JOFOC_Redacted.pdf

U.S. Department of Energy Washington, DC 20585

Justification for a Sole-Source 8(a) Contract over $25 Million Office of Headquarters Procurement Services (MA-64)

Assessment and Authorization (A&A) Support Services For the Office of the Chief Information Officer (OCIO)

1. Identification of the Agency and Contracting Activity

This document sets forth the justification and approval for award of a sole-source 8(a) Indefinite Delivery Indefinite Quantity (IDIQ) contract to an Alaska Native Corporation Owned Firm (ANC) over $25 million in accordance with Federal Acquisition Regulation (FAR) 19.805-1(b)(2); where an acquisition exceeds the competitive threshold (i.e.; $7 million for acquisitions assigned manufacturing North American Industry Classification System (NAICS) codes and $4.5 million for all other acquisitions), the Small Business Administration (SBA) may accept the requirement for a sole source 8(a) award if SBA accepts the requirement on behalf of a concern owned by an Indian tribe or an Alaska Native Corporation.

In accordance with FAR 19.808-1(a), the SBA may not accept for negotiation a sole-source 8(a) contract that exceeds $25 million unless the requesting agency has completed a justification in accordance with the requirements of FAR 6.103-5.1 The proposed contractor, Akima Mission Optimization, LLC, (hereafter referred to as �AMO�) is an Alaska Native Corporation (ANC) Owned Firm. This memorandum outlines the justification for the award of a sole-source to an ANC. FAR 6.104-1(b) provides:

For sole-source 8(a) contracts over $25 million, the justification must include, at a minimum, the contents described at paragraphs (a)(3), (a)(4), and (a)(7) of this section. It should also include a determination that using a sole-source contract is in the best interest of the agency concerned and any other matters specified by agency procedures.

FAR 6.104-1 (a)(3); (a)(4) and (a)(7) provide respectively:

(a) At a minimum, each justification must include the following information:

(3) A description of the supplies or services required to meet the agency's needs (including the estimated value).

1On July 18, 2025, the Department of Energy (DOE) effected a class deviation to implement the Federal Acquisition Regulatory Council�s model deviation text to the Federal Acquisition Regulation (FAR) Part 6 - Competition Requirements in accordance with, in part, the Office of Management and Budget (OMB) memorandum M-25-26, Overhauling the Federal Acquisition Regulation, which initiated a major overhaul of the FAR (Revolutionary FAR Overhaul, or �RFO�). DOE�s Class Deviation states that DOE will use the RFO model deviation text for Part 6 in lieu of 48 Code of Federal Regulations (CFR) Part 6. Consequently, there is a citation discrepancy regarding FAR 19.808-1(a) referenced above. FAR 19.808-1(a) refers to adhering to the requirements of FAR 6.303, but because of DOE�s use of RFO Part 6, this citation now maps to a FAR 6.103-5 authority.

(4) An identification of the statutory authority permitting other than full and open competition

(7) A determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

This requirement is being offered under the 8(a) Business Development Program (15 U.S.C. 637) by the U.S. Department of Energy (DOE), Office of Headquarters Procurement Services (MA-64), located in Washington, DC on behalf of the Office of the Chief Information Officer (OCIO).

2. A Description of the Supplies or Services Required to Meet the Agency�s Needs

OCIO enables the DOE�s missions in energy, science, and nuclear security through the power of information and technology. In support of the Chief Information Officer (CIO) requirement to develop and maintain an agency-wide cyber and information security program, the OCIO Office of Cybersecurity (IM-30) leads cybersecurity operations, strategy, policy, authorization, and assessment efforts across the Department. IM-30 program goals are as follows:

Ensure Resiliency Through Increased Operational Visibility

Increased operational visibility across DOE program offices, sites, and labs is a critical component to protecting Federal data systems and networks. This increased visibility enhances situational awareness of DOE networks and enables more accurate and timely reporting and incident response. To improve Enterprise operational visibility, IM-30 ingests, integrates, analyzes, and protects cybersecurity data while enriching information sharing and collaboration.

