HIM EIDM - Exemption to Fair Opportunity Postings _Redacted.pdf

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

Acquisition Title: EIDM Hosting – Perspecta Enterprise Solutions, LLC Data Center Agency: CMS Acquisition Year: 2020

APP: 200332

1. Description of Action:

A. Nature

a. ____ New Requirement

b. ____ Follow-On Order

c. _X__ Modification of Existing Purchase Order / Contract Number: HHSM-500-T0003

B. Order Against

a. _X___ Multiple Award IDIQ Contract Number: HHSM-500-2013-00014I

C. Contract Type

a. _X__ Firm-Fixed Price

b. ___ Time and Materials

c. _ Cost Plus Fixed Fee (CPFF)

i. ____ Term

ii. ____ Completion

d. ____ Cost Plus Award Fee (CPAF)

e. ____ Other: Hybrid Contract

D. Projected Cost / Price of contract (Base & All Options):

E. The total estimated value of the proposed sole source action (for modifications only) for 1 year:

F. Funding Source(s):_________ G. ____: Basis for Approval (Far 6.303-1(d))

__X_: Individual Basis

____: Class Basis

The Healthcare Infrastructure Marketplace (HIM) Task Order was competed under FAR 16.505(b)(1), Fair Opportunity, utilizing the CMS Virtual Data Center (VDC) multiple award IDIQ contract. The awardee was HP Enterprise, now called Perspecta Enterprise Solutions. Enterprise Identity Management Systems (EIDM) is one of many applications hosted under the task order, though all others have since migrated to CMS Cloud. The Period of Performance of the current/last contract option period for EIDM Hosting ends June 30, 2020. Funding for the EIDM portion of this hosting services contract (including hardware and software) . This includes specialized Exadata and Oracle Database Appliance (ODA) servers used to run the Oracle Identity Management Software Suite.

Background:

Our nation’s healthcare system has experienced major reform due to the enactment of the American Recovery and Reinvestment Act (ARRA); Health Information Technology for Economic and Clinical Health (HITECH); the Patient Protection and Affordable Care Act, also known as Affordable Care Act (ACA); and by the growing population of beneficiaries and insurance exchange applicants.

The Centers for Medicare & Medicaid Services (CMS) was mandated within these reforms to assure the security of CMS’ health care systems. As part of this effort, CMS deployed an Enterprise Identity Management System (EIDM) to meet the Affordable Care Act mandate of “Modernizing Computer and Data Systems of the Centers for Medicare & Medicaid Services to Support Improvements in Care Delivery.”

CMS’ existing EIDM system works in conjunction with other Identity based services,

1. Identity Services, which registers users, vets their identity, and provisions them with system access credentials

2. Authentication, which verifies the credentials of a user when accessing CMS systems

3. Authorization, which manages the rights and privileges of each user to access specific CMS information resources, and

4. Auditing, this verifies the proper compliance with access control policies and legitimate access by users.

The EIDM is an integrated suite of standards-based enterprise products and services which support registration, authentication, authorization, and lifecycle management services.

EIDM is integrated with both the

2. Description of Supplies or Services:

EIDM supports the process of a user requesting and being approved for a role to access a CMS business application, based on requirements defined by that specific business application, including the level of assurance (LOA) required for access to that same specific CMS business application. During the role selection and approval process, EIDM checks the assurance level of the user credentials against the LOA required by the business application and, if necessary, invokes a service to help assure CMS that the individual attempting to access the CMS system is who they claim to

be. EIDM also supports for those business applications that require additional security.

The foundation of the current EIDM system hosted at the Perspecta Data Center

EIDM provides lifecycle management for all registered users. There are over to be integrated with the EIDM or consuming EIDM services. The distinct EIDM system hosted within the Perspecta Data Center averages around

Current reporting identifies over

3. Authority and Rationale:

The Contracting Officer shall give every awardee a fair opportunity to be considered for a delivery/task order exceeding $3,000 unless one of the following statutory exceptions applies. FAR 16.505(b)(2). Mark the applicable exception:

___ The agency need for the supplies or services is so urgent that providing a fair opportunity would result in unacceptable delays [FAR 16.505(b)(2)(i)(A)];

__Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services are unique or highly specialized [FAR16.505(b)(2)(ii)(B)];

_X_ The order must be issued on a sole-source basis in the interest of economy and efficiency because it is a logical follow-on to an order already issued under the contract, provided that all awardees were given a fair opportunity to be considered for the original order [FAR 16.505(b)(2)(i)(C)];

or

The Division of Identity Management Enterprise Systems (DIMES) within the Enterprise Systems Solutions Group (ESSG) has initiated an EIDM modernization project. The modernization effort now underway will migrate the current EIDM system to a new cloud based solution, which was scheduled to go-live on April 6, 2020. While CMS has made every effort to deliver the new solution on schedule, it has now been determined that CMS’ role management platform is not yet stable enough to give CMS full confidence that we can successfully support our volume of users, and the target date for EIDM migration to the new IDM cloud solution will not be met. However, due to the customization and integration between the EIDM system and the current host contractor’s it is also not feasible to change host providers for the interim period between June 30, 2020 and final migration to the IDM cloud service, which will now take place within the next 12 months. There is no reasonable expectation that any contractor other than the incumbent would be determined best value in a competition for this work, given the short period of performance for the extension and the relatively large cost, effort and risk of migrating the current physical data center implementation.

4. Provide a statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made:

At this time, CMS intends to extend EIDM hosting services under the HIM Hosting task order to the point where successful migration from EIDM to the new IDM solution can be completed. Once the migration of EIDM users to the new IDM solution is completed and EIDM has been decommissioned, CMS will no longer have a need for hosting services provided under the HIM hosting task order.

5. State any other facts supporting the justification: N/A.

Approvals:

Program Office Certification. This is to certify that portions of this justification have been developed by the undersigned program office personnel, including supporting information and/or data verifying the Government’s minimum needs, schedule requirements and other rationale for Exceptions to Fair Opportunity, which form the basis for this justification.

Best Value Determination. The CO will perform analysis of the proposed prices including likely comparison of previous prices paid in order to make this determination.

Contracting Officer Certification: This is to certify that the justification for the proposed acquisition has been reviewed and that to the best of my knowledge and belief, the information and/or data provided to support the rationale and recommendation for approval, is accurate and complete.

Head of Contracting Authority (HCA) Approval I hereby confirm that the circumstances described above apply and approve this Justification for Exception(s)

Fair Opportunity.

Melissa Starinsky / Date

Competition Advocate Approval

I hereby confirm that the circumstances described above apply and approve this Justification for Exception(s) to Fair Opportunity.

_______________N/A_______________________ Name / Date

Senior Procurement Executive (SPE) Approval Based on the foregoing justification, I hereby approve the procurement of (state supplies/services being procured) on an other than full and open competition basis pursuant to the authority of (state the full statutory authority and FAR cite and title, consistent with paragraph 4, e.g. 41 U.S.C. 253(c)(1)), as implemented by FAR 6.302-1), subject to the availability of funds, andprovided that the services herein described have otherwise been authorized for acquisition.

_______________N/A________________________ Name / Date