Consolidation Document Final Redacted FOR SAM PUBLISHING.pdf

Determination for Consolidation of Requirements

FAR 7.107-2 Consolidation

Date: July 16, 2025

Subject: Determination for Consolidation of Requirements for Cybersecurity Support Services

(CSS)

I. Introduction and Purpose

This document serves as the written determination prepared by the Contracting Officer for the consolidation of requirements for Cybersecurity Support Services (CSS) Contract, with an estimated total dollar value $32,078,445.14, in accordance with Federal Acquisition Regulation (FAR) 7.107-2 and 15 U.S.C. 657q.

II. Acquisition Details

• Acquisition Title: Cybersecurity Support Services (CSS)

• Agency/Component: Allen Hill, Chief Information Officer (CIO), Federal Communications Commission

• Estimated Total Dollar Value (including options): $32,078,445.14

• Description of Consolidated Requirements:

The purpose of this acquisition is to consolidate cybersecurity-related services currently provided under two separate contracts Network Security Operations Center (NSOC) and Security Program Support (SPS), into a single integrated contract. This consolidation includes an updated scope of work that includes new tasks and mission critical cybersecurity initiatives. Combining these services into a single effort will support a more cohesive and aligned cybersecurity program; it will eliminate redundancies; provide a long-term cost savings; and ensure consistent delivery of services under a single management and performance structure.

While each award fulfilled specific program needs at the time of issuance, the decentralized nature of the support led to inconsistent reporting structures, varying performance standards, and disagreement about which contract scope incorporates changing requirements to meet regulatory and FCC mission/business needs. The proposed contract will have a period of performance beginning on or about 10/9/2025, with a 12 – Month Base Period, and Four, (4), 1 year Option Periods, and include FAR 52.217-8, Option to Extend Services.

• Previous Contracting Approach (if applicable):

Historically, the Cybersecurity services covered under this consolidation effort were procured separately under two (2) distinct contract actions. Each contract was initially awarded to a small business, Amalga Systems Inc., DBA AA Consulting, UEI, LHVRTLX22FF9, and Agile Defense, LLC, UEI, NV1MK89XJ2J7.

These two contracts can be characterized as providing on-premises reactive cybersecurity services, whereas CSS will provide a holistic cloud-based cybersecurity program solution.

The Network Security Operations Center’s (NSOC) contract primary objective is safeguarding the FCC's critical information infrastructure. This is achieved by reducing exposure to cyber risk, ensuring priority response and recovery to cyber threats/incidents, maintaining shared situational awareness of cyber threats, vulnerabilities, and incidents, and using trustworthy cyber protocols, products, services, configurations, and architectures.

The Security Program Support (SPS) contract primary objective, which include Program Management, Security Program Management, Cybersecurity Policy, Audit Support (Compliance), Vulnerability/Plan of Action and Milestone (POA&M), Assessment and Authorization (A&A), Information System Security Officer (ISSO), Security Training and Awareness, Risk Management, and Privacy Support Services, as defined in the Performance Work Statement (PWS) provides all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and nonpersonal services necessary.

III. Compliance with FAR 7.107-2(a)

Before making this determination, the following steps have been taken:

1. Market Research Conducted (FAR 7.107-2(a)(1))

• Description of Market Research:

The Office of the Chief Information Officer (OCIO) conducted thorough market research in FY 2025 Q3 in accordance with FAR Part 10 guidelines to find a contractor suited for this innovative direction.

Our strategic approach to sources began with an initial survey of mandatory sources during the planning process. This strategy was designed to evaluate the capabilities of various socio-economic entities for set-aside opportunities, aiming to fulfill the FCC's small business goals without compromising technical performance. In compliance with FAR Part 8.002(a)(2), we reviewed potential sources for the work. During the planning process, we satisfied the requirements of FAR Part 8.002(a)(2) and determined that no mandatory sources can fulfill this requirement. Our initial survey revealed that Federal Prison Industries and Ability One do not provide the necessary IT Security services.

Regarding non-mandatory sources, we identified several Government-Wide Agency Contracts (GWAC) and Federal Supply Schedules (FSS) that offer commercial IT services. These include the General Services Administration (GSA) Alliant 2 (Alliant – Large & Small Business), The National Institute of Health’s Information Technology Acquisition and Assessment Center (NITAAC) Chief Information Officer (CIO) Solutions and Partners 3 (SP3) also known as CIO-SP3, GSA Multiple Award Schedule (MAS) Special Item Number (SIN) 54151S,GSA VETS II, and GSA Highly Adaptive Cybersecurity Services (HACS) - MAS.

