NITAAC_CEMS_JEFO - redacted_Redacted.pdf

“Source Selection Information – see FAR 2.101 and 3.104” Title

Justification for an Exception to Fair Opportunity

CUI

CUI

1. Identification of the agency and contracting activity:

Federal Agency and contracting activity

Agency:

United States Air Force (USAF) Air Force Life Cycle Management Center (AFLCMC) Propulsion Integration Division (LPZ) Comprehensive Engine Management System (CEMS) 3001 Staff Drive, Suite 2AB1 88G Tinker Air Force Base, OK 73145

Contracting Activity:

Erin Flynn Pacifico, Contracting Officer National Institute of Health (NIH) Information Technology Acquisition and Assessment Center (NITAAC) Bethesda, MD 20892-7511 Phone: 301-451-0212

Contracting Officer's Representative (COR) Information.

2. Nature and/or description of the action being approved:

Acquisition purpose and objectives.

The CEMS Program Management Office (PMO) is seeking immediate contractor support to address critical operational requirements for J85 engines and to ensure compliance with stringent Department of the Air Force (DAF) audit standards. This modification is vital to sustain CEMS’s 24/7 availability, supporting military operations and the warfighter's mission by improving aircraft readiness and reliability. The additional funding will allow for expanded labor support, facilitate the timely implementation of Financial Information Audit Remediation (FIAR) efforts, and provide additional software licenses that are necessary to the CEMS mission.

The Propulsion Directorate within Air Force Life Cycle Management Center requires contractor assistance for Information Technology (IT) Operations and Maintenance, Integration Services, and Critical Infrastructure Protection and Information Assurance for its Accountable Property System of Record for all engine-related data, CEMS.

This request seeks approval to issue a modification without providing fair opportunity under the existing NITAAC Task Order 75N98125F00001, awarded under Contract

CUI

sustainment, technical refreshes, and continuous improvement efforts, ensuring consistent operational performance without degradation.

Under HHSN316201200156W / 75N98125F00001, Concept Plus serves as the single focal point to the Air Force (AF) CEMS PMO, AFLCMC/LPZC, providing comprehensive development and sustainment activities as directed. This includes all IT development, maintenance, and sustainment activities for CEMS IT software, ensuring system functionality, availability, reliability, manageability, maintainability, auditability, and responsiveness to the DoD and AF Propulsion community at a level system availability. Additionally, the scope involves ongoing identification and implementation of best practices and innovative technologies to enhance system performance and improve business processes. This includes initiatives such as migrating to DevSecOps methodologies and supporting enterprise-level solutions to ensure the system remains resilient, efficient, and aligned with mission requirements.

In July 2025, the CEMS PMO received requests from various clients to prioritize two urgent, time-sensitive initiatives. The first involves accelerating the implementation of enterprise solutions mandated by the Secretary of the Air Force/Financial Management (SAF/FM) to address Office of the Under Secretary of Defense’s (OUSD) current FIAR priorities, specifically focusing on reducing material weaknesses related to budgetary information, mission-critical asset data, and financial feeder systems. The second request pertains to integration of the J85 engine platform into the Reliability Centered Maintenance (RCM) Toolset within the CEMS architecture, as the J85 currently faces notable supportability and reliability challenges that could be mitigated using the RCM Toolset applications. The contractor, along with the CEMS PMO, also recognized the need to obtain two licenses for use in support of the task order. The licenses are Checkmarx and iText.

The additional scope includes:

Increased support from Contractor team to implement the RCM Toolset for the J85 to support urgent readiness needs for J85 engines and the T-38 aircraft

Expanded labor support to meet new audit compliance directives with the deployment of Financial Information Audit Remediation (FIAR) Compliance Acceleration.

Material costs (ODCs) for annual software licenses including Checkmarx and iText in both the base and outyears.

Failure to address the J85 engine supportability challenges while simultaneously failing to implement and meet FIAR compliance requirements could negatively impact warfighter readiness, mission effectiveness, and operational availability which is paramount in supporting the National Defense Strategy objectives. If the system is inoperable, the warfighter will not have access to the time critical data of the engine

CUI

and engine-piece parts. This may result in a catastrophic event that will lead to loss of the aircraft and loss of life. USAF currently has no contingency plans in place if the system goes down.

3. Description of the supplies or services required to meet the agency’s needs (including the estimated value).

This requirement is for efforts deemed critical to USAF operations and readiness, as documented in Section 3.4 of the CEMS Software System Support Performance Work Statement (PWS). Two distinct requirements have been identified as critical for meeting mission objectives: the RCM Toolset, referenced in Section 3.4.4 of the PWS, and the FIAR Compliance Acceleration, as outlined in Sections 1.2 and 3.1 of the PWS. While both efforts were included in the original PWS, specific tasks related to FIAR have been mandated to facilitate system modifications to ensure adherence to FIAR guidelines, leading to an expedited remediation schedule to meet OUSD timelines. Concerning the RCM Toolset, requirements specific to J85 were not fully defined until August 2025. The projects associated with these requirements, along with the requested increase in materials (other direct costs), are outlined below.

Project(s):

Project title: Reliability Centered Maintenance Toolset for J85 Engines

Project description:

The J85 engine continues to face significant challenges that adversely affect its operational readiness. These issues primarily stem from reliability concerns, low engine removal rates, fluctuating production levels, and substantial parts shortages, resulting in an insufficient number of engines to support pilot training programs and contributing to a critical pilot shortage. The J85 engine powers the T-38 trainer and the F-5 fighter jet. According to af.mil, “The T-38 Talon is a twin-engine, high-altitude, supersonic jet trainer used in various roles due to its design, operational efficiency, ease of maintenance, high performance, and strong safety record. Air Education and Training Command is the primary user of the T- 38 for joint specialized undergraduate pilot training. Additionally, Air Combat Command, Air Force Materiel Command, and National Aeronautics and Space Administration utilize the T-38A in various capacities.”

As of September 2024, the USAF reported a pilot shortage exceeding 1,800, largely attributed to maintenance issues related to the T-38 and its J85 engines. In response, the J85 System Program Office has allocated from its budget to engage the CEMS PMO and implement the RCM Toolset for the J85 engine. Expanding the capabilities of the RCM Toolset will support

CUI

improvements in aircraft readiness and availability, thereby strengthening mission-critical operations.

The implementation of the RCM Toolset possesses the potential to increase mean time between removals by approximately , reduce shop visit costs per flying hour by over , and generate cost savings of more than for the DAF over the next decade. Ultimately, this toolset will contribute to more reliable actuarial models, significantly enhancing fleet readiness and aircraft reliability.

To deliver critical reliability tools to the J85 engine program, the CEMS PMO requires additional personnel across several key labor categories including System Architects, Software System Engineers, DevOps Engineers, Developers, Project Managers, Application Programmers, Functional Analysts, and Database Administrators. As stated in the other project description, these roles currently support Task 5 – Priority Support.

Failure to implement this change and exercise this option by 30 Sep 2025 will prevent the CEMS PMO from securing the necessary funding for additional resources to help improve the J85 engine program, risk defense readiness, and prevent substantial cost savings for the DoD. Securing these critical resources will allow the DAF to maintain readiness for generations to come.

Project title: Financial Information Audit Remediation Compliance Acceleration

Project description:

During the annual DAF financial statement audit, DAF received Notices of Finding and Recommendations (NFRs) that highlight Defense Business Systems’ (DBS) inability to support timely, data-driven decision-making, and data integrity.

To support remediation of these NFRs, downgrade DAF's IT Material Weaknesses, and drive DAF toward achieving a clean audit opinion, the Office of the Under Secretary established the Audit Remediation and Capability Integration (ARCI) program to implement five (5) distinct capabilities across Financial Management (FM) and FM feeder systems.

Audit support and remediation efforts were specifically identified in the PWS, specifically section 1.2 (page 6), section 3.1 (page 8), and section 3.1.6.4 (page 14).

material system, placing it under implementation of additional workstreams to support FIAR-related initiatives.

These critical workstreams include Identity, Credential, and Access Management (ICAM), Configuration Management Database/Enterprise Integration (CMDB/EI), Security Information and Event Management (SIEM), enhanced

Justification for an Exception to Fair Opportunity

CUI

CUI

System Security measures, and Standard Financial Information Structure (SFIS).

Specific requirements for each workstream are identified in the Requirements Documents, attached. Addressing these vulnerabilities promptly is critical to maintaining data integrity, operational effectiveness, and ensuring compliance with DAF audit standards. To support senior leadership directives within the DoD and to expedite project timelines to adhere to May 2026 workstream implementation (with Sep 2026 baseline acceptance), SAF/FM is providing to the CEMS PMO to fund additional resources necessary for the successful implementation of these workstreams as part of the FIAR efforts. As such, this effort falls under the Priority Support CLIN 0050.

To achieve mandated timelines and ensure successful implementation of the enterprise solutions, the CEMS PMO requires additional personnel in several key labor categories including Software System Engineers, DevOps Engineers, Developers, and Database Administrators. Currently, these roles support Task 5 – Priority Support.

Failure to exercise this option by 30 Sep 2025 will prevent the CEMS PMO from securing the necessary funding for additional resources. This will jeopardize the project's ability to meet mandated timelines and, ultimately, compromise the DAF’s ability to achieve a clean audit opinion. This is a critical dependency for successful audit outcomes.

Materials (ODCs): Checkmarx and iText annual licenses

Description: An increase to the not-to-exceed amount for materials (ODCs) is required so that the contractor, Concept Plus, can obtain Checkmarx and iText software licenses to support direct work on this task order. All software required for this task order will be required to follow the Cyberspace Infrastructure Planning System (CIPS) requirements implemented by the Air Force Life Cycle Management Center’s BES Directorate to ensure proper implementation and approved use. The requirement for these software licenses is a direct result of the accelerated FIAR requirements we are pursuing under this modification. USAF will not directly use or own this software; Government use is limited to consuming the work products produced using the software.

1. Checkmarx is critical to the CEMS’ mission as it provides automated, comprehensive static application security testing (SAST) tailored to our development pipeline. It enables early identification and remediation of security vulnerabilities in custom code, ensuring compliance with DoD cybersecurity mandates and significantly reducing risk exposure. Building on the success seen by the USAF Business & Enterprise Systems (BES) Directorate, Concept Plus will leverage Checkmarx to harden its DevSecOps Continuous

Justification for an Exception to Fair Opportunity

CUI

CUI

Integration/Continuous Delivery (CI/CD) pipeline. Specifically, Checkmarx SAST will be integrated to meet the SAST scanning requirements set by the Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) and Risk Management Framework (RMF), echoing the USAF's initial engagement. Like the USAF, this will empower developers to identify, triage, and remediate vulnerabilities earlier in the Software Development Life Cycle (SDLC), reduce false positive rates, and accelerate application delivery timelines. This software will be renewed each year for the life of the task order.

2. iText is essential to the CEMS mission because it enables secure, automated generation and manipulation of PDF documents used in reporting, audit support, and system interoperability. It supports advanced capabilities such as digital signing, encryption, and dynamic form handling—requirements necessary to meet compliance and data integrity standards. This software will allow Concept Plus to streamline workflows and reduce manual effort by automatically generating various documents as PDFs, such as reports, forms, and technical publications. Mirroring the potential applications for the USAF, Concept Plus will also utilize iText to customize documents with specific branding and watermarks, as well as split and merge existing PDF files as needed. Importantly, iText's support for standards like PDF 2.0, PDF/A (for archiving), and PDF/UA (for accessibility) will ensure generated documents meet compliance and security requirements, particularly for long-term preservation and accessibility, thereby adhering to government agency handling procedures for large volumes of digital documents. This software will be renewed each year for the life of the task order.

Provide the following information:

i. Requirement type:

Support services (non-research & development) Supplies/Services Information Technology (IT) or Electronic and Information Technology

Construction Architect-engineer (A-E) Services Design-Build Research & Development (R&D) R&D Support Services Other (specify):

ii. Type of action:

Performance/delivery period for FY25 obligation for base period

4. Identification of the exception to fair opportunity (see 16.505(b)(2)). The supporting rationale, including a demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the exception cited.

Acquisition authority.

(A) The agency need for the supplies or services is so urgent that providing a fair opportunity would result in unacceptable delays.

(B) The agency need for the supplies or services is so urgent that providing a fair opportunity would result in unacceptable delays.

(C) Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(D) The order must be issued on a sole-source basis in the interest of economy and efficiency because it is a logical follow-on to an order already issued under the contract, provided that all awardees were given a fair opportunity to be considered for the original order.

(E) It is necessary to place an order to satisfy a minimum guarantee.

(F) For orders exceeding the simplified acquisition threshold, a statute expressly authorizes or requires that the purchase be made from a specified source.

Demonstration of the proposed contractor(s) unique qualifications to provide the required supply or service.

(A) Name of the proposed contractor(s).

Concept Plus LLC

(B) Nature of the acquisition and proposed contractor(s) unique qualifications.

Concept Plus was initially selected for contract award based on

The contractor currently provides all maintenance, Project Estimated Dollar Value Estimate Performance Period

Reliability Centered Maintenance Toolset for J85 Engines

36 months (Sep 2025-Sep 2028)

Financial Information Audit Remediation Compliance Acceleration

12 months (Sep 2025-Sep 2026)

Software Licenses (Checkmarx & iText)

12 months (Sep 2025-Sep 2026)

CUI

sustainment activities, development, support and updates for CEMS. Their proven performance has resulted in system availability to date.

Furthermore, their workforce possesses the specialized expertise required for accelerating FIAR requirements and seamlessly integrating the J85 engine into the RCM Toolset. This includes expansive knowledge in Identity, Credentials, and Access Management (ICAM), Configuration Management Database/Enterprise Integration (CMDB/EI), Security Information and Event Management (SIEM), enhanced System Security measures, and Standard Financial Information Structure (SFIS), as required in Attachment 2.

As outlined in Sections 1.2 and 3.1 of the PWS, audit support and remediation efforts are core requirements. Task 5 allows for acceleration of specific efforts that fall under the Financial Information Audit Remediation Compliance Acceleration initiative. Additionally, RCM Toolset for J85 Engines is in the scope of Task 5 and is described in the PWS under Section 3.4.4.

Concept Plus’s Selecting another vendor at this critical juncture would introduce unacceptable risks to the DAFs ability to meet strict audit requirements and mission-critical objectives.

Introducing a new vendor would jeopardize ongoing efforts and lead to:

Duplication of Effort: Competing these two projects would lead to a duplication of effort between work under the current task order and a new task order, as the work under the PWS would be the same. This duplication would lead to increased costs, delays to critical audit timelines, and potential disruption to the mission-critical CEMS and RCM Toolset. A new vendor would be duplicating the efforts already underway for these particular projects, and still not have the deep understanding of the system to make a meaningful contribution in a short time.

Therefore, awarding this modification to Concept Plus is the only practical and responsible course of action to ensure timely and effective completion of these critical requirements, to minimize risk, and protect the Warfighter’s interests.

Compromised Data Integrity and Audit Readiness: The segregation of duties between two contractors working in CEMS would create risk with respect to cybersecurity vulnerabilities. If two contractors independently modify the CEMS system code related to FIAR or RCM without proper coordination, incompatible or conflicting changes could be committed to production. For instance, one contractor might update a shared library or database schema while the

CUI

other deploys code dependent on the previous version, leading to runtime errors, system crashes, or data corruption. Such misconfigurations can introduce vulnerabilities that attackers could exploit, resulting in a cybersecurity violation, system inoperability, and untimely loss of the Authority to Operate (ATO). Furthermore, if one contractor deploys code without conducting mandatory security checks—such as static code analysis, vulnerability scanning, or penetration testing—this could result in deviations from the approved baseline configuration. Such deviations compromise system integrity and violate compliance requirements essential for maintaining the ATO. By introducing a second contractor, the complexity of managing version control, configuration management, and security compliance increases exponentially. These technical challenges underscore the importance of retaining a single contractor to ensure consistent application of security controls, streamlined operations, and adherence to the system’s approved baseline configuration.

5. Determination by the ordering activity Contracting Officer that the anticipated cost to be fair and reasonable.

Labor rates for the NIH Information Technology Acquisition and Assessment Center (NITAAC), CIO-SP3 have been established and determined fair and reasonable at the IDIQ contract level. The NITAAC assisted contracting officer will consider existing fixed loaded hourly rates and levels of effort on the task order, and the IGCE for this additional work as determining factors for reasonableness. The IGCE for Checkmarx and iText software products is based on independent quotes from each software vendor, which the NITAAC contracting officer will use in comparison to the quote that will be requested from Concept Plus. Based on the information presented in this document there is no indication that the price will not be fair and reasonable to the Government. A final determination will be conducted prior to the award of this contract. An award will only be made if it is shown that the quoted price to the Government is fair and reasonable.

6. Any other facts supporting the justification.

No additional details to add.

7. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made.

While the tasks defined in this modification fall within the originally defined scope, the significant increase in overall contract value pushes the proposed modification out of scope as the increased level of effort is significant and was not included in the original task order

CUI

competition. To address this in any follow-on to this order, the CEMS PMO will focus on employing more flexible and adaptive contract structuring techniques. This includes: (1) utilizing options or phased procurements to allow for competitive bidding on future phases or expansions of the project; (2) exploring the use of modular contracting, where portions of the project can be separately competed; and (3) incorporating clear and well-defined criteria for scope changes and associated cost adjustments within the original contract, ensuring transparency and predictability for all potential offerors. Furthermore, the CEMS PMO will weigh the use of T&M contracts and CLINs when warranted, researching best practices for structuring IT contracts to address unprogrammed requirements and unforeseen circumstances while preserving fair competition. This proactive approach will allow us to manage project growth effectively while upholding the principles of fair opportunity.