B.4 Revvity ELN FedRamp - JOFOC_Redacted.pdf

Signals ELN platform used by NIH. As the software owner, Revvity has exclusive access to the platform's source code, system architecture, and internal development environment, which is required to perform the security control remediation, interoperability configuration, and technical documentation necessary to achieve FedRAMP Moderate authorization. No other company, including resellers, integrators, or third-party consultants, has the technical access or authority to modify Revvity's platform to meet these requirements. Under the prior contract ( ), the project management, documentation, and 3PAO coordination functions were managed through an intermediary rather than directly by the software owner.

This limited the Government's visibility into progress, impeded effective oversight, and ultimately resulted in higher costs without achieving FedRAMP authorization. Direct engagement with Revvity for the full scope therefore prioritizes accountability, continuity, and efficient use of Government resources.

5. Special Considerations for Certain Contract Extensions or Bridge Contracts:

N/A (Not a contract extension/bridge contract)

6. Actions to Increase Competition:

a. A Synopsis Was Published: In accordance with FAR subpart 5.1, a Notice of Intent was posted on SAM.Gov on August 7, 2026 with a close date of August 14, 2026 at 9:00AM and stated that all responsible sources may submit a capability statement, which will be considered by the Contracting Officer and the Program Office.

b. Responses Were Received: As a result of this notice, four capability statements were received. The Program Office reviewed the four statements and provided their assessment of each statement, which is saved to Tab B of the contract file. As described in the assessments, the Program Office found that all four had critical deficiencies, including that all four vendors lacked the proprietary access and requisite authority required to perform the FedRAMP remediation work on their own systems and none provided a path forward to overcome this hurdle.

c. Sources Expressing Interest: The sources listed below expressed, in writing, an interest in the acquisition, but were rejected due to the following reasons:

1.

(a) No Access to Proprietary Source Code or Internal Systems: The core objective of this requirement is to bring the Revvity ELN software to a FedRAMP Moderate compliance level. This effort necessitates direct, unfettered access to Revvity's proprietary source code, internal system architecture, and development/deployment infrastructure. As a third-party reseller, has no access to or authority to modify these proprietary systems. This work cannot be performed through a standard authorized partner or reseller channel.

(b) Fundamental Misunderstanding of Scope: ’s response indicates they perceive this requirement as a standard software resale and implementation task. However, the government’s need is not for a reseller but for a provider who can perform deep, internal system remediation and engineering to meet federal security mandates. 's proposal to act as a value-added reseller is non-responsive to the actual scope of work.

(c) Lack of Relevant Experience: does not demonstrate any experience with the federal authorization process (FedRAMP), software security remediation, or managing proprietary enterprise SaaS environments for federal customers. Their experience is in hardware logistics, telecommunications staffing, and commercial IT support, which does not align with the highly specialized software security and compliance expertise required.

2.

(a) Inability to Access and Modify Proprietary Systems: The central task of this requirement is the internal re-engineering of the Revvity platform to achieve FedRAMP Moderate compliance. This work requires direct, privileged access to Revvity's proprietary source code, internal development environments, and system architecture. , as an external consulting firm, does not and cannot have the requisite access or legal authority to perform this work.

Their expertise is in assessing, guiding, and monitoring—not in directly modifying a third-party commercial software product from within.

(b) Misinterpretation of the Government's Need: is offering services as a FedRAMP advisor and compliance partner. While such services are valuable in many contexts, this solicitation is not for advisory support. The government requires a contractor that can perform the hands-on remediation of the software itself. Our market research has already confirmed that Revvity Signals Software, Inc. is the sole entity capable of performing this internal remediation on its own proprietary product.

(c) Duplicative and Unnecessary Role: The work required is the sole responsibility of the software developer (Revvity). Hiring an external firm like would create an unnecessary and ineffective contractual layer.

They would be positioned to advise on a process they cannot execute, creating a situation where the government is paying a consultant to observe work only the OEM can perform.

3.

