PCCS-24-40010 JEFO _Redacted.pdf

Justification for Exception to Fair Opportunity Exceeding the SAT pursuant to FAR 16.505(b)(2)(ii)(B)

JEFO No.: FY24-00164 - 1

JEFO No.: FY24-00164

Date: May 28, 2024 PR Number: PCCS-24-40010

1. Identification of the agency and the contracting activity, and specific identification of the document as a “Justification for an Exception to Fair Opportunity.”

The Department of Homeland Security (DHS), Cybersecurity and Infrastructure Security Agency (CISA), Office of Chief of Contracting Office (COCO) prepared this Justification for an Exception to Fair Opportunity.

2. Nature and/or description of the action being approved.

CISA/COCO intends to modify task order 70RCSA20FR0000133 with NTT Data Services pursuant to Federal acquisition Regulation (FAR) 16.505(b)(2)(i)(C).

3. A description of the supplies or services required to meet the agency’s need.

NTT Data Services Federal Government LLC (NTT Data Services) is currently providing cyber hygiene services under time-and-materials (T&M) task order 70RCSA20FR0000133.

The competitively awarded task order had a one-year base and four one-year options for a total task order value of 1. During the period of performance, the Government issued modification P00008 to remove the fourth option and to redistribute the ceiling under the option to options 2 and 3, thereby, reducing the performance period to four years. 2

The modification will add a one-year option period with an estimated value of to extend services to allow continued critical CISA services, which currently support over 7,500 Federal Civilian Executive Branch (FCEB), State, Local, Tribal, and Territorial (SLTT) and Critical Infrastructure (CI) organizations. The modification will (i) increase the total task order value from ;

and (ii) add and exercise the option period from September 30, 2024 to September 29, 2025 to continue critical services. CISA/COCO seeks to execute a bilateral modification to add the option in lieu of a separate logical-follow order.

1 The total performance period was September 30, 2020 to September 29, 2025. Base Period September 20, 2020 to September 29, 2021; Option Period 1: September 30, 2021 to September 29, 2022; Option Period 2: September 29, 2022 to September 29, 2023; Option Period 3: September 29, 2023 to September 29, 2024; and Option Period 4:

September 30, 2024 to September 25, 2025. The task order also included FAR 52.217-8 Option to Extend Services, which was included in the solicitation and evaluated at the time of award.

2In FY22 CISA received line item congressional appropriations to increase its attack surface management capabilities and with those funds CSD leadership mandated an increase in the federal and contract resources needed to support a drastic increase in the number of organizations receiving the key cyber hygiene services provided by this task order. To meet this mandate, the Contracting Officer awarded modification P00008 to avoid raising the ceiling while supporting the increase in the number of FTEs needed to support the large increase in organizations using the services provided by this task order.

JEFO No.: FY24-00164 - 2

The services required are continued critical cyber hygiene services to support the CISA Cybersecurity Division (CSD) Vulnerability Management Assessment branch to fulfill the DHS cybersecurity mission by performing various types of assessments for Federal, State / Local / Tribal / Territorial (SLTT), and Critical Infrastructure / Key Resources (CIKR) environments. The Cyber Hygiene section provides a variety of proactive services which evaluate an organization’s external security posture to assist the organization in improving their cybersecurity posture, limiting exposure, and reducing exploitation rates. Specific support services include the enrollment and maintenance of Federal, SLTT and CIKR stakeholder organizations in CISA’s vulnerability scanning, web application scanning and attack surface management services, which are critical to identifying vulnerable systems within the nation’s critical infrastructure, enforcing compliance with CISA Binding Operational Directives (BODs) that mandate specific Federal Government agency actions within specified timeframes (e.g., 15 days to mitigate critical vulnerabilities), and proactively reducing risk to the national’s critical systems.

4. Identify the exception to fair opportunity and supporting rationale, including a demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the exception cited.

