Login.gov NIST 800-63 Revision 4 Kantara Identity Assurance Program

Assessment and Trust Mark Services

Justification for Other than Full and Open Competition

(JOFOC)

IAW FAR 6.104(GSA Class Deviation RFO-2025-6) Justification and

Approval

Identification of the Agency and Contracting Activity U.S. General Services Administration (GSA) Federal Acquisition Service (FAS) Technology Transformation Services (TTS), Technology Acquisition Division (Tech Acq) 1800 F Street NW Washington, DC 20405

Nature of the Action Being Approved Modification P00007 to Contract No. 47QPCA24P0001 adds National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63 Revision 4 Kantara Initiative, Inc. (Kantara) assessment and Trust Mark services to support Login.gov's Rev. 4 Kantara certification. The Rev. 4 Trust Mark services fall within the general scope of the original contract; the Rev. 4 assessment services do not.

This justification addresses the out-of-scope addition of the Rev. 4 assessment services, added on a sole-source basis in accordance with the Only One Responsible Source authority at FAR 6.103-1(GSA Class Deviation RFO-2025-6).

Docusign Envelope ID: 5C18F64B-F889-85AB-8170-179488186EFC

CUI

Description of the Supplies/Services Required to Meet the Agency's Needs Login.gov is a shared authentication platform providing the public secure access to participating Government services, established at NIST SP 800-63 Identity Assurance and Authentication Assurance Levels. Login.gov participates in the Kantara Identity Assurance Program as a Credential Service Provider (CSP): a trusted entity that issues or registers user authenticators and issues electronic credentials to users.

NIST SP 800-63 establishes the federal digital identity guidelines for identity proofing, authentication, and federation. Kantara’s Identity Assurance Framework and Identity Assurance Approval Process provide a federally recognized conformity assessment mechanism to evaluate whether a CSP’s covered services conform to those NIST guidelines.

NIST released SP 800-63 Rev. 4 in July 2025, with Rev. 3 superseded as of 08/01/2025. OMB Circular A-130 requires federal agencies to meet the requirements of, and be in compliance with, NIST standards and guidelines within one year of their respective publication dates. CSPs seeking to obtain or maintain Kantara Trust Mark certification for SP 800-63-4 must undergo a conformity assessment under Kantara’s Identity Assurance Framework and Identity Assurance Approval Process. A Kantara-Accredited Assessor prepares an assessment report for Kantara review; upon acceptance through Kantara’s Assurance Review Board process, Kantara grants Approval, issues the Kantara Trust Mark, and lists the approved service on Kantara’s Trust Status List.

The resulting Kantara Trust Mark, and the corresponding listing on Kantara's Trust Status List, provide an independently reviewed, publicly verifiable demonstration that a CSP's identity proofing, credential management, and authentication services conform to NIST SP 800-63-4. Although the Trust Mark is issued by Kantara rather than by NIST or OMB, it carries particular significance for federal relying parties:

Kantara was historically approved as a Trust Framework Provider under GSA's Federal Identity, Credential, and Access Management (FICAM) program, and its certifications provide trusted assurance of conformance to NIST digital identity standards (as further detailed in the Contractor's Unique Qualifications section below).

The original contract was awarded to Kantara on a sole-source basis for Trust Mark services supporting Login.gov's participation in the Kantara Identity Assurance Program. This modification adds both the Rev. 4 Trust Mark services, which fall within the general scope of the original contract, and the Rev. 4 conformity assessment services, which do not. This justification addresses the out-of-scope Rev. 4 assessment services.

The total value of this modification is $319,111.00, increasing the total contract value to $377,111.00. The added services will be performed within the current Option Period 2 period of performance, 10/26/2025 through 10/25/2026.

Statutory Authority This action is conducted under simplified acquisition procedures for commercial services (41 U.S.C. 1901). Because the purchase is being made on a sole-source basis, 41 U.S.C. 1901(e)(2) requires that the sole-source justification be made in writing and approved in accordance with 41 U.S.C. 3304(e). The authority for this sole source is 41 U.S.C. 3304(a)(1) and FAR 6.103-1(GSA Class Deviation RFO-2025-6) — Only One Responsible Source: the services required by the agency are available from only one responsible source, and no other type of services will satisfy the agency's requirements.

Contractor’s Unique Qualifications Kantara is uniquely qualified because it operates a trust-framework certification scheme that evolved from the Government's own digital identity landscape. This history gives its Trust Mark particular significance for federal agencies.

In 2011, under GSA's FICAM Trust Framework Solutions program, the Government approved multiple Trust Framework Providers (TFP), including InCommon LLC, Kantara, Open Identity Exchange (OIX) Corporation, and SAFE-BioPharma Association, to assess and recognize CSPs against federal identity assurance standards.

The relevant market has changed significantly since 2011. Market research indicates that the other historical Trust Framework Providers no longer provide a current, comparable NIST SP 800-63-4 certification pathway:

● Open Identity Exchange (OIX) ceased its U.S. operations in 2024.

