Experian-RIDP_J-and-A-Other-Than-Full-and-Open_2026-01-13.pdf

JUSTIFICATION AND APPROVAL

FOR OTHER THAN FULL AND OPEN COMPETITION

Acquisition Title:

Agency:

Acquisition Year (FY):

Author and Title:

2. Description of Action:

Nature:

New Requirement

Follow-on Requirement

Modification to Existing Purchase Order/Contract Number:

Pricing: ✔Firm-Fixed Price

Cost $47,626,519 Time & Materials

Other:

Funds: OMA

Project Number 000787 (Identity Management (IDM) ✔ Other Funds:

Name of Proposed Contractor(s): Experian

Street Address:

City, State, Zip:

475 ANTON BLVD

COSTA MESA, CA 92626

3. Description of Services or Supplies:

Basis for Approval (FAR 6.303-1(d)): ✔Individual Basis Class Basis

The total estimated value of the proposed action, including all options is $ 47,626,519.50

Provide/maintain Identity Assurance Level 2 (IAL2) Knowledge Based Authentication (KBA) remote Identity Proofing. CMS requires a Risk Based Alternative (RBA) solution for meeting the IAL2 requirements. The services must provide: Social Security Number (SSN) Verification Service, as customized for CMS, to verify whether or not the SSN provided by a person, as part of the Manual Identity Proofing (MIDP) process, is associated with that person; Proactive Monitoring/”HeartBeat” transaction service for the purpose of determining if the RIDP Services are available; Risk Assessment service to evaluate the risk associated with the device used upon User Login to, or other user activity within, a CMS system; Continuous Assessment (CA) service which takes as input static data from the IDM Hub database and responds with the same responses provided by the RBA; the purpose being for CMS to detect if the risk profile associated with system users who have already been identity proofed has changed since they were granted system access; Actively retain transaction audit logs and provide auditing capabilities; Testing services for CMS applications integrated (or integrating) with the RIDP Services; Present to CMS all data set types used in its identity proofing services; CMS shall have the option to restrict usage of any controversial public data sets for identity proofing services if deemed necessary; Tracking and reporting usage data at the individual application level; Spanish Call Center interpretation services supporting the phone-based identity proofing of CMS users who failed online RIDP; Limited English Proficiency (LEP) interpretation services supporting the vendor’s phone-based identity proofing of CMS users who failed online RIDP; Professional Services (PS) support to CMS applications integrated with, or in the process of integrating with, the Risk Based Alternative (RBA) IAL2 RIDP services;

Reporting, and analysis, of RIDP transactions and services; and Support for CMS and other teams during audits, including but not limited to Security Impact Analysis (SIA) and Cybersecurity and Risk Assessment Program (CSRAP) reviews.

Edward Custer, Contracting Officer's Representative (COR)

CMS

Remote Identity Proofing (RIDP) Services https://www.acquisition.gov/far/part-6#FAR_6_303_1

4. Authority and Rationale: Identify the statutory authority, FAR title and FAR citation permitting other than full and open competition. It may be one of the following most commonly used citations by the operating divisions of the Department of Health and Human Services (HHS), but other exceptions may apply per FAR Subpart 6.3.

Actions other than simplified acquisition procedures (select only one and provide an explanation):

✔ FAR 6.302-1: Only one responsible source and no other supplies or services will satisfy agency requirements, 41 U.S.C.

3304(a)(1)

[ N o t e -the Revolutionary FAR Overhaul has changed the applicable citation to FAR 6.103-1] CMS has conducted market research which indicates that only Experian is offering an RBA solution for proofing individuals at IAL2, and the other vendors evaluated do not offer an RBA or the full range of customized features provided to CMS by Experian.

Therefore, Experian is the only responsible source able to quickly provide the required products and services with the level of quality and lack of risk that will satisfy CMS’ requirements.

FAR 6.302-2: Unusual and compelling urgency, 41 U.S.C. 3304(a)(2)

FAR 6.302-5: Authorized or Required by Statute, 41 U.S.C. 3304(a)(5)

Other (See FAR Subpart 6.3 for additional authority)

5. Agency Actions to Take or Remove Barriers That Led to Other Than Full and Open Competition (If applicable):

CMS posted a pre-solicitation notice through SAM.gov on December 2, 2025 (closing December 17, 2025 at 1:00 PM) to determine if other interested vendors could fulfill the requirements for Remote Identity Proofing (RIDP) services. CMS received expressions of interest from a total of five contractors. Of those five interested parties, three vendors submitted capability statements (LexisNexis, Socure, and TransUnion), while two companies (SEBENZA LLC and PATRIOT ALLIED SOLUTIONS LLC) indicated interest on SAM.gov but did not provide the requested information.

