SSJ-693JJ320A000013_ 693JJ322F00228N_P00007_Redacted.pdf

Department of Transportation Federal Highway Administration

IT Acquisition Center of Excellence

SOLE SOURCE JUSTIFICATION

LOGICAL FOLLOW-ON

Order # 693JJ320A000013_ 693JJ322F00228N

The Department of Transportation (DOT) makes this Justification for orders pursuant to Federal Acquisition Regulation (FAR) 8.401(b), GSAR 538.7104-3(b)(2).

i.) Identification of Agency and Contracting Activity:

Program Office:

DOT, Office of the Secretary (OST) Office of the Chief Information Officer (OCIO) 1200 New Jersey Avenue, SE Washington, D.C. 20590

Contracting Activity:

Federal Highway Administration (FHWA) IT Acquisition Center of Excellence (ACE) 1200 New Jersey Avenue, SE Washington, D.C. 20590 ii.) Nature and/or Description of Action Being Approved:

The OCIO has a need to extend the cybersecurity management support services under Cyber Security Information & Program Services (CSIPS) Blanket Purchase Agreement (BPA) Order 693JJ320A000013_693JJ322F00228N awarded to Deloitte to support OST's applications and information systems. The Order currently expires on 02/28/2026 and this request is to extend current levels of support for an additional two (2) months (through 04/30/2026). The extension is needed while DOT goes through the process of restructuring the Department’s information technology workforce and determines whether this support can be reduced or fully assumed by Federal employees.

iii.) A Complete Description of Supplies/Services Required to Meet Agency’s Need:

This task order provides a broad range of technical and professional services to DOT infrastructure, application, and information systems. Awarded to Deloitte, the cybersecurity support provides mission essential cybersecurity services, including operations and oversight, risk and vulnerability management in support of multiple binding operational directives, and Federal Information Security Management Act (FISMA) compliance and reporting. Additionally, the contractor supports DOT systems to securely address vulnerabilities and non-compliance with Office of Management and Budget (OMB) and FISMA Directives, impacting enterprise cyber readiness and operational integrity; supports, operates, and maintains DOT cybersecurity tool stack (i.e., BigFix including Splunk) to enable the Continuous Diagnostic and Mitigation (CDM) program to corelate and pass data to the CDM dashboard from all security tools on behalf of the department, managing inventory, patching, and updates; and operates and maintains Tenable for vulnerability management, scanning, and compliance across the enterprise.

This effort is required in accordance with OMB Memoranda 21-31 Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents in conjunction with Execution Order (EO) 14028, Improving the Nation's Cybersecurity, to ensure logging, log retention, and log management, with a focus on providing centralized access and visibility for the DOT Cybersecurity Operations Center

(SOC).

This effort is of paramount importance during the ongoing IT modernization throughout the Federal government to increase the sharing of such information, as needed and appropriate;

to accelerate incident response efforts; and to enable more effective defense for DOT Networks, information systems, and applications.

Deloitte is providing the necessary support to comply with the cybersecurity and privacy requirements, including identifying associated risks and impacts and prioritizing alternatives. Additionally, Deloitte is on track to develop automations to improve security posture reporting and prioritization of cybersecurity weakness remediations and is developing modernization plans for risk management modernization, leveraging artificial intelligence (AI) and automation to improve timeliness of compliance activities.

DOT is developing suitable strategies with the application managers and infrastructure leaders on cybersecurity matters, developing audit recommendations for tactical implementation, and reducing costs to ensure information systems hardening, data protection, and mission resiliency.

This modification P00007 to order 693JJ321A000003_693JJ322F000061 will extend the order by two (2) additional months through 4/30/2026. The anticipated value over the extension period of performance is $612,452.35.

iv.) Authority and Supporting Rationale:

This Justification is prepared as required by FAR 8.401(b), GSAR 538.7104-3(b)(iii).

The applicable rationale for the sole source for this action is:

The order should be issued on a sole source basis in the interest of economy and efficiency because it is a logical follow-on to an FSS order already issued on a competitive basis.

The original acquisition was conducted as a competitive call order under the multiple-award CSIPS BPAs issued against the General Services Administration (GSA) Multiple Award Schedule (MAS).

Deloitte has a management and subject matter team in place providing these services and is familiar with the DOT environment. Over the span of this engagement, DOT has increased its cybersecurity posture and compliance contributing to the Department’s Cybersecurity FISMA performance goals (FY24 DOT earned “B”). Additionally, this team has provided the necessary hardening to DOT infrastructure and applications by implementing lessons learned and recommendations from major cybersecurity incidents where threat actors breached multiple OST applications and attempted to move throughout the environment.

ix.) Contracting Officer Certification that the Justification is Accurate and Complete to the Best of the Contracting Officer’s Knowledge and Belief:

I hereby certify that this justification is accurate and complete to the best of my knowledge, and I determine based on the findings above that the sole source approach is in accordance with the requirements and is in the best interest of the Government.

Ajmal Khan Date Contracting Officer

FHWA IT-ACE

x.) Evidence that any supporting data that is the responsibility of technical or requirements personnel (e.g., verifying the Government’s minimum needs or requirements or other rationale for limited sources) and which form a basis for the justification have been certified as complete and accurate by the technical or requirements personnel.

Supporting data provided by technical or requirements personnel has been certified as complete and accurate as demonstrated by reasonable technical review and adherence to current task order rates.

xi.) Written Determination by the Approving Official:

I hereby certify that this justification is accurate and complete to the best of my knowledge, and I determine based on the findings above that the limit sources approach is in accordance with the requirements and is in the best interest of the Government.

Justin Ubert Date Supervisory Information Technology Specialist Office of the Secretary of Transportation, OST