5_1 JEFO CSDS II Interim Oder CLIN 0006_20220804_Redacted.pdf

CISAM 3016.505-90(b)(4) Justification for Exception to Fair Opportunity

Exceeding the SAT pursuant to FAR 16.505(b)(2)(ii)(B)

JEFO No:

Rev: 10/22/2020

JEFO Number: PR Number:

1. Agency and Contracting Activity.

The Department of Homeland Security, U.S. Citizenship and Immigration Services (USCIS), Office of Contracting, proposes to award a task order on behalf of the USCIS, Office of Information Technology (OIT), Information Security Division (ISD), Security Operations Branch (SOB), pursuant to Federal Acquisition Regulation (FAR) 16.505(b)(2), Exception to the fair opportunity process.

2. Nature and/or description of the action being approved.

USCIS intends to issue a task order modification to add the required services for CLIN 0006 System, Platform, and Tool Integration Surge support to task order W52P1J-18-D- A077/70SBUR22F00000115 for Cyber Security Defense Services (CSDS) II under LinkTec LLC’s (LinkTec) U.S. Army Information Technology Enterprise Solutions – 3 Services (ITES- 3S) contract, contract number W52P1J-18-D-A077/70SBUR22F00000115. LinkTec is the contractor currently providing support under task order W52P1J-18-D- A077/70SBUR22F00000115 for Cyber Security Defense Services (CSDS) II.

3. Description of Supplies/Services.

On January 26, 2022, the Office of Management and Budget (OMB) released a Federal strategy to move the entire U.S. Government toward a “zero trust” approach to cyber security. This strategy comes in response to the May 12, 2021, Executive Order (EO) 14028 on Improving the Nation’s Cyber Security in which President Biden directed the federal government to dedicate itself towards advancing security measures that dramatically reduce the risk of successful cyber-attacks against the Federal Government’s digital infrastructure. USCIS has committed itself to improving its resilience to cyber security threats by embracing two concepts that align with and enable this priority: the Secure Access Service Edge (SASE) security model and Zero Trust Network Architecture (ZTNA).

Under the Cyber Security Defense Services II (CSDS II), task order W52P1J-18-D- A077/70SBUR22F00000115, specifically CLIN 0006, LinkTec will be the sole entity responsible for ensuring the SASE security model and ZTNA contain the ability to identify, protect, respond, and recover from any cyber security threat determined to disrupt the lawful immigration process.

The contractor is responsible for ensuring the confidentiality, integrity and availability of all systems that support the processing of petitions by identifying cyber security risks to supported systems and data. Furthermore, they will establish the appropriate safeguards that prevent, limit, or contain the impact of a detected cyber security event and thwart adversaries’ ability to obtain data or damage systems that support the immigration process.

CSDS II CLIN 0006 requires that LinkTec implement the highest security parameters ensuring the move of applications supporting the immigration process to ZScaler SASE security model from Cisco does not disrupt the agency’s Congressional reporting requirements as outlined in Public Law 117-43 Section 2503. The resources obtained via this CLIN will review existing configuration settings to identify potential security vulnerabilities and propose setting or architectural changes to address vulnerabilities within applications.

USCIS intends to add CLIN 0006 via a modification to task order 70SBUR22F00000115, issued to LinkTec LLC. The estimated total value of the modification is . The period of performance for the proposed action is 8/4/2022 – 12/3/2022.

4. Statutory exception and supporting rationale.

The applicable statutory FAR citation and basis for using an exception to fair opportunity process is:

FAR 16.505(b)(2)(i)(B). Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

Rationale:

Currently, LinkTec is providing CSDS II services, under the W52P1J-18-D- A077/70SBUR22F00000115 task order with the period of performance end date of 6/03/2023.

