JEFO - Okta Operations and Maintenance Services_Redacted.pdf

This is a Justification for an Exception to Fair Opportunity, a federal procurement document authorizing a sole-source task order award without competitive bidding.

HRSA seeks to issue a firm-fixed-price task order under the NIH NITAAC CIO-SP3 Government-Wide Acquisition Contract (GWAC) for Okta Operations and Maintenance (O&M) Services in FY 2026. The task order will be awarded to Deloitte Consulting, LLC for a 12-month base period from July 25, 2026 through July 24, 2027, with potential extension under FAR 52.217-8. The estimated value is redacted but includes a 0.65% NITAAC/NIH contract access fee. The requirement encompasses continued Access Management Services (AMS) and HSPD-12 System Integration Services for the Okta Federated Identity Hub, which serves as HRSA and HHS's enterprise authentication and identity federation platform supporting secure access to mission-critical applications. Services include comprehensive O&M support, system administration, single sign-on (SSO) management, identity federation integrations (SAML and OpenID Connect), user provisioning and deprovisioning, identity lifecycle management, system monitoring, incident response, and troubleshooting. The contractor must maintain compliance with HSPD-12, FIPS 201, Federal Identity Credential and Access Management (ICAM) policies, FISMA, and NIST cybersecurity requirements.

The justification invokes FAR 16.507-6(b)(2)—the unique or highly specialized services exception—arguing that Deloitte is the only contractor capable of providing required services at the necessary quality level due to the specialized, tightly integrated nature of HRSA's production Okta environment, its complex HSPD-12 infrastructure dependencies, enterprise application integrations, established federation trust relationships, and agency-specific identity governance configurations. Market research confirmed no other NITAAC CIO-SP3 holder or commercially available source possesses equivalent operational knowledge. The justification emphasizes that transitioning to a successor contractor would require substantial duplication of effort, introducing approximately 30% increased implementation costs, significant schedule delays, and unacceptable operational and cybersecurity risks to mission-critical authentication services. The contracting officer certifies price reasonableness based on an Independent Government Cost Estimate developed from prior contract performance, current labor categories, and market rates. The document requires posting to SAM.gov within 14 days of order placement and must remain posted for a minimum of 30 days per FAR requirements.