X FAR 16.505(b)(2)(i)(C). The order must be issued on a sole-source basis in the interest of economy and efficiency because it is a logical follow-on to an order already issued under the contract, provided that all awardees were given a fair opportunity to be considered for the original order.

Rationale:

The Government is adding an option instead of issuing a logical follow-on to task order 70RCSA20FR0000133. The task order was competitively solicited under the General Services Administration (GSA) Alliant 2 Indefinite Delivery Indefinite Quantity (IDIQ) multiple award contract using the ordering procedures at FAR 16.505. NTT Data Services is currently performing cyber hygiene services to support 7500 stakeholders. During the task order period of performance, NTT Data Services has matured and refined the services to ensure that compliance with critical CISA BODs is enforced. Enforcement will occur in Fiscal Year (FY) 2025. Under this circumstance, it is prudent to add an option period that will allow for administrative ease and effective use of resources.

Without ongoing support,

1. The current list of over 7,500 FCEB, SLTT and CI organizations receiving vulnerability scanning services via this task order will cease to receive daily notifications and weekly reports identifying critical vulnerabilities within their internet-accessible assets and recommended mitigations for addressing the vulnerabilities. This translates to these organizations being vulnerable to a cyber incident (e.g., hacker stealing their data or shutting down a key service) and unaware of their vulnerable state.

JEFO No.: FY24-00164 - 3

2. The current list of over 2,000 FCEB, SLTT and CI organizations receiving web application scanning services via this contract will cease to receive monthly reports identifying critical vulnerabilities and configuration flaws within their web applications, which is a key infection vector for ransomware. This translates to these organizations being vulnerable to a cyber incident—possibly even a major ransomware incident such as the 2021 Colonial Pipeline incident that caused a major fuel shortage on the East Coast— and unaware of their vulnerable state.

3. The full list of FCEB agencies mandated to comply with Binding Operational Directive (BOD) requirements will no longer receive notifications and reports identifying areas of non-compliance, thus, leaving Government networks vulnerable to compromise by malicious cyber actors, and the agency heads unaware of their vulnerable status. This translates to Federal agencies possibly having agency and/or private sector data stolen, or key public services being shut down; and

4. CISA will fail to comply with the White House’s Executive Order on Transforming Federal Customer Experience and Service Delivery as the current 10,000 annual customer-service emails will go unanswered.

The proposed action is in the interest of economy and efficiency because it will prevent duplication of costs to perform the services including administrative costs to transfer the services to another contractor. To solicit other sources at this time would result in performance disruption and unnecessary cost inefficiencies to the Government. For example, security entry on duty (EOD) timelines for CISA range between 7 and 140 days for the types of support needed on this task order. With the average EOD being 20 days, if a new vendor wins, there could be disruption of services up to six months long while CISA clears the new contractor staff to on-board and trains them on the necessary standard operating procedures and customer support processes. No other vendors will be disadvantaged since these services would have been extended through a logical follow-on with the same contractor. The modification is within the scope of the task order and will provide the necessary services to meet CISA BOD enforcement requirements.

5. Determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

The Contracting Officer determined the anticipated prices will be fair and reasonable using historical data from the current competitively awarded task. Furthermore, the Contracting Officer anticipates the prices will be fair and reasonable consistent with NTT Data Services Alliant 2 contract that includes fair and reasonable maximum rates.

6. Any other facts supporting the justification.

None.

JEFO No.: FY24-00164 - 4

7. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made.

CISA/COCO intends to conduct a competitive procurement for which preparations for market research will begin Q4 FY24. The anticipated award is Q4 FY25. This modification will provide funding to continue critical services as described in Section 4.

8. DHS intends to post this requirement on SAM.gov pursuant to FAR 16.505(b)(2)(ii)(D).

9. Technical/Requirements Personnel Certification.

Pursuant to FAR 16.505(b)(2)(ii)(B)(9), I certify that this requirement meets the Government’s minimum need and that the supporting data, which form a basis for the justification, are accurate and complete.