In accordance with FAR Part 8.0004, we researched GSA FSS and GWAC vehicles to determine whether an existing contract vehicle could satisfy the required services. We identified five (5) existing contract vehicles that may support the requirement:

• GSA Highly Adaptive Cybersecurity Services (HACS) – MAS

• GSA Alliant 2

• National Institute of Health’s Information Technology Acquisition and Assessment

Center (NITAAC) Chief Information Officer (CIO) Solutions and Partners 3 (SP3), also known as CIO-SP3 – GWAC

• GSA Multiple Award Schedule (MAS) SIN 54151S – FSS

• GSA VETS II

• Key Findings Relevant to Consolidation:

o Market research, including reviews of GSA’s Highly Adaptive Cybersecurity Services (HACS) vendor confirms that there is a robust vendor base that is capable of meeting the consolidated requirement. Consolidation enables a better security outcome. A single, centralized contract enables holistic security monitoring, streamlines cybersecurity standardized reporting and incident response which all lead to a stronger cybersecurity posture. It also allows the FCC to manage risk more effectively across its environment.

o The Government recognizes the importance of preserving small business participation, the market research focused on such participation. The GSA Highly Adaptive Cybersecurity Services (HACS) is a small business set-aside Government-Wide Acquisition Contract (GWAC) that offers tailored IT security solutions from a diverse pool of industry partners. This contract vehicle is the best suited due to its specific cybersecurity offerings and the alignment of its subcategories with the FCC. HACS covers a wide range of fields, including seven-step Risk Management Framework services, virus detection, zero trust architecture, and network management which are aligned with critical cybersecurity functions. Examples of HACS subcategories aligning with FCC requirements are High-Value Asset assessments, penetration testing, incident response, and cyber hunt.

o There are 559 Small Businesses under the HACS GWAC, with 373 located in the DMV area, that possess the necessary skills and capabilities to meet the FCC’s requirements.

o Securing services through small businesses (SB) set-aside, with General Services Administration (GSA) Highly Adaptive Cybersecurity Services (HACS) credentials, presents a low-risk option. These contractors have demonstrated the necessary skills and capabilities to meet FCC requirements. The analysis in 2025 included contractor outreach, reviewing past performances of the vendors noted in Table 1 of the market research report and examining their websites. All of the vendors identified in table 1 affirmed the viability of a small business set-aside under GSA HACS. No significant concerns were encountered regarding business operations, trade, or compliance with environmental and safety regulations.

o Cost and Resource Efficiencies – Consolidating services under one contract is expected to reduce duplication in program management and control by $2,000,000 over the life of the purposed contract. Also, $7,000,000 will be saved by integrating the network security operation center (NSOC) and the virtual security operations center (VSOC) capabilities into an unified service within CSS.

These savings can be reinvested into capability enhancements and innovations.

2. Identification of Alternative Contracting Approaches (FAR 7.107-2(a)(2))

• Alternatives Considered:

o As part of the acquisition planning process, the Government considered multiple alternative contracting strategies that involved a lesser degree of consolidation.

One alternative contracting approach is to continue with the current contract structure and re-compete the work that is in the current NSOC contract and execute the option years on the SPS contract. This approach is not in the best interest of the Government and was not selected because it duplicates work and creates inconsistencies in service delivery with a complex management and performance structure.

o The Government considered establishing a single vendor Blanket Purchase Agreement (BPA) under an existing GSA Multiple Award Schedule.

• Reason for Non-Selection of Alternatives:

o Continuing services as a separate standalone contract is less beneficial than the proposed consolidation because the reporting structures are inconsistent, the performance standards do not align across contracts for the same program areas, and inefficiencies are added when both contractors expect the other contractor to perform the work of updated requirements.

o Segregated contracts introduce risk by impacting the Government’s ability to align cross-functional security activities. Keeping the contracts as two separate efforts, where the contractor use different workflow and reporting formats, makes it difficult to ensure unified governance.

Although BPAs can streamline procurement in some cases, managing a BPA that issues separate task orders for each need can introduce delays, duplicative documentation and administrative overhead. In a rapidly evolving cybersecurity threat environment, the FCC requires a contract model that ensures immediate responsiveness and seamless support.

3. Coordination with Office of Small Disadvantaged Business Utilization (OSDBU) / Office of Small Business Programs (OSBP) (FAR 7.107-2(a)(3))

• Date(s) of Coordination: The FCC Small Business Office has coordinated on the requirement, 7/14/2025.