As described in greater detail below, the CSDS work is paramount to agency continuity of operations. With the continued persistence from various state-sponsored actors and the requirement to enhance the agencies cyber-hygiene, only LinkTec can initiate the tasks related to the implementation of ZTNA, while continuing to respond to the ever-changing threat landscape and ensure provide 24x7 cyber security incident response services to identify, protect, respond and recover from cyber-attacks because the services ordered are unique or highly specialized.

The current CSDS II task order has several performance requirements, each with their own timeline. The CSDS II CLIN 0006 modification will add work on the following tasks:

implementation of ZScaler security policies. ZScaler will be a new product that will provide firewall security intrusion protection for the USCIS IT network. This task order modification is required to support the implementation of security parameters of all the systems and applications that support the agency over to the new enterprise security firewall within ZScaler. Additionally, this task order modification is needed to support ZTNA efforts to assist

OIT Information Security Division in developing a strategy for securing advanced network connections to align with the evolving needs of the agency.

Awarding or switching to another contractor in the middle of the ongoing planning, testing, and analysis of existing cyber security solutions which will intergrate with ZScaler and all facets of the ZTNA would cause an unacceptable delay in the agency completing the required actions in the EO.

The prime contractor must have a basic understanding of all the CSDS II tasks and how they interconnect in order to successfully perform the requirement in CLIN 0006. This understanding takes time that is not available to develop due to the deadline to accomplish the task. No other contractor is able to satisfy this short-term requirement primarily because of the interconnectivity of CLIN 0006 with the work already being performed under CSDS II, while continuing to respond to new challenges and threats. Introducing a new contractor at this time to perform the above-mentioned task would result in a unacceptable delay during the transition period, disrupt services being provided and leave USCIS systems unprotected and vulnerable from cyber-attacks in the current increased threat landscape.

LinkTec LLC is a responsible source, with the requisite understanding of USCIS systems and the inter-related tasks required for the successful implementation of ZTNA, and only they are able to satisfy this short-term requirement without an unacceptable gap in mission critical services.

5. Determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

The Contracting Officer anticipates the proposed price will be consistent with the ITES-3S contract held by LinkTec that includes maximum/ceiling rates. In addition, historical pricing information is available for all services to be provided, which are the basis for the Independent Government Cost Estimate.

Prior to award, the contracting officer will be able to determine that issuing the proposed modification via W52P1J-18-D-A077/70SBUR22F00000115 represents the best value and that the proposed price is fair and reasonable for award.

6. Any other facts supporting the justification.

The CSDS II Program establishes the architectural defenses for the USCIS network and systems. In the last year, USCIS has fended off several known cyber-attacks. The CSDS II Program is comprised of several core components protecting access to the network and systems in the areas of cyber security architecture, multi-cloud security, vulnerability management, penetration testing, and security code review. Together these components

JEFO No represent a comprehensive and innovative approach to addressing the needs of an every-changing environment and world.

The CSDS Program is working with the Office of Contracting in order to re-compete this requirement with an expected award date in the third quarter of Fiscal Year 2023.

7. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made.

Any barrier to competition will be removed when LinkTec completes all tasks initiated on the incumbent task order and continued on this sole source task order in response to the cybersecurity event mentioned earlier as well as upon finalization of the source selection and a transition to a new awardee as noted above. No other competitive barriers are known at this time, which would lead to a future fair opportunity exception. This sole source task order modification is only intended to continue the current services until the award and transition-in of the re-compete competitive procurement is completed.

8. USCIS intends to post this requirement on Beta.Sam.gov pursuant to FAR 16.505(b)(2)(ii)(D).

9. Technical/Requirements Personnel Certification.

Pursuant to FAR 16.505(b)(2)(ii)(B)(9), I certify that this requirement meets the Government’s minimum need and that the supporting data, which form a basis for the justification, are accurate and complete.

Date

10. Contracting Officer Certification

Pursuant to FAR 16.505(b)(2)(ii)(B)(8), I certify that this justification is accurate and complete to the best of my knowledge and belief.