P03_JA_IT Security Engineering Support_Final_Redacted.pdf

VA-21-00070850

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed sole source modification is for a continuation of Information Technology (IT) Security Engineering Support (SES) services against Transformation Twenty-One Total Technology Next Generation (T4NG),Contract VA118-16-D-1009 Task Order (TO) VA11817F10090014 with AbleVets, LLC.

3. Description of the Supplies or Services: On September 25, 2017, T4NG Contract VA118-16-D-1009, TO VA11817F10090014 was awarded to AbleVets using competitive procedures on a Firm Fixed-Price basis. The effort is in support of the Office of Information and Technology (OIT), Office of Information Security (OIS), Information Security Policy and Strategy, Cybersecurity Technology and Metrics (CTM) Information Technology Security Engineering Support contract with Ablevets. This TO provides baseline support, Authorization To Operate (ATO) support, risk management support and pre-acquisition support. A more detailed description of the IT Security Engineering Support requirements is provided in Section 5 of this Justification. The current period of performance ends on June 24, 2021.

The period of performance for this proposed action shall be June 25, 2021 to August 24, 2021 with one, one-month option period. VA will require this period for seamless sustainment of the Software as a Service (SaaS) Cloud Service Digital Transformation Center (DTC) surge support effort as detailed in section 5 below, without any disruptions to transition support to the new TO that is currently being competed. The total estimated value of the proposed action is , inclusive of the option period.

4. Statutory Authority: The statutory authority permitting an exception to fair opportunity is Section 41 U.S.C. 4106(c)(2) as implemented by the Federal Acquisition Regulation (FAR) 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: The proposed source for this action is AbleVets, 15049 Conference Center, Drive, Suite 250, Chantilly, VA 20151.

The original TO was awarded to AbleVets as a result of a competitive action under T4NG. As part of its ATO support, AbleVets is providing support for SaaS Cloud ATOs.

On May 12, 2021, Cloud Service DTC notified CTM that there will be an unexpected surge of SaaS ATO requests through the end of the current fiscal year. This unanticipated request constitutes a 265% increase over the normal package development and deployment pace. As a result, VA had to better assess its

Information Technology Security Engineering Support VA-21-00070850 requirements which caused delays in soliciting the anticipated recompete effort.

Additional input due to the complexity of the requirements as a result of the unanticipated DTC surge was required. For example, the Information Systems Security Engineering (ISSE) team provides review of projects going through the VA IT Process Request (VIPR) and support the business owner request submissions with pre-acquisitional security analysis artifacts that ensure implementation of minimum-security requirements before procurement. Some of these artifacts are: pre-categorization, Analysis of Alternatives (market research support), security impact analysis, and contractual security control language. Without the support in the pre-acquisition, VA is at risk for procuring products that do not meet the secure VA business use case resulting in costly re-engineering, delays to schedule, and reducing the capability to care for Veterans. Further, it was determined, as a result of market research, that the requirements and acquisition strategy for the Request for Task Execution Plan needed to be revised. The acquisition package documentation was updated to align with the new requirements and unknown SaaS Cloud Service DTC surge support effort. Due to this unanticipated request, the requirements for the new effort had to be reevaluated to include optional tasks for surge support.

AbleVets has worked closely with VA over the past five years and has obtained and demonstrated significant knowledge of VA’s current environments, integrations, services and applications. Only AbleVets can provide the aforementioned SaaS Cloud Service DTC surge support effort without any disruptions to Authorization Support as detailed below.

Authorization Support There are two areas in which authorization support would be affected. The ISSE team provides the pre-categorization (Data Security Categorization) of all vendor systems to stakeholders to effectively build the basis of information system minimum security control baselines. This eliminates the need to do costly re-engineering of products procured that did not initially meet the VA security standards. If the pre-categorization is not completed, business owners are at risk of solidifying contracts with vendors that will not or cannot meet data protection needs, costing millions in re-engineering and delayed deployment of purchased solutions resulting in reduced capability of care to Veterans. There is no backup team for the pre-categorization of cloud products.

