Sole Source Justification SSJ_ ICAM-HSPD-12_FinalSigned_10SEP2026.pdf

SOLE-SOURCE LOGICAL FOLLOW-ON

JUSTIFICATION and APPROVAL for a MAS Task Order In Accordance with RFO GSAR 538.7104-3

For Orders or BPAs Exceeding the SAT established under Federal Supply Schedules

1. Agency and Contracting Activity.

This requirement is in support of General Services Administration (GSA), Office of Mission Assurance, 1800 F Street, NW Washington, D.C. 20405. The contracting activity is the Internal Acquisition Service Center, 1800 F Street NW, Washington, DC 20405.

2. Nature and/or description of the action being approved.

Approval is requested to issue a sole-source logical follow-on acquisition task order to Deloitte Consulting Limited Liability Partnership (LLP) under GSA Multiple Award Schedule Contract No.

GS-35F-0617Y for specialized engineering, integration, operational program support, and technical advisory services in support of the GSA Homeland Security Presidential Directive 12 Branch.

The required services relate to Homeland Security Presidential Directive 12 (HSPD-12), Personal Identity Verification, background investigations, and Identity, Credential, and Access Management infrastructure (ICAM). The order will support the continued implementation, sustainment, troubleshooting, and enhancement of HSPD-12 and ICAM capabilities, including identity lifecycle management, credentialing support, background investigation support, system integration, technical analysis, user provisioning and de-provisioning support, testing, documentation, and related program support activities.

The contemplated order will be issued as a Labor-Hour task order for a period consisting of one 12-month base period, four 12-month option periods, and one optional six-month transition or extension period, if exercised. Funding for each period will be provided subject to the availability of fiscal year funds.

This justification is prepared pursuant to GSAR 538.7104-3, as applicable, to support restricting consideration as a sole-source under the applicable MAS/FSS ordering procedures, to Deloitte Consulting LLP.

The Labor-Hour contract type is addressed separately in the applicable Labor-Hour Determination and Findings. This justification addresses only the basis for restricting consideration to Deloitte Consulting LLP.

This justification will be posted to the Contract Opportunities section of SAM.gov, as required by applicable regulation and policy.

3. Description of Supplies/Services required to meet the agency’s needs (including the estimated value).

Docusign Envelope ID: 688E3412-8869-8B13-8324-F02C8424CCA2

GSA requires comprehensive, integrated, and highly specialized HSPD-12, PIV, background investigation, and ICAM support services. The mission of the GSA HSPD-12 Branch is to manage GSA’s internal implementation of HSPD-12 and related ICAM services, including the creation, issuance, management, and use of PIV credentials for GSA employees and contractors nationwide.

The HSPD-12 Branch also supports secure electronic and physical access for GSA personnel, background investigation processing for contractors, logical access and physical access integration, credential lifecycle management, and related data and system support. These services are critical to GSA’s ability to onboard personnel, grant access to facilities and information systems, comply with federal identity and credentialing requirements, and maintain secure agency operations.

The required services include, but are not limited to, the following areas:

A. Program Management, Transition, Reporting, Quality Assurance, and Change Management Support

The contractor shall provide program management and oversight for all contractor and subcontractor activities required under the Performance Work Statement (PWS). This includes identifying a Program Manager responsible for management, direction, training, administration, quality assurance, and overall execution of the task order.

Required support includes transition activities, reporting, quality assurance planning, risk management, issue tracking, stakeholder coordination, and change management and communications support related to the HSPD-12 Branch’s mission areas.

B. HSPD-12 / ICAM Program Operations, Credentialing, Background Investigation, Logical Access, Physical Access, and PKI Support

The contractor will provide comprehensive operational and technical support for GSA's HSPD-12 and ICAM program operations. Core responsibilities include managing the entire PIV card lifecycle, overseeing credentialing stations, performing registrar duties, and assisting personnel through background investigations and Trusted Workforce 2.0 initiatives. Additionally, the contractor will drive program administration by coordinating with stakeholders, managing help desk support, running data audits across interconnected HR and security systems, and developing strategy, training, and OMB reporting documents. Finally, the role supports physical and logical access control policies, visitor management, GSA Credential and Identity Management System (GCIMS) software enhancement testing, and PKI technology upgrades.

