JA ITOPS TSS_Redacted.pdf

Information Technology Operations and Control Number VA-24-00097911 Services Transformation Support Services Extension

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed sole source action is for a modification to the hybrid Firm-Fixed-Price (FFP) and Time-and-Materials (T&M) Task Order (TO) 36C10B19N10070015 for Information Technology Operations and Services (ITOPS) Transformation Support Services (TSS) issued under Transformation Twenty-One Total Technology Next Generation (T4NG) Contract VA118-16-D-1007 with Booz Allen Hamilton (BAH). The purpose of this modification is to extend the period of performance of Option Period Four for two months and incorporate one additional two-month option period for the continuation of ITOPS TSS. This extension will serve as a bridge of support until a new competitive TO is awarded.

3. Description of the Supplies or Services: The scope of the ITOPS TSS TO is to provide Information Technology (IT) enterprise support services in order to sustain operations and Office of Information and Technology (OIT) remediation support services; these services include program/project management; systems, application, and database administration; software/system technical support; cyber security; and disaster recovery. IT is constantly evolving and therefore the required support services evolved throughout the TO period of performance to support consolidating, transforming, and modernizing IT services across the enterprise. The VA IT infrastructure supports mission critical health care and benefits delivery for the Nation’s Veterans and must be operational 24x7x365. The nature of its mission and its sheer size makes VA a target for adversaries and cyber-attacks. The IT environment must be sufficiently resilient to thwart relentless cybersecurity attacks and constantly maintain continuity of operations. Services under the current TO include operational infrastructure and information security protection support services necessary to support VA to address information system security vulnerability components, ensuring information security risk controls are implemented and monitored, audit reporting, and remediation activities in response to the Federal Information Security Management Act (FISMA) and the Federal Information System Controls Audit Manual (FISCAM). Critical support is provided for the following: Contractor On-Site/Enterprise End User Services (EUS)/Operations (EUO) and Enterprise Cyber Security Program (ECSP) support remediation efforts, Baseline Configuration Management reviews and updates, VA’s Assessment and Authorization support services, and operational support to VA’s Specialized Device Cybersecurity Department (SDCD) for securing VA specialized devices and medical devices. These are mission critical activities. This support consists of 1,297 Contractor staff supporting 11 VA teams responsible for Service Requests (SR). SR are an overall term for alignment of effort and are used with the T&M effort for specific projects to allocate hours and people to each workstream. The following are the current SRs being supported by BAH that are required to continue until the follow-on TO is awarded and transitioned: 1) SR01 for Continuous Readiness in Information Security Program Remediation Support, 2) SR04 for Enterprise Performance Monitoring Support, 3) SR05 for Cyber Workforce Management, 4) SR06 for Vulnerability Management, 5) SR07 for Executive Views and Dashboards (Material Weakness), 6) SR08 for Supply Chain Cyber Security Management, 7) SR14 for Major Incident Case Management Resources, 8) SR15 for Application Control Program, 9) SR16 for Specialized Device Risk Management, 10) SR17 for Electronic Health Record Management EUD Deployment, and 11) SR18 for FISMA Containerization Asset to Boundary.

A critical function of the ITOPS TSS TO is to reduce the number of existing vulnerabilities to a level that will remove the long-standing Material Weakness (MW) in VA’s annual FISMA audit, resulting from security vulnerabilities which may lead to the theft or leakage of Veterans’ privacy information. In response to the MW findings from the FISMA annual audit, continuous support is required across all of the pillars within OIT including the Office of Information Security’s ECSP which supports the Information Security Programs and Logistics, Information Security Policy and Strategy, and Information Security Operations service lines. Additionally, continued support is required for EUS, comprised of EUO, and Infrastructure Operations, as well as Office of People Science to support the implementation of all recommendations identified in the FISMA and FISCAM audits. These requirements are all mission critical. As such, OIT requires that the current services outlined above, under TO 36C10B19N10070015, continue without interruption.

