ISSO_Justification_for_Exception_to_Fair_Opportunity.pdf

ISSO

Justification for Exception to Fair Opportunity

Exceeding the SAT pursuant to FAR 16.505(b)(2)(ii)(B)

JEFO No.: 19-003

Date: May 24, 2019 PR Number: ___________________________

1. Agency and Contracting Activity. Identification of the agency and the contracting activity, and specific identification of the document as a “Justification for an Exception to Fair Opportunity.”

Department of Homeland Security (DHS) Federal Emergency Management Agency (FEMA) Office of the Chief Procurement Officer (OCPO) 500 C Street SW Washington, DC 20472

2. Nature and/or description of the action being approved.

a) Type of action: New contract

b) Amount: $9,273,280.48

c) Type of Funding: Cybersecurity

d) Year of funding: FY2019

e) Other brief descriptive words and phrases: Sole-source to eGlobalTech via the

DHS EAGLE II Strategic Source Contract (FC-2 – Small Business) for Information System Security Officer (ISSO) service

Performance Period

Base Period: June 1, 2019 – May 31, 2020 Option to Extend Services (6 Months) per FAR-52-217-8: June 1, 2020 – November 30, Estimated Value

Based Period (12 Months) $6,276,840.48

Option to Extend (6 months) $2,996,440.00

Total $9,273,280.48

3. A description of the supplies or services required to meet the agency’s need (including the estimated value).

The Contractor shall serve as Information System Security Officers (ISSOs) for FEMA Program Offices, such as Office of Response and Recovery (ORR), Resilience (RES), Office of the Chief Financial Officer (OCFO). ISSOs are “the principal advisor to the Information System Owner (SO), Business Process Owner, and the Chief Information Security Officer (CISO) or designee on all matters, technical and otherwise, involving the security of an information system.”

The Contractor shall protect and maintain the confidentiality and integrity of information systems. The Contractor shall provide experience certified security professional to perform the following duties:

• Ensure that security requirements for their assigned major application or general support system are being met;

• Ensure that requests for certification and accreditation (C&A) of assigned major application or general support system is completed in accordance with the published DHS and FEMA procedures;

• Ensuring that protective measures for physical security threats are in place;

• Ensuring compliance with all legal requirements concerning the use of commercial proprietary software, e.g., respecting copyrights and obtaining site licenses;

• Maintaining an inventory of hardware and software within the program/development offices or field site facility;

• Coordinating the development of a Contingency Plan and ensuring that the plan is tested and maintained;

• Ensuring risk analyses are completed to determine cost-effective and essential safeguards;

• Ensuring preparation of security plans for sensitive systems and networks;

• Attending security awareness and related training programs and distributing security awareness information to the user community as appropriate;

• Reporting IT security incidents (including computer viruses) in accordance with established procedures;

• Reporting security incidents not involving IT resources to the appropriate security office; and

• Providing input to appropriate IT security personnel for preparation of reports to higher authority concerning sensitive and/or national security information systems.

The contractor shall provide experience certified security professional and shall be designated as key personnel. The ISSO shall serve as the point of contact (POC) for all security matter related to their assigned system. ISSO shall assist Information System Owners (ISSO) with the execution of the following activities:

• Security Authorization Support

• Federal Information Processing Standards Publications 199

• Risk Assessment

• Privacy Threshold Assessment/Privacy Impact Assessment

• E-Authentication

• Security Plan

• Contingency Support

• Security Control Testing

• Plan of Action and Milestone (POA&M) Management

• Annual Security Assessment

• Security Controls Compliance

• Configuration Management Support

• Risk Assessment and Management Support

• Continuous Monitoring Support

• Security Performance Plan

ISSO Support Project Management

The contractor shall develop a Program Management Plan (PMP) for the successful execution the Statement of Objectives (SOO). The plan shall include an information on how tasks will be managed, scheduled, and tracked.

The contractor and FEMA shall hold regularly scheduled monthly Contractor Management Meetings. The meeting shall provide the government and the contractor an opportunity to discuss current tasking, provide additional guidance to the technical task management of the contract, and give the contractor an opportunity to ask questions pertinent to the successful completion of the task.

