Signed Final_Legal_SOLE_SOURCE_JOTFOC_ECS_Bridge.pdf

SOLE SOURCE JUSTIFICATION FOR AN URGENT

AND COMPELLING, 8(a) DIRECT AWARD TO AN

ALASKA NATIVE CORPORATION (ANC)

Enterprise Cybersecurity, Privacy, Controlled Unclassified Information, and Records

Management Support Services

In accordance with FAR 6.302-5(b)(4), FAR 6.302-2(a)(2) and FAR 6.303-2

1. Agency and Contracting Activity

This justification is prepared by the U.S. General Services Administration (GSA), Federal

Acquisition Service (FAS), Office of Centralized Acquisition Service (OCAS) on behalf of the

U.S. Small Business Administration (SBA), Office of the Chief Information Officer

(OCIO), Information Security Division (ISD). The proposed acquisition will be executed by

GSA under the authority of FAR 6.302-5(b)(4), Authorized or Required by Statute, in support of

SBA’s mission-critical cybersecurity and information protection requirements. In addition to this contract action being authorized by statute, the circumstances surrounding the requirement are critical to the entire enterprise IT infrastructure security; and, therefore, the need to have no lapse in contract coverage also represents an unusual and compelling urgency in accordance with FAR

6.302-2(a)(2).

2. Nature and/or Description of the Action Being Approved

GSA intends to award a firm-fixed-price contract on a sole source basis to Chenega Systems, LLC (Chenega), an Alaska Native Corporation (ANC) and SBA-certified 8(a) participant, for Enterprise Cybersecurity, Privacy, Controlled Unclassified Information (CUI), and

Records Management Support Services.

The estimated value of this one-year effort is $12,152,654.53. The period of performance will not exceed one (1) year, inclusive of any options.

This action constitutes an 8(a) direct award authorized by statute and implemented under 13

CFR 124.506(b) and FAR 19.805-1(b)(2), permitting direct awards to eligible ANC-owned firms regardless of contract value. In addition, the circumstances surrounding this requirement are critical to SBA that it also represents an unusual and compelling urgency in accordance with

FAR 6.302-2(a)(2).

3. Description of Supplies or Services Required

Docusign Envelope ID: 5BB399A0-BA38-4315-941E-E047B9F7D49B

The U.S. Small Business Administration (SBA) provides value-added services to the small business community. The SBA Office of the Chief Information Officer (OCIO), Information

Security Division (ISD), supports this mission by delivering cybersecurity, privacy, CUI, and records management services throughout the enterprise.

At a high level, SBA’s information technology (IT) ecosystem consists of a 20,000-node Multi-

Protocol Label Switched (MPLS) infrastructure, two on-premises data centers, approximately seventy field offices, and multiple cloud environments. The SBA also consumes computer resources from Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) providers, and leverages approximately forty Software as a Service (SaaS) products. The environment includes significant presences in Microsoft (O365, M365, D365), Amazon Web Services (AWS), and

Salesforce.

The ISD seeks an innovative and flexible partner to provide enterprise-level support for the following integrated services:

• Program Management

• Cybersecurity Policy and Compliance

• Cybersecurity Operations

• Cybersecurity Architecture and Engineering

• Privacy Program Management

• Controlled Unclassified Information (CUI) Program

• Records Management Services

This contract will support SBA’s enterprise IT general support systems, encompassing more than

10,000 end users, six major operating centers, seventy regional offices, one major call center, and multiple cloud-based environments. The services described herein are consistent in scope between the current contract SBA is operating under and this sole source bridge contract for which we are requesting approval. No changes have been made to the work required under current contract and this bridge contract.

The services will ensure the SBA can meet and sustain compliance with the President’s

Management Agenda (PMA) Cross Agency Priority (CAP) Goals, Office of Management and

Budget (OMB) metrics, and Council of the Inspectors General on Integrity and Efficiency

(CIGIE) standards. These services will be provided in a consistent, measurable, and cost-effective manner aligned with SBA’s enterprise security strategy.

4. Statutory Authority Permitting Other Than Full and Open Competition

This acquisition is conducted under the authority of FAR 6.302-5(b)(4), Authorized or Required by Statute. Specifically, 15 U.S.C. § 637(a) and 13 CFR 124.506(b) permit sole source awards to Alaska Native Corporations (ANCs) under the SBA 8(a) Business Development Program, regardless of contract value, provided the SBA accepts the requirement into the 8(a) program. In addition to this contract action being authorized by statute, the circumstances surrounding the requirement are so critical that it also represents an unusual and compelling urgency in accordance with FAR 6.302-2(a)(2).