Secondly, the ISSE provides authorization support to approximately 20 systems (on average) per month to provide consultation and engineering guidance leading up to an ATO. As it currently stands, the ISSE team developed the authorization process for cloud in Enterprise Management Assurrance Support Service (eMASS) and is the only team that develops the VA Federal Risk and Authorization Management Program (FedRAMP) package within eMASS. If the ISSE team is not able to continue authorization support, FedRAMP packages will not be properly documented and a majority of the workload required by the DTC cloud team would not be completed. In addition, the ISSE team is often brought in to correct deficient packages to ensure correct implementation and documentation of authorization artifacts for ATO.

Information Technology Security Engineering Support VA-21-00070850

Only AbleVets can meet VA’s requirements for seamless SaaS Cloud Service DTC surge support. Specifically, under the Authorization support, if Ablevets support is lost during the SaaS Cloud Service DTC surge support effort then the increased number of products entering the Assessment and Authorization (A&A)/Package development phase will become bottlenecked due to the lack of expertise required to work the packages, therefore causing significant delays in the delivery of 159 currently scheduled products. As previously stated, the SaaS Cloud Service DTC surge represents a 265% increase over the normal package development and deployment pace. It is anticipated this number will increase during the duration of this development phase. Further, the 30-60-day estimate is based on previous efforts conducted for similar development and sustainment services of this magnitude and complexity. Failure to deploy Saas Cloud Service DTC surge support seamlessly would cause serious harm to VA and Veterans.

If defects in deployment cannot be fixed or do not have effective workarounds, many VA systems will not have effective identity validation and integration resulting in loss or delay of service and potential customer information security threat.

In addition to the aforementioned surge support, the ISSE team will still need to support its other activities as detailed below:

Baseline Support With a gap in coverage, VA will no longer have the process to evaluate enterprise secure configuration baselines which are mandated for use within VA to include the analysis needed for deviations to VA policy and approval from the Chief Information Security Officer. These are core applications widely used (operating systems, databases, web servers, etc.) that are deployed in every ATO and pose a significant risk by potentially duplicating millions of vulnerabilities reducing the overall security posture as an Agency.

Risk Management Support The ISSE team provides security impact and risk analysis to many organizations to assess the impact of secure change configuration management. Many of the support requests are related to changes that affect the enterprise operationally or through working groups addressing enterprise problems. In collaboration with the OIS offices, to include the Enterprise Security Architecture team, the ISSE team provides security engineering perspective to projects. For example, during the current global pandemic, the ISSE team provided support to many projects increasing the ability to work remotely by serving as the primary contributor in the Cisco WebEx authorization or assessing the Windows Virtual Desktop Citrix baselines. If the support does not continue, VA is at risk for not having the security engineering expertise to tackle enterprise problems and loses the collaborative relationships forged with external stakeholders in OIS and OIT.

Pre-acquisitional Support The ISSE team provides review of projects going through the VIPR and support the business owner request submissions with pre-acquisitional security analysis artifacts that ensure implementation of minimum requirements before procurement. Some of these artifacts are: pre-categorization, Analysis of Alternatives (market research

Information Technology Security Engineering Support VA-21-00070850 support), security impact analysis, and contractual security control language. Without the support in the pre-acquisition, VA is at risk for procuring products that do not meet the VA business use case resulting in costly re-engineering, delays to schedule, and reducing the capability to care for Veterans.

