JA_BetaSam.pdf

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

Acquisition Title: HHS HSPD-12 ICAM Gap Support

Agency: PSC

PSC Divisions: ASA - Assistant Secretary for Administration

Acquisition Year (FY): 2021

Author: Joseph Gonzalez, and Marcia Levin

2. Description of Action:

Nature: New Requirement Follow-on Order

Modification to Existing Delivery/Task Order/Contract Number:

Order Against: Multiple Award ID/IQ Contract Number: HHSN316201200018W

Pricing: Firm-Fixed Price Time & Materials Cost Type

Funds: OMA Other Funds: Service & Supply Fund

3. Description of Applicable Contract Provisions:

This is a noncommercial order off an established GWAC with time-and-materials and fixed-price orders.

4. Description of Supplies or Services:

The estimated value of the proposed action, including all options, is: $ $63,200,850.53

This contract is to provide uninterrupted, continuous support for HHS's end-to-end solution to comply with Federal Identity, Credential and Access Management (FICAM) requirements along with ongoing integration activities and security updates to complete the system’s FISMA authority-to-operate process.

The IAM@HHS Program provides HHS with comprehensive identity and access management solutions in compliance with the Homeland Security Presidential Directive 12 (HSPD-12), which outlines a Government-wide standard for secure and reliable forms of identification. IAM@HHS also combines the Office of Management and Budget, Electronic Authentication, Federal Information Processing Standards 201-2, and Federal Identity, Credentialing and Access Management (FICAM) requirements to create a large-scale, collaborative program that provides strategic direction and information for all initiatives related to identity and access management at HHS. Specific benefits of the standardized HSPD-12 credentials include secure access to Federal facilities and disaster response sites and multi-factor authentication, digital signature, and encryption capabilities.

The following services are currently provided by Deloitte and require careful evaluation by the Government in conjunction with the current contractor before transition to another contractor can occur:

• Public Key Infrastructure (PKI) support primarily for certificates encoded on HSPD-12 and related smart cards;

• Smart card management system (supports HSPD-12 identity smartcards);

• Enrollment and issuance station (support the badge issuance process); development and operational support of the identity management service and Simplified Sign On service;

• Security services supporting the C&A process; and infrastructure support for systems;

• Program management consulting, IV&V, subject matter expert, capital planning, and enterprise architecture support;

• Program management consulting, outreach and communications support Software acquisition and maintenance support for both Sun and Oracle products;

• Public Key Infrastructure (PKI) Certificate Authority (CA).

The period of performance includes a six (6) month base period and two 12-month option periods.

5. Authority and Rationale:

The Contracting Officer shall give every awardee a fair opportunity to be considered for a delivery/task order exceeding the micro purchase threshold unless one of the following statutory exceptions applies. FAR 16.505(b)(2). Mark the applicable exception:

The agency need for the supplies or services is so urgent that providing a fair opportunity would result in unacceptable delays [FAR 16.505(b)(2)(i)(A)];

Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services are unique or highly specialized [FAR 16.505(b)(2)(i)(B)];

Deloitte developed and owns the Smart Card Management System (SCMS) that provides HSPD-12-compliant credentials and ICAM services throughout HHS, it is a managed service that HHS elected to use in 2009 with HHS ownership solely in the actual data and ancillary integration built transaction code. Deloitte is the sole provider with engineering access to this intellectual property and the proprietary knowledge to the inner workings of this system, and how it can be upgraded and modified without catastrophic cyber and physical vulnerability to the HHS mission. Transition of information stored within the current solution to another will require extensive planning, mapping, and testing, to preserve management of over 180,000 issued cards, over 350,000 identities, over 90 integrated applications and specialized configurations made with internal and external business partners for compliance, for example the Grants Management Quality Service Management Office (QSMO).

The HHS HSPD-12 enterprise architecture federates the OS headquarters and OPDIVs' physical and logical access provisioning systems, generating the mandated unique identifier required to issue signing and authentication certificates to the HHS issued PIV Card, an old mandate enforced with emphasis by the most recent OMB M-19-17 memorandum issuance.

Without PIV cards, and authentication layers, absolutely no electronic information exchange could be executed without substantial risk of exposure to cyber attacks and a breach of proprietary and privacy protected identity and health information, the basic core of HHS.

