Triple Point Justification_.pdf

Sole Source Justification (SSJ) FAR 8.401 & GSAM/R 538.7104-3(b)(1) (GSAM/R 538.7104-3(b)(1)(iii))

1. Acquisition Title: IT Modernization Support Services Division: Office of the Chief Information Officer (OCIO) Contracting Activity: Specialized Scientific Information Technology (SSIT) Division Author: Christina Yan, COR

2. Nature and/or Description of the Action being Approved:

Office of the Chief Information Officer (OCIO) requests a 12-month firm-fixed-price, sole-source modification extending existing BPA Call 75N92023F00002 under BPA 75N92023A00005 with Triple Point Security, Inc. The task order was competitively awarded on September 20, 2023, under the GSA Multiple Award Schedule (MAS), Highly Adaptive Cybersecurity Services (HACS) framework, and neither the BPA nor the underlying task order has previously been issued using sole-source or limited-sources procedures. This action will modify the existing task order to extend performance from September 20, 2026, through September 19, 2027 .

The acquisition is conducted under the Federal Supply Schedule (FSS) Program using the ordering procedures established by the General Services Administration in GSAM/R subpart 538.71. The Government projects execution of the modification in September 2026 using fiscal year 2026 CIF Cybersecurity Funding, identified by the program office as one-year FY2026 appropriations.

BPA Period of Performance and Planned Action: Parent BPA 75N92023A00005 is an 8(a) BPA awarded on February 20, 2023, with a five-year ordering period and a period of performance from February 21, 2023, through February 20, 2028. The proposed 12-month extension of Task Order 75N92023F00002, from September 20, 2026, through September 19, 2027, falls entirely within the existing BPA ordering/performance period. Accordingly, no extension of the BPA ordering period is required for this action. The extension approach has been reviewed and vetted by the BPA administering Contracting Officer.

BPA Ceiling and Capacity: BPA 75N92023A00005 has a ceiling value of $47,500,000.00 and a current total value of $37,447,996.59. The proposed modification will increase Task Order 75N92023F00002 by $1,542,774.16, from a current task-order value of $14,475,229.15 to a new total task-order value of $16,018,003.31. After the proposed task-order increase, the cumulative BPA value will be $38,990,770.75, leaving $8,509,229.25 in remaining BPA ceiling capacity. Therefore, the proposed extension fits within the existing BPA ceiling, and no increase to the BPA ceiling is required or contemplated as part of this action.

the Phase 2 implementation contractor(s) can execute against the revised roadmap and methodology; and Maintain Federal ZTA policy alignment and maturity tracking during the extension period and transition residual PMO functions and institutional knowledge to NIH staff and/or the Phase 2 implementation team.

This 12-month extension of Task Order 75N92023F00002 is not intended to cover the full three-year Phase 2 ZTA implementation effort. It is limited to the period necessary to preserve continuity, re-engineer the Phase 1 methodology for centralized governance, establish and operate the IT Centralization Portfolio Management PMO framework, maintain program controls, and complete an orderly knowledge transfer to the separately competed implementation effort.

Parent BPA 75N92023A00005 is an 8(a) BPA awarded on February 20, 2023, with a five-year ordering period from February 21, 2023, through February 20, 2028. Task Order 75N92023F00002 was competitively awarded to Triple Point Security, Inc. on September 20, 2023. The task order contains a base period from September 20, 2023, through September 19, 2024, Option Period 1 from September 20, 2024, through September 19, 2025, and Option Period 2 from September 20, 2025, through September 19, 2026. The total task-order value for the base and two option periods is $14,475,229.15. The proposed extension remains within both the existing BPA ordering period and the existing $47,500,000.00 BPA ceiling.

The proposed modification extends Task Order 75N92023F00002 for 12 months, from September 20, 2026, through September 19, 2027. The extension will provide PMO, governance, roadmap re-engineering, program-control, policy-alignment, coordination, and transition support related to NIH IT centralization and Phase 2 ZTA. It will not perform the separately competed Phase 2 implementation work.

4. Authority Cited and Rationale: Authority of the FSS Program, Title III of the Federal Property and Administrative Services Act of 1949 (41 U.S.C. 251, et seq.); Title 40 U.S.C. 501, Services for Executive Agencies, as implemented at FAR 8.401 and GSAM/R 538.7104-3(b)(1).

c. GSAM/R 538.7104-3(b)(1)(iii)- The order should be issued on a sole source basis in the interest of economy and efficiency because it is a logical follow-on to an FSS order already issued on a competitive basis.

The logical-follow-on conditions are satisfied. Task Order 75N92023F00002 was placed competitively on September 20, 2023, under the GSA HACS/MAS framework using parent 8(a) BPA 75N92023A00005, and no prior sole-source or limited-sources justification has been identified for this task order. The proposed 12-month modification continues the same NIH-specific Phase 1 roadmap, target-state architectures, sequencing logic, risk registers, dashboards, governance artifacts, stakeholder framework, and decision history produced and maintained under the competitively awarded task order. The extension therefore continues the same program-management and roadmap baseline rather than creating a new, independent requirement. The proposed extension also falls within the BPA's existing five-year ordering period and available ceiling capacity.

The restriction is based on economy and efficiency as a logical follow-on, not on a finding that the broader market lacks general ZTA or cybersecurity PMO capability. Market research recognizes that other Schedule contractors can provide ZTA, cybersecurity program-management, and IT-governance services in general.

The material distinction is that the 12-month extension must immediately re-engineer the NIH-specific Phase 1 baseline already developed under Task Order 75N92023F00002. Requiring a replacement contractor to reconstruct and validate that baseline before productive re-engineering could begin would duplicate work and cost already incurred and would consume a material portion of the limited 12-month extension period.

The proposed extension is a direct and logical continuation of work performed by Triple Point Security, Inc.

under Task Order 75N92023F00002. During Phase 1 of the NIH ZTA initiative (Tasks 3-5 of the current SOW), Triple Point:

Developed NIH's comprehensive three-year ZTA cybersecurity program charter and plan;

Conducted gap analyses and developed target state architectures for NIH Institutes, Centers, and Offices (ICOs);

Designed the ZTA implementation roadmap and engagement plans for both individual ICOs and NIH enterprise IT solutions; and

Established the program management framework, risk tracking dashboards, and stakeholder engagement structure currently in use.

The institutional knowledge required for this extension is embedded not only in completed documents, but also in the rationale underlying architectural choices, sequencing decisions, unresolved dependencies, risk treatments, stakeholder positions, and governance decisions developed during Phase 1. The Government is not relying on incumbent status alone. The efficiency case rests on the extension's immediate dependency on the NIH-specific Phase 1 baseline that Triple Point developed and currently maintains, and on the duplication and delay associated with reconstructing that baseline before productive re-engineering can begin.

The centralization change requires continuity under the existing task order: the original ZTA roadmap was architected around NIH's decentralized IT model, in which each ICO independently managed infrastructure and security posture. NIH's transition to centralized IT governance materially changes the roadmap assumptions. Moving the PMO function to another contractor at this point would require that contractor to reconstruct the Phase 1 decision history, validate existing artifacts, re-establish stakeholder context, and learn dependencies among ICOs and enterprise services. The acquisition package estimates that this transition could consume approximately three to six months of the 12-month extension. Based on the Government's 12-month estimated extension value of $1,542,774.16, three to six months represents approximately $385,694 to $771,387 in equivalent performance value. Not all of this amount would necessarily constitute duplicative cost; however, a substantial portion of the transition effort would be devoted to reconstructing and validating Phase 1 artifacts, decision history, dependencies, stakeholder context, and program controls already developed under the existing task order. This would duplicate Government effort and cost, compress the remaining productive performance window, and increase the risk that Phase 2 begins without a centralization-aligned roadmap and governance framework.

The continuity need is tied to specific Government deliverables and program controls, including the Phase 1 roadmap, target-state architectures, sequencing logic, risk registers, dashboards, stakeholder engagement history, governance artifacts, and the assumptions and decisions underlying those products.

Those items are the starting point for the extension effort. The proposed modification does not ask Triple Point to begin a new implementation effort; it extends the incumbent's existing task order so the contractor can revise and transition the same technical and program-management baseline it created under the original competitive award in response to NIH's subsequent shift to centralized IT governance.

The Government is actively promoting competition: the full Phase 2 ZTA implementation effort - a three-year, multi-ICO effort representing the substantial majority of remaining ZTA implementation work - is being separately competed under GSA HACS small business procedures, with award anticipated by September 30, 2026. The 12-month extension is intentionally limited to PMO, governance, roadmap re-engineering, coordination, knowledge-transfer, Federal policy-alignment, and transition functions. Triple Point will not perform the separately competed Phase 2 implementation work under this modification and will not direct, supervise, or evaluate the Phase 2 contractor(s).

Consequences of a break in PMO services or transition to a new PMO vendor:

Loss of Institutional Knowledge: A replacement vendor would need to reconstruct the architectural rationale, program assumptions, dependencies, risk history, stakeholder context, and governance decisions underlying the Phase 1 roadmap before it could perform productive extension work.

Program Delay and Cost Duplication: Transition-in, validation, and reconstruction of accepted Phase 1 work would consume a substantial portion of the extension period and duplicate Government cost without advancing the requirement. The acquisition package estimates a three-to-six-month transition burden for a replacement PMO vendor. Based on the $1,542,774.16 12-month estimated extension value, this represents approximately $385,694 to $771,387 in equivalent performance value. This range is provided as an estimate of the value of the performance period potentially consumed by transition and reconstruction and should not be interpreted as a finding that every dollar in that range would be duplicative cost.

Risk to the Centralization Initiative: A lapse in PMO continuity could leave NIH without a coherent governance and decision framework while OCIO is actively transitioning enterprise IT responsibilities to the centralized operating model.

Phase 2 Coordination Risk: The Phase 2 implementation contractor(s) will require the revised roadmap, methodology, governance framework, and knowledge-transfer package at the outset of performance. Delay or discontinuity in the extension would increase Phase 2 startup and alignment risk.

