Sole Source Justification ISS final redacted_Redacted.pdf

CUI//SP-SSEL

Version 02/26/2026

FEDERAL SUPPLY SCHEDULE (FSS)

SOLE SOURCE JUSTIFICATION

Solicitation 47QFMA26K0002

Identity Support Solutions in support of:

The Defense Manpower Data Center

(DMDC)

United States (U.S.) General Services Administration (GSA) Federal Acquisition Service (FAS)

Assisted Acquisition Services (AAS) Army

Interagency Agreement Number 47QFMA10S0001

Controlled by AAS Contracting Officer Ryan Mathews: ryan.mathews@gsa.gov

Version 02/26/2026

The General Services Administration (GSA) Assisted Acquisition Services (AAS) makes this FSS Sole Source Justification for orders pursuant to Federal Acquisition Regulation (FAR) 8.4 (GSA Class Deviation Revolutionary FAR Overhaul (RFO)-2025-08) and General Services Acquisition Regulation (GSAR) 538.7104-3 (GSA Class Deviation RFO-2025-FSS-GSAR 538).

1. Identification of Agency and Contracting Activity:

Agency:

GSA AAS acting in support of the Defense Manpower Data Center (DMDC)

Contracting Activity:

GSA AAS Contracting Office (QFACB) 100 S Independence Mall W Philadelphia, PA 19106

2. Nature and/or Description of Action Being Approved:

Request approval of a sole source justification for an award of a task order to Peraton, Inc under the GSA Multiple Award Schedule (MAS) - Information Technology Category. This task order is for IT services for a performance period from 25 September 2026 to 24 June 2027, with the potential to extend to 24 December 2029. This period is comprised of a 9-month base period, plus two, 12-month option periods, plus the maximum 6-month extension authorized by FAR clause 52.217-8. It is anticipated that this task order will be awarded as a Firm Fixed Price (FFP) type order. The total estimated value of the order is (inclusive of the maximum six-month extension period of FAR 52.217-8).

This Identity Support Solutions (ISS) requirement is currently supported by Peraton under two separate GSA BPA Orders; 47QFMA21F0032 Call 24 Global Force Management Data Initiative (GFM DI) and 47QFMA21F0035 Call 27 Legacy Credentialing Operations (RAPIDS). Both orders were awarded under the Defense Manpower Data Center (DMDC) Interoperability Technology & Program Services (ITPS) Blanket Purchase Agreement (BPA) in September 2021 and are set to expire in September 2026. The ISS task order will encompass work from both ITPS BPA Orders as well as provide for the decommissioning of the RAPIDS system and the transition of RAPIDS data into the My DoD Identity Solution (MyDIS) system. The ISS requirement has been determined to be solicited under the PSC DA01 IT And Telecom - Business Application/Application Development Support Services (Labor)/NAICS 541519 Other Computer Related Services.

3. A Complete Description of Supplies/Services Required to Meet Agency’s Need (Including the Estimated Value):

In order to comply with Executive Order 14412 “Securing the Nation Against Advanced Cryptographic Attack”, issued June, 2026, the Department of War (DoW) is initiating a rapid, enterprise-wide transition to deploy quantum-resistant cryptography on high-impact systems by 2030. In support of this, the DoW Chief Information Officer (CIO) announced the release of a Post Quantum Cryptography (PQC) strategy in June 2026.

One of these high impact systems is the DMDC identity ecosystem. This ecosystem is composed of Person Data Repository (PDR), Common Update Framework

Version 02/26/2026

(CUF), Real-Time Automated Personnel Identification System (RAPIDS), and ID Card Office Online (IDCO), and is a mission-critical, highly customized environment that serves as the foundation for physical and logical access across the Department of War (DoW). Put more simply, this environment ensures that secure communications, encrypted emails and digital signatures remain valid, allowing communications within the DoW to only be seen by individuals with the proper credentials.

The CUF manages complex business rules and data transformations that ensure the integrity of information exchanged between PDR and connected systems

The critical delivery of the MyDIS system is seen as the first steppingstone in the DoW CIO’s Post Quantum Cryptography strategy. Accordingly, this task order provides support for the decommissioning of RAPIDS, the transition of RAPIDS data into the MyDIS system and the sustainment of RAPIDS and GFM DI during this process. Once MyDIS is deployed and operating at Full Operational Capacity, it will replace RAPIDS as the DoW’s primary authority for issuing CACs and managing military personnel, retiree, and contractor identities. The RAPIDS-to-MyDIS transition must be supported in four phases:

Phase 1: Develop a comprehensive strategy and schedule for the sunsetting of RAPIDS, including all IDCO functionality, to ensure a seamless transition to the MyDIS system.

Phase 2: Provide direct technical support to extract, format, and validate all necessary data from RAPIDS for ingestion into MyDIS or for storage as necessary.

Phase 3: Maintain RAPIDS in a stable, secure, “maintenance-only” state while MyDIS assumes primary operational duties.

Phase 4: Execute the complete shutdown of RAPIDS, ensure all data is securely archived, and sanitize the operating environment.

This transition is a highly linear, tightly coupled engineering sequence. A contractor performing this work without detailed knowledge of the IDCO/RAPIDS technical environment, including system integrations, API structures, and performance configurations, introduces significant operational risk and threat to national security. Therefore, an extensive transition-in or discovery period would be required for this task order. A minimum of 18 to 24 months of transition-in time would be required at award due to the complexity and scale of DMDC’s legacy credentialing suite and the institutional knowledge and mastery needed from the contractor to successfully transition the RAPIDS data into MyDIS. However, the current DMDC identity environment cannot accommodate a transition-in period of any magnitude due to DMDC’s need for Day 1 readiness in order to complete its credentialing transition objectives on schedule, as they’ve been directed. While basic documentation was done by Peraton on the current BPA orders to allow an overall academic framework for a new contractor to take over the role for sustainment of RAPIDS, there is no way to transfer the practical experience and field experience the incumbent contains that would be needed to support the credentialing modernization effort (RAPIDS decommissioning, transition to MYDIS) within the required DoW timeframe. DMDC’s credentialing suite spans approximately deeply interconnected applications governed by decades of evolving standard policies and congressional mandates, and thousands of policy requirements, Version 02/26/2026 business rules and technical dependencies that must be understood by the contractor to safely manage and operate these systems and applications. A new contractor would have to actively reverse engineer the customized code for these systems and map out how decades of policy are technically enforced, which would take approximately 18 – 24 months. This would result in limited operational stability while also significantly delaying the MyDIS credentialing transition process, adding up to two years of sustainment support for RAPIDS and two years to the separate MyDIS contract to ensure that all functions are understood as well as sunset properly. An 18-24 month delay would, in turn, put the DoW at significant risk of being unable to defend and secure the nation against cryptographic attacks, as the successful deployment of the MyDIS system to replace the Legacy Credentialing systems is crucial to that effort.

Further, because the legacy credentialing systems are tightly integrated, and essential to daily operations, a transition-in phase would occur in a live mission-critical system environment.

A contractor without Peraton’s institutional knowledge working in such an environment creates unacceptable risks to identity services, credentialing, enterprise security, mission readiness. More specifically, a new contractor risks integration failures and an inability to update the proper credentials which could disrupt global RAPIDS operations, delay Common Access Card (CAC) and alternate credential issuance, and prevent personnel from obtaining required physical and logical access to military facilities, installations, and networks. Such disruptions could force reliance on legacy authentication methods, creating cybersecurity vulnerabilities and potential noncompliance with federal and DoW multifactor authentication requirements. Therefore, the downstream effect of needing a transition-in phase on this system environment is more than just an IT delay; it is the risk of widespread credentialing outages, the compromise of DoW communication security, and the denial of base and network access for warfighters, civilians, and contractors globally.

4. The Authority and Supporting Rationale:

The acquisition is conducted under the authority of the Multiple-Award Schedule (MAS) Program. Consideration of schedule contractors will be restricted in accordance with:

GSAR 538.7104-3(b)(ii) (GSA Class Deviation RFO-2025-FSS-GSAR 538) – Only one source is capable of providing the supplies or services required at the level of quality required because the supplies or services are unique or highly specialized.

Peraton is exclusively positioned to execute the RAPIDS decommissioning while also providing the required sustainment of the system because they possess the institutional knowledge of how the legacy system interacts with the backend database, the Central Issuance Facility (CIF) and the broader identity Credential Management infrastructure. Their continued support would help to ensure DMDC does not face any delays with the RAPIDS decommissioning or MyDIS deployment and are able to accomplish their objectives in a timely manner. Peraton’s ongoing performance of the services required for this order has established extensive, specialized knowledge of the DMDC identity ecosystem, including its unique architecture, integrations, and operational requirements. Considering the time constraints placed on DMDC with regards to decommissioning RAPIDS, transitioning RAPIDS data to MyDIS, and fulfilling DMDC’s requirement to deliver PQC-ready credentials by FY28, Peraton’s expertise positions them as the only source currently capable

Version 02/26/2026 of providing the required mission support within the tight timeframe necessary to maintain continuity of operations and remain in compliance with EO 14412 and DoW directives.

Based on the above information, the DMDC identity ecosystem cannot support a traditional transition-in or discovery period due to its mission-critical role in national security operations. A contractor without established knowledge of the environment would require a significant amount of transition time and the contractor would be required to learn while operating a mission-critical system, creating an unacceptable risk to identity services that support warfighter readiness, installation security, and enterprise access hindering DMDC’s ability to defend and secure the nation from cryptographic attacks. Additionally, errors introduced during this learning period could disrupt critical operations, compromise data integrity, and require significant time and resources to restore mission-essential identity services.

5. Determination by the Ordering Activity Contracting Officer that the Order Represents a Fair and Reasonable Price Consistent with GSAR 538.7102-2(d)(2) and 538.7104-2(a)(3) (GSA Class Deviation (GSA Class Deviation RFO-2025-FSS-GSAR 538)

After issuing the Request for Quote (RFQ) and receiving a quote from Peraton, the Contracting Officer will conduct a price analysis using price analysis techniques within the FAR and current market research to make sure that the prices offered to the Government are fair and reasonable. The techniques used will include at a minimum: comparison to an independent government cost estimate, in accordance with FAR 15.404-1(b)(5) (GSA Class Deviation RFO-2025-15), and comparison of proposed prices to historical prices paid, whether by the Government or other than the Government, for the same or similar items, in accordance with FAR 15.404-1(b)(2) (GSA Class Deviation RFO-2025-15). Additionally, if Peraton submits a quote with labor rates that are at or below their Multiple Award Schedule contract labor rates, they will have already been determined fair and reasonable at the MAS contract level. The Contracting Officer has determined that this task order represents the best value to the Government. This determination is based on the aforementioned unique operational requirements of the DMDC identity ecosystem (PDR, CUF, RAPIDS, IDCO) and the unacceptable mission and security risks associated with transitioning performance to a contractor lacking demonstrated, specialized knowledge of this unique operational environment.

6. Description of the Market Research Conducted Among Schedule Holders and the Results of the Research:

The DMDC ISS requirement will be solicited in accordance with GSAR 538.7104-3(b)(ii) (GSA Class Deviation RFO-2025-FSS-GSAR 538) - Only one source can provide the supplies or services required at the level of quality required because the supplies or services are unique or highly specialized. However, in accordance with FAR Part 10.001 (GSA Class Deviation RFO-2025-10), AAS Army and DMDC personnel conducted market research by releasing a RFI (#1819783) on GSA eBuy on 25 June 2026. The purpose of the RFI was to

Version 02/26/2026 determine whether other GSA MAS IT contractors, other than the incumbent, Peraton Inc., have the experience and capabilities to perform the DMDC support required by the ISS task order. In response to the RFI, the Government received seven (7) responses from GSA Professional Services Schedule contractors. Of the seven responses, three (3) are small businesses.

1. AccelGov,LLC (Small Business)

UEI NANQLBFHT5E1

6701 Democracy Blvd Suite 555 Bethesda, MD 20817

2. Advanced Cybersecurity Experts, LLC (ACE) (Small Business)

UEI J866DLWCTSG8

309 Briarwood Drive Leander, TX 78641

3. Booz Allen Hamilton (Large Business)

UEI JCBMLGPE6Z71

8283 Greensboro Drive McLean, VA 22102

4. FedTec LLC (Large Business)

UEI EY6QS5J3VKB1

1950 Opportunity Way, Suite# 1300 Reston, VA 20190-5495

5. Hunter Strategy, LLC (Small Business)

UEI DCNYSJXG7MW9

1522 SW 13th Ct Pompano Beach, Fl 33069-4711

6. Leidos, Inc. (Large Business)

UEI QLNMVC12KWY3

1750 Presidents Street Reston, VA 20190

7. Peraton, Inc. (Incumbent) (Large Business)

UEI ZBPQEJVECCT4

12975 Worldgate Drive Herndon, VA 20170

AccelGov,LLC is an 8(a) and Women Owned Small Business (WOSB). AccelGov, LLC was deemed incapable of safely performing the requirement because its response to the RFI did not demonstrate the specialized, pre-existing knowledge necessary to operate and maintain the DMDC identity environment. The company relies on future discovery, reverse-engineering of business logic, and Government-provided documentation rather than demonstrating proven understanding of critical PDR schemas, CIO structures, IDCO

Version 02/26/2026 integrations, and customized HID implementations. This approach introduces unacceptable technical and mission risks, making the proposal technically unacceptable.

Advanced Cybersecurity Experts, LLC (ACE) is a Service-Disabled Veteran-Owned Small Business (SDVOSB). ACE was deemed incapable of safely performing the requirement because its proposed approach depends on a transition period and Government-furnished information to develop knowledge of critical system configurations and business logic.

While reverse-engineering methods may be permitted, ACE does not demonstrate the pre-existing expertise required to operate the DMDC identity environment without introducing unacceptable risk. The need to learn PDR schemas, CIO structures, connection configurations, and HID implementations during performance creates the same operational and mission risks the requirement was designed to prevent.

Booz Allen Hamilton is a large business. BAH demonstrates acceptable capability in four of the six assessed areas but is unacceptable in two critical areas.

BAH does not demonstrate possession of the required IDCO connection details and relies on a discovery-based methodology to identify legacy interfaces, creating unacceptable operational risk. Although technically capable in many areas, BAH cannot fully satisfy the requirement without conducting a discovery phase that is inconsistent with mission needs.

FedTec LLC is a Woman-Owned Large Business. FedTec LLC is determined to be unacceptable across all six assessed areas. While FedTec LLC demonstrates transparency regarding its proposed approach, its solution relies heavily on a 45-day transition period, extensive incumbent knowledge transfer, and Government-furnished information to develop an understanding of the environment.

As a result, FedTec LLC’s approach introduces the discovery phase and operational risks that the requirement was specifically designed to avoid.

Hunter Strategy LLC is a small, HUB zone certified business. Hunter Strategy, LLC is determined to be unacceptable across all six assessed areas. Although Hunter Strategy, LLC presents its approach as a compliant methodology, the proposed solution relies on a post-award transition period to confirm, validate, and obtain critical technical details that are required prior to performance. This approach effectively introduces a discovery and knowledge acquisition phase after award, demonstrating a lack of the pre-existing system knowledge and immediate operational readiness required by the RFI. As a result, Hunter Strategy LLC cannot meet the requirement for zero-day readiness without introducing unacceptable mission and operational risk.

Leidos Inc. is a large business. Leidos was determined to be unacceptable in five of the six assessed areas.

Version 02/26/2026

. Instead, Leidos relies on post-award discovery, analysis, and Government-furnished information to develop this understanding. This approach introduces the same operational risks the requirement is intended to prevent and does not demonstrate the immediate readiness necessary to safely perform the mission-critical work.

Peraton, Inc. is the incumbent on the historical orders in support of this requirement. Peraton is a large business and was determined to be acceptable across all six evaluation categories.

As the incumbent provider, Peraton demonstrates the level of pre-existing knowledge and operational familiarity required to support the mission-critical environment without a discovery or transition period. Their response provides specific, technical, and verifiable examples of ongoing system support, demonstrating comprehensive understanding of the architecture, integrations, business rules, and operational requirements. Based on the evaluation criteria, Peraton is the only respondent that demonstrates the immediate readiness and depth of institutional knowledge necessary to perform the requirement without introducing unacceptable operational risk.

GSA AAS anticipates a fully competitive award to be in place upon expiration of the TO’s maximum period of performance in December 2029, at the latest. This FSS Sole Source Justification is required for the immediate requirement for a nine month to potential three (3) years and three months ISS contract. A full and open competition at this time would create unacceptable operational risks.

7. Any Other Facts Supporting the Justification:

No other facts support this justification.

8. Statement of the Actions, if Any, the Agency May Take to Remove or Overcome any Barriers that Led to the Restricted Consideration Before Any Subsequent Acquisition for the Supplies or Services is Made:

The Government intends to solicit only to Peraton under the GSA Schedule contract vehicle for the planned task order to provide ISS services for a 9-month period, with the potential for a 39-month period. Due to the specialized expertise required and the limited timeframe available, no other contractor can provide the necessary level of support without introducing unacceptable mission risk. For the follow-on competition, multiple Requests for Information (RFI) will be posted to the acquisition community to ensure a competitive acquisition. The RFI will involve soliciting feedback from industry to eliminate any barriers that will hinder competition. GSA will ensure that offers are solicited from as many potential sources as is practicable.