• FCC OSBP Representative(s) Contacted: Susan Nicholson, FCC Small Business Specialist, Summary of Coordination and Feedback: The current strategy was reviewed and discussed with Key Stakeholders. It was agreed that the benefits are as described in the MRR and Acquisition Strategy. There are no concerns as this procurement will remain with Small Business. Finally, this acquisition is in the spirit of Executive Order (EO) 14240, "Eliminating Waste and Saving Taxpayer Dollars by Consolidating Procurement," by using the GSA MAS identified herein. The GSA HACS is considered a BEST IN CLASS and supports Government-wide priorities.

4. Identification of Negative Impact on Small Business Concerns (FAR 7.107-2(a)(4))

• Potential Negative Impact:

• The consolidation will not have a negative impact on small business concerns. The proposed contact consolidation is being executed in a manner that preserves meaningful opportunities for small business participation. The procurement will be conducted under FAR Part 8, leveraging the GSA Highly Adaptive Cybersecurity Services (HACS) Special Item Numbers (SINs), which include provisions for small businesses. This vehicle is specifically designed to promote small business inclusion for cybersecurity procurements. Quantification (if feasible):

o The approach is anticipated to enhance small business access by simplifying procurement through an established GSA schedule and enabling the government to engage with multiple small business vendors under a single, cohesive framework. As a result, the consolidation is not expected to have a measurable adverse impact on the ability of small businesses to participate in the federal cybersecurity market.

5. Steps Taken to Include Small Business Concerns in the Acquisition Strategy (FAR 7.107- 2(a)(5))

• Mitigation Strategies:

o Small business concerns were considered throughout the acquisition strategy and was a significant factor in selecting the specific GWAC to use. GSA Highly Adaptive Cybersecurity Services (HACS) is a small business GWAC, and the best suited in the Federal marketplace due to its specific cybersecurity offerings.

Using HACS will ensure the award goes to a small business, and meets the requirements.

The broader acquisition approach used a survey of mandatory sources that aimed to assess the capabilities of various socio-economic concerns for set-aside opportunities to satisfy FCC small business goals without compromising technical performance. The survey of mandatory sources determined that Federal Prison Industries and Ability One do not offer the required type of IT services. Non-mandatory sources that were considered, not selected, and that also focus on small businesses include:

GSA Alliant 2 - The Alliant 2 Small Business contract was canceled. To maximize small business participation, Alliant 2 will not be used.

National Institute of Health’s Information Technology Acquisition and Assessment Center (NITAAC) Chief Information Officer (CIO) Solutions and Partners 3 (SP3), Small Business (SB), also known as CIO-SP3 SB – CIO-SP3 SB was considered and determined to not be sufficiently specialized in cyber security.

GSA VETS II – GSA VETS II is exclusively for service-disabled veteran-owned small business firms and was determined to lack specific cybersecurity expertise.

• Expected Small Business Participation:

o The expected level of small business participation under the proposed consolidated acquisition is available under the GSA Highly Adaptive Cybersecurity Services (HACS) programs, which include a small business set-aside Government Wide Acquisition Contract (GWAC) that offers unparalleled access to tailored IT security solutions from a diverse, pre-vetted pool of small business industry partners.

o With 559 small business vendors under the HACS GWAC, and 373 located in the DC-Maryland-Virginia (DMV) area, the expected level of small business participation is considerable. The availability of this market base ensures that while the number of prime small business awards may decrease due to consolidation, the depth, quality, and dollar value of small business participation can be preserved and potentially enhanced under a consolidated structure.

o To ensure a competitive yet manageable vendor pool and to avoid unnecessary administrative burden, the pool was narrowed down to 3-5 qualified small business vendors using the procedures outlined under FAR Part 8.4 (See Vendor Pool, Table 1 MRR). These procedures support streamlined acquisitions under the GSA Schedule and allow for effective competition while complying with small business participation goals. To establish the list of vendors to be considered, some certification criteria were used. Eligible SBs should:

1. Have an active registration in SAM.gov at the time of proposal submission

2. Hold GSA HACS GWAC contracts under Special Item Number (SIN)

54151HACS

o Additionally, eligible offerors must possess certifications in all HACS subgroups, including: (High-Value Asset Assessments, Penetration Testing, Risk and Vulnerability Assessments, Incident Response and Cyber Hunt).

The solicitation should be reserved for Small Businesses (SBs) using FAR Part 8 to obtain the best value for the government, and to foster competition while meeting the SBA Size Standards for NAICS 541519 (Other Computer Related Services).

