P03 JnA Login.gov MFA Follow-on to Oddball_Redacted.pdf

CONTROL NUMBER VA-24-00072528

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics

Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed Firm Fixed Price (FFP) sole source action is for Login.gov Scrum Teams (Multi-factor Authentication (MFA)), which includes improvements to the VA.gov system so that users can quickly, easily, and securely sign-in to VA.gov and the VA Health and Benefits mobile app. The proposed contractor is Oddball, Inc., 1875 K street NW, Ste 400, Washington, D.C. 20006.

3. Description of Supplies or Services: The proposed action provides support for both the platform infrastructure and user-facing experience that enables users to login to VA.gov and the VA Health and Benefits mobile application. The Government anticipates that approximately two large scrum teams are required to manage this effort, the Platform Infrastructure Team and the Support and Sign-in Experience Team. The platform infrastructure team manages authentication needs for VA.gov and the VA Health and Benefits mobile app. This includes the development, management, and maintenance of authentication and login infrastructure, including functionality related to Single Sign-on (SSOe) and Sign-in Service (SiS) and other associated support services. The support and sign-in experience team provides support to all Veteran-facing service teams building on the VA.gov and VA Health and Benefits mobile app platform around sign-in operations and experience. The proposed FFP action is for an 8-month base period. The total estimated value of the proposed action is

4. Statutory Authority: The statutory authority permitting other than full and open competition for this acquisition is 41 U.S.C. 3304(a)(5), “Authorized or Required by Statute”, as implemented by FAR 6.302-5. For this action, 38 U.S.C. 8127(c), known as the Veterans First Contracting Program provides the authority to directly contract with a Service-Disabled Veteran-Owned Small Business (SDVOSB) or a Veteran- Owned Small Business (VOSB).

5. Rationale Supporting Use of Authority Cited Above: The proposed source for this acquisition is Oddball who is a certified SDVOSB and is technically qualified to support the MFA requirements for VA.gov and the VA Health and Benefits Mobile application. Oddball won a competitive task order in December 2022 to perform this work and has performed successfully to date. The task order expires on July 2, 2024, however, continued support and iteration on the forms is an ongoing need beyond this task order. Specifically if the MFA support currently being provided by Oddball under their CEDAR contract is not extended, Veterans will lose access to the multi-factor authentication options (currently VA.gov supports authentication with Login.gov, ID.me, DS Logon (a Department of Defense product), and

Login.gov Scrum Teams (Multi-factor Authentication Follow On)

MyHealtheVET) needed to log into VA.gov. This would remove their access to the many features available through VA.gov. Oddball provides all infrastructure, support, maintenance, and monitoring of the aforementioned VA.gov authentication infrastructure. If there was a technical issue with the authentication options on VA.gov, and VA did not have the required Oddball support, millions of Veterans would not be able to login to VA web properties to manage their benefits.

Additionally, this would affect the entirety of teams working within OCTO on logged-in VA.gov experiences. VA would also lose required support to create any new integrations related to authentication for any new features being built on VA.gov.

6. Efforts to Obtain Competition: Market research was conducted in June 2024, as discussed in Section 8. Upon the determination that a sole source award to Oddball was in the best interest of the Government, the Contracting Officer confirmed that Oddball meets all of the requirements detailed in VAAR 819.7008. Consistent with the guidelines of the Veterans First Contracting Program, the proposed action described herein will be synopsized and this justification will be posted on the Contracting Opportunities Page in accordance with FAR Part 5.

7. Actions to Increase Competition: The current task order was competed and awarded on the Customer Experience, DevOps, Agile Releases (CEDAR) Indefinite Delivery, Indefinite Quantity (IDIQ) contract. The contract ceiling of CEDAR is accounted for, and therefore the continued MFA support cannot be obtained via the CEDAR IDIQ. A new IDIQ, the Secure, Performant, Reliable, and User-Centered Experiences (SPRUCE) contract is planned to replace CEDAR and is currently in the evaluation phase. Continued support and improvements to MFA is ongoing and needed to bridge the gap between the CEDAR and SPRUCE contracts. It is expected that future needs for this work will be competed on the SPRUCE contract in fiscal year 2025. CEDAR (and SPRUCE, when it is awarded), are the preferred vehicles to acquire the type of software development services under this action as they are 100% set aside for SDVOSBs and the awardees have proven software development capability.

8. Market Research: Market research was conducted in 3rd quarter FY24. The Contracting Officer considered whether there are other capable contractors in the marketplace. Given that the CEDAR contract is nearing its ceiling and is no longer a viable vehicle for this work, and the follow-on IDIQ contract, SPRUCE, is not yet awarded, it is not in the Government’s best interest to compete for a short-term bridge effort as it may result in a transition to a different contractor, and then a transition to a third contractor once SPRUCE is awarded. The potential for three different contractors to have to transition this work in roughly eight months would likely result in disruptions to the services being performed. As described in Section 3, improving the MFA process is critical. In order to minimize disruptions in service and continue improving Veterans’ login experiences, it is in VA’s best interest to award the instant action to the contractor currently performing the work, Oddball, with the planned follow-on action to be competed under SPRUCE.

10. Technical/Requirements Certification

I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

Date

Digital Services Expert

11. Fair and Reasonable Cost Determination

I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on an analysis of historical prices paid by the Government for the same services. The contracting officer will use existing CEDAR labor rates, which have previously been determined to be fair and reasonable, to verify Agile Six’s proposed price is fair and reasonable per FAR 15.404-1(b)(2)(ii).

Contracting Officer Office of Procurement, Acquisition and Logistics Department of Veterans Affairs

12. Contracting Officer Certification/Approval

I certify that this justification is accurate and complete to the best of my knowledge and belief.

Contracting Officer Office of Procurement, Acquisition and Logistics

7/2/24

Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition of Login.gov Scrum Teams (Multi-factor Authentication Follow-On on an other than full and open competition basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein described have otherwise been authorized for acquisition.

Advocate for Competition Technology Acquisition Center Office of Procurement, Acquisition, and Logistics