On May 17, 2019, the TO was awarded to BAH on a competitive basis under fair opportunity procedures on the T4NG vehicle, consisting of a 12-month base period beginning on September 23, 2019, with 4 12-month option periods and 1 60-day optional task for transition support. Subsequently, on September 14, 2023, the final option period was exercised and currently expires on September 22, 2024. Therefore, the overall period of performance shall be extended from 60 months to 64 months and will commence September 23, 2024, go through November 22, 2024, and incorporate 1 additional 2-month option period for continued support through January 22, 2025, if needed, to provide a seamless transition. The total estimated value of the proposed action is . However, there is unused ceiling from the original TO award that will cover the extension, inclusive of the option period. As such, the overall TO value will remain the same at .

4. Statutory Authority: The statutory authority permitting an exception to fair opportunity is Section 41 U.S.C. 4106(c)(2) as implemented by the Federal Acquisition Regulation (FAR) 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: The proposed source for this action is BAH, 1 Christopher Way, 13 STE 200, Eatontown, NJ 07724. BAH is currently fulfilling the TSS requirements under the existing TO. VA is in the process of competitively awarding a new competitive TO. Although requirement development for the competitive TO began in the first quarter of fiscal year (FY) 2024, unforeseen circumstances have delayed the solicitation release to mid-September, with an award projected in the first quarter of FY 2025 in November 2024. This timeline extends at least two months beyond the current TO expiration date. Once the competitive contract is awarded, there is also a need for at least 60 days of overlap to support a seamless transition of the services to a new vendor, as planned in the original TO award. For these reasons, OIT requires support provided by BAH beyond its current end date of September 22, 2024.

A Request for Information (RFI) was posted on the Contract Opportunities site via SAM.gov on March 21, 2024. On April 1, 2024, 18 responses were received as well as 29 questions and recommendations on the Performance Work Statement (PWS). Based on the large number of RFI responses, compounded with the scope and complexity of multiple VA service lines involved in reviewing and addressing the RFI questions and recommendations, carrying over the resultant answers to the PWS and updating the applicable acquisition package documentation took much longer than originally anticipated, causing delays in completing the acquisition package. Further delays in the solicitation release are attributed to strategic changes in the planned work under the follow-on TO, TSS 2.0. In June 2024, it was determined that a significant portion of EUS tasks would be split off from TSS and require a separate TO on a different vehicle to address some key labor categories and EUS's specific Objectives and Key Results. TSS lacked the specific contract agility that EUS needed for its support such as field support, enterprise help desk functions, portfolio management, etc. That contract is currently projected to be awarded in September 2024. As a result, VA Leadership reviewed and identified significant duplications of effort in both acquisitions, necessitating a thorough review and separation of efforts between the TSS and EUS tasks. This required multiple comprehensive line-by-line reviews of the PWS and the IGCE, along with revisions to all ancillary documents to align with the TSS efforts.

Given these delays, OIT requires the support provided by BAH to continue beyond its current end date of September 22, 2024, until the TSS 2.0 TO is awarded in Fiscal Year 2025, November 2024 timeframe. Subsequently, VA needs to plan for the time and effort for the offboarding activities and transitioning services which must occur and are anticipated to take approximately 60 days. As resources are fully onboarded, the transition tasks will commence. The awardee needs to work hand in hand with these organizations to orchestrate a smooth transition which would include understanding specific actions that need to be performed, beginning to perform these functions, and receiving feedback while initially performing the functions. Offboarding will occur during the transition time while Contractors are being onboarded. Offboarding activities include out briefings, the sanitization of the Contractor equipment, and the return of Government Furnished Equipment.

Without this continuation of services, VA’s systems will be open to critical vulnerabilities.

Identifying prohibited and unapproved software will not be accomplished. Localized Provided By Client artifacts and Governance, Risk, and Compliance documentation