JEFO_CIT_InformationSecurity_Redacted.pdf

Justification for an Exception to Fair Opportunity Page 1 of 10

Justification for Exception to Fair Opportunity

�Source Selection Information� � see FAR 2.101 and 3.104.�

Identification of the agency and contracting activity.

Federal agency and contracting activity.

Department of Health and Human Services (HHS) Office of Acquisitions, National Institute of Child Health and Human Development

(NICHD)

Sponsoring organization.

National Institute of Health (NIH) Center for Information Technology (CIT) Information Security Program (ISP)

Contracting Officer�s Representative (COR) Information.

Nature and/or description of the action being approved.

Acquisition purpose and objectives.

The objective of this requirement is for NIH to professional support services that will assist Institutes, Centers, and Offices (ICOs) of NIH in institutionalizing cyber-security practices and procedures that meet Federal Standards, Regulations, and Policies, that are strategically aligned with NIH business needs.

Justification for an Exception to Fair Opportunity Page 2 of 10

b. Project background.

Protecting the National Institutes of Health (NIH)�s information and systems is one of the most important technological challenges facing the organization today.

Within the Office of the Director (OD), the Center for Information Technology (CIT) and the Office of the Chief Information Officer (OCIO), work together under the same leadership to keep NIH secure and able to operate. While the OCIO oversees NIH Information Technology (IT) governance, policies, assessments, and information security, CIT provides the infrastructure, operations, and services needed to achieve a secure IT environment for NIH enterprise IT services.

CIT�s approach to cyber security has historically been tactical and reactive. In 2019, the Government shifted to a more strategic and proactive approach to improve its� cybersecurity position and reduce risk. The CIT Information Security Program (ISP) was created to lead these efforts.

The CIT ISP is an important effort to CIT�s approach for cybersecurity, providing governance, support to reduce risk, improve visibility, promote secure enterprise architecture, and strengthen protections across CIT and NIH. The CIT ISP establishes security priorities for the Task Areas and supports them by defining security policy, standards on security controls and compliance, reporting progress on key metrics, and providing guidance on Infosec practices. Key metrics include but not limited to: HHS, NIH, GAO, and other regulatory requirements that may change frequently and must be prioritized among other tasks (e.g., vulnerabilities, incidents, ticket management, exceptions/waivers, plan of action & milestones). As CIT evolves to reach its security and strategic goals, it will need a strong foundation of IT security governance and compliance to connect diverse research communities and promote secure data exchange. Through collaborative teamwork and comprehensive security initiatives the CIT ISP looks towards the challenge of guiding CIT to a consistent and standardized security position for the advancement of NIH and its stakeholders.

The current contract is an ISP support contract to Guidehouse Incorporated (Inc.)

under Contract No. HHSN316201200040W, Award No. 75N97 on a sole source basis. Th original contract (HHSN316201200040W / 75N97 F0000 )

Justification for an Exception to Fair Opportunity Page 3 of 10 was competitively awarded to Guidehouse through NITAAC CIO-SP3 under Task Area 2 (Chief Information Officer (CIO) Support) and Task Area 6 (Integration Services) as a competitive follow-on. t was competed under unrestricted (full and open competition) with a period of performance from 09/29/2021 � 09/28/2024.

A new contract was awarded on 09/29/25, HHSN316201200040W 75N97A25F10001 was issued for two (2) months, extending support through 11/28/2025. This extend the work through 11/28/2026.

Description of the supplies or services required to meet the agency�s needs (including the estimated value).

Project Title. CIT Information Security Program (ISP) Order for Cybersecurity and OM Support, including Risk Management Framework (RMF) and Cybersecurity Operations Support Services.

Project description. The CIT Chief Information Security Officer (CISO) is charged with establishing policy and reviews that ensure the safeguarding of NIH information and systems. To meet the ever-changing needs of IT services, CIT�s ISP looks to expand and continuously improve its� current functions into a strong cyber risk management program by ensuring compliance with Federal and Agency regulations and policies. Additionally, the NIMHD program staff require contractor personnel to provide security support. CIT ISP�s vision is to use a multifaceted approach that considers people, processes, and technology through a mission-focused lens that addresses the needs of NIH ICOs while protecting research, assets, and data. A key component is a strong security operations program that helps identify risks day to day and focuses on improving cyber hygiene across CIT � including its cloud infrastructure. CIT, as the primary provider of enterprise services across NIH, plays a pivotal role, and ISP, in its capacity to bolster CIT's security function, has a widespread impact throughout NIH. ISP contributes to securing various enterprise tools and services, including Network Services, ICAM

, Hosting, Data Center, Cloud and Collaboration tools.

NIMHD contractor support was originally approved and provided through competitive award to Guidehouse (HHSN316201200040W / 75N97021F00002).

This continued support was inadvertently not included in the der award to Guidehouse LLC. However, the NIMHD program needs to update the necessary system and security requirements as delineated in the HHS Policy for IT System Inventory Management (document # HHS-OCIO-OES-2024-11-007).

Therefore, this JEFO is addressing this oversight by adding this work back into the Order.

Justification for an Exception to Fair Opportunity Page 4 of 10

The recently released November 2024 policy (HHS-OCIO-OES-2024-11-007) was not in place prior to the ISP base award; therefore, NIMHD is requesting incorporation of this requirement and reactivation of ISP support through this JEFO within the current exercised Option Period 1 of the ISP award under Guidehouse LLP contract (HHSN316201200040W / 75N97024F00001).

The HHS policy requires all operational entities to perform security assessments, which are an essential part of complying with the HHS policy and for reporting on critical vulnerabilities. The NIMHD is deficient in identifying and implementing appropriate security Standards for the rollout of Microsoft 365 and other software tools. The Policy requires assessing the existing applications and software added in NIH M365 Tenant and perform security impact analysis to identify insecure products posing risk to NIH. From the assessments, identify if there are secure equivalent vendor products to substitute or at minimum identify the compensating controls that can limit risk if the software is mission essential.

Also, from the Policy there are ancillary requirement for assessing and reporting potential cyber risks are needed for NIMHD to maintain its Authority to Operate (ATO). This also requires the Contractor to:

Develop Plans for Data Calls and provide the coordination . This requires developing inquiries and working with system teams to ensure essential information is collected and properly relayed to the HHS/Office of Chief Information Officer (OCIO).

Provide waiver management support for vulnerabilities and threats in the IRT Portal, and among necessary POCs & NIMHD Federal Leadership. The contractor also performs quality assurance, vulnerability management, agent installation and ri -based review on the many different waiver types (e.g., firewall, risk mitigation, end-of-life, & general policy).

Develop the ATO artifacts including System Security Plan, Incident Response Plan, Privacy Impact Analysis, and Contingency Plan for NIMHD platform.

Enter the system information into the NIH CSAM system.

Perform Security Control Assessments to assess the NIST 800-53 Rev 5 control implementation as part of the annual FISMA control assessments requirements.

Provide a Security Assessment Plan at the start of the assessment period and Security Assessment Report at end of testing identifying any weaknesses from testing.

Justification for an Exception to Fair Opportunity Page 7 of 10

Name and address of the proposed contractor(s)

Guidehouse Inc

Nature of the acquisition and proposed contractor(s) unique qualifications.

The nature of this acquisition is to modify and extend the current order. This action will allow for continuity of services. Guidehouse Inc. is the incumbent and has been providing these services since , wo

(2) month rder (9/29/25 � 11/28/25). Because of Guidehouse�s Inc.�s unique qualifications gained through performance of this contract, utilizing another contractor, to perform the same services at the same high-level of performance for this interim 12-month extension, would not be cost effective, as the new contractor would need at least 3-months to become productive at the levels required. These qualifications and gained experience include Guidehouse�s Inc. development of expertise in support of CIT ISP�s cybersecurity efforts including operation and maintenance (OM), vulnerability management, risk management support. Guidehouse Inc. has built a strong rapport which would be impossible to duplicate in 12 months.

Therefore, any lack or delay in service would create serious consequences for the CIT ISP Cybersecurity services.

etermination by the Contracting Officer that the consistent with FAR .

The Contractor will be requested to provide a quote, and the Contracting Officer (CO) will make a determination that the anticipated costs will be fair and reasonable based on a comparison of proposed prices to the independent government cost estimate (IGCE) and historical prices paid, as provided in the current contract. Additionally, this modification will not award higher rates than the already determined fair and reasonable prices of their Government Wide Acquisition Contract through NITAAC.

Justification for an Exception to Fair Opportunity Page 8 of 10