SSJ_OD OCIO_ISMS_Redacted.pdf

OD OCIO

NIH | OALM | OLAO | SSIT

SJ | GSA MAS

Source Selection Information – See FAR 2.101 and 3.104

(i) Decreased Cybersecurity Posture:

Increased vulnerabilities as continuous monitoring, threat response, and risk management activities lapse or are degraded.

Slower detection and response times to emerging threats across NIH's large and complex IT environment, which processes more than of Internet traffic daily.

(ii) FISMA Compliance Failures:

Disruption to A&A activities, risking lapses in system Authorizations to Operate (ATOs) for OCIO and IC information systems.

Failure to meet mandatory annual security awareness and role-based training requirements for NIH staff, resulting in FISMA non-compliance.

POA&M tracking failures, increasing NIH's enterprise risk posture and exposure to audit findings from OIG, GAO, and HHS.

(iii) Operational Degradation:

Loss of real-time cybersecurity dashboards and metrics used by NIH CIO and CISO for decision-making.

Disruption to the IT Security Service Desk, leaving OCIO staff and IC personnel without timely responses to information security and privacy inquiries.

Loss of management and maintenance of NIH's Information Security Program Wiki, SharePoint, and communication platforms, degrading program-wide information sharing.

(iv) Risk to Foundational IT Centralization:

A contractor transition during active centralization would significantly increase risk to OCIO's ability to absorb new IC functions, as the ISMS contractor plays a direct role in coordinating with IC CIOs and ISSOs and supporting their security compliance activities.

(v) Financial and Transition Costs:

Duplicative costs associated with onboarding a new contractor into a rapidly evolving environment, including knowledge transfer, system access provisioning, and ramp-up time that cannot be recovered.

Potential fines and recovery costs associated with security incidents or compliance failures arising from a gap in service.

The incumbent contractor possesses the institutional and operational knowledge needed to fulfil the requirements in the Statement of Work (SOW) and has consistently provided the qualified personnel to effectively meet those requirements. Given the current status of the recompete task order, and the potential transition to a new contractor, significant risks are present, including duplication of cost not recoverable through competition, mission degradation and the compromise of OD OCIO’s cybersecurity posture.

SJ | GSA MAS

Source Selection Information – See FAR 2.101 and 3.104

The incumbent contractor has demonstrated a high level of expertise and familiarity with OD OCIO’s Information Security systems and given their proven track record of successful project delivery, they are the best qualified vendor to maintain continuity of services during this interim period until a competitive task order is awarded. The extension will allow sufficient time to conduct a proper, FAR compliant competitive acquisition without compromising the integrity of OD OCIO’s mission-critical services.

The information above reinforces that it is imperative for work to continue under the current TO with the incumbent contractor

, as they are uniquely positioned to provide the required services at the necessary level of quality within the limited time frame available.

DETERMINATION BY THE ORDERING ACTIVITY CONTRACTING OFFICER THAT

THE ORDER REPRESENTS THE BEST VALUE.

By placing an order against the GSA MAS contract using the procedures in , the ordering activity Contracting Officer has concluded that the award of a ten-month fifteen-day extension to represents the best value to the Government and results in the lowest overall cost alternative (price, administrative costs, and security risks, etc.) to meet the Government’s immediate needs. he Contracting Officer and the OCIO Project Officer will conduct a price evaluation by assessing whether the proposed level of effort, labor mix, and labor hours are appropriate for the work to be performed, and to determine whether the total price is fair and reasonable.

The incumbent contractor’s pricing was determined to be fair and reasonable as determined by FAR 8.404(d) and they have historically provided discounts in addition to their GSA MAS rates.

The incumbent contractor will be encouraged to propose additional discounts for ten-month fifteen-day extension.

DESCRIPTION OF THE MARKET RESEARCH CONDUCTED AMONG SCHEDULE

HOLDERS AND THE RESULTS OR A STATEMENT OF THE REASON MARKET

RESEARCH WAS NOT CONDUCTED.

The Government intends to conduct Market Research in accordance with Part 10 as a part of the fully competitive TO recompete.

The Government intends to publish a limited-sources justification notice, within 14 days after placing the order, to SAM.Gov for a minimum of 30 days in accordance with

OTHER FACTS SUPPORTING THE JUSTIFICATION.

None.

STATEMENT OF ACTIONS TO REMOVE OR OVERCOME BARRIERS THAT LED TO

THE RESTRICTED CONSIDERATION BEFORE ANY SUBSEQUENT ACQUSITION

FOR THE SUPPLIES OR SERVICES IS MADE.

The Government will only solicit the incumbent contractor for the current TO extension under this GSA Federal Supply Schedule Multiple Award Schedule contract, to extend the existing TO for ten months and fifteen days as no reasonable alternatives exist for this requirement. No other firm can provide the necessary services at the requisite level of expertise within the time frame

SJ | GSA MAS

Source Selection Information – See FAR 2.101 and 3.104 required

The Government is actively working on the subsequent TO re-compete, which is currently in the requirements development phase. It is anticipated that a competitive award will be in place upon expiration of the current TO’s ten-month fifteen-day extension. OD OCIO’s technical staff continually monitors the market and evaluates services on an ongoing basis that would potentially improve their existing platforms. As Foundational IT Centralization initiatives mature, the technical staff will monitor the marketplace and re-evaluate the requirement to see if other solutions can be utilized to enhance competition.

[Certification & Signatures Follow]