A16_JOFOC_NIGC_CJIS_Redacted_1.pdf

SINGLE SOURCE DETERMINATION USING

SIMPLIFIED ACQUISITION PROCEDURES (SAP) UNDER THE

SIMPLIFIED ACQUISITION THRESHOLD (SAT)

AUTHORITY: FAR 13.106-1(b)(1)

PR# 0040674485

1. Contracting activity/agency.

Department of the Interior, Interior Business Center, Acquisition Services Directorate, Division 5 Branch 1 on behalf of the National Indian Gaming Commission (NIGC).

2. Description of supplies or services required to meet agency needs.

a. The first objective of this requirement is to obtain a Commercial off-the-shelf (COTS) online system and software to ensure NIGC, Tribal Gaming Regulatory Authorities (TGRA’s) and other entities who have authorized access to Federal Bureau of Investigation (FBI) Criminal History Record Information (CHRI) from the NIGC satisfy the awareness training requirements of Criminal Justice Information Services (CJIS) Security Policy (CJISSECPOL) Policy Area 2, Awareness Training (AT).

b. The contractor must provide a COTS online system and software which will streamline NIGC audits of Tribes with access to FBI CHRI, from the NIGC to ensure the NIGC has a service with the capacity to comply with CJIS Security Policy (CJISSECPOL) Policy Area 11, 5.11.2, 2.

c. Estimated value is $39,541.00 for the base year. A total for a base + four option years is estimated at $231,977.00.

d. A planned performance period is:

8/20/2024 to 8/19/2025 – Base Period 8/20/2025 to 8/19/2026 – Option 1 8/20/2026 to 8/19/2027 – Option 2 8/20/2027 to 8/19/2028 – Option 3 8/20/2028 to 8/19/2029 – Option 4

3. Identification of the single source to be solicited.

JDI VENTURES LLC

3023 N Shannon Lakes DR STE 102 Tallahassee, Florida 32309-2368

4. Reason for authority cited. The contracting officer has determined the circumstances of the contract deem only one source reasonably available in accordance with FAR 6.302-1 Only one responsible source and no other supplies or services will satisfy agency requirements and FAR 13.106-1(b)(1)(i) Soliciting from a single source.

5. Rationale.

Based on market research, the contractor, JDI Ventures, Inc. is the only vendor that is able to provide commercial off the shelf software to meet the CJIS Audit Unit requirements for industry specific, commercial off-the-shelf (COTS) software needs.

The CJIS Audit Unit (CAU) program oversees the implementation of the NIGC’s external and internal compliance strategies to achieve and demonstrate compliance with the Memorandum of Understanding (MOU) between the Federal Bureau of Investigation (FBI) and NIGC concerning Noncriminal Justice Fingerprint Submissions. CAU audit staff deliver trainings, technical assistance and conduct selective audits / investigations of those tribes with an executed, suspended, or terminated MOU with the NIGC regarding Criminal History Record Information.

The CJIS Audit (COTS solution) from Peak Performances is in use by forty-three (43) states and five (5) federal agencies and has the capability to:

Build and perform multiple types of audits Browser based for easy use (Internet Explorer) Support multiple audit question types (Multiple choice, True/False, Yes/No, Text entry) Support relational sub questions triggered by answers Allows the CAU to set up multiple audit sections on each audit to cover topic areas Allows CAU to build out of specific compliance statements for each question Automatically builds a response to the local agency (tribes) with all compliance statements Allows the administrator to edit the out of compliance response before sending it back Allows the local agency to respond to all out of compliance areas Allows the CSA to compile internal notes on communications with local agencies Allows the CSA to see that a local agency reviewed the final report Allows the CSA to print a copy of the audit Builds and tracks the entire audit cycle Tracks all local agencies to organize and schedule audits on time Stores all audit history in the database for easy review and FBI audits Allows the local agency to review all their past audits Allows the auditor to perform the audit using the software Includes a follow up module Mark items that need follow up Schedule the items to easily view items on their due dates Has an optional document management module Allows the auditor to request the local agency upload a document during the audit 50 GB Storage Built in online training course to train the end user how to respond to your audits Built in help files that will walk the user or admin through how each function works

6. Market Research.

The NIGC needs CJIS training and auditing services to remain in compliance with Federal Bureau of Investigation (FBI) Criminal Justice Information Services (CJIS) Division at all tribal casinos. While there are small numbers of other vendors that offer CJIS services, only the incumbent contractor meets all the compliance standards.