Compliance and Security Risk: A disruption in ZTA program governance could delay NIH progress toward applicable Federal ZTA, FISMA, CISA, NIST, and related cybersecurity policy objectives, while also disrupting risk tracking, stakeholder reporting, and other program controls.

5. Market Research:

Market research was conducted in accordance with RFO FAR 10.001. The Government reviewed the GSA HACS/MAS contractor pool, relevant Government acquisition information, historical performance and cost information, transition requirements, and the availability of vendors capable of providing ZTA, cybersecurity program-management, and IT-governance services. The research confirmed that the market broadly contains vendors capable of performing general ZTA and cybersecurity PMO services. The distinguishing feature of this extension is its immediate dependency on the NIH-specific Phase 1 technical and program-management baseline that must be re-engineered for the centralized IT operating model.

The Government determined that another qualified schedule contractor could ultimately perform general ZTA PMO work; however, competition for this narrow, time-limited extension would not eliminate the transition burden. A new PMO vendor would need to reconstruct and validate the Phase 1 context before productive re-engineering could begin, consuming an estimated three to six months of the 12-month extension period and creating duplicative cost, compressed performance time, and schedule risk. The Government therefore concluded that restricting consideration for this one-time extension is justified in the interest of economy and efficiency while the substantially larger Phase 2 implementation effort proceeds competitively.

The market-research conclusion is therefore not that competition is impossible or that only Triple Point possesses general technical capability. Rather, for this narrowly bounded extension, competition would not eliminate the incumbent-specific transition burden. The acquisition record estimates that a replacement PMO vendor would require approximately three to six months to reconstruct Phase 1 context before becoming fully productive. Against a 12-month extension, that transition would consume a substantial portion of the period intended for roadmap re-engineering, governance stand-up, Phase 2 coordination, and knowledge transfer, while duplicating Government expenditures without advancing those outcomes.

In accordance with GSAM/R 538.7104-3(b)(3), the approved Sole Source Justification will be made publicly available on SAM.gov, the Government-wide Point of Entry (GPE), within 14 days after award/execution of the modification and will remain publicly available for a minimum of 30 days. Before posting, the Contracting Officer will review the justification and remove contractor proprietary data and any other information exempt from public disclosure, as applicable.

6. Procurement history:

a. Contractor: Triple Point Security, Inc Contract or Order Number: 75N92023A00005/75N92023F00002

Award Date and Period of Performance: September 2023 PoP: Base Period: 9/20/2023 – 9/19/2024

Optional Period 1: 9/20/2024 – 9/19/2025 Optional Period 2: 9/20/2025 – 9/19/2026

Value (including all options): $14,475,229.15 Competitive Status: Task Order 75N92023F00002 was competitively awarded on September 20, 2023, under the GSA HACS/MAS framework. No prior sole-source or limited-sources justification has been identified for this call. BPA Call 75N92023F00002 was competitively awarded; therefore, no prior noncompetitive authority is being carried forward for this BPA Call.

The procurement history therefore establishes a competitive lineage for the logical-follow-on authority: Task Order 75N92023F00002 was competitively placed in September 2023 under parent 8(a) BPA 75N92023A00005, the base period and two option periods run continuously through September 19, 2026, and no prior sole-source or limited-sources justification has been identified for the task order. The proposed extension begins immediately after the current task order expires, remains within the BPA period of performance and ceiling, and is limited to the continuity work necessary to revise and transition the incumbent-developed Phase 1 baseline.

7. Actions to Foster Competition for Future, Similar Requirements:

This modification is a one-time, 12-month extension of existing Task Order 75N92023F00002. NIH will not use this justification to extend the task order beyond September 19, 2027, without a new acquisition determination and any justification required by the applicable ordering procedures. The Phase 2 ZTA implementation effort has been structured as a separate competitive GSA HACS small business acquisition, with award anticipated by September 30, 2026. The extension scope is intentionally bounded, so implementation work remains outside this sole-source action.

The extension deliverables require structured documentation, knowledge transfer, updated governance artifacts, revised roadmap and methodology products, risk/program-control documentation, and transition support so NIH staff and/or the competitively selected Phase 2 contractor(s) are positioned to assume residual program-management functions. NIH OCIO will continue to monitor the market and structure future ZTA and cybersecurity program-management acquisitions to maximize competition to the extent practicable.

These transition deliverables are intended to reduce the incumbent-specific knowledge barrier that supports this one-time action. By requiring the revised roadmap, methodology, governance artifacts, risk/program-control documentation, and structured knowledge-transfer package to be documented and transferred, NIH will place the Government and the competitively selected Phase 2 contractor(s) in a better position to perform future program-management functions without dependence on undocumented incumbent knowledge. This directly addresses the condition that makes the present logical follow-on more efficient than an immediate PMO transition.

8. Additional Information or Other Facts:

The Phase 2 ZTA implementation work - representing the substantial majority of remaining ZTA implementation effort and investment - is being competed separately under GSA HACS small business