5. Demonstration That the Proposed Contractor’s Unique Qualifications or

Circumstances Require Use of the Authority Cited

Chenega Systems, LLC is a federally recognized Alaska Native Corporation (ANC) and a current SBA 8(a) participant. Under the 8(a) program, ANCs are statutorily eligible for direct awards under 15 U.S.C. § 637(a).

Beyond this eligibility, Chenega possesses significant relevant experience providing enterprise cybersecurity, privacy, and compliance services across federal civilian and defense agencies.

Chenega is the incumbent contractor for these services for SBA. Chenega has successfully delivered large-scale cybersecurity operations, managed security services, and information assurance programs for clients such as the Department of Homeland Security, the Department of

Defense, and other federal agencies with complex hybrid IT infrastructures.

In addition to being the incumbent, Chenega has the expertise, cleared workforce, and the demonstrated ability to integrate security services across cloud and on-premises environments.

This makes them uniquely qualified to meet SBA’s enterprise cybersecurity needs on a compressed timeline, ensuring no lapse in protection of SBA’s critical IT systems.

The acquisition urgency is reflected in the time remaining on the current bridge contract leaving less than 3 weeks until the enterprise cybersecurity services will expire, leaving the SBA vulnerable to security breaches. This contract requirement supports and provides cybersecurity, ensuring the protection of SBA’s information assets supporting its $1+ trillion small business program portfolio. In Fiscal Year 2025, the SBA guaranteed 84,400 small business loans totaling

$44.8 billion. On average, the agency guarantees 1,600 small business loans per week worth over

$860 million – or 320 loans per workday for $170 million. SBA is the only cabinet-level federal agency fully dedicated to small business and provides counseling, capital, and contracting expertise as the nation’s only go-to resource and voice for small businesses.

The OCIO manages the agency’s enterprise IT general support system and data centers, consisting of more than 10,000 end users, 6 major operating centers, and 70 regional offices throughout the United States territories, 1 major call center, and multiple cloud-based services environments, totaling approximately 300 network nodes. As a critical part of the OCIO and

SBA’s technical ecosystem, this contract will ensure that SBA has the cybersecurity to protect the agency and the United States’ small businesses.

This contract is intended to support the major tasks within the ISD in a consistently implemented, managed, measurable, and cost-effective manner. The SBA must meet and deliver results outlined within the Presidents Management Agenda (PMA) Cross Agency Priority (CAP)

Goals, target metrics defined by the Office of Management and Budget (OMB), and the Council of the Inspectors General on Integrity and Efficiency (CIGIE) criteria. The publications establish the foundation needed to address the critical challenges and requirements where the SBA and the

Government, as a whole, are evaluated. The Government would be seriously injured if these services were allowed to lapse and security protocols, processes and services were to end.

In order to safeguard the entire SBA IT infrastructure, GSA must ensure an uninterrupted supply of enterprise cybersecurity services. This critical need is required no later than November 8, 2025, when the current bridge contract expires. The competitive procurement for this requirement is already underway, however, it will not be awarded in time to satisfy the need for continual services. Introducing a new contractor is not feasible. There is not sufficient time to complete a competitive procurement and also allow time for the proper integration and transition between vendors to take over this work. This would result in a timing risk of not being completed on time as well as the integration and transition being unsuccessful; both which would compromise the entire agency’s IT security. This requirement while it is a routine requirement, the current process is anything but routine. The most recent competitive procurement, began by the SBA in 2023 for this requirement, was protested by six contractors at the U.S. Government

Accountability Office (GAO). As a result of SBA’s corrective action to reevaluate all offers, SBA determined that cancellation of the procurement, followed by a re-solicitation would be in the best of interest of the Government. In the meantime, SBA awarded two sole-source bridge task orders. The first to the incumbent contractor and when that bridge expired, to Chenega under the authority of FAR 19,805-1(b)(2) while the recompete progressed. This current 8(a) direct award bridge expires November 8, 2025. While award of a task order for these requirements was expected during, Q3 of FY 2025, this procurement was further delayed because of the transfer of all SBA contracts to GSA as a result of recent Executive Orders aimed at efficiency and centralizing procurement in all of Government. This caused an enormous delay in restructuring and resubmitting the competitive procurement out for offer. This award only serves to act as a counterbalance to ensure continual enterprise cybersecurity but also allow flexibility to end this bridge when the new award is in place and the transition/integration of the new award has taken place.