Other sources that provide criminal justice audit services were reviewed and were determined to not meet the audit requirements for COTS software for CJIS compliance. The CJIS Security Policy contains 16 policy areas and hundreds of standards that must be met in order to comply with CJIS Security Policy (CJISSECPOL) Policy Area 11, 5.11.2, 2.

The following is a list of sources identified during market research:

a. GSA Advantage; One result after searching for “CJIS” then filtering for “Training.” Not applicable/relevant. Unsatisfactory and Unacceptable.

b. Centraleyes: https://www.centraleyes.com/. This company does not produce any custom or COTS products or services responsive to CJISSECPOL AT or Formal Audits.

c. Continuum GRC: https://continuumgrc.com/audit‐compliance‐solutions‐CJIS . This company does not produce any custom or COTS products or services responsive to CJISSECPOL AT or Formal Audits. Information provided is deceptive as the FBI does not “certify” a CJIS provider.

d. FYI Fingerprints: https://www.fyifingerprints.com/ . This company does not produce any custom or COTS products or services responsive to CJISSECPOL AT or Formal Audits.

e. Hyperproof: https://learn.hyperproof.io/ . This company does not produce any custom or COTS products or services responsive to CJISSECPOL AT or Formal Audits.

f. Oregon State Police: CJIS Learning & Development Unit, https://www.oregon.gov/osp/programs/cjis/pages/cjis‐training‐unit.aspx. State government FBI CJIS CSA, SIB. CJA authorized recipient.

g. CJIS Online, www.cjisonline.com Current contracted CJIS training provider.

h. CybeReady, https://cybeready.com/cjis‐security‐awareness‐training‐cheat‐sheet. CybeReady is a computer and network security company Santa Clara, California. The CJIS Security Awareness Training Cheat Sheet was published on October 2, 2023 and is identified as a 6 minute read. The sheet does not reflect CJISSECPOL 5.9.3. The sheet identifies 13 policy areas. 5.9.3 is 16 policy areas. The levels identified in the sheet are not accurate for the previous level based training requirements or the current role training requirements in the CJISSECPOL.

i. Compass IT Compliance, https://www.compassitc.com/blog/what‐does‐it‐mean‐to‐be‐cjis‐ compliant. Blog, December 11, 2022. Identified as an 11 minute read. Not current. References CSP 5.9.1, not CJISSECPOL 5.9.3. References 13 policy areas. CJISSECPOL is now 16 policy areas. The levels identified in the blog are not accurate for the current role based training required by the CJISSECPOL. Not applicable/relevant. Unsatisfactory/Unacceptable.

j. Texas Department of Public Safety, https://www.dps.texas.gov/section/crime‐records‐service/cjis‐ securityawareness‐training. State government FBI CJIS CSA, SIB. CJA authorized recipient.

k. Florida Department of Law Enforcement, https://www.fdle.state.fl.us/NCJA‐CSP‐ Compliance/Training, State government FBI CJIS CSA, SIB. CJA authorized recipient. CJIS Launch Pad, a Peak Performance Solution with CJIS Online, https://florida.cjisapps.com/noncrim/launchpad/

l. Department of Justice, https://www.justice.gov/otj/page/file/1266936/download. This link results produces a DOJ Tribal Access Program slide deck dated April 2020. In the slide deck the DOJ directs users to CJIS Online.

Of the eight commercial sources and four federal and state law enforcement agencies identified during market research, none met the same criteria as JDI VENTURES LLC.

Under the authority of FAR 13.106-1(b)(1), the undersigned hereby determines the circumstances of this contract action deem only one source is reasonably available as supported herein.

Mark Salyer Contracting Officer

Requirements personnel certification I certify that the technical data which forms a basis for this justification is complete and accurate and meets the Government’s minimum needs.

Heather Anderson NIGC Procurement Liasion