Justification Deloitte LLP_P00008_Redacted.pdf

Version 12/27/18

Department of Transportation Federal Highway Administration (FHWA)

Information Technology (IT) Acquisition Center of Excellence (ACE)

SOLE SOURCE JUSTIFICATION

LOGICAL FOLLOW-ON

ORDER NO. 693JJ320A000013_693JJ322F00228N

The Department of Transportation (DOT) makes this Justification for orders pursuant to Federal Acquisition Regulation (FAR) 8.401(b) and GSAR 538.7104-3(b)(2).

i.) Identification of Agency and Contracting Activity:

Program Office:

DOT, Office of the Secretary (OST) Office of the Chief Information Officer (OCIO) 1200 New Jersey Avenue, SE Washington, D.C. 20590

Contracting Activity:

Federal Highway Administration (FHWA)

IT ACE

1200 New Jersey Avenue, SE Washington, D.C. 20590 ii.) Nature and/or Description of Action Being Approved:

The OCIO has a need to extend the cybersecurity management support services under Cyber Security Information & Program Services (CSIPS) Blanket Purchase Agreement (BPA) Order 693JJ320A000013_693JJ322F00228N awarded to Deloitte to support OST's applications and information systems. The Order currently expires on 04/30/2026 and this request is to extend current levels of support for an additional four (4) months (through 08/31/2026). An extension is needed while DOT goes through the process of restructuring the Department’s information technology workforce and determines whether this support can be reduced or fully assumed by Federal employees.

iii.) A Complete Description of Supplies/Services Required to Meet Agency’s Need:

This task order provides a broad range of technical and professional services to DOT infrastructure, application, and information systems. The cybersecurity support provides mission essential cybersecurity services, including operations and oversight, risk and vulnerability management in support of multiple binding operational directives, and Federal Information Security Management Act (FISMA) compliance and reporting.

Additionally, the contractor supports DOT systems to securely address vulnerabilities and non-compliance with Office of Management and Budget (OMB) and FISMA Directives, impacting enterprise cyber readiness and operational integrity; supports, operates, and maintains DOT cybersecurity tool stack (i.e., BigFix including Splunk) to enable the Continuous Diagnostic and Mitigation (CDM) program to corelate and pass data to the

CDM dashboard from all security tools on behalf of the department, managing inventory, patching, and updates; and operates and maintains Tenable for vulnerability management, scanning, and compliance across the enterprise.

This effort is required in accordance with OMB Memorandum 21-31 Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents in conjunction with Execution Order (EO) 14028, Improving the Nation's Cybersecurity, to ensure logging, log retention, and log management, with a focus on providing centralized access and visibility for the DOT Cybersecurity Operations Center

(SOC).

This effort is of paramount importance during the ongoing IT modernization throughout the Federal government to increase the sharing of such information, as needed and appropriate;

to accelerate incident response efforts; and to enable more effective defense for DOT Networks, information systems, and applications.

Deloitte provides critical support to comply with the cybersecurity and privacy requirements, including identifying associated risks and impacts and prioritizing alternatives. Additionally, Deloitte is on track to develop automations to improve security posture reporting and prioritization of cybersecurity weakness remediations and is developing modernization plans for risk management modernization, leveraging artificial intelligence (AI) and automation to improve timeliness of compliance activities.

DOT is developing suitable strategies with the application managers and infrastructure leaders on cybersecurity matters, developing audit recommendations for tactical implementation, and reducing costs to ensure information systems hardening, data protection, and mission resiliency.

The proposed modification P00008 to order 693JJ320A000013_693JJ322F00228N will extend the order by four (4) additional months through 8/31/2026 at an anticipated value of iv.) The Authority and Supporting Rationale:

This Justification is prepared as required by FAR 8.401(b) and GSAR 538.7104-3(b)(iii).

The applicable rationale for the sole source for this action is:

The order should be issued on a sole source basis in the interest of economy and efficiency because it is a logical follow-on to an FSS order already issued on a competitive basis.

The original acquisition was conducted as a competitive call order under the multiple-award Cyber Security Information & Program Services (CSIPS) BPAs issued against the General Services Administration (GSA) Multiple Award Schedule (MAS).

Deloitte has a management and subject matter team in place providing these services and is familiar with the DOT environment. Over the span of this engagement, DOT has increased its cybersecurity posture and compliance contributing to the Department’s Cybersecurity provide continuity of services while DOT is working on the recompete for this requirement.

vii.) Any Other Facts Supporting the Justification:

N/A.

viii.) Statement of the Actions the Agency May Take to Remove or Overcome any Barriers that Led to the Restricted Consideration Before Any Subsequent Acquisition for the Supplies or Services is Made:

OCIO is currently developing a new contract to provide the requirements for cybersecurity support. This effort underway would enable OCIO to continue services while the new contract effort is finalized and awarded.

ix.) Contracting Officer Certification that the Justification is Accurate and Complete to the Best of the Contracting Officer’s Knowledge and Belief:

The Contracting Officer’s signature on the Approvals Signature Page constitutes a certification that the justification is accurate and complete to the best of the Contracting Officer’s knowledge and belief.

x.) Evidence that any supporting data that is the responsibility of technical or requirements personnel (e.g., verifying the Government’s minimum needs or requirements or other rationale for sole source) and which form a basis for the justification have been certified as complete and accurate by the technical or requirements personnel:

The technical personnel’s signature on the Approvals Signature Page constitutes a certification that this justification is complete and accurate to the best of the technical personnel’s knowledge and belief.

xi.) Written Determination by the Approving Official(s):

Supporting data provided by technical or requirements personnel has been certified as complete and accurate as demonstrated by reasonable technical review and adherence to current task order rates.