IDM_JA 8 Month POP Extension JA.pdf

FEDERAL SUPPLY SCHEDULE LIMITED-SOURCES JUSTIFICATION

Acquisition Title: Title: Identity Management Systems Operations and Maintenance (IDM O&M)

Agency: Centers for Medicare and Medicaid Services (CMS)

Acquisition Year: 2026

Authors: Steven Felsenberg, Benjamin Peter, Jeremy Garvin

1. Description of Action:

Nature

☐ New Requirement

☐ Follow-On Order

☒ Modification of Existing Purchase Order / Contract Number: 47QTCA19D00FF

75FCMC22F0004

Contract Type

☒ Firm-Fixed Price

☐ Time and Materials

☐ Cost Plus Fixed Fee (CPFF)

☐ Term

☐ Completion

☐ Cost Plus Award Fee (CPAF)

☐ Other:

Total Projected Cost / Price: $9,776,543 Funding Source (s): #0787 Identity Management (IDM)

0511: Federally-Facilitated Exchange_Reimb:Mand FY26 $2,242,330

0516: Medicaid Integrity Program_Direct:Mand FY26 $34,211

0511: Federal Administration_Direct:Disc FY26 $ 130,375

0511: Program Operations_Direct:Disc FY26 $2,849,944

0511: Program Operations_Direct:Disc FY26 $2,875,850

0519: Support Contracts_Direct:Mand FY26 $1,242,208

0522: Operational Support_Direct:Mand FY26 $689,162

Name of Proposed Contractor(s): Omni Fed, LLC Street Address: 7528 Rio Grande Way City, State, Zip: Gainesville, VA 20155-1967

2. Description of Supplies or Services:

IDM is a distributed system comprised of multiple software components, including Commercial Off the Shelf (COTS) products, providing enterprise authentication, identity proofing, access management, and application integration services supporting more than 800 CMS applications. Services for O&M of IDM are being acquired under the GSA Multiple Award Schedule (MAS), Contract No. 47QTCA19D00FF, Task Order No.

75FCMC22F0004. O&M tasks include the following:

• Authentication Services: Okta Identity as a Service (IDaaS) with Multi-Factor Authentication

(MFA)

• Identity Proofing: Experian Remote Identity Proofing (RIDP) services

• Infrastructure Management: AWS cloud hosting and CI/CD pipeline operations

• Application Integration: Ongoing onboarding and support for 800+ business applications

• Security Compliance: NIST 800-63, CMS Acceptable Risk Safeguards (ARS), and FISMA requirements

The action contemplated in this Justification is an eight (8) month extension to the task order consisting of 17 two-week sprints to continue Operations and Maintenance development work along with a dedicated scrum team supporting Identity, Credential, and Access Management (ICAM) modernization — a high-priority initiative mapped to CMS strategic goals.

Omni Federal has successfully performed IDM services since May 12, 2022. In the most recent CPARS evaluation, the contractor received ratings of "Very Good" in Quality, Schedule, and Management. The contractor operates within an Agile framework conducting five Program Increments per year. Per FY 2026 Q1– Q3 Monthly Contract Management Status Reports, the contractor has maintained 99.9% system availability throughout the current contract period.

The Contracting Officer considers this extension to be new work, which requires justification and approval in accordance with General Services Administration Acquisition Regulations (GSAR) 538.7104-3.

The requirement number associated with this action is 270157.

3. Authority:

☒: ORDER AGAINST FSS: Authority of the Multiple Award Schedule Program, Title III of the Federal Property and Administrative Services Act of 1949 (41 U.S.C. 251, et seq.); Title 40 U.S.C. 501, Services for Executive Agencies; and Section 803 of the National Defense Authorization Act of 2002 (PL 107-107) and implemented by GSAR 538.7104-3. Mark the applicable exception and for each discuss how the cited authority applies in accordance with GSAR 538.7104-3.

☐ An urgent and compelling need exists, and following the procedures would result in unacceptable delays (GSAR 538.7104-3(b)(i));

☐ Only one source is capable of providing the supplies or services required at the level or quality required because the supplies or services are unique or highly specialized (GSAR 538.7104-3(b)(ii)); or

☒ In the interest of economy and efficiency, the new work is a logical follow-on to an original Federal

Supply Schedule order provided that the original order was placed in accordance with the applicable

Federal Supply Schedule ordering procedures. The original order or BPA must not have been previously issued under sole-source or limited sources procedures (GSAR 538.7104-3(b)(iii)); or

IDM is a Mission Essential application. The current Identity Management System Operations and Maintenance contract (47QTCA19D00FF/75FCMC22F0004) was awarded through fair opportunity under the underlying multiple-award contract vehicle on May 12, 2022. The proposed modification would extend performance for eight months, from September 12, 2026, through May 11, 2027, to permit completion of critical modernization activities, maintain continuity of mission-essential services, and avoid substantial duplication of cost and unacceptable performance risk associated with transitioning the requirement during active implementation efforts.

CMS's Identity Management System (IDM) provides enterprise authentication, identity proofing, access management, and application integration services supporting more than 800 CMS applications and user communities. IDM serves as a foundational cybersecurity and operational capability supporting CMS mission functions, beneficiary access, provider access, contractor access, and enterprise identity services. Any disruption to these services could adversely affect CMS operations, security posture, and user access to critical healthcare systems.

At the time of this request, the contractor is actively executing critical Identity, Credential, and Access Management (ICAM) modernization initiatives, including migration of applications to enterprise identity services, implementation of modern credential service providers, enhancement of authentication capabilities, and reduction of legacy identity management solutions throughout the agency. Approximately ninety applications are in various stages of migration and integration activities, with approximately sixty applications currently in active implementation status.

Transitioning these efforts to a successor contractor before completion would require duplication of transition, onboarding, knowledge-transfer, security-access provisioning, environment validation, and operational certification activities already performed by the incumbent contractor. Based upon CMS experience during the most recent contractor transition, program management assessments, and the complexity of the current environment, CMS estimates a successor contractor would require approximately four months to complete transition activities before achieving operational readiness.

Additionally, IDM operates under an Authority to Operate (ATO) renewed on February 3, 2026, and valid through February 2, 2029. Ongoing security control implementation, continuous monitoring activities, vulnerability remediation efforts, and identity modernization initiatives are currently integrated into the contractor's operational processes. Transitioning responsibility during execution of these activities would introduce avoidable cybersecurity, schedule, and operational risks and could delay implementation of planned security enhancements supporting the system's authorized security posture.

The proposed eight-month extension represents the minimum period necessary to complete critical modernization activities, maintain continuity of mission-essential services, conduct an orderly competitive follow-on acquisition, and execute a planned transition without disrupting ongoing operations. Accordingly, this modification is in the Government's best interest and satisfies the requirements of GSAR 538.7104-3(b)(iii).

☐ An item peculiar to one manufacturer can be a particular brand name, product, or a feature of a product, peculiar to one manufacturer). A brand name item, whether available on one or more schedule contracts, is an item peculiar to one manufacturer. (GSAR 538.7104-4(a));

4. Market Research:

CMS previously conducted a competitive procurement under the GSA Multiple Award Schedule (MAS) for the current IDM task order. CMS is currently completing a competitive procurement for the IDM requirement. This interim action is a short-term logical follow-on modification necessary to maintain continuity of existing services while the competitive procurement is finalized. The planners performed an environmental scan of the marketplace and determined that it was most advantageous to extend this current task order for this short-term extension while the ongoing competitive procurement runs its course.

5. Actions to Increase Competition:

CMS is in the process of conducting a competitive procurement for the next iteration of the required services.

6. Any other facts supporting the justification: N/A

Approvals:

1. Program Office Certification: This is to certify that portions of this justification have been developed by the undersigned program office personnel, including supporting information and/or data verifying the Government’s minimum needs, schedule requirements and other rationale, which form the basis for this Limited Source Justification.

Contracting Officer Representative (COR) / Date

Program/Project Manager (P/PM) / Date

2. Contracting Officer Certification and Best Value Determination:

This is to certify that the justification for the proposed acquisition has been reviewed and that to the best of my knowledge and belief, the information and/or data provided to support the rationale and recommendation for approval is accurate and complete.

By my signature below, after a review of the relevant documents, I have determined that the order subject to this Limited-Sources Justification represents the best value for the Government as set forth in GSAR 538.7102-2(d)(2) and constitutes a fair and reasonable price. The basis for my determination is as follows:

The Contracting Officer has determined the price to be fair and reasonable based on comparison to historical pricing, review of the contractor's current GSA Schedule rates, and anticipated level of effort for the eight-month bridge period. Omni Federal's proposed rates are consistent with and do not exceed the rates established under the original competitively awarded task order (47QTCA19D00FF/75FCMC22F0004), and the contractor has demonstrated continued strong performance as evidenced by "Very Good" CPARS ratings across all evaluated areas.

Jeremy Garvin Contracting Officer

3. CMS Competition Advocate Approval

I hereby confirm the circumstances described above apply and approve the Limited Source Justification.

Lyandra Emmanuel

4. Head of Contracting Activity (HCA) Approval

I hereby confirm the circumstances described above apply and approve the Limited Source Justification.

N/A

Name / Date

5. Office of Small and Disadvantaged Business Utilization

6. OGC Legal Review

7. HHS Competition Advocate Approval

8. Senior Procurement Executive (SPE) Approval Based on the foregoing justification, I hereby confirm the circumstances described above apply and approve the Limited Source Justification.