In summation, this contract action serves to protect the SBA government enterprise from all cybersecurity risks if there were to be a lapse in coverage for these services. Delay of the award would result in serious injury to SBA and the Government agencies which interact with SBA.

6. Description of Efforts Made to Solicit Offers from Other Sources

This requirement is currently in the process of being competed using full and open competition under Federal Supply Schedules. The market research report for that procurement is attached to this justification and the contract file. Pursuant to FAR 6.302-5(b)(4) and 13 CFR 124.506(b), the SBA will formally offer the requirement to the 8(a) program for acceptance and award to

Chenega as an ANC-owned 8(a) participant.

Market research confirmed that multiple qualified vendors provide similar cybersecurity services; however, this statutory authority allows the Government to meet urgent mission needs while directly supporting the socioeconomic objectives of the 8(a) program and the economic self-sufficiency of ANCs. There is not sufficient time to compete this requirement. This acquisition serves to fulfill the urgent and critical cybersecurity requirements while the competitive procurement that’s underway is allowed to finish. Delay in award to the incumbent contractor would result in serious injury to SBA.

7. Determination of Fair and Reasonable Cost

The Contracting Officer (CO) will determine the final negotiated price to be fair and reasonable in accordance with FAR 15.404-1. The CO will review Chenega’s price proposal against the Independent Government Cost Estimate (IGCE), analyze pricing elements, and consider historical pricing for similar services. This analysis will ensure that the award price of

$12,152,654.53 is fair, reasonable, and represents the best value to the Government.

8. Market Research

Market research was conducted in accordance with FAR Part 10 through review of market data, GSA contract vehicles, and SBA’s Dynamic Small Business Search (DSBS). Research confirmed that Chenega is an eligible ANC-owned 8(a) participant with extensive past performance and capacity to execute complex cybersecurity programs.

While other firms provide comparable services, the 8(a) statutory framework allows the

Government to proceed with a direct award to Chenega, the incumbent, to achieve both operational continuity and socioeconomic objectives. Chenega is registered in SAM.gov and does not have any active exclusions.

9. Any Other Supporting Facts

• The SBA 8(a) program is designed to foster business development and economic self-sufficiency for disadvantaged business entities, including ANCs.

• This direct award supports Executive Orders and federal policies advancing Native business participation in federal procurement.

• The up to one-year period of performance ensures continuity of essential cybersecurity and information protection services while the SBA develops a longer-term, competitive acquisition strategy.

• Chenega’s support structure enables SBA to centralize enterprise cybersecurity, privacy, and CUI services, eliminating duplication across program offices and promoting consistent implementation of federal security standards.

10. Actions to Remove Barriers to Future Competition

The GSA, in coordination with SBA, intends to utilize this one-year bridge period to finalize a comprehensive, competitive acquisition strategy for future enterprise cybersecurity requirements.

The follow-on acquisition, to the current contract, is being competed as a full and open procurement, a multiple-award schedule award to ensure broader industry participation.

11. Technical and Requirements Certification

I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

Michael Post

Program Manager / Requirements Official

U.S. Small Business Administration

12. Contracting Officer Certification

I certify that this justification is accurate and complete to the best of my knowledge and belief.

Lindsay Wong

Contracting Officer

U.S. General Services Administration

13. Approval

Based on the foregoing justification, I hereby approve the use of other than full and open competition for this acquisition, pursuant to the authority of FAR 6.302-5(b)(4) and FAR 6.302-

2(a)(2).

Kimura Armstead

Division Director

U.S. General Services Administration

FAS, Office of Centralized Acquisition

Docusign Envelope ID: 5BB399A0-BA38-4315-941E-E047B9F7D49B

10/29/2025

10/29/2025

10/30/2025

Sharon Chen

Senior Assistant General Counsel

Office of the General Counsel, Personal Property Division

Al Munoz

Competition Advocate

FAS, Office of Centralized Acquisition

Darrick Early

Contracting Executive

U.S. General Services Administration

FAS, Office of Centralized Acquisition

Docusign Envelope ID: 5BB399A0-BA38-4315-941E-E047B9F7D49B

10/30/2025

10/30/2025

10/31/2025