E53_BSR_LSJ_Zero_Trust_IT_Services_Redacted_1.pdf

United States Department of the Interior

INTERIOR BUSINESS CENTER

Washington, DC 20240

LIMITED-SOURCES JUSTIFICATION

AUTHORITY: FAR 8.405-6 and 40 U.S.C 501

Solicitation #: 140D0424Q0778

This acquisition is conducted under the authority of the Multiple Award Schedule (MAS) Program.

1. Identification of the agency and contracting activity, and specific identification of the document as a “Limited-Sources Justification.”

The Department of the Interior (DOI), Interior Business Center (IBC), Acquisition Services Directorate (AQD), Division II, Branch II, in support of a requirement for the Health Resources and Services Administration (HRSA), an operating division within the Department of Health and Human Services (HHS).

2. Nature and/or description of the action being approved.

This Limited-Sources Justification (LSJ) is for a follow-on requirement to award a firm-fixed-price (FFP) limited-source task order (TO) to Deloitte & Touche Limited Liability Partnership (LLP) under its General Services Administration (GSA) Schedule GS-00F- 029DA to provide Information Technology (IT) Support Services.

3. A description of the supplies or services required to meet the agency’s needs (including the estimated value).

a. This requirement is for IT services to develop a Zero Trust program governance, data governance, policy framework and compliance support to implement Zero Trust IT cybersecurity requirements required by Executive Order (EO) 14028 to improve the nation’s cybersecurity. In response EO 14028, issued in May 2021, the Cybersecurity and Infrastructure Security Agency (CISA) established the Zero Trust Maturity Model (ZTMM), a roadmap that agencies can reference as they transition towards Zero Trust Architecture (ZTA). The ZTMM represents a gradient of implementation across five distinct pillars, in which advancements can be made over time toward optimization. The pillars include Identity, Devices, Networks, Applications and Workloads, and Data. Each pillar includes general details regarding the following cross-cutting capabilities: Visibility and Analytics, Automation and Orchestration, and Governance. Governance is associated with the enforcement of an agency’s cybersecurity policies, procedures, and processes, within and across pillars, to manage an agency’s enterprise and mitigate security risks in support of Zero Trust principles and fulfillment of the Federal EO 14028 requirement. The Contractor must perform the following overall tasks (see Statement of Work for more details/requirements applicable to these tasks):

Solicitation #: 140D0424Q0778

i. Contract Management

ii. Project/Program Management and Implementation

iii. Logistic Services for Office of Planning, Analysis and Evaluation

iv. Development of a HRSA Data Governance Policy Guidance Document

v. HRSA Compliance with Zero Trust Policy Pillar Mandates

vi. Assist with the establishment of Cross-HRSA Standards/Language for Data

Use Agreements

vii. Creation of a Standardized HRSA Data Dictionary

viii. Development and Implementation of an Action Plan for Data Quality

Improvement Processes at HRSA.

ix. Usage of the Developed Action Plan for Data Quality Improvement Processes at HRSA to Implement Data Quality Enhancements.

x. Assist with the establishment of a Zero Trust Program Office

b. The Independent Government Estimate is for a two-year period of performance (POP). The two-year POP will be fully funded with no year funds.

4. The authority and supporting rationale (see 8.405-6(a)(1)(i) and (b)(1)) and, if applicable, a demonstration of the proposed contractor’s unique qualifications to provide the required supply or service.

a. FAR authority: FAR 8.405-6(a)(1)(i)C – In the interest of economy and efficiency, the new work is determined to be a logical follow-on to an original Federal Supply Schedule order and the original order was placed in accordance with the applicable Federal Supply Schedule ordering procedures. The original order was not previously issued under sole-source or limited-sources procedures. The previous GSA TO was competed under GSA amongst small and other than small contract holders.

b. In September 2022, a TO (75R60222F80155) was awarded to Deloitte & Touche LLP and issued under its GSA Schedule GS-00F-029DA to provide IT support services to the HRSA to perform a ZTRA, evaluate existing capabilities, perform gap analysis, develop a roadmap to include potential product needs, policy/standard operating procedures (SOP), and a migration plan needed to transition to a compliant ZTA. This current requirement is needed to perform the follow-on work to develop data governance and policy needed to execute the migration plan that was developed under the previous GSA TO for the transition and implementation of ZTA.

c. HRSA also shares IT infrastructure with the National Institutes of Health (NIH) that is managed by the NIH Center for Information Technology (CIT), thus NIH CIT acts as an NIH and HRSA service provider. Both agencies share a common environment in the form of a single Microsoft 365 tenant and Active Directory (AD) forest holding both NIH and HRSA accounts, data, credential and device management. The desired outcome of the Zero Trust assessment and follow-on activities cannot be achieved without the extensive and deep knowledge of how those configurations and network operations are managed and maintained today in the environment operated by NIH. Given the closely coupled global configurations of the HRSA and NIH Microsoft 365 environment, alignment with a ZTA for HRSA is highly dependent upon the direct involvement of NIH and one of their current contractors (Deloitte), tools and platform ecosystem. NIH currently has a contract with Deloitte to perform AD re-architecture and the knowledge gained from performing this work will drive some of the data policies and framework needed for this requirement. Consequently, the work for this current requirement is not only follow-on work from the previous TO but is also highly dependent and integrated with work that Deloitte is currently performing under the separate contract.

d. The previous GSA TO period of performance was from 9/30/2022 to 5/29/2023 thus Deloitte has already spent several months performing the ZTA requisite gap analysis and developed a migration plan for HRSA. Deloitte’s previous migration plan, developed by utilizing CISA ZTMM along with their existing in-depth knowledge, technical expertise of HRSA/NIH shared IT infrastructure, will ensure the development of effective cybersecurity data governance, policy, procedures and processes for the successful implementation of the highest level of protection for HRSA's data assets.

e. Having another Contractor perform the new work is anticipated to double the cost since the new Contractor will need to devote time and effort in acquiring the IT infrastructure knowledge and expertise of the NIH and HRSA shared intricate IT environment. Time and effort will also need to be spent on assessing, analyzing and understanding the work and migration plan that was previously developed by Deloitte.