Option Year Time Total Base 12 months $2,719,459.30 Option Year 1 12 months $2,801,043.08 Option Year 2 12 months $2,885,074.38 Option Year 3 12 months $2,971,626.60 Option Year 4 12 months $3,060,775.40 Option Operational Transition 6 months $1,576,299.33 Total Estimated Value: $16,014,278.09

The total estimated value of this task/delivery order based on the Government’s Independent Government Estimate (IGE), for the base and all option periods is $16,014,278.09.

The anticipated CLIN structure is as follows:

CLINs Description of Service (Yearly)

0001 Project Management Support

0002 Planning & Program Support

0003 Credentialing & Background Investigation Support

0004 Physical Access Management Support

0005 PKI Management Support

0006 GCIMS Support and Logical Access Management Support

4. This justification is prepared in accordance with the applicable MAS/FSS ordering procedures, GSAR Subpart 538.71, as applicable, and any applicable agency RFO requirements governing sole-source justification, logical follow-on task orders under the GSA Multiple Award Schedule.

1. Authority:

☒ 538.7104-3(b)(iii): The authority for this action applies because the order is a logical follow-on to an existing Federal Supply Schedule (FSS) order that was previously competed.

Rationale:

The determination to restrict consideration to Deloitte Consulting LLP on a sole-source logical follow-on basis is not based solely on incumbent status, but on Deloitte’s current integrated role in GSA-specific HSPD-12, GCIMS, background investigation, credentialing, logical and physical access, PKI, MSO coordination, and ICAM operations, and the Government’s determination that continued performance by the incumbent is in the interest of economy and efficiency. Because the requirement is a continuation of services currently being performed under the existing FSS order, transition to another contractor at this time would create unacceptable transition, operational, security, compliance, and performance risk and could disrupt mission-critical HSPD-12/ICAM support.

The required services are unique and highly specialized because they involve the integrated operation and support of multiple interdependent systems, processes, stakeholders, and federal requirements. The requirement is not limited to general HSPD-12 advisory support. It requires end-to-end knowledge and operational capability across GSA’s HSPD-12 ecosystem, including GCIMS, credentialing processes, background investigation support, Trusted Workforce 2.0 and Continuous Vetting activities, GSA Access Card management, MSO coordination, logical access support, physical access support, PKI support, help desk escalation, data reconciliation, technical troubleshooting, and agency-wide operational support.

Deloitte currently provides programming and technical support for GCIMS, supports HSPD-12 background investigation processes, supports Trusted Workforce 2.0 and Continuous Vetting-related activities, and provides credentialing services associated with the issuance and maintenance of GSA Access Cards. Deloitte also supports logical and physical access, identity management activities, MSO-related services, nationwide operational support, information technology coordination, and project management for the current effort.

GCIMS is a central system supporting GSA’s background investigation and credentialing processes. It supports higher-tier help desk functions and automated processes involving mass initiations, RapBack, Trusted Workforce activities, MSO interfaces, GSA Access Card management, and Defense Counterintelligence and Security Agency (DCSA)-related processes. GCIMS also provides essential data to US Access, GSA Information Technology (IT), and other applications used for onboarding, offboarding, maintenance, access provisioning, and operational decision-making.

Because of Deloitte’s current performance role and system-specific knowledge, Deloitte possesses operational familiarity, technical understanding, and integrated process knowledge that would be difficult for another contractor to replicate without a significant transition period and unacceptable performance risk. A new contractor would need to develop knowledge of GSA-specific workflows, system configurations, data flows, stakeholder relationships, credentialing processes, background investigation procedures, GCIMS functionality, help desk processes, access management dependencies, and ongoing initiatives before being able to provide effective support at the required level of quality.

Failure to maintain uninterrupted support could adversely affect core agency operations, including personnel onboarding and offboarding, facility access, logical access, background investigation processing, credential issuance, system troubleshooting, data exchange, audit response, and compliance with evolving federal identity and credential requirements.

The HSPD-12 Branch’s mission is also subject to continuing federal and agency-level changes. OMB, NIST, OPM, DCSA, FAS MSO, and GSA IT changes may affect the HSPD-12 Branch’s requirements during the period of performance. These include Trusted Workforce 2.0 implementation, HR 2.0 transition planning, MSO service and contract changes, GSA IT restructuring, cybersecurity requirements, audit activity, ePACS support, delegated access provisioning, and automated workflow initiatives.