● SAFE-BioPharma was acquired in 2019 and folded into its successor's operations, which focuses on digital-certificate technology; it no longer operates as an independent Trust Framework Provider.

● InCommon now operates an education and research federation assurance framework that maps to NIST standards rather than issuing a NIST SP 800-63 conformance certification.

Kantara is the only historical TFP provider identified as having maintained and updated its certification program through the evolution of NIST SP 800-63.

Kantara's current program is a comprehensive certification scheme where Kantara owns the criteria, accredits assessors, requires independent assessment from accredited assessors, reviews results, issues its proprietary certification, and maintains the publicly available certification list. While accredited assessors perform the assessment fieldwork, they operate exclusively within Kantara's scheme and cannot independently grant Kantara-certified status.

As a result of this legacy standing as the sole surviving federally recognized provider, federal agencies rely on the Kantara certification as trusted, independent assurance that CSPs conform to NIST SP 800-63 standards. This certification is a critical component of Login.gov's ability to demonstrate conformance to its agency partners and their oversight bodies.

Kantara has recently restructured its Identity Assurance Program. Beginning calendar year 2026, entities seeking Kantara certification must obtain the required assessment services directly through Kantara; the accredited assessors that perform the underlying fieldwork now operate exclusively under Kantara's direct contract and can no longer be engaged independently. The Rev. 4 Trust Mark services added by this modification fall within the general scope of the original contract, which was already awarded and justified as a sole source to Kantara. The Rev. 4 assessment services are the out-of-scope component this justification addresses, and Kantara is the only responsible source from which they can be obtained.

Efforts to Solicit Offers The Government determined that soliciting additional sources would not result in competition because the required Rev. 4 assessment services must be obtained through Kantara. Under Kantara's restructured Identity Assurance Program, entities seeking Kantara certification must contract for the required assessment services directly through Kantara rather than separately contracting with an accredited assessor.

In accordance with FAR 5.101(GSA Class Deviation RFO-2025-5), FAR 5.201(GSA Class Deviation RFO-2025-5), and FAR 12.202(GSA Class Deviation RFO-2025-12), the Government posted a notice of the proposed sole-source modification to sam.gov on 07/08/2026, for a response period of 10 calendar days. No responses were received by the response deadline.

This outcome mirrors the original contract award, which was publicized twice:

through the notice of intent to sole source and the combined synopsis/solicitation that followed. Neither announcement drew interest from alternative sources or any indication of capability. The consistent absence of engagement across multiple publications supports the determination that Kantara is the only responsible source.

Determination that the Anticipated Cost will be Fair and Reasonable.

The Contracting Officer has determined the total modification value of $319,111.00 to be fair and reasonable.

This determination is based on a price analysis conducted in accordance with FAR 15.404-1(GSA Class Deviation RFO-2025-15). Price reasonableness was established through multiple techniques, including comparison of prices obtained through market research, and a comparison to the contractor's uniform, published commercial rates. The Government also considered data submitted by the contractor supporting its pricing structure.

The Government requested price reductions, which the contractor declined, citing its uniform rate structure and its obligations as a conformity assessment body under

ISO/IEC 17065.

Market Research Conducted and Results.

Market research included an examination of the history of the federal identity trust-framework landscape and the current marketplace for NIST SP 800-63 Revision 4 certification services. The Government also posted a notice of the proposed sole-source modification to SAM.gov on 07/08/2026. The results of these efforts are detailed in the ‘Contractor's Unique Qualifications’ and ‘Efforts to Solicit Offers’ sections above.

Other Facts Not applicable.

Sources that Expressed an Interest in the Acquisition.

No other sources expressed interest in this acquisition. The notice posted to sam.gov on 07/08/2026 received no responses by the response deadline.

Actions to Overcome Any Barriers to Competition.

Kantara owns and operates the Identity Assurance Program, controls the applicable assessment criteria and approval process, accredits the assessors within its scheme, and solely issues the Trust Mark. Under Kantara's restructured program, the required Rev. 4 assessment services must be obtained directly through Kantara.

No other source can provide the required assessment pathway.

For future acquisitions, the Government will monitor the digital identity certification marketplace to determine whether other recognized conformity assessment or certification programs become available that satisfy Login.gov's requirements.

Certifications Technical requirements certification I hereby certify that the supporting data provided, which form the basis for the JOFOC, are accurate and complete to the best of my knowledge and belief.

Michelle Roberts, Acquisition Project Manager/COR

GSA/FAS/TTS

Approving Official Contracting Officer Certification I hereby certify that the JOFOC is accurate and complete to the best of my knowledge and belief.

Jonah Jordan, Contracting Officer

GSA/FAS/TTS

7/22/2026 | 19:22:41 BST

7/23/2026 | 14:12:53 BST