Justification_Redacted.pdf

Version 12/27/18

Department of Transportation Federal Highway Administration (FHWA)

Information Technology (IT) Acquisition Center of Excellence (ACE)

SOLE SOURCE JUSTIFICATION

LOGICAL FOLLOW-ON

ORDER NO. 693JJ320A000018_693JJ323F00304N

The Department of Transportation (DOT) makes this Justification for orders pursuant to Federal Acquisition Regulation (FAR) 8.401(b) and GSAR 538.7104-3(b)(2).

i.) Identification of Agency and Contracting Activity:

Program Office:

DOT, Office of the Secretary (OST) Office of the Chief Information Officer (OCIO) 1200 New Jersey Avenue, SE Washington, D.C. 20590

Contracting Activity:

Federal Highway Administration (FHWA)

IT ACE

1200 New Jersey Avenue, SE Washington, D.C. 20590 ii.) Nature and/or Description of Action Being Approved:

The OCIO has a need to extend the cybersecurity management support services under Cyber Security Information & Program Services (CSIPS) Blanket Purchase Agreement (BPA) Order 693JJ320A000018_693JJ323F00304N awarded to Ernst and Young to support OST's penetration testing activity. The Order currently expires on 9/28/2026 and this request is to extend current levels of support for an additional five (5) months (through 2/28/27). An extension is needed while DOT goes through the process of restructuring the Department’s information technology workforce and determines whether this support can be reduced or fully assumed by Federal employees.

iii.) A Complete Description of Supplies/Services Required to Meet Agency’s Need:

This task order provides specific technical and professional services for Penetration Testing of DOT infrastructure, application, and information systems. The Penetration Testing support provides mission essential cybersecurity services, including determination and evaluation of risk and vulnerabilities in support of the Risk Reduction mandates in Binding Operational Directive (BOD) 16-04, other BODs, and Federal Information Security Management Act (FISMA) compliance and reporting. Additionally, the contractor supports DOT prioritization of vulnerabilities and non-compliance with Office of Management and Budget (OMB) and FISMA Directives, impacting enterprise cyber readiness and operational integrity; and supports, operates, and maintains DOT cybersecurity Red Team, Purple Team, and Blue Team penetration testing missions.

This effort is required in accordance with OMB Memorandum 21-31 Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents in conjunction with Execution Order (EO) 14028, Improving the Nation's Cybersecurity, to ensure functional capabilities are enabled and operational supporting visibility for the DOT Cybersecurity posture.

This effort is of paramount importance during the ongoing IT modernization throughout the Federal government to increase the sharing of such information, as needed and appropriate, and to enable more effective defense for DOT Networks, information systems, and applications.

Ernst & Young LLP provides critical support to comply with the cybersecurity and privacy requirements, including identifying associated risks and impacts and prioritizing alternatives. Additionally, Ernst & Young is on track developing automation to provide efficient security posture reporting and prioritization of cybersecurity weaknesses remediations and is developing modernization plans for risk management modernization, leveraging artificial intelligence (AI), and verifying effectiveness of compliance activities.

DOT is developing suitable strategies with the application managers and infrastructure leaders on cybersecurity matters, developing audit recommendations for tactical implementation, and reducing costs to ensure information systems hardening, data protection, and mission resiliency.

The proposed modification P00004 to order 693JJ320A000018_693JJ323F00304N will extend the order by five (5) additional months through 2/28/27 at an anticipated value of iv.) The Authority and Supporting Rationale:

This Justification is prepared as required by FAR 8.401(b) and GSAR 538.7104- 3(b)(1)(iii). The applicable rationale for the sole source for this action is:

The order should be issued on a sole source basis in the interest of economy and efficiency because it is a logical follow-on to an FSS order already issued on a competitive basis.

The original acquisition was conducted as a competitive call order under the multiple-award Cyber Security Information & Program Services (CSIPS) BPAs issued against the General Services Administration (GSA) Multiple Award Schedule (MAS).

Ernst &Young has a management and subject matter team in place already providing these same services and is familiar with the DOT environment. Over the span of this engagement, DOT has improved its cybersecurity posture and validated compliance contributing to the Department’s Cybersecurity FISMA performance goals. Additionally, this team has provided the necessary hardening to DOT infrastructure and applications by considering the risk by changing the order to firm fixed price. The Government determines the total price to be fair and reasonable.

vi.) Description of the Market Research Conducted Among Schedule Holders and the Results of the Research:

No formal market research was conducted at the modification level as the initial order was awarded competitively among the multiple-award CSIPS BPA 693JJ320A000018 that was issued against GSA Schedule GS-00F-290CA. Moreover, the purpose of this extension is to provide continuity of services while DOT is working on the recompete for this requirement.

vii.) Any Other Facts Supporting the Justification:

N/A.

viii.) Statement of the Actions the Agency May Take to Remove or Overcome any Barriers that Led to the Restricted Consideration Before Any Subsequent Acquisition for the Supplies or Services is Made:

OCIO is currently developing a new contract to meet the requirements for cybersecurity support. This effort underway would enable OCIO to continue services while the new contract effort is finalized and awarded.

ix.) Contracting Officer Certification that the Justification is Accurate and Complete to the Best of the Contracting Officer’s Knowledge and Belief:

The Contracting Officer’s signature on the Approvals Signature Page constitutes a certification that the justification is accurate and complete to the best of the Contracting Officer’s knowledge and belief.

x.) Evidence that any supporting data that is the responsibility of technical or requirements personnel (e.g., verifying the Government’s minimum needs or requirements or other rationale for sole source) and which form a basis for the justification have been certified as complete and accurate by the technical or requirements personnel:

The technical personnel’s signature on the Approvals Signature Page constitutes a certification that this justification is complete and accurate to the best of the technical personnel’s knowledge and belief.

xi.) Written Determination by the Approving Official(s):

Supporting data provided by technical or requirements personnel has been certified as complete and accurate as demonstrated by reasonable technical review and adherence to current task order rates.