JA25-140 CSS JA Final_Redacted 30SEP25.pdf

CUI

Cybersecurity Support Services

Page 1 of 7 Pages

Controlled By: DCMA Controlled By: DCMAIT-C CUI Category: PROCURE

LIMITED SOURCE JUSTIFICATION & APPROVAL (J&A)

FEDERAL ACQUISITION REGULATION (FAR) PART 8 ACQUISITIONS

Multiple Award Schedule (MAS)/Multiple Award Contract Orders under MAS/General Services Administration Schedules (GSA)/Federal Supply Schedules

(FSS) FAR 8.405-6

Purchase Request Number:

Contract Number: 47QTCA8D0002A Task/Delivery Order Number: HC104723F4060 Procurement Title: Defense Contract Management Agency (DCMA) Cybersecurity Support Services (CSS) Estimated Value: (Lifecycle value) Statutory and Regulatory Authority: 10 U.S.C. 3204(a) and FAR 8.405-6(a)(1)(i)(C)

J&A Number: JA25-140

Upon the basis of the following justification, I, as the Procuring Activity Competition Advocate, hereby approve this limited source justification pursuant to the authority of FAR 8.405- 6(a)(1)(i)(C). The acquisition referenced herein is conducted under the Statutory Authority of the Multiple Award Schedule Program, 41 U.S.C. 152(3).

1. REQUIRING AGENCY AND CONTRACTING ACTIVITY:

Requiring Agency:

DCMA Information Technology Cybersecurity Center (DCMAIT-C) 3901 Adams Avenue Fort Lee, Virginia 23801-1809

Contracting Activity:

DISA/Defense Information Technology Contracting Organization (DITCO) Defense Information Systems Agency (DISA)/Defense Information Technology Contracting Organization/PS64 6910 Cooper Ave Ft. Meade, Maryland 20755

2. NATURE/DESCRIPTION OF ACTION(S): The nature of this action is a modification to the firm-fixed price Task Order 47QTCA8D0002A/HC104723F4060 for additional cybersecurity support services. This action will increase the level of effort for a 12-month period of performance with a 5-month option period to align with the task order’s final completion date.

This modification will increase the cybersecurity posture for DCMA to include increased threat detection and monitoring, cyber policy and workforce support and cyber defense capabilities to

Page 2 of 7 Pages include Zero Trust (ZT), Web Application Security Program Support, Alternate Logon Token (ALT) Account Management, and a Firewall Assurance Program. These services align with mandated Executive Order (EO) 13694 and14144 issued on 16 January 2025 and Department of Defense (DoD) Chief Information Office (CIO) directives and will be funded with Operations and Maintenance funds for each period of performance. The total estimated lifecycle value of the increase is . The following is the estimated delivery schedule and estimated life-cycle costs for each of the Task Order periods:

Period of Performance Estimated Cost 28 September 2025 – 27 September 2026 28 September 2026 – 07 February 2027 (5-month Option Period)

Total:

3. DESCRIPTION OF SUPPLIES/SERVICES: These additional cybersecurity support services include ZT, Web Application Security Program Support, Detect Services, ALT Account Management, Cybersecurity/Information Assurance Policy Support, Cyber Workforce Qualification Management, and Firewall Assurance Program. Additional support is required to defend from existing and emerging threats and bolster the defense of critical digital infrastructure. Currently, this task order consists of vulnerability scanning and management, network monitoring, security breach services in addition to Public Key Infrastructure (PKI) Certification, Cybersecurity Engineering, and Compliance. All these tasks are encompassed under three existing functional areas: 1) Security Management, 2) Security Engineering, and 3) Security Compliance.

4. IDENTIFICATION OF LIMITED SOURCE AUTHORITY AND DEMONSTRATION OF

CONTRACTOR’S UNIQUE QUALIFICATIONS:

(a) Circumstances Justifying Limiting the Source. Pursuant to FAR 8.405-6(a)(1)(i)(C), in the interest of economy and efficiency, the new work is a logical follow-on to work on an existing FSS order. The original order was placed in accordance with the applicable FSS ordering procedures. The original order was not previously issued under sole-source or limited-sources procedures. The new work described above provides related cybersecurity services at an increased level of effort and is a logical follow-on to the original Task Order.

Description of the Justification. DCMA’s Cybersecurity division maintains an ongoing obligation to safeguard agency data and infrastructure by continuously addressing and remediating identified vulnerabilities to uphold the agency’s cybersecurity posture, operational readiness, and regulatory compliance. This commitment aligns with the requirements established by the Federal Information Security Modernization Act, Department of Defense Instruction (DoDI) 8500.01, and the Risk Management Framework (RMF) standards.

Page 3 of 7 Pages

In accordance with directives issued by the President of the United States, DCMA is actively working toward full compliance with applicable EO 13694 and 14144 on Strengthening and Promoting Innovation in the Nation’s Cybersecurity and DoDI

8500.01 and its rigid compliance timeline. This effort includes the implementation of critical services such as Web Application Security Program Support, Senior Program Management, Detection Services, ALT Qualification Management, Firewall Assurance Program, ZT Architecture Implementation, and Information System Security Engineer (ISSE) functions to ensure that DCMA in compliance with EO 13694 and 14144.

