LSJ CSRM Program.docx

LIMITED SOURCE JUSTIFICATION (LSJ)

1. IDENTIFICATION OF AGENCY AND CONTRACTING ACTIVITY

Agency: Social Security Administration (SSA)

Contracting Office: Office of the Deputy Commissioner for Budget, Finance, and Management (DCBFM) Office of Acquisition and Grants (OAG) Office of Information Technology Acquisition (OITA) Division of Program Contracts (DPC)

Contracting Officer (CO): Brenda Monch

Contracting Officer’s

APP Tracking Information: OCIO-25-021B0

2. NATURE AND/OR DESCRIPTION OF ACTION BEING APPROVED

Type of Action:

New award

· Modification of existing award

· Contemplated Contract Type:

· Firm-Fixed-Price

· Time and Materials/Labor Hour

· Cost-Reimbursement

· Combination We seek approval of a LSJ to issue a 12-month logical follow on task order to the following mission-critical cybersecurity risk management program services call order:

Call Order 28321323FA0010092 – Integrated organization-wide cyber security risk management (CSRM) program to allow line leaders through senior executives to prioritize risk and make solid risk-based decisions.

This call order was issued under SAAS Blanket Purchase Agreement number 28321319A0040007 with Deloitte consulting LLP, which has since expired, for a period of performance from 02/15/2023 through 2/14/2025. We seek approval of a 12-month follow on task order under Deloitte Consulting’s GSA schedule.

3. DESCRIPTION OF SERVICES REQUIRED TO MEET AGENCY NEEDS AND ESTIMATED VALUE

The cybersecurity risk management process is guided by the Federal Information Security Modernization Act (FISMA) of 2014, which along with Executive Order 13800, empowers the Commissioner with the authority and accountability for information security and cyber risk management.

Our integrated organization-wide cyber security risk management (CSRM) program enables line leaders through senior executives to prioritize risk and make solid risk-based decisions. The agency continues to build upon it current foundational CSRM program towards FISMA Level 4 maturity. In FY23 and FY24 the SSA Inspector General (IG) audited SSA and concluded that SSA’s cyber security risk management strategy was insufficient. Additionally, we determined that the scope and maturity of the existing strategy needs further maturing to manage cyber risks in a comprehensive manner to prioritize cyber risks and enable informed risk-based decisions at the enterprise level.

An effective CSRM Project Management Office (PMO) function is crucial to the success of SSA managing its cyber security risk. Cybersecurity risk is spread throughout the agency and not solely based on system assessments. Unlike point in time assessments, cybersecurity threats are constantly changing, and new threat actors are appearing on a regular basis. Organization-level and mission/business-level cyber risks must also be considered, and along with system-level risks, integrated with the Agency’s Enterprise Risk Management Program.

Cybersecurity risk management is necessary as the alternative is crisis management. Cyber risk data will be better utilized to enable resource allocation and budget appropriately across a portfolio of cybersecurity risks to the Agency.

At the current time, OIS relies on the contracted assessor expertise to provide expert guidance and execution of a FISMA Level 4 maturity CSRM Program. Under the current call order, the contractor must provide industry knowledge not currently available with the SSA federal workforce.

Total Estimated Value: ~$615,825.00 Description of Services: This follow-on task order will provide the Government with continued subject matter expertise to mature and maintain the cybersecurity risk management program to enable line leaders through senior executives to prioritize risk and make solid risk-based decisions in accordance with NIST guidance to meet FISMA and Executive Order 13800 requirements.

4. AUTHORITY AND JUSTIFICATION RATIONALE

41 U.S.C. § 152(3), et seq., and 41 U.S.C. § 501 as implemented by the Multiple Award Schedule Program, and under the procedures of the Federal Acquisition Regulation (FAR) Subsection 8.405-6 “Federal Supply Schedules-- Limiting Sources.” Specifically, FAR 8.405-6 provides that orders placed under Federal Supply Schedules (FSS) are exempt from the competition requirements in Part 6 of the FAR. However, we are further restricting consideration pursuant to the following authority:

FAR 8.405-6(a)(1)(i)(C) – In the interest of economy and efficiency, the new work is a logical follow-on to an original Federal Supply Schedule order provided that the original order was placed in accordance with the applicable Federal Supply Schedule ordering procedures. The original order or BPA must not have been previously issued under sole-source or limited-sources procedures.

This order would be a follow-on to call order 28321323FA0010092 which was awarded to Deloitte Consulting through Blanket Purchase Agreement (BPA) number 28321319A0040007. The call order is set to expire on 2/14/2025 and the BPA has already expired. This task order would be to continue the work done under the referenced call order. The call order was awarded on a competitive basis. Two quotations were initially received. Deloitte was found to represent the best value and was ultimately awarded call order 28321323FA0010092.

This action constitutes a logical follow on in that the work is a continuation the work under the prior call order and it would be both more economical and efficient to continue work under this authority. Having to re-compete this action would not be efficient in that a new contractor would need to go through the costly and time consuming process of suitability and laptop distribution. Additionally, a new contractor would also have a learning curve that would take time to overcome. Additionally, any potentials for a significant disruption in service poses additional security risk to the agency. These assessments identify security risks that allow stakeholders to focus on remediation activities that can prevent numerous issues or attacks. Without the continued maturation of the Cybersecurity Risk Management Program, the agency could experience significant negative impact in many areas including the following:

1) Failure to achieve FISMA level 4 maturity;

2) FISMA audit findings due to lack of compliance; and

3) Lack of informed risk decisions leading to crisis management and misallocation of budget and resources..

5. DETERMINATION OF BEST VALUE

As provided in FAR 8.404(d), the General Services Administration (GSA) has already determined the prices offered for supplies and fixed-price services and rates for services offered at hourly rates under schedule contracts to be fair and reasonable. By placing an order against a schedule contract using the procedures in FAR 8.405, the CO has concluded that the order represents the best value and results in the lowest overall cost alternative to meet the Government’s needs.

Regardless, before making any award, the CO will verify that all services proposed are currently available on the GSA schedule and offered at or below the current approved GSA hourly rates.

6. MARKET RESEARCH CONDUCTED

OAG is not required to synopsize the requirement on the System for Award Management (SAM) Contracting Opportunities page, as GSA contracts are considered to have already undergone the posting requirements listed under FAR Part 5.

Deloitte Consulting received BPA awards as well as a call order award following a competitive process, and as such, they are qualified to continue services under FAR 8.405-6(a)(1)(i)(C). As mentioned above, The BPA that call order 28321323FA0010092 was awarded against has since expired. No market research is necessary.

7. OTHER SUPPORTING FACTS

GSA has completed a determination of responsibility at the GSA Schedule contract level and maintains that ordering agencies are not required to conduct it at the order level. However, because Deloitte Consulting are currently performing these services, SSA possesses first-hand knowledge that past performance has been satisfactory at minimum.

Regardless, prior to issuing new award and in accordance with FAR 4.1102, 4.1201, and 9.401, the CO will examine the System for Award Management and make an affirmative determination of the contractors’ responsibility.

8. REMOVING OR OVERCOMING BARRIERS

OIS and OAG are currently working to award new BPAs following multiple award schedule competitive procedures, which will result in competitive call order awards moving forward.

9. RECOMMENDATION OF THE COR AND CONCURRENCE OF THE PROGRAM OFFICIALS

The contracting officer and other contracting officials hereby certify that the information provided in support of this limited sources justification is accurate and complete to the best of their knowledge and belief.

Contracting Officer’s Representative (COR) – certification pending Office of Information Security (OIS) Office of the Associate Commissioner (OAC)

Office of the Associate Commissioner (OAC)

10. CERTIFICATION BY THE CONTRACTING OFFICER AND OTHER CONTRACTING OFFICIALS

RECOMMEND:

Contract Specialist

OAG/OITA/DPC

Division Director / Contracting Officer OAG/OITA/DPC

Office Director OAG/OITA image2.png image3.jpeg image1.png