Redacted_LSJ_1.pdf

LIMITED-SOURCES JUSTIFICATION

AUTHORITY: FAR 8.405-6 and 40 U.S.C 501

Solicitation Number: 140D0424Q0124

This acquisition is conducted under the authority of the Multiple Award Schedule Program.

1. Identification of the agency and contracting activity, and specific identification of the document as a “Limited-Sources Justification.”

This document serves as a Limited-Sources Justification for the Healthcare Threat Operations Center (HTOC) Maturation Support Services requirement. The contracting activity procuring this requirement is the Department of the Interior (DOI), Interior Business Center (IBC), Acquisition Services Directorate (AQD), Division 1, Branch 3 on behalf of the Department of Health and Human Services (HHS), Office of the Chief Information Officer (OCIO), Office of Information Security (OIS).

2. Nature and/or description of the action being approved.

The purpose of this document is to outline the rationale for procuring HTOC Maturation Support Services from Alyn, Inc. (Alyn) (UEI: GFZVKNF7RVJ3). This is a follow-on task order of an existing requirement for HHS OCIO OIS. HHS procured and awarded the current task order, 75P00123F80120, to Alyn on a limited-sources basis in accordance with FAR 8.405-6(a)(1)(i)(B) with only one source having the capability to provide the services required at the level of quality required because the services are unique and highly specialized. The previous task order, 140D0421F0235, was procured and awarded by DOI to Alyn on a limited-sources basis in accordance with FAR 8.405- 6(a)(1)(i)(B) as well. This follow-on requirement is anticipated to be procured in the same manner as a single task order placed under General Services Administration (GSA) Multiple Award Schedule (MAS) Information Technology (IT) – IT Services, Special Item Number (SIN) 54151HACS – Highly Adaptive Cybersecurity Services (HACS) to Alyn, Contract Number 47QTCA20D004B, in accordance with FAR 8.405- 6(a)(1)(i)(B).

3. A description of the supplies or services required to meet the agency’s needs (including the estimated value).

HHS OCIO OIS’s Cybersecurity Operations (CSO) program has a requirement to maintain and expand Federal partner cybersecurity integration and threat projection services without delay or interruption. As cyber threats continue to create challenges and obstacles to global pandemic crisis, and as threats multiply and become more complex, the need for increased as well as enhanced federal integration, collaboration, Solicitation Number: 140D0424Q0124 partnership, threat projections, and integration of controls and threat management strategies continue to grow exponentially. The evolving cyber threat landscape coupled with the rapid proliferation of information assets, the increased mobility of the HHS workforce, and the need to derive value and intelligence from information assets have forced HHS to continue its investment in Federal Healthcare Threat Operations management and integration services.

The objectives of this task order are to:

1. Provide increased and enhanced Federal partnership integration strategies; and

2. Consolidate tactical threat projection services, data analytics, and operational roadmaps and activity; and

3. Eliminate federal partnership redundancies, streamline processes, and implement cybersecurity requirements into a strategic plan through program and portfolio management standards ensuring continuity across the Government.

The objectives include strategic observations and recommendations to existing and future support structure for internal HHS sector engagements and communications.

HTOC has unique requirements supporting specifically federal agencies (HTOC Partners), federal sensitive data, and the integration of HHS, Department of Veterans Affairs (VA), and Defense Health Agency (DHA) cyber operations. This task order provides strategic and tactical support services to strengthen and expand these federal partnership functions and will ensure HHS receives inter-agency operational data (partner data, not just HHS data), executes data analytics support, custom data development and enrichment support, and provides product development recommendations such as reporting and communications.

The period of performance (PoP) includes a 12-month base period and one 12-month option period. A two-year period of performance is required as maturation of the HTOC program is expected to be reached in 2025. The included option period allows flexibility to respond to cybersecurity threats and allows the time necessary to ensure full maturation of the HTOC.

The Independent Government Estimate (IGE) has a total estimated value of for a two-year period of performance (one 12-month base period and one 12-month option period). With the inclusion of FAR 52.217-8, Option to Extend Services, the total estimated value is for a two-year period of performance (one 12-month base period and one 12-month option period) with an optional up to six-month extension of services. The table below includes the IGE broken out by the base period and option periods, including the option under FAR 52.217-8.

The FAR 52.217-8 option was calculated by adding six months of the highest priced period ( ) to the total estimated price for the base period and all option periods.

Alyn actively provides cyber incident support services that are critical to the operations of HHS’s HTOC. Alyn brings capabilities, experience, knowledge, and relationships that are unique and highly specialized in order to deliver the necessary project milestones necessary at a level of quality required in the HTOC project’s planned timeline.

