4-2c limited Source Justification Redacted.pdf

220 BINNEY

CAMBRIDGE, MA 02142

Volpe.DOT.gov

Justification for an exception to fair opportunity

Noncompetitive Logical Follow-on Task Order Issued Under a Government-Wide Acquisition Contract (GWAC) Exceeding the Simplified Acquisition Threshold (SAT)

This acquisition is conducted under the authority of the Clinger-Cohen Act of 1996, of which the primary statutory referenced authority is 40 U.S.C. 11302(e) which specifically authorizes Government-Wide Acquisition Contracts (GWACs) for information technology programs, operated by U.S. Office of Management and Budget (OMB)-designated executive agents.

I. Contracting Activity.

Agency: U.S. DOT Volpe National Transportation Systems Center Office: V-222, Operations and Simplified Acquisitions Branch Contact: Christopher Dooley, Acquisitions Branch Chief & Contracting Officer

Phone: (857) 998-2257 | e-mail: christopher.dooley@dot.gov

II. Nature and/or description of the action being processed.

Contractor: VersaTech Inc., 8510 Corridor Rd, #200, Savage, MD 20763-9505 Point of Contact: Jason Peay | contracts@versatechinc.com Contract Type: Firm-Fixed-Price Period of Performance: 12-month base period with 12-month option period

III. Description of supplies/services required to meet agency needs.

The Volpe National Transportation Systems Center (Volpe Center) requires contractor support to conduct comprehensive security assessment services for its Cybersecurity Program. The contractor shall evaluate the effectiveness of existing security controls, identify vulnerabilities and gaps, and verify compliance with applicable laws, regulations, and policies. The assessment will deliver actionable findings and prioritized remediation recommendations to strengthen Volpe’s security posture, mitigate risk, and enhance its information assurance framework in support of the Center’s ongoing mission to protect critical systems and information.

Independent Government Cost Estimate (IGCE):

Period of Performance: The period of performance consists of a 12-month base period and a 12-month option period. Across both the base and option periods, the contractor will perform cybersecurity assessments or Cyber Maturity Assessment (CMA) revisions on up to 10 systems, including optional system assessments based on agency needs.

CAMBRIDGE, MA 02142

Volpe.DOT.gov

IV. Justification/Rationale for Limiting Sources & Demonstration of Contractor's Unique Qualifications

In accordance with DOT Class Deviation 2026-14, dated October 27, 2025, the U.S. DOT implements the Federal Acquisition Regulatory Council’s model deviation text to FAR Part 16 under the Revolutionary FAR Overhaul (RFO Part 16). RFO 16.507-2 requires an order to be placed on a fair opportunity basis unless supported by a written determination that one of the circumstances described in RFO 16.507-6(b)(3) applies and the requirement is exempted based on a justification prepared per RFO 16.507-6(d).

Per RFO 16.507-6(b)(3), an agency is authorized to issue a sole-source task order under an Indefinite Delivery, Indefinite Quantity (IDIQ) contract under the following circumstance:

“The order must be issued on a sole-source basis in the interest of economy and efficiency because it is a logical follow-on to an order already issued under the contract, provided that all awardees were given a fair opportunity to be considered for the original order." (RFO 16.507- 6(b)(3))

Original Award: Comprehensive Cybersecurity Risk Assessment Services and Program Support IDIQ Contract No.: 75N98119D00077 | Task Order No.: 6913G625F50027N Competition History: The original order was awarded with documented adequate competition under fair opportunity procedures.

The previous task order was awarded to VersaTech Inc. on August 15, 2025, with a 7-month period of performance. Subsequently, DOT policy mandated that Volpe migrate all program systems from NIST 800-53 Rev 4 to Rev 5. This requirement was outside the scope of the original task order, and the required level of effort was not fully defined at the time. The initial 7-month task order served as a short-term, low-value stop gap action to prevent a gap in critical security coverage and maintain basic operational continuity. Because original IDIQ contract holders were competitively solicited under fair opportunity procedures for ongoing cybersecurity assessment services under the primary contract framework, a logical follow-on requirement for expanded compliance updates was reasonably foreseeable to all awardees.

Furthermore, the foreseeability of logical follow-on actions is an established authority and core operational benefit of the NITAAC CIO-SP3 GWAC framework. NITAAC’s public-facing program guidance and FAQ resources explicitly highlight the issuance of logical follow-on task orders as an allowable, streamlined, and beneficial acquisition strategy for ordering agencies under FAR 16.505 (and applicable agency class deviations).

The increase in value from the initial task order to the proposed IGCE ($ ) directly reflects scaling the mandatory NIST SP 800-53 Rev 5 migration and assessment services across up to 10 enterprise systems over a full annual operational cycle.

CAMBRIDGE, MA 02142

Volpe.DOT.gov

Awarding this follow-on requirement to a new contractor would result in a substantial duplication of costs, estimated between $125,100 and $145,100, that would not be recovered through competitive procurement. These costs stem directly from redundant onboarding, technical orientation, and administrative environment setup required for an alternate vendor to reach the baseline level of system familiarity currently maintained by the incumbent, VersaTech Inc.

Onboarding & Administrative Processing ($45,000 – $65,000): Personnel onboarding and clearance re-verification for an alternate contractor requires 60 to 90 days for full background vetting, compared to 30 to 60 days for incumbent personnel re-verification.