IV. Necessity and Justification for Consolidation (FAR 7.107-2(b) and (c))

The consolidation of these requirements is determined to be necessary and justified because the benefits of this acquisition substantially exceed the benefits that would be derived from each of the alternative contracting approaches identified under paragraph (a)(2) of FAR 7.107-2.

A. Substantial Benefits (FAR 7.107-2(c))

The following benefits are anticipated from this consolidation:

• Cost Savings or Price Reduction:

o Estimated cost savings of approximately $7 million over the life of the contract, representing an approximate 18% reduction due to economies of scale in management, reduced administrative overhead, and optimized resource allocation.

• Quality Improvements:

o By integrating previously separate contract efforts under one (1) vendor, the Government will be better positioned to ensure consistent service delivery and strategic alignment with FCC cybersecurity goals, instead of having different contracts with varying performance requirements.

o Having a single point of accountability for contract execution, issue resolution, and performance reporting across the cybersecurity program will increase efficiency. Miscommunication will be reduced, and oversight will be less fragmented.

o Consolidation allows for standardized reporting and data flow, giving the FCC improved performance in real-time visibility into cybersecurity posture across all service areas.

• Reduction in Acquisition Cycle Times:

o Historically, the need to manage multiple separate solicitations including distinct acquisition packages, evaluation teams, award documents and approval chains has extended procurement timelines and delayed project execution. Under a consolidated approach, the Government will eliminate the need to issue and manage two separate solicitations and subsequent contracts, which often require overlapping acquisition schedules and coordination among multiple teams.

o The average acquisition lifecycle for each previously cybersecurity contract was approximately 6-8 months per action from planning through award. The consolidation is expected to reduce the overall cycle time by at least 5-6 months by:

1. Reducing the number of acquisition packages requiring approval.

2. Consolidate legal, policy, and technical reviews.

3. Eliminating duplicative solicitation development.

4. Minimizing procurement lead times for modifications and task initiation under a unified contract

• Better Terms and Conditions:

o The consolidated contract represents a broader and more comprehensive requirement than the two (2) legacy contracts it replaces. As a result, this effort provides the Government with greater leverage to enforce uniform FAR Clauses, cybersecurity standards and reporting formats across all service areas. These correct inconsistencies that previously existed among the separate contracts, enhances compliance, and simplifies oversight.

o The acquisition strategy is formed by the structure of the GSA’s Highly Adaptive Cybersecurity Services (HACS) program. Vendors under HACS have demonstrated capability in delivering mission critical cybersecurity services and are already subject to pre-negotiated terms, and federal cybersecurity compliance requirements.

Engaging vendors from this market provides a strong baseline for negotiating fair and reasonable terms that align with FCC’s objectives.

Any Other Benefit:

o In addition to improved quality, streamlined acquisition timelines and enhanced small business participation, other benefits are the single point of accountability for contract execution, issue resolution and performance reporting, reducing miscommunication and fragmented oversight. Consolidation allows for standardized reporting and data flow, giving the FCC real-time visibility into cybersecurity posture across all service areas.

o With one contract responsible for the full scope, the Government benefits from retained institutional knowledge and more consistent personnel, rather than onboarding new teams under separate contract. The continuity improves response time, institutional familiarity and operational maturity.

o The consolidation allows FCC to implement changes, policies or strategies across the full cyber environment without needing to coordinate across multiple vendors or contract vehicles.

B. Quantification of Benefits (FAR 7.107-2(d))

While consolidation may reduce the number of small businesses from two (2) to one (1), the Government has taken proactive steps to ensure substantial small business participation through the use of HACS qualified small business firms. Market research confirms a large vendor base is capable of performing under a consolidated model.

1.Increases Operational Integration and Efficiency 2.Improves Oversight and Accountability

3. Reduces Acquisition Cycle Time

4. Improves Quality and Continuity of Services

1. Quantifiable Dollar Amounts (FAR 7.107-2(d)(1))

The anticipated financial benefits are equivalent to:

• Estimated Contract/Order Value: $32,000,000

• Calculated Financial Benefit:

o Estimated contract value is less than $94 million, so the calculated financial benefit threshold is 10% of the estimated value, which is $3.2 million. The anticipated financial benefits of $7 million exceed the 10% threshold of the estimated contract value of $32 million, thus meeting the substantial benefit criteria.

2. Non-Quantifiable Benefits (FAR 7.107-2(d)(2))

While not directly quantifiable in dollars, there are many benefits to consolidation, as described below.