Additionally, continuation of the maturation services provided by Alyn prevents HHS from excessive costs associated with project restarts. Continuing services through Alyn ensures HTOC achieves a fully operational status in the next 18-24 months as the project timelines are presently on course. The design and implementation phases are complete with the HTOC program being in its most critical phase of expanding across all of HHS and other Federal Healthcare-providing Agencies.

If this requirement is not awarded to Alyn, a new vendor will immediately reduce and impact the ability to sustain operational status of the HTOC program at a critical state.

HTOC provides Healthcare and Public Health Sector (HPH) cybersecurity predicate threat analysis and intelligence. In partnership with Federal healthcare agencies the HTOC collects, analyzes, and provides HHS cybersecurity threat perspectives critical to safeguarding public and, ultimately, private healthcare data. This expansion to private healthcare data meets new guidelines set forth through an executive order to increase breadth of bidirectional information sharing across not only the federal, but private sectors as well. Without Alyn, execution of this effort would result in unacceptable delays as the HHS HTOC program has a requirement to fully execute HTOC services without interruption.

Additionally, a new vendor replacing Alyn will require substantial effort, impact, and costs to onboard necessary analysts across multiple HHS OpDivs and multiple OpDiv networks. As a result, the Government will experience impactful project setbacks, substantial delays to critical cyber threat intelligence, and unexpected costs not projected for. Delays to compete the requirement, award to a new vendor, and to onboard new personnel could increase costs as much as . These costs are not planned for and will result in a dramatic impact to the HTOC project’s budget and timeline.

OpDivs has gained confidence in Alyn’s quality of services and its ability to deliver.

Awarding to a new vendor will move the project back in its timeline and eliminate current capabilities. Alyn’s unique and highly specialized services immediately enhances HHS’s ability to deliver HTOC to the HPH sector with external private entity relationships and advanced Federal partnerships. These unique relationships ensure HTOC is able to sustain forward momentum in providing the required maturation services to the HTOC.

Alyn currently has physical and network access to critical systems and data. Through Alyn’s current engagements in supporting the maturation services for the HTOC, similar access has also been granted to external federal partners such as the United States (US) Department of Veterans Affairs. A new vendor will require extensive onboarding activities to include HHS security reviews, Operating Division authorizations, renewed agreements, complex badging, and network access to not only HHS, but to external federal partners. This process is currently a 90-day process, at a minimum. Combined with timing of executing a new award, the project would be set back in such a way that impacts to the HTOC program sustainment will be detrimental. As previously mentioned, Alyn already has the necessary and unique relationships established, badging, and network access to internal and external partners to allow for uninterrupted support to the maturation of the HTOC program.

Not only would there be impacts in time and cost, but also impacts as it relates to vulnerabilities in cybersecurity threats as there is an increased cybersecurity risk of healthcare systems during a time when performance and speed are critical to the health of millions. The HTOC program experiences increased complications that are due to increased cybersecurity threats. A single successful cybersecurity threat, such as a ransomware attack on critical federal agencies, could significantly affect the Government’s ability to deliver life-saving equipment or vaccinations to the American public. During the maturation of the HTOC, Alyn created the unique relationships with HHS’s Government partners, internally and externally to HHS. These relationships provide Alyn with the unique ability to respond to threats quickly and integrate responses into the HTOC environment that satisfy the needs of these agencies. To prevent agency vulnerabilities to increased cybersecurity threats and uninterrupted service to the maturation of the HTOC, Alyn’s continued support is necessary.

As mentioned above, changing to a new vendor at this time would ultimately create an undue burden, cause critical delays, and increased costs for the Government.

Additionally, changing to a new vendor at this time will only increase the cybersecurity risk of the US healthcare systems. Therefore, awarding to Alyn to bring the program to a fully operational state is in the best interest of the Government, for both cost, timing, and cybersecurity reasons.

While Alyn’s unique and highly specialized services are necessary to complete the HTOC through maturation, once fully operational the project maintenance support may be provided by other contractors. However, Alyn is the only vendor capable of bringing the HTOC in its current state to full maturity without a significant and adverse impact in the Government’s level of effort, time, and cost. As the initial maturation phase of the HTOC is expected to take place through 2025, HHS OCIO OIS expects this anticipated task order to be the last order prior to transitioning into the project maintenance support phase of the HTOC Program.

5. A determination by the ordering activity contracting officer that the order represents the best value consistent with FAR 8.404(d).

The Contracting Officer (CO) determines that the anticipated price will be fair and reasonable through the use of the GSA MAS program and through the program’s schedule pricing. The rates used by GSA MAS program schedule contract holders have been determined at the time of schedule contract award to be fair and reasonable. To further ensure the price is reasonable, price evaluation will be conducted in accordance with FAR 8.405-2(d).

6. A description of the market research conducted among schedule holders and the results or a statement of the reason market research was not conducted.

Market research was conducted by researching the acquisition history of this requirement. Originally the HTOC Program support was a part of work required under task orders IND14PD00949 and IND14PD00950 for HHS Enterprise Security Program Support. Alyn was a subcontractor under these task orders providing the HTOC Maturation Support. These orders expired in Fiscal Year (FY) 2020 and were replaced by separate task orders each with their own performance work statement (PWS). The follow-on HTOC Maturation Support requirement, task order 140D0421F0235, was solicited and awarded by DOI/IBC/AQD to Alyn on a limited-sources basis in accordance with FAR 8.405-6(a)(1)(i)(B) with only one source having the capability to provide the services required at the level of quality required because the services are unique and highly specialized. Following the expiration of this task order, HHS procured and awarded the follow-on requirement, task order 75P00123F80120, to Alyn also on a limited-sources basis in accordance with FAR 8.405-6(a)(1)(i)(B).

Further market research was conducted by searching GSA eLibrary for the required services. Other contractors on GSA MAS SIN 54151HACS were examined to determine if any other contractors could potentially have the capability of fulfilling this requirement.

Several contractors were identified on this SIN that could provide cybersecurity support services; however, no other contractor is able to quickly meet the HOTC program maturation requirements outlined in the Statement of Objectives (SOO) without causing significant delays in contractor support and continuation of HTOC program maturation, increased cybersecurity threats, and increased costs to the Government.

7. Any other facts supporting the justification.

Cybersecurity threats to the US Government continue to increase year after year. The Government Accountability Office (GAO) published in their 2023 High-Risk Series that cybersecurity and cyber threats to Government systems are a high-risk area for the Government expressing the need to ensure the cybersecurity of the Nation. The most recent large-scale attack, SolarWinds, in December 2020 highlighted the weaknesses of Government agencies. The importance that HTOC maturation brings to addressing these issues is that it creates a network between the three largest Government healthcare agencies that allows sensitive information exchange and combined protection from these cybersecurity threats. This program further increases the strength of these agencies’ cybersecurity responses; however, maturation of the HTOC program to a fully operational state is necessary.

A Request for Quotation (RFQ) will not be released on GSA eBuy as it has been determined that there is only one source capable of providing the HTOC maturation support services required at the level of quality required because the services are unique and highly specialized. After the placement of the task order, a notice will be posted on SAM.gov along with a redacted copy of the approved Limited-Sources Justification in accordance with the requirements at FAR 8.405-6(a)(2).

8. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the restricted consideration before any subsequent acquisition for supplies and services is made.

This requirement is to bring HTOC to a mature and fully operational state, at which time the process becomes automated and ingrained in the workflow processes of the involved agencies. At that time, the requirement for HTOC would then change from building and developing of the HTOC to maintenance support of the HTOC. During the period of performance of this anticipated task order, the needs of the HTOC maturation will be examined. If HTOC has reached maturation, then competition will occur for the maintenance support of the HTOC program. The included option period allows flexibility to respond to cybersecurity threats and allows Alyn the time necessary to ensure full maturation of the HTOC which is expected to be reached in 2025. Once the HTOC program has reached maturation and is in a fully operational state, future contract support may be competed as the confined expertise and experience of Alyn is expected to no longer be required.

9. The ordering activity contracting officer’s certification that the justification is accurate and complete to the best of the contracting officer’s knowledge and belief.

I certify this justification is accurate and complete to the best of my knowledge and belief.

Date

Contracting Officer

10. Evidence that any supporting data that is the responsibility of technical or requirements personnel (e.g., verifying the Government’s minimum needs or requirements or other rationale for limited sources) and which form a basis for the justification have been certified as complete and accurate by the technical or requirements personnel.

I certify the technical data which forms a basis for this justification is complete and accurate and meet the Government’s minimum needs.

Program Office/COR

11. For justifications under 8.405-6(a)(1), a written determination by the approving official identifying the circumstance that applies.

Under the authority of FAR 8.405-6(a)(1)(i)(B), only one source is capable of providing the services required at the level of quality required because the services are unique and highly specialized to the HHS OCIO OIS HTOC program; therefore, the approving official hereby determines the circumstances of this action can only be provided by Alyn, Inc.

12. Reviews and Approvals

Concur

Branch Chief

January 8, 2024

01/08/2024

Concur

Division Chief

Approve

Bureau Competition Advocate

1/10/2024

1/11/2024