This net 30-day delay creates an unrecoverable cost impact broken down as follows:

o Lost Labor Productivity ($35,000 – $50,000): During the additional 30-day clearance window, non-cleared replacement personnel cannot access live DOT system environments or Controlled Unclassified Information (CUI). Operating at an estimated 50% productivity loss (restricted to reviewing public documentation offline while awaiting PIV card provisioning and suitability determinations) results in 480 hours × 50% unproductive rate × $165/hour average = ~$39,600 to $49,500 in unrecoverable labor costs paid for delayed operational output.

o Federal Administrative Overhead ($10,000 – $15,000): Direct government labor expended by DOT Personnel Security, COR, and acquisition personnel to process initial suitability vetting, fingerprinting, and badge credentialing for a non-incumbent workforce. This is estimated at 60 to 80 hours of federal labor time ($120 to $150/hour fully burdened government rate) plus credentialing fees, totaling approximately $8,000 to $12,000.

System Technical Orientation & Tooling Setup ($80,100):

o Technical Orientation ($57,600): A new contractor would require approximately

320 labor hours (four senior subject matter experts devoting 80 hours each) to review architecture profiles across up to 10 enterprise systems. At a fully burdened rate of $180/hour, this represents $57,600 in duplicative labor costs solely for system orientation—costs that VersaTech Inc. incurs at $0 due to their active baseline knowledge.

o Environment Provisioning ($22,500): Configuring new IT access roles, security assessment tools, and environment provisioning for a non-incumbent introduces an additional $22,500 in redundant administrative labor.

Operational & Security Compliance Risk: Beyond direct financial duplication, transitioning to a new source would introduce a 60-to-90-day operational blind spot while new staff are cleared and oriented. Disrupting ongoing security assessment cycles creates significant operational risk and directly jeopardizes the agency’s ability to maintain continuous compliance with FISMA, NIST Risk Management Framework (RMF), and mandatory federal cybersecurity standards. Retaining the incumbent under logical follow-

CAMBRIDGE, MA 02142

Volpe.DOT.gov on authority avoids these duplicative expenditures and ensures uninterrupted protection of critical agency systems.

V. Determination by the Contracting Officer of Fair and Reasonable Cost

Under NITAAC CIO-SP3 GWAC Contract No. 75N98119D00077, labor categories and maximum hourly rates were negotiated at the master contract level and determined fair and reasonable. Prior to awarding this follow-on task order, the Contracting Officer will evaluate VersaTech’s proposed level of effort and labor mix against the IGCE. The Contracting Officer will complete a formal price reasonableness determination before award

VI. Description of the market research conducted and the results.

Volpe Center technical and acquisition personnel (V220 and V230) conducted market research between November 2025 and February 2026. Market research included querying the Small Business Administration (SBA) Dynamic Small Business Search (DSBS) database and reviewing available GWAC vendor listings. DOT’s historical source, the CSIPS Blanket Purchase Agreement (BPA), expired in 2025 and is unavailable. Additionally, technical staff consulted with acquisition and technical personnel across other federal agencies, held exploratory discussions with industry experts, and evaluated current market trends and cybersecurity assessment methodologies

Following this analysis, utilizing the NITAAC contract vehicle—designated as a Best in Class (BIC) solution—was determined to represent the lowest-risk, most cost-effective, and most efficient acquisition pathway.

VII. Other Facts Supporting the Justification

Awarding his requirement to VersaTech, Inc., a small disadvantaged business concern, as a logical follow-on order is necessary to maintain operational continuity and avoid duplicative costs. This strategy is justified under RFO 16.507-6(b)(3) based on the following:

1. Logical Relationship: Per RFO 16.507-6(d)(1), the logical relationship is established through direct scope alignment and task continuity. VersaTech will execute the same core taskings—delivering security assessments on new systems while conducting follow-up Cyber Maturity Assessments (CMAs) on previously evaluated systems.

2. Continuity of Operations: Transitioning to a new vendor would delay critical assessment cycles, increase operational risk, and jeopardize compliance with FISMA, NIST RMF, and federal mandates.

CAMBRIDGE, MA 02142

Volpe.DOT.gov

3. Proven Capability: VersaTech’s performance history provides high confidence in their ability to continue delivering compliant cybersecurity services without performance risk.

4. Cost Efficiency: Retaining the incumbent avoids redundant onboarding, training, and ramp-up costs as described above in paragraph IV.

5. Risk Mitigation: VersaTech is vetted under the NITAAC GWAC, possesses active tool/environment clearances, and meets all CUI handling and security requirements.

6. Regulatory Compliance: This action satisfies RFO 16.507-6(b)(3) criteria for logical follow-on task orders following a competitive initial award.

VIII. Actions to Remove or Overcome Barriers to Competition

The reliance on noncompetitive procedures is driven by a temporary, one-time system migration from NIST 800-53 Rev 4 to Rev 5, which required specialized baseline system knowledge and created short-term operational urgency. To ensure long-term competition and facilitate an orderly transition, the agency will execute the following strategy:

Ongoing Market Research & Competitive Re-Procurement: The Government will continuously conduct market research to identify potential contractors and track marketplace changes to maximize competition for future cybersecurity assessment requirements. Once the Volpe Center completes the baseline NIST SP 800-53 Rev 5 migration and reaches a steady-state operating environment, future operations and maintenance requirements will be competitively re-procured or transitioned to DOT OCIO shared services.

Option Period Rationale & Non-Exercise Guardrail: Given that the planned transition to DOT OCIO shared services is in its early development stages with full implementation targeted for mid Fiscal Year 2028 (FY28), there is reasonable confidence that the 12-month option period will be required and exercised to ensure continuous security coverage and regulatory compliance throughout this transition window. Inclusion of the option period provides necessary operational flexibility during this multi-year timeline;

however, as a safeguard to maximize competition, if a steady-state environment is achieved and either a competitive replacement contract or the DOT OCIO shared services capability becomes operational prior to the end of the 12-month base period, the Contracting Officer will not exercise the option period.