Deloitte’s current knowledge of the existing environment is necessary to provide uninterrupted support while the HSPD-12 Branch responds to these changing requirements.

Market research identified multiple contractors with general HSPD-12 or ICAM capability.

However, based on evaluations by HSPD-12 subject matter experts, no other respondent demonstrated the capability to perform the full integrated scope of the requirement at the level of quality required without substantial transition risk, performance degradation, or disruption to ongoing HSPD-12 operations. Several firms appeared capable of performing discrete portions of the requirement but did not demonstrate sufficient experience across the full range of required operational, technical, background investigation, credentialing, GCIMS, logical access, physical access, PKI, and program management support.

Accordingly, Deloitte is capable of providing the required services at the level of quality required within the necessary timeframe and without unacceptable risk to GSA’s mission, systems, personnel access, credentialing operations, background investigation processes, and compliance obligations.

5. Description of Market Research

In accordance with FAR Part 10, the General Services Administration (GSA) conducted comprehensive market research in March 2026 to identify qualified sources capable of fulfilling the full range of Homeland Security Presidential Directive 12 (HSPD-12) and Identity, Credential, and Access Management (ICAM) support services.

A. Initial Schedule Review and Request for Information (RFI)

Initial research of GSA eLibrary identified approximately 46 sources holding GSA Multiple Award Schedule (MAS) contracts under relevant Special Item Numbers (SINs), specifically SIN 541519PIV (Credentialing Life Cycle Support) and SIN 541519ICAM (Identity, Credential, and Access Management).

To further validate market capability and competitive interest, GSA Market Research as a Service (MRAS) issued an eBuy Request for Information (RFI) from March 9, 2026, through March 13, 2026, under North American Industry Classification System (NAICS) code 541519. The RFI yielded responses from the following seven (7) interested small business MAS contractors:

● BruckEdwards

● Communications Resource, Inc.

● KR3 Information Systems Inc.

● LS3 Inc.

● One Federal Solution

● POWTEC LLC

● RedMatter Solutions

B. Capability Evaluation and Technical Assessment

Subject matter experts (SMEs) from the GSA HSPD-12 Branch conducted a rigorous technical evaluation of the seven RFI responses against the draft Performance Work Statement (PWS). The evaluation focused on whether the vendors demonstrated the specialized capability, corporate resources, and direct experience necessary to execute the full, integrated scope of the requirement on a nationwide basis. This scope includes:

● HSPD-12 and ICAM program management

● Background investigation and credentialing support

● GSA Credential and Identity Management System (GCIMS) operations

● Logical and Physical Access Control Systems (LACS/PACS)

● Public Key Infrastructure (PKI) management

● Comprehensive, nationwide operational support

While initial market data showed that SIN 541519PIV features approximately 45 contractors (including 26 small businesses) offering specialized HSPD-12 labor categories—such as IT Senior Managers, IT Managers, IT Senior Consultants, IT Consultants, and IT Analysts—the RFI responses confirmed that these firms only possess general technical capability or experience restricted to isolated portions of the requirement.

C. Market Research Conclusion

Following a detailed review of the RFI submissions, the HSPD-12 Branch determined that none of the RFI respondents possess the requisite capability, depth of expertise, or integrated experience to perform the entire requirement at the high standard of quality required by the Government.

While several respondents demonstrated the ability to perform standalone portions of the work, no source other than the incumbent, Deloitte, demonstrated the holistic capability to manage the highly complex, interconnected technical and operational interdependencies of this program.

This requirement represents a high-risk, agency-wide, mission-critical acquisition.

Improper execution or transition delays would result in severe operational consequences, including:

● System degradation and critical security vulnerabilities

● Personnel onboarding/offboarding disruptions and credentialing backlogs

● Widespread physical and logical access failures across GSA facilities and networks

● Non-compliance with federal identity and credentialing mandates, resulting in elevated audit risk

Consequently, to mitigate unacceptable operational risk and ensure seamless continuity of operations without a lengthy and disruptive transition period, Deloitte is the only source identified through market research and past performance information capable of providing the full scope of support within the Government’s required timeframe.

6. Any other facts supporting the sole-source logical follow-on action to the incumbent contractor justification. (List any other facts not otherwise categorized in the SSJ.)