ISSO Support

The contractor shall provide experienced certified security professional and shall be designated as key personnel. The ISSO shall serve as the point of contact (POC) for all security matter related to their assigned system. ISSO shall assist Information System Owners (ISSO) with the execution of the following activities:

• Security Authorization Support

• Federal Information Processing Standards Publications 199

• Risk Assessment

• Privacy Threshold Assessment/Privacy Impact Assessment

• E-Authentication

• System Security Plan

• Contingency Support

• Security Control Testing

• Plan of Action and Milestone (POA&M) Management

• Annual Security Assessment

• Security Controls Compliance

• Configuration Management Support

• Risk Assessment and Management Support

• Continuous Monitoring Support

• Security Performance Plan

4. Identify the exception to fair opportunity and supporting rationale, including a demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the exception cited. [If the contracting officer uses the logical follow-on exception, the rationale shall describe why the relationship between the initial order and the follow-on is logical (e.g., in terms of scope, period of performance, or value)]. [Select one and explain rationale below]:

___X___FAR 16.505(b)(2)(i)(A). The agency need for the supplies or services is so urgent that providing a fair opportunity would result in unacceptable delays.

_______FAR 16.505(b)(2)(i)(B). Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

________FAR 16.505(b)(2)(i)(C). The order must be issue on a sole-source basis in the interest of economy and efficiency because it is a logical follow-on to an order already issued under the contract, provided that all awardees were given a fair opportunity to be considered for the original order.

_________FAR 16.505(b)(2)(i)(D). It is necessary to place an order to satisfy a minimum guarantee.

_________FAR 16.505(b)(2)(i)(E). For orders exceeding the simplified acquisition threshold, a statute expressly authorizes or requires that the purchase be made from a specified source.

Rationale:

Background:

On July 10, 2017, FEMA issued an RFP under the DHS EAGLE II Contract - Functional Category 2 – Small Business for Information System Security Officer (ISSO) Services. The requirement was solicited to all contractors under that functional category. On April 29, 2019, FEMA canceled the solicitation. FEMA determined that no acceptable offers were received for the solicitation, and the Government’s underlying requirements had changed. FEMA is in the process of re-evaluating its acquisition strategy and revising requirements. In the meantime, FEMA has an urgent need to maintain ISSO services without interruption. This requirement is being issued as a sole-source task order under EAGLE II with eGlobal Tech to allow FEMA sufficient time to redefine the ISSO requirement according to the current need and pursue another competitive process.

It would not be cost effective to bring another contractor in as FEMA redefines their ISSO requirement to perform the current work for such a large, complicated, and critical program. eGT is the only company with the current knowledge and people in place to complete the task in the time available. Ramp-up time required to get a new Contractor staff up to speed to be able to meet required deliverables is counterproductive and will force the schedules to slip/be missed. In addition, based on the impact to current Program Projects such as Grant Modernization and IT Modernization, the loss in unique technical expertise will impact FEMA's ability to comply with DHS and FEMA OCIO Information Security requirements. This uniqueness also extends to understanding the interdependencies of FEMA systems as it relates to Cyber Security.

The agency’s need for the supplies or services is so urgent that not continuing services while a competitive process is conducted would result in unacceptable delays to the Agency. The delay would result in serious injury, financial or other harms to the Government, as this action is for the immediate protection of FEMA’s information systems from the illegal and malevolent activities of cyber-criminals, cyber-terrorists, and hostile governments. Failure to obtain approval of this request for onsite Information System Security Official (ISSO) support jeopardizes the FEMA ability to comply with federal requirements, and DHS and FEMA OCIO Information Security requirements. Compliance with these requirements are essential to maintaining the operations and functions of the critical IT systems that are necessary to support and maintain the disaster operations and impact essential mission critical programs such as the National Flood Insurance Program and the National Continuity Program.

Without onsite ISSO contractor support, FEMA will lack the ability to ensure systems confidentiality, integrity, the ability to protect information and prevent unauthorized system access and assure security requirements. Failure to approve this action will be detrimental to FEMA’s information systems and will severely impact FEMA’s Cyber Security Program and to FEMA’s overall Mission.

5. Determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

The Contracting Officer has determined that the anticipated pricing will be fair and reasonable based on the following:

Historical Pricing, labor rates as set forth in the incumbent contract and based on DHS EAGLE II pricing.

