JEFO_CyHy FY26-0049 _Redacted.pdf

HSAM 3016.507-6

JUSTIFICATION FOR EXCEPTION TO FAIR OPPORTUNITY

EXCEEDING THE SIMPLIFIED ACQUISITION THRESHOLD

JEFO No. FY26-00026 - 1 -

JEFO No.: FY26-0049 PR Number: PCCS-26-40001

1. Agency and Contracting Activity.

The Department of Homeland Security (DHS), Cybersecurity and Infrastructure Security Agency (CISA), Chief of Contracting Office (COCO) prepared this justification for an exception to fair opportunity.

2. Nature and/or description of the action being approved.

This Justification for an Exception to Fair Opportunity is prepared in accordance with Federal Acquisition Regulation (FAR) 16.507-6(d)(2), FAR Class Deviation 26-04, Revision 1 for FAR Part 16.1

3. A description of the supplies or services required to meet the agency’s need (including the estimated value).

The CISA Cybersecurity Division, Vulnerability Management sub-division requires continued Cyber Hygiene (CyHy) services that aid in strengthening the cybersecurity posture, limiting exposure, and reducing exploitation rates for over 12,500 customers across the Federal Civilian Executive Branch, State, Local, Tribal, and Territorial Governments, and Critical Infrastructure entities, and which provide multiple types of vulnerability scanning.

These services are highly specialized cybersecurity services aligned to modernized and automated scanning services and assessments, which enable CISA to defend the nation against rapidly evolving threats. Scanning services are scalable products where the Government delivers proactive products that evaluate an organization’s cybersecurity posture as well as provide support on improving exposed vulnerabilities. The first type of scanning service includes Vulnerability Scanning (VS) which is where CyHy Services scans for and reports on vulnerabilities that are detectable from outside an organization's network (IP-based). The second kind of scanning service provided is Web Application Scanning (WAS). This scanning service assesses the “health” of publicly available accessible web applications by checking for known vulnerabilities and weak configurations. Finally, Posture and Exposure services are provided.

Posture and Exposure services use open-source data from both freely available and/or vendor supplied data feeds to provide actionable reports to CyHy stakeholders.

1 FAR Class Deviation 26-04, Revision 1 for FAR Part 16 was issued as part of the Revolutionary FAR Overhaul (RFO), which was implemented in response to Executive Order 14275, Restoring Common Sense to Federal Procurement, signed April 15, 2025. Any subsequent citations to FAR Part 16 in this document will be cited as “RFO FAR” for brevity, and are referring specifically to FAR Class Deviation 26-04, Revision 1 for FAR Part 16.

JEFO No. FY26-00026 - 2 -

The period of performance will be March 30, 2026 through March 29, 2027. The total estimated value is .

4. Identify the exception to fair opportunity and supporting rationale, including a demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the exception cited.

Pursuant to RFO FAR 16.507-6(b)(3), The order must be issued on a sole-source basis in the interest of economy and efficiency because it is a logical follow-on to an order already issued under the contract, where all awardees were given a fair opportunity to be considered for the original order.

Rationale:

The incumbent Contractor, NTT Data Services Federal Government, LLC (NTT Data) is currently performing services under task order 70RCSA20FR0000133, which is scheduled to end on March 29, 2026. The task order was competitively awarded to the incumbent on September 30, 2020 against the General Services Administration (GSA) Alliant 2 Unrestricted procurement vehicle.

NTT Data is the only vendor that can ensure continued critical services to prevent disruption of services to CISA and its customers until the competitive award in FY27 and transition of services to a new Contractor2. NTT Data currently: (1) provides monitoring and response capabilities to the nation’s most critical entities; (2) delivers services to the ~12,500 CISA customers enrolled in Vulnerability Scanning, Web Application Scanning, and Posture & Exposure; (3) onboards new customers into these services and supports modernization and efficiency efforts; and (4) supports CISA’s ability to support the following direction: National Vulnerability Incident Response; National Cybersecurity Strategy’s Strategic Objective 1.5;

Supporting the Federal Civilian Executive Branch’s compliance with mission Binding Operational Directives, including: 22-01 (replaced 18-01) - Reducing the Significant Risk of Known Exploited Vulnerabilities, 23-01--- Improving Asset Visibility and Vulnerability Detection on Federal Networks, and 23-02--- Mitigating the Risk from Internet-Exposed Management Interface.

Continued support is essential. To solicit other sources at this time would result in schedule delays, performance disruption of critical security services, and unnecessary cost inefficiencies to the Government. A new competitive procurement could take up to 12 months before an award is made. This would delay performance, disrupt mission critical services and increase administrative costs to the Government. If a new vendor is awarded this effort there could be further disruption of services up to 4 months long while CISA clears the new contractor staff to

2 Market research is being conducted in anticipation of a competitive award in FY27. Early findings demonstrate that there are multiple companies on the GSA Alliant 2 Unrestricted Government Wide Acquisition Contract that can support the requirement. GSA Alliant 2 is a mandatory strategic sourcing vehicle (SSV).

JEFO No. FY26-00026 - 3 -on-board. For example, the average security entry on duty (EOD) timelines for CISA are between 69 and 120 days for the types of support needed on the current task order. The follow-on work must be performed immediately upon completion of the current task order to ensure continuity of operations and avoid a disruption of critical security services. NTT Data has unique knowledge and expertise with the current phase of the program that no other vendor possesses. A different vendor would have to work to catch up in order to become familiar with the services and perform the follow-on which would result in a substantial increase to program costs. The added administrative and performance cost as well as performance risk at this time dimmish economy and efficiency to the Government, making the short-term logical follow-on necessary.

5. Determination by the Contracting Officer that the anticipated cost to the Government will be fair and reasonable.

Pursuant to RFO FAR 16.506(f), if the service prices were not established at the IDIQ level, then the Contracting Officer must establish prices for the order using the policies and methods in RFO FAR subpart 15.4. The Contracting Officer anticipates a fair and reasonable price will be achieved based on using the rates established by the GSA Alliant 2 GWAC, consideration of historical pricing, and comparison of the labor mix and level of effort to the Independent Government Cost Estimate (IGCE).

6. Any other facts supporting the justification.

None at this time.

7. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made.

CISA continues to monitor the commercial marketplace and conduct market research. Award of a short-term task order to NTT Data will allow continued CyHy support while a competitive procurement is underway and will prevent the cessation of these highly specialized services in support of mission critical activities. The estimated award date is in Q2 Fiscal Year 2027. CISA intends to post the approved justification on www.sam.gov pursuant to RFO FAR 16.507-6(f)(1).

8. Technical/Requirements Personnel Certification.

Pursuant to RFO FAR 16.507-6(d)(2)(ix), I certify that this requirement meets the Government’s minimum need and that the supporting data, which form a basis for the justification, are accurate and complete.

Contracting Officer’s Representative