U.S. Department of Transportation

Federal Railroad Administration

U.S. DEPARTMENT OF TRANSPORTATION FEDERAL

RAILROAD ADMINISTRATION SOLE SOURCE

JUSTIFICATION

1. Agency and Contracting Activity

Department of Transportation (DOT), Federal Railroad Administration (FRA), Office of Acquisition (RAD-30) , 1200 New Jersey Avenue, S.E., Washington, DC 20590.

2. Nature and/or Description of the Action Being Approved

This action is a 12-month, sole source, bridge order to the incumbent vendor, Criterion Systems LLC., for continued Cybersecurity and Privacy Program Support Services. This bridge will extend the period of performance from July 19, 2026, to July 19, 2027. This contract action is necessitated by the United States Department of Transportation’s (USDOT) reorganization of its Information Technology (IT) function into a digital factory model under the 1DOT organization

3. Description of the Supplies/Services Required to Meet the Agency’s Needs

The FRA requires uninterrupted, highly specialized Cybersecurity and Privacy Program Support Services. These services ensure the FRA fully complies with the Federal Information Security Modernization Act (FISMA) of 2014, OMB Circular A-130, and relevant Departmental cybersecurity directives.

The scope of work encompasses comprehensive coverage for all FRA FISMA-reportable systems, requiring the continuous maintenance of the Risk Management Framework (RMF) and the Information Security Continuous Monitoring Program (ISCMP). The architecture currently under administration includes:

• Eight (8) production systems (including three hosted in the cloud, seven Moderate Security Impact systems, and five Privacy systems).

• Four (4) systems under active development, bringing the total technical architecture to twelve (12) IT systems.

• Environment Composition: Microsoft Dynamics 365 applications, cloud environments (SaaS, PaaS, IaaS), and on-premises datacenters.

The contractor is required to operate, monitor, and configure the DOT and DHS Security Tool Suites utilized within the FRA enclave. This includes specialized engineering and administration of tools such as Tenable Nessus, BigFix, SCCM, SCOM, DB Protect, Netsparker, Burp Suite, and the DOT Cybersecurity Assessment and Management (CSAM) repository. The required services mandate senior key personnel—specifically a Project Manager and Senior Information System Security Specialists—possessing advanced credentials (CISSP, CISA, CAP/SSCP, CIPP, CCSK) and deep, institutionalized knowledge of FRA’s safety-critical infrastructure.

• Estimated Value of Extension: $775,027

• Critical Need: These services are essential for the integration of FRA team under the new Digital Factory model mandated by the FY26 THUD Appropriations Act – passed as section D of the Consolidated Appropriations Act, 2026, Consolidated Appropriations Act, 2026 (P.L. 119-75).

4. Statutory authority permitting other than full and open competition

The authority to extend this order without full and open competition is located under GSAR 538.7104-3. The pertinent authority is GSAR 538.7104-3(b)(ii) provides an exception to fair opportunity where “only one source is capable of providing the products, services, or solution required at the level of quality required because the products, services, or solutions are unique or highly specialized.”

Duplication of Cost & Operational Inefficiency

Competing this intermediate 12-month bridge period would introduce substantial duplication of costs that the Government would not recover through competition. A new vendor would require extensive onboarding, system-level credentialing, and a protracted transition-in period to match the current technical velocity. The incumbent, Criterion Systems, LLC., possesses non-transferable, system-specific architectural knowledge derived from managing the RMF lifecycle of FRA's custom Microsoft Dynamics 365 environments and cloud enclaves.

The cost to offboard the incumbent, execute a multi-month transition, and clear new personnel through DOT Order 1630.2B background checks for a temporary 12-month pipeline is fiscally irresponsible and structurally inefficient. It directly violates the streamlined, cost-conscious intent of the RFO framework.

Onboarding Delays

A transition to any other vendor at this juncture would trigger an immediate 90 to 120-day degradation of operational support while new personnel undergo mandatory agency-specific tool training (e.g., DOT CSAM and BigFix workflows), and understanding of FRA’s systems and environment. Because this requirement supports active safety-critical rail systems, the agency cannot absorb the multi-month delay required to stand up an uninitiated contractor workforce.

5. Demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the authority cited

• Unique Knowledge: Use of other than full and open competition is justified due to the unique circumstances associated with the FY26 Transportation, Housing and Urban Development (THUD) Appropriations Act, which mandates major enterprise level consolidation of all Information Technology divisions following the new One DOT strategy under the Department of Transportation (DOT) Chief Digital and Information Officer (CDIO) and modernization including RMF modernization to improve speed in delivery through innovation. The current contractor, Criterion, possesses critical institutional knowledge of FRA’s existing IT environment, applications, and infrastructure. This knowledge is necessary to support the One DOT transition of FRA systems into this operating model. This knowledge includes familiarity with FRA’s legacy systems, DOT cybersecurity and privacy operational processes, and security architecture that are directly tied to ongoing modernization and consolidation activities..

• Unacceptable Risk: Awarding this requirement to a new vendor/contractor source at this stage would introduce significant operational and schedule risk. A new vendor would require an estimated 90–120-day transition period to gain the necessary understanding of FRA’s systems and environment. Such delays would hinder FRA’s ability to meet the statutory consolidation timeline while potentially disrupting ongoing Cybersecurity operations support and delaying the migration of mission systems into shared product lines. This would also create unacceptable operational and cybersecurity risks to FRA systems that support critical safety and regulatory functions creating significant security and operational vulnerabilities.

• Strategic Misalignment: Additionally, conducting a full and open competition at this time would likely result in an award structure that does not align with the final One DOT CDIO operating model. As the department finalizes the enterprise consolidation framework, any newly competed contract could require substantial restructuring, duplication of costs, or early contract termination once the final model is implemented.

Continuing services with the incumbent contractor during this transitional period ensures continuity of operations, reduces cybersecurity and privacy risk to mission systems, and supports alignment with the Department’s evolving enterprise cybersecurity governance structure.

6. Determination of Fair and Reasonable Cost

The Contracting Officer will ensure that the total estimated cost of $775,027for this 12-month bridge extension is fair and reasonable. The cost determination will be established utilizing the following methods:

• Historical Price Analysis: Comparison against the competitively established base and option year labor rates under the current Call Order (693JJ621F000026).

• GSA Schedule Alignment: Verification that all utilized labor categories correspond directly with, or are lower than, the capped commercial services pricing on Criterion, Inc.’s underlying GSA Schedule Contract.

• Independent Government Cost Estimate (IGCE): Validation against a detailed IGCE formulated by the FRA IT program office, factoring in historical hours expended across core FFP CLINs and historical LH ad-hoc requirements.

A formal price negotiation memorandum will document the final agreement, ensuring the taxpayer receives maximum value under commercial terms.

7. Description of the Market Research Conducted

Market research was conducted in early 2026 to evaluate the feasibility of satisfying this requirement through alternative commercial channels. While multiple highly capable cybersecurity vendors hold Federal Supply Schedules, market research confirmed that no alternative commercial vendor can assume administration of FRA’s safety-critical systems instantaneously without creating an immediate operational break in coverage.

Furthermore, because the USDOT is actively executing a top-level modernization strategy, traditional market research confirms that entering into a multi-year competitive contract under standard legacy frameworks would result in redundant contracting vehicles. Criterion remains uniquely positioned as the only commercial source capable of maintaining the requisite continuous uptime and operational continuity for these specific 12 systems during this highly technical bridge window.

8. Any Other Facts Supporting the Justification

Operational Risk & Mission Failure Mitigation

The FRA is currently in the high-stakes phase of an agency-wide technical transition to a modernized "digital factory method" for IT delivery. This modernized framework fundamentally restructures how software, security, and infrastructure are provisioned across the

Department. Introducing a vendor transition or causing a lapse in cybersecurity support during this active migration window creates an unacceptable vulnerability window for FRA's safety-critical infrastructure.

The incumbent’s continuous presence is required to maintain the Authority to Operate (ATO) for the current 8 production systems and securely steer the 4 systems under development into production. Any disruption would directly jeopardize the vulnerability management program, weaken incident response capabilities, and compromise the continuous monitoring of the enterprise network via the CDM tool suite. This risk directly impacts national transportation safety telemetry.

RFO Policy Alignment (DOT CD 2026-22 / 2026-24)

This action directly aligns with the streamlined commercial acquisition principles mandated by the USDOT Senior Procurement Executive. Under DOT CD 2026-22 (implementing the "Common Sense" mandate of EO 14275), procurement activities are directed to bypass redundant, burdensome competitive cycles for legacy pipelines that are scheduled for decommission or structural absorption. Forcing a full open competition for a temporary, 12-month standalone bridge when the underlying pipeline is dying would be a direct violation of CD 2026-22.

Additionally, executing this extension via a bilateral modification allows the Government to strictly adhere to DOT CD 2026-24. This ensures the mandatory, updated RFO commercial services clauses (specifically the integration of the modern Clause 52.222-90 framework) are bilaterally incorporated into the order, hardening the regulatory compliance posture of the legacy order before its ultimate sunset.

9. Actions to Remove Barriers to Competition

The use of other than full and open competition for this requirement is limited to the current transitional period associated with the Department of Transportation’s (DOT) Department-wide IT consolidation under the Office of the Chief Information Officer (CIO), as directed by the FY26 Transportation, Housing and Urban Development (THUD) Appropriations Act. Once the DOT CIO Digital Factory operating model and supporting acquisition framework are finalized, future requirements for DevOps, software engineering, and application support services will be aligned with the Department’s enterprise acquisition strategy.

At the conclusion of this 12-month bridge period, this localized, legacy FRA pipeline will be completely phased out. The Cybersecurity and Privacy Program Support Services will be structurally transitioned into the centralized, multi-mode USDOT Digital Factory vehicle. This enterprise-wide vehicle is designed to commoditize and institutionalize IT delivery across all operating administrations.

By executing this temporary bridge extension, the FRA secures the necessary runway to map its 12 reportable FISMA systems into the broader Digital Factory modern framework, ensuring that all future iterations of these requirements are fully competed under the modern, agency-wide commercial acquisition ecosystem.