LSJ_NAVFAC TRAS Extension_Redacted.pdf

47QFMA20F0035

GSA FAS

AAS Army | Sector 3

This document is prepared in accordance with FAR 8.405-6(c)

Source Selection Information - See FAR 2.101 and 3.104

Limited-Sources Justification

Naval Facilities Engineering Systems Command (NAVFAC) Command Information Office (CIO)

Technology Risk Analysis Services (TRAS)

This document is hereby identified as a Limited-Sources Justification and was prepared in accordance with FAR 8.405-6(c).

1. IDENTIFICATION OF THE AGENCY AND THE CONTRACTING ACTIVITY.

The requiring activity is the Naval Facilities Engineering Systems Command (NAVFAC) Command Information Office (CIO), located in Washington DC. The contracting activity is General Services Administration (GSA) Federal Acquisition Service (FAS), Assisted Acquisition Services (AAS) Army, Sector 3 - Philadelphia, PA.

2. NATURE AND/OR DESCRIPTION OF CONTRACT ACTION.

The Government intends to issue a modification to extend GSA Contract # 47QTCA18D00DJ, Task Order (TO) # 47QFMA20F0035 with Karthik Consulting LLC (Karthik) for 12-months to continue Technology Risk Analysis Services (TRAS) for NAVFAC CIO from 24 September 2024 to 23 September 2025. The TO is a combination Firm Fixed Price (FFP) / Time and Material (T&M) TO that was awarded under the GSA Federal Supply Schedule Multiple Award Schedule contract utilizing FAR 8.405-2(c)(3) procedures on 24 September 2020 with a 12-month base period and four (4) 12-month options. This TO is set to expire 23 September 2024 if no action is taken.

This extension is to prevent a break of service while providing the Government the necessary time to consolidate to the current TRAS TO along with another AAS administered TO (Risk Management Framework (RMF) Assess and Authorize/Cybersecurity Safety (CYBERSAFE) GSA Contract # 47QTCK18D0029, TO # 47QFMA21F0040, previously awarded under the GWAC GSA Alliant 2 Contract).

The TRAS and RMF CYBERSAFE requirements are similar in scope and support the same objectives of ensuring cybersecurity compliance and cyber operations. The consolidation will eliminate duplicative efforts in the acquisition process. The consolidation will also allow for increased oversight and potential savings to NAVFAC.

Savings and cost avoidance will be introduced with economies of scale. Combining the scope will support efforts to efficiently coordinate RMF planning, execution, and evaluate approaches to evolving threats.

The separation between the two TOs create inefficiencies and confusion where coordination is required between tasks supported by different contractors. NAVFAC requires cybersecurity compliance efforts to be fully integrated into cyber operations. The merger of the TOs reflect NAVFAC’s desire to move towards a comprehensive cybersecurity strategy where compliance ensures adherence to regulations and standards, while operations focus on protecting systems. This holistic approach greatly improves operational efficiency and the security posture of NAVFAC’s Facility Related Control Systems (FRCS). While NAVFAC anticipates some efficiencies in acquisition and administration, the primary driver for the consolidation is the need for an integrated and comprehensive approach to the implementation of cyber services.

3. DESCRIPTION OF THE REQUIRED SUPPLIES/SERVICES TO MEET THE AGENCY’S NEEDS.

47QFMA20F0035

GSA FAS

AAS Army | Sector 3

This document is prepared in accordance with FAR 8.405-6(c)

Source Selection Information - See FAR 2.101 and 3.104

The Department of Defense (DoD) mandates the use of cybersecurity across the enterprise through the use of technology risk analysis methods that are consistent with the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF). NAVFAC’s mission is to formally accept or reject system risk posture by implementing technology risk analysis and associated enterprise risk tolerances based upon specific cyber requirements. Using RMF, NAVFAC employs a proven, well defined, and risk-based cybersecurity approach for enterprise-level authorization of information technology (IT) systems and services. RMF focuses on security as an integral part of a system’s overall lifecycle and enforces a tailored set of security control references and procedures that provide a structured process for managing security and privacy risk. This includes security categorization; security control selection, implementation, and assessment; information system authorization;

and monitoring.

Risk Management Framework (RMF) services are critical in supporting NAVFAC operations by ensuring the security, integrity, and resilience of information systems. Key factors in which RMF is crucial to NAVFAC include:

Enhancing NAVFAC’s Cybersecurity Posture Compliance with Regulations and Standards Supporting Mission-Critical Operations Facilitating Overall IT/OT Security Providing Informed Risk Decisions Cybersecurity Training and Awareness

The incumbent, Karthik, is currently assessing technology risk, addressing cybersecurity inefficiencies, implementing a rigorous configuration management process in accordance with NAVFAC’s specific requirements, Plans of Action, and Milestones (POA&Ms).

As part of the scope of the current task order, Karthik supports NAVFAC by providing RMF implementation, analyzing life-cycle management policy, guidance, oversight, and direction for operational technology command, control, and communications-computer systems. These include technology insertion, policy and procedural development, operation and maintenance engineering support, standards provisioning, architectures, integration, operations policy, and procedures for communications and computer systems with specialized technical skills and subject matter expertise. Performance under this contract is required throughout the continental United States (CONUS) as well as OCONUS locations.

The total 12-month estimate of the modification extension is

4. IDENTIFICATION OF STATUTORY AUTHORITY AND JUSTIFICATION/RATIONALE FOR LIMITING SOURCES

DEMONSTRATING THE CONTRACTOR’S UNIQUE QUALIFICATIONS TO PROVIDE THE REQUIRED

SUPPLY/SERVICE.

In accordance with FAR 8.405-6(a)(1)(i)(B), only one source is capable of providing the supplies or services required at the level of quality required because the supplies or services are unique or highly specialized.

The timing of the consolidation effort has created an uncertain environment that requires further analysis of multiple impacted organizations within the Navy. The period of performance for the TRAS contract expires on 23 September 2024.