• Defining a holistic cybersecurity services program under a single contracted requirement enables the FCC to more effectively align requirements through a unified approach to risk and vulnerability assessments, penetration testing, cyber hunts, and incident response.

These requirements align with FCC mission to enhancement of software supply chain security, establishment of a cyber safety review board, detection improvements of cybersecurity incidents, and implementing a unified approach to risk and vulnerability assessments, penetration testing, cyber hunts, and incident response.

• Having two vendors responding to changes in the IT environment previously created delays due to the need for coordination between multiple parties, resulting in slower response times when addressing cyber threats. In the new environment, with a single vendor, the feedback loop will be significantly shortened. This streamlined communication allows for faster detection, response, and mitigation of cyber incidents, as interactions now occur between the Government and one contractor instead of multiple vendors. Historically, coordinating between multiple vendors led to an average response time ranging from 30 minutes to several hours. With the transition to a single vendor, we expect to reduce this response time to just 10 minutes, based on similar implementations in other federal agencies.

• Moving from a traditional on-site model to a hybrid multi-cloud, vendor-managed solution is a pivotal shift for the FCC's cybersecurity framework that can be executed with higher efficiency under a single vendor. This transition is necessary due to technological advancements and the FCC's move towards a multi-cloud IT environment.

• The migration to a single vendor-managed format for cybersecurity support services will significantly enhance the Federal Communications Commission's (FCC) cybersecurity posture. Key benefits include:

o Operational Efficiency: By reducing duplicate work orders from single incidents, the FCC can streamline changes in the IT environment, ensuring faster and more coordinated responses to cyber threats.

o Congruity and Efficiency: The CSS approach ensures uniformity in workflows and processes, which is crucial for maintaining a robust cybersecurity defense.

o Cost Efficiency: The current annual cost of the Network Security Operations Center (NSOC) and Virtual Security Operations Center (VSOC) is approximately $5.2 million. The proposed CSS solution pertaining to NSOC and VSOC work is estimated at approximately $4.4 million per year, resulting in an average annual savings of approximately $800,000. Over the entire contract period, combining the NSOC and VSOC savings with all personnel cost savings, including five years and the extension of services, the total savings amount to approximately $7 million.

o Performance and Reliability: Enhanced performance and reliability through consistent application of security measures and protocols.

o Compliance with Federal Information Security Modernization Act of 2014 and

OMB CIRCULAR NO. A-130.

• Integrating previously separate contract efforts under one (1) vendor, the Government will be better positioned to ensure consistent service delivery and strategic alignment with FCC cybersecurity goals, instead of having different contracts with varying performance requirements.

• In addition to improved quality, streamlined acquisition timelines and enhanced small business participation, other benefits are the single point of accountability for contract execution, issue resolution and performance reporting, reducing miscommunication and fragmented oversight. Consolidation allows for standardized reporting and data flow, giving the FCC real-time visibility into cybersecurity posture across all service areas.

• With one contract responsible for the full scope, the Government benefits from retained institutional knowledge and more consistent personnel, rather than onboarding new teams under separate contracts. The continuity improves response time, institutional familiarity, and operational maturity.

• The consolidation allows FCC to implement changes, policies or strategies across the full cyber environment without needing to coordinate across multiple vendors or contract vehicles.

3. Administrative/Personnel Cost Reduction (FAR 7.107-2(d)(3))

• The market research has determined that the price of service would be reduced by $800K per year. This affords FCC a cost savings of 15% and enhances cybersecurity performance by shifting NSOC/VSOC services from a traditional on-site model to a hybrid multi-cloud, vendor-managed solution.

V. Determination

Based on the market research, analysis of alternative contracting approaches, coordination with the Office of Small Business Programs, identification of potential small business impacts and mitigation strategies, and the comprehensive assessment of benefits, I hereby determine that the consolidation of requirements for OCIO Cybersecurity Program/ Cybersecurity Support Services is necessary and justified in accordance with FAR 7.107-2. The benefits of this acquisition substantially exceed those derived from alternative contracting approaches, and steps have been taken to ensure maximum practicable participation by small business concerns.

VII. Approvals

Coordination with Office of Small Disadvantaged Business Utilization (OSDBU) / Office of Small Business Programs (OSBP)

Susan Nicholson, Small Business Specialist, Federal Communications Commission

Sunny Diemert, Senior Procurement Executive (SPE) / Chief Acquisition Officer (CAO), Federal Communications Commission