JA FAR 16.5 - IDme ESD_Redacted.pdf

CONTROL NUMBER VA-25-00093601

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics

Technology Acquisition Center 23 Christopher Way

Eatontown, NJ 07724

2. Description of Action: The proposed action is for a modification to firm-fixed price to Contract NNG15SD27B Order 36C10B23F0118 with V3 Gate, LLC for ID.me Identity and Access Management (IAM) Credential Service Provider (CSP) Software-as-a- Service (SaaS) solution Single Sign On External (SSOe) new user and renewal user identity proofing subscriptions.

3. Description of the Supplies or Services: The ID.me CSP SaaS solution allows Veterans and Government personnel to verify their identity via the required identity proofing subscriptions, as well as authenticating them when they require access to secure VA systems. The current ID.me IAM CSP SaaS solution consists of a yearly Credential Brokers license, with associated services, and new and renewal identity proofing subscriptions. The ID.me CSP SaaS solution’s new and renewal user proofing subscriptions allow an individual to prove their identity and establish credentials as a Veteran, VA employee or approved VA contractor by sharing information unique to and only known by that individual. Additionally, the ID.me CSP solution meets National Institute of Standards and Technology (NIST) 800-63-2 Level of Assurance (LOA) 1, 2, 3 and is accredited at NIST 800-63-3 Identity Assurance Level (IAL) 2 and Authenticator Assurance Level (AAL2 2.2).

Recent Department of Government Efficiency (DOGE) initiatives are to streamline duplicating contract efforts and maximizing efficiencies. A combined effort between Identity, Credential and Access Management (ICAM) and the Enterprise Service Desk (ESD) to drive the use of the automations, efficiencies, and higher security available in the existing ID.me solution for Personal Identity Verification (PIV) exemption’s identity proofing. The ESD Tier One support can conduct PIV exemptions through agents in a manual process in the user’s last four Social Security Number and Date of Birth are verified. This method does not meet the robust secure authentication and identity verification standards for both PIV exemptions and password resets that exist within the ID.me solution. By maximizing the use of the existing ID.me solution VA will reduce redundancies, increase automations and response times, increase security authentications, free ESD agent resources, and achieve an estimated 75% in cost savings, or about $1.4M, for PIV exemptions. ESD is scheduling a phase out of manual agent driven PIV exemptions by the end of September where users requiring identity proofing will be directed by ESD support agents to go through the available ID.me accounts and/or account creation. It is anticipated that this will increase identity proofing requests in ID.me by 151,500, which comes to 60,600 new users and 90,900 renewal users respectively.

The Period of performance (PoP) is from date of modification through April 30, 2026.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in Section 8 of this document it was determined the ID.me CSP SaaS solution can meet all of VA’s functional requirements and will provide cost-savings far outpacing other options. The ID.me CSP SaaS solution can meet all VA’s interoperability requirements within the existing VA SSOe technical stack, VA.gov platform, VA Lighthouse Application Programming Interface (API), and MHV platform. The ID.me software code can interoperate with the IAM SSOe, VA Lighthouse API, and VA.gov configurations to differentiate user identity proofing levels which correlate to application and service availability and accessibility based on the user’s credentials.

ID.me, as a software solution, specifically integrates with these platforms to permit the establishment of new ID.me credentials, specifically at the IAL2 level and higher supporting the existing applications above. Further, the reconfiguration of the VA applications listed above which utilize ID.me, and replacement of the existing ID.me solution itself, would require enormous duplication of effort, delivery delays and duplicated costs that would not be recovered through competition. Specifically, VA requires duplicative support to conduct extensive planning activities to determine the necessary configurations for the new solution, reconfigure network settings and security configurations accordingly and develop new configurations of all connection points for identity proofing. Further, as the applications utilizing ID.me for authentication have highly varied technical stacks and architectures, each would require VA to engineer, secure and build a new working solution, conduct functional, regression and security testing and require a significant migration of existing users. These efforts are anticipated to require two years of redundant labor and activities to recreate what has already been built within the VA network, as well as a significant level of in-person support for Veterans with cognitive disorders, low vision or physical disabilities who would not otherwise be able to access their needed benefits. This comes with duplicated costs of at least $15,000,000.00 that would not be recovered through competition. This estimate is based on an analysis of the previous cost and level of effort associated with integrating the current ID.me solution with the aforementioned applications.

The ID.me CSP solution is based on proprietary software source code. Further, only ID.me and its resellers have access to ID.me’s proprietary code base to provide necessary support for VA’s existing ID.me based solution, support the interoperability requirements of any increases in users or new applications and provide associated configuration and professional services. Access to this code is necessary to ensure all services are properly configured. Without the ID.me CSP, VA would not be able to securely scale to meet the increased usage growth and new applications/websites being migrated to the existing ID.me CSP solution over the course of the PoP.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in the market research section of this document. This effort did not yield any additional sources that could meet the Government’s requirements. There is no competition anticipated for this acquisition. In accordance with FAR 5.301 and 16.505(b)(2)(ii)(D), the award notice for this action will be synopsized on the Contract Opportunities Page and the justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: Government technical experts have conducted continuous market research to monitor the marketplace for technological changes and new solutions. The Government technical experts conducted extensive market research including reviews of product websites, internet searches, direct communications, and other specific product research with most recent market research efforts conducted in June 2025.

Direct communication was conducted with the ESD Tier One provider General Dynamics Information Technology, Inc. (GDIT) and Login.gov representatives to ascertain the availability of PIV verifications and compatibility with the ID.me solution.

While both provide means of identity proofing, neither of the reviewed alternatives were able to meet the technical or interoperability requirements discussed in Section 5 of this justification. Based on this market research, it was determined that no other solution can interoperate with the ID.me solution, without significant duplication of effort and costs as described in Section 5 of this justification. Additionally, it was determined that none of these products could interoperate or provide maintenance for the existing ID.me CSP SaaS solution due to ID.me’s proprietary source code. As such, the market research confirmed that any other solution would require a complete overhaul of the existing IAM ID.me solution costing millions in duplicated costs and delays.

9. Other Facts: N/A.

10. Technical/Requirements Certification I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

11. Fair and Reasonable Cost Determination I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on anticipated competition. Additionally, NASA SEWP V GWAC has already determined the prices on contract to be fair and reasonable.

Finally, the successful quote will be compared to the Independent Government Cost Estimate.

12. Contracting Officer Certification/Approval I certify that this justification is accurate and complete to the best of my knowledge and belief. This contract action exceeds the simplified acquisition threshold, but does not exceed $750,000, therefore, the certification required by FAR 16.505(b)(2)(ii)(A) serves as the Contracting Officer’s approval.