Justification for FPKIMA _FY24_Redacted.pdf

U.S. General Services Administration

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

FAR 16.505(b)(2)(i)(B)

1. Agency and Contracting Activity

This requirement is in support of the General Services Administration (GSA), Federal Acquisition Service (FAS) Office of Information Technology Category (ITC) Identity, Credential & Access Management Division, USAccess Managed Service Office (MSO) 1800 F Street, NW Washington, D.C. 20405. The contracting activity is Office of Enterprise Telecommunications Solutions Acquisition (QT2F3BBB), 1800 F Street NW, Washington, DC 20405.

2. Nature and/or description of the action being approved.

a. Type of action: This procurement is an Alliant 2 Governmentwide Acquisition Contract (GWAC) order for services. The order will be issued under General Dynamic Information Technology’s (GDIT) Alliant 2 GWAC, 47QTCK18D0003.

This Justification for an Exception to Fair Opportunity contains information regarding the Management Services Office’s (MSO) intention to restrict consideration to one awardee per FAR 16.505(b)(2)(i)(B). A combination firm-fixed price and time-and-materials task order will be issued.

b. Amount the current LSJ is justifying:

The estimated value of this order, for the base and all option period is:

Period From To Base and Options Potential Value

Base (5 months) 1 May 2024 30 Sept 2024

Option 1 (12 Months) 1 Oct 2024 30 Sept 2025

Option to Extend Services

1 Oct 2025 31 March 2026

Continuity of Services

(COS)

Estimated Total Contract Value

$13,658,798.72

3. A complete description of the supplies and/or services required to meet the agency’s needs.

This acquisition is for the Federal Public Key Infrastructure Management Authority (FPKIMA) Technical Support & Operations for the Federal Public Key Infrastructure. The FPKIMA is the backbone for identity management throughout the Federal Government and business partners.

This acquisition will provide GSA with the technical and operational services to assist the FPKI Program in maintaining the FPKI infrastructure. Support includes issuance and revocation of trusted digital certificates from the infrastructure to federal agencies enabling secured access into information systems and Federal buildings. Additionally, key services include technical and security management of the Federal Bridge Certification Authority (FBCA), which supports secured cross-organizational communications and the Common Policy Certification Authority (FCPCA), which supports the Personal Identity Verification (PIV) cards.

A core part of the contractor’s duties is assisting the FPKI Program in renewing its Authority to Operate (ATO). An ATO is a security controls assessment conducted to determine the level of risk associated with operating the system and the effectiveness of the system’s security controls in satisfying the security requirements of the system.

Security controls are safeguards put in place to protect the infrastructure’s confidentiality, integrity, and availability.

Like all other federal systems, the FPKIMA must perform an ATO every three years. The FPKIMA’s ATOs are granted by the GSA Information Systems Security Manager (ISSM).

The program is currently operating under an ATO that expires on April 30, 2024.

Preparation and execution of the assessment takes approximately two years to complete and requires active support by the contractor throughout all stages of the process.

Preparation includes not only ensuring up to 300 security controls are in place but are also properly documented. Assessment includes an intense evaluation of the system’s security controls by a third-party assessor (3PAO), who then documents any findings.

During post assessment, the contractor must provide mitigation strategies for each finding documented by the 3PAO, who then validates the proposed mitigation strategies.

Another FPKIMA project currently underway and requiring contractor support is the creation of the Public Trust Transport Layer Security (TLS) Root and Certificate Authorities (CAs). This project, which is in its planning and development phase, will be critical in securing public-facing government web sites and applications. The target market for this service is all federal civilian agency web servers. Currently, agencies must purchase or otherwise procure web server digital certificates from commercial

“Source Selection Information-See FAR 2.101 and 3.104” vendors, resulting in cost, complexity, and security impacts. The Public Trust TLS project will offer agencies a federal alternative. Supported by the U.S. Office of Management and Business (OMB) and the Chief Information Officers (CIO) Council and requested by agencies, it is a high priority for FPKIMA.

4. The authority and supporting rationale (see 16.505(b)(2) and, if applicable, a demonstration of the proposed contractor’s unique qualifications to provide the required supply or service.

FAR 16.505(b)(2)(i)(B): Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

a. The incumbent contractor, GDIT, is currently assisting FPKIMA with the ATO renewal process. Planning and preparation for the renewal began in March 2022.

b. Due to the technical complexities and interdependencies involved, changing contractors during the ATO renewal process would pose an unacceptable risk to the Government. A new contractor would face a steep learning curve, requiring time to familiarize itself with GSA’s ATO processes and expectations, as well as the security of the infrastructure. The resulting delays and potential errors could jeopardize timely ATO renewal. Onboarding a new contractor would also cause a substantial duplication of cost to the Government that is not expected to be recovered through competition.

c. Should the FPKIMA’s ATO not be renewed on schedule, the FPKIMA would not be allowed to operate, resulting in a lapse in service that would be catastrophic not only for GSA but also for the over 130 agencies and mission partners that depend on this service. Millions of federal employees and contractors would be unable to perform daily tasks via PIV cards to include logical and physical access, encrypt emails, digitally sign documents, secure communications, etc..

d. As the incumbent contractor, GDIT has completed three of the FPKIMA’s prior ATOs. It is intimately familiar with security of the infrastructure as well as GSA’s ATO processes and expectations. Awarding a bridge contract (task order) to GDIT will allow it to continue working on the renewal and greatly minimize the risk to the Government.

e. Additionally, the planning and development phase of the Public Trust TLS project, which GDIT is also assisting with, should not be interrupted. As this is a heavily anticipated project the FPKIMA must demonstrate progress to federal civilian agencies as well as OMB and the CIO Council. The FPKIMA requires GDIT to complete the planning and development phase by providing essential documentation to include resources needed and architecture design.

f. As well, GDIT is currently the only vendor with intimate knowledge and experience with the FPKI Trust Infrastructure, which includes the root certificate authority (CA), backbone to the entire Federal government. The root CA is the top hierarchy of the FPKI ecosystem. Currently, the available vendors do not have FPKI Trust Infrastructure experience at this level. However, in the future recompete, the team plans on opening competition to vendors with general PKI knowledge with the intent of training any new incoming vendor on the FPKI Trust Infrastructure and FPKI-specific policies and procedures.

g. Accordingly, the benefit of allowing GDIT to continue working on ATO renewal and the Public Trust TLS project under a short-term sole-source bridge contract (task order) outweighs any benefits that might accrue from a competition held during the same time window.

5. A demonstration by the ordering activity- Contracting Officer- that the anticipated cost to the Government will be fair and reasonable.

The Government has determined that awarding a task order to GDIT for the required FPKI support services represents the best value and results in the lowest overall cost alternative (considering price, special features, administrative costs, etc.) to meet the Government’s needs. The Government anticipates awarding a sole source task order based on an evaluation of technical capability and a fair and reasonable price.

In accordance with FAR 15.404, price analysis shall be utilized. The CO will consider the level of effort and the mix of labor quoted for this task order, as well as the reasonableness of the overall price.

Price analysis will be determined through comparison of the proposed price quote received to the Independent Government Cost Estimate (IGCE), Alliant 2 pricing and historical pricing. The task order will only be awarded upon the Contracting Officer’s determination that the price is valid, consistent with the prices included in the Contractor’s schedule contract and is reasonable.

6. Any other facts supporting the justification.

Market research was conducted during September through December 2023 and included reviewing all current acquisition strategies and possible vendors available to FPKIMA.The market research confirmed that the requirement calls for highly specialized, niche skills and capabilities, such that the offeror pool is quite small. The Alliant GWAC, under which the incumbent task order was placed, has only one vendor with both PKI and Federal PKI experience – GDIT (following a series of mergers and acquisitions involving FPKIMA’s previous contractor, SRA International, Inc., with the surviving entity being acquired by GDIT in 2018). The Alliant GWAC contract has expired and the ordering period ended on April 30, 2019, therefore a logical follow-on cannot be conducted. However, a justification is being utilized to issue a task order under the Alliant 2 GWAC.

7. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led exception to fair opportunity before any subsequent acquisition for the supplies or services is made.

GSA FPKIMA is limiting this task order to a base period of five months plus one twelve-month option period in order to allow for completion of the ATO and TLS project previously described. This is the shortest possible time frame to complete the ATO process and implement the TLS project.

A competitive re-procurement will be conducted in FY25. Planning for the recompete will begin immediately upon ATO renewal. The FPKIMA will work to engage industry to assess their level of interest and ability in providing the necessary FPKI technical support services. The period of performance of the recompeted contract will be adjusted so as to allow sufficient time both for a competition to replace it upon its expiration and for the next ATO renewal date, thereby avoiding a need for another noncompetitive bridge contract in the future. Additionally, for the future recompete, the requirements will be reframed from specifically Federal to general PKI knowledge, which will allow for more open competition.

Program/Technical Certification and Approval

I hereby certify and accept the responsibility that any and all supporting data provided above or used to justify the above requested for a sole source procurement (e.g., verifying the Government’s minimum needs, schedule requirements, and/or other rationale for other than full and open competition) is accurate and complete to the best of my personal knowledge and belief:

Jeffrey Voiner, Contracting Officer Representative Date

Contracting Officer’s Certification

I hereby certify that the information contained in this Justification for Other than Full and Open Competition, is accurate and complete to the best of my knowledge.

Deborah Aubert, Contracting Officer Date

One Level Above Contracting Officer’s Review and Approval

I hereby certify that the information contained in this Justification for Other than Full and Open Competition, is accurate and complete to the best of my knowledge.

Everlean Rutherford, Branch Chief Date

Competition Advocate: In accordance with FAR 16.505(b)(2)(C)(2), for proposed orders exceeding $750,000, but not exceeding $15 million.

I certify and approve that this justification is accurate and complete to the best of my knowledge and belief.

Marquita Washington, Competition Advocate Date