JA_Sole_Source_Redacted.pdf

Justification and Approval for Sole Source

“Source Selection Information – see FAR 2.101 and 3.104”

1. Identification of the agency and contracting activity.

a. Federal agency and contracting activity.

Department of Health and Human Services National Institutes of Health (NIH) National Institute on Drug Abuse (NIDA) Office of Acquisition

b. Sponsoring organization.

National Center for Advancing Translational Sciences (NCATS) Information Technology Resources Branch (ITRB) Cybersecurity Services (CSS)

c. Project Officer information.

2. Nature and/or description of the action being approved.

a. Acquisition purpose and objectives.

The National Center for Advancing Translational Sciences (NCATS) plans to award a contract to Zero Trust, LLC, to continue to provide cybersecurity support for an additional 2.5 months while a re-competition for a new contract award is conducted as a competitive, open market total small business set-aside with an expected award date early in fiscal year 2025 on or around October 16, 2024.

b. Project background

NCATS Information Technology Resources Branch (ITRB) recently established a Cybersecurity Services (CSS) section as a separate function from its general scientific research support and IT support section. The Cybersecurity Section has two groups. The Information Security and Privacy group focuses on the user side, providing training, user support, program support, audit management, regulatory and policy compliance. The Cybersecurity Integration Center focuses on the technical side, providing security engineering, infrastructure protection, penetration testing, incident detection/management/response, and threat identification.

NCATS uses an extensive array of physical and virtual systems to support its scientific mission, focused both within NCATS and toward extramural collaboration. This includes scientific instrumentation, data acquisition, data analytics, robotics and laboratory automation, intra-and interagency collaboration abilities, information technology infrastructure, and technical support. Each of these has its own cybersecurity requirements.

NCATS requirements to support this array are elastic. NCATS requires day-to-day cybersecurity support, but also requires on-demand efforts to address specific administrative security projects such as preparation of technical approval packages, special studies, technical coordination with extramural collaborators.

c. Contractual background.

In 2020, ITRB conducted a competitive, total small business set-aside for a single-awardee IDIQ contract to meet these needs resulting in the following award under Solicitation No. 75N95020R00009:

Contract Number 75N95020D00011 Contractor Name: Zero Trust, LLC Organization Type: Small Business Ordering Period: September 29, 2020, through September 28, 2023 Contract Minimum: $5,000 Contract Maximum: $10,625,887.00

To date, the total dollar amount obligated is $10,382,830.71 under the following task orders:

Task Order No. 75N95020D00011 / 75N95020F00001 Title: “NCATS Cybersecurity Services Program Support” Period of Performance: 09/29/2020 through 09/28/2021 Obligated Amount: $1,666,692.31

Task Order No. 75N95020D00011 / 75N95021F00001 Title: “NCATS Cybersecurity Services Program Support” Period of Performance: 09/29/2021 through 09/28/2022 Obligated Amount: $2,165,000.00

Task Order No. 75N95020D00011 / 75N95022F00001

Title: “NCATS Cybersecurity Services Program Support” Period of Performance: 09/29/2022 through 03/31/2023 Obligated Amount: $1,450,000.00

Task Order No. 75N95020D00011 / 75N95023F00001

Title: “NCATS Cybersecurity Services Division Program Support” Period of Performance: 04/01/2023 through 09/28/2023 Obligated Amount: $1,560,212.44

Task Order No. 75N95020D00011 / 75N95023F00002 Title: “NCATS Cybersecurity Services Division Program Support” Period of Performance: 09/29/2023 through 07/28/2024 Obligated Amount: $3,540,925.96

The Government anticipates recompeting this requirement as an open market, total small business set-aside with award in early FY2025.

3. Description of the supplies or services required to meet the agency’s needs (including the estimated value).

a. Project title. NCATS Cybersecurity Services Program Support

b. Project description.

See Attachment 1 – Statement of Work (SOW) for a full description of the requirement. The NCATS CSS Program is seeking to further its goal to support the unique NCATS biomedical research enterprise and safeguard its diverse Hybrid IT (both cloud and on-premises) resources that NCATS relies on each day to fulfill its mission. The program is committed to balancing mission needs and risk; reducing NCATS high risk areas;

improving protections for data, infrastructure, and staff; and working to increase visibility into IT assets, operations, threats, and risks. These goals will be achieved via NCATS-specific initiatives and federal-wide directives and compliance requirements to promote IT management best practices of the full life cycle of NCATS IT investments, including configuration and patch management, system administration, and change and operations management.

Requirement type.

_ Research & development (R&D) _ R&D support services X Support services (non-R&D) _ Supplies/equipment X Information technology (IT) _ Construction _ Architect-engineer (A & E) services _ Design-build _ Other (specify): ____________________

Type of action.

_ New requirement X Follow-on _ Other (specify): Modification

Proposed contract/order type.

X Firm-fixed-price _ Other fixed-price (specify, e.g., fixed-price award-fee, fixed-price incentive-fee): __________ _ Cost-plus-fixed-fee _ Other cost reimbursement (specify, e.g., cost-plus-award-fee, cost-plus-incentive-fee): ___________ _ Time and materials _ Indefinite Delivery/Indefinite Quantity _ Other (specify): ___________ _ Completion Form _ Term form

Acquisition identification number

75N95024Q00446

c. Total estimated dollar value and performance/delivery period.

, period of performance 7/29/2024 to 10/15/2024.

4. Identification of the statutory authority permitting other than full and open competition.

_ This acquisition is conducted under the authority of 41 United

States Code (U.S.C.) 3304(a)(1) as set forth in Federal Acquisition Regulation (FAR) 6.302-1.

X This acquisition is conducted using the procedures at FAR

Subpart 13.5 in accordance with 41 U.S.C. 1901.

_ This acquisition is conducted using the procedures at FAR

Subpart 13.5 under the authority of 41 U.S.C. 1903.

5. Demonstration that the proposed contractor(s) unique qualifications or the nature of the acquisition requires use of the authority cited.

a. Name and address of the proposed contractor(s).

Zero Trust LLC 6710A Rockledge Dr., Suite 400 Bethesda, MD 20817

b. Nature of the acquisition and proposed unique qualifications of the contractor(s).

The proposed contractor has unique qualifications to perform this requirement and is the only organization that can complete the specific work at this time. Additionally, the proposed contractor has been providing these services for thirty-five (35) months. Their unique qualifications include:

Capability to secure and support a shared computational cloud environment that enables internal and external contributors from government, academia, industry, and non-profit foundations to collaborate in a connected fashion. This includes maintaining security of sensitive information, such as personal identifiable information (PII) and millions of identifiable electronic health records.

Capability to secure and support a distributed network of laboratories and associated scientific equipment/systems performing experiments while guiding virtual experimentation in a shared collaborative computational cloud environment. This includes complex systems comprised of multiple cloud environments (Amazon Web Services, Azure, Google Cloud Platform), multiple platforms as a service (Palantir Foundry, Salesforce, Box), open-source packages (e.g.

REDCap), custom developed software, and on-premises hardware capabilities, including high performance computing.

Capability to support a cloud environment that allows connections from scientific instruments and collaborators worldwide in a secure manner, which ensures applications can be accessed by authenticated users. This environment allows for the establishment of Virtual Research Organizations (VROs), which consist of thousands of researchers from over thirty (30) nations. This includes supporting and enabling secure access for these VROs to shared resources to perform collaborative research projects, ranging from clinical informatics, cheminformatics, business and administrative tools, resources for the rare disease community, and others.

Capability to design enhancements for scientific instruments and secure them for cloud usage. For example, having controlling PCs for scientific instruments run on Ubuntu, a Linux distribution based on Debian and composed mostly of free and open-source software, but with the controlling software written in Django, a free and open-source Python-based web framework. These and related enhancements allow modern software development and infrastructure management tools to be installed on controlling PCs while maintaining security; as a result, the scientific instruments can perform as dynamic components within a larger collaborative cloud environment.

Capability to use the core components of functional scientific instruments, such as motion control stages, instrument cases, valves, but completely replace the controlling components with more modern and secure alternatives, such as motion controllers, field programmable gate arrays (FPGAs) used to operate motion control systems and valves, and the controlling personal computers (PCs).

6. Description of the efforts made to ensure that offers are solicited from as many potential sources as practicable. Indicate whether a SAM.gov Contract Opportunities notice was or will be publicized as required by FAR Subpart 5.2 and, if not, which exception under FAR 5.202 applies.

In accordance with FAR Subpart 5.2, a synopsis of proposed contract action to negotiate and award this contract was published on SAM.gov Contract Opportunities on July 17, 2024, for six (6) days. The synopsis included a statement that all responsible sources may submit a capability statement, proposal, or quotation, which shall be considered by the agency.

Nine (9) responses were received to the notice from the following sources:

BGESH INCORPORATED

148 WESTFIELD LNDG STE 200

LA VERNIA, TX 78121-5732

UEI: HKEXMP55KEG6

BLUEBERY HAWAII TECHNOLOGY SOLUTIONS LLC

10815 WILLIAM PASS LN

CYPRESS, TX 77433-6486

UEI: ZW6GMVL368J6

CLOUDEN TECHNOLOGIES LLC

43965 MAIDEN CREEK CT

ASHBURN, VA 20147-3923

UEI: G1N8SZFS39R7

DELAWARE NATION INVESTMENTS LLC

395 NE 31ST ST

NEWCASTLE, OK 73065-6485

UEI: J4Q3LZFQBHP6

PKH ENTERPRISES, LLC

5404 WISCONSIN AVE

CHEVY CHASE, MD 20815-3573

UEI: LFDFJPULHSF5

PROKSI TECHNOLOGY JV LLC

2488 HEADHOUSE SQ S

BENSALEM, PA 19020-3668

UEI: MMNADB28Q9D6

SIXGEN INC

185 ADMIRAL COCHRANE DR, STE 210

ANNAPOLIS, MD 21401-7583

UEI: W2PKJHAU9JR9

STEALTH ICT LLC

1309 COFFEEN AVE, STE 5377

SHERIDAN, WY 82801-5777

UEI: CB3LYHMP4JK4

ZIONE SOLUTIONS LLC

37000 GRAND RIVER AVE STE 355

FARMINGTON, MI 48335-2810

UEI: NF5ZJKAS9T45

All nine (9) respondents were assessed as not capable of meeting the requirement, because they either failed to address the specific requirements in the notice and its Attachment 1 – Statement of Work or addressed them insufficiently for the Government to determine they are capable of meeting the requirement.

7. Determination by the Contracting Officer that the anticipated cost/price to the Government will be fair and reasonable.

NIDA expects the contract will use the same level of effort at the same rates as under the previous contract, for which the pricing was extensively evaluated and determined to be fair and reasonable.

8. Description of the market research conducted (see FAR Part 10) and the results, or a statement of the reasons market research was not conducted.

Market research was performed for the follow-on contract to be awarded in FY2025 and this work was determined to be suitable for competition in the open market as a small business set aside.

9. Any other facts supporting the use of other than full and open competition.

This requirement is to continue existing services until the follow-on contract can be competed and awarded. The incumbent has performed satisfactorily at a fair and reasonable price.

Use of other than full and open competition for this acquisition will avoid the following risk that would result if these services ended abruptly: the security of sensitive information involved in active and ongoing projects would be jeopardized. This includes personally identifiable information (PII) and millions of identifiable electronic health records contained within the National Covid Cohort Collaborative (N3C) which are utilized by the collaborators within this cloud environment. In the event of a breach of the N3C data, the programs and reputation of NCATS would be irreparably harmed. It would prematurely terminate the N3C program and jeopardize the work of hundreds of active projects with collaborators around the world.

The disruption caused by transition to an interim contractor poses major cost, performance, and security risks to the Government. The cost of transition would be duplicated for each award and would far exceed any cost savings obtained by this short-term contract.

10. Listing of sources, if any, that expressed, in writing, an interest in the acquisition.

The following sources have expressed, in writing, an interest in this requirement:

Assurit Consulting Group LLC, 11325 Random Hills Rd, Suite 360, Fairfax, VA 22030.

Alakaina Foundation, 1600 KAPIOLANI BLVD, STE 530, HONOLULU, HI 96814.

Armavel LLC, 2715 64TH AVE NE, TACOMA, WA 98422.

Booz Allen Hamilton, 800 CORPORATE DR STE 101, STAFFORD, VA 22554.

Easy Dynamics Corporation, 2000 CORPORATE RDG, STE 240, MC

LEAN, VA 22102.

Emagine It Inc., 909 Rose Ave, STE 900, NORTH BETHESDA, MD 20852.

Gray Tier Technologies LLC, 2800 EISENHOWER AVE, STE 220, ALEXANDRIA, VA 22314.

Inqwest Inc., 7911 CULLODEN CREST LANE, GAINESVILLE, VA 20155.

IronVision LLC, 131 John Daniel Way, Brooklyn Park, MD, 21225

MBL Technologies Inc., 1100 N GLEBE RD, STE 1010, ARLINGTON, VA 22201.

NexThreat LLC, 7686 RICHMOND HWY STE 116, ALEXANDRIA, VA 22306.

Obsidian Global LLC, 1055 THOMAS JEFFERSON ST NW, SUITE 310, WASHINGTON, DC 20007.

TACG LLC, 4501 SINGER CT, STE 300, CHANTILLY, VA 2015.

Technuf LLC, 6290 MONTROSE RD, ROCKVILLE, MD 20852

Xpect Solutions Inc., 11350 RANDOM HILLS RD, STE 800, FAIRFAX, VA 22030.