www.uscis.gov

Rev: 02/10/2026

Justification for Exception to Fair Opportunity, Exceeding the Micro-purchase Threshold, Governance Communications Assessments & Classified Services (GCACS) III /

Cybernamic, LLC

REFERENCE: Justification Log Number: FY27-0008 and PR Number:

1. Agency and Contracting Activity.

The Department of Homeland Security (DHS), U.S. Citizenship and Immigration Services (USCIS), Office of Contracting (OCON), proposes to modify an existing task order on behalf of the Office of Information Technology (OIT), Information Security Division (ISD), Risks Information Systems & Classified Operations (RISCO) Branch, pursuant to RFO 16.507-6(b), Exceptions to the fair opportunity process.1

2. Nature and/or Description of the action Being Approved.

This action seeks approval for a sole source extension to Cybernamic LLC (Cybernamic) via modification No. P00027 to Task Order No. 70SBUR22F00000242 to continue the GCACS III services currently performed by Cybernamic to maintain continuity of critical classified-systems security, communications, assessment, compliance, and program-management support. The current task order was competitively awarded in September 2021 to Cybernamic, under General Services Administration (GSA) 8(a) STARS III Governmentwide Acquisition Contract (GWAC) No. 47QTCB21D0381, through a fair-opportunity process under the 8(a) STARS III GWAC for the period September 21, 2022, through April 20, 2026. The task order was subsequently modified under FAR 52.217-8 Option to Extend Services and extended for a total of six (6) months via modifications No. P00023 (04/21/2026 to 08/20/2026), P00025 (08/21/2026 to 09/20/2026), and P00026 (09/21/2026 to 10/20/2026), to maintain continuity of services, while USCIS conducted the GCACS IV recompete.

3. Description of Supplies/Services.

GCACS III provides cybersecurity governance, assessment, engineering, classified-system, and secure-communications support for USCIS. This justification seeks approval to continue the following work unique to 70SBUR22F00000242 to include:

Program and project management, quality management, reporting, and process improvement.

RMF security control assessments, authorization package development, continuous monitoring, and vulnerability-management support.

1 In this document, citations to, RFO Part 16, RFO Part 10, RFO Part 11 and RFO Part 15 are citations specifically to Federal Acquisition Regulation (FAR) Class Deviation 26-04, Rev. 1 for FAR Part 16, FAR Class Deviation 26-12, Rev. 1 for FAR Part 10, Rev. 1 for FAR Part 11, Rev. 1 for FAR Part 15, which were issued as part of the Revolutionary FAR Overhaul (RFO), which was implemented in response to Executive Order 14275, Restoring Common Sense to Federal Procurement, signed April 15, 2025.

JEFO, Exceeding the SAT, GCACS III – Cybernamic

FY27-0008

Rationale:

GCACS III services performed on this task order must continue while the GCACS IV award remains under protest. The proposed extension is limited to the period necessary to avoid a disruption in mission-critical classified-systems security, compliance, secure communications, security assessment, penetration-testing, automation, and program-management support.

Cybernamic is the incumbent contractor performing GCACS III under task order No.

70SBUR22F0000022 and is the only 8(a) STARS III awardee capable of providing the required services at the level of quality required within the required timeframe. This determination is based on Cybernamic’s existing specialized capabilities, active task-order responsibilities, required personnel clearances and system access, and current knowledge of the USCIS classified-systems environment.

Specifically, Cybernamic currently provides and is actively integrated into the following specialized GCACS III functions:

1. Classified Information-System Security Officer Support. Cybernamic personnel provide Information System Security Officer (ISSO) support for USCIS classified systems, including ongoing support for system-security documentation, security-control implementation, risk-management activities, continuous monitoring, and coordination with system owners and Government security personnel.

2. Secure Work Area Compliance Support. Cybernamic provides Information Security Compliance Representative (ISCR) support for USCIS Secure Work Areas (SWAs), including support necessary provide Tier I and Tier II support for USCIS classified sites.

This support requires familiarity with the current classified-site operating environment, established support procedures, existing equipment and configuration records, active issue-resolution activities, and coordination protocols.

3. Secure and Tactical Communications. Cybernamic provides Communications Security (COMSEC) support for secure classified communications and Tactical Communications (TACCOMs) support for contingency operations and USCIS law-enforcement mission requirements. These services require personnel with the applicable clearances, access, training, and familiarity with the existing communications environment and operational procedures.

