JOFOC_HighBond Risk Mgmt Software_SAM.pdf

National Transportation Safety Board Justification for Other than Full and Open Competition

“HighBond Compliance Risk Management Software”

HighBond Compliance Risk Management Software JOFOC Page 1 of 2

1. Program Office / Procurement Request Office of Chief Information Officer (OCIO), Computer Services Division (CIO-10)

2. Nature of Action

The purpose of this Justification for Other than Full and Open Competition (JOFOC) is to provide documentation that the software required for purchase be limited to the brand-name only “HighBond Compliance” for risk management software.

3. Description of Requirement

The National Transportation Safety Board (NTSB) has a requirement to subscribe to HighBond Compliance risk management software and support as a key component in the agency’s information security and risk management programs. The NTSB has a requirement to purchase the following items:

Item # Part Number Description Qty 1 FEDRAMPENV FedRamp Moderate Environment 1 2 SHBSOL0COMMDO ComplianceBond Solution 1

3 SHBPRORB00L1MDO

Diligent Professional User Licenses with Robotics 10

4 IMPACTREPORT HighBond Impact Reports 1

The period of performance is from September 27, 2026 to September 26, 2027.

4. Authority Cited FAR 13.106-1(b)(1), Soliciting from a single source. Contracting Officers may solicit from one source if the contracting officer determines that the circumstances of the contract action deem only one source reasonably available (e.g., urgency, exclusive licensing agreements, brand-name or industrial mobilization).

5. Unique Qualifications / Circumstances of Requirement The HighBond cloud software product assists the OCIO staff with managing systems risks and preparing for assessments and audits to facilitate the implementation of the Federal Information Security Management Act (FISMA) requirements Agency wide. It is the only known risk management software product that does not require a development process prior to use which allows immediate use by the NTSB. HighBond provides a governance, risk and compliance platform that is unique to the NTSB environment.

In addition, this product is FedRamp-authorized Cloud compliant. NTSB, like all federal agencies, must use cloud-based products authorized by FedRamp. The HighBond product is-FedRamp Moderate meaning it’s already approved to handle (CUI) or Controlled Unclassified information. The NTSB has Moderate systems that contain (CUI) Controlled Unclassified Information.

This is the only known FedRamp authorized product that maps directly to NIST SP 800-53 r5 controls and FISMA reporting requirements that are assessed annually by the Third-Party Assessor. The NTSB is required each year to manage and maintain the following documentation: Security Assessment Reports, System Security Plans (SSP) and the Plan of Action & Milestones (POA&M). These documents are critical for NTSB to meet FISMA annual

National Transportation Safety Board Justification for Other than Full and Open Competition

“HighBond Compliance Risk Management Software”

HighBond Compliance Risk Management Software JOFOC Page 2 of 2 reporting requirements such as completing and submitting CIO and System Privacy reports to DHS and OMB and completing the annual IG audit report that is submitted to OMB and Congress.

No one contractor’s unique qualifications are cited as the basis for this justification. Rather, the software identified by the brand name herein has been determined to be the only items that meet the NTSB’s requirement.

6. Efforts to Determine More Than One Source In accordance with FAR 5.101(a)(1), a notice of the contract action will be posted electronically on the government-wide point of entry, the System for Award Management website (www.sam.gov) for five (5) days. The notice will state that all responsible sources may submit a capability statement, proposal, or quotation, which will be considered by the agency.

7. Contracting Officer’s Determination I have reviewed the JOFOC and determined that based on the information provided that it is accurate and complete to the best of my knowledge and belief. The award and anticipated cost of any subsequent award will be fair and reasonable, and in the best interest of the government.

8. Market Research Market research was conducted to determine if other products could support the NTSB requirement. Several resources were used for researching the market including seminars, webinars, advertisements, vendor meetings, and industry consultation. The annual subscription basis of this software permits the NTSB to evaluate its value to the OCIO and usefulness to other NTSB offices with similar need such as the CFO and MD offices. Market research will be performed for future acquisitions to identify new or improved products that meet or exceed requirements.

9. Other Pertinent Information N/A

10. List of Interested Sources

No other sources have expressed interest in this requirement.

11. Efforts to Remove Barriers to Competition The NTSB will continue to monitor the market for new technologies and sources that can provide new advanced capabilities that meet or exceed requirements.

12. Contracting Officer’s Certification The Contracting Officer certifies that this Justification is accurate and complete.

http://www.sam.gov/