Enhance Risk Management Practices to Support Business Decisions

Effective enterprise risk management (ERM) ensures that resources are focused on prioritized risks with the greatest potential to impact operations and mission accomplishment. Through the enhancement of Enterprise Cybersecurity Risk Management (ECRM) and the Information and Communication Technology (ICT) Supply Chain Risk Management (SCRM) programs, IM-30 implements frameworks and methodologies for cybersecurity risk assessment and measurement to maximize value, increase operational performance, ensure regulatory compliance, and provide consistency and continuity in decision-making, prioritization, and communication across all levels. IM-30 also improves the processes around security authorizations that are included in the risk management lifecycle.

Develop Cybersecurity Policy and Execute Governance Activities

Strategy and policy analysis and development are vital to keeping OCIO integrated with Federal cybersecurity requirements and guidance. Internal and external collaboration communicates DOE initiatives and increases awareness of how Department-wide, interagency partner and private sector entities are approaching the changing cybersecurity landscape. This collaboration has yielded significant benefits to OCIO on the topic of Executive Order (EO) 14028, Improving the Nation�s Cybersecurity.

Deliver Improved Cybersecurity Training, Education, and Awareness

IM-30 improves stakeholder experience through improved training, education, and awareness.

These efforts are crucial to enabling informed risk-based decision making by mission owners as informed decision-making hinges on knowing how to ask the right questions and having a clear network of resources to rely on for support. Building the cybersecurity community within DOE, and in partnership with other Federal agencies, enables the formation of those networks underpinning the DOE�s cyber professionals, as well as the broader Enterprise workforce.

In support of the above goals, the Contractor shall assist DOE with performing the following:

Support the leadership and stakeholders with managing risk reduction and authorization through a variety of project management activities such as maintaining project schedules, assessing the impact of new laws, regulations, polices and guidance on A&A requirements/initiatives and implementing any changes required to remain compliant.

Demonstrate knowledge and expertise of the current National Institute of Standards and Technology (NIST) and Committee on National Security Systems (CNSS) requirements and guidance supporting risk reduction.

Maintain processes by keeping A&A templates such as the Security Assessment Reports (SAR) and Executive Summary Reports current and in accordance with DOE policies and NIST guidance.

Develop, review, and approve assessment plans to assess implemented controls.

Provide support in developing, updating, and maintaining the Program Cyber Security Plans (PSCPs).

Assess the controls in accordance with DOE guidance documents and the assessment procedures described in assessment plans.

Prepare assessment reports documenting the findings and recommendations from control assessments.

Support the development of initial remediation actions and Plan of Action and Milestones (POA&M) on the controls and reassess remediated controls.

Assemble the authorization package and submit the package to the authorizing official.

Assess the controls implemented within and inherited by the system in accordance with the continuous monitoring strategy.

Assist the system owners with artifact gathering as required during Government sponsored audits.

Conduct risk assessments and risk review of new/emerging technologies, trends, and solutions.

Provide support for the Enterprise Authorization to Operate (eATO) program.

Provide support for DOE Federal Risk and Authorization Management Program (FedRAMP) program.

Automate processes by loading and maintaining information into tools and applications as requested.

Monitor routing, signature approval process, and workflow of assigned documents to ensure document meets project schedule timelines.

Assist with the update and implementation of new or revised cybersecurity governance and policy, as required.

Provide support for audits and data calls relating to A&A, as required.

Plan, coordinate, facilitate and possibly participate in cybersecurity related meetings and working group discussions. Prepare meeting minutes, action items, and follow up on action items assigned to IM-30 or the Chief Information Security Officer (CISO). Prepare working materials including briefing materials, white papers, and handout, as appropriate.

Provide cybersecurity related services to meet additional support requirements defined on a Task

Order basis by the Contracting Authority of the requesting Departmental Elements.

System support to ensure that CISO and Cybersecurity support systems including Governance, Risk and Compliance (GRC) tools are securely designed, developed, operated, and maintained for the CIO and other offices across DOE.

Provide �Train the Trainer� and other Cybersecurity training support especially regarding FedRAMP, the A&A process, the Federal Risk Management Framework (RMF) and GRC tools.

Any other scope that the Department deems necessary for providing an efficient, secure and resilient operating environment for the Department of Energy.

Provide subject matter expertise on the secure operations of current and future Information Technology (IT) and Operations Technology (OT) systems at DOE. This could include cloud-based future, Artificial Intelligence (AI), and quantum solutions.

Provide support in response to customer priorities in support of any of the above listed activities.

Name and Address of the Proposed Contractor:

Akima Mission Optimization, LLC 2553 Dulles View Drive, Suite 700 Herndon, VA 20171 UEI Number: Y26LESNVKR67 NAICS Code: 541519 � Other Computer Related Services

Contract Type:

In accordance with FAR 16.504(c)(2), MA-64 plans to award a single-award IDIQ contract where firm-fixed-price (FFP), time-and-materials (T&M), labor hour (LH), or a combination of these contract type task orders, may be issued under the IDIQ.

Pursuant to FAR subpart 16.601(d), prior to the issuance of a T&M or LH Task Order, the CO will:

Prepare a Determination and Findings (D&F) that no other contract type is suitable.

The D&F will be� o Signed by the CO prior to the execution of the Base Year or any Option Years of the order; and o Approved by the Head of the Contracting Activity (HCA) prior to the execution of the Base Year when the Base Year plus any Option Years exceed three years;

and

Ensure that the order includes a ceiling price that the contractor exceeds at its own risk.

Estimated Total IDIQ Ceiling Value (including options):

The estimated total IDIQ ceiling value and anticipated Ordering Period is as follows:

3. Specification of the Statutory Provision Providing the Exception from the Requirement to Use Competitive Procedures in Entering into the Contract (see FAR 19.805-1)

Sole-source awards under the 8(a) Program (15 U.S.C. 637) are authorized, therefore full and open competition is not required. Likewise, FAR 19.805-1(b)(2) states, �where an acquisition exceeds the competitive threshold, the SBA may accept the requirement for a sole source 8(a) award if the SBA accepts the requirement on behalf of a concern owned by an Indian tribe or an Alaska Native Corporation.�

4. Determination that the Use of a Sole-Source Contract is in the Best Interest of the

Agency Concerned

The award of an 8(a) sole-source IDIQ contract that exceeds $25 million to an ANC is in the best interest of DOE because this contract will support the achievement of the OCIO�s mission objectives and goals, and it will support the achievement of DOE�s small business goals.

The proposed contractor, AMO, provides IT and cybersecurity support services to the DOE, DOD (Army/Navy/Air Force), Federal Civilian agencies, and Intelligence Community Joint Command partners such as INSCOM and INDOPACOM Command, as well as Control, Communications, and Cyber Directorate (J6).

AMO is a member of the Akima, LLC (Akima) family of companies, which maintains a portfolio of small businesses, 8(a) companies, and operating companies with a proven track record of ensuring mission success. Within the last 3 years, Akima subsidiaries held 12 DOE contracts, employing hundreds of Q- and L- cleared employees at DOE locations nationwide such as:

National Nuclear Security Administration (NNSA) Operations Security (OPSEC) Personnel Security & Facility Clearance Program (62 Full-time Equivalents (FTEs))

Sandia National Laboratories (SNL) Mission Support (114-200 FTEs) Consolidated Nuclear Security (CNS) (Y-12 National Security Complex/Pantex) IT and Engineering Support Services (75 FTEs) Oak Ridge National Laboratory (ORNL) Project/Business Management Support

Services Lawrence Livermore National Laboratory (LLNL) Mission Support Services (520-700

FTEs) Waste Isolation Pilot Plant (WIPP) Engineering Support Services (35 FTEs) United Cleanup Oak Ridge (UCOR) Engineering Support Services (newly awarded) NNSA Chief of Nuclear Security Technical Support (5 FTEs)

AMO also has the required corporate experience, staffing/recruiting capability, and past performance to manage a contract of this size, scope, and complexity. In addition, AMO prioritizes five areas as critical for delivering value to the OCIO:

Enterprise IT: Focusing on helping agencies transform their existing infrastructure to reimagine workflows, enhance security, and improve overall delivery. This includes enterprise architecture, IT service management, as well as the administration of complex databases to establish unified communications across the enterprise.

