Single Source - FAR Part 13.5_Redacted.pdf

SharePoint ID: SP-CIO-221651 Page 1 of 4

FAR Part 13.5 Single Source Justification Template Version Date: XX/2023

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION

In Accordance with FAR 13.501(a)

For Commercial Contract Actions Above the Simplified Acquisition Threshold (SAT) Not to Exceed the Threshold at FAR 13.500(a)

1. Agency and Contracting Activity:

a. Requesting Activity:

Office of Personnel Management (OPM) Office of the Chief Information Officer (OCIO) Cybersecurity Division (CD) 1900 E Street NW Washington, DC 20415

b. Contracting Activity:

Office of Personnel Management Office of Procurement Operations (OPO) 1900 E Street NW Washington, DC 20415

2. Nature/Description of Action: Cybersecurity Training from the SANS Institute

a. Type of Action: New firm fixed price award.

b. Amount the current justification is justifying (including all options):

c. Brief Description: OCIO intends to procure services from the following company:

SANS Institute 1120 Rockville Pike, Suite 200 North Bethesda, MD 20852

3. Description of Supplies/Services: The Office of the Chief Information Officer (OCIO), Cybersecurity Division (CSD), requires Cloud Security Training from the SANS Institute for 2x OPM Virtual Training Courses of 15 Students each, and 3x On-Demand Self- Paced Training Courses of a total of 19 Students.

4. Authority and Circumstance to Justify Sole Source (including Brand Name):

Authority Circumstance ☒ 41 U.S.C.3304(a)(1) When the supplies or services required by the agency are available from only one responsible source and no other type of supplies or services will satisfy agency requirements.

SharePoint ID: SP-CIO-221651 Page 2 of 4

Version Date: XX/2023

Authority Circumstance ☐ 41 U.S.C.3304(a)(2) When the agency’s need for the supplies or services is of such an unusual and compelling urgency that the Government would be seriously injured unless the agency is permitted to limit the number of sources from which it solicits bids or proposals.

☐ 41 U.S.C.3304(a)(3) It is necessary to award the contract to a particular source or sources in order-

(i) To maintain a facility, producer, manufacturer, or other supplier available for furnishing supplies or services in case of a national emergency or to achieve industrial mobilization;

(ii) To establish or maintain an essential engineering, research, or development capability to be provided by an educational or other nonprofit institution or a federally funded research and development center; or

(iii) To acquire the services of an expert or neutral person for any current or anticipated litigation or dispute.

☐ 41 U.S.C.3304(a)(4) It is precluded by the terms of an international agreement or a treaty between the United States and a foreign government or international organization, or the written directions of a foreign government reimbursing the agency for the cost of the acquisition of the supplies or services for such government.

☐ 41 U.S.C.3304(a)(5) A statute expressly authorizes or requires that the acquisition be made through another agency or from a specified source; or

The agency’s need is for a brand name commercial product for authorized resale.

☐ 41 U.S.C.3304(a)(6) The disclosure of the agency’s needs would compromise the national security unless the agency is permitted to limit the number of sources from which it solicits bids or proposals.

SharePoint ID: SP-CIO-221651 Page 3 of 4

Version Date: XX/2023

Authority Circumstance ☐ 41 U.S.C.3304(a)(7) The agency head determines that it is not in the public interest in the particular acquisition concerned.

5. Rationale Supporting the Circumstance to Justify Sole Source (including Brand

Name):

The Office of the Chief Information Officer (OCIO), Cybersecurity Division (CSD), requires Cloud Security Training from the SANS Institute as they are the only vendor with GIAC Certificate Authority.

It is essential to the success of the implementation of cloud cybersecurity that personnel have appropriate skills necessary to perform that work to standards that are acceptable.

With that there is only a single entity that can verify that personnel have the skills necessary which is GAIC Certificate Authority. GAIC is the only source that can provide all five (5) cloud security certification requirements: GIAC Cloud Security Essentials Certification (GCLD), GIAC Cloud Security Automation (GCSA), GIAC Cloud Threat Detection (GCTD), GIAC Certified Web Application Defender (GWEB), and GIAC Public Cloud Security (GPCS). These certifications allow OPM OCIO to demonstrate that personnel performing the OPM modernization effort to the cloud have the technical knowledge and capability to meet that challenge.

It was also identified that the vendor System Administration, Networking, and Security (SANS) Institute has a unique affiliation with GAIC to provide cloud security certification training and is the only identified affiliate trainer for GAIC Certification training.

6. Solicitation of Sources:

An initial search was conducted to assure that the requested services were not already being provide by a contracted resource or available under an existing Blanket Purchase Agreement (BPA). Multiple searches were conducted via the internet and companies were reached out to in the market research. Most of the companies did not have or did not provide authorized training for GAIC certification. SANS Institute is the only vendor that meets OPM’s needs. While there are authorized resellers, based on their own information, they would not be able to provide the best value to the government based on their significantly increased pricing.

A synopsis will be published on SAM. GOV.

7. Fair and Reasonable Determination:

As mentioned, the SANS Institute and authorized resellers were contacted regarding the pricing for the required classes. All the authorized resellers would provide a certain