4. Security Authorization and Assessment Support. Cybernamic provides Security Control Assessor support for ongoing security authorization, assessment, and continuous-monitoring activities. The contractor’s personnel possess knowledge of existing assessment plans, security-control evidence, findings, plans of action and milestones, remediation activities, and system-specific risk determinations.

5. Penetration Testing and Security Automation. Cybernamic provides penetration-testing support and Security Development (SecDev) automation support. These services are integrated with current GCACS III security-assessment activities, existing automation efforts, and USCIS-specific security processes.

6. RISCO Program and Project Management. Cybernamic provides program and project management support for RISCO’s ongoing security, classified-operations, compliance, communications, assessment, and risk-management priorities. The contractor’s personnel have current knowledge of program schedules, deliverables, dependencies, stakeholder responsibilities, and active workstreams.

Cybernamic provides personnel who hold or are eligible for clearances and access necessary to support classified USCIS systems and sites. The incumbent’s workforce has already completed the applicable onboarding, access-processing, training, and integration activities necessary to perform the work. Another contractor and its personnel would require:

Personnel clearances: The ISCRs and Secure Communication Engineers must possess Top-Secret Sensitive Compartmented Information (TS/SCI) clearance level(s), access eligibility, and verification requirements to work in the Secure Work Areas.

Facility and system access: Appropriate Background Suitability checks and required access approvals to onboard which takes a significant amount of time for processing.

Training and certifications: Contractor personnel currently possess the required training and certifications to support the task areas. This eliminates the time it takes to screen, interview, and evaluate personnel for each position.

Transition and knowledge transfer: The planned 110-day protest window overlaps and constrains the critical 30-to-60-day knowledge transfer period. To mitigate transition risks and prevent a gap in services, the acquisition schedule must be adjusted to decouple the transition phase from the protest timeframe

The Government’s transition analysis, dated July 2025, determined that a successor contractor would require approximately 60-90 days to recruit and retain qualified personnel; complete required clearance and access processes; receive Government-furnished training; obtain familiarity with active GCACS III work products and program processes; and complete an orderly knowledge transfer. The available period required for the continuation date of October 21, 2026, is insufficient to complete those activities without a material risk of interruption or degradation in required services.

The Government considered the following alternatives:

1. Conducting a new fair-opportunity competition among 8(a) STARS III awardees.

This alternative was not selected because the time required to issue a solicitation, evaluate quotations, make an award, and complete the required personnel clearance, access, onboarding, and transition activities would not permit uninterrupted performance beginning October 21, 2026.

2. Transitioning only selected functional areas to another contractor. This alternative was not selected because the GCACS III functions are operationally interdependent.

Dividing ISSO, ISCR, classified-site support, COMSEC, TACCOMs, Security Control Assessment, penetration testing, SecDev automation, and program-management functions among multiple contractors would introduce unacceptable risks to accountability, coordination, continuity of operations, and security compliance during the limited extension period.

3. Performing the work with Government personnel. This alternative was not selected because USCIS does not have sufficient Government personnel with the required specialized skill sets, clearances, access, and availability to assume the full scope of the current GCACS III services without a disruption in performance.

4. Allowing services to lapse pending resolution of the GCACS IV protest. This alternative was not selected because it would create an unacceptable gap in support for classified-system security, secure communications, Security Control Assessments, penetration testing, security automation, and related RISCO mission requirements.

Without the proposed extension, USCIS would risk a gap in critical services supporting the security, compliance, availability, and operational readiness of USCIS classified systems and classified sites. A lapse in these services could delay security assessments and remediation efforts, impair support for secure and tactical communications, disrupt classified-site support, and adversely affect RISCO’s ability to execute its security and law-enforcement support responsibilities.

Accordingly, only Cybernamic is capable of continuing the required GCACS III services at the level of quality required within the timeframe necessary to prevent a gap in mission-critical support.

5. Determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

The Contracting Officer determines that the anticipated cost to the Government will be fair and reasonable. The Government will evaluate Cybernamic’s proposed pricing using one or more of the price-analysis techniques identified in RFO 15.404-1 to evaluate the extension proposal and may conduct negotiations as necessary to ensure that the price is fair and reasonable.

6. Any other facts supporting the justification.

The competitive recompete for this requirement has been protested and is currently awaiting decision by the Government Accountability Office (GAO). As a result, USCIS has issued stop work orders to the GCACS IV task order awards while awaiting the decision. This further delays

Approval

Pursuant to RFO 16.507-6(d)(2)(x), I hereby determine that the circumstance identified in Section 4 applies to the order.

Procuring Activity Advocate for Competition