Control No: MICC 2026-8

FAR Part 8 Limited Sources Justification

1. Requiring Activity: Headquarters, U.S. Army Medical Command, JBSA Fort Sam Houston, TX.

2. Contracting Activity: U.S. Army Mission and Installation Contracting Command (MICC) - Fort Sam Houston, Mission Support Division, 2205 Infantry Post Road, Fort Sam Houston, TX 78234.

3. Description of Action: Request approval of a new nine (9) month firm-fixed-price task order under the General Services Administration (GSA) Federal Supply Schedule (FSS) Program with Three Wire Systems, LLC, 3130 Fairview Park Drive, Suite 425, Falls Church, Virginia 22042. The requirement is to continue to provide sustainment of the FASOR2.0 IT platform under contract W9124J-20-F-0110 with a limited scope as well as migrate data to the new Army designated platform and decommission the current platform. The Government will execute this action against FSS contract GS-35F- 0300T Multiple Award Schedule (MAS) to Three Wire Systems LLC, 1775 Tysons Blvd.

FL5, McLean, VA 22102-4285. Award is projected for January 2026 and fiscal year 2026, Operations and Maintenance (OMA) funds will be used. An acquisition plan is not required because this procurement does not meet the threshold at Defense Federal Acquisition Regulation Supplement 207.103(d)(i)(B).

4. Description of Supplies/Services: This requirement is for the sustainment of the FASOR2 IT system until such time as the new agile platform is operational as required by Army Directive 2024-02 (Enabling Modern Software Development and Acquisition Practices). The new platform is projected to be operational and ready on 01 October 2026. The contractor shall also migrate data from the current system into the new platform and decommission FASOR2. FASOR2 is the authoritative data source for Army child and adult abuse incidents that are referred to the FAP. This effort will maintain the FASOR2 Authority to Operate (ATO) in the cloud environment; sustain and support Cyber Security of the legacy system for all users, isolate required data in the Army Central Registry, migrate data into the new designated platform and permanently decommission FASOR2 in its current iteration. Specifically, the contractor shall provide the following services:

Sustainment of the existing FASOR2 version for 9 months.

Provide Cyber Security expertise to use the Risk Management Framework (RMF) process to maintain the FASOR2 ATO in the Cloud environment.

Migration of data from the FASOR2 into the designated Agile platform.

Federal law mandates all military Services to implement the Office of Secretary of War FAP in accordance with Department of War (DoW) directives. These directives and U.S. Army regulations require FAP data collection and retrieval for historical checks, child and adult abuse incident management, and reporting to Congress, DoW and Army. The National Defense Authorization Act (NDAA) has mandated FAP requirements since 1981. There is no substitute system that can track the data for the Army to produce the required reports for Congress.

Period of performance:

Base Year: 24 JAN 2026 - 30 SEP 2026 Value: $1,248,322.01 FAR Clause 52.217-8: 01 OCT 2026 - 30 MAR 2027 Value: $ 818,881.34

Total Value: $2,067,203.35

5. Authority Cited: Title 41 United States Code (U.S.C.) §4106(c)(2) as implemented in Federal Acquisition Regulation (FAR) 8.405-6 and substantiated by FAR 8.405- 6(a)(1)(i)(B) -- Only one source can provide the supplies or services required at the level of quality required because the supplies or services are unique or highly specialized.

6. Reason for Authority Cited: The FASOR2 IT system is the Army’s IT system of record used by FAP to execute DoW FAP policy and directives. Three Wire Systems, LLC is the incumbent contractor and sole source with knowledge of the Army Central Registry (ACR) data. Three Wire Systems successfully migrated data from the legacy FASOR to FASOR2 and in the process, developed their expertise in isolating data sets, which is an essential competence that is crucial for timely and successful data migration to the designated Agile platform. Their historical knowledge of the ACR and the coding they developed to migrate the data to alternative platforms makes them the uniquely qualified and the only source capable of providing these highly specialized services.

a. Background.

