F03_JA_JFOC_Over_SAT_Final_Redacted_1.pdf

Order No. 140D0425F0797 vulnerability mitigation.

3. Regulatory Non-Compliance and Statutory Risk: The timely award of this order’s optional extension periods is essential to ensure NIAID’s adherence to the PHSA and other critical statutory and regulatory obligations. The removal of specialized support would jeopardize the agency's ability to support quality management, change control processes, and operational security and this would undermine the reliability and security of IT systems, potentially leading to disruptions in critical research on allergic, immunologic, and infectious diseases. Without robust vulnerability remediation and penetration testing, NIAID's information systems would be more susceptible to cyber threats, which could compromise sensitive research data and hinder the institute's ability to respond to emerging public health threats. The absence of strategic planning and project management support would misalign IT initiatives with NIAID's long-term goals, affecting the institute's overall efficiency and effectiveness. Furthermore, failing to adhere to legal and regulatory standards could jeopardize funding, damage public trust, and impair NIAID's capacity to adapt to new public health challenges.

4. Critical IT Security Vulnerabilities and Legal Liability: A lapse in order continuity poses a critical risk to the security posture of NIAID. The absence of comprehensive support for the ISSO function, system-level governance, and control implementation would hinder the ability to meet security requirements throughout the system development life cycle, as mandated by NIAID’s Cybersecurity Program. Without key operational security tasks such as vulnerability management, penetration testing, incident response coordination, and SA&A activities, NIAID would struggle to maintain the necessary security posture to achieve and sustain system Authority to Operate (ATO).

The lack of continuous monitoring would reduce real-time situational awareness and proactive risk mitigation, increasing the likelihood of undetected vulnerabilities and breaches. Overall, these deficiencies would lead to non-compliance with federal cybersecurity mandates, including OMB Memorandum M-17-25 and NIH’s cybersecurity policies, ultimately compromising the security, consistency, and reliability of NIAID’s systems, staff, and processes.

Continued support provided by NTT under the current order is the only path to avoid the consequences noted above. No other vendor has the established experience and expertise to meet NIAID’s mission needs while DOI is completing a longer-termed competed order as well as ensure a sufficient transition time between this bridge order and the competed order. Currently, the competed order is anticipated to be awarded in September 2026, and at least a one-month transition period is required to ensure adequate time to transition knowledge and procedures.

Attempting to compete a new order or issuing an award to a vendor other than NTT at this time until the new award can be completed would result in either a gap in service or degradation in service while the new vendor takes time to acclimate to the work required by NIAID. The inclusion of the additional two-month option periods is to provide the Government support in the event a protest is received against the competed order.

5. A determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

The contracting officer (CO) determines that the anticipated prices will be fair and reasonable based on a comparison with quoted prices for these three option periods against the historical pricing information for this work generated under this order as well as previous iterations of this work. Furthermore, as an order under CIO-SP3, the pricing information from this IDIQ will be used to establish whether the pricing for the option periods are fair and reasonable. The pricing information from the IDIQ were derived through competition and have already been established as fair and reasonable. Finally, this requirement is for commercial services and is exempt from cost analysis per FAR 15.403-1(b)(3). Other than certified cost or pricing data may be requested for further analysis if deemed necessary by the CO. Additional discounts will be requested as well.

6. Any other facts supporting the justification.

The CIO-SP3 IDIQ that was used for this order was recently extended with an ordering period ending on October 29, 2026. Orders under this IDIQ may have performance periods that run through October 20, 2031. Given that this action only adds a maximum of six months of support to this task order, this action is within the terms of the CIO-SP3 IDIQ.

7. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made.

Action has already been taken to remove barriers to competition as a competed order is already in the process of being issued with an anticipated award timeframe of late September, 2026.

Future orders for this work will be provided via competition.

8. The contracting officer’s certification that the justification is accurate and complete to the best of the contracting officer’s knowledge and belief.

I certify that this justification is accurate and complete to the best of my knowledge and belief.

Contracting Officer

9. Evidence that any supporting data that is the responsibility of technical or requirements personnel (e.g., verifying the Government’s minimum needs or requirements or other rationale for an exception to fair opportunity) and which form a basis for the justification have been certified as complete and accurate by the technical or requirements personnel.

I certify that the technical data which forms a basis for this justification is complete and accurate and meets the Government’s minimum needs.

COR

10. A written determination by the approving official that one of the circumstances in FAR 16.505(b)(2)(i)(A) through (E) applies to the order.

FAR 16.505(b)(2)(i)(B)– In accordance with FAR 16.505(b)(2)(i)(B) and HHS Deviation 16.507, this task order must be issued on a sole-source basis because only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

11. Reviews and Approvals:

Approve

Competition Advocate