SAMHSA IT Security JEFO Signed_Redacted.pdf

c. FAR 16.507-6(b)(3) - The order must be issued on a sole-source basis in the interest of economy and efficiency because it is a logical follow-on to an order already issued under the contract, provided that all awardees were given a fair opportunity to be considered for the original order.

A sole-source bridge contract is being requested for the current vendor, Centerpoint LLC to continue providing services due to the criticality and ongoing nature of the cyber security services required to protect SAMHSA's Information Technology (IT) systems and applications.

This sole source action is economical and efficient because SAMHSA operates over many IT systems with numerous unique security configurations that are essential to its operations. The contractor personnel supporting these systems must possess a combination of cyber security skills and specific system knowledge, which can only be achieved through a proper contract transition and knowledge transfer sessions over an extended time period (typically 30-60 days).

The current vendor has a dedicated staff with the necessary expertise, system knowledge, and specialized training to effectively perform this work. Transitioning to a new vendor without proper preparation would be impractical/impossible because prior knowledge and understanding of specific configurations for system-specific controls is required as it relates to the specific SAMHSA environment to perform the job function. Transitioning to a new vendor at this juncture into the process will cause delays in meeting HHS goals and potential systems outages.

The SAMHSA systems and applications are accessed daily by a large number of internal and external users. Any disruption in the cybersecurity services provided by the vendor would have severe consequences for SAMHSA's mission and business processes. The potential risks include increased information security risks and potential non-compliance with essential security and access control policies. Failure to award a bridge contract to the current vendor would put HRSA at risk of data breaches, compliance violations and disruptions to its mission-critical applications. This could lead to significant operational inefficiencies and potential legal consequences.

5. Agency actions to take to remove barriers that led to Fair Opportunity Exception (if applicable): Not Applicable. A competition for these services is currently ongoing.

6. Market Research: Market Research documentation is attached.

7. Additional Information or Other Facts: Not Applicable.

8. Technical or Requirements Program Management Certification: I certify that the supporting data under my cognizance which are included in this justification (e.g., verifying the Government’s minimum needs or requirements or other rationale for an exception to fair opportunity are accurate and complete to the best of my knowledge and belief. (Always required.)

Title CISO Signature & Date:

10. Fair and Reasonable Price Determination: As the contracting officer, I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable.

Price analysis will be used to determine that the pricing for this order is fair and reasonable.

The NITAAC contract includes contract labor rates that have been determined to be fair and reasonable and will be used with other pricing data received from the contractor to determine that the pricing on the bridge is fair and reasonable.

This determination will be made using the following: ☐ cost analysis ☐ price analysis ☐ cost realism ☐ market pricing ☒ historical pricing ☐ other:

As a part of this basis, certified cost, or pricing data (see FAR 15.403)— ☐ will be required. ☒ will not be required and the following FAR part 15 exception applies:

☐ Prices that will be agreed upon are based on adequate price competition.

☐ Prices that will be agreed upon are based on prices set by law or regulation.

☒ A commercial item is being acquired.

☐ A waiver has been granted by the HCA in accordance with FAR 15.403-2(c)(4).

☐ The contract action is a modification to a contract or subcontract for commercial item(s).

☐ The estimated cost of the contract action is less than the threshold for certified cost or pricing data.

11. Contracting Officer (CO) Certification and Approval: I hereby certify that this justification is accurate and complete to the best of my knowledge and belief. (Always required; CO approval authority is limited to $900,000.)

Robert Burdette Contracting Officer Signature & Date: