FIAR FMI LSJ 27MAR2025_Redacted 2 Applied.pdf

Limited Sources Justification and Approval (J&A)

April 2024 Page 2 of 6April 2024 Page 2 of 6

I. Contracting Activity.

Air Force District of Washington/Contracting Directorate (AFDW/PKS), 1500 West Perimeter Road, Ste 5750, Joint Base Andrews, MD 20762, Contracting Officer is Christine M. Dolan, christine.dolan@us.af.mil

II.Nature and/or description of the action being processed.

This action establishes a sole-source bridge between competitive contracts to ensure continuity of mission critical audit and audit system remediation services for the Department Air Force (DAF) Financial Improvement and Audit Remediation (FIAR) efforts. This contract will be awarded to Deloitte & Touche LLP, 1919 N. Lynn Street, Arlington, VA 22209-1742. This contract will be awarded using FAR 8.405-6(a)(1)(A) for a Base period of 12 months with a 12-month option (24 total months). Deloitte & Touche LLP is currently performing these audit and audit system remediation services under contract FA701418D5000 Task Order (TO) FA701422F0111, with a period of performance (PoP) from 06 May 2022 to 22 April 2025. This new contract will commence upon the expiration of the current period of performance of TO FA701422F0111, extending services from 23 April 2025 to 22 April 2026, with an option to extend (FAR Clause 52.217-9) to 22 April 2027. This approach ensures uninterrupted support for FIAR enterprise information technology (IT) and security controls work to downgrade material weaknesses (MW) identified by the DoD Inspector General (IG) independent public accountant (IPA) from 2018-2024 for ineffective security controls (segregation of duties (SoD), access controls (AC), security management (SM), interface controls (IC), and configuration management (CM) in DAF Financial Information Systems for the General Fund (GF) and Working Capital Fund (WCF) by December 2026. The contract type will be Firm Fixed Price (FFP). This sole-source contract will be a new order against Deloitte GSA Multiple Award Schedule GS00F029DA.

Base Period 23 March 2025 - 22 March 2026 CLIN 0001 FIAR IT Sys/Integration Services 12 months CLIN 0002 Travel

Total Base Year

Option Period 23 March 2026 - 22 March 2027

CLIN 1001 FIAR IT Sys/Integration Services 12 months $

CLIN 1002 Travel $

Total Option Period $

Total Requirement $

III. Description of supplies/services required to meet agency needs.

The Office of the Assistant Secretary of the Air Force for Financial Management and Comptroller (SAF/FM) oversees and manages the annual financial statement audit process. The SAF/FM Deputy Assistant Secretary Business Systems and Technology/Chief Information Officer (SAF/FMI) requires support to continue development and deployment of highly specialized and complex cybersecurity solutions for Department of Air Force (DAF) financial and financial feeder systems across five key capabilities: Identity, Credential, and Access Management (ICAM), Security Information and Event Management (SIEM), System Security (SS), Configuration Management Database (CMDB), and Enterprise Integration (El).

SAF/FMI requires uninterrupted, highly specialized service delivery for the following services:

April 2024 Page 3 of 6April 2024 Page 3 of 6

Task 1 - Information Technology (IT) Audit Liaison Support. Providing audit liaison support to remediate material weaknesses in financial information systems by facilitating walkthroughs of audit processes and assisting with the exchange of audit information, audit samples, and supporting documentation in response to auditor requests.

Task 2 - IT Assessable Unit Corrective Actions and Integrated Master Schedules (IMS). Provide beginning- to-end Corrective Action and IMS support for the information technology assessable unit portion of the DAF's financial statement audit. SAF/FMI works with DAF stakeholders to improve the information technology Corrective Action Plan (CAP)/Notice of Finding and Recommendations (NFR) process to gain efficiencies.

Task 3 - Financial Improvement Audit Remediation (FIAR) Information Technology (IT) Systems/Integration.

Provide support in assessing, documenting, testing, and monitoring internal IT controls for financial systems in auditing to downgrade material weaknesses.

Task 4 - Identity, Credential & Access Management (ICAM). Provide ICAM solutions to secure and assure access to DAF financial information systems and manage digital identities, credentials, and access to systems and data. SAF/ FMI plans to achieve this by implementing a suite of ICAM solutions across Identity Provider (ldP), Identity, Governance, and Administration (IGA), and Privileged Access Management (PAM) and onboarding all 69 financial and financial feeder systems to these solutions. ICAM deliverables include onboarding and technical integration, operational support, environment support, and migration support for financial systems to the DAF enterprise ICAM.

SAF/FMI has 36 financial information systems remaining to onboard to the Identity Provider (ldP) solution, 36 systems remaining to onboard to Identity Governance and Administration (IGA), and 46 systems remaining to onboard to Privileged Access Management (PAM) to meet the DAF audit roadmap requirements for financial information systems.

Task 5 - Security Information & Event Management (SIEM). Provide real-time monitoring and analysis of security related events and data to detect and respond to security incidents more quickly, reducing cyber-attacks' impact on DAF financial systems and improving overall security posture. This effort requires integrating financial and financial feeder systems with multiple Cybersecurity Service Providers (CSSPs) and providing operational support for all system owners. SIEM activities include onboarding, technical integration, and operational support. The DAF currently has 60 remaining systems to onboard to the DAF's security logging and SIEM solution to meet the DAF audit roadmap requirements for Financial Information Systems.

Task 6 - System Security (SS). Assist SAF/FMI in securing DAF financial information systems by configuring and maintaining systems securely, reducing the risk of cyber-attacks. SAF/FMI plans to achieve complex system security integration through a federated approach to integrate and interface with multiple Cybersecurity Service Providers and other cybersecurity organizations. System security deliverables include conducting system security assessments, onboarding, technical integration, and operational support. The DAF currently has 39 systems to assess and remediate control deficiencies to meet the DAF audit roadmap requirements for Financial Information Systems.

Task 7 - Configuration Management Database (CMDB)/Enterprise Integration (El). Assist SAF/FMI in providing a CMDB solution and support for a centralized repository of information related to hardware, software, systems, and services to help improve the visibility of IT infrastructure to manage and maintain the change management process for the CMDB, including procedures for requesting, approving, and implementing changes. CMDB deliverables include onboarding and technical integration, organizational change management, and operational support.

Enterprise integration supports other systems and applications, including directory services, authentication protocols, and authorization frameworks, to meet the DAF audit roadmap requirements for financial information systems. The DAF currently has 39 systems remaining to onboard the CMDB solution to meet the DAF audit roadmap requirements for financial information systems.

CONTROLLED UNCLASSIFIED INFORMATION

April 2024 Page 4 of 6April 2024 Page 4 of 6

These services are performance-based and will be funded with Operations and Maintenance (O&M) 3400 appropriations. The total estimated value of this 12-month action is $ with a 1-year option cost of

IV. Identification of the justification/rationale for limiting sources and demonstration of the contractor's unique qualifications to provide the required supply/service.

FAR 8.405-6(a)(1)(A) An urgent and compelling need exists, and following the procedures would result in unacceptable delays. Continuation of the Advisory and Assistance Services (A&AS) enterprise information technology (IT) and security control tasks performed by the current vendor directly support the DAF's efforts to downgrade IT general controls material weaknesses in DAF Financial Information Systems for both the General Fund and Working Capital Fund by December 2026. The DAF audit roadmap requires the DAF to complete closing all IT general control material weaknesses in DAF financial information systems by December 2026 in support of the DAF receiving an unqualified audit opinion. It supports the broader Department of Defense (DoD) goal of meeting the National Defense Authorization Act (NDAA) statutory requirements for meeting deadlines for the DoD to achieve audit readiness and an unqualified audit opinion. The progress made over the past two years would halt, and IT audit roadmap dates would be pushed to the right if a new vendor needs to train on DAF business processes and systems. A break in service would cause the DAF to suspend its FY25 audit work. It will result in the re-issuance of IT general controls material weaknesses by the IPA, which were downgraded over the last year, putting the DAF on a reverse trajectory, resulting in the date for favorable audit opinion to slip to the right by one or two years.

Deloitte currently has its resources optimally allocated to serve the needs of the DAF while minimizing waste and inefficiency. The DAF could not complete a competitive action sooner than to . By December 2026, the DAF targets the remediation of more than 90% of its remaining IT general control material weaknesses.

To achieve these objectives in a time-constrained environment, the DAF must leverage existing program support success to maintain future progress. Over the past 2.5 years, Deloitte has provided A&AS essential to DAF's audit readiness and financial improvement efforts, driving significant audit remediation progress, including sustaining closure of critical IT NFRs, downgrading and eliminating material weaknesses, resolving financial system weaknesses, and enabling compliance with federal standards. To attempt to award a short-term contract for this period, independent of the re-compete, to any source other than the current Contractor (Deloitte) would require an additional time-consuming procurement cycle, mobilization, and potential transition to a new Contractor, resulting in unacceptable time delays and a gap in service to the Government totaling a minimum of inclusive of a transition-in period. A short-term competitive action of this size would require acquisition planning, solicitation preparation and review, and proposal evaluation. Market research has demonstrated that vendors are likely to respond to a competitive offering, but only Deloitte can perform without requiring a transition-in and sustaining a learning curve. Switching to any other vendor would cause the Government to sustain an unacceptable break in service. When considering both time periods (the timeline required to sustain audit readiness performance and the time to compete, evaluate, award, transition, and learning needed for a new vendor), the cost benefit analysis of competing this requirement on the open market does not justify the mission degradation the DAF anticipates. Switching to any other vendor would cause the Government to sustain an unacceptable break in service. Deloitte has developed and operated DAF's tools to achieve DoD and DAF's audit objectives; no other source can immediately provide or operate the highly specialized suite at the same level of quality in the needed time frame.

The current vendor has developed, configured, and maintained this specialized FIAR IT technical stack, demonstrating a deep understanding of the DAF's complex architectures, security protocols, business rules, and audit requirements.

April 2024 Page 5 of 6April 2024 Page 5 of 6

Deloitte has developed and created FIAR IT solutions that comply with the Federal Information System Controls Audit Manual (FISCAM) and National Institute of Standards and Technology (NIST) 800-53 requirements, utilizing the aforementioned technologies in various DAF environments. The DAF FIAR IT Program is supported by a team of skilled vendor personnel with advanced specialized skills and a thorough understanding of the complex FIAR IT technical stack. The vendor's expertise and familiarity with the DAF's specific implementation are crucial for maintaining the system's effectiveness and meeting audit milestones and objectives for financial information systems by December 2026.

Cost and Resource Implications

Award to an alternative source for this requirement would result in unacceptable delays, estimated at , substantial duplication of costs, estimated at $ , and places the Department of the Air Force's budget at risk for reduction by % for not meeting NDAA audit-related provisions. Given the complexity of the DAF's financial systems and processes, the transition to an alternative source would require extensive time and resources to reach a comparable level of proficiency. For example, the onboarding process for new personnel to the DAF's specialized and complex IT FIAR technical environment and complex IT audit requirements are estimated to take

. During this period, financial information systems that are significant and material for the DAF to get an audit opinion would require rework of established IT FIAR methodologies and processes, and efforts to onboard IT FIAR solutions would be interrupted. The high risk to cost underscores the vital importance and necessity of maintaining continuity with the current vendor, Deloitte, to ensure mission success and fiscal responsibility.

The DAF IT FIAR program is at a critical time frame. The current approach to finish the required IT FIAR work with the current vendor, who has advanced specialized knowledge over an extensive period, will allow the government to meet audit roadmap milestones and objectives by December 2026. Considering the December 2026 deadline and the complexity of downgrading material weaknesses in financial information systems, maintaining continuity with the current contractor, Deloitte, who has a deep understanding of the DAF's complex financial systems environment and audit requirements and has demonstrated capability in these specialized areas aligns with the FAR exception for Fair Opportunity.

Any disruption to continued support will delay current and ongoing integrations crucial for achieving, sustaining, and protecting critical systems supporting Air Force missions and operations. Without continuing this work, the DAF will fail to address information technology general controls and material weaknesses in its financial management systems within the audit objectives timelines. As a result, this will have significant mission impacts on the DAF's goal of achieving an unqualified audit opinion by fiscal year 2026 for its General Fund and 2028 for its Working Capital Fund and will result in increased cybersecurity risks, leave DAF financial systems exposed to critical cyber threats, potentially compromising sensitive data and operations. Additionally, the DAF will face potential funding penalties or restrictions on federal funds if audit readiness is not achieved on time.

V. Determination by the ordering activity Contracting Officer that the order represents the best value consistent with

FAR 8.404(d).

The resulting proposal will be evaluated by the SAF/FMl's government technical team to ensure the appropriate skill mix and labor hours are included in the DAF's negotiation position. The Contracting Officer will conduct a price reasonableness determination. Analysis will be based on historical costs incurred, the Independent Government Cost Estimates, and the technical evaluation. As this requirement meets the commercial services definition IAW FAR 2.101, certified cost and pricing data are not applicable.

April 2024 Page 6 of 6April 2024 Page 6 of 6

VI. Description of the market research conducted and the results, or explain why market research was not conducted.

The DAF completed market research through various methods for continued audit and audit system remediation services support of the FIAR program. To date, four (4) Requests for Information (RFI) were posted to sam.gov.

Additionally, the DAF hosted an Industry Day to better tailor the requirements and assist industry in understanding the DAF's specific needs. The DAF received RFI responses from vendors, both large and small businesses. Based on the market research, there were several vendors capable on the GSA OASIS Pool 2 contract vehicle. The GSA OASIS Pool 2 Unrestricted (UR) ordering period expired on 1 March 2025. The GSA recompete follow-on first group of contracts awarded on 06 Dec 24 as GSA OASIS+ UR.

A Fair Opportunity Proposal Request was preparing to be issued on the GSA OASIS+, it was learned in Dec 2024, NAICS 541219 and 541211 and the scope of FIAR Audit services was not included in the recently awarded follow-on GSA OASIS+ contracts. An additional RFI was then issued on sam.gov in early Jan 2025, requesting Industry make known any contract vehicles available that meets the scope of FIAR Audit services under NAICS 541219/541211.

The results varied and there were several vendors that indicated FIAR services are available under the GSA MAS Schedule. Therefore, due to schedule constraints and timeline, there is not enough time to competitively award the follow-on effort without lapse in service under the GSA MAS schedule. When considering both time periods (the timeline required to sustain audit readiness performance and the time to compete, evaluate, award, transition, and learning needed for a new vendor), the cost benefit analysis of competing this requirement on the open market does not justify the mission degradation the DAF anticipates. Switching to any other vendor would cause the Government to sustain an unacceptable break in service and cause the DAF to be unable to meet audit milestones and objectives for financial information systems by December 2026.

VII. Other facts supporting the justification.

N/A

VIII. Actions the agency may take to remove or overcome any barriers that led to the restricted consideration before any subsequent acquisition for the supplies or services.

Once this work is complete to downgrade IT general controls material weaknesses in financial information systems, the government will reassess, create a strategy, and create acquisition strategies for the continuation of work. The government plans to populate a bidder's library with deliverables from Deloitte, providing access to essential information for potential contractors. By sharing information openly, the government aims to remove barriers for small and large vendors. By providing comprehensive information and fostering transparency, the government will enable potential contractors to: (1) gain a clear understanding of project requirements and ongoing work; (2) assess their capabilities and resources for contract requirements; and (3) prepare competitive proposals based on accurate and up-to-date information.

IX. Certification by the Contracting Officer.

As evidenced by my signature above, I have determined this document to be both accurate and complete to the best of my knowledge and belief.

X. Certification by the technical/requirements personnel.

As evidenced by my (our) signature(s) above, I (we) certify that any supporting data contained herein, which is my (our) responsibility, is both accurate and complete.