Additional costs are further anticipated as a new Contractor will also need to spend time working in close collaboration and constant communication with Deloitte, NIH and HRSA on the IT infrastructure nuances arising from the on-going work under the separate contract. Having a new Contractor will also result in the managing of a multi-vendor IT ecosystem which will cost more to HRSA and NIH in Government time spent.

f. The previous work and on-going work performed by Deloitte will provide them with even greater technical experience and deep understanding of HRSA and NIH shared IT infrastructure which is crucial for effectively designing governance and compliance policies, procedures, and controls under this requirement to ensure IT infrastructure meets ZTA. If this justification is not approved, HRSA and NIH may run the risk of having inefficient data policies, security measures and protocols and fail to meet Zero Trust capabilities. This in turn will leave IT infrastructure vulnerable to unauthorized system access, cyber threats, and data breaches resulting in costly system downtime.

g. Based on the above facts, it is logical and reasonable to have Deloitte perform the subsequent/follow-on new work as it will minimize cost, maximize productivity, and increase efficiency that will ensure the development of effective data policy and governance for a successful Zero Trust transition and implementation.

5. A determination by the ordering activity contracting officer that the order represents the best value consistent with FAR 8.404(d).

Price will be evaluated in accordance with FAR 8.404(d). The Contracting Officer will determine price reasonableness based on comparison of the proposed price with prices found fair and reasonable on previous similar purchases and current GSA price lists. In accordance with FAR 8.405-2(d) the Government will consider the level of effort and the mix of labor proposed in the total price reasonableness determination to ensure the TO represents the best value.

6. A description of the market research conducted among schedule holders and the results or a statement of the reason market research was not conducted.

A search through the GSA MAS identified category 54151HACS (Highly Adaptive Cybersecurity Services (HACS)) as the most suitable and in scope Schedule to support this requirement. Although this Schedule has 137 other than small businesses and 497 small businesses that may be able to support this requirement, Deloitte is the only Contractor under this Schedule that performed the previous GSA TO (75R60222F80155). The current circumstances places Deloitte in a strong position with a justifiable reason to be the only one to perform this requirement as logical follow-on work in the interest of the economy and efficiency.

7. Any other facts supporting the justification.

a. It is also in the best interest of the Government for Deloitte to develop Zero Trust data governance, policies and procedures based on the gap analysis report and migration plan that they developed on the previous TO. In doing so, will make Deloitte fully responsible to deliver a data governance policy and procedures that are consistent with and practical with the previously developed Zero Trust gap analysis and migration plan.

Having Deloitte perform the work on the previous project and follow-on project will make them overall responsible and accountable for the operations and maintenance phase of this entire project.

b. Since the issuance of the EO in May 2021, HRSA has made it a priority to fully comply with ZTA. It is crucial for this requirement to initiate as soon as possible and for it to follow-on the previous work to ensure the new work is efficiently and effectively completed within a two-year POP and simultaneously with on-going work integrated with this requirement. The IT environment is constantly and rapidly evolving and even minor delays can compromise IT security.

c. Additionally, the Zero Trust program governance, data governance, policy framework and compliance support that will be provided through this requirement will also benefit HRSA and NIH due to their shared IT infrastructure. NIH has approximately 25 Institutes and Centers that will benefit from the services of these requirement.

8. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the restricted consideration before any subsequent acquisition for supplies and services is made.

There are no subsequent acquisitions anticipated for this requirement since the intent of this requirement is to provide HRSA with an enterprise-level data governance policy and procedures that the organization and its IT system owners can follow to fully transition and implement ZTA capabilities and remain compliant with Zero Trust program requirements.

9. The ordering activity contracting officer’s certification that the justification is accurate and complete to the best of the contracting officer’s knowledge and belief.

I certify this justification is accurate and complete to the best of my knowledge and belief.

Contracting Officer

10. Evidence that any supporting data that is the responsibility of technical or requirements personnel (e.g., verifying the Government’s minimum needs or requirements or other rationale for limited sources) and which form a basis for the justification have been certified as complete and accurate by the technical or requirements personnel.

I certify the technical data which forms a basis for this justification is complete and accurate and meet the Government’s minimum needs.

Deputy Chief Information Officer

11. For justifications under 8.405-6(a)(1)(i)(C), a written determination by the approving official identifying the circumstance that applies.

In the interest of economy and efficiency, this requirement is a logical follow-on to an original Federal Supply Schedule order that was placed in accordance with the applicable Federal Supply Schedule ordering procedures which was not previously issued under sole-source or limited-sources procedures.

12. Reviews and Approvals

Approve

Bureau Competition Advocate