I_04 Sole Source Justification - Redacted.pdf

FSS Sole Source Justification ID.me Credential Service Provider

This document serves as written justification of a sole source acquisition under the authority of Revolutionary Federal Acquisition Regulation Overhaul (RFO) General Services Acquisition Regulation (GSAR) 538.7104-3(b)(1)(ii) – Only one source is capable of providing the products, services, or solution required at the level of quality required because the products, services, or solutions are unique or highly specialized.1

The Internal Revenue Service, Office of Chief Procurement Officer, Treasury Acquisition Division (TAD) intends to award a sole source, single award Blanket Purchase Agreement (BPA) to ID.me through their General Services Administration (GSA) Federal Supply Schedule (FSS). The BPA will have a period of performance of five years (base year + four option years) and an estimated value of .

The Department of the Treasury (Treasury) requires a scalable, secure, and federally compliant Identity and Access Management (IAM) solution delivered as Software-as-a-Service (SaaS) with associated services. The solution must support operational risk management, auditability, and compliance with applicable federal cybersecurity and privacy mandates, including the Privacy Act, Office of Management and Budget (OMB) M-19-17, and Executive Order 14144. Additionally, Treasury requires contractor collaboration to develop, test, and implement new capabilities to deter and prevent fraud.

Requirement

Treasury identified the following security and identity verification requirements as mission-critical minimum thresholds necessary to support secure, compliant, and scalable digital identity verification for external users. These requirements were established through careful analysis of statutory obligations (e.g., the Privacy Act, OMB M-19-17), evolving cyber threat landscapes, and Treasury’s strategic need to protect Personally Identifiable Information (PII) across digital channels. The minimum requirements are as follows:

IAL2 – Ensures verified identity proofing for moderate-risk interactions, such as accessing personal federal records, in accordance with NIST SP 800-63-3.

AAL2 – Guarantees strong authentication through NIST-compliant multi-factor controls.

FedRAMP Certification – Confirms that the cloud platform hosting identity verification meets the federal government’s cybersecurity and continuous monitoring standards.

Full-Service Kantara Certification – Validates that the solution adheres to rigorous user-centric identity trust frameworks, enhancing accountability and data protection.

MFA – Protects systems by requiring multiple, diverse authentication factors, greatly reducing the risk of unauthorized access.

SSO – Streamlines access across Treasury systems, reducing user burden and improving security via centralized session management.

Advanced Fraud Detection – Refers to a system’s ability to go beyond basic identity checks and actively detect, prevent, and respond to sophisticated and evolving fraud threats —

1 The Department of the Treasury issued a class deviation (2025-00019) to implement the change to FAR Part 8.

including those powered by AI and social engineering. These are not just passive controls (like checking if a password is correct) — they involve real-time, behavioral, and contextual analysis to detect malicious intent, even when credentials appear valid.

Biometric with Facial Recognition – Adds a high-assurance identity verification mechanism that improves accuracy and fraud resistance using immutable biometric traits.

National In-Person Proofing Presence – Refers to the availability and geographic reach of physical locations where individuals can verify their identity in person as part of a digital identity proofing process.

Live Proofing Agent – Refers to a real-time identity verification service where a trained proofing agent remotely or in person validates the user identity by checking government issued identification documents (as defined in NIST 800-63 available here:

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63a-4.pdf).

A solution that lacks any of these required components will necessitate significant modifications, certifications, and system integrations. In addition, costs would arise through increased contract pricing, delayed implementation, the need for agency sponsorship and oversight of third-party assessments (e.g., FedRAMP or Kantara), and the operational risk of deploying non-compliant identity verification systems. In addition to cost, selecting a non-compliant solution would introduce unacceptable delays to mission-critical service deployment and expose Treasury to compliance and security risks under OMB M-19-17, Executive Order 14144, FISMA, and the Privacy Act. Failing to implement a fully compliant and secure identity solution will not only expose Treasury to technical and regulatory risk but would also compromise the Department’s ability to reliably serve the public. Inadequate verification capabilities could result in user frustration, access barriers for vulnerable populations, increased fraud risk, and degraded trust in Treasury systems.

In addition to the identity verification capability-as-a-service, Treasury requires specialized services to support, maintain, and enhance the capabilities of the identity verification solution.

Treasury needs contractor support to collaborate with and develop and implement new capabilities that will result in deterring fraud, preventing fraud, drive down costs through optimization, and automating manual authentication processes. The nature of these services is inextricably linked to the original equipment manufacturer’s (OEM’s) proprietary technology, designs, and processes.

The development and implementation of new or enhanced capabilities associated with the identity verification capability-as-a-service relies on proprietary and protected intellectual property that only the OEM is authorized and technically capable of accessing.

Market Research Summary

Treasury Enterprise Systems and Identity Management Office conducted market research between August and December 2024 using the minimum requirements stated above to identify possible tools that could meet Treasury’s need. Market research was conducted through online research and in consultation with industry professionals (Gartner Group), and several product options were identified: 1Kosmos, CLEAR, Exostar, ID.me, and Jakobsen ID.

A comparative analysis of the identified products against the minimum requirements was conducted, and the following summarizes the foundational requirements that were not met (for clarity, only criteria that differentiated among CSPs are depicted; requirements that were uniformly met by all CSPS are omitted from the table):

Minimum Requirement 1Kosmos CLEAR Exostar ID.me Jakobsen ID

FedRAMP Certification (CSP) Yes No No Yes No

Live Proofing Agent No No Yes Yes No

The analysis concluded ID.me was the only solution that satisfied all criteria without requiring modification or the integration of multiple third-party tools.

Market research conducted by TAD found multiple ID.me license resellers available through the FSS program. At the time of writing this justification document, ID.me does not hold an FSS;

however, GSA expects one to be in place by the time this action is expected to be awarded.

Sole Source Justification

In response to Executive Order 14240 – Eliminating Waste and Saving Taxpayer Dollars by Consolidating Procurement, GSA established its OneGov Strategy to prioritize direct relationships with OEMs such as software developers. To follow administration priority to consolidate services and work with OEMs, Treasury will establish a BPA with ID.me for identity verification licenses and fraud detection and prevention services once GSA awards them a FSS under SIN 541519CSP (expected in December 2025). The market research conducted for this requirement resulted in the identification of ID.me as the only solution that satisfied all minimum requirements. While market research indicates a small pool of authorized resellers of ID.me licenses, these resellers are not capable of providing the specialized services required to develop and implement new capabilities in deterring fraud, preventing fraud, and automating the manual authentication process. ID.me, as the OEM of their software, is the only source capable of providing these services as they own the proprietary and protected intellectual property necessary to modify the software with enhancements. No other vendor has the legal rights, access to proprietary technical data, or demonstrated performance capability to provide the necessary services without unacceptable risk to mission success. In addition, procuring directly with ID.me eliminates markup and ensures clear accountability for support and performance.

Signature

I certify the justification is accurate and complete to the best of my knowledge and belief.