Sole Source Justification _ELK Support_Redacted.pdf

Department of Transportation Federal Highway Administration

IT Acquisition Center of Excellence

SOLE SOURCE JUSTIFICATION

LOGICAL FOLLOW-ON

ORDER NO. 693JJ321A000003_693JJ322F000061

The Department of Transportation (DOT) makes this Justification for orders pursuant to Federal Acquisition Regulation (FAR) 8.401(b) and GSAR 538.7104-3(b)(2).

i.) Identification of Agency and Contracting Activity:

Program Office:

DOT, Office of the Secretary (OST) Office of the Chief Information Officer (OCIO) 1200 New Jersey Avenue, SE Washington, D.C. 20590

Contracting Activity:

Federal Highway Administration (FHWA) IT Acquisition Center of Excellence (ACE) 1200 New Jersey Avenue, SE Washington, D.C. 20590 ii.) Nature and/or Description of Action Being Approved:

The OCIO has a need to extend the cybersecurity management support services under Cyber Security Information & Program Services (CSIPS) Blanket Purchase Agreement (BPA) Order 693JJ322F000061 awarded to Criterion Systems to support the Department’s ELK Stack for Elasticsearch, Logstash and Kibana. This is in support of Federal directives and law, including Executive Order 14028, OMB-M-21-31, the Federal Information Security Modernization Act of 2014 (P.L. 113-283), the Clinger-Cohen Act of 1996 (P.L.

104-106), the IoT Cybersecurity Improvement Act of 2020 (P.L. 116-207), the Homeland Security Act of 2002 (P.L. 107-296), and the Budget and Accounting Act of 1921 (P.L. 67- 13). This Order was scheduled to expire on 07/16/2025 and was extended by eleven (11) months through 06/16/2026 via modification P00009. A further extension is needed to avoid any disruption to departmental cyber support while DOT goes through the process of restructuring the Department’s information technology workforce and determines whether this support can be reduced or fully assumed by Federal employees. This action will extend the period of performance end date to 9/30/2026.

iii.) A Complete Description of Supplies/Services Required to Meet Agency’s Need:

This task order provides a broad range of technical and professional services to the DOT, including required logging capabilities to meet OMB-M-21-31 requirements. Awarded to Criterion Systems, the cybersecurity support provides mission essential tasks. In accordance with National Institute of Standards of Technology (NIST) SP Publication 800- 53 Security and Privacy Controls for Information Systems and Organizations, Executive

Order 14028 Improving the Nation's Cybersecurity, OMB-M-21-31 Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents. DOT must develop and sustain the capability to provide logging, log retention, and log management, with a focus on ensuring centralized access and visibility for the highest-level enterprise Security Operations Center (SOC). This resource provides engineering support to develop and sustain the DOT capability, supporting over 100 information systems already onboard with another 50 systems in process. Without this support, capacity would decrease sharply, resulting in system downtime and service delays.

Deliverables include data on boarding (list of 50+ data sources from all modes), dashboard creation, operation and maintenance of Elastic Cloud, and upgrading platform and agents.

This modification P00012 to order 693JJ322F000061 will extend the order by three and half (3.5) months, through 9/30/2026. The anticipated value over the extension period of performance is .

iv.) The Authority and Supporting Rationale:

This Justification is prepared as required by FAR 8.401(b) and GSAR 538.7104-3(b)(iii).

The applicable rationale for the sole source for this action is:

The order should be issued on a sole source basis in the interest of economy and efficiency because it is a logical follow-on to an FSS order already issued on a competitive basis.

The original acquisition was conducted as a competitive call order under the multiple-award CSIPS BPAs issued against the General Services Administration (GSA) Multiple Award Schedule (MAS).

Criterion Systems has a management and subject matter team in place providing these services and is familiar with the DOT environment. Over the span of this engagement, DOT has dramatically increased compliance with logging requirements by ingesting multiple logs across all DOT HQ (non-FAA) systems and provided increased response capabilities in the event of a security incident or appropriate data requests.

The Department has already invested significant time and resources in establishing and identifying the requirements of implementing logging capabilities across the Operating Administrations (OAs). This requirement is critical to meeting new mandates and strategic implementation already underway within DOT’s workforce and information systems. If engagement support is not continued, it would place the Department and its information systems at significant risk and critical compliance with OMB and EO mandates would not progress. Without an extension of this order, DOT loses the nuanced understanding of its own logging requirements and sources.

v.) Determination By The Contracting Officer That The Anticipated Cost to The Government Will be Fair and Reasonable:

The rates and level of effort proposed under the Order were determined to be fair and reasonable through the competition at the base order. The current rates proposed for this extension are based on the rates from the BPA with about % discount. Please note that the BPA rates were proposed in the base award from the Criterion GSA Schedule and GSA schedule price are already determined to be fair and reasonable.

NOTE: This action is a logical follow-on to the competed Order No.

693JJ321A000003_693JJ322F000061 under the GSA Schedule No. GS-35F-0032V.

vi.) Any Other Facts Supporting the Justification:

Not applicable.

vii.) Statement of the Actions the Agency May Take to Remove or Overcome any Barriers that Led to the Restricted Consideration Before Any Subsequent Acquisition for the Supplies or Services is Made:

None. The follow-on order will be awarded on a competitive basis if continuation of contractor services is anticipated.

viii.) Contracting Officer Certification that the Justification is Accurate and Complete to the Best of the Contracting Officer’s Knowledge and Belief:

I hereby certify that this justification is accurate and complete to the best of my knowledge, and I determine based on the findings above that the sole source approach is in accordance with the requirements and is in the best interest of the Government.

Ajmal Khan Date Contracting Officer

FHWA IT-ACE

ix.) Evidence that any supporting data that is the responsibility of technical or requirements personnel (e.g., verifying the Government’s minimum needs or requirements or other rationale for limited sources) and which form a basis for the justification have been certified as complete and accurate by the technical or requirements personnel.

Supporting data provided by technical or requirements personnel has been certified as complete and accurate as demonstrated by reasonable technical review and adherence to current task order rates.

x.) Written Determination by the Approving Official:

I hereby certify that this justification is accurate and complete to the best of my knowledge, and I determine based on the findings above that the limit sources approach is in accordance with the requirements and is in the best interest of the Government.

Justin Ubert Date Supervisory Information Technology Specialist Office of the Secretary of Transportation, OST