Cybersecurity: Focusing on helping agencies detect, pre-empt, and thwart complex and evasive threats. This includes not only the basics of confidentiality, integrity, availability, and response but also policy governance, Security Operations Center (SOC) operations, and forensics.

Data Analytics: Focusing on helping agencies to unlock the power of data and automate recommended actions to improve mission outcomes. This includes AI, Machine Learning, and Robotics.

Digital and Systems Modernization: Focusing on industry best practices and collaboration to design systems and applications in support of agency mission.

This includes Cloud Migration; Agile engineering; performance management; and system kitting, staging, and refresh.

Technology Products & Solutions: Focusing on helping agencies evaluate, analyze, and recommend ways to implement next-generation technologies in a way that best aligns with mission requirements. This includes vendor agnostic solutioning and license management.

Akima is an ANC, SBA certified 8(a), a small, disadvantaged business (SDB), and a benefactor of the Alaska Native Claims Settlement Act (ANCSA) enacted in December 18, 1971. AMO was founded in 2019 as a subsidiary of Akima, maintains Top Secret Facility Clearance (TS FCL), is a certified 8(a) SDB, and a member of the Akima family of companies. The Akima family of companies offers extensive understanding of the DOE environment gained through service to the DOE. Coupled with their expertise in mission support services that enhance operational efficiency and effectiveness for government agencies, and the ability to provide highly technical subject matter experts (SMEs), will progress the OCIO�s mission. AMO�s organizational structure allows them to leverage a shared services model that provides DOE with standardization, consistency, and quality control as well as dedicated back-office infrastructure while maintaining the flexibility, readiness advantages, and status of a small business. AMO can also easily access Akima resources, tools, and employee expertise to contribute to the performance of the IDIQ contract.

In summary, AMO�s robust understanding of the OCIO�s requirements regarding cybersecurity operations, strategy, policy, authorization, and assessment efforts demonstrates capability to fulfill the full spectrum of DOE�s anticipated cyber and information security requirements. In addition, since AMO is an ANC SBA certified 8(a) and SDB, these certifications will help DOE meet a multitude of small business acquisition goals while simultaneously fulfilling the needs of the agency.

Based on the above information and market research (see Market Research Report), DOE has determined that awarding a sole-source 8(a) award to AMO is in the best interest of the Government.

5. Determination that the Anticipated Cost of the contract will be fair and reasonable

The contracting officer (CO) will compare proposed prices to the Independent Government Cost Estimate (IGCE) developed for this requirement which incorporated a labor category and rate analysis that compared labor rates from similar labor categories, published on the General Services Administration (GSA) Multiple Award Schedule (MAS) for companies that provide similar services.

6. Such other Matters as the Head of the Agency Concerned Shall Specify for Purposes of this Section

A sole-source 8(a) IDIQ contract is necessary to support the OCIO�s need for cybersecurity, privacy, and assessment and authorization support services to accomplish its mission, strategy, and strategic goals. AMO has the required capabilities and expertise to satisfy OCIO�s requirements to include assisting the OCIO with improving the DOE�s cybersecurity posture.

The CO will provide a copy of DOE�s approved justification to the SBA�s Associate Administrator for Business Development to obtain the SBA�s authorization for DOE to negotiate directly and issue a contract award to the identified 8(a) ANC Firm. Additionally, a copy of this justification will be posted to SAM.gov for a minimum of 30 days in accordance with FAR6.301(c)(3), Availability of the Justification.

APPROVED BY: