JA Under FSS 26F1637 1006260010 Xacta - R.pdf

SOLE SOURCE JUSTIFICATION UNDER FEDERAL SUPPLY SCHEDULE

SECTION 1: IDENTIFICATION OF THE AGENCY AND THE CONTRACTING

ACTIVITY

Department of State Contracting Activity Acquisition Management

Requiring Activity

Bureau of Intelligence & Research Technology & Innovation Office

(INR/TIO)

SECTION 2: NATURE AND/OR DESCRIPTION OF THE ACTION BEING

APPROVED

Approval is requested to limit the number of sources for soliciting and awarding Firm Fixed Price Call Order under a Federal Supply Schedule contract for the supplies and/or services described in Section 3 on behalf of the Requiring Activity.

SECTION 3: DESCRIPTION OF SUPPLIES OR SERVICES REQUIRED TO MEET

THE AGENCY’S NEEDS

XACTA 360 Software license for the Telos XACTA 360 Governance, Risk, and Compliance platform.

Professional services provided by Telos Corporation or an authorized reseller to configure proprietary XACTA workflows, database structures, reporting capabilities, and support cyber compliance assessments necessary to support INR's Top Secret authorization environment and Intelligence Community compliance processes.

Training and Technical Support for the initial administrator and user training together with ongoing U.S.-based technical support to ensure uninterrupted operation of the enterprise platform and timely implementation of software updates, security patches, and vendor enhancements.

The estimated value for the Base plus four (4) 12-month options of Telos Corporation products and services is .

SBU - CONTRACTING AND ACQUISITIONSSBU - CONTRACTING AND ACQUISITIONSSBU - CONTRACTING AND ACQUISITIONS

SECTION 4: AUTHORITY AND SUPPORTING RATIONALE

This acquisition is conducted under the authority of the Multiple-Award Federal Supply Schedule Program as implemented in FAR 8.401 using procedures set forth in GSAR 538.71.

See GSAR .

GSAR -

product, or

Historically, INR obtained Governance, Risk, and Compliance platform through a shared contract vehicle made available through the Intelligence Community. This method is no longer available preventing INR from maintaining and modernizing the Governance, Risk, and Compliance platform. Consequently, INR must independently acquire and operate a Governance, Risk, and Compliance platform to ensure uninterrupted compliance with the Federal Information Security Modernization Act (FISMA), Intelligence Community cybersecurity policies, Intelligence Community security requirements, and mandatory continuous monitoring obligations applicable to National Security Systems.

INR must maintain continuous cybersecurity authorization and continuous monitoring processes across the Department's Top Secret enterprise network. The use of a brand-name specification for Telos Corporation XACTA and Cyber Compliance Services is essential to INR’s requirement.

INR conducted market research and technical evaluations of commercially available Governance, Risk, and Compliance (GRC) platforms designed to support the Intelligence Community (IC) Risk Management Framework (RMF). Market research indicates that alternative commercial products lack the requisite native capabilities and cannot be modified to satisfy INR’s operational and security baselines without introducing unacceptable risk and custom software development.

Telos Xacta 360 is the only commercially available product that satisfies all minimum mission requirements out-of-the-box through standard, vendor supported functionality. All other products lacked:

SBU - CONTRACTING AND ACQUISITIONSSBU - CONTRACTING AND ACQUISITIONSSBU - CONTRACTING AND ACQUISITIONS

Embedded Integration with ICD 503 and CNSS 1253 Overlays: Unlike standard commercial GRC tools built for NIST SP 800-53 or FedRAMP baselines, Xacta natively encodes Intelligence Community Directive (ICD) 503 and Committee on National Security Systems Instruction (CNSSI) 1253 security controls, threat overlays, and test procedures. Alternative platforms require extensive custom data modeling, manual control mapping, and schema modifications.

Native Multi-Tenant Control Inheritance: Top Secret enterprise systems rely heavily on control inheritance from underlying cloud enclaves (e.g., AWS S-C2S, Azure Government Top Secret) and shared infrastructure. Xacta’s propagation utilities natively enable Security Control Assessors (SCAs) and Authorizing Officials (AOs) to link, inherit, and auto-populate common controls across system boundaries without manual duplication.

IC-Wide Workflow & Artifact Standardization: AOs across the IC and Department of Defense (DoD) enforce specific, mandatory templates, artifact schemas, and body-of evidence formats. Because IC A&A workflows are standardized around Xacta-generated artifacts, migrating to an unfamiliar engine introduces data structure mismatches that directly delay time-to-Authorization to Operate (ATO).

Inter-Agency Reciprocity & Data Sharing: To support ICD 503 reciprocity directives across joint-tenant operations, Xacta enables seamless, machine-readable export and import of Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), and System Security Plans (SSPs) without requiring complex manual data translation.

Vendor-Backed Air-Gapped Deployment: Xacta provides fully supported, on-premises installation packages tailored for Top Secret air-gapped environments with zero outbound internet dependencies, backed by cleared vendor engineering support and dedicated classified patch distribution cycles.

Because Xacta is the platform through which INR manages this shared infrastructure inheritance, it now serves as the authoritative enterprise repository for all operational authorization packages, inherited controls, assessment artifacts, POA&M records, and historical risk determinations relied upon by Authorizing Officials. Replacing the existing Xacta environment would disrupt these dependencies and require complete re validation of

SBU - CONTRACTING AND ACQUISITIONSSBU - CONTRACTING AND ACQUISITIONSSBU - CONTRACTING AND ACQUISITIONS authorization data, redevelopment of automated workflows, reconfiguration of control mappings, extensive user retraining, re accreditation of operational processes, and end to end system testing.

The software architecture, workflow engine, database schema, APIs, and customization frameworks are the exclusive proprietary intellectual property of Telos Corporation. Because INR has already deployed Xacta across the Top Secret network, any expansion, engineering, or modification work must be performed directly by Telos or an authorized partner to maintain active system warranties, ensure continuous vendor support, and preserve access to tier-3 engineering escalations.

Transitioning to an alternative platform would interrupt ongoing authorization activities for operational Top Secret systems, halting risk acceptance decisions and continuous monitoring evaluations. This would result in prohibitive duplicate costs, severe schedule delays, increased cybersecurity risk, and mission disruption, with no corresponding benefit to the Government.

SECTION 5: DETERMINATION BY THE ORDERING ACTIVITY CONTRACTING

OFFICER THAT THE CONTRACT ACTION REPRESENTS THE BEST VALUE

CONSISTENT WITH FAR 8.305

The Contracting Officer has determined that the anticipated price(s) will be fair and reasonable based on GSA contracts or pricing agreements, catalog or established price list, price competition, and independent estimate. By signing the justification, the Contracting Officer makes a determination that the to the Government is expected to be fair and reasonable.

SECTION 6. DESCRIPTION OF THE MARKET RESEARCH CONDUCTED AMONG

SCHEDULE HOLDERS AND THE RESULTS OR A STATEMENT OF THE REASON

MARKET RESEARCH WAS NOT CONDUCTED

While INR currently relies on this software for its enterprise cybersecurity infrastructure due to high technical risks, operational downtime, and prohibitive duplicate costs associated with replacing existing proprietary detection content, INR is fully committed to fostering maximum practicable competition for all subsequent acquisitions.

SBU - CONTRACTING AND ACQUISITIONSSBU - CONTRACTING AND ACQUISITIONSSBU - CONTRACTING AND ACQUISITIONS

To overcome existing barriers and rigorously evaluate alternative solutions, INR will execute the following pre-solicitation mitigation process prior to initiating any follow-on procurement or standard refresh cycle.

Continuous Market Research & Enterprise GRC Evaluation: INR will continuously monitor the commercial marketplace for emerging cyber threat detection, endpoint protection, and IC-capable Governance, Risk, and Compliance (GRC) platforms. This includes periodically evaluating commercial offerings supporting ICD 503 and CNSS 1253 controls to determine whether vendor-supported implementations have matured sufficiently to satisfy agency security standards without requiring a brand-name restriction.

Prior to follow-on acquisition planning, INR will perform a comprehensive technical and cost benefit reassessment of system requirements. This evaluation will specifically analyze whether migrating away from the incumbent architecture has become technically feasible, operationally viable, and cost-effective—ensuring that potential replacement costs do not impose unrecoverable duplicate expenses or unacceptable risk to mission continuity.

In addition, on August 13, 2026, the Request for Information (RFI) was posted via GSA Market Research As a Service (MRAS). On August 21, 2026, the RFI closed and DoS received a total of 3 responses:

TECH SERVICE SOLUTIONS LLC (Small Business) Everforth ECS (Other Than Small Business) Telos Corporation (Other Than Small Business)

The market research indicated that all three vendors are listed on the GSA Multiple Award Schedule (MAS); additionally, two vendors hold contracts under Alliant 2, and one vendor is awarded under Alliant 3. The prevalent NAICS codes identified were 541511, 541512, and 511210.

If market research and technical reassessments confirm that alternative commercial products meet strict Intelligence Community requirements and that seamless content/infrastructure migration can be achieved without severe operational disruption or non-recoverable duplicate

SBU - CONTRACTING AND ACQUISITIONSSBU - CONTRACTING AND ACQUISITIONSSBU - CONTRACTING AND ACQUISITIONS costs, INR will structure the follow-on procurement as a full and open competition (or competitive action under FAR Part 8).

SECTION 7. STATEMENT OF THE ACTIONS, IF ANY, THE AGENCY MAY TAKE

TO REMOVE OR OVERCOME ANY BARRIERS THAT LED TO THE RESTRICTED

CONSIDERATION BEFORE ANY SUBSEQUENT ACQUISITION FOR

THE SUPPLIES OR SERVICES IS MADE

INR/TIO will:

Conduct periodic market research to identify emerging solutions.

Evaluate future commercial products capable of maintaining continuous cybersecurity authorization and processes across the Department's Top Secret enterprise network.

Reassess whether future commercial products satisfy cyber compliance services implementation requirements without requiring proprietary XACTA functionality.

Evaluate whether future migration can be accomplished without substantial redevelopment of Government-owned detection content.

Reassess the requirement before exercising any option periods or initiating a follow-on acquisition.

INR/TIO expects to obtain a technical data package or develop a performance specification that will support competition for future acquisitions of the same or similar items.

SBU - CONTRACTING AND ACQUISITIONSSBU - CONTRACTING AND ACQUISITIONSSBU - CONTRACTING AND ACQUISITIONS