REDACTED JA_ID.me.pdf

Brand Name ID.me Control Number VA-26-00012041

JUSTIFICATION FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for a firm-fixed-price delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Governmentwide Acquisition Contract (GWAC) for renewal of the Brand Name ID.me Identity and Access Management (IAM) Credential Service Provider (CSP) Software-as-a-Service (SaaS) solution which includes an annual Credential Brokers license, maintenance support and help desk assistance.

3. Description of the Supplies or Services: VA, Office of Information & Technology, Office of the Chief Technology Officer requires the ID.me IAM CSP SaaS solution to support new and renewal user proofing subscriptions, which allow individuals to prove their identities and establish credentials for the purposes of secure authentication into external VA systems, such as VA.gov, the VA Health and Benefits mobile app, VA’s Enterprise Service Desk, and more. VA requires a CSP that can be used by anyone who needs to interact with VA’s external digital tools, including Veterans and beneficiaries, family members, dependents, and caregivers that live in the United States or abroad; VA employees and Contractors; and other professionals interacting with VA in an official capacity. To support all users, VA requires a CSP that allows users having difficulty completing identity verification remotely to transfer to a human-assisted process with a person who can act as a trusted referee, which the National Institute of Standards (NIST) defines as a person or organization that can vouch for the identity of the end user. VA also requires a CSP that meets Federal identity standards set by NIST at the following levels: 800-63-2 Level of Assurance (LOA) 1, 2, and 3; NIST 800-63-3 Identity Assurance Level (IAL) 1, 2; and Authenticator Assurance Level (AAL) 1, 2, and

3. In addition, VA requires a CSP that is compliant with the Office of Management and Budget Memo 19-17, which requires federal agencies to use NIST 800-63 compliant credentials that are federally or commercially shared, and with Executive Orders 14249, 14247, and 14271, which prioritize fraud reduction and usage of commercially available solutions. Also, VA requires a CSP that can verify users internationally. Finally, VA requires a CSP that is interoperable with its current infrastructure, including VA’s Single Sign-On external (SSOe) technical stack, the VA.gov platform, the VA Health and Benefits Mobile platform, the VA Lighthouse Application Programming Interface (API) and the My HealtheVet (MHV) platform.

For ID.me, VA requires renewal of the yearly Credential Broker license, which allows up to 125 million Multi-Factor Authentication (MFA) events in the Base Period and in each Option Period, as well as maintenance support and help desk support. The Broker License will provide Veterans with publicly available customer support, including an inbound and outbound call center, video chat, live chat, and email channels as well as maintenance that includes software updates, patches, and fixes. Escalation support channels shall be available for VA employees, Contractors, and designated

Brand Name ID.me Control Number VA-26-00012041 representatives. Help desk inquiries associated with VA will be prioritized across general support, escalations, and fraud investigations. The required support shall ensure the ID.me IAM CSP solution continually meets NIST 800-63-2 LOA 1, 2, 3 and remains accredited at NIST 800-63-3 IAL 1, 2; and AAL 1, 2, and 3 throughout the Period of Performance (PoP) and be compliant with a minimum of Web Content Accessibility Guidelines 2.1 Level A and Level AA accessibility standards.

Additionally, VA requires 600,000 new users and 4.25 million renewal user identity proofing subscriptions in the Base Period; 580,000 new users and 4.55 million renewal user identity proofing subscriptions in Option Period 1; 560,000 new user and 4.84 million renewal user identity proofing subscriptions in Option Period 2; and 540,000 new user and 5.12 million renewal user identity proofing subscriptions in Option Period 3. VA also requires Optional Tasks for an additional 400,000 new user and 2 million renewal user identity proofing subscriptions at the LOA3 level, and 60,000 new user and 90,000 renewal user identity proofing subscriptions at the IAL2 level in the Base Period; and 460,000 new user and 2,090,000 renewal user identity proofing subscriptions in each Option Period. Finally, VA requires Optional Tasks to increase MFA events by either 5 million events or 10 million events for the Base Period and each Option Period.

The PoP for this effort shall be a 12-month Base Period with 3 12-month Option Periods, as well as 6 Optional Tasks in the Base Period, and 4 in each Option Period to be exercised at the Government’s discretion. The total estimated price of the proposed action, inclusive of all Option Periods and Optional Tasks, is $ .

4. Statutory Authority: This brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C.

4106(c)(2) as implemented by Federal Acquisition Regulation (FAR) Overhaul VA Deviation 16.507-6(b)(2), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in Section 8 of this document, it was confirmed that only the ID.me IAM CSP SaaS solution can meet all of VA’s interoperability requirements within the existing VA SSOe technical stack, VA.gov platform, VA Health and Benefits Mobile platform, VA Lighthouse API and the MHV platform. Specifically, the ID.me software code can interoperate with the IAM SSOe, VA Lighthouse API, My HealtheVet, and VA.gov configurations to differentiate user identity proofing levels which correlate to application and service availability and accessibility based on the user’s credentials. IAM SSOe, VA Lighthouse API , VA.gov, the MHV platform, and the VA Health and Benefits Mobile platforms provide basic services and tools for logged-in users and only work with ID.me’s proprietary IAM CSP SaaS solution requiring annual renewal of the ID.me Credential Broker subscription. Veterans and users accessing applications and services that involve Personally Identifiable Information, Protected Health Information, and sensitive information which require higher levels of identification, such as confirming Veteran status, are directed to increase their security level to IAL2, which can utilize ID.me’s self-service identity verification, the Trusted Referee feature for video verification, or the in-person option via ID.me’s Sterling product. The use of the ID.me

Brand Name ID.me Control Number VA-26-00012041

IAM CSP SaaS solution in VA’s technical stack offers increased security for user identification.

Further, as applications utilizing ID.me for authentication have highly varied technical stacks and architectures, each would require VA to engineer, secure, and build a new working solution; conduct functional/regression/security testing; and migrate existing users. These efforts are estimated to require at least two years of redundant labor and activities to integrate a new credential service provider. Replacing ID.me with another credential service provider would require running and paying for two commercial solutions simultaneously for an estimated two years. VA would need to support and pay for ID.me while integrating a new CSP, so that Veterans would not lose the ability to manage their VA health and benefits online, ensuring VA had enough time to help users transition to a different CSP. The estimated cost to run a second CSP for two years is approximately $32 million, which VA would need to pay while onboarding a new CSP.

Transitioning Veterans from the existing ID.me IAM CSP SaaS solution would also require a heavy financial investment to provide digital and in-person support for Veterans, especially those that are older, those with cognitive and physical disabilities, and those with low or no vision. Between June 2024 – November 2025, VA retired its use of the legacy My HealtheVet user ID and password and the Defense Self-Service Logon credential. This resulted in an 18-month effort of moving approximately 2 million accounts to ID.me, which required the support of an additional contractor team on top of VA’s existing vendor support, not to mention the hundreds of Veteran-facing staff, who helped Veterans sign-up for ID.me at in-person events. Finally, the aforementioned costs do not include what it would cost VA to identity proof users with a new vendor. At present, there are eight million ID.me accounts utilized at VA. Replacing the existing ID.me IAM CSP SaaS solution with another CSP would require eight million people to transition to an alternative solution, at least two to three years of dedicated work from hundreds of VA employees, and costs far surpassing last year’s credential transition due to the vast increase in the number of people who would need to move to new accounts.

The ID.me IAM CSP solution is based on proprietary software source code that can only be accessed by ID.me and its resellers. This code is required to provide necessary support for VA’s existing ID.me based solution, support the interoperability requirements of any increases in users or new applications and provide maintenance support and help desk assistance. Access to this code is also necessary to ensure all services are properly configured. VA’s IAM SSOe, VA Lighthouse API, VA.gov, and the VA Health and Benefits mobile app platform configurations were specifically integrated with ID.me’s proprietary software coding. VA has limited data rights to the configurations.

However, they only work with the proprietary ID.me solution. Thus, all aforementioned configurations would still need to be successfully replaced before a new CSP solution could access this data. The existing configuration’s source code for identity proofing records, metadata, and data points would be unable to interoperate with another CSP software solution without being entirely reconfigured. To perform the required maintenance and provide help desk support a non-Original Equipment Manufacturer would require access to ID.me’s proprietary data to include the source code. Without

Brand Name ID.me Control Number VA-26-00012041 this, no other source has the ability to provide the necessary maintenance other than ID.me or a reseller. Failure to acquire maintenance support and help desk support would prevent VA from obtaining software upgrades, risk interoperability concerns and put Veteran data at risk as unpatched software can contain common vulnerabilities and exposures that bad actors can actively exploit to gain unauthorized access to patient data.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this justification. This effort did not yield any additional sources that could meet the Government's requirements. However, the undersigned VA technical representative determined that limited competition is available among resellers for Brand Name ID.me SaaS solution, maintenance support, and help desk support.

Furthermore, the proposed action will be synopsized on the Contracting Opportunities Page in accordance with FAR Overhaul VA Deviation 5.201. Any proposals that are received shall be evaluated.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: Market research was conducted in March 2026. Similar solutions reviewed include CLEAR and Login.gov. Login.gov and CLEAR would both require technical reconfiguration of IAM SSOe, the VA Lighthouse API, VA.gov, and the VA Health and Benefits mobile app platform resulting in substantial duplicated time and costs described above. Also, neither Login.gov nor CLEAR can meet VA’s requirement for the Trusted Referee identity verification creating a significant risk that a portion of VA users would be unable to verify their identity and access services. Finally, Login.gov does not offer support for international users, and CLEAR only accepts a limited number of international passports for identity verification. As VA has many Veterans living abroad – including those served by the VA Medical Center in Manilla, Philippines – VA requires a CSP that can verify users internationally.

Request for Information (RFI) 366908 was posted to all 127 Contract Holders on NASA SEWP V, specifically Groups B, C, and D on January 26, 2026, to ascertain potential Brand Name ID.me resellers. Responses were due by February 6, 2026. Two responses were received, one from a Service-Disabled Veteran-Owned Small Business (SDVOSB), and one from a Women-Owned Small Business. Both responses proposed Brand Name ID.me solutions; no alternative solutions were identified or proposed in response to this RFI.

A second RFI was released on the General Services Administration (GSA) Advantage / eBuy as RFI1795522 on February 10, 2026, with a closing date of February 17, 2026.

GSA Advantage / eBuy identified nine SDVOSB resellers of ID.me. However, none of the SDVOSB contract holders responded and the only response received was from ID.me, the Original Equipment Manufacturer.

Additional market research was conducted in March 2026 by the Contract Specialist on the NASA SEWP V website. This search identified 11 resellers of ID.me, with 4

Brand Name ID.me Control Number VA-26-00012041 identified as SDVOSBs, however only 1 SDVOSB has responded to RFI 366908, as noted above. As such, the solicitation will be posted as a small business set-aside on the NASA SEWP V website.

9. Other Facts: None.

Brand Name ID.me Control Number VA-26-00012041

Technical/Requirements Certification

I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

Product Lead, Login & Identity

Office of the Chief Technology Officer

Office of Information and Technology

Department of Veterans Affairs

Fair and Reasonable Cost Determination

I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on anticipated competition. Additionally, NASA SEWP V GWAC has already determined the prices on contract to be fair and reasonable.

Finally, the successful quote will be compared to the Independent Government Cost Estimate.

Contracting Officer Technology Acquisition Center Office of Procurement, Acquisition, and Logistics

Contracting Officer Certification

I certify that this justification is accurate and complete to the best of my knowledge and belief.

Contracting Officer Technology Acquisition Center Office of Procurement, Acquisition, and Logistics

Brand Name ID.me Control Number VA-26-00012041

Office of General Counsel Review

I have reviewed this document and find it legally sufficient, based on the representations set forth in the documents and, if any, attachments. The Agency Senior Procurement Executive’s approval is an independently supported decision not wholly reliant on the legal sufficiency determination.

Attorney, Procurement Law Group Office of General Counsel U.S. Department of Veterans Affairs

Brand Name ID.me Control Number VA-26-00012041

HCA Concurrence

In my role as Head of the Contracting Activity, based on the foregoing justification, I hereby concur with the acquisition for the renewal of the current ID.me IAM CSP SaaS solution with comprehensive maintenance support and help desk assistance, pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the services herein described have otherwise been authorized for acquisition.

Head of the Contracting Activity Technology Acquisition Center Office of Procurement, Acquisition, and Logistics

Senior Procurement Executive Approval

In my role as Agency Senior Procurement Executive, based on the foregoing justification, I hereby approve the acquisition for the renewal of the current ID.me IAM CSP SaaS solution with comprehensive maintenance support and help desk assistance, on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the property and services herein have otherwise been authorized for acquisition.

Executive Director, Office of Acquisition and Logistics (003A) and Senior Procurement Executive