P00033_47QFMA21F0040_EFO_For Posting_2025-08-25.pdf

CUI//SP-SSEL

Version 02/28/2025 Page 1

JUSTIFICATION FOR AN EXCEPTION

TO FAIR OPPORTUNITY

UNDER INDEFINITE

DELIVERY/INDEFINITE QUANTITY

(IDIQ) CONTRACTS

Solicitation 47QFMA21F0040

Risk Management Framework (RMF) Assess and Authorize/Cybersecurity Safety

(CYBERSAFE)

in support of:

Naval Facilities Engineering Systems Command (NAVFAC)

United States (U.S.) General Services Administration (GSA) Federal Acquisition Service

Assisted Acquisition Services (AAS) Army

Interagency Agreement Number 47QFMA20S0008

Controlled by AAS Contracting Officer (Jon Woloszyn): (Jon.Woloszyn@gsa.gov)

Version 02/28/2025 Page 4 defense critical infrastructure such as HVAC, electrical grids, water treatment, physical security, and communications networks across Navy installations. These systems are urity measures to prevent potential cyber threats, system disruptions, and unauthorized access.

-FRCS could compromise this critical infrastructure, thereby derailing mission critical operations, including disruption to the warfigh supply chain.

Deloitte is the only source capable of providing the services at the level of quality required because these services are unique and highly specialized. For example, FRCS cybersecurity support services require integration of heavily customized COTS components with proprietary cybersecurity hardening. This is a unique security architecture that requires deep understanding of both the original commercial architecture and the specific modifications implemented. Another unique component includes the Proprietary Behavioral Analytics Engine. The defensive cybersecurity capabilities utilize custom-coded algorithms for behavioral pattern recognition that would require reverse-engineering and extensive documentation review for a new contractor to understand and maintain. This requirement also incorporates Automated Audit Log Integration. The specialized audit log review system requires knowledge of custom data parsing protocols, alert thresholds, and response procedures that are unique to this implementation.

Due to the high complexity of the FRCS it is estimated that it would take 8-12 months for a new company to reach the level of expertise and support that Deloitte is currently

Transferring cybersecurity hardening knowledge is complex due to undocumented modifications and institutional knowledge. Deloitte, the primary architect of the standardized MC-FRCS risk assessment framework, has spent approximately five years accumulating highly specialized knowledge of systems architecture, operational parameters, and risk tolerance.

Such knowledge is critical to delivering tailored recommendations that align with

Senior Risk Assessor's requirements. A new contractor would need extensive time to validate custom behavioral analytics and security protocols, plus obtain complete security clearance and system access approvals. Disrupting support would roll back established procedures, potentially exposing NAVFAC to unidentified risks and requiring years to rebuild institutional knowledge. Therefore, conducting fair opportunity procedures at this time would not be feasible and would result in unacceptable delays impacting critical mission capabilities critical infrastructure.

Without the ceiling increase requested for OY4, NAVFAC's ability to protect, react and restore when cyber incidents occur will be significantly degraded. Moreover, NAVFAC will not meet DoD and DoN directives to maintain a secure technology infrastructure, resulting in degraded system performance and increased risk of adversarial cyber-attacks against the OT/IT networks. These vulnerabilities result in having "non-hardened control systems" which will present significant exposure to adversaries and threats, potentially causing direct lethality impacts to the warfighter and fleet operational missions with a primary threat focus on the INDO- PACOM AOR in addition to Naval Base San Diego

Version 02/28/2025 Page 5

(CA), Naval Station Norfolk (VA), Joint Base Pearl Harbor-Hickam (HI), and Naval Submarine Base Kings Bay (GA), where cybersecurity threats to FRCS have been previously identified.

The rationale is based on the above assessment and urgency of the geopolitical situation in the INDO-PACOM Area of Responsibility (AOR). NAVFAC cannot afford any gaps or drops in the quality or expertise of the contractor support it is currently receiving via the A&A CyberSafe contract. The only solution to prevent mission failure and catastrophic impacts to our war fighter is to award the OY4 increased ceiling to Deloitte. This increase will provide support from 24 September 2025 through 23 September 2026 and will ensure uninterrupted services for NAVFAC CYBERSAFE during the fair opportunity re-compete solicitation process, managed through NAVFAC's internal contracting support.

e. Determination That the Anticipated Cost is Fair and Reasonable:

The assigned GSA Project Manager (PM) will complete a technical evaluation on the appropriate for the work to be performed. Price analysis will be performed in accordance with FAR 15.404-1(b)(2), the Contracting Officer anticipates using various price analysis techniques and procedures to ensure a fair and reasonable price such as a comparison of proposed prices for the additional services to historical prices paid and comparison of proposed prices with the independent Government cost estimates.

f. Other Facts Supporting the Justification:

This acquisition is a modification to an existing task order, as NAVFAC is recompeting it in-house. This modification is necessary due to escalating geopolitical tensions in the region. The rise in cyber-attacks on operational technology necessitates a greater effort to strengthen the security of facility-related control systems across all Navy Installations. The geopolitical events are ongoing through 2026 could not have been foreseen when this task order was awarded.

g. Statement of Actions, if any, the Agency May Take to Remove or Overcome Any Barriers That Led to the Exception to Fair Opportunity:

For the original award, the agency provided a fair opportunity to all Alliant II contract holders in accordance with FAR 16.505 resulting in the receipt of two offers with an award being made to Deloitte Consulting LLC. The contract is currently in Option Year 3 with 1 option remaining. At the expiration of the contract, NAVFAC plans to recompete the requirement.

At this time, only Deloitte Consulting LLC can perform the required services within the timeframe necessary. No other firm can provide the necessary services at requisite level of expertise at this time. The Government will solicit only Deloitte Consulting LLC under its GSA Alliant 2 contract 47QTCK18D0029 for the requirement.

h. Certification by Technical or Requirements Personnel:

I hereby certify that the supporting data is accurate and complete.