IT Modernization Redacted LSJ.pdf

However, due to the complexity and additional FISMA requirements, both efforts (GRC tool implementation and ZTA roadmap development) are not completed. Therefore, there is a need to increase the funding for tasks 2, 3, and 6 under Option Period 2.

Due to the importance of this program, NIH leadership has allocated CIF Cybersecurity funding to fund this BPA Call.

The current contractor (Triple Point Security) is already performing the work and providing the services required. Therefore, in accordance with FAR 8.405-6(a)(1)(B), this request is a limited source justification to a BPA Call already in place. The original order was not previously issued under sole-source or limited-sources procedures. Please refer to section 4(b) for the justification for the unique and highly specialized ongoing work of the current vendor Triple Point Security.

b. Project background.

Triple Point Security was awarded the current BPA Call on September 20, 2023, with an expiration date of

September 19, 2026, if all options are exercised. Triple Point was awarded the BPA Call competitively off GSA through a Multiple Award BPA. The BPA Call is currently at its first option period ending on September 19, 2025.

3. Description of the supplies or services required to meet the agency’s needs (including the estimated value).

Project Title: NIH Information Technology Modernization Support Services

Project Description:

The purpose of the BPA Call modification is to complete the GRC tool implementation to modernize components of the NIH A&A Program, assist NIH to complete the development of a ZTA roadmap, achieve Optimum ZTA Maturity in alignment with Executive Order (E.O.) 14028, Improving the Nation’s Cybersecurity, and provide executive leadership support during the implementation of the ZTA roadmap.

Requirement type.

Support services (non-research & development) Supplies/equipment

X Information technology (IT) Other (specify): ____________________

Type of action

New requirement Follow-on

X Other (specify): Modification to existing contract 75N92023F00002/75N92023A00005

Proposed contract/order type.

X Firm-fixed-price Time and Material Indefinite delivery (specify whether indefinite quantity, definite quantity, or requirements): ___________ Other (specify):

Acquisition identification number. Blanket Purchase Agreement (BPA) Number, 75N92023A00005 and BPA Call Number 75N92023F00001

Total estimated dollar value ncrease) and performance/delivery period.

Current Call Value: $12,148,759.65 Value Requested by this action: $ 2,326,469.50 Total Call Value: $14,475,229.15

(The current BPA has sufficient remaining for the additional funding)

Current Period of Performance for Option Year 2:

September 20, 2025 – September 19, 2026 (No Change)

4. Identification of the justification rationale [see 8.405-6(a) and (b)] and, if applicable, a demonstration of the proposed contractor’s unique qualifications to provide the required supply or service.

a. Acquisition authority.

X This acquisition is conducted under the authority of the Multiple Award Schedule Program. Consideration of schedule contractors will be restricted to fewer than the number required by Federal Acquisition Regulation FAR 8.405-6(a)(1)(B)

This acquisition is conducted under the authority of the Multiple Award Schedule Program. Consideration of schedule contractors will be restricted only to the item peculiar to one manufacturer as provided in FAR 8.405-6(a)(2)

b. Demonstration of the proposed contractor(s) unique qualifications to provide the required supply or service.

Name and address of the proposed contractor(s).

Triple Point Security Inc:

50 Catoctin Cir NE, Leesburg, VA 20176

Nature of the acquisition and proposed contractor(s) unique qualifications.

The nature of this acquisition is to obtain approval to increase the contract for Option Year 2 under the current BPA Call with Triple Point Security. FAR 8.405- 6(a)(1)(B) states “Only one source is capable of providing the supplies or services required at the level of quality required because the supplies or services are unique or highly specialized." It is imperative that Triple Point Security be allowed to continue its work on the GRC Tool Implementation Support and NIH ZTA roadmap development in order for NIH to continue to be FISMA compliant.

Both the NIH GRC Tool Implementation and the NIH ZTA roadmap development efforts wrapped up their second-year work and are about 67% complete. Both GRC Tool requirements and the ZTA roadmap are developed based on a framework that is custom designed by the current vendor Triple Point Security LLC specifically to meet NIH’s technical requirements and environments including NIH’s high value IT assets, legacy systems, current tools and technologies deployed, NIH’s organization and IT structures, current operating environment, and available budget. Switching to a different vendor for those two efforts can introduce significant risks and financial loss. Transferring to another vendor would result in an incoherent or poorly documented framework.

Triple Point Security designed the GRC Tool and ZTA roadmap frameworks which are considered proprietary solutions making a clean transition difficult. The new vendor may have to custom design frameworks to replace the current ones resulting in significant duplication of effort leading to significant cost increase and project delay. Additional details are provided in section 6 of this document.

5. Determination by the ordering activity Contracting Officer that the order represents the best value consistent with FAR 8.404(d).

By placing an order against a schedule contract (current BPA) using the procedures in FAR 8.405, the ordering activity Contracting Officer has concluded that a modification to the existing order represents the best value (see FAR 2.101) and results in the lowest overall cost alternative (considering price, special features, administrative costs, etc.) to meet the Government’s needs. Furthermore, additional discounts will be sought before modifying the order in accordance with FAR 8.405-4.

In accordance with 8.405-2(d), Evaluation, the price evaluation will be conducted by determining if the labor proposed to perform the work is appropriate, and by determining that the total price is reasonable. The resultant modification will be a FFP effort using institutional knowledge of the work to be performed and information for previous similar efforts to negotiate a fair and reasonable price. The Government will rely on labor categories and rates consistent with the Contractor’s Federal Supply Schedule with similar discounts to those provided under the current Blanket Purchase Agreement to ensure the proper discounts are sought.

6. Description of the market research conducted among schedule holders and the results, or a statement of the reasons market research was not conducted.

NIH is currently establishing an enterprise level Cybersecurity Support Services (CSS) BPA. We received responses to our RFI, that was posted February 2025, from over 100 vendors.

Based on the market research results and our calculations, we would achieve cost avoidance of $2.88M via a sole source award to the incumbent for tasks 2, 3, and 6 instead of awarding those tasks to a new vendor. The $2.88M cost avoidance includes staffing costs to conduct the re-compete and transition costs from the incumbent to a new vendor. Additionally, as discussed in section 4b, if we switch to a new vendor, the new vendor will need to recreate the framework and all the documents and artifacts would need to be re-written. This would cause a duplicate of effort of at least 30% of the work previously completed over the last two years. This work alone will result in additional cost of $1.45M.

This Limited Source Justification (LSJ) will be posted to SAM.gov within 14 days following award for 30 days.

7. Any other facts supporting the justification.

None

Statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the restricted consideration before any subsequent acquisition for the supplies or services is made.

Removal of barriers to competition.

The completion date of the subject BPA Call is September 2026. As stated above, it is that any recompete work will be encompassed under the pending competitively solicited CSS BPA. The acquisition team is currently conducting market research for the CSS BPA to ensure adequate competition for the re-competition of this requirement.

Listing of sources, if any, that expressed an interest in writing, in the acquisition.

N/A

9. Program office certification.

This is to certify that the portions of this justification that have been developed by the undersigned program office personnel, including supporting information and/or data verifying the Government’s minimum needs or requirements, or other rationale for limited sources, are accurate and complete.

10. Contracting Officer Certification.

This is to certify that the justification for the proposed acquisition has been reviewed and that to the best of my knowledge and belief the information and/or data provided to support the rationale and recommendation for approval is accurate and complete.

11. Chief of the Contracting Office and Head of the Contracting Activity signature(s).

12. Competition Advocate signature.