Defense Web Technologies, the original designer/developer of the FASOR IT System, began building the Army FASOR using their proprietary Xtendable Server technology in 2005. They continued to work on FASOR through 2014, when Humana acquired Defense Web Technologies. At that time, Humana made the decision to drop all Federal Information Technology projects, to include FASOR, prompting Defense Web Technologies to identify Three Wire Systems, LLC as the exclusive Xtendable Service provider to continue support and maintenance, until the proprietary Xtendable Server platform was eventually decommissioned. Outside of Defense Web Technologies and Three Wire Systems, LLC, no other contractor has worked on the FASOR IT system. Because of this, when Georgia Tech Research Institute (GTRI) was awarded contract W31P4Q-18-D-0002 in 2018 to maintain and support FASOR, they were forced to limit their involvement with performing translation of the source code to meet new standard requirements. Subsequently, GTRI subcontracted all work to Three Wire Systems, LLC relating to the sustainment of the FASOR IT system and the modification/updating of the source code. Defense Web Technologies issued the Government a perpetual license for the Xtendable Server core and the libraries that existed at the time, including everything related to the FASOR IT system. The Xtendable Server core included everything needed to set up a basic web site. Three Wire Systems, LLC has continued to develop additional FASOR IT system libraries and features, which are their intellectual property. No other contractor had access to these libraries and, therefore, the full FASOR IT system code suite. Personnel currently with Three Wire Systems, LLC were initially hired for key positions in 2014 from their previous positions with Defense Web Technologies. These personnel developed the original FASOR IT system and currently work to sustain and meet Government requirements, as well as maintaining a compliant cyber posture.

In September of 2020, Three Wire Systems, LLC was awarded a GSA Task Order

(W9124J-20-F-0110) to modernize and enhance FASOR with a period of performance from 24 September 2020 to 23 July 2025. The requirement was to continue to provide sustainment to FASOR as well as translate all functionality to non-proprietary coding in the cArmy Cloud Environment and migrate all data from the Xtendable Server to the Cloud Environment. Although the software is still proprietary, it is now owned by the Government and the Xtendable Server platform was decommissioned. The intent was to recompete the sustainment of FASOR2 as a competitive requirement. However, in August of 2024 the FASOR requirement was considered an ideal candidate for the ACC-APG Digital Capabilities Contracting Center of Excellence, which would handle any requirements for these types of IT services. During the long review process, the Army instituted policy to move all systems to a low code/no code environment (Army Directive 2024-02 Enabling Modern Software Development and Acquisition Practices).

The new platform is projected to be operational on 01 October 2026. As a recompete to sustain FASOR2 is no longer needed, MEDCOM requested a new contract to provide continued sustainment of FASOR2 until the new platform is ready and data can be migrated. Three Wire Systems is the only company with the required level of knowledge and experience to sustain the current FASOR2 server technology, with access to the full source code suite, and familiarity with the day-to-day duties of Military Family Programs to include the FAP.

The FAP mission is military unique in its efforts to prevent, manage, and treat victims and offenders in child maltreatment and domestic abuse in the Army. The FAP operates under the authority of U.S. laws for child abuse and victim advocacy and implements the program in the Army in compliance with Army Regulation (AR) 608-18, The Army Family Advocacy Program, and DoDI 6400.01 Family Advocacy Program. These regulations govern the Army-unique capabilities that FAP and FASOR must provide.

Parts of the FAP mission include, but are not limited to, Child and Adult Abuse prevention, management and treatment of abused victims, Domestic Abuse Victim Advocacy, New Parent Support Program, and Problematic Sexual Behavior of Children and Youth. FAP mission requirements are specific to the military, operate globally on U.S. military installations, and require annual reporting to Congress. FASOR is the information system used to manage incidents of adult and child abuse referred to the Army. Knowledge of the FAP mission and its unique requirements would be highly difficult for a contractor not currently aware of Congressional, DoW and Army mandates for the FAP. Three Wire Systems, LLC has extensive knowledge of the FAP programs and mandates.

FAP has a complex clinical decision-making algorithm (decision tree algorithm) as well as regulations that come from the National Defense Authorization Act, the DoW, the Department of the Army, and MEDCOM; all of which can change from year to year.

Some of the FAP subprograms interact and are interdependent at times. One of these subprograms shares data with the other applications on the platform on which it resides.

Various levels of hierarchy within the FAP (e.g. FAP Manager, FAP Chief, FAP supervisor, FAP Administration & Command), and across organizations from Medical Treatment Facilities to MEDCOM Regions, to Headquarters MEDCOM, require their own rules, roles, and access to FASOR2 for data release, data analyses, and reports.

The release of information varies from Health Insurance Portability and Accountability Act (HIPAA) to Personally Identifiable Information (PII), to third party, or a combination thereof.

The FASOR2 IT system supports four essential tasks related to Army readiness:

Adult and child incident management (required by federal law and DoD Manual (DoDM) 6400.01/FAP and its related volumes).

Army Central Registry abuse data collection for reporting to Congress, DoW and Army (required by DoDM 6400.01 Volume 2 and AR 608-18/Army FAP).

Installation records checks (required by DoDM 1402.05/Background Checks on Individuals in DoW Child Care Services); and

Hosting of the Case Review / Incident Determination Committee algorithm to comply with DoW definitions of abuse, which is used by Army installation garrison commanders to manage the Case Determination Committee (CDC)/ Incident Determination Committee (IDC) committee processes (required by DoDM 6400.01 Volume 4).

The FASOR2 system is the authoritative source for adult and child abuse incidents and is on the Army's High Value Asset list. High Value Assets are those assets, Federal information systems, information, and data for which an unauthorized access, use, disclosure, disruption, modification, or destruction could cause a significant impact to the United States' national security interests, foreign relations, economy, or to the public confidence, civil liberties, or public health and safety of the American people. HVAs may contain sensitive controls, instructions, data used in critical Federal operations, or unique collections of data (by size or content), or support an agency's mission essential functions, making them of specific value to criminal, politically motivated, or state sponsored actors for either direct exploitation or to cause a loss of confidence in the U.S. Government. The FAP’s business processes and requirements include, but are not limited to:

Record keeping by DoW and Army standards.

Record management processes for a "family record" involving multiple individuals (open, monitor, manage, transfer, close, re-open).

Case management meeting regulatory guidance (high-risk severe cases require contacts that are more frequent).

Fatality data collection, management and reporting.

Reports generation for local prevention and treatment management.

Problematic sexual behavior of children and youth incident data collection, management and reporting (all Army installations).

Intimate partner adult abuse and child abuse data collection, management and reporting.

Background checks for Childcare and Criminal Investigation Department.

Electronic Health Record documentation.

HIPAA and Privacy Act processes tailored to the military.

Data collection requirements for Congress, DoW, Army, researchers and other vested agencies.

Transitional Compensation eligibility.

Training requirements for FAP and Commanders.

The FAP has complex business rules unlike traditional case management. A typical case management system (CMS), such as the Army ACS Client Tracking System or medical Case Management System, is based on adding a person or case to the system and then adding events that happen to the person throughout the tracing history. The case can be associated with other cases in the system or collateral contacts, which are not cases. FASOR2 however is completely different and is unlike any other system.

Following are a few examples of complex FAP business rules:

Example 1: FASOR2 is an incident tracking system. Rather than all incidents revolving around a person/case, it is all persons revolving around an incident.

Example 2: There is significant complexity in FAP incident roles and Army

Regulations/Uniform Code of Military Justice (UCMJ) definitions of roles. Within an incident (case) there are victims who may be sponsors, family members, sponsors who may be offenders, victims or neither, and offenders who may be sponsors, family members or neither or unknown persons.

Example 3: Significant complexity occurs when transferring incidents. If an incident requires a transfer to another Army installation, it is imperative for accurate Congressional reporting that the FASOR2 IT system records the incident properly so that it is not under or over reported by duplication. Three Wire Systems is the only contractor that fully knows and understands this.

Example 4: The Background Check functionality and accuracy is essential to preventing a known or suspected offender from having additional opportunities to offend by becoming a youth coach or other role where they may have access to vulnerable populations. Other military services besides the Army also utilize the background check when dealing with cross-service situations. Errors in this process risk the safety of Army Families or improper accusations if someone who is a victim, or the sponsor of a victim, reflects positive in the background check.