(a) No Access to Proprietary Systems and Source Code: Achieving FedRAMP Moderate authorization for the Revvity Signals ELN requires direct, privileged access to Revvity’s proprietary source code, system architecture, internal development environments, and operational infrastructure. This access is necessary to perform the deep technical remediation, architectural modifications, and implementation of security controls that are foundational to the authorization process. , as an external third-party consultant, does not and cannot possess this level of access.

(b) Misalignment with Sole-Source Nature of the Work: The government’s market research confirms that Revvity Signals Software, Inc. is the only entity with the proprietary rights, internal access, and inherent capability to perform the required modifications on its own product. The work is not a matter of advisory guidance but of direct, hands-on engineering and remediation of a proprietary commercial platform. Engaging a third party without this access would be operationally infeasible and would not lead to a successful FedRAMP authorization.

(c) Duplicative and Ineffective Role: While proposes to manage and guide the authorization process, they cannot perform the core technical tasks.

This would necessitate the government managing a separate contract with Revvity to perform the actual remediation work, creating an inefficient, costly, and unnecessarily complex management structure. The government’s requirement is for a single vendor capable of executing all aspects of the authorization, which is inherently limited to the software owner, Revvity.

4.

(a) No Access to or Authority to Modify Proprietary Systems: The core requirement of this effort is the remediation and modification of Revvity’s proprietary ELN platform to achieve FedRAMP Moderate compliance. This work necessitates direct access to the application’s source code, internal system architecture, and development environment. Our market research confirms that Revvity is the sole entity with the proprietary rights, access, and authority required to perform this work. , as an independent third-party vendor, does not and cannot have this level of privileged access. Any attempt to onboard a third party to perform this work on Revvity's proprietary system would be rejected by the platform owner and is therefore not a viable path forward for the government.

(b) Proposed Strategy is Not Viable: proposed execution strategies do not overcome the fundamental lack of access. While they can provide project management and compliance documentation support, they cannot perform the

With respect to SDVOSB participation, the market research did not identify two or more responsible SDVOSB concerns that are capable of performing the requirement at a fair market price and that could reasonably be expected to submit offers. Of the four vendors that submitted capability statements in response to the Notice of Intent posted to SAM.gov, only one vendor was categorized as SDVOSB, . That vendor was determined by the COR not to be capable of completing the work. Accordingly, the Contracting Officer determined that an SDVOSB set-aside is not practicable as market research did not identify an SDVOSB concern that possessed both the required proprietary technical access and could satisfy the conditions necessary for an SDVOSB sole-source award.

8. Procurement history:

NCATS requires access to a FedRAMP-authorized ELN to support laboratory studies with a chemistry focus. This acquisition will provide the necessary services to obtain FedRAMP Moderate authorization for the Revvity Signals ELN, ensuring compliance with NARA/OMB mandates to transition all federal records to electronic format. The ELN will support NCATS' research mission by providing a secure, scalable, and interoperable platform for documenting and managing research data.

Progress toward achieving FedRAMP authorization for the Revvity Signals ELN began under a previous contract but was not completed. The earlier effort was managed through an intermediary rather than contracting directly with Revvity Signals Software, Inc. (Revvity), which limited government visibility into progress and impeded effective oversight. The task order ultimately incurred higher costs without achieving the intended outcomes. While some preparatory tasks were accomplished, critical milestones such as full remediation, interoperability validation, and final submission of the FedRAMP package remained unfinished. The prior contract engaged a Third-Party Auditing Organization (3PAO) who completed a gap analysis and provided that report to NCATS and Revvity. As a result, the present requirement is limited to completing FedRAMP authorization activities for the existing NIH-selected platform. This is a new contracting action for completion of a previously initiated FedRAMP authorization effort. The importance of direct engagement with the software provider to ensure technical precision, adherence to schedule, and full compliance with FedRAMP requirements is critical.

9. Additional Information or Other Facts:

N/A

10. Technical or Requirements Program Management Certification: I certify that the supporting data under my cognizance and included in the justification are accurate and complete to the best of my knowledge and belief. (Always required.)