Security Operations Center JEFO Redacted_Redacted.pdf

U.S. Customs and Border Protection Justification for Exception to Fair Opportunity (JEFO) – FAR 16.505(b)(2)(ii)(B)

Date: June 29, 2025 PR Number: 20146850

1. Agency and Contracting Activity.

The Department of Homeland Security (DHS), U.S. Customs and Border Protection (CBP), Office of Information and Technology (OIT), Cybersecurity Directorate (CSD), and the Office of Acquisition (OA), Information Technology Contracting Division (ITCD), prepared this justification for an exception to fair opportunity.

2. Nature and/or description of the action being approved.

CBP intends to execute a sole source award to the current incumbent contractor for Cyber Security Operations Center services under the GSA Alliant II government Wide Contract Vehicle (GWAC).

This action will provide continuity of service for the mission critical CBP Cyber Security Operations Center services contract and ensure that the cybersecurity mission of CBP can continue without a lapse in service.

Awardee:

Leidos Inc.

9737 Washington Drive Gaithersburg, MD 20878

3. A description of the supplies or services required to meet the agency’s need (including the estimated value).

The contractor supports CBP Cyber Security Operations Center services assisting in the management, maintenance, and support of CBP Security Operations Center (SOC) 24 hours a day, 7 days a week, 365 days a year to protect the CBP information systems infrastructure.

The following tasks and services are to be provided:

Program Management / Project Management Cyber Defense Forensics (CDF) Support Attack Sensing & Warning (AS&W) Support Cyber Incident Response Team (CIRT) Support Cyber Threat Intelligence (CTI) Support Cyber Risk Management (CRM) Support Security Modernization (SecMod) Support Vulnerability Assessment (VA) Support Security Engineering and Sustainment (SES) Support

Enterprise Logging Solution (ELS) Support Development Security Operations (DevSecOps) Support (Optional) Information System Security Officer (ISSO) Support Cyber Threat Hunting (CTH) Support Operations Enhancement (OE) Support Office of Professional Responsibility Cyber Investigations (CI) Support Security Technology & Policy (STP) Support

The estimated value of the firm, fixed-price (FFP), six (6) month Cyber Security Operations Center services contract for primary security operation center support, required travel, and contract access fee (CAF) totals .

4. Identify the exception to fair opportunity and supporting rationale, including a demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the exception cited.

X_ FAR 16.505(b)(2)(i)(B). Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

Rationale:

Analysis indicates that this contractor is the only source capable of continuing performance without interruption to mission critical operations. Any lapse in service would cause a ripple effect of detrimental mission impact to not only CBP, but other DHS sister agencies. The daily duties of the CBP SOC team have widespread safety implications across all of DHS and throughout the United States. By ensuring that the network is not only secure by mitigating persistent relentless cyber-attacks to protect the CBP network which if shutdown would result in millions of dollars of trade, fees, and customs fees lost to the Federal Government. CBP SOC plays critical roles in protecting our national borders from threats, ensuring the safety of the public and our officers while protecting our network infrastructure from persistent ongoing cyber threats. The CBP SOC is unique, demanding specialized skillsets, toolsets, and significant financial investment, given its critical mission to safeguard national borders by defending a complex digital landscape where cyber and physical security converge, protecting critical infrastructure, handling sensitive data, and mitigating the immense economic consequences of security breaches on trade and travel.

The specialized services required include advanced threat detection and response, incident response and forensics, penetration testing, vulnerability assessments, and compliance with federal cybersecurity standards. These services are critical to maintaining the security and integrity of CBP’s information systems. Leidos has provided highly specialized cybersecurity services to CBP for the past several years, demonstrating an unmatched understanding of our systems, threats, and operational requirements. Their skillset and methodologies have been integral in protecting CBP’s critical infrastructure. Leidos has proven ability to deliver advanced, integrated cybersecurity solutions, and its comprehensive full-spectrum cyber capabilities, including advanced analytics and specialized Zero Trust implementation.

In addition, Leidos supports the Computer Incident Response Team efforts through direct operational involvement, comprehensive planning, and advanced tools for incident detection and remediation, while also specializing in high value asset scanning via continuous vulnerability assessment, critical infrastructure protection, and advanced physical and digital scanning technologies, further enhancing security with proactive cyber threat hunts and penetration testing.

5. Determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

To determine whether the anticipated cost to the Government will be fair and reasonable, the proposed pricing will be evaluated against the existing IDIQ ceiling rates as well as historical data for this requirement. The rates will be reviewed by the Contracting Officer (CO) to ensure they are in line with the IDIQ rates and the current task order rates. CBP has developed an independent government cost estimate (IGCE) and the CO will compare the proposed price to the IGCE and historical pricing.

6. Any other facts supporting the justification.

Leidos has a proven track record in managing top secret clearances for personnel and ensuring compliance with all security protocols and regulations. Switching to a new contractor for this period would increase overall risk and reduce support to CBP. The impact of a lapse in service to CBP can have far-reaching consequences, compromising national security, disrupting economic activities, jeopardizing public safety, and impairing the overall efficiency and effectiveness of border management operations. By leveraging the current specific skillsets and capabilities, CBP can effectively justify the selection of the existing contractor for cybersecurity services requiring top secret clearances.

7. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the exception to fair opportunity before any subsequent acquisition for the supplies or services is made.

The agency intends to compete this requirement under the Government Wide Acquisition Vehicle GSA Alliant II in Fiscal Year 2026 quarter one.

8. CBP shall post this justification on SAM.gov pursuant to FAR 16.505(d) within 14 days after placing an order exceeding the simplified acquisition threshold.