JA Minimum Award- SPRUCE 0005- ACE- Redacted final.pdf

Accelerate Cybersecurity Excellence (ACE) Control Number VA-25-00009832

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: This proposed action is for a firm-fixed-price Task Order that will be issued under the Secure, Performant, Reliable, and User-Centered Experiences (SPRUCE), indefinite delivery, indefinite quantity (IDIQ) Contract Number 36C10B25D0004 with Rise8, Inc. for support for the Office of the Chief Technology Officer (OCTO) in maintaining the current VA.gov Authority to Operate (ATO) and conducting discovery for, and beginning the implementation of, a continuous Authority to Operate (cATO).

3. Description of the Supplies or Services: VA Office of Information & Technology, OCTO has a requirement for a team of experts to improve the security posture of VA.gov and to empower VA’s product development teams with modern security solutions and industry best practices. Since its foundation, OCTO has been at the vanguard of modernizing Government delivery of responsive, accessible, human-centered digital experiences that serve and empower Veterans. OCTO has significantly increased its services and applications, which has led to higher cybersecurity risks. As the cybersecurity threat landscape evolves, OCTO continues to modernize its technology, processes, and policies to protect the security and privacy of Veterans' data. Scaling our cybersecurity capabilities to support OCTO operations and modernization is crucial to mitigating these risks.

The Contractor shall be responsible for ensuring that OCTO’s ATOs are accurate, modern, up-to-date, and robust. Additionally, the Contractor will collaborate with representatives from other teams by providing necessary integrated planning, documentation, diagrams, and other support as required.

The Contractor support shall focus on determining the level of maturity in the current security posture, performing a gap analysis and assessment of platforms and products within the current ATO, and assigning priority level and remediation steps for the identified problem areas. All initiatives and tasks should be approached through a lens of potentially achieving a cATO for VA.gov at some future date. Work may also include enhancing incident response preparedness, providing cybersecurity training, and implementing modern security solutions for VA.gov Platform. Specifically, the Contractor shall conduct a six-month discovery phase (Base Period) on transforming the VA.gov Platform to identify gaps and opportunities for potentially evolving the current traditional ATO to cATO. This work will be foundational for understanding the gaps and improvements needed to support achieving a future cATO. This will be followed by one 12-month option period to begin the implementation and reengineering of the VA.gov platform to support a cATO posture, to make the process operational, and finally to sustain and maintain the solution until the end of the PoP. The Order will also include one optional task for additional iterations.

Additionally, for both the Base Period and Option Period, the Contractor shall be responsible for understanding the current ATOs for OCTO products and determine if they are accurate, up-to-date, and robust. The Contractor’s support will require collaboration with representatives from other teams to ensure successful integrated planning (including agile ceremonies if necessary), documentation, diagrams, and other necessary support are provided.

The Period of Performance for this effort shall be a 6-month base period, with one 12-month option period. The total estimated price of the proposed action is inclusive of all options.

4. Statutory Authority: The statutory authority permitting an exception to fair opportunity is Section 41 U.S.C. 4106(c)(4) as implemented by the Federal Acquisition Regulation (FAR) Subpart 16.505(b)(2)(i)(D), entitled "It is necessary to place an order to satisfy a minimum guarantee."

5. Rationale Supporting Use of Authority Cited Above: The proposed source for this effort is Rise8, Inc., 601 S Harbour Island Blvd, Ste 109, Tampa, FL 33602.

Solicitation 36C10B24R0005 was issued competitively, utilizing the SAM.gov website on November 29, 2023. The solicitation closing date was December 21, 2023.As a result of the competition, ten (10) awards were made in accordance with the criteria set forth in the Basis for Award of the solicitation, on October 1, 2024. . Included in the solicitation was FAR clause 52.216-22, Indefinite Quantity, which stated the minimum guaranteed award for each resultant contract award under the SPRUCE contract. This order is being issued to Rise8 to satisfy the minimum guarantee. Rise8 has been determined by the Government's technical experts to provide all aforementioned required services.

The determination included a review of the selected awardee's technical capabilities.

An option period is included in this effort due to complexity of the requirement and the multiple phases needed to develop and implement a cATO for a system as mission critical and complex as VA.gov. It is essential that the contract provide continuity between the discovery, development, and implement phases of this project to ensure it is implemented and supported in production successfully.

A minimum guaranteed order under an IDIQ contract must be placed during the same fiscal year as the IDIQ is awarded to avoid a bona fide need violation and until it is placed, there is no enforceable contract. Once the IDIQ contract has been awarded, an obligation is created. Given the time remaining in the fiscal year, it is not possible to compete the orders with an expectation that each remaining SPRUCE contractor not meeting the minimum will be awarded one.

6. Efforts to Obtain Competition: In accordance with FAR 5.301 and 16.505(b)(2)(ii)(D), this action will be synopsized at award on SAM.gov and the justification will be made publicly available within 14 days after the award. In addition, this justification will be posted with the solicitation to notify all the SPRUCE vendors.

7. Actions to Increase Competition: There is no competition anticipated for this action as it is being issued to meet the mandatory minimum guaranteed value for this IDIQ contract. It is expected that any future requirements will be awarded on a competitive basis.

8. Market Research: . VA attempted to satisfy the minimum guarantees through competitive requirements under Spruce throughout the FY. However with 10 awardees under Spruce, not all minimum guarantees have been met as a result of the competitive process. As we enter the 4th quarter of the FY we are awarding this action under the authority stated above to avoid a bona fide need violation as previously discussed. Market research was conducted by posting a Request for Information (RFI) on the Acquisition Task Order Management System (ATOMS). Rise 8, Inc. responded to the RFI and the Government’s technical representatives have deemed them capable of meeting the requirements of the Performance Work Statement.

9. Other Facts: None.

Accelerate Cybersecurity Excellence (ACE) CONTROL NUMBER VA-25-00009832

10.Technical/Requirements Certification

I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

11. Fair and Reasonable Cost Determination

I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on an analysis of historical prices paid by the Government for the same services. The contracting officer will use existing CEDAR labor rates, which have previously been determined to be fair and reasonable, to verify Agile Six’s proposed price is fair and reasonable per FAR 15.404-1(b)(2)(ii).

12.Contracting Officer Certification/Approval

I certify that this justification is accurate and complete to the best of my knowledge and belief.

Accelerate Cybersecurity Excellence (ACE) CONTROL NUMBER: VA-25-00009832

Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition for maintaining the current VA.gov Authority to Operate (ATO) and conducting discovery for, and beginning the implementation of, a continuous Authority to Operate (cATO) for the Accelerate Cybersecurity Excellence (ACE) requirement on an other than full and open competition basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.