VA requires a two month extension, with one, one-month option in order to ensure seamless sustainment of the SaaS Cloud Service DTC surge and the support listed above. It is anticipated it will take approximately 90 days to complete the SaaS Cloud Service DTC surge. VA anticipates award of a competitive TO under the T4NG contract vehicle on July 31, 2021. On-boarding personnel for the new TO can take approximately 30-60 days. AbleVets currently possesses all resources ready with the necessary security clearances to include physical, logical and elevated system access, no learning curve for any new resources required, and retainment of knowledge of Contractor staff and can commence performance immediately upon award. Only AbleVets can provide the essential services without a significant interruption and minimal turnover which is critical to Veterans, caregivers, and families. AbleVets can provide the required services immediately upon contract award with no ramp-up time required. Also, no other contractor can provide the required services because they could not onboard the proper personnel immediately. This transition will require the coordination and facilitation of multiple contractor resources to be recruited, accepted, physical, logical, and elevated access established, background investigation submitted, and Government furnished equipment (GFE) issued. Each accepted Contractor would require National Criminal Fingerprint for an initial criminal background check that is favorable. In addition to a favorable Fingerprint check, a background investigation request would have to be submitted to VA Security and Investigation Center for review and concurrence and then submitted to Office of Personal Management (OPM) for investigation. Once received by OPM, the PIV process would involve each contractor to be scheduled, registered, fingerprint capture, badge creation, issuance, and desktops support (to register PIV Certs). This would all be required prior to the issuance of a PIV and elevated system access being granted. Due to the multiple dependencies to complete these actions, a contractor would have to supply contractor personnel who have a current adjudicated background investigation, current PIV card, existing accesses and already issued GFE.

VA’s current TO with AbleVets is scheduled to expire on June 24, 2021. Loss of continuous, uninterrupted support to deploy SaaS Cloud Service DTC surge effort timely, would be considered a high-level risk to VA department wide. A delay or break in service would lead to needed products not being available for use to provide services to Veterans and products that are brought in not being properly vetted and secured, leading to a reduced security posture and increased risk to Veterans and their data VA requires Ablevets to provide the required support until the awardee of the recompete is onboarded and ramped up; then, the services can be transitioned to the awardee uninterrupted and seamlessly.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 this document. This effort did not yield any additional sources that can

Information Technology Security Engineering Support VA-21-00070850 meet the Government’s requirements. In accordance with FAR 5.301 and 16.505(b)(2)(ii)(D), the award notice for this action will be synopsized on the Federal Business Opportunities Page (FBO) and the justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: VA currently anticipates award of a competitive TO on July 31, 2021 under the T4NG contract vehicle after which all services will be handled under the competitive award. In the event transition is necessary, as outlined in Section 5, work will be handled under the competitive award after transition and ramp up has occurred.

8. Market Research: Market research was conducted from March 24 through April 6, 2021. A Request for Information (RFI) was released on the FBO website on April 28th and closed on May 5, 2021. The RFI included a Performance Work Statement and requested that interested parties provide indication of their respective capabilities to perform the aforementioned services support. Responses were received from nine vendors to include four large businesses: AbleVets, CGI Federal Inc., Booze Allen Hamilton, SRA International Inc; one small Business: Amida Technology Solutions Inc., and four service disabled Veteran-owned small businesses (SDVOSB): TISTA Science and Technology Corporation, Insignia Technology Services LLC, Favor Technology LLC, and Sprezzatura-GovernmentCIO Joint Venture, LLC.

The responses were reviewed by VA subject matter experts from the Cybersecurity Technology and Metrics team. While sources were found that possess the general capabilities, no sources were found that can provide the support services in the required timeframe as outlined in Section 5 of this justification. Given AbleVets is currently performing the services, the Contracting Officer and Program Manager contacted the company on May 17, 2021 to ascertain if it was capable of meeting VA’s requirements for seamless SaaS Cloud Service DTC surge support. AbleVets confirmed it is capable of provide the requirements. Based on this market research, VA has determined that only AbleVets can meet all of VA’s aforementioned requirements.

9. Other Facts: None.

Information Technology Security Engineering Support VA-21-00070850

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

Name: Date: see digital signature

Title: Signature:

11. Fair and Reasonable Cost Determination: hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on a comparison with the Independent Government Cost Estimate and prices obtained through market research on same or similar services conducted by Government Technical experts

Title: Signature:

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Title: Signature

Information Technology Security Engineering Support VA-21-00070850

Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition of Information Technology Security Engineering Support services on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.

Date: see digital signature Signature:

Advocate for Competition Technology Acquisition Center

Office of Procurement, Acquisition, and Logistics