The DoW FAP, and by extension the FASOR2 IT System, is congressionally mandated to prevent and respond to reports of child abuse/neglect, domestic abuse, and problematic sexual behavior in children and youth in military families. AR 608-18, The Army Family Advocacy Program, and DoDI 6400.01 are unique to the DoW FAP.

They receive periodic updates as well as new guidance with imposed implementation suspense.

If the FASOR2 IT system is not available, the Army FAP mission will fail. The

FASOR2 IT system is required to operate without interruption, 24 hours/7days a week under Congressional mandate. The system is used by the FAP to track and handle approximately 12,000 Army incidents of adult and child abuse annually, incidents which can occur at any point during the day and therefore requires a fully functional system operating continuously to ensure all incidents are recorded when reported. The FASOR2 IT System’s data collection for child abuse and domestic violence incidents is equivalent to any medical treatment incident requiring an automated system for data capture. Further, if the FASOR2 IT system remains offline for any period, the FAP leadership will not have access to processed data and therefore cannot accurately report abuse incidents in mandatory quarterly and annual Congressional reporting.

The FASOR2 IT system will be decommissioned after the completion of this contract. Per current Army Directive 2024-02, MEDCOM must migrate FASOR2 to a low code/no code Agile platform. MEDCOM and the Deputy Chief of Staff G1 agree Appian is the best platform to complete the modernization of FASOR2. Currently there are 29 million records in FASOR2 comprising 62 gigabytes of data. This data must be pared down to migrate onto the new platform. Identified data sets cannot be lost or corrupted in this process as this would severely impact the ability to conduct historical ACR checks on new allegations of Domestic Abuse (DA) and Child Abuse and Neglect (CAN) and conduct employment checks for the Department of the Army. DCS G1 is funding the implementation of this solution in Fiscal Years 2026 and 2027. The new Appian platform will need to cover all the current FASOR modules and will need to be fully tested before operational which is projected to be 01 October 2026. MEDCOM is required to migrate current ACR data onto the new platform from FASOR2 to ensure availability of historical data for required background checks per DoDI 1402.05.

b. Alternatives.

There are no alternatives to an award to Three Wire Systems, LLC. The FASOR2 Program Management Office (PMO) does not have internal expertise to perform the work. Costs to expand this office would require authorization of many new civilian positions, which is not feasible with present reorganizations and budget reductions. As previously stated, FASOR2 PMO cannot suspend operations because Congress has mandated 24 hours/7days a week accessibility to properly administer abuse incidents as they occur.

c. Impact if justification request is not approved.

Failure to award a new sole source task order to Three Wire Systems, LLC will cost the government more money and time for an upfront transition of software/hardware that will severely degrade the successful execution of the FAP mission when migration to an Agile platform occurs. Three Wire Systems, LLC currently performs required Cyber Security activities that support the existing Continuous Authority to Operate.

Awarding a new task order to Three Wire Systems would not require a new Authority to Operate and would save one year of labor and Independent Verification and Validation (IV&V) efforts that the risk modernization framework process requires. Historical cost for this one year of labor is estimated at $2.1 million and does not include the learning curve required for a new contractor to become familiar with the functionality of FASOR2 and FAP mission. Three Wire Systems, LLC, has a complete operational FASOR2 sustainment infrastructure. This includes the capabilities for development, testing, staging, training and production environments managed with robust change and configuration management tools and processes. This also includes 24 hour/7 days a week server monitoring, daily Cyber Security information flow regarding threats and patches that they must apply to the servers, a code repository and sprint documentation system as well as the history and documentation for ten years of trouble tickets and associated code. All Three Wire Systems personnel have the required training certificates, common access cards and tokens to access the FASOR2 servers.

Awarding a new task order to Three Wire Systems, LLC will save nine or more months of procurement and setup time and will eliminate the high risk of losing critical FASOR code and data, Cyber Security compliance, etc., as Three Wire Systems currently sustains and operates these environments for FAP.

7. Efforts to Obtain Competition: The Contracting Officer will publish the notices required by FAR 8.405-6(a)(3) and any bids or proposals received shall be considered.

a. Effective competition: A Sources Sought Notice was posted to GSA ebuy on 4 December 2025 under RFI # 1788603 with a response date of 11 December 2025.

Numerous Capability Statements were received, see Tables below.