ITOMSS JEFO_Redacted.pdf

Justification for Exception to Fair Opportunity Exceeding the Simplified Acquisition Threshold pursuant to

Revolutionary FAR Overhaul (RFO) 16.507-6(b)(2)

JEFO No. FY26-00026 - 1 -

JEFO No.: FY26-0026 PR Number: PCCA-26-00007

1. Agency and Contracting Activity.

The Department of Homeland Security (DHS), Cybersecurity and Infrastructure Security Agency (CISA), Chief of Contracting Office (COCO) prepared this justification for an exception to fair opportunity.

2. Nature and/or description of the action being approved.

This Justification for an Exception to Fair Opportunity is prepared in accordance with Federal Acquisition Regulation (FAR) 16.507-6(d)(2), FAR Class Deviation 26-04, Revision 1 for FAR Part 16.0F

Pursuant to RFO FAR 16.507-6(b)(2), only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

3. A description of the supplies or services required to meet the agency’s need (including the estimated value).

In support of its mission, the Cybersecurity and Infrastructure Security Agency (CISA) Office of Chief Information Officer (OCIO) requires continued Information Technology Operations and Maintenance Support Services (ITOMSS) to provide effective operational and management solutions to facilitate the sustainability and administration of the Information Technology (IT) systems in support of the CISA mission requirements. ITOMSS increases the productivity of end users, engineers, mission support personnel, administrative users, and all offices in support of CISA's overall mission by quickly and efficiently delivering reliable, innovative, and secure IT services.

The current contract for support ends on February 5, 2026. CISA/COCO intends to award a task order to CACI NSS, LLC (CACI) under the mandatory DHS SSV General Services Administration (GSA) Alliant 2 Governmentwide Acquisition Contract (GWAC) contract number 47QTCK18D0009 without considering other contract holders pursuant to RFO FAR 16.507-6(b)(2).

The Contractor will provide continued support to CISA OCIO’s Service Support instance(s) to ensure services are integrated, well defined, documented, standardized, repeatable, accurate, and

1 FAR Class Deviation 26-04, Revision 1 for FAR Part 16 was issued as part of the Revolutionary FAR Overhaul (RFO), which was implemented in response to Executive Order 14275, Restoring Common Sense to Federal Procurement, signed April 15, 2025. Any subsequent citations to FAR Part 16 in this document will be cited as “RFO FAR” for brevity, and are referring specifically to FAR Class Deviation 26-04, Revision 1 for FAR Part 16.

Revolutionary FAR Overhaul (RFO) 16.507-6(b)(2)

JEFO No. FY26-00026 - 2 -timely. Tasks include Program Management Support Services, Enterprise IT O&M Support, Audio Visual and Asset Management End User Support, CISA Supplemental Application Development Support, Stakeholder Requirements Management (SRM) Business Process Automation Support, and Video Teleconferencing (VTC) support. The period of performance will be February 6, 2026 through July 16, 2026. The total estimated value is .

4. Identify the exception to fair opportunity and supporting rationale, including a demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the exception cited.

In accordance with RFO FAR 16.507-6(b)(2), only CACI is capable of providing the highly specialized services required for the ITOMSS. The ITOMSS are essential for CISA's mission to support and protect services that impact public health, safety, and security. Should these services not be continued, CISA’s operational capabilities will be impacted, rendering the agency unable to meet DHS mission-critical requirements, including the prevention of future attacks against the United States and our allies; responding decisively to natural and man-made disasters; and ensuring a safe, secure, and prosperous Homeland. ITOMSS directly supports the operations and maintenance of essential cybersecurity systems that defend CISA and provide monitoring and cybersecurity services to critical sectors such as energy, healthcare, transportation, and financial services. These sectors are vital to the safety of human life and the protection of property.

Disruptions to these operations could result in catastrophic consequences, including loss of life, economic instability, and national security risks. This work, currently provided by CACI across DHS, is highly specialized for CISA’s ongoing IT operational transition and is foundational to the Government’s ability to prevent, detect, respond to, and recover from cybersecurity incidents that could otherwise compromise the integrity and availability of critical infrastructure. At this time, there are no other contract holders on the mandatory DHS SSV except CACI that are capable of supporting the highly specialized DHS CISA specific ITOMSS and CISA’s unique transition activities within the required time schedule for this requirement.

CACI provides seamless ITOMSS. Transition to another contractor for this short-term requirement would negatively impact the following critical operational capabilities and activities:

• Mission-critical Tier One, Two, and Three technical support for CISA's systems that provide services to excepted and exempt functions.

• CISA Identity Management Services which underpins CISANet's login and Single-Sign-On capabilities for end user devices and applications.

• System administration of CISA's systems authorized to continue operations, even during a lapse in appropriations.

• Account creation and modification across CISA's internal and external systems.

• Collaboration tool management and maintenance.

• Software packaging, distribution, and management, including critical patch management functions of CISA's information technology systems.

Revolutionary FAR Overhaul (RFO) 16.507-6(b)(2)

JEFO No. FY26-00026 - 3 -

If another contractor were to be utilized at this time, all activities and capabilities would cease immediately, and all information technology end-user support and system administration would come to a complete halt for at least 90 days to facilitate transition. This is due to the highly specialized nature of the services being provided. This would severely degrade the Government’s ability to respond to cyber threats in real-time, increasing the risk of prolonged outages, data breaches, and operational failures in sectors where timely response is essential to saving lives and protecting property. It would also impede CISA’s ability to prevent millions of dollars of potential losses through cybercrime investigations, impacting CISA’s ability to conduct cyber and cybersecurity investigations, and to provide cybersecurity assessments and technical assistance to Government agencies as well as some public and private organizations.

5. Determination by the Contracting Officer that the anticipated cost to the Government will be fair and reasonable.

Pursuant to RFO FAR 16.506(f), if the service prices were not established at the IDIQ level, then the Contracting Officer must establish prices for the order using the policies and methods in RFO FAR subpart 15.4. The Contracting Officer anticipates a fair and reasonable price will be achieved based on utilization of the rates established by the GSA Alliant 2 GWAC, consideration of historical pricing, and comparison of the labor mix and level of effort with the Independent Government Cost Estimate (IGCE).

6. Any other facts supporting the justification.

Enterprise ITOMSS has been historically provided by CACI via the Desktop Support Services (DSS) 2.0 BPA DHS put in place for headquarters and internal agencies to utilize for network support. The DSS 2.0 BPA has expired and the DSS 3.0 BPA is currently under protest. The protest is not expected to be resolved before the current ITOMSS task order expires on February 5, 2026, and all possibilities to extend the current order have been exhausted. The Government intends to eventually issue a task order on the DHS Enterprise DSS 3.0 BPA once the BPA becomes available to DHS and its components. Award of a short-term task order to CACI will allow continued ITOMSS support while the DHS DSS 3.0 BPA protest is resolved and will prevent the cessation of these highly specialized services in support of mission critical activities.

7. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made.

CISA continues to monitor the commercial marketplace. The new DHS DSS 3.0 BPA was competed and awarded on September 25, 2025; however, it was timely protested post-award and cannot be used until the protest is resolved. CACI is the only capable vendor that can currently provide the highly specialized ITOMSS. CISA intends to post the approved justification on www.sam.gov pursuant to RFO FAR 16.507-6(f)(1).