Failure to continue Deloitte support with this gap contract would endanger the assets, resources, healthcare, and pandemic response activities that make up the HHS mission and business partners. Most specifically, if this is not awarded to the incumbent, current remediation to the HHS-wide architecture prevents corrective action in response to the latest SolarWinds hack among federal agencies most visible to the White House and the Cybersecurity and Infrastructure Security Agency and appropriate identity mechanisms will not be available for a potential nationwide vaccine credential project that supports the COVID-19 efforts for HHS.

The incumbent's current smartcard management system, as a managed service, is approved by GSA for compliant Federal Identity, Credential and Access Management Services, which is required by NIST before such a framework can be put in place due to the amount of PII information that these systems process. Accordingly, the architecture is uniquely tailored to work in the HHS HSPD-12 environment so that the data these systems handle is transacted in the most secure and efficient manner to retain compliance and the public's trust.

Without Deloitte’s continued support, all HHS Identities and certificate authentication mechanisms for HHS would cease operation.

Every HHS-related that website that is utilized by internal and external consumers would become inaccessible, literally HHS.gov would become a black screen to the public; PIV-enabled digital signatures of documents, and encrypted emails capabilities would also cease.

In short, HHS would become completely non-operational.

If a new integrator were to be selected, they would have to go through extensive requirements gathering, development, and testing to try and connect their solution with the many systems Deloitte has already integrated HHS-wide.

The order must be issued on a sole-source basis in the interest of economy and efficiency because it is a logical follow-on to an order already issued under the contract, provided that all awardees were given a fair opportunity to be considered for the original order [FAR 16.505(b)(2)(i)(C)];

It is necessary to place the order to satisfy a minimum guarantee [FAR 16.505(b)(2)(i)(D)]; or

A statute expressly authorizes or requires that the purchase be made from a specified source. [FAR 16.505(b)(2)(i)(E)].

6. Agency Actions to Take or Remove Barriers That Led to Fair Opportunity Exception (If applicable):

Describe the actions, if any, the agency may take to remove or overcome any barriers that led to the restricted consideration prior to any subsequent acquisition for the supplies of services is made. If no such actions have been taken, explain why.

A current fully competitive solicitation for the next-generation FICAM solution is still in process, with an estimated award date of October 1, 2022. For that reason, the period of performance for this sole-source contract includes a six-month base and a 12-month option period, and an additional 12-month option period for possible transition time.

The length of this contract action is in anticipation of the many starts-and-stops that PSC/ISBS has encountered in trying to stand up the currently delayed re-compete efforts. These include the potential need for standing up a new re-compete effort, and the ability to gather, and evaluate additional technical requirements that have developed for the HSPD-12 program due to recent legislation and change in direction in the HHS IT program as a whole.

To emphasize the point, if this gap contract is not awarded by April 1, 2021, there will be potentially dire circumstances to HHS. Internal users may not be able to access mission critical platforms such as ITAS, and UFMS. Furthermore, external users may not be able to provided updated information on HHS-supported grants, or health related data. Adding to that users could lose the ability to digitally sign documents and send encrypted messages, both items that have been raised to extreme importance in a full-telework environment.

7. Fair and Reasonable Price/Cost Determination: I hereby determine that the anticipated price/cost for this contract action will be fair and reasonable.

The IGCE has been prepared using the current contract methodology, negotiated under the NITAAC CIO SP3 IDIQ. The contracting officer will ensure that the price is fair and reasonable. Certified cost and pricing data is required, if applicable. The price proposal must address labor estimates, material costs and material indirect costs. The fully loaded hourly rates established at the NITAAC/CIO-SP3 contract have already been determined fair and reasonable, and price analysis will be conducted to ensure the quoted rates are consistent with those on Deloitte's CIO-SP3 contract. Further, the price analysis will consider the level of effort and labor mix to ensure it is appropriate for the work to be performed. Any proposed material costs (e.g., direct materials, subcontracts for supplies and incidental services for which there is not a labor category specified in the contract, and other direct costs such as incidental services for which there is not a labor category in the contract, travel, computer usage charges, etc.) must include an explanation of each material element, detailing the rationale used in developing the estimate, as well as supporting documentation. The Government will evaluate material costs to determine they are necessary for the work to be performed, as well as perform a cost analysis of any proposed material costs to determine the reasonableness of the proposed cost. Material Indirect Costs shall be proposed in accordance with the incumbent’s current negotiated indirect rate agreement.