The HSPD-12 Branch supports GSA-wide identity, credentialing, background investigation, and access management functions that are essential to the agency’s ability to operate securely and effectively. The consequences of disrupted or inadequate support include:

● Degradation of GCIMS functionality;

● Reduced ability to support background investigation, credentialing, logical access, physical access, and data transfer processes;

● Loss or reduction of automated background investigation, credentialing, and data reconciliation capabilities;

● Data integrity issues affecting downstream systems;

● Delays or interruptions in onboarding, offboarding, credential issuance, and access provisioning;

● Increased manual workload for Government personnel;

● Reduced ability to support Trusted Workforce 2.0, Continuous Vetting, RapBack, and related compliance activities;

● Impacts to employees’ and contractors’ ability to access facilities, information systems, and applications;

● Increased risk of audit findings, compliance issues, or security vulnerabilities; and

● Restricted help desk support for HSPD-12 background investigation and GSA

Access Card processes.

The attached Technical Memorandum for Record provides additional technical rationale supporting the need for continuity of support and the specialized nature of the requirement.

The requirement also involves multiple anticipated changes and uncertainties over the base and option periods, including evolving OMB and NIST requirements, OPM HR 2.0 implementation, DCSA Trusted Workforce 2.0 requirements, FAS MSO service and contract changes, GSA IT organizational changes, audit activity, ePACS support, delegated access provisioning, and cybersecurity requirements. These factors reinforce the need for a contractor with deep knowledge of GSA’s current HSPD-12 environment and the ability to respond quickly to changing mission requirements.

7. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to restricted consideration before any subsequent acquisition of supplies or services is made.

Although a sole-source logical follow-on award to the incumbent is appropriate for this requirement due to the mission-critical nature of the work, specialized system knowledge, operational continuity needs, and unacceptable transition risk, GSA may take steps to reduce barriers to competition for future acquisitions. These steps may include earlier and broader industry engagement, issuance of draft requirements or RFIs, improved Government-owned technical and operational documentation, required knowledge transfer and transition materials, assessment of discrete tasks for separate competition or conversion to Firm-Fixed-Price CLINs, identification of work not requiring unique incumbent knowledge, evaluation of phased transition approaches, and continued market research under applicable MAS SINs, including 541519PIV, 541519ICAM, and other relevant SINs.

These actions are intended to improve competition for future HSPD-12/ICAM support requirements where practicable and consistent with mission needs.

8. Determination by the Contracting Officer That the Anticipated Task Order Represents the Best Value

Pursuant to GSAR 538.7102-2(b)(4), as applicable, I determine that the anticipated task order represents the best value to the Government.

Although MAS contract rates establish ceiling rates, the ordering activity will perform and document an order-level price reasonableness analysis. The analysis will consider Deloitte’s proposed labor categories, proposed hourly rates, estimated labor hours, historical usage, the Independent Government Estimate, available MAS pricing information, and any discounts obtained from MAS ceiling rates.

The sole-source logical follow-on action is justified because Deloitte Consulting LLP, as the incumbent contractor, is currently positioned to continue performing the full integrated requirement at the required level of quality, within the required timeframe, and without unacceptable risk to GSA’s mission-critical HSPD-12/ICAM operations. The anticipated task order provides the best value to the Government because it maintains continuity of essential services, mitigates operational, transition, security, and compliance risk, and avoids disruption to GSA-wide credentialing, access, background investigation, and ICAM processes.

Accordingly, the anticipated task order represents the best value to the Government, consistent with applicable MAS ordering procedures and GSAR requirements.

Program/Technical Certification and Approval

I hereby certify that the supporting data provided above, and any supporting information used to justify this sole-source logical follow-on action to the incumbent contractor, including the Government’s minimum needs, schedule requirements, technical rationale, market research, continuity considerations, transition risk assessment, and rationale for restricting consideration under the applicable MAS/FSS ordering procedures, is accurate and complete to the best of my knowledge and belief.

Phil Ahn, Project Manager/ COR Date

Approval/Contracting Officer’s Certification

I hereby certify that the information contained in this sole-source logical follow-on action to the incumbent contractor is accurate and complete to the best of my knowledge.

Jeaneen Monroe, Contracting Officer Date

9/10/2026 | 13:22:05 BST

9/10/2026 | 13:23:59 BST