Notice of Intent to Sole Source.pdf

NOTICE OF INTENT TO SOLE SOURCE

Solicitation Number: 9594OIT260064 Title: Specialized Cybersecurity, Privacy Engineering, and Continuous Authorization Support Services

1. General Information.

• Document Type: Special Notice (Notice of Intent to Sole Source)

• NAICS Code: 541519 – Other Computer Related Services

• Product Service Code (PSC): DJ01 – IT And Telecom - Security And Compliance

Support Services

2. Description of the Requirement.

a. The Court Services and Offender Supervision Agency (CSOSA) intends to award a sole-source, purchase order to Business Operational Concepts, LLC, a certified Women-Owned Small Business (WOSB). The Contractor will provide expert, multi-disciplinary cybersecurity, privacy engineering, and program management services.

b. The scope of work requires the immediate deployment of qualified personnel to support a portfolio of forty-five (45) enterprise information systems transitioning to a continuous authorization model. Key technical drivers of this requirement include:

• Engineering, configuration, and operational deployment of continuous monitoring workflows utilizing the agency’s mandatory Caveonix Governance, Risk, and Compliance (GRC) platform.

• The development and execution of an enterprise migration strategy for full compliance with NIST Cybersecurity Framework (CSF) 2.0 standards.

• Authoring and implementing an agency-wide AI Threat Strategic Plan and Playbook in strict alignment with Executive Order 14110.

• The ongoing execution of complex Privacy Threshold Analyses (PTAs), Privacy Impact Assessments (PIAs), and annual FISMA audit preparation activities.

3. Statutory Authority. The statutory authority permitting other than full and open competition for this acquisition is Section 8(m) of the Small Business Act (15 U.S.C. 637(m)), as implemented by FAR 6.302-5(b)(7) ("Sole source awards under the Women-Owned Small Business (WOSB) Program") and FAR 19.1506. The applicable NAICS code is 541519, which is formally designated by the Small Business Administration (SBA) as an industry substantially underrepresented by WOSB concerns.

4. Justification for Sole Source. Business Operational Concepts, LLC is uniquely qualified to execute this highly technical scope of work without introducing unacceptable operational gaps, data vulnerabilities, or transition delays to the agency’s 45 systems. The Contractor possesses specialized, proven corporate past performance transitioning organizations from the Static 3-year ATO model to Continuous ATO model using Governance, Risk and Compliance tools such as Cavenoix, etc. within federal environments and maintains an immediate pipeline of certified Key Personnel holding required combinations of PMP, PMI-ACP, and advanced security/agile certifications.

5. Response Instructions.

a. This notice is not a request for competitive proposals. However, interested, SBA-certified WOSB concerns that believe they can fully meet the specialized technical requirements described above may submit the following:

(1) Active SBA certification as a WOSB in SAM.gov under NAICS 541519

(2) At least one project demonstrating corporate experience engineering and managing the following:

(a) Security authorizations via tools such as Caveonix GRC platform.

(b) Authoring federal enterprise strategies for NIST CSF 2.0 migration and AI framework implementation.

(c) Delivery of ATO packages for multiple systems (minimum 15) within a 12 month period.

(d) Immediate corporate capacity to staff qualified personnel meeting the following education, experience, and certifications (provide resumes showing capability):

(i) Program Manager with the following certifications and qualifications:

• ITIL v4 Foundations;

• Project Management Professional (PMP);

• PMI-ACP Certified;

• SAFe Product Owner/Product Manager;

• Certified SAFe Scrum Master; and

• Certified SAFe Agilist.

• Minimum of seven (7) years of progressive project/program management experience supporting federal cybersecurity or IT modernization efforts;

• Demonstrated experience managing multi-disciplinary teams in a federal environment, preferably supporting ISSO/RMF/ATO activities; and

• Strong knowledge of FISMA, NIST RMF, NIST SP 800-53, CSF 2.0, and federal compliance reporting.

(ii) At least four Information System Security Officers (ISSOs) with the following certifications and qualifications:

• (ISC)² CISSP;

• Certified Information Security Manager (CISM); and

• Certified Information Security Auditor (CISA).

• Minimum of five (5) years of hands-on experience performing ISSO or equivalent functions in a federal environment;

• Demonstrated experience developing and maintaining SSPs, SARs, POA&Ms, SIAs, and supporting ATOs under the NIST RMF; and

• Experience with continuous monitoring, vulnerability management, risk assessments, and privacy compliance (PTA/PIA).

(3) The submitted project must include the following information:

• Title;

• Description how the submitted projected aligns with all elements identified in

5.a(2) above;

• Period of performance;

• Value;

• Client reference information.

b. The above information must be submitted electronically via email to catherine.collins@csosa.gov no later than August 5, 2026. All responses must be in writing.

Telephone requests/information will not be considered.

c. This notice is not a request for competitive proposals; however, the Government will consider all responses received by the response date stated above. A determination by the Government not to compete this acquisition is solely within the discretion of the Government.

6. Place of Performance. CSOSA location 800 North Capitol Street, NW, Washington, DC, 20002-4260.

mailto:catherine.collins@csosa.gov