ITSSS_-_SSJ_Redacted_1.pdf

Page 2 of

3. Description of the supplies or services required to meet the agency�s needs (including the estimated value).

a. Project title.

NHGRI IT Systems Security Services (ITSSS)

b. Project description.

This contract action is for IT Systems Security Services and requires the contractor to provide manpower and expertise to assist the NHGRI ISSO in the form of IT security documentation services support, security program management support, comprehensive Security Assessment and Authorization (SA&A) analysis, preparation and management support, incident response support, continuous diagnostics and mitigation (CDM) support, and other related IT security services.

Requirement type.

Research & development (R&D) R & D support services Support services (non-R&D) Supplies/equipment Information technology (IT) Construction Architect-engineer (A & E) services Design-build Other (specify):

Type of action.

New requirement Follow-on to the same services provided under Contract

GS-35F-274DA / 75N92021F00134

Other (specify):

Proposed contract/order type.

Firm-fixed-price

Page 3 of

Other fixed-price (specify, e.g., fixed-price award-fee, fixed-price incentive-fee):

Cost-plus-fixed-fee Other cost reimbursement (specify, e.g., cost-plus-award-fee, cost-plus-incentive-fee):

Time and materials Indefinite delivery (specify whether indefinite quantity, definite quantity, or requirements):

Other (specify):

Acquisition identification number. The Contracting Officer will identify a new solicitation and award number.

Total estimated dollar value and performance/delivery period. The Independent Government Cost Estimate (IGCE) is for a period of performance of 12 months ;

4. Authority and supporting rationale (see GSAR 538.7104-3(b)(1)) and, if applicable, a demonstration of the proposed contractor�s unique qualifications to provide the required supply or service, Identification of the statutory authority permitting other than full and open competition.

a. Acquisition Authority

This acquisition is conducted under the authority of the Multiple Award Schedule Program. Consideration of schedule contractors will be restricted to fewer than the number required by GSAR 538.7103-3, as follows:

GSAR 538.7104-3(b)(i), need is of such unusual urgency that following the procedures would result in unacceptable delays in fulfilling that need.

GSAR 538.7104-3(b)(ii), only one source is capable of providing the products, services, or solution required at the level of quality required because the products, services, or solutions are unique or highly specialized.

GSAR 538.7104-3(b)(iii), The order should be issued on a sole source basis in the interest of economy and efficiency because it is a logical follow-on to an FSS order already issued on a competitive basis.

The 12-month s being sought to provide NHGRI leadership the time required to decide right-sizing the ITSSS based on the IT consolidation at NIH level. NIH Leadership is pursuing IT consolidation in support of HHS� announced major restructuring on March 27, 2025, in accordance with President Trump's Feb. 11, 2025, Executive Order (EO), "Implementing the President's 'Department of Government Efficiency' Workforce Optimization Initiative". The plan

Page 4 of aims to save $1.8 billion annually by reducing the workforce from 82,000 to 62,000, and centralizing IT, HR, and procurement functions. Careful consideration of the implementation of this EO is underway, and a Tiger Team has been formed to address all issues and impacts. This is currently a top priority but requires careful planning, hence, the necessity for the requested

A delay or lapse in service would significantly impact NHGRI ISSO�s ability to participate in NIH InfoSec initiatives like ICAM modernization, Intune adoption, NIH Enterprise Logging Warehouse, etc., meant to enhance the security of NIH systems and data. Other activities at risk of being delayed or suspended include Continuous Diagnostics and Mitigation (CDM)\, Incident Response and Recovery (IRR), and Security Assessment and Authorization (SA&A). The SA&A is the process that produces Security Impact Analyses (SIAs) and the Authorization to Operate (ATO) for scientific systems and a delay or lapse in this service would negatively impact the NHGRI mission as systems could not be launched in production without them.

NIH�s IT Leadership has been building an IT roadmap that will consolidate some NIH ICOs� IT Security services under CIT and OCIO. Leadership is actively strategizing the final NIH IT environment, and this consideration will directly impact the NHGRI requirement. Pending business case reviews, senior leadership is expected to finalize its IT consolidation strategy by the end of the Summer 2026. Depending on the course of action selected by leadership, there will be a short window of time for planning for potential recompeting this contract before the end of this .

Once a strategy is selected, it is estimated that 4 months will be required to conduct acquisition planning, recompete, and select the contractor for the NHGRI ITSSS requirement. A transition period of 2 months must also be considered to allow system knowledge transfer, access provisioning, and process integration between the current contractor and the new one. A rushed or poor transition could disrupt operations and introduce security risks, which would have an impact on the NHGRI mission. There is also a risk that Leadership�s IT Consolidation strategy might be delayed into the fall and then the NHGRI ITSSS recompete timeframe would be even shorter.

Page 5 of

This acquisition is conducted under the authority of the Multiple Award Schedule Program. Consideration of schedule contractors will be restricted only to the item peculiar to one manufacturer as provided in GSAR 538.7104-4 Items peculiar to one manufacturer.

b. Demonstration that the proposed contractor(s) unique qualifications or the nature of the acquisition requires use of the authority cited.

Name and address of the proposed contractor(s).

Richard S. Carson & Associates, Inc.

Nature of the acquisition or proposed unique qualifications of the contractor(s).

GSAR 538.7104-3(b)(v), law expressly authorizes or requires that the purchase be made from a specified source.

GSAR 538.7104-3(b)(v), Page 6 of

Determination by the Contracting Officer that the order represents a fair and reasonable price consistent with GSAR 538.7102-2(d)(2) and 538.7104-2(a)(3).

Description of the market research conducted among schedule holders and the results, or a statement of the reasons market research was not conducted.

NHGRI conducted market research, appropriate to the circumstances of issuing a sole sou

7. Any other facts supporting the use of other than full and open competition.

8. Statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the restricted consideration before any subsequent acquisition for the supplies or services is made.

a. Removal of barriers to competition.

For reasons stated above, currently, only Richard S. Carson & Associates, Inc.

can provide a continued, uninterrupted service at this time for this contract. Upon conclusion of the NIH�s IT Leadership consolidation planning, estimated by the end of Summer 2026, any future need for these services, beyond this contract, would be procured using competitive acquisition procedures. Future requirements for IT Systems Security Services will be competitively re-competed under open market or GSA procedures based on the results of the upcoming market research, giving due consideration to small business capabilities. A new award based on this competition is anticipated prior to the expiration of the anticipated contract, on April 12, 2027.

b. Listing of sources, if any, that expressed an interest, in writing, in the acquisition.

No sources expressed an interest in this continued service.

Page of