Signature: Date: 3/13/2021

Name: Victoria Estabrook

Title: Contracting Officer

8. Any other facts supporting the justification:

OMB M-19-16 and OMB M-19-17 are two of the most recent legislative actions that without Deloitte’s continued support in this enterprise-wide federated ecosystem, every HHS-related website to all internal and external consumers will become inaccessible with the most topical impact being to OPDIV and OS CARES ACT delivery for COVID-19 relief and Operation Warp Speed access. In a very recently released article on January 11, 2021, from the HHS Press Office itself, "...OMB today formally designated ...HHS as a Quality Service Management Office for grants..." In FY20, COVID-19 response increased grant funding across the government from $750 billion to over $200 trillion for which HHS Grants QSMO has three key roles as Marketplace Coordinator, Solutions Manager and Community Builder. HHS Grants QSMO has mandatory authentication timelines prescribed by OMB and the systems and interfaces that power HSPD-12 badging, the Access Management System for SSO, and provisioning secure logical and physical access to credential holders across HHS is administered and maintained by Deloitte.

If Deloitte is not awarded this contract, then a new contractor must be able to provide immediate service to the HHS community by having the existing infrastructure in place to be able to seamlessly integrate with the HHS SCMS. This would include the full incorporation of the hundreds of enrollment and issuance machines, the connections necessary to facilitate smartcard authentication to the HHS network, the AMS and XMS sign-on systems, and the HHS email environment to name the most prominent. As of right now, no

Digitally signed by Victoria W. Estabrook -S DN: c=US, o=U.S. Government, ou=HHS, ou=PSC, ou=People, 0.9.2342.19200300.100.1.1=2000119096, cn=Victoria W. Estabrook -S Date: 2021.03.13 15:28:58 -05'00' other contractor has this capability, and it has been estimated that such a hand-off to a new contractor could take approximately two years.

9. Technical / Requirements Certification: By my signature below, I certify that the supporting data under my review which is included in this Justification for an Exception to Fair Opportunity is accurate and complete.

Program Manager

Name: Marcia Levin

Position Title: Director, ISBS and HSPD-12 Program Manager

Email address: marcia.levin@psc.hhs.gov

Phone: (301) 443-0778

Program Manager Supervisor (or one level above Program Manager)

Name: Michael Saunders

Position Title: Director, RLO

Email address: michael.saunders@psc.hhs.gov

Signature:

Date: Feb 25, 2021

10. Contracting Officer's Approval (Required for proposed contract not to exceed $700,000 (value calculated including all options)): I hereby certify that this justification is accurate and complete to the best of my knowledge. I approve this sole source justification subject to availability of funds, and provided that the services and supplies herein described have otherwise been authorized for acquisition.

Name: Victoria Estabrook Phone: (301) 492-4729

Signature: Date: 3/13/2021

11. Legal Review:

12. OPDIV Competition Advocate Approval (Required for proposed contract over $700,000 but not exceeding $13.5 million value calculated including all options)):

I have reviewed this justification and find that it adequately supports an exception to fair opportunity.

Name: Phone:

Signature: Date:

13. Office of Small and Disadvantaged Business Utilization:

I have reviewed this justification and find that it adequately supports an exception to fair opportunity.

Name: Phone:

Michael E. Saunders -S

2021.02.25 15:25:39 -05'00'

Digitally signed by Victoria W. Estabrook -S DN: c=US, o=U.S. Government, ou=HHS, ou=PSC, ou=People, 0.9.2342.19200300.100.1.1=2000119096, cn=Victoria W. Estabrook -S Date: 2021.03.13 16:21:39 -05'00'

Signature: Date:

14. OPDIV HCA Approval (Required for proposed contract over $13.5 million but not exceeding $68 million value calculated including all options)):

Name: Susan Cortes-Shrank Phone: (301) 492-4434

Signature: Date: 03/15/2021

15. Department Competition Advocate:

Concur: Non-Concur:

Name: Phone:

Signature: Date:

Susan Cortes-shrank -S Digitally signed by Susan Cortes-shrank -S Date: 2021.03.15 09:48:41 -04'00'

(The below approval paragraph is required if the cumulative contract value, including all options, exceeds $68 million.)

16. HHS Senior Procurement Executive (SPE) Approval:

Based on the foregoing justification, I hereby approve the procurement of stated supplies/services being procured on the exception to the fair opportunity basis pursuant to the authority of paragraph 5, 41 U.S.C. 4101, as implemented by FAR 16.501-2.

State supplies/services being procured:

State the full statutory authority and FAR cite and title, consistent with paragraph 4, e.g. 41 U.S.C. 3304:

Name: Phone:

Signature: Date: