MCS 2.5 JEFO - 70RTAC21FR0000096 - final redacted.pdf

Justification for Exception to Fair Opportunity Exceeding the SAT pursuant to FAR 16.505(b)(2)(i)(B)

JEFO No.: FY21-00232 - 1 -

JEFO No.: FY21-00232

Date: 08/04/2021 PR Number: RUIO-21-S0114

1. Agency and Contracting Activity.

The Department of Homeland Security (DHS), Office of Procurement Operations (OPO), Information Technology Acquisition Center (ITAC), prepared this justification for an exception to fair opportunity.

2. Nature and/or description of the action being approved.

DHS/OPO intends to award a task order without considering other awardees under the General Services Administration (GSA) Governmentwide Acquisition Contract (GWAC) Alliant 2 Indefinite-Delivery Indefinite-Quantity (IDIQ) contract # 47QTCK18D0030 pursuant to Federal Acquisition Regulation (FAR) subpart16.505(b)(2)(i)(B), only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

The proposed contractor to perform the services is listed below:

Perspecta Enterprise Solutions, LLC (Perspecta) 15050 Conference Center Dr.

Chantilly VA 20151 to Perspecta

3. A description of the supplies or services required to meet the agency’s need (including the estimated value).

The contractor shall support the U.S. Department of Homeland Security (DHS) Headquarters (HQ) Office of Chief Officer (OCIO), Chief Information Security Officer Division (CISOD) by providing key security services to the DHS Enterprise as well as to the Management (MGMT) portfolio of systems and security engineering services. These services include Information System Security Officer (ISSO), risk management services, and assessments of the security posture of systems. The services are typically performed on systems within defined Federal Information Security Modernization Act (FISMA) boundaries and may be required by DHS Policy 4300A/B. Tasks that form part of these services include the following:

• ISSO support services to develop, support, and maintain the appropriate operational security posture for assigned information security systems and/or programs.

• Independent Assessment support, including personnel to assess information systems or organizations for compliance with defined performance measures, development of annual performance plans, assess and measure maturation of cybersecurity, operation of tools, development of products, training, and management of the compliance portfolio.

JEFO No.: FY21-00232 - 2 -

• Enterprise Risk Management support, including service desk incident handling, cybersecurity training and knowledgebase management, customer outreach, security analysts for Plans of Action & Milestones (POA&Ms), document review, security authorization programs, risk reporting, and common controls oversight support. Also required for systems support are database administration and application development support.

• Management Risk Management Support, including component cybersecurity training and component information security program support for security authorizations, ongoing authorizations, and POA&M management.

• Security Engineer support services to enable the Information Technology office to rapidly respond to the growing security tool portfolio and all DHS HQ FISMA system to Network Operations Security Center (NOSC) Tools and the infrastructure that supports the NOSC Tools.

The total estimated value for this procurement including all options is indicated below.

Ordering Period Length Estimated Cost Base Period 3 Months $8,149,008.83 Option Period 1 3 Months $8,149,008.83 Option Period 2 3 Months $8,149,008.83 Total Value Including All Options 9 Months $24,447,026.49

4. Identify the exception to fair opportunity and supporting rationale, including a demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the exception cited.

This acquisition is being conducted pursuant FAR subpart 16.505(b)(2)(i)(B), only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

Perspecta currently provides ISSO, assessments support, compliance, security engineering support, and risk management services to the DHS Enterprise and MGMT Portfolio of systems under task order 70RTAC18FR0000048 (MCS 2.0). The ordering period of this task order ends on September 5, 2021. ISSO and Risk Management and Assessments support services are being recompeted under the General Services Administration (GSA) Highly Adaptive Cybersecurity Services (HACS) Women-Owned Small business (WOSB) socio-economic category. It is anticipated that two Blanket Purchase Agreements (BPAs), one for ISSO support and one for Risk Management and Assessments Support, will be awarded in August 2021. Perspecta is the only source that can provide these high specialize services with this short timeframe. Also, the DHS HQ Entry on Duty (EOD) process to adjudicate access to DHS systems and facilities can take on average between 30 to 180 days depending on the clearance level. The security clearance level for contractor personnel under for the new BPAs is Top-Secret. The long lead time involved with bringing on new resources poses significant risks to the confidentiality, integrity, and availability of mission-critical IT systems. For instance, every federal IT system

JEFO No.: FY21-00232 - 3 -requires the appointment of an ISSO. Most systems under the DHS HQ Portfolio are serviced by ISSOs that are sourced under the current task order. The ISSO serves as the primary point of contact for all security matters related to the assigned system. A gap in ISSO services could result in that system losing its ability to remain operational due to the lack of oversight to ensure security risk are being addressed in a timely fashion. The assessment schedule for systems under the DHS HQ portfolio will be also impacted, assessments cannot occur without the support of contractor assessors’ personnel. IT systems will be at risk of losing their Authorization to Operate (ATO) because the lack of ISSO support to maintain security documentation and the overall security posture of the system and lack of assessors to conduct security assessments. This will introduce an unnecessary and unacceptable level of risk to the DHS HQ Portfolio of IT systems and it will negatively impact the Department’s Federal Information System Management Act (FISMA) Scorecard. In addition, the lack of contractor personnel for compliance and assessment support will affect the current migration effort to transfer management of IT systems to the Cyber Security Assessment and Management (CSAM) tool which is expected to be completed by the end of this fiscal year. Although there are several qualified government personnel to manage this work, the sheer magnitude of activities is beyond the scope of what can be handled by the existing federal staff personnel.

This interim sole source task order is the only option available to continue service delivery to customers by ensuring compliance with Federal, DHS, OCIO policies, regulations, and directives within the IT infrastructure. This action will permit the implementation of best practices that reduce and manage operational and informational risk while the new competitive procurements are solicited, evaluated, and awarded. In addition, this interim action will allow transition time from the incumbent vendor to the new BPA awardees.

5. Determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

The Contracting Officer has determined that the anticipated prices for the proposed requirement are fair and reasonable based on the vendor’s GSA Alliant 2 contract. The task order will be place in accordance with FAR 16.505, orders under indefinite-delivery contracts. GSA has already negotiated fair and reasonable prices for the services on the vendor’s GSA schedule contract. Discounts to the GSA schedule rates will be requested. The level of effort and the mix of labor proposed to perform the specific tasks being ordered will be considered in order to determine the total price reasonable. The contractor’s labor mix and level of effort will also be compared to the independent government cost estimate.

6. Any other facts supporting the justification.

Any interruption or lapses regarding the current security services provided under the task order may introduce unacceptable risks. For instance, security assessments and authorization services on average take 6 to 9 months to complete. Any interruptions to the security assessment process can set back any prior work that has already been completed under the task order. The security services performed under the current task order depend on a continuum that should not be broken.

JEFO No.: FY21-00232 - 4 -

7. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made.

The recompete of this requirement is currently in progress and it is anticipated that two Blanket Purchase Agreements (BPAs), one for ISSO support services and one for Risk Management and Assessment support services, will be awarded in August 2021. These services are being recompeted under the GSA HACS Women-Owned Small Business (WOSB) socio-economic category.

8. DHS intends to post this requirement on Sam.gov pursuant to FAR 16.505(b)(2)(ii)(D).

9. Technical/Requirements Personnel Certification.

Pursuant to FAR 16.505(b)(2)(ii)(B)(9), I certify that this requirement meets the Government’s minimum need and that the supporting data, which form a basis for the justification, are accurate and complete.

All below listed Signatures have been Redacted – G.R.

Joan De Jesus Technical Representative/COR

10. Contracting Officer Certification and Approval

Pursuant to FAR 16.505(b)(2)(ii)(B)(8), I certify that this justification is accurate and complete to the best of my knowledge and belief.

Gregory Ruderman Contracting Officer

11. Approval.

I hereby determine that the circumstance in FAR 16.505(b)(2)(i)(B) applies.

Juan Arratia Procuring Activity Advocate for Competition Office of Procurement Operations

Victoria Short Head of Contracting Activity Office of Procurement Operations