Sole Source Justification Final.pdf

U.S. Department of Transportation (US DOT) Justification For Other Than Full And Open Competition

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION

Defensive Counterintelligence and Insider Threat Program (DCIITP) Support Services

Contract #693JK426C600016

This Sole Source Justification (SSJ) is prepared pursuant to the authority of 41 U.S.C. § 3304(a)(1)) as set forth under Revolutionary Federal Acquisition Regulation (FAR) Overhaul (RFO) Part 6.103 - Other than full and open competition, subsection RFO Part 6.103-1 – Only one responsible source and no other supplies or services will satisfy agency requirements. Further, the sections follow the content required by RFO Part 6.104-1

1. Agency & Contracting Authority:

Office of Intelligence, Security, and Emergency Response (S60) Office of the Secretary (OST) Department of Transportation Washington, DC 20590

2. Nature of Action Being Approved:

Approval of a sole source, Firm-Fixed Price (FFP) on a contract acquisition to be awarded to PKH Enterprises, LLC for professional Insider Threat investigative and analyst support services.

About the Defensive Counterintelligence and Insider Threat Program (DCIITP):

Governed by DOT Order 1642.1A and established in direct compliance with Executive Order 13587, the DCIITP serves as the Department of Transportation’s formalized framework for safeguarding departmental assets against internal vulnerabilities and foreign intelligence adversaries. The program actively secures DOT’s personnel, critical transport infrastructure, and sensitive data networks by fusing advanced technical monitoring with proven counterintelligence methodologies.

By establishing a unified defensive posture, the DCIITP enhances the department’s capabilities to preemptively identify and neutralize security risks before they disrupt vital national infrastructure.

The strategic mission of the DCIITP is to deter, detect, and mitigate risks posed by individuals with authorized access who may—either wittingly or unwittingly—compromise national security.

Spanning all DOT operating administrations, including a highly scaled, dedicated Federal Aviation Administration (FAA) Defensive CI and Insider Threat Programs, the program applies uniformly to all federal employees, contractors, and digital networks. It addresses two primary risk vectors:

malicious or negligent insider threats, which include sabotage, unauthorized data leaks, and severe cyber hygiene failures; and aggressive exploitation by Foreign Intelligence Services seeking to conduct espionage or steal intellectual property within the U.S. transportation sector.

Ultimately, the DCIITP shifts the Department of Transportation from a reactive security posture to a proactive risk-mitigation shield. By focusing strictly on objective behavioral and systemic anomalies rather than demographic profiling, the program isolates technical risks and human vulnerabilities early. This objective focus allows the department to intervene constructively to support vulnerable personnel and fortify critical assets well before a security breach can materialize.

3. Description of Supplies or Services:

Following a market review, DCIITP determined that PKH is the unique provider possessing the necessary expertise and experience to deliver hands-on operational, technical, and programmatic insider threat support to U.S. Government agencies. Specifically, PKH enables agencies to identify, assess, and mitigate insider risks by delivering:

• Core Analytics & Operations: Behavioral risk analysis, baseline behavior analytics, vigilance case triage, and tool/data integration.

• Programmatic Frameworks: Insider Threat Framework implementation and enterprise policy development.

• Stakeholder Alignment: Facilitating critical coordination across counterintelligence, Human

Resources, Information Technology, Security, and legal divisions.

4. Statutory Authority (including the proposed contractor’s unique qualifications or the nature of the acquisition that requires use of the authority cited)

41 U.S.C. § 3304(a)(1) via RFO 6.103-1 – Only one responsible source and no other supplies or services will satisfy agency requirements.

PKH Enterprises, LLC (PKH) is the only source physically and technically capable of fulfilling this requirement without causing substantial operational downtime, severe schedule delays, and unacceptable national security risk to the Department of Transportation (DOT). Market research confirmed that alternative market solutions (such as Forcepoint or DTEX) rely on non-compatible technical architectures that do not support DOT’s enterprise software stack. PKH possesses an exclusive operational footprint, proprietary tools, and cleared personnel tailored to DOT’s specific national security mandate:

• Comprehensive market research confirmed that alternative commercial vendors focus on technical solutions not utilized by DOT (e.g., Forcepoint, DTEX). PKH is the only vendor possessing direct, hands-on operational proficiency and active, direct technical partnerships with both Nuix and Cogility. This exclusive technical alignment makes PKH uniquely capable of configuring, optimizing, and extracting immediate operational value from DOT’s baseline software investments without critical operational failure.

• Standard industry vendors lack the specialized architecture experience required to execute DOT's federated insider threat model. PKH is the only source with a proven track record of building, operating, and scaling enterprise insider threat architectures across federal civilian environments, with personnel currently embedded at the Department of Homeland Security (DHS) Chief Security Office, U.S. Secret Service (USSS), and Department of Justice (DOJ) EOUSA.

Because DOT requires an immediate, flawless transition to a federated model to defend critical infrastructure, no other vendor possesses the requisite operational capability to satisfy this requirement.

• PKH owns proprietary User Behavior Analytics (UBA) tuning and anomaly rule development framework that has empirically demonstrated a reduction in false-positive alerts by up to 90 percent across large-scale federal environments. These proprietary algorithms cannot be licensed, replicated, or deployed by any other vendor, making PKH uniquely qualified to establish DOT’s scalable insider threat foundation.

• This contract provides essential operational and technical support to meet expanded department requirements and ensure uninterrupted mission continuity. Additionally, this acquisition secures specialized subject matter expertise and analytical capacity to execute defined performance deliverables.

The complexity of the work and associated integration challenges, as well as critical timelines for operationalizing the Nuix and Cogility platform, compel the DCIITP to award this work to PKH Enterprises, LLC. The reasons are illustrated below:

a. Institutional Knowledge:

• PKH currently performs Nuix and Cogility optimization for the program, and its understanding of DCIITP’s specific analytical infrastructure and technical stack is essential for continuity and to minimize risk on this highly sensitive contract that implicates national security.

• Their existing familiarity with the insider threat system architecture, data flows, integration points, and operational constraints reduces the risk of integration issues and accelerates readiness.

• Institutional knowledge of prior investigative workflows, DCIITP policy considerations, and vendor-developed artifacts eliminates the typical “ramp-up” learning curve, enabling immediate, productive analysis.

• Their awareness of historical pitfalls and other federal agencies-specific mission requirements increases the likelihood of a successful platform deployment and reduces project risk.

• Retaining the incumbent vendor mitigates risk by eliminating transition-related schedule overruns and integration defects.

b. Cost Avoidance:

• Transitioning to a new vendor would require duplicative costs for specialized training, clearance transfers, and software/system environment orientation, resulting in unacceptable delays in fulfilling the program's requirements, and such duplicated costs are unlikely to be recovered through competition.

c. Extended Onboarding Timelines:

• Immediate mission continuity: Personnel associated with the proposed vendor can commence insider threat analytical efforts immediately, significantly reducing delays typically caused by extended onboarding.

• Established stakeholder relationships: The PKH team has cultivated effective working relationships with DCIITP key stakeholders, ensuring efficient communication and program alignment.

• Knowledge of organizational context: New contractors would face steep learning curves regarding DCIITP program terminology, investigative processes, and team dynamic factors already internalized by the current team, effectively reducing risk and ramp-up time.

• Continuity and responsiveness: Experienced team members are immediately available to support Nuix and Cogility triage, answer technical questions, and resolve investigative challenges, maintaining steady mission progress.

• Compressed Timelines: DCIITP’s mission requires immediate platform optimization to successfully transition from Initial Operational Capability (IOC) to Full Operational Capability

(FOC). While the initial User Activity Monitoring (UAM) deployment for testing has already begun, the immediate next step is a phased rollout across the entire department. To execute this expansion, contractor support is required immediately. Currently, DCIITP operates as a "one-deep" manned position, creating a critical single point of failure where a single individual must assume the entire workload for the enterprise. Securing immediate contractor support is vital to mitigate this operational risk, provide sufficient time for comprehensive threat detection, facilitate analyst training, and maintain platform validation throughout the current fiscal cycle.

For these reasons—risk reduction, schedule acceleration, cost avoidance, avoidance of unacceptable delays, and probability of successful delivery—PKH is the only vendor that can meet DOT’s needs for this high-risk national security-sensitive requirement.

5. A description of efforts made to ensure that offers are solicited from as many potential sources as is practicable, including whether a notice was or will be publicized as required by subpart 5.2 and, if not, which exception under 5.202 applies.

The Department conducted a thorough market survey and capability review against the highly specialized technical specifications of the DCIITP, utilizing the Gartner BuySmart framework (scoring vendors against 240 requirements) to determine whether any other vendors were capable of meeting DOT’s need for this unique requirement. The evaluation confirmed that the proposed vendor is the only responsible source capable of managing the complex User Activity Monitoring (UAM), User and Entity Behavior Analytics (UEBA), and integrated Nuix/Cogility platform infrastructure. No other commercial firm possesses the critical combination of active federal operational embedding and platform-specific architectural mastery required to maintain uninterrupted continuity of national security operations.

This immediate necessity is critical given the USDOT’s phased UAM/UEBA deployment, which commenced in June 2026; the lengthy ramp-up period required for an unfamiliar vendor would introduce unacceptable risk to both the project schedule and departmental security.

6. A determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

The Contracting Officer will determine whether the cost to be fair and reasonable prior to award.