A Technical Evaluation Panel (TEP) reviewed the three capability statements and determined that none of the respondents could fulfill all of CMS's requirements for RIDP services

6. Bridge Contracts: N/A - This procurement is not a bridge contract.

7. Actions to Increase Competition:

CMS posted a pre-solicitation notice on 12/02/2025 and it closed 12/17/2025 at 1:00 PM. CMS only received 3 Capability Statements via email and 2 other companies (SEBENZA LLC and PATRIOT ALLIED SOLUTIONS LLC) said they were interested on SAM.gov but did not respond with any information CMS requested. The 3 respondents to the pre-solicitation notice were LexusNexus, Socure, and TransUnion. The LexusNexus response was not a “capability statement, proposal, or quotation” as requested by CMS and did not provide any capability information for the Technical Evaluation Panel (TEP) to evaluate. Socure indicated a capability to provide many of the requirements listed by CMS but did not meet the requirement for providing a knowledge-based Authentication (KBA) Level of Assurance (LOA) 2 or 3 (LOA2/LOA3) Remote Identity Proofing (RIDP) solution which is needed by some CMS Health Insurance Marketplace applications which are still in the process of migrating to Experian's Risk Based Alternative (RBA) for RIDP proofing to Identity Assurance Level 2 (IAL2). TransUnion did not meet the requirement of providing a RBA for RIDP which is needed by the majority of applications using the Experian RIDP services.

TransUnion only offers a method of achieving IAL that requires taking a photo of a government-issued ID, the data from the back of that ID, and a “selfie” by the person who is going through RIDP. Therefore, TransUnion did not meet a key requirement of CMS – offer a RBA for IAL. The TEP did not find any of the capability statements provided met all of CMS' requirements for RIDP services.

There is another critical factor that was not addressed in the request for TEP review of the capability statements/pre-solicitation RFI responses from TransUnion, Socure, and Lexus/Nexus. That factor is the time and expense that would be required from each of the CMS applications which have completed, or are in the process of completing, their migration to the Experian Risk Based Alternative (RBA) for achieving Identity Assurance Level (IAL) 2. If these CMS applications were forced to now migrate to the software of another Remote Identity Proofing (RIDP) vendor, this would take many months (and for some Health Insurance Marketplace applications a year or more) to transition to the new RIDP vendor’s software. During this time CMS would need to pay for both RIDP solutions to be running simultaneously, for 8-12 months in many cases and over a year for some Marketplace applications, as applications migrated from Experian to the new vendor. Even if an RBA was provided by another vendor, the cost of changing the https://www.acquisition.gov/far/part-6#FAR_Subpart_6_3 https://www.acquisition.gov/far/part-6#FAR_6_302_1 software of every application using the Experian RIDP services to make API calls in a new format and receive (and then process) responses in a new format, which would be the case for any new RIDP vendor, would involve time and expense that the business owners of these applications have not planned or budgeted for. The transaction cost difference that would be required to offset these costs, which CMS applications would be forced to expend to make the software changes, means that even if a vendor with both RBA and Knowledge Based Authentication (KBA) RIDP services was available, staying with Experian would still be the most cost effective solution for CMS. In other words, the expense and complexity of changing products would offset any performance or cost benefits of such a switch.

8. Market Research:

In addition to the RFI previously discussed, CMS conducted an internet search. Through this activity, CMS identified companies offering products that they say meet the prescriptive Identity Assurance Level (IAL) standard in NIST 800- 63A. However, upon close inspection of supporting information it is clear that the vendor does not offer an RBA.

What is offered by the other vendors is the prescriptive method - which is obvious from the references to taking a photo, uploading documents, etc. CMS’ Market Research led to the conclusion that only Experian offers an RBA solution for proofing individuals at IAL2 contained within the solution itself with no external dependencies.

The standard (prescriptive) NIST 800-63-3 Identity Assurance Level 2 (IAL2) solution requires strong and fair evidence verification, with document verification, facial recognition, and liveness detection for the strong evidence component. This IAL2 solution requires the consumer to have access to a valid Identity Document (“real ID” driver’s license or photo ID and/or USA issued passport), and the technology required to submit the images to CMS with the required level of clarity. It is estimated that roughly 15% of the U.S. adult population (from ages 18 to 65 and over) do not have a smartphone that would support the collection of these images, and depending on the demographic a sizable percentage (young, old, unhoused in particular) may not have either a driver’s license or a passport. Access to the Internet and appropriate Internet bandwidth could also be problematic for some populations of CMS system users. These technological and documentation issues have the potential to negatively impact certain populations of CMS users (the elderly, homeless, those in rural areas, those without ready access to the Internet or an Internet connection with sufficient bandwidth, etc.). The NIST guidelines allow an agency to implement a Risk Based Alternative (RBA) solution for meeting the NIST 800-63 IAL2 requirements.

