Cyber SOC Bridge II JEFO Redacted 3.31.26.pdf

U.S. Customs and Border Protection Justification for Exception to Fair Opportunity (JEFO) – FAR 16.507-6(b)(2)

(Class Deviation Number 26-04)

Date: January 16, 2026 PR Number: 20155929

1. Agency and Contracting Activity.

The Department of Homeland Security (DHS), U.S. Customs and Border Protection (CBP), Office of Information and Technology (OIT), Cybersecurity Directorate (CSD), and the Office of Acquisition (OA), Procurement Directorate, Information Technology Contracting Division (ITCD), prepared this justification for an exception to fair opportunity.

2. Nature and/or description of the action being approved.

CBP intends to award a 6-month bridge with 6-month option to the current incumbent contractor for the Cyber Security Operations Center services “bridge" contract under the GSA Alliant II Government Wide Contract Vehicle (GWAC), pursuant to FAR 16.507-6(b)(2) (Class Deviation Number 26-04). The anticipated period of performance is as follows:

Base Period: 03/24/2026 – 09/23/2026 Option to Extend Services: 09/24/2026 – 03/23/2027

This action will provide continuity of service for the mission critical CBP Cyber Security Operations Center services contract and ensure that the cybersecurity mission of CBP can continue without a lapse in service.

Awardee:

Leidos Inc.

9737 Washington Drive Gaithersburg, MD 20878

3. A description of the supplies or services required to meet the agency’s need (including the estimated value).

The Contractor supports CBP Cyber Security Operations Center services assisting in the management, maintenance, and support of CBP Security Operations Center (SOC) 24 hours a day, 7 days a week, 365 days a year to protect the CBP information systems infrastructure.

The following tasks and services are to be provided:

Program Management / Project Management Cyber Defense Forensics (CDF) Support Attack Sensing & Warning (AS&W) Support Cyber Incident Response Team (CIRT) Support Cyber Threat Intelligence (CTI) Support Cyber Risk Management (CRM) Support Security Modernization (SecMod) Support Vulnerability Assessment (VA) Support Security Engineering and Sustainment (SES) Support

(Class Deviation Number 26-04)

Enterprise Logging Solution (ELS) Support Development Security Operations (DevSecOps) Support (Optional) Information System Security Officer (ISSO) Support Cyber Threat Hunting (CTH) Support Operations Enhancement (OE) Support Office of Professional Responsibility Cyber Investigations (CI) Support Security Technology & Policy (STP) Support

The estimated value of the firm fixed price (FFP), six (6) month base and six (6) month Option to extend services task order for Cyber Security Operations Center services for primary security operation center support, required travel, and the contract access fee (CAF) total in the amount of

A 6-month bridge task order provides the necessary timeframe to conduct a new solicitation process and award the subsequent contract. This ensures the seamless and effective transition and operational sustainment of Cyber SOC services. This critical period not only allows the incoming awardee sufficient time to achieve full stand-alone capacity without compromising vital systems

4. Identify the exception to fair opportunity and supporting rationale, including a demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the exception cited.

FAR 16.507-6(b)(2) (Class Deviation Number 26-04). Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

Rationale:

Analysis indicates that this contractor is the only source capable of continuing performance without interruption to mission critical operations. Any lapse in service would cause a ripple effect of detrimental mission impact to not only CBP, but other DHS sister agencies. No break in service can occur to ensure protection of CBP systems, thereby ensuring ongoing mission needs are met.

Leidos possesses a unique combination of deep knowledge of the complicated CBP network environment and many years of IPT (Integrated Product Team) experience within many different program offices within CBP and DHS. This institutional understanding, further solidified by historical data and performance metrics gathered over the past 5 years of service, and collaborative history have been meticulously developed and refined over time, directly addressing the complex and highly specialized requirements of the SOC environment. This combination of advanced solutions and skilled human capital forms Leidos's operational efficiency and effectiveness.

Leidos has an understanding of the CBP and DHS landscape, and established infrastructure. The intricate nature of these services means that a new vendor would face significant hurdles in understanding and adapting to the operational nuances and security protocols already in place.

(Class Deviation Number 26-04)

Consequently, introducing a new vendor would entail substantial drawbacks, including considerable time, cost, and inherent risks. A new entity would require significant time to onboard, integrate into current operations, and overcome steep learning curves, inevitably leading to potential disruption of critical services that Leidos currently provides. An additional significant concern is the average time to onboard an employee for CBP clearance, which typically ranges from 3 to 6 months, further exacerbating delays and operational gaps should a new vendor be introduced. The process of building trust and understanding within such a highly specialized and sensitive environment is not instantaneous and carries significant operational and security implications, underscoring the criticality of maintaining continuity. This is supported by the Market Research Report (MRR).

The daily duties of the CBP SOC team have widespread safety implications across all of DHS and throughout the United States. Maintaining a secure CBP network through relentless cyber-attack mitigation is paramount, as any shutdown would immediately result in millions of dollars in lost trade, fees, and customs revenue for the Federal Government. This underscores the critical financial impact of ensuring continuous network protection. CBP SOC plays critical roles in protecting our national borders from threats, ensuring the safety of the public and our officers while protecting our network infrastructure from persistent ongoing cyber threats. The CBP SOC is unique, demanding specialized skillsets, toolsets, and significant financial investment, given its critical mission to safeguard national borders by defending a complex digital landscape where cyber and physical security converge, protecting critical infrastructure, handling sensitive data, and mitigating the immense economic consequences of security breaches on trade and travel.

The specialized services required include advanced threat detection and response, incident response and forensics, penetration testing, vulnerability assessments, and compliance with federal cybersecurity standards. These services are critical to maintaining the security and integrity of CBP’s information systems. Leidos has provided highly specialized cyber security services to CBP for the past several years, demonstrating an unmatched understanding of our systems, threats, and operational requirements. Their skillset and methodologies have been integral in protecting CBP’s critical infrastructure. Leidos has proven ability to deliver advanced, integrated cybersecurity solutions, and its comprehensive full-spectrum cyber capabilities, including advanced analytics and specialized Zero Trust implementation. The present period of performance under the task order is critically insufficient for the proper and secure onboarding of a new contractor, given the inherent complexity of this vital requirement. In addition, Leidos supports the Computer Incident Response Team efforts through direct operational involvement, comprehensive planning, and advanced tools for incident detection and remediation, while also specializing in high value asset scanning via continuous vulnerability assessment, critical infrastructure protection, and advanced physical and digital scanning technologies, further enhancing security with proactive cyber threat hunts and penetration testing.

5. Determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

The Contracting Officer (CO) will compare proposed pricing against the existing task order to determine whether the anticipated cost to the Government will be fair and reasonable. In addition, the CO will utilize the previously developed Independent Government Cost Estimate

Version 2.0 November 2020

5. Determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

The Contracting Officer (CO) will compare proposed pricing against the existing task order to determine whether the anticipated cost to the Government will be fair and reasonable. In addition, the CO will utilize the previously developed Independent Government Cost Estimate (IGCE) and historical prices paid.

6. Any other facts supporting the justification.

Leidos has a proven track record in managing top secret clearances for personnel and ensuring compliance with all security protocols and regulations. Switching to a new contractor for this period would increase overall risk and reduce support to CBP. The impact of a lapse in service to CBP can have far-reaching consequences, compromising national security, disrupting economic activities, jeopardizing public safety, and impairing the overall efficiency and effectiveness of border management operations. By leveraging the current specific skillsets and capabilities, CBP can effectively justify the selection of the existing contractor for cybersecurity services requiring top secret clearances.

7. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made.

The agency intends to compete this requirement under the Government Wide AcquisitionVehicle GSA Alliant II in Fiscal Year 2026 quarter three.

8. CBP intends to post this justification on SAM.gov pursuant to FAR 16.507-6(f) (Class Deviation Number 26-04).

9. Technical/Requirements Personnel Certification:

Pursuant to FAR 16.507-6(d)(2)(ix) (Class Deviation Number 26-04), I certify that this requirement meets the Government’s minimum need and that the supporting data, which form a basis for the justification, are accurate and complete.

Date

1/21/26