The proposed fully loaded hourly rates (ranging from $120/hr to $195/hr) will be validated against historical government contract data and an Independent Government Cost Estimate (IGCE).

7. A description of the market research conducted (see part 10) and the results or a statement of the reason market research was not conducted.

The Department conducted a comprehensive market survey, technical evaluation, and capability review against the highly specialized technical specifications required for the DOT Defensive Counterintelligence and Insider Threat Program (DCIITP). This market research focused on identifying commercial vendors capable of managing complex, enterprise-wide insider threat mitigation frameworks, specifically looking for sources with demonstrated proficiency in User Activity Monitoring (UAM), User and Entity Behavior Analytics (UEBA), and integrated Nuix/Cogility https://www.acquisition.gov/far/part-5#FAR_Subpart_5_2 https://www.acquisition.gov/far/part-5#FAR_5_202 https://www.acquisition.gov/far/part-10#FAR_Part_10 platform infrastructures. The evaluation assessed vendor capabilities in enterprise governance, program management, architectural sustainment, and immediate personnel deployment readiness.

Specifically, our analysis confirmed the absence of any alternative provider that offers:

The formal findings and technical evaluation of the market research yielded the following definitive outcomes:

• Exclusive Enterprise Governance Competencies: The findings demonstrated that alternative commercial vendors lack PKH's embedded expertise across the full spectrum of insider threat program maturity, as required by DOT. This specific operational lifecycle includes enterprise governance, program management, UAM strategy, component coordination, training, strategic communications, and stakeholder management across complex federal civilian sectors.

• Platform-Specific Mastery and Performance Metrics: The technical review established that PKH is the only vendor with hands-on, operational execution of the Six-Step Analytical Process specifically tailored to the DCIITP's newly acquired Nuix platform and Cogility-based entity/link analysis graphs, which DOT requires. PKH also maintains critical integration familiarity with complementary federal tools such as Everfox, Splunk, DTEX, Veriato, and Microsoft Purview.

Furthermore, the research highlighted that PKH's advanced behavioral tuning has a proven track record of achieving up to a 90 percent reduction in false-positive alerts in large federal environments, directly optimizing analytical signal quality.

• Immediate Availability and Elimination of Unacceptable Transition Risk: The research established that PKH is uniquely and immediately available to deploy an active, fully cleared (Top Secret/SCI) workforce within 2–3 weeks of contract award, ensuring zero ramp-up or mission transition risk, which is essential to DOT.

• Avoidance of Cost Duplication and Schedule Failure: Market research indicated that onboarding any alternative source would necessitate extensive reverse-engineering of existing customized configurations and behavioral risk models. This would result in a substantial duplication of costs that is not expected to be recovered through competition. A lengthy onboarding and calibration cycle for an unfamiliar vendor would introduce unacceptable schedule friction, rendering compliance with the United States Department of Transportation (USDOT) in progress phased UAM/UEBA deployment creating an unmitigated vulnerability in the Department’s national security posture.

8. A listing of the sources, if any, that expressed, in writing, an interest in the acquisition.

Market research confirmed that the unique integration requirements are dependent upon the established DCIITP framework, and no other identified source possesses the platform-specific mastery required to maintain mission continuity.

9. A statement of the actions, if any, the agency may take steps to remove or overcome any barriers to competition before any subsequent acquisition of the supplies or services required.

DCIITP will assess opportunities to broaden competition for future acquisitions by documenting proposed vendor processes, capturing technical specifications, and ensuring that sufficient system and operational knowledge is transferred to government staff. Where feasible, the program will update and standardize system documentation, evaluate potential training for alternative vendors, and explore modular or open-architecture solutions to reduce reliance on platform-specific proprietary knowledge. These actions will help enable full and open competition for similar analytical and technical requirements in future procurements.

10. Technical Personnel Certification -

The signature below of the technical representatives certifies that the supporting technical data specified in this document is complete and accurate and justifies the acquisition of the services from

PKH.

11. Contracting Officer Certification – RFO 6.104-1(a)(12)

The signature below of the technical representatives certifies that the supporting technical data specified in this document is complete and accurate and justifies the acquisition of the services from

PKH.

12. Approval of Advocate for Competition for the procuring activity RFO 6.104-2

The signature of OST’s Competition Advocate below approves this justification.

CERTIFICATION:

I certify that the facts and representations under my cognizance which are included in this Justification, along with any other supporting data, which form a basis for this Justification are complete and accurate.

Name: Date [Technical Personnel]

CONTRACTING OFFICER CERTIFICATION:

I certify that this Justification is accurate and complete to the best of my knowledge and belief.

Stephen Jones Date [Contracting Officer]

COMPETITION ADVOCATE APPROVAL:

I approve this Justification as being accurate and complete to the best of my knowledge and belief.

Date Chief Financial Officer (CFO) [OST’s Competition Advocate]