JEFO 2-MO Bridge Guidehouse_Redacted.pdf

Justification for an Exception to Fair Opportunity Brand Name Justification Page 1 of 8

Justification for Exception to Fair Opportunity

“Source Selection Information” – see FAR 2.101 and 3.104.”

1. Identification of the agency and contracting activity.

a. Federal agency and contracting activity.

Department of Health and Human Services (HHS) Office of Acquisitions, Institute of Child Health and Human Development (NICHD)

b. Sponsoring organization.

National Institute of Health (NIH) Center for Information Technology (CIT) Information Security Program (ISP)

c. Contracting Officer’s Representative (COR) Information.

2. Nature and/or description of the action being approved.

a. Acquisition purpose and objectives.

This acquisition is for Professional Services in an information technology environment to be provided for continued assistance to Institutes, Centers, and Offices (ICOs) of NIH in institutionalizing cyber-security practices and procedures that meet Federal Standards, Regulations and Policies; and are strategically aligned with NIH business needs. These support services will be in support of the CIT.

The objective of this requirement is for NIH to acquire continuation of the above-mentioned services, as well as, the necessary professional support services that will assist ICOs of NIH in institutionalizing cyber-security practices and procedures that meet Federal Standards, Regulations, and Policies, that are strategically aligned with NIH business needs. A

Justification for an Exception to Fair Opportunity Brand Name Justification Page 2 of 8 bridge contract HHSN316201200040W/75N97024F00001 was awarded on 03/31/2025 with a POP ending 09/28/2025. The program needs to update necessary system and security requirements; as delineated in the HHS Policy for IT System Inventory Management. Additionally, the recently released November 2024 policy was not in place prior to the award of the current Bridge/Extension Contract.

This acquisition will be processed under the procedures at Federal Acquisition Regulation (FAR) 16.505(b)(2)(i)(B)(1) and 6.302-2, Unusual and Compelling Urgency.

b. Project background.

Protecting the National Institutes of Health (NIH)’s information and systems is one of the most important technological challenges facing the organization today.

Within the Office of the Director (OD), the Center for Information Technology (CIT) and the Office of the Chief Information Officer (OCIO), work together under the same leadership to keep NIH secure and able to operate. While the OCIO oversees NIH Information Technology (IT) governance, policies, assessments, and information security, CIT provides the infrastructure, operations, and services needed to achieve a secure IT environment for NIH enterprise IT services.

CIT’s approach to cyber security has historically been tactical and reactive. In 2019, the Government shifted to a more strategic and proactive approach to improve its’ cybersecurity position and reduce risk. The CIT Information Security Program (ISP) was created to lead these efforts.

The CIT ISP is an important effort to CIT’s approach for cybersecurity, providing governance, support to reduce risk, improve visibility, promote secure enterprise architecture, and strengthen protections across CIT and NIH. The CIT ISP establishes security priorities for the Task Areas and supports them by defining security policy, standards on security controls and compliance, reporting progress on key metrics, and providing guidance on Infosec practices. Key metrics include but not limited to: HHS, NIH, GAO, and other regulatory requirements that may change frequently and must be prioritized among other tasks (e.g., vulnerabilities, incidents, ticket management, exceptions/waivers, plan of action & milestones). As CIT evolves to reach its security and strategic goals, it will need a strong foundation of IT security governance and compliance to connect diverse research communities

Justification for an Exception to Fair Opportunity Brand Name Justification Page 3 of 8 and promote secure data exchange. Through collaborative teamwork and comprehensive security initiatives the CIT ISP looks towards the challenge of guiding CIT to a consistent and standardized security position for the advancement of NIH and its stakeholders.

The current contract is an ISP support contract bridge/extension to Guidehouse Incorporated (Inc.) under Contract No. HHSN316201200040W, Award No.

75N97021F00002 on a sole source basis. This original contract (HHSN316201200040W / 75N97024F00001) was competitively awarded to Guidehouse through NITAAC CIO-SP3 under Task Area 2 (Chief Information Officer (CIO) Support) and Task Area 6 (Integration Services) as a competitive follow-on.

Since there were not sufficient small businesses to compete on the requirement it was competed under unrestricted (full and open competition) with a period of performance from 09/29/2021 – 09/28/2024, which was extended 03/28/2025. On 03/31/2025, modification 75N97024F00002 / P00003 was issued to exercise the six

(6) month option period extending the contract through 09/28/2025. This bridge/extension contract is intended to extend the work through 11/28/2025.

3. Description of the supplies or services required to meet the agency’s needs (including the estimated value).

a. Project Title. CIT Information Security Program (ISP) Bridge/Extension for

Cybersecurity and OM Support, including Risk Management Framework (RMF) and Cybersecurity Operations Support Services.

b. Project description. The CIT Chief Information Security Officer (CISO) is charged with establishing policy and reviews that ensure the safeguarding of NIH information and systems. To meet the ever-changing needs of IT services, CIT’s ISP looks to expand and continuously improve its’ current functions into a strong cyber risk management program by ensuring compliance with Federal and Agency regulations and policies. CIT ISP’s vision is to use a multifaceted approach that considers people, processes, and technology through a mission- focused lens that addresses the needs of NIH ICOs while protecting research, assets, and data. A key component is a strong security operations program that helps identify risks day to day and focuses on improving cyber hygiene across CIT – including its cloud infrastructure. CIT, as the primary provider of enterprise services across NIH, plays a pivotal role, and ISP, in its capacity to bolster CIT's security function, has a widespread impact throughout NIH. ISP contributes to securing various enterprise tools and services, including Network Services, ICAM, Hosting, Data Center, Cloud and Collaboration tools.

