693JJ323F00301N_SSJ - Kingfisher_Redacted.pdf

Department of Transportation Federal Highway Administration

IT Acquisition Center of Excellence

SOLE SOURCE JUSTIFICATION

LOGICAL FOLLOW-ON

Order # 693JJ320A000019_693JJ323F00301N

The Department of Transportation (DOT) makes this Justification for orders pursuant to Federal Acquisition Regulation (FAR) 8.401(b) and GSAR 538.7104-3(b)(2).

i.) Identification of Agency and Contracting Activity:

Program Office:

DOT, Office of the Secretary (OST) Office of the Chief Information Officer (OCIO) 1200 New Jersey Avenue, SE Washington, D.C. 20590

Contracting Activity:

Federal Highway Administration (FHWA) IT Acquisition Center of Excellence (ACE) 1200 New Jersey Avenue, SE Washington, D.C. 20590 ii.) Nature and/or Description of Action Being Approved:

The OCIO has a need to extend the cybersecurity management support services under Cyber Security Information & Program Services (CSIPS) Blanket Purchase Agreement (BPA) Order 693JJ320A000019_693JJ323F00301N awarded to Kingfisher (A Crimson Company) to support the Department’s System Authorizations and Assessments related to federal directives and law. The Order currently expires on 6/14/2026 and this request is to extend current levels of support for an additional six (6) months (through 12/14/2026). The extension is needed while DOT goes through the process of restructuring the Department’s information technology workforce and determines whether this support can be reduced or fully assumed by Federal employees.

iii.) A Complete Description of Supplies/Services Required to Meet Agency’s Need:

This task order provides a broad range of technical and professional services to DOT Information System security authorizations and assessments. Awarded to Kingfisher, the Security Assessment Support Services ensuring the accuracy of system inventory, categorization, plan of action and milestones and other technology within DOT’s Federal Information Security Management Act (FISMA) systems, tracking compliance and providing federally mandated reporting. Additionally, the contractor develops required Security Assess Plans (SAP) and Security Assessment Reports (SAR). In addition, the contractor provides long-term institutional knowledge of specific security controls and their implementation methods and rationale and how they map to complex regulatory frameworks like National Institute of Standards and Technology (NIST) Security and Privacy (SP ) 800-53 and FISMA.

DOT is developing suitable strategies with the Operating Administration (OA) leaders on cybersecurity matters, developing audit recommendations for tactical implementation, and reducing costs to ensure information systems hardening, data protection, and mission resiliency.

This modification P00012 to order 693JJ320A000019_693JJ323F00301N will extend the order by six (6) additional months through 12/14/2026. The anticipated value over the extension period of performance is .

iv.) Identification of The Exception to Fair Opportunity and the Supporting Rationale:

This Justification is prepared as required by FAR 8.401(b) and GSAR 538.7104-3(b)(iii).

The applicable rationale for the sole source for this action is:

The order should be issued on a sole source basis in the interest of economy and efficiency because it is a logical follow-on to an FSS order already issued on a competitive basis.

The original acquisition was conducted as a competitive call order under the multiple-award CSIPS BPAs issued against the General Services Administration (GSA) Multiple Award Schedule (MAS).

Kingfisher/Crimson Phoenix has a management and subject matter team in place providing these services and is familiar with the DOT environment. Over the span of this engagement, DOT has increased its cybersecurity posture and compliance contributing to the Department’s Cybersecurity FISMA performance goals (FY24 DOT earned “B”).

Additionally, this team has provided the necessary subject matter expertise to conduct technical cybersecurity assessments for the OST Information Systems Inventory including on-premises and FedRAMP SaaS applications. Critical activities include planning, organizing, coordinating and tracking to ensure OST Information systems complete assessment activities, communicating with DOT System Owners, Information System Security Managers (ISSMs) and Information System Security Officers (ISSOs) on assessment evolution, and conducting comprehensive security assessments. This engagement is not a change in the type of work currently being conducted under the order, but rather an extension of the current work.

The Department has already invested significant time and resources in establishing and identifying the requirements of implementing cybersecurity and privacy across the OAs.

This requirement is critical to meeting new mandates and strategic implementation already underway within DOT’s workforce and information systems. If engagement support is not continued, it would place the Department and its information systems at significant risk.

Critical modernization and capability integration would be delayed, and modernization restricted due to inaccurate policy and guidance. If they were to depart, DOT will not reach critical milestones for new systems requiring Authorization to Operate (ATO) and those requiring renewal will be out of compliance.

v.) Determination By The Contracting Officer That The Anticipated Cost to The Government Will be Fair and Reasonable:

The rates and level of effort proposed under the Order were determined to be fair and reasonable through competition at the base order. Moreover, these rates were proposed by the contractor underlying their GSA Schedule rates and a review of the extension quote in the amount of received from the vendor confirms the rates proposed are in accordance with current BPA rates and are, therefore, considered fair and reasonable.

None. This action is a logical follow-on to the competed Order No.

693JJ320A000019/693JJ323F00301N under the GSA Schedule No. GS-35F-0490T.

vi.) Any Other Facts Supporting the Justification:

Not applicable.

vii.) Statement of the Actions the Agency May Take to Remove or Overcome any Barriers that Led to the Restricted Consideration Before Any Subsequent Acquisition for the Supplies or Services is Made:

None. The follow-on order will be awarded on a competitive basis if continuation of contractor services is anticipated.

viii.) Contracting Officer Certification that the Justification is Accurate and Complete to the Best of the Contracting Officer’s Knowledge and Belief:

I hereby certify that this justification is accurate and complete to the best of my knowledge, and I determine based on the findings above that the sole source approach is in accordance with the requirements and is in the best interest of the Government.

Ajmal Khan Date Contracting Officer

FHWA IT-ACE

ix.) Evidence that any supporting data that is the responsibility of technical or requirements personnel (e.g., verifying the Government’s minimum needs or requirements or other rationale for limited sources) and which form a basis for the justification have been certified as complete and accurate by the technical or requirements personnel.

Supporting data provided by technical or requirements personnel has been certified as complete and accurate as demonstrated by reasonable technical review and adherence to current task order rates.

x.) Written Determination by the Approving Official:

I hereby certify that this justification is accurate and complete to the best of my knowledge, and I determine based on the findings above that the limit sources approach is in accordance with the requirements and is in the best interest of the Government.

Justin Ubert Date Supervisory Information Technology Specialist Office of the Secretary of Transportation, OST