Products from 1Kosmos, Entrust (includes Onfido, now part of Entrust), Experian, Jumio, GB Group (GBG -previously IDology), ID.Me, LexisNexis, Ping Identity (includes ForgeRock, now part of Ping Identity), and Socure were evaluated, using publicly available information, focusing on their features, compliance standards, and unique capabilities. None but Experian demonstrated a proven RBA to the NIST 800-63-3 prescriptive requirements for IAL2.

Experian’s RBA has been in use at CMS since Sept. 2022 and is now used by all CMS applications utilizing the Experian RIDP Services contract except the Health Insurance Marketplace’s Data Services Hub (DSH) – which is in the process of migrating to the RBA.

Experian has already modified their RIDP service to support CMS, greatly reducing the risk to CMS that the RIDP product being procured will effectively and efficiently meet CMS’ specialized identity proofing requirements within the timeframe required. The risk of existing customers and users encountering a negative user experience or a lack of RIDP services availability is also mitigated by a sole source award to Experian. Additionally, the other potential vendors do not offer the full range of customized features provided to CMS by Experian. These competing products cannot be modified to meet CMS’ needs within the timeframe that would be required to transition to a new vendor.

Therefore, Experian is the only responsible source able to quickly provide the required products and services with the level of quality and lack of risk that will satisfy CMS’ requirements.

9. Procurement History:

Purchase order or contract number: 75FCMC21C0005

Was action competed? Yes

No

If action was not competed, state the cited authority, summarize rationale, and describe the actions that were supposed to be taken to increase competition and the results thereof:

In connection with the contract cited above, CMS completed a Justification and Approval for use of other than full and open competition citing FAR 6.302-1 - Only one responsible source and no other supplies or services will satisfy agency requirements, 41 U.S.C. 253(c)(1) in its Justification for Other than Full and Open Competition. CMS' rationale was that only Experian offered tools and services that could satisfy CMS' specialized identity proofing requirements.

10. Additional Information to support the justification:

None

11. Technical / Requirements Certification: By my signature below, I certify that the supporting data included in this

J&A is accurate and complete.

Program Manager

Name: William Thompson

Position Title: Program Manager, IT Specialist (System Analysis)

Email address:

William.Thompson@cms.hhs.gov

Phone: (443) 821-4206

Program Manager Supervisor (or one level above Program Manager)

Name: Jeffrey Cernik

Position Title: Acting Director, Division of Identity Management Enterprise Systems (DIMES)

Email address:

Jeffrey.Cernik@cms.hhs.gov

Signature:

Date:

12. Fair and Reasonable Price/Cost Determination: As Contracting Officer, by my signature below, I hereby determine that the anticipated price/cost to the Government for this contract action will be fair and reasonable.

The Contracting Officer will perform price analysis to determine that the negotiated price for this action will be fair and reasonable.

Name:

Jeremy Garvin Phone:

13. Contracting Officer's Approval (Required for proposed contract not to exceed $700,000 (value calculated including all options)): I hereby certify that this justification is accurate and complete to the best of my knowledge. I approve this justification subject to availability of funds, and provided that the services and supplies herein described have otherwise been authorized for acquisition.

Jeremy Garvin

14. Legal Review: N/A

15. OPDIV Competition Advocate Approval (Required for proposed contract over $700,000 but not exceeding $13.5 million (value calculated including all options)):

I have reviewed this justification and find that it adequately supports other than full and open competition.

mailto:William.Thompson@cms.hhs.gov mailto:Jeffrey.Cernik@cms.hhs.gov

Lyandra Emanuel

16. Office of Small and Disadvantaged Business Utilization Review: (Required for contracts exceeding $68 million (value calculated including all options)):

Concur:

Non-Concur:

17. OPDIV HCA Approval (Required for proposed contract over $13.5 million but not exceeding $68 million (value calculated including all options)):

Doug Bergevin

18. Department Competition Advocate (Required for contracts exceeding $68 million (value calculated including all options)):

Concur:

Non-Concur:

19. HHS Senior Procurement Executive (SPE) Approval:

Based on the foregoing justification, I hereby approve other than full and open competition for the above stated procurement, subject to the availability of funds, and provided that the services herein described have otherwise been authorized for acquisition.

State supplies/services being procured:

State the full statutory authority and FAR cite and title, consistent with paragraph 4, e.g. 41 U.S.C. 3304: