EIDM_O+M_JA_Signed.pdf

DEPARTMENT OF HEALTH AND HUMAN SERVICES

CENTERS FOR MEDICARE AND MEDICAID SERVICES

oFF¡CE OF ACQUTS|TION & GRANTS MANAGEMENT

DOCUMENT SIGN OFF SHEET

Document Title: Justification and Aooroval (J&A ) for Out of Scooe Modification t a ment EIDM Remote ldenti P

Multi-Factor Authentication IMFAI Se rvices - Operations and Maintenance (O&M) Task Order

Final Signature Level Required: Competition Advocate

Date All Signatures Needed by: O6/2I/2OL9

NAME

oFFrcE/GROUP/DtVtSON or Title

SIGNATURE & DATE

Authored by

Dawn R. Wilkins oAGM/rrcc/Drsc Dawn R.

Wilkins -S

Digitally signed by Dawn R. W¡lk¡ns -s

Date:2019.06.17 I 2:1 0:l 5 -04'00'

Cleared by Andrew

Mummert oAGM/rTCG/DrSC Andrew îälåy;i:l"ijí, Mu m mert -s ?j5;3?iåj.3j'

Lyandra o¡s,tàryr,enedbyryðnd,å ' tmmånu€i.9

Em ma n U gl -S Dåte, 2orq6.r8 rs:2e:2o,o4oo Cleared by

Lyandra Emmanuel oAGM/rrcc

Cleared by Kimberly Tatum oAGM/DPOS Kimberly Tatum -S

Digitally signed by KimberlyTatum -5

Date:2019.06.20 20:30:1 2 -04'00'

Cleared by Derrick Heard

Deputy Director, OAGM and Chief Grants Management

Officer

Derrick L. B:li:lli:üïå:;

Heard -s ?ååi3îi313;1'

Cleared by Melissa

Starinsky I'or:

Director, OAGM and Head of Contracting Activity

(HcA)

Derrick L.

Heard -S

Digitally signed by Derr¡ck L. Heard -5

Date: 201 9.06.21 1 6:37:54 -04'00'

Cleared by Karen Jackson

CMS Deputy Chief Operating

Officer/Competition Advocate bl,Ibta

DEPARTMENT OF HEALTH AND HUMAN SERVICES

CENTERS FOR MEDICARE AND MEDICAID SERVICES

OFFICE OF ACQUISITION & GRANTS MANAGEMENT

DOCUMENT SIGN OFF

summary of the Request:

Purpose: The pu rpose of the attached l&A is to approve the out of scope modification to provide additional services under the Enterprise ldentity Management (EIDM), Remote ldentity Proofìng (RIDP), Multi-Factor Authent¡cation (MFA) Services - Operations and Maintenance (O&M) task order.

Fundins Summary: The totâl est¡mated cost for these additional services is 59,842,042 - $1,585,885 for Option Per¡od l- (current period) and 58,256,157 for Option Period 2.

Current Period of Performance: We are currently in Option Period 1 of the task order, which has a period of performance of Septem ber 8, 2018 to Septembe t 7 ,2OL9. The first period of this modification will be Date of Award to September 7, 2019.

Future Period of Performance: The task order has five (5) remaining option periods running from Septem ber 8, 2019 to May 17 ,2022 (includin9 a 4-month Trans¡tion Out); however, the only future option period that w¡ll be ìmpacted by this modification is Option Period 2

(September 8, 2019 to Septembe r 7 ,2020]..

Author¡tv: This act¡on will be awarded pursuant to FAR16.505(b)(2)(i)(A). lt authorizes an exception to fair oppoftun¡ty on the basis that the agency need for the su pplies or services is so urBent that providing a fair opportun¡ty would result in unacceptable delays. This modification will allow CMS applications to be migrated from the current Oracle-based EIDM system to the new cloud-based IDM solution by fVlarch 29,2020.

Will this be publiclv published/posted? lf, ves, please provide the source/location where it will be available: Yes, in accordance with FAR 16.505(bX2Xii)(D)(3), the J&A for this modification will be posted to FedB¡zopps within 30 (30) days after award.

Additional Comments/Notes:

PaFe(s) Requirins ComÞetition Advocate Siqnature: J&4, p. 6

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

Acquisition Title: Enterprise Identity Management (EIDM), Remote Identity Proofing (RIDP), Multi-Factor Authentication (MFA) Services - Operations and Maintenance

Agency: Centers for Medicare and Medicaid Services (CMS)

Acquisition Yean 2019

Author: Carla Layne

1 Description of Action:

A, Nature

a. New Requirement

b. _ Follow-On Order

c. X Modification of Existing Purchase Order / Contract Number #HHSM-500-201 7-0001 sI/HHSM-500-T0001

B. Order Against

a. _ Multiple Award lDlQ Contract Number

C. Contract Type

a. _ Firm-Fixed Price

b. _ Time and Materials

c. _ Cost PIus Fixed Fee (CPFF)

i. Term

ii. _ Completion

d. -, X Cost Plus Award Fee (CPAF)

e. _ Other: _

D. Projected Cost / Price of contract (Base & All Options): Total price of contract including Base plus all Option Periods is $57,425,581.98.

E, The total estimated value of the proposed sole source action (for modifications only):

The estimated value of this action is S9,8420042 - $1,585,885 for Option Period I (current period) and $8,256,1 57 for Option Period 2.

F. Funding Source (s):_Project 000787

c. : Basis for Approval (Far 6.303-1(d)

X : Individual Basis

: Class Basis

2. Description of Supplies or Services:

CMS procured two separate contracts related to Enterprise Identity Management (EIDM), Remote ldentity Proofing (RIDP), and Multi-Factor Authentication (MFA). This EIDM/RIDP/MFA O&M is the fir'st contract (HHSM-500-2017-0001 5yHHSM-500- T0001). The O&M contract maintains the existing EIDM/RIDP/MFA functions that are provided through a customized deployment of Oracle's ldentity Management suite (for EIDM), Expelian Precise ID as enhanced for CMS (for RIDP), and Symantec Validation & ID Protection (VlP - for MFA). The O&M Contractor is required to maintain the current EIDM/RIDP/MFA funçtions until all applications have been migrated to a new Identity Management (lDM) solution.

The second contract procured (HHSM-500-2017-00006V75FCMC18F0002) is fol an ldentity Management (lDM) System Integration (Sl) Contractor, which was responsible for developing a modelnized Identity Management (lDM) System based on Okta's Identity as a Service (lDaaS) solution fol account creation and account management, Experian's Precise lD (as enhanced for CMS) fol RIDP, and Saviynt's Identity Governance and Administration as a Service (lGAaaS) for role management and approval workflows. This new cloud-based IDM solution is already built and in place.

Additionally, the IDM SI contractor was lequiled to develop a process and timeframe to migrate all current applications from EIDM/RIDP/MFA to the new IDM solution. The IDM SI contractor was to be responsible for leading this migration, with support from the EIDM/RIDP/MFA O&M contractor in rnigrating data and business logic, etc. from the existing EIDM/RIDP/MFA applications to the new IDM solution. After all of the applications have been fully migrated, the EIDM/RIDP/MFA O&M contractor will implernent the decommissioning of the cunent EIDM system.

Due to the severe contractor performance issues with the IDM SI contractor, successful migration ofapplications to the new IDM solution by the IDM SI contractor is not possible.

Therefore, this action seeks to procure services to migrate applications using EIDM as an authentication and as an authorization source to the new IDM solution, including the development of an IDM Hub Business Logic Layer, under the EIDM/RIDP/MFA O&M contract.

The APP number for these services is l9l 830.

3. Authority and Rationale:

The Contracting Officer shall give every awardee a fair opportunity to be considered for a delivery/task order exceeding $3,000 unless one ofthe following statutory exceptions applies.

IrAIì 16.505(b)(2). Mark the applicable exception:

_x- The agency need for the supplies or services is so urgent that providing a fair oppofiunity would result in unacceptable delays !ìAR l(r.505(bX2XiXA)l;

By June 30, 2020 the current EIDM system is required to be decommissioned and no longer running in the Perspecta Data Center. The Perspecta Data Center contract ends June 30,2020. The Oracle IDM solution, upon which EIDM is based, is not a proven cloud-hosted velsion to which CMS could migrate. Therefore, CMS planned to migrate applications to the new IDM solution by February 28,2019. As discussed above, the IDM SI contractor was supposed to complete this migration, but now CMS has had to shift the migration completion date to March 29, 2020. Due to various contract performance issues that still exist with M SI contractor re are unacceptable risks that they will not able to meet schedule deadlines and that CMS will not have applications that can effectively provide the identity and credentialing services required for users of CMS systems.

It would be impossible to compete a new task order, on-board a new contractor and complete the migrations to the new IDM solution by March 29,2020 due to the amount of time required to ramp up staffi, transition in and successfully take over operations. The current IDM SI task order for the full body of work took approximately seven (7) months to compete from issuance of the solicitation to the award of the task order. Consistent with our Procurement Administrative Lead Time (PALT) standards that are based on the contracting method and estimated dollar value, it would take at least four (4) months to compete a new task order for these Hub development/rnigration services. Given the complexity and scope of the services, transition of the work to a new contractor would take at least three (3) to four (4) months to complete, which would leave only one (l) to two (2) months until the applications would need to be migrated to the new IDM solution.

As stated above, the timeframe for the IDM SI contractor to complete the migration ended .

pn Februarv 28,2019-Due to consistent poor performance of the IDM SI contractor, CMS is not exercising the first Option Period of that contract. Therefore, IDM SI contractor support CMS proposes that the EIDMiRIDP/MFA o¡&M contractor perform the application migration from the Oracle-based EIDM system to the new IDM solution. This includes the development of the IDM Hub Business Logic Layer, and supporting Application Program lnterfaces (APIs), which is an interface between CMS Enterprise Portal, Application User Interfaces and the IDM Commercialoff the Shelf (COTS) products (Okta, Saviynt and Experian).

Furthermore, C-HIT, the EIDM/RIDP/MFA O&M contractor, is qualified to perform this Hub development/migration work since they are currently maintaining the current EIDM system and are already tasked with suppoting the migration to the new IDM solution. C- HIT has maintained good performance on the O&M task order as evidenced by the positive CPARS ratings received for providing essential support to the CMS Portal Team, which was a significant event that resulted in CMS meeting its goal of getting the Portal system up and running on time, and being very attentive to CMS concerns by responding quickly to address and fix any problems. Also, their in-depth knowledge of the current EIDM system is a time saver as it decreases the time required for knowledge transfer and other transition in activities. In addition, C_-HIT was the next offeror in line for award of theJfiM, SI contlact ancl offered an accgptaþle approaqh to providing the svste.m inteelg]lion and migration se_¡¡ices. )h"y received strengths for having key and non-key personnel that ã,iæ-dfdffiTT[íllseis and for having experience suppórting a one-way synchronization of passwords from the EIDM system to Okta. They are also the contractor for the CMS Enterprise Portal, which will interface with the applications that make up the new IDM solution. This knowledge and experience puts C-HIT in the unique position of being able to perfbrm the Hub development/migration work on such short notice.

The current Period of Performance for EIDM/RIDP/MFA O&M contract is September 8, 201 8 to September 7,2019. The next Option Period (Option Period 2) is September 8, 2019 to Septemb er 7 ,2020. CMS anticipates that the application migration and decommissionirrg of the Oracle-based EIDM system will be cornpleted by end of Option Period 2.

_Only one awardee is capable of providing the supplies ol services required at the level of quality required because the supplies or services are unique or highly specialized [FAR r6.505(bx2xiixB)l;

_ The order must be issued on a sole-source basis in the interest of economy and efficiency because it is a logical follow-on to an order already issued under the contract, provided that all awardees were given a fair opportunity to be considered for the original order [FAR I 6.505(bX2XiXC)l;or

It is necessary to place the order to satisfy a minimum guarantee [rAIì r6.sos(bx2xixD)1.

_ A statute expressly authorizes or requires that the purchase be made from a specified source. [rAIì I 6.505(bX2XiXE)1.

4. Provide a statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made:

Once the IDM Hub is developed and implemented and applications are migrated to the new IDM solution, Operations and Maintenance (O&M) is required. CMS is taking actions to identify Hub O&M services requirements. A subsequent acquisition for IDM Hub O&M services and related tasks will be done so that there is fair opportunity for competition of the work to be performed. All of the new solution IDM work, which includes IDM Hub O&M and Tier 2lTier 3 Helpdesk Support Services, is not being done by the C-HIT EIDM O&M contractor. Other than funding, there are no other known barriers which could lead to the exception to fair opportunity. CMS plans to complete the IDM Hub O&M cost estimate in a timely manner so that the funds are obtained in order to remove this barrier.

5. State any other facts supporting the justification (if any):

NiA

Approvals:

Plogram Office Certification. This is to certify that portions of this justification have been developed by the undersigned program office personnel, including supporting inforrnation and/or data verifying the Government's minimum needs, schedule requirements and other rationale for Exceptions to Fair Opportunity, which form the basis for this justification.

Carla L ^ D¡gitally signed by Carla L. Layne ne-5s Contracting Officer

Dioitallv tigned bY cãthY I carte, Cathv T. Carter -S s-t Date:2019.06.21 09:23:06-04'00

Program/Project Manager (P/PM) / Date

Best Value Determination. By my signature below, after review of the relevant documents, I have determined that the ordel subject to this Justification represents the best value for the Government as set forth in FAR 16.505(b)(2)(ii)(B)(5), and constitutes a fair and reasonable price. The basis for my determination is as follows:

The Contracting Officer will perform cost realism analysis on the Contractor's proposed costs to ensure they are fair and reasonable; realistic for the services required; and reflect that the contractor undel'stands the complexity of the requirement. The Contracting Olficer's analysis will verify that; the proposed labor costs; the proposed labor categories and hours; the indirect costs; other direct costs, and fee are realistic and overall reflect the contractor''s comprehension ofthe requirement. The Contracting Officer will compare the proposed costs for the Hub Development services against the pricing in existing Federal contracts.

Contracting Officer Certification: This isto certify that thejustification forthe proposed acquisition has been reviewed and that to the best of my knowledge and belief, the information and/or data provided to suppoft the rationale and recommendation for approval, is accurate and complete.

D a w n R. Wi I ki n s - S 3:1fið,1'L:iið'"iJ,ililiãl*.'

Contracting Officer / Date

Additional OAGM Approvals:

I hereby confirm the circumstances described above apply and approve the justification for F,xceptions to Fair Opportunity.

Diqitally signed by Lyandra Lyandra Emmanuel -S r,ñ'aiuei-s

Date: 201 9.0ó.21 I 3:09:48 -04'00'

OAGM Division Director / Date

Lyandra Emmanuel - Disitallv signed bv Lvandra

5 rH,ïriî.;: .21,t3:to:2s-o4,oo, OAGM Group Director / Date

Head of Contracting Authority (HCA) Approval:

I hereby confirm that the circumstances described above apply and approve this Justification for Exception(s) to Fair Opportunity.

Derrick L. Heard -s 3:Tlå'Ïon^edbvDenickL' Date: 201 9.06.21 16:36:34 {4'00'

HCA Name / Date For: Melissa Starinsky

Competition Advocate Approval

I hereby confirm that the circumstances described above apply and approve this Justification for Exception(s) to Fair Opportunity.

(, LI 2otq Name

Senior Procurement Executive (SPE) Approval

I hereby confirm the circumstances described above apply and approve the Justification for Exceptions to Fair Opportunity.

N/A SPE Name lDate