The integration of these services is essential to resolving numerous outstanding cybersecurity audit findings identified through both internal and external evaluations.

These findings represent significant risks to the agency’s cybersecurity posture, operational readiness, and adherence to DOD’s cybersecurity mandates.

While these initiatives fall within DCMA’s operational scope of Security Management, Security Engineering and Security Compliance they currently exceed existing resource capacity.

Utilizing available FY 2025 funds present an effective solution to add this work immediately to ensure ongoing cybersecurity operations while meeting the mandates of EO 13694 and 14144. This strategic allocation will accelerate progress on critical cybersecurity objectives, ensure compliance, and enhance the resilience of DCMA’s network infrastructure in alignment with evolving Federal mandates.

It is in the Government’s best interest to use the incumbent contractor for the acquisition of these essential cybersecurity services. Crest is already familiar with DCMA cybersecurity posture and procedures, and the new work closely aligns with the work they currently perform for DCMA. This method avoids duplicative efforts and leverages the expertise of the current contractor to ensure federal mandates are met while supporting DCMA’s mission.

(b) Justification:

(1) Minimum Government requirements. The minimum requirement for this effort includes adding the following services: ZT implementation, Web Application Security Program Support, Detect Services, ALT Account Management, Cybersecurity/Information Assurance Policy Support, Cyber Workforce Qualification Management, and Firewall Assurance Program.

(2) Proposed sole source contractor. Crest is uniquely positioned to fulfill DCMA’s cybersecurity requirements due to their expertise as the incumbent cybersecurity contractor for DCMA. As the incumbent contractor, Crest will be able to implement a comprehensive ZT architectures and advanced Web Application Security programs.

Crest possesses extensive experience supporting Federal Agencies with critical cybersecurity services, including Detect Services, ALT Account Management, and Cyber Workforce Qualification Management. Their team comprises of highly

Page 4 of 7 Pages certified cybersecurity professionals with deep knowledge of Federal cybersecurity policies, compliance standards, and threat landscapes.

(3) Crest’s established integration capabilities with existing DCMA infrastructure enable rapid deployment and immediate operational readiness, which are critical when considering economy and efficiency. This combination of specialized technical expertise, federal compliance experience, and proven rapid response capability makes Crest uniquely qualified and capable of meeting DCMA’s needs as a logical follow-on to an existing task order.

(4) Discussion regarding cause of the limited source situation. This work aligns with the current DCMA Cybersecurity Services Support effort and adding this work into the existing effort will avoid duplication of effort and cost. This also provides continuity of services with the cybersecurity services currently provided to DCMA. These services encompass a broad range of technical and programmatic functions that work together to maintain the agency’s cybersecurity posture in alignment with DoD and Federal standards. As DCMA continues to mature its cybersecurity architecture— particularly in alignment with ZT principles and evolving risk management requirements—the newly identified services are designed to build upon, enhance, and integrate with existing capabilities, rather than operate as stand-alone or separate efforts.

(5) Demonstration of limited source. Due to the nature of the work aligning so closely with work currently being performed, it would be in the Government’s best interest in terms of economy and efficiency to leverage the current contractor. The use of another multiple award contract holders would result in a duplication of effort in several task areas, such as Detection Services, ALT Account Management, Cybersecurity and Information Assurance Policy Support, Cyber Workforce Qualification Management, Firewall Assurance Program, ZT Architecture Implementation, and ISSE as the new contractor would need to replicate existing capabilities, reacquire situational awareness, and establish working knowledge of DCMA’s specific cybersecurity threat landscape and mitigation strategies.

(6) Procurement discussion. This current contract effort is set to expire in February of

2027, and by the time the Government would be able to compete just the portion of the work that is being added, it would coincide with recompeting the DCMA Cybersecurity Services effort. By adding this work into the current DCMA Cybersecurity Services effort, the Government will be able to cohesively move forward with a contractor who is familiar DCMA cybersecurity posture. While competition would normally be pursued to ensure best value, a logical follow-on is considered most advantageous.

(7) Impact. Delays in delivery and deployment of critical cybersecurity services would result if the source were not appropriately limited and the procurement undergoes a full competitive process. This will have significant detrimental effects on DCMA’s

Page 5 of 7 Pages mission as well as leaving the agency non-compliant with EO 13694 and 14144, and DoDI 8500.

