SSJ DCFO RMF-SOD_Redacted.pdf

SOLE SOURCE JUSTIFICATION UNDER SIMPLIFIED PROCEDURES

FOR CERTAIN COMMERCIAL ITEMS

UNDER FEDERAL ACQUISITION REGULATION (FAR) PART 12

1. AGENCY AND CONTRACTING ACTIVITY:

The Department of War, Washington Headquarters Services, Acquisition Directorate (WHS/AD), on behalf of the Office of the Deputy Chief Financial Officer (ODCFO).

2. DESCRIPTION OF ACTION:

WHS/AD proposes to issue a sole-source, hybrid Firm-Fixed Price (FFP) and Time and Materials (T&M) contract to Osprey Cove, LLC (a Service-Disabled Veteran-Owned Small Business [SDVOSB]), located at 3032 Little Haven Rd, Virginia Beach, Virginia 23452. The T&M portion of the contract will be for travel. The contract will provide technical, cybersecurity, and financial management audit advisory services supporting the Risk Management Framework (RMF) and Cross-Application Segregation of Duties (SoD). The estimated value of this action is $400,00.00. which includes labor ($394,285.00) and travel ($4,790.00), with a twelve (12) month period of performance. The effort will be funded by Operations and Maintenance (O&M) appropriations funds.

3. DESCRIPTION OF SUPPLIES/SERVICES:

The ODCFO assists the Under Secretary of War (Comptroller) (USW(C)) with responsibilities including the consolidated Department of War (DoW) financial statement audit, oversight of all DoW Component audits, and directing improvements that lead to unmodified audit opinions. The DCFO requires specialized support to resolve long-standing financial system deficiencies involving RMF cybersecurity control assessments that support Authority to Operate (ATO) decisions and financial statement audit testing, which continue to identify material weaknesses in security management, access control, segregation of duties, configuration management, and interfaces.

The contractor shall provide non-personal services across five core technical tasks as specified in the Performance Work Statement (PWS) below:

Task 1: Governance Meeting Support: Organize, attend, and support large-scale collaboration meetings (forums, workshops, multi-stakeholder working groups) with dedicated planning, logistics, pre-briefs, execution, minutes, and action tracking.

Task 2: ICAM Solution Deployment, Onboarding, and Segregation of Duties: Provide financial management subject matter expert (SME) oversight, guidance, and functional requirements for Identity, Credential, and Access Management (ICAM); deliver SoD rule governance across Business Enterprise Architecture (BEA) end-to-end processes; and accelerate system onboarding into the FIAR Systems Database (FSD).

6. EFFORTS TO OBTAIN COMPETITION:

In accordance with FAR 5.2 and statutory publicizing guidelines, WHS/AD publicized a Notice of Intent to Sole Source (Special Notice WHS-26-R-DCFO-RMF) on SAM.gov for fifteen (15) calendar days, beginning on August 19, 2026, and closing on September 3, 2026. The notice detailed the core technical scope (Governance Support, ICAM/SoD Rule Governance, FM Overlay eMASS integration, and ServiceNow eGRC advisory) and required interested vendors to submit a comprehensive capability statement demonstrating:

1. Corporate experience within the past three (3) years performing RMF, FISCAM, and eGRC (ServiceNow/eMASS) alignment within a DoD/DoW component;

2. Availability of a Program Manager meeting mandatory qualifications (Ph.D., 15+ years of HQ DoW experience, and academic/publication credentials); and

3. Business size, UEI, CAGE code, and active contract vehicle information.

Only one (1) capability statement was received in response to the notice. The Government evaluated the submission and determined that the respondent was not technically capable of meeting the requirement. The respondent failed to demonstrate the requisite corporate experience bridging FISCAM and RMF eMASS integration and failed to propose Key Personnel meeting the mandatory 15+ years of HQ DoW financial governance and academic/publication credentials required by the PWS. Therefore, Osprey Cove, LLC remains the only known responsible source capable of fulfilling the agency's requirement.

7. FAIR AND REASONABLE COST DETERMINATION:

The Contracting Officer determines that the anticipated price will be fair and reasonable using the techniques identified at FAR 15.404 . The Government will compare the proposed labor rates against historical rates paid for similar financial and cybersecurity advisory labor categories within WHS/AD, published GSA Federal Supply Schedule pricing for comparable professional labor categories, and the Independent Government Cost Estimate (IGCE).

8. MARKET RESEARCH:

Market research was conducted from July 2026 through September 2026 by reviewing commercial marketplace capabilities, historical contracting actions within OUSW(C), and surveying federal government-wide acquisition vehicles. This research culminated in the formal posting of the Notice of Intent to Sole Source on SAM.gov from August 19, 2026, to September 3, 2026, under NAICS 541611 (Administrative Management and General Management Consulting Services) and PSC R704 (Support - Management: Auditing Services). Based on market research and the evaluation of the single non-capable response received, the Government determined that no other commercial vendor possesses the unique combination of technical RMF-FISCAM crosswalk expertise, eMASS 29-family integration capability, ServiceNow eGRC audit workflow proficiency, and qualifying Key Personnel required to perform the requirements set forth in the PWS.

9. ANY OTHER FACTS SUPPORTING THE USE OF SOLE SOURCE:

None.

10. INTERESTED SOURCES:

As noted in Section 6, a Notice of Intent was posted to SAM.gov on August 19, 2026, with responses due September 3, 2026. Only one vendor submitted a capability statement; however, technical review determined the respondent did not possess the required capabilities or meet key personnel standards. No other sources expressed interest.

11. ACTIONS TO INCREASE COMPETITION:

The Government will continue to monitor the marketplace and track industry advancements in automated eGRC tools, cybersecurity control mapping solutions, and federal audit remediation support. For any future follow-on requirements, WHS/AD and ODCFO will conduct extensive early market research, including Requests for Information (RFIs) and possibly industry days, to identify emerging commercial sources and foster competitive acquisition environments once the FM Overlay baseline and eGRC architecture are stabilized across the Department.

12. Is this acquisition for a non-competitive follow-on acquisition previously awarded on a non-competitive basis?

Yes. A copy of the previous justification is attached. The actions to remove any barriers to competition have been taken.

No.

APPROVAL

I hereby certify that the supporting data under my cognizance included in this justification is accurate and complete to the best of my knowledge and belief.

Jonathan W. Diggs Contracting Officer

Washington Headquarters Services, Acquisition Directorate (WHS/AD)

Date: __09/24/2026_

DIGGS.JON

ATHAN.W.

129435765

Digitally signed by

DIGGS.JONATHA

N.W.1294357650 Date: 2026.09.24 18:01:17 -04'00'