Contractor support was originally approved and provided through

Justification for an Exception to Fair Opportunity Brand Name Justification Page 4 of 8 competitive award to Guidehouse (HHSN316201200040W / 75N97021F00002).

This continued support was inadvertently not included in the current bridge/extension contract award to Guidehouse LLC. CIT program needs to update the necessary system and security requirements as delineated in the HHS Policy for IT System Inventory Management (document # HHS-OCIO-OES-2024- 11-007). Therefore, this JEFO is addressing this oversight by adding this work back into the Bridge/Extension contract.

The recently released November 2024 policy (HHS-OCIO-OES-2024-11-007) was not in place prior to the ISP bridge/extension base award; therefore, CIT is requesting incorporation of this requirement and reactivation of ISP support through this JEFO within the current exercised Option Period 1 of the ISP bridge/extension award under Guidehouse LLP contract (HHSN316201200040W / 75N97024F00001).

4.

a. Provide the following information:

Requirement type.

☐ Support services (non-research & development) ☐ Supplies/equipment Information technology (IT) ☐ Other (specify):

Type of action.

☐ New requirement ☐ Follow-on:

Other (specify): Bridge/Extension Contract with, in scope modification to include additional work under Bridge/Extension Contract with Guidehouse

LLC., HHSN316201200040W / 75N97021F00002.

Proposed contract/order type.

☐ Firm-fixed-price Time and materials ☐ Indefinite Delivery Indefinite Quantity ☐ Other (specify):

Acquisition identification number. A new bridge/extension contract number will be identified when the award is issued.

b. Total estimated dollar value and performance/delivery period.

The total Independent Government Cost Estimated (IGCE) to complete this work during this period of performance of 09/29/2025 – 11/28/2025 is . The total contract value is: inclusive of the FAR 52.217-8 clause.

Justification for an Exception to Fair Opportunity Brand Name Justification Page 5 of 8

5. Identification of the justification rationale [see 16.505(b)(2)(a) and, if applicable, a demonstration of the proposed contractor’s unique qualifications to provide the required supply or service.

a. Acquisition authority.

☐(A) The agency’s need for the supplies or services is so urgent that providing a fair opportunity would result in unacceptable delays. This acquisition is for items peculiar to one source of supply. A limited source justification in accordance with FAR Subpart 6.302- 2, “Unusual and Compelling Urgency” because a bridge/extension contract is in place while a re- compete of the original requirement is taking place.

☐ (B) Item(s) peculiar to one manufacturer; the brand-name, product, or feature is essential to the Government’s requirements and market research indicates other companies’ similar products, or products lacking the particular feature, do not meet, or cannot be modified to meet, the agency’s needs.

(C) The order must be issued on a sole-source basis in the interest of economy and efficiency because it is a bridge/extension contract to allow enough time to compete a logical follow-on contract, provided that all awardees were given a fair opportunity to be considered for an order already issued under the original contract.

☐ (D) It is necessary to place an order to satisfy a minimum guarantee.

☐ (E) For orders exceeding the simplified acquisition threshold, a statute expressly authorizes or requires that the purchase be made from a specified source.

6. Demonstration of the proposed contractor(s) unique qualifications to provide the required supply or service.

Name and address of the proposed contractor(s) Guidehouse Inc

Nature of the acquisition and proposed contractor(s) unique qualifications.

The nature of this acquisition is to establish a bridge/extension contract to allow for continuity of services. Guidehouse Inc. is the incumbent and has been providing these services since 2021(under a contract issued with a base year

Justification for an Exception to Fair Opportunity Brand Name Justification Page 6 of 8 and four 1-year option periods. Because of Guidehouse’s Inc.’s unique qualifications gained through performance of this contract, utilizing another contractor, to perform the same services at the same high-level of performance for this interim 2-month bridge/extension contract, would not be cost effective, as the new contractor would need at least 3-months to become productive at the levels required. These qualifications and gained experience include Guidehouse’s Inc. development of expertise in support of CIT ISP’s cybersecurity efforts including operation and maintenance (OM), vulnerability management, risk management support. Guidehouse Inc. has built a strong rapport which would be impossible to duplicate in 2 months.

Therefore, any lack, or delay in service would create serious consequences as well as information security risks for the CIT ISP Cybersecurity support services.

A re-competition of the original requirement is ongoing, and the Government is reluctant to introduce a new contractor before the new award.

7. Determination by the ordering activity Contracting Officer that the order represents the best value consistent with FAR 8.404(d).

The Contractor will be requested to provide a quote, and the Contracting Officer (CO) will make a determination that the anticipated costs will be fair and reasonable based on a comparison of proposed prices to the independent government cost estimate (IGCE) and historical prices paid, as provided in the current contract.

8. Description of the market research conducted among schedule holders and the results, or a statement of the reasons market research was not conducted.

To prevent a break in service, this bridge/extension contract was awarded to ensure mission critical support to NIH CIT and other program offices.

The current risk is that many of these applications and software add-ins are not FedRAMP authorized, and ICOs have not been performing security reviews of the potential risk that can be introduced into the environment. As CIT evolves to reach its security and strategic goals, it will need a strong foundation of IT security governance and compliance to connect diverse research communities and promote secure data exchange. Through collaborative teamwork and comprehensive security initiatives the CIT ISP looks towards the challenge of guiding CIT to a consistent and standardized security position for the advancement of NIH and its stakeholders.

This bridge/extension contract award, with the incumbent contractor, Guidehouse Inc., will