These effects include:

o Increased Vulnerability to Cyber Threats: Delays in implementing ZT architectures, Firewall Assurance, and Detect Services will leave DCMA’s mission-critical systems exposed to sophisticated cyberattacks, increasing the risk of unauthorized access, data breaches, and potential disruption of defense operations.

o Operational Disruptions: Without timely ALT Account Management and Cyber Workforce Qualification Management, secure user authentication and personnel readiness will be compromised, risking operational continuity and system integrity.

o Non-Compliance with Federal Cybersecurity Mandates: Failure to promptly deliver Cybersecurity/Information Assurance Policy Support could lead to lapses in regulatory compliance, resulting in potential sanctions, loss of certification, or reduced Federal funding.

o Loss of Confidence and Mission Readiness: Cybersecurity incidents caused by delayed service deployment would undermine stakeholder confidence and could degrade DCMA’s ability to effectively manage defense contracts and support warfighters.

5. BEST VALUE DETERMINATION: GSA has already determined that prices of supplies, fixed price services, and rates for services offered at hourly rates are fair and reasonable for the purpose of establishing the schedule contract. However, the Contracting Officer is still required to make a determination of fair and reasonable pricing for individual orders, BPAs, and orders under BPAs, using the proposal analysis techniques at FAR 15.404-1. The complexity and circumstances of the acquisition should determine the level of detail and analysis IAW FAR 8.404(d) for acquisitions under FAR 8.405-2(d).

6. MARKET RESEARCH: Meaningful market research was conducted within the previous 12 months to identify all qualified sources capable of providing the required cybersecurity services for DCMA. The market research was performed by the DCMA Program Manager in coordination with DCMA’s Cybersecurity Subject Matter Experts between December 2024 and July 2025.

As part of the market research process, it was determined that the estimated cost for one (1) year of continued performance, whether under the ENCORE III Small Business (SB) Suite contract vehicle or via a newly solicited contract through an alternative Government-wide Acquisition Contract (GWAC) or MAS, would be approximately . This estimate reflects current pricing trends observed across ENCORE III SB, the GSA MAS, and other comparable contracting vehicles offering similar scope, complexity, and level of effort. The analysis supports the conclusion that pursuing a new or alternate acquisition strategy would not result in cost savings and may introduce schedule risk and administrative burden without a commensurate benefit in pricing or performance

Page 6 of 7 Pages

The research team included technical experts within Cybersecurity whose research focused on identifying vendors capable of delivering ZT implementation, Web Application Security Program Support, Detect Services, ALT Account Management, Cybersecurity/Information Assurance Policy Support, Cyber Workforce Qualification Management, and Firewall Assurance Program. The research included reviews of the GSA Schedule databases, DISA’s multi-award contracts, Federal procurement portals, industry capability briefings, and outreach to known cybersecurity vendors with experience supporting federal agencies. The purpose was to ensure a comprehensive understanding of the marketplace to identify all potential providers able to meet the urgent delivery as required by the Executive Order and other DoD directives and technical requirements.

Crest is uniquely positioned as the current contractor that is responsible for maintaining DCMA’s cybersecurity contract since 18 August 2023. Crest’s domain knowledge of DCMA’s cybersecurity infrastructure and established integration capabilities fully satisfy DCMA’s specific needs. A new contractor would not be able to immediately begin this work without a significant ramp up period, halting the current program successes in order to become familiar with DCMA’s cybersecurity infrastructure. Additionally, there would be duplication in effort as outlined in section (4)(b)(3) of this document.

Based on current market research, conducted between December 2024 to July 2025, it has been determined that only the cybersecurity services provided by Crest can fully meet the Government’s need within the timelines required to enable compliance with executive orders and other DoD policies. No competitor’s functional replacement products or services exist in the marketplace at this time to meet the Government’s immediate needs. However, the Government will continue to conduct market research to monitor the market for changes that will enable the Government to plan the future competitive action at the end of the current contract.

7. ANY OTHER SUPPORTING FACTS: None.

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE BARRIERS THAT LED TO THE

RESTRICTED CONSIDERATION:

(a) Procurement history. Previous effort is as follows:

• Contractor name and business size: Ryan Consulting Group, Inc. / Small Business

• Contract number and dollar value: HHSN316201200092W / HC104719F0081 /

$16,654,373.12

• Contract period of performance: 18 September 2019 to 17 August 2022

• Method of acquisition: 8(a) Set-aside via National Institutes of Health Acquisition and Assessment Center (NITAAC) GWACs, CIO-SP3,8(a) Small Business.

(b) In order to remove barriers with the Cybersecurity Support Services contract, DCMA is currently in the process of re-competing this contract when the last option year exercise has been completed in FY 2027.

Page 7 of 7 Pages

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

((FAR 8.405-6)(c)(2)(x))

NAME: SIGNATURE/DATE: See separate signature page

TITLE/ORGANIZATION:

PHONE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

(FAR 8.405-6(c)(2)(x))

NAME: SIGNATURE/DATE: See separate signature page

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE/DATE: See separate signature page

PROCURING ACTIVITY COMPETITION ADVOCATE (PACA) APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief. Since this justification does not exceed $15M, this review serves as approval and my written determination that the aforementioned FAR circumstances apply.

NAME: SIGNATURE/DATE: See separate signature page

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO