SecOps Interim Order -8 LSJ_Redacted.pdf

CISAM 3008.405-690(a)(2) Limited-Sources Justification (LSJ)

For orders or BPAs exceeding the Simplified Acquisition Threshold

LSJ No: Page 1 of 6

LSJ Number: PR Number:

Limited-Sources Justification

1. Agency and Contracting Activity.

The Department of Homeland Security (DHS), U.S. Citizenship and Immigration Services (USCIS), Office of Contracting (OCON), proposes to extend the interim task order award for Security Operations (SecOps) Support Services, 70SBUR22F00000127, via FAR Clause 52.217- 8, on behalf of the USCIS Office of Information Technology (OIT), Information Security Division (ISD), Security Operations Branch (SOB). Pursuant to FAR 8.405-6, Limiting Sources, this justification will cover the dollar value and period of performance of the full six (6) months allowable under FAR Clause 52.217-8 as this information was not included in the initial limited-sources justification that was approved on May 10, 2022.

2. Nature and/or description of the action being approved.

USCIS requests a hybrid firm-fixed price (FFP) and labor hour (LH) contract modification to task order 70SBUR22F00000127 with Solutions By Design II, LLC. (Unique Entity Identifier:

MXCNBCPZM7Z4), 1953 Gallows Rd, Ste 650, Vienna, VA 22182-4096. The intent of the modification is to exercise FAR Clause 52.217-8 to extend services for six (6) months. This anticipated action will provide continuation of critical services while USCIS competitively procures these services through the approved acquisition strategy for Cyber Security Support Services (C3S) – Operations. The Government projects award of this option in February 2023 for the period of performance covering March 16, 2023, to September 15, 2023. While the Government evaluated price reasonableness at time of award, the evaluated price has changed based on subsequent modification actions. Therefore, this limited-sources justification is necessary to exercise FAR Clause 52.217-8 with respect to these changes.

3. Description of Supplies/Services.

The Security Operations (SecOps) Support Services interim task order awarded to Solutions By Design II on June 14, 2022, hereafter called SecOps interim task order, is an order for professional services to identify, protect, respond, and recover from cybersecurity threats that was placed on a sole source basis under the General Services Administration (GSA), Highly Adaptive Cybersecurity Services (HACS), Multiple Award Schedule (MAS), Special Item Number (SIN) 54151. These services support the mission of the USCIS/OIT/ISD by identifying cyber security risks to USCIS systems and data and establishing appropriate safeguards that will prevent, limit, or contain the impact of a cyber security event in the future, such as those related to the SolarWinds vulnerabilities and providing support for the security of the unclassified USCIS Enterprise boundary and integrated Local Area Networks (LAN’s), cloud environments, and between DHS OneNet and USCIS CISNet.

CISAM 3008.405-690(a)(2) - Limited-Sources Justification (LSJ)

LSJ No: Page 2 of 6

On January 26, 2022, the Office of Management and Budget (OMB) released a Federal strategy to move the entire U.S. Government toward a “zero trust” approach to cyber security. This strategy comes in response to the May 12, 2021, Executive Order (EO) 14028 on Improving the Nation’s Cyber Security in which President Biden directed the federal government to dedicate itself towards advancing security measures that dramatically reduce the risk of successful cyber-attacks against the Federal Government’s digital infrastructure. USCIS has committed itself to improving its resilience to cyber security threats by embracing two concepts that align with and enable this priority: the Secure Access Service Edge (SASE) security model and Zero Trust Network Architecture (ZTNA).

Zscaler is the SASE based solution that USCIS is implementing to help meet these priorities.

USCIS is required to immediately commence with the design, implementation, and deployment of Zscaler, and these services are being provided under the current SecOps interim task order.

The SecOps interim task order is currently assisting USCIS in implementing integration and automations designed to orchestrate extended detection and response capabilities that collect and correlate data from ZScaler’s multiple policy layers – endpoint, server, cloud workload, and network. This allows for faster detection of threats and improved investigation and response times through security analysis.

Outstanding key tasks for this effort include:

Estimated to be completed by 11/30/2022; Develop customized Security Orchestration Automation Response integration capabilities with ZScaler and Swimlane.

Estimated to be completed by 6/31/2023; Develop rules and governance policies that provide SecOps analysts a centralized view into all inbound and outbound traffic and allows the analyst to look at Zscaler artifacts, capture suspicious indicators and perform reputation checks or lookups all with a single click. This reduces the number of manual steps and time that an analyst would require to identify and hunt for threats. Once Zscaler deems an indicator of compromise as malicious, Swimlane can automatically have Zscaler enforce a block policy from within its user interface, without requiring the analyst to log into multiple systems or switch screens.

o Once integration is completed, validate Zscaler allows the analyst to keep on top of threats by performing security actions that go across ZScaler’s access control, SSL inspection, advanced threat protection and data protection capabilities all from within Swimlane’s user interface.

o Develop playbooks to automate a host of analysts’ actions so that analysts have a security event information at their fingertips when starting an incident investigation o Develop conditional tasks within playbooks can help reduce false positives and ensure that analysts investigate incidents that have been confirmed as malicious.

Given the specialized nature and urgency of this response, USCIS requires a six (6) month extension to allow Solutions By Design II, LLC. (SBD) time to complete the outstanding tasks to mitigate the significant risk to USCIS and provide enough time for the succeeding competitive procurement to be finalized and awarded. This extension will also provide the continuation of services in support of the SecOps Program which includes Security Operations Center, Development Operations (DevOps), Security Solutions Research and Development, Cyber

LSJ No: Page 4 of 6

USCIS is currently actively working on the recompete acquisition of this requirement. However, the EO required additional work that could only be accomplished by the incumbent. Because of the short duration of this proposed extension and extensive knowledge required to transition each function, there is no portion of this work that can be segregated to allow for competition in a four

(4) month period.

There are no alternatives to exercising FAR Clause 52.217-8 because this work cannot be separated out and performed by another contractor. It is so integrally related to the rest of the order that only SBD can perform the work. In addition, the time it would take to solicit competitively, award and transition (EOD process) for this work would outweigh the benefit and possible cost savings for the remaining six (6) months of this requirement. There would be significant negative impact to the services being provided by the current contractor if the Government made an attempt to split services at this juncture in the requirement.

Without continuation of services on this task order, there will be substantial duplication of cost and an unacceptable mission degradation across nearly all USCIS and the stakeholders they support. The current SecOps contractor is currently identifying cyber security risks to USCIS systems and data and establishing appropriate safeguards that will prevent, limit, or contain the impact of a cyber security event in the future, such as those related to the SolarWinds vulnerabilities and providing support for the security of the unclassified USCIS Enterprise boundary and integrated Local Area Networks (LAN’s), cloud environments, and between DHS OneNet and USCIS CISNet.

The inability to perform the above-mentioned tasks would expose USCIS to significant cyber security risks within the increased threat landscape.

5. Determination by the ordering activity contracting officer that the anticipated order represents the best value consistent with FAR 8.404(d).

The contracting officer has determined that exercising FAR Clause 52.217-8 under the proposed task order with SBD represents the best value and will result in the lowest overall cost, considering price and administrative costs, to meet the Government’s needs. The initial award was placed in accordance with FAR 8.404, “Use of Federal Supply Schedules.” GSA has already negotiated fair and reasonable pricing rates, and discounts to these GSA schedule rates were requested prior to making an award.

6. A description of the market research conducted among schedule holders and the results, or a statement of the reason market research was not conducted.

Market research was not conducted specifically for this action to exercise FAR Clause 52.217-8.

However, market research is ongoing throughout the life of the task order. At the time of modification P00003, when option period 1 was incorporated into the base period of performance, market research from the base award, 70SBUR22F00000127, was reviewed and remained valid. Market research from the C3S – Operations recompete was also reviewed. The marketplace has not substantially changed since the incorporation of option period 1 into the base period of performance and it is impossible to accomplish this requirement via any other

LSJ No: Page 5 of 6 action or contractor. Only one source is capable of providing the services required at the level of quality required because the services are unique or highly specialized. As the services are highly specialized it is in the Government’s best interest to continue with the contractor already performing these services for the exercise of FAR 52.217-8. The recompete for this requirement is ongoing. This limited-sources justification is for continuation of services required for the interim six (6) months until Zscaler project is completed and the new award is in place.

7. Any other facts supporting the limited-sources justification.

The SecOps Program is the first lines of defense for the USCIS network and systems. In the last year, USCIS has fended off several known cyber-attacks. The SecOps Program is comprised of several core components protecting access to the network and systems in the areas of user authorization, authentication, privileged access management, secret key management in hardware, and device certificate management. Together these components represent a comprehensive and innovative approach to addressing the needs of an every-changing environment and world.

8. A statement of actions, if any, the agency may take to remove or overcome any barriers that led to restricted consideration before any subsequent acquisition for the supplies or services is made.

The proposed extension of the SecOps interim task order via FAR Clause 52.217-8 will provide enough time for the current contractor to complete the outstanding tasks related to the Zscaler project, mitigate any risk in lapse of service in case the project is not completed within the current estimated timelines, and provide enough time for the succeeding competitive procurement to be finalized and awarded. USCIS does not anticipate requiring additional sole source awards for this requirement after execution of this action. The Government is currently recompeting this requirement under the name of C3S – Operations via GSA HACS MAS SIN 54151 as an 8(a) set-aside and plans to make an award in fiscal year 2023.

In order to eliminate barriers to competition, OIT will continue to conduct surveillance of the marketplace to determine if there are alternative technical solutions that will allow for cost effective changes. The Government will continue to seek competition in future acquisitions for the same type of support, thus, eliminating the barriers to competition.

9. USCIS intends to post this requirement on Beta.SAM.gov pursuant to FAR 8.405- 6(a)(2)(i).