JEFO FY25-073 (HART Development)-FE_Redacted.pdf

OPOAM 3016.505-90(a)(2)(ii) Justification for Exception to Fair Opportunity

Exceeding the SAT pursuant to FAR 16.505(b)(2)(ii)(B)

JEFO No.: FY25-073 Rev. 6/2021 - 1 -

JEFO No.: FY25-073

Date: PR Number: RUIM-25-00033

1. Agency and Contracting Activity.

The Department of Homeland Security (DHS), Office of Procurement Operations (OPO), Departmental Operations Acquisition Division I (DOAD I) on behalf of the Office of Biometric Identity Management (OBIM) prepared this justification for an exception to fair opportunity.

2. Nature and/or description of the action being approved.

DHS/OPO intends to award a hybrid labor-hour and time and material task order against the General Services Administration (GSA) Alliant 2 Unrestricted government-wide acquisition contract, 47QTCK18D0003, for Mission Systems Lifecycle Support (MSLS) services without considering other awardees pursuant to FAR 16.505(b)(2)(i)(B) to:

General Dynamics Information Technology, Inc.

3150 Fairview Park Drive, Suite 100 Falls Church, VA 22042-4504

3. A description of the supplies or services required to meet the agency’s need (including the estimated value).

The proposed sole source contract ensures the continuation of mission-critical MSLS services, essential for national security. This contract supports the Homeland Advanced Recognition Technology (HART) program, sustains the legacy Automated Biometric Identification (IDENT) System, and supports the expansion of Biometric Data Sharing Program (BDSP).

OBIM provides enterprise-level biometric identity services to DHS and its components, as well as the U.S. Departments of State, Justice, and Defense; State, local, tribal, and territorial entities;

the Intelligence Community; and international partners. OBIM provides these services today using the legacy IDENT System, the largest biometric system in the Federal government – processing approximately 350,000 transactions daily, and comparing, storing, and sharing information related to the 350(+) million identities in its data stores.

OBIM requires continued services from GDIT to deliver IDENT maintenance releases that address critical break fix issues (system interventions to correct emergent system performance issues), system change requests, domestic and international customer onboardings for existing biometric services, and preventative maintenance to meet customer/stakeholder requirements while ensuring system availability of existing OBIM operational capabilities that provide daily operational support to DHS missions as well as Interagency, International, and other mission

Exceeding the SAT pursuant to FAR 16.505(b)(2)(ii)(B)

JEFO No.: FY25-073 Rev. 6/2021 - 2 -partners. IDENT is the largest biometric system in the U.S. Government – a high volume, enterprise biometric (fingerprint, face, and iris) system with very complex business rules tailored to each of OBIM’s 50+ customer systems. OBIM’s customers, in turn, rely on these services to enable 24 hour/day, 7 day/week operational decision making on decisions that directly affect national security and public safety – from identifying known or suspected terrorists, to supporting enforcement actions, as well as whether to grant or deny benefits such as immigration benefits or trusted traveler status. GDIT leverages their expert knowledge of the IDENT eXchange Message (IXM) formatting and business rules, as well as their expert level knowledge of IDENT’s legacy monolithic code base and its logic to construct a tailored transaction responses for each customer that meets privacy laws that prohibits exposure and protects against violation of confidentiality provisions (e.g., Special Protected Classes such as individuals covered under the Violence Against Women Act (VAWA)) and data sharing agreements between internal DHS components, other U.S. domestic law enforcement entities, and international governments. Through biweekly or every two weeks, IDENT maintenance releases, OBIM provides vital access to enterprise level capabilities used by DHS components (such as CBP, FEMA, ICE, TSA, USCIS, USCG, and USSS), Federal, and International customers/stakeholders as they vet individuals to identify known or suspected terrorists, national security threats, criminals, and watchlist individuals who have violated other laws.

In parallel to providing this sustainment support for IDENT, an expanded Development, Security, and Operations (DevSecOps) skillset is required for the execution of the HART program. The Office of the Chief Information Office’s (OCIO) HART Program Management Office (PMO) is leading the development of the modernized follow-on system, HART. The HART system is nearing its Initial Operational Capability (IOC), when it will replace IDENT as the DHS biometric system of record, enhancing the Department’s biometric comparison, storage, and sharing capabilities with a modernized, cloud-based system. Over the next 18 months, the government will rely upon the GDIT team to complete system development/deployment, operational testing, and transition to the system of record.

OBIM and OCIO/HART PMO require the delivery of uninterrupted, comprehensive DevSecOps support for both the IDENT and HART systems. This includes:

Development of New Capabilities:

o Design, develop, and implement new features for IDENT and HART systems.

o Ensure new capabilities align with stakeholder requirements and mission needs.

System Maintenance and Enhancements:

o Perform adaptive, perfective, corrective, and preventative maintenance.

o Address critical break-fix issues and system change requests.

o Conduct domestic and international customer onboardings for biometric services.

Agile Development, Security, and Operations (DevSecOps) Methodology:

Exceeding the SAT pursuant to FAR 16.505(b)(2)(ii)(B)

JEFO No.: FY25-073 Rev. 6/2021 - 3 -o Utilize Agile methodologies for system lifecycle management. Provide expertise in Agile methodologies and DevSecOps practices.

o Establish sprint teams to execute development lifecycles. Implement iterative design, development, testing, and deployment processes.

Continuous Integration/Continuous Delivery (CI/CD):

o Maintain and improve the HART software development pipeline.

o Automate development, testing, and deployment processes.

o Ensure seamless integration of new features and updates.

Business Rules Management:

o Transform business rules from IDENT to HART using IBM Business Automation Manager Open Editions (BAMOE).

o Ensure business rules are automated and accurate, aligning with privacy and policy constraints.

o Update business rules to reflect changing stakeholder agreements and requirements.

Compliance and Governance:

o Adhere to DHS Acquisition directives and SELC policies.

o Ensure compliance with data sharing agreements and confidentiality provisions.

Stakeholder Support:

o Provide daily operational support to DHS missions and interagency partners.

o Enable 24/7 decision-making capabilities for identifying threats and supporting enforcement actions.

o Maintain system availability and reliability for mission-critical operations.

In addition to HART and IDENT, BDSP is a U.S. foreign assistance program that provides biometric identity management capabilities to help foreign partners manage borders and identify security threats. In early 2023, MSLS re-engineered the BDSP solution, developing a new UBC tool and IRIS backend, now referred to as BDSP 2.0. This updated solution has been deployed in Panama and Costa Rica, with plans for further updates in Mexico and other high-priority countries in 2025 and beyond. MSLS has the institutional knowledge of the technical architecture and business capabilities, providing installation, configuration, software development, and workflow support for foreign partners.

Exceeding the SAT pursuant to FAR 16.505(b)(2)(ii)(B)

JEFO No.: FY25-073 Rev. 6/2021 - 5 -

(RHEL), RedShift, Informatica, and Python. This unique level of expertise enables OBIM to provide 24x7x365 operational biometric support using the legacy IDENT system, while simultaneously enabling OCIO to leverage those skills to finish development, test, and deployment of HART.

Foundational Source of Development Expertise

As a result of their vast experience with the IDENT system and the delivery of enterprise biometric services, GDIT has become the foundational source of development expertise for the HART government/industry team. In 2021, due to increasing government concerns regarding the performance of the previous HART development contractor, the government took over an increasing level of responsibility for serving as the HART system integrator. As part of this effort, the government directed GDIT to take responsibility for two key areas within HART:

Business Rules Automation and the Continuous Integration / Continuous Delivery (CI/CD) Pipeline.

Regarding business rules, GDIT leveraged their deep expertise and intimate knowledge of IDENT and its legacy software implementation of business logic as they transformed the HART excel spreadsheet solution for a business rules management into a modernized, automated RedHat Decision Manager tool solution (now known as IBM Business Automation Manager Open Editions (BAMOE)). Given that these business rules implement the specific privacy and policy constraints that govern how stakeholders share sensitive data, it was imperative that the HART business rules solution be automated, accurate, and consistent with the IDENT implementation. GDIT undertook the effort to analyze the previously delivered business rules – documenting errors and resolving them, thereby reducing this element of HART technical debt, -

- the buildup of work that had resulted from making choices early in the program that prioritized short-term gains over long-term maintainability and quality of software development. The importance of a contractor’s understanding of business rules and their specific technical implementation cannot be overstated. Business rules are the technical implementation of IDENT and HART customers’ data sharing agreements, and these agreements are continuously updated at the request of HART’s business authority and customers/stakeholders. The extensive catalogue of business rules drives complex workflows within the IDENT and HART systems.

GDIT’s expertise with IDENT (and its often-undocumented business logic), and expert knowledge of HART’s new IBM BAMOE solution allow for consistent, accurate, and rapid updates to the business rules. Customer operational needs, presidential priorities and executive orders drive frequent changes to IDENT. Similar rapid, accurate updates must be made to HART as the government is currently executing parallel operations and comparing responses from both systems during operational testing.

Likewise, GDIT leveraged their expert-level experience in release and deployment activities for enterprise-wide biometrics systems as they took responsibility for the maintenance and continued improvement of the HART software development pipeline. In a similar manner to their business rule implementation, they analyzed the current design of the previously delivered pipeline, Exceeding the SAT pursuant to FAR 16.505(b)(2)(ii)(B)

JEFO No.: FY25-073 Rev. 6/2021 - 6 -leveraged their extensive experience in mission critical, enterprise-level software release deployment, identified gaps and defects within the pipeline, then documented and corrected these defects. Additionally, they began the process of automating the development, test, and deployment processes within the pipeline – work that continues today for HART stakeholders.

Transition and Deep System Knowledge

From 2021 through 2023, GDIT used their deep expertise in enterprise-level biometric system software development and deep knowledge of HART’s “IDENT eXchange Message” (IXM)-based business services, to analyze the HART system and identify gaps and defects—adding them to the backlog of technical debt. They were then able to use their expert level of understanding of IDENT and HART stakeholders, and detailed knowledge of customer requirements, service level agreements, biometric service request volumes, and criticality of missions to prioritize the work necessary to address the technical debt. In August 2023, when the previous HART system integrator’s contract ended, it was only GDIT’s years of system-specific expertise that enabled them to assume the role of providing development teams to cover the full scope of HART software development. This prior experience, coupled with knowledge gained through numerous transition sessions with the departing vendor (the original developer) to review existing (and sometimes limited) documentation, and to perform a hands-on analysis of the system, set the GDIT team up for success.

In short, from 2021 through 2023, GDIT used their expert-level knowledge of IDENT, IXM, business rules, customers’ technical requirements and all IDENT/HART biometric modalities to document and resolve large amounts of technical debt, and to begin the process of bringing the HART system into alignment with IDENT. Their deep insight into biometric business workflows and the associated software logic applicable to both HART and IDENT have been the reason that the government has been able to exit the Architecture Refresh phase and resume development.

Mastery in Critical Areas

GDIT has achieved, over the past decade, a mastery level of experience that is vital to developing HART while keeping it in sync with the legacy system, IDENT. They possess unique knowledge of the entire set of complex and highly sensitive business rules and data access security controls that are required to manage data sharing between stakeholders. They possess a deep level of expertise with the IXM specification and how this foundational specification is implemented in both IDENT and HART. They have deep understanding of the operational business workflows that customers depend upon to accomplish their missions – and they fully understand the complex software logic that implements these business workflows in both IDENT and HART (often using different approaches). They have acquired this expertise through a significant amount of hands-on development, test, and troubleshooting over the past 10+ years.

They also have a mastery level of expertise in IDENT and HART data, including interpretation of data, how it works, how data needs to be structured and the linkage between both IDENT and HART’s data and their respective application tiers which is critical to maintaining both systems’ strict performance and SLA requirements. GDIT performs this work today, at an exceptionally high level of skill, with deep understanding of the two entirely different database architectures

Exceeding the SAT pursuant to FAR 16.505(b)(2)(ii)(B)

JEFO No.: FY25-073 Rev. 6/2021 - 7 -and entirely different database technologies. They manage an extremely complex database Extract, Transform, and Load (ETL) process between the two systems’ databases—a process that must be kept in sync to accomplish program objectives.

Continuity and Security

This work must continue uninterrupted, and at the same level of quality, in order to achieve HART IOC and enable the decommissioning of IDENT before the end of FY2026. There is intense budgetary pressure to accomplish HART IOC before the end of FY2026, as pushing IOC into FY2027 would create significant budget ramifications for the Department, causing duplication of costs that would not be able to be recouped through competition. Furthermore, from an operational perspective, the Department seeks to deploy the replacement system into production without delay, such that the Department can then deploy new capabilities for all customers, without having to be concerned about creating a gap between the legacy and replacement systems. Any loss of development velocity or drop in quality/efficiency will jeopardize the achievement of the government’s critical enterprise biometric system objectives.

These two major systems (IDENT and HART) must behave similarly, despite having two entirely different architectures/technical foundations. HART is the replacement system for IDENT. The HART system must provide the capabilities that are provided with in IDENT so that stakeholders do not experience a gap in services. This is critical since many use IDENT and future HART for mission critical operations aligning to administration priorities. GDIT’s deep expertise in both systems, amassed over years of hands-on learning, will remain the key to achieving HART IOC and decommissioning IDENT on schedule and within budget.

Preservation of National Security Objectives:

This work directly supports the HART and IDENT systems. GDIT possesses the previously mentioned unique capabilities and domain-specific expertise that are critical to simultaneously maintaining the operational readiness and effectiveness of both the legacy (IDENT) and modernized (HART) enterprise biometric systems.

GDIT’s expert interpretation of existing business rules, data, and operational workflow logic for stakeholders across IDENT and HART ensures that changes are supported in parallel between both systems. Within IDENT, GDIT rapidly builds out security mitigations, onboardings, business rule changes, defect resolutions, and new capabilities in response to emerging Executive Orders and customer operational requirements. Shortly afterwards, they implement these same changes within HART to ensure consistency and avoid operational gaps.

Parallel Operations is a key activity for HART to assess and validate that both systems provide the same services and data to stakeholders. Therefore, as messages coming in from stakeholders and back out to stakeholders must have consistent data between both systems to ensure that there are no impacts to stakeholder decision making for mission critical operations. This parallel approach ensures that both systems remain aligned and operationally effective, supporting DHS components such as Customs & Border Protection (CBP), Immigration & Customs Enforcement

Exceeding the SAT pursuant to FAR 16.505(b)(2)(ii)(B)

JEFO No.: FY25-073 Rev. 6/2021 - 8 -

(ICE), Transportation Security Administration (TSA), United States Citizenship & Immigration

Services (USCIS), United States Coast Guard (USCG), and United States Secret Service (USSS) in their mission to vet and identify known or suspected terrorists, national security threats, criminals, and individuals on watchlists.

Avoidance of Mission-Impacting Delays:

The urgency of this work, as dictated by national security requirements, precludes the feasibility of transitioning to another contractor at this point in the lifecycle of both programs. Introducing a new contractor would delay project completion for activities including late state Parallel Operations, operational test and evaluation, defect and perfective, corrective, preventative, adaptive development work, and CI/CD Pipeline management and execution of SecDevOps by approximately two years and jeopardize the government’s ability to meet mission requirements (deploy HART, decommission IDENT, continue uninterrupted support for customer operations throughout) due to institutional knowledge for the business logic and technical expertise of both IDENT and HART system components specific to this contractor . This delay would be caused by the entire post-award sequence of events that would be required to bring a new set of 7 contractor development teams up to the point where they would possess even a minimal amount of skill on both systems. Furthermore, the velocity of all teams would drop significantly as the experienced teams are required to divert attention to train up new teams. This decreased level of development velocity would continue for a significant period until they achieved the level of expertise of the incumbent. In summary, these activities include:

Final recruitment actions (especially challenging for subject matter experts such as testers and DevSecOps engineers and personnel security vetting (3 to 6 months) Onboarding to program (PIV cards, email address, receive government IT equipment), Application for and receipt of access to necessary networks/systems; Formation of new dev teams (3-4 months)

Hands-on learning as the government conducts a 4 to 6-month transition effort between the contractors and their teams.

Initial learning curve—Begin process of learning about IDENT and HART’s unique application of technologies; Ramp up to a “Junior” level of competence; Ramp up to a “Senior” level of competence (at least 10+ months) o Note: Initial learning curve can begin while the government conducts the transition but will not truly ramp up in earnest until the incumbent contractor team is gone, and the follow-on contractor team is responsible for development.

Hands-on learning Ramp up to “Expert” level competence (years).

Given the Department’s desire to avoid adding significant capabilities to the legacy system, that would then have to be added to HART prior to IOC (and therefore delaying IOC), any action that delays achievement of HART IOC could result in negative impacts to the DHS components (such as Customs & Border Protection (CBP), Immigration & Customs Enforcement (ICE), Transportation Security Administration (TSA), United States Citizenship & Immigration Services (USCIS), United States Coast Guard (USCG), and United States Secret Service

Exceeding the SAT pursuant to FAR 16.505(b)(2)(ii)(B)

JEFO No.: FY25-073 Rev. 6/2021 - 9 -

(USSS)) ability to vet and identify known or suspected terrorists, national security threats, criminals, and watchlist individuals who have violated other laws. As previously described, DHS components (as well as our DHS mission partners) have a constantly evolving set of missions that require rapidly changing biometric support. As such, the Department seeks to deploy HART into production without delay, such that the Department can then deploy new capabilities for all customers, without having to be concerned about creating a gap between the legacy and replacement systems.

Given that IDENT and HART are unique and highly complex mission-critical enterprise biometric systems supporting national security missions, a new set of development teams without institutional knowledge of the system code baselines and internal components will not be able to support testing and parallel operations with the required HART IOC timeline. A new contract would necessitate a costly and time-intensive transition effort. This transition would occur in the middle of parallel operations and preparations for operational testing, which are critical milestone activities to reach IOC. Refocusing efforts to support the transition would result in reduced throughput and velocity to complete the required development, testing, and remediation activities. This disruption would cause additional HART schedule delays and jeopardize the resolution of any critical IDENT production issues requiring development and testing support for remediation. The HART PMO estimates that this would push HART IOC out into FY2028, with IDENT decommissioning occurring after that—potentially finishing in late FY2028 or early FY2029.

Continuity of secure operations during a time of limited resources and increased focus on government efficiency:

DHS is currently operating both systems under a significant budget shortfall, given that OBIM’s budget is built upon the premise that only one system is operational, when in fact, both IDENT and HART are currently running in parallel. Furthermore, the Federal government’s intense focus on contract cost and efficiency necessitates accomplishment of program objectives in the shortest timeline possible.

As previously described, transitioning from the existing task order to a new task order is expected to cause a two-year delay in the HART schedule for achievement of HART Initial Operational Capability (IOC) and the subsequent decommissioning of IDENT.

Such a delay to the HART program would cause the government to incur a sizeable Operating and Support (O&S) cost for every additional year that IDENT continues to operate in parallel to HART, with a large percentage of that cost front-loaded in each fiscal year. Given the anticipated two-year delay, this would create this additional bill for FY2027 and FY2028. With the previous cost of the IDENT O&M task order at per year and the HART task order at per year, this amounts to a total of for each additional year.

Additionally, the government would require an additional (approximately) to extend the MSLS contract in FY2026. This would be driven by the need for an extension of the MSLS contract for 6 months during new vendor ramp-up , followed by an additional 6-month

Exceeding the SAT pursuant to FAR 16.505(b)(2)(ii)(B)

JEFO No.: FY25-073 Rev. 6/2021 - 10 -period for knowledge transfer While some of this overlap will be required for whatever point the transition happens, a requirement to perform this transition at the beginning of FY2026 will (1) necessitate the requirement to provide support for both IDENT and HART, and (2) force the Department to secure an within the current fiscal year (extremely difficult at this point in FY2025.)

Trusted Relationship and Access to Sensitive Data:

The incumbent contractor has already undergone extensive security vetting and holds the necessary clearances to work with classified or sensitive national security data contained in the IDENT and HART systems. Transitioning to a new set of contractor development teams would require significant time and resources to ensure that all personnel on the new teams are able to adhere to the same security standards, all at a time when the government must remain focused on the dual objectives of continuing to provide uninterrupted support to operational customers with IDENT, while achieving HART IOC in FY2026. After achieving HART IOC, the government will decommission IDENT and its data stores and will turn off data replication between IDENT and HART data stores, thereby significantly reducing the risk of improper handling of sensitive data.

Mitigation of Operational Disruptions and Threats:

Any disruption in the continuity of this work poses a direct threat to meeting the following mission outcomes:

Determination of visa issuance and admissibility into the United States, Establishment of eligibility for immigration benefits, Issuance of credentials (i.e., determine whether an individual should be granted access to a sensitive facility or system), Execution of law enforcement actions with potential homeland security implications, Verification of the identity of persons associated with matters of national security, Conduct of intelligence and trend analyses

5. Determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

The Contracting Officer (CO) will ensure the price is fair and reasonable by comparing the price proposed by the contractor against the Independent Government Cost Estimate (IGCE) and historical prices paid under Task Order No. 70RCSA20FR0000078 for the same services. The historical prices proposed were competed and determined fair and reasonable at the time of award.

Additionally, GSA Alliant 2 Unrestricted has established maximum fully burdened hourly labor rates applicable only to Time-and-Materials and Labor-Hour Task Order Contract Line-Item Numbers (CLINs). As a result, the CO will confirm that the proposed fully burdened hourly labor rates for the labor hour portion of this requirement are at or below the ceiling rates.

Awarding to another vendor would cause undue burdens and excessive costs.

Exceeding the SAT pursuant to FAR 16.505(b)(2)(ii)(B)

JEFO No.: FY25-073 Rev. 6/2021 - 11 -

6. Any other facts supporting the justification.

Task Order 70RCSA20FR0000078 is set to expire at a critical juncture in the Department’s effort to modernize its enterprise-level biometrics identity services program—during operational testing and final preparations to make the HART system ready to deploy as the Department’s biometric system of record. DHS has determined that it is essential to issue a new task order to the only responsible source in order to maintain continuity of operations and transition from IDENT to HART. Continued development lifecycle services from the incumbent service provider are required for the completion and delivery of HART as the replacement for IDENT. The timeline for HART's Initial Operational Capability (IOC) is targeted for no later than FY26Q4, with IDENT decommissioning targeted for FY27Q2. When the existing task order expires on October 31, 2025, there will be less than 12 months to reach the anticipated

HART IOC.

Switching the development vendor at this critical juncture will significantly disrupt and delay the development lifecycle activities necessary to remediate findings identified during operational testing and parallel operations with customers and stakeholders. Both the IDENT and HART systems contain highly complex business rules tailored for each of DHS’s 50+ customers across federal, state, tribal, and international partners. In-depth knowledge of both the IDENT and HART systems is crucial to accelerate the identification and correction of issues to ensure proper operation and performance in the operational environment.

7. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made.

Regarding barriers, from 2023 to 2025, our primary objective has been to achieve HART IOC as quickly as possible to set the conditions for decommissioning IDENT. Given the budget constraints that required supporting only one system at a time, there was a strong emphasis on maintaining development velocity. Consequently, there was limited appetite for onboarding a new development partner as we approached IOC, especially with an experienced team already in place. This approach was consistently supported through departmental working groups, steering committees, and intense Congressional oversight.

Market research was completed, and while other companies could bring valuable capabilities to the marketplace, their strengths are not fully aligned with OBIM’s unique requirements.

OBIM’s needs for scalability, seamless integration with existing systems, compliance with federal standards, and advanced biometric capabilities cannot be fully met by these vendors.

This sole source contract is intended to provide for continuous support through HART Program IOC plus six (6) months. This will provide the time necessary for the Government to transition to a competitively awarded post-IOC contract support structure for HART development and operations and maintenance, where other vendors are suitable.

8. DHS intends to post this requirement, along with a redacted version of this justification, on SAM.gov pursuant to FAR 16.505(b)(2)(ii)(D).