance of data integrity and availability for over 22,000 state, local, and tribal stakeholders and private sector users (e.g., lenders, insurers, real estate professionals)

5. Transition-related activities o Support for operational ramp-up and transition to follow-on competitive contracts o Knowledge transfer to new contractors o Parallel operations and increased government oversight to manage transition risk

The continuity of these services is necessary:

Avoid service disruption and downstream consequences such as delays in map updates, interruptions in NFIP administration, and negative impacts on stakeholders who rely on flood risk data

Maintain the ability of lenders to determine whether structures securing federally backed mortgages are located in Special Flood Hazard Areas

Prevent interruptions in public access to NFIP flood hazard information and associated customer support services

Without this interim continuity order, Risk MAP operations and core NFIP program functions would be jeopardized, with significant potential impacts on public safety, property protection, and the national economy.

4. The statutory exception and supporting rationale (see GSAM 538.7104-3(b)(1))).

This requirement supports NFIP’s statutorily mandated mission to produce, maintain, and distribute flood hazard information and flood risk data, as well as to administer the National Flood Insurance Program. Specifically, this effort supports:

Mission Essential Task: Flood Insurance Operation Essential Task: Federal Insurance Data Authority: Publish authoritative flood risk and hazard information for the nation

Accurate and secure flood map data and associated services are critical to:

Determining flood insurance requirements for federally backed mortgages Informing local land use, building codes, and mitigation planning Supporting individual and community-level decisions about flood risk

Without the NFIP and the Risk MAP data government-backed flood insurance coverage would not be accessible to many property owners, and many real estate transactions and loan originations could be delayed or halted due to the inability to determine flood risk status.

Additionally, loss of system support will introduce serious vulnerabilities to the information shared with public and increase the possibility of data integrity issues, including exposure of Personally Identifiable Information (PII).

SSJ Template > SAT 2- 4 -

Market Research (MR) Schedule of Events:

1. During performance of HHS SP3 CIO “Bridge” HHSN316201200030W; Task

Order4: 70FA6023F00000039, a Request for Information (RFI) “CDS O&M RFI Q4 Review” was conducted 3/11/2024 to gauge industry IT system and data management methodologies. The O&M requirement was two (2) of eight (8) objectives within the CDS scope.

2. Thirty-one (31) responses were received and entered to an evaluation rubric by the Requirements Officer and Program Manager of Information Technology Data Management (ITDM) program office for stakeholders of CDS to analyze.

a. Twenty-four (24) responders were judged as capable of performing O&M solutions from examples, process maps, schedules, and defined labor categories.

b. Seven (7) were deemed to have insufficient explanations, convoluted processes, or outdated methodologies.

3. An “Operations and Modernization (O&M), Virtual Industry Day” was conducted June 5, 2024, with attending government representative from FEMA RAPID and Risk Management Directorate, Chief Information Office SMEs, Contract Officer, CDS Product Owners, and ITDM program staff.

4. The scope of O&M and purpose came into question by the FEMA CIO and instruction from CIO was to stop modernization activities.

5. Priority changes effect on CDS O&M initiative and Market Research efforts:

a. CIO interpretation of modernization of IT systems when sustainment should be program’s focus.

b. CDS cloud migration of RAM system to FEMA Enterprise Cloud (FEC) environment

c. Administration and Agency leadership acquisition and procurement policy shift.

d. Reduction of budget and funding levels by FEMA leadership required rescope of

CDS services.

e. FEMA leadership requirement to utilize internal (CIO BPA) or external (USDA

STRATUS IAA) preexisting procurement vehicles.

f. Reorganization actions within FEMA, the Risk Analysis, Planning & Information

Directorate (RAPID) to Resilience reorganization and subsequent Risk Mapping Assessment and Planning (Risk MAP) IT to National Flood Insurance Program (NFIP) IT Business Platform (NFIP IT BP).

6. CDS Program notified by USDA STRATUS Contract Officer, external programs and agency would not be supported by USDA BPA vehicle.

7. NFIP IT BP strategy to ensure CDS continuity of services lead to Sole Source procurement option.

Summarization of CDS market research methods and resources performed. Request for Information rubric released, 2024, to IT industry for awareness of future requirement support efforts.

There are options available on the commercial marketplace, and it is FEMA’s intent to compete this action on an appropriate GWAC. Given the lack of time and need for continuity of

SSJ Template > SAT 2- 5 -services this contract was not available for even a limited sources competition because of the time needed for a successful transition to a new vendor.

The HHS SP3 CIO contract expired on 7/7/2026. All extensions have been exhausted.

Additional time is needed to begin transition and operations and maintenance to another contract vehicle. Neither the FEMA OCIO O&M BPA or the United States Department of Agriculture (USDA) Inter-agency Agreement (IAA) contracts could be used to move the contract off the SP3 CIO contract vehicle. Risk MAP and FID personnel began strategizing on the follow-up acquisition with the plan of using the USDA operations and maintenance PWS Interagency Reimbursable Work Agreement (IRWA). Risk MAP and FID were contacted (mid-March) by the USDA CO to communicate that a USDA restructuring initiative was underway, and the USDA CIO was stopped all external IAAs. The Department of Homeland Security shutdown was in full effect, and resulted in severe delays in acquisition strategy meetings due to the fact that a large portion of staff was furloughed. The continued budget discussion, administrative pivots in leadership, and program instability cause the acquisition to be delayed even further.

This sole source to the incumbent is the only option left and is abbreviated as much as possible to allow for competition in a more administratively stable environment.

IBM’s continued performance is therefore necessary to:

Avoid loss of system functionality and data integrity.

Preserve the Government’s ability to perform its mission and meet NFIP statutory obligations, including the publication of flood hazard information and support for federally backed mortgage determinations.

Allow sufficient time to develop, compete, and execute a structured transition to the planned OCIO O&M-based solution and any associated BPA for CDS/Risk MAP IT.

IBM is the only source capable of maintaining continuity of Risk MAP IT services at the required performance level, within the available timeframe, and without introducing unacceptable mission risk to loss of life, property, and insurance housing industries during this short-term continuity bridge. The proposed sole source order is limited to the minimum duration necessary to sustain operations and enable an orderly transition to a competitive follow-on solution once an appropriate vehicle becomes available.

It is the Government’s intent to compete a follow-on requirement through full and open competition once the appropriate procurement vehicles are available. Planned actions include:

Completing the award of a FEMA Operations and Maintenance Contract and related

BPAs to support the long-term Risk MAP IT and CDS needs.

Structuring the follow-on competitive acquisition to minimize transition risk by requiring detailed transition plans and knowledge transfer activities.

SSJ Template > SAT 2- 6 -

In addition, the NFIP program will undertake concrete steps to ensure that the Risk MAP, RAM Cloud environment is fully supportable by future competitive vendors. The program will document the current CDS and RAM Cloud architecture, interfaces, and operational processes; develop and implement a structured transition plan, including defined knowledge transfer milestones; and use the outcome of the OCIO O&M vehicle (once available) to inform the requirements and acquisition strategy for any BPA piggyback solution for CDS/Risk MAP IT. These actions demonstrate that this bridge is a temporary measure and that the program is actively planning and enabling a timely return to competition.

Given the combination of mission-critical functions, time constraints, and the complexity of the CDS environment, limiting competition to IBM for this temporary continuity order is justified as a logical follow-on in the interest of economy and efficiency.

As stated, this interim sole source order is limited to the minimum duration and scope necessary to maintain continuity of operations and to allow for a deliberate and competitive follow-on acquisition.

This acquisition is being conducted under the authority of the Multiple-Award Schedule Program, 41 U.S.C. 152(3), Competitive Procedures, and 40 U.S.C. 501, Services for Executive Agencies, in accordance with HSAM 3008.401-71, Sole source justifications, and GSAM 538.7104-3, Sole source justifications. An award will be made in the interest of economy and efficiency as a logical follow-on to an original Federal Supply Schedule order #70FA6023F00000039 pursuant to GSAM 538.7104-3(b)(1)(iii).

5. FEMA intends to post this justification on SAM.gov pursuant to GSAM 538.7104-3(b)(3)(ii).

6. Contracting Officer’s Certification. I certify that the data supporting the recommended use of other than full and open competition is accurate and complete to the best of my knowledge and belief.

Contracting Officer Date

7. Technical/Requirements Personnel Certification. I certify this requirement meets the

Government’s minimum need and that the supporting data, which forms a basis for this justification, is complete and accurate.

STEVEN D

KIMMELL

Digitally signed by STEVEN D

KIMMELL

Date: 2026.07.13 14:17:51 -04'00'

MARIANNE D SLABY Digitally signed by MARIANNE D SLABY Date: 2026.07.13 14:22:47 -04'00'

SSJ Template > SAT 2- 7 -

Technical Representative Date

APPROVAL:

Contracting Officer Date

Note: The Contracting Officer is the final approving official when the action does not exceed $900K.

Procuring Activity Advocate for Competition Date

Note: The Procuring Activity Advocate for Competition (PAAC) is the final approving official when the action exceeds $900K but is less than or equal to $20M.

Approval by the PAAC is not required if the J&A is reviewed and approved by an official designated by the Component who is a member of the armed services at the general or flag officer level or a civilian in a grade above the GS-15 (or equivalent) level. However, this exception does not apply to justifications citing that cite RFO 6.103-2 Unusual and Compelling Urgency as the authority.

Head of Contracting Activity Date

Note: The HCA is the approving official when the action exceeds $20M but is less than or equal to $90M (less than or equal to $150M for USCG). The HCA is not required to approve the justification if the Component PAAC is a member of the armed services at the general or flag officer level or is a civilian in a grade above the GS-15 (or equivalent) level. HCA may also delegate approval to a member of the armed services at the general or flag officer level or a civilian in a grade above the GS-15 or equivalent level. However, this exception does not apply to justifications that cite RFO 6.103-2 Unusual and Compelling Urgency as the authority per HSAR 3006.104-270 (HSAR Class Deviation 25-01).

MARIANNE D SLABY Digitally signed by MARIANNE D SLABY Date: 2026.07.13 14:23:53 -04'00'

SSJ Template > SAT 2- 8 -