6. Any other facts supporting the justification.

Two (2) major ISSO services (Enterprise ISSOs and Cyber Security Program ISSOs) are covered under a BPA that expires as of May 31, 2019. With this BPA ending, Enterprise ISSO and Cyber Security Program ISSO services will now be incorporated under this award for ISSO services. Any delay in this award for these services would result in serious injury, financial or other harms to the Government, as this action is for the immediate protection of FEMA’s information systems from the illegal and malevolent activities of cyber-criminals, cyber-terrorists, and hostile governments.

Failure to obtain approval of this request for onsite Information System Security Official (ISSO) support jeopardizes the FEMA ability to comply with DHS and FEMA OCIO Information Security requirements. Compliance with those requirements is essential to maintaining the operations and functions of these critical IT systems that are necessary to support and maintain the operations of such programs the National Flood Insurance Program and in providing access to disaster system. Without onsite ISSO contractor support, FEMA will not be able to ensure that the confidentiality, integrity and availability security requirements are being met for FEMA’s information systems which will severely impact the FEMA IT Security Program. The ISSO will have access to sensitive information (e.g., vulnerability scans/reports, security authorization packages, etc.) that cannot be processed offsite. Any delays would immediately affect FEMA’s ability to protect its information systems and will put FEMA personnel and the public at risk.

FEMA’s Office of the Chief Information Officer (OCIO) has been working with the Office of the Chief Procurement Officer (OCPO) to award a single contract to replace the two OCIO ISSO service contract vehicles for Enterprise/Cyber Security Program ISSOs and Program ISSO Support. Both contracts (the EADIS BPA and the eGlobalTech) are scheduled to end on May 31, 2019. The ISSO program requires stabilization in the workforce to address Notice of Findings and Recommendations (NFRs), system weakness and expiring security authorization packages.

An ISSO is critical to the management of an information system. Not only does the ISSO have access to sensitive information (e.g., vulnerability scans/reports, security authorization packages, etc.), the ISSO is the Information System Owner’s cyber security subject matter experts. Historical data has shown the un-stabilization in our ISSO contracts has increased the number of the NFRs the Agency receives annually.

Even with a plan, it takes an ISSO 30 days to become familiar with a new system and 90 days to be effective in managing a system. With the audit year starting every October 1, FEMA must be able to show the Financial Auditors consistency in the management of information systems. Over the past year and half, no considerable progress has been made towards improving the cybersecurity hygiene of FEMA’s information systems. For the auditor to see progress, personnel must be in place throughout the full audit year. A 12-month contract would provide such an opportunity to stabilize the program and demonstrate to the Financial auditors that FEMA can manage its information systems. Anything less would significantly impact ongoing stabilization efforts.

Failure to obtain approval of this request for a 12-month ISSO support contract jeopardizes FEMA’s ability to comply with DHS and FEMA’s OCIO Information Security requirements. Compliance with those requirements is essential to maintaining the operations and functions of critical IT systems that are necessary to support and maintain the operations and in providing access to disaster systems.

7. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made.

FEMA is in the process of re-evaluating its acquisition strategy and revising requirements, and intends to re-solicit on a competitive basis. FEMA believes that a 12-month period of performance is the minimal time necessary to deliver stable program support and complete the new competition.

8. DHS intends to post this requirement on FedBizOpps pursuant to FAR 16.505(b)(2)(ii)(D).

Yes

9. Technical/Requirements Personnel Certification.

Pursuant to FAR 16.505(b)(2)(ii)(B)(9), I certify that this requirement meets the Government’s minimum need and that the supporting data, which form a basis for the justification, are accurate and complete.

Technical Representative/COR Date

10. Contracting Officer Certification and Approval *

Pursuant to FAR 16.505(b)(2)(ii)(B)(8), I certify that this justification is accurate and complete to the best of my knowledge and belief and hereby determine that the circumstances for an exception to fair opportunity exist:

Not exceeding $700,000 Date Contracting Officer

*Note: In accordance with FAR 16.505(b)(2)(ii)(C)(1), proposed orders with an estimated value exceeding the simplified acquisition threshold, but not exceeding $700,000, the ordering activity contracting officer’s certification that the justification is accurate and complete to the best of the ordering activity contracting officer’s knowledge and belief will serve as approval.

For OPO, the contracting officer should sign each justification prior to approval by the next higher level (e.g., Competition Advocate, HCA, and/or CPO).

11. Approval.

Over $700,000 but not exceeding $13.5 million Date Component Competition Advocate

Over $13.5 million but not exceeding $68 million Date Head of Contracting Activity