JA_Signed.pdf

Updated December 2015 1

J&A under FAR Subpart 8.4 - Limited Source Justification

“Source Selection Information – see FAR 2.101 and 3.104”

1. Identification of the agency and contracting activity.

a. Federal agency and contracting activity. Department of Health and Human

Services/Program Support Center/Acquisition Management Services

b. Requiring activity. U.S. Food and Drug Administration, Office of Security

Operations

c. Requiring Activity Point of Contact information.

• Name. Brian Frieze

Mailing address. U.S. Food and Drug Administration

Building #2, Room 25, 10903 New Hampshire Avenue

Silver Spring, MD 20993-0002

• E-mail address. Brian.frieze@fda.hhs.govlol

• Telephone number. 301-796-2392

2. Nature and/or description of the action being approved.

A new Quantum data connector will be provided by Deloitte/Quantum to facilitate the transfer of data to the new FDA C*Cure 9000’s and Innometriks ID Server Application.

Acquisition purpose and objectives:Deloitte will design and build a solution and define this process. The ultimate goal is to provide a write only data connector that will provide the specific FDA credential attributes from the Quantum Secure application and pass all identified enrollment attributes into the new C*Cure 9000 and Innometriks ID Server

Application. This information will be used to enroll government personnel from HHS headquarters and provide them onsite ingress & egress access at FDA facilities nationwide.

Project background: The Food & Drug Administration (FDA) Office of Physical

Security, is in the process of replacing the current FDA, MDI PACS system with a new

C*CURE 9000 PACS system, utilizing an Innometriks FICAM software solution. This will consist of installing new FDA servers, utilizing existing HHS IP backbone, by provisioning new IP VM connectors. The transfer of all current credentials into the new

C*CURE 9000 PACS software head end, consisting of the new FDA servers with

C*CURE 9000 and Innometriks.

mailto:Brian.frieze@fda.hhs.govlol

Updated December 2015 2

3. Description of the supplies or services required to meet the agency’s needs

(including the estimated value).

a. Project title.

FDA IDMS Quantum Data Connector

b. Project description: Deloitte will design and build a solution and define this process. The ultimate goal is to provide a write only data connector that will provide the specific FDA credential attributes from the Quantum Secure application and pass all identified enrollment attributes into the new C*Cure 9000 personnel from HHS headquarters and provide them onsite ingress & egress access at FDA facilities nationwide.

• Requirement type.

Support services (non-research & development)

Supplies/equipment

Information technology (IT)

Other (specify): ____________________

• Proposed contract/order type.

Firm-fixed-price

Time and materials

Blanket Purchase Agreement: ___________

Other (specify): ___________

• Acquisition identification number. 19-233-SOL-00182

c. Total estimated dollar value and performance/delivery period. $98,000.00 –

POP is one year

4. The authority and supporting rationale [see 8.405-6(a)(1)(i) and (b)(1)] and, if applicable, a demonstration of the proposed contractor’s unique qualifications to provide the required supply or service.

a. Acquisition authority.

This acquisition is conducted under the authority of the Multiple Award

Schedule Program. In accordance with Federal Acquisition Regulation

(FAR) 8.405-6(a), consideration of schedule contractors will be restricted to fewer than the number required at FAR 8.405-1, 8.405-2, 8.405-3 (i.e., fewer than three FSS contractors). FAR 8.405-6(a)(1)(i), for a proposed order or BPA with an estimated value exceeding the micro-purchase threshold not placed or established in accordance with the procedures in

Updated December 2015 3

8.405-1, 8.405-2, or 8.405-3, the only circumstances that may justify the action are-

(A) An urgent and compelling need exists, and following the procedures would result in unacceptable delays;

(B) Only one source is capable of providing the supplies or services required at the level of quality required because the supplies or services are unique or highly specialized;

(C) In the interest of economy and efficiency, the new work is a logical follow-on to an original Federal Supply Schedule order provided that the original order was placed in accordance with the applicable Federal Supply Schedule ordering procedures. The original order or BPA must not have been previously issued under sole-source or limited-sources procedures.

c. Supporting rationale of the nature of the acquisition that necessitates limiting sources.

FDA requires the integration to support immediate availability of identity and credential data and card status to be able to seamlessly provision and de-provision access to the FDA staff members across the many facilities maintained and operated by FDA.

Name and address of the proposed contractor(s).

Bradley Hiddemen, CISSP, CIPP

Senior Manager

Cyber Risk Services

Deloitte & Touche LLP

Tel: (or Direct:) +1 571 882 6861

Mobile: + 1 610 334 7587

Fax: + 1 703 574 3451 bhiddemen@deloitte.com www.deloitte.com

• Supporting rationale of the nature of the acquisition that necessitates limiting sources under acquisition authority cited in 4a and, if applicable, the proposed contractor(s) unique qualifications.

Deloitte provides identity and credential data (inclusive of employee name, HHSID, PIV card status, and other access-related attributes) as a managed service to the Department of Health and Human Services through the

Department’s SAFE (ePACS) platform.

The key to the sole source justification is that FDA is requesting an integration task order to a system that Deloitte provides to the Department mailto:bhiddemen@deloitte.com http://www.deloitte.com/

Updated December 2015 4 as a managed service (HHS Quantum Secure SAFE/ePACS). Because

Deloitte are the primary contract holder and product owner/operator of the

HHS ePACS system, no other contractor is able to access the product to build/test/deploy that connector.

5. Determination by the ordering activity Contracting Officer that the order represents the best value consistent with FAR 8.404(d).

Deloitte & Touche LLP is a HHS contract holder under

HHSN316201200018W_HHSP233201800007W (HHS Quantum Secure SAFE/ePACS).

Accordingly, cost information will be provided to and accepted by PSC. An independent government cost estimate has been prepared based on the contractor’s IDIQ rates.

6. Description of the market research conducted among schedule holders and the results, or a statement of the reasons market research was not conducted.

Thorough market research was conducted for the current contract and found that Deloitte

& Touche LLP has been providing the same service to the FDA MDI PACS under

HHSN316201200018W_HHSP233201800007W.

7. Any other facts supporting the justification.

FDA must strike the appropriate balance between the desired goal of providing HHS-wide shared services to facilitate service reuse, and the pragmatic reality of supporting a diverse and changing set of OPDIV- and STAFFDIV-specific requirements while simultaneously leveraging existing OPDIV and Program investments. In order to facilitate this balanced approach to providing ICAM services, a comprehensive assessment of Departmental requirements and path forward is vital in order to comply with the extensive changes made to the FICAM Architecture and Roadmap following the Cybersprint activities promulgated by the OPM breaches. OMB M-04-04 and FIPS 201-2 Legislation that previously governed

Federal Identity, Credential and Access Management direction was deprecated, re-written and re-issued in the middle of 2017 with more extensive changes anticipated for “Identity” by November 2017, to complete the “new” FICAM Roadmap and Architecture.

The following services are currently provided by Deloitte and require careful evaluation before transition to another contractor can occur:

Public Key Infrastructure (PKI) support primarily for certificates encoded on HSPD-12 and related smart cards

Smart card management system (supports HSPD-12 identity smartcards);

Enrollment and issuance station (support the badge issuance process); development and operational support of the identity management service and Simplified Sign On service;

Security services supporting the C&A process; and infrastructure support for systems.

Updated December 2015 5

Program management consulting, IV&V, subject matter expert, capital planning, and enterprise architecture support

Program management consulting, IV&V, subject matter expert, capital planning, and enterprise architecture support

Program management consulting, outreach and communications support Software acquisition and maintenance support for both Sun and Oracle products

Public Key Infrastructure (PKI) Certificate Authority (CA)

Without Deloitte’s support, all FDA Identities and certificate authentication mechanisms for the entirety will not be inserted into the new FDA PACS. A new integrator will have to go through extensive requirements gathering, development, and testing to try and connect their solution with the many systems Deloitte has already integrated HHS-wide.

8. Statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the restricted consideration before any subsequent acquisition for the supplies or services is made.

a. Removal of barriers to competition: by executing a time-limited procurement vehicle contract, Deloitte can continue to provide maintenance support for

HHS and then provide FDA Physical Access Control System priorities and software support.

9. Program office certification.

Evidence that any supporting data that is the responsibility of technical or requirements personnel (e.g., verifying the Government’s minimum needs or requirements or other rationale for limited sources) and which form a basis for the justification have been certified as complete and accurate by the technical or requirements personnel.

Official Name & Title Signature Date

Requiring

Activity

POC

POC

Immediate

Supervisor

Head of the

Sponsoring

Brian K. Frieze Physical Security Specialist

Tampathi Carroll-McIntyre Chief of Physical Security

Karl Thrash Director Office of Security Operations

Updated December 2015 6

Program

Office

10. Contracting Officer certification.

This is to certify that the justification is accurate and complete to the best of the contracting officer’s knowledge and belief.

Official Name & Title Signature Date

Contracting

Officer

Patricia Natividad patricia.natividad Typewritten Text 01 Mar 2019 patricia.natividad Typewritten Text