Version 12/27/18

Department of Transportation Federal Highway Administration (FHWA)

Information Technology (IT) Acquisition Center of Excellence (ACE)

SOLE SOURCE JUSTIFICATION

LOGICAL FOLLOW-ON

ORDER NO. 693JJ320A000013_693JJ322F00228N

The Department of Transportation (DOT) makes this Justification for orders pursuant to Federal Acquisition Regulation (FAR) 8.401(b) and GSAR 538.7104-3(b)(1)(iii).

i.) Identification of Agency and Contracting Activity:

Program Office:

DOT, Office of the Secretary (OST) Office of the Chief Information Officer (OCIO) 1200 New Jersey Avenue, SE Washington, D.C. 20590

Contracting Activity:

Federal Highway Administration (FHWA)

IT ACE

1200 New Jersey Avenue, SE Washington, D.C. 20590 ii.) Nature and/or Description of Action Being Approved:

The OCIO has a need to extend the cybersecurity management support services under Cyber Security Information & Program Services (CSIPS) Blanket Purchase Agreement (BPA) Order 693JJ320A000013_693JJ322F00228N awarded to Deloitte to support OST's applications and information systems. The CSIPS BPA Order currently expires on 10/31/2026 and this request is to extend current levels of support for an additional two (2) months (through 12/31/2026). An extension is needed while DOT goes through the process of restructuring the Department’s information technology workforce and determines whether this support can be reduced or fully assumed by Federal employees.

iii.) A Complete Description of Supplies/Services Required to Meet Agency’s Need:

This task order provides a broad range of technical and professional services to DOT infrastructure, application, and information systems. The cybersecurity support provides mission essential cybersecurity services, including operations and oversight, risk and vulnerability management in support of multiple binding operational directives, and Federal Information Security Management Act (FISMA) compliance and reporting.

Additionally, the contractor supports DOT systems to securely address vulnerabilities and non-compliance with Office of Management and Budget (OMB) and FISMA Directives, impacting enterprise cyber readiness and operational integrity; supports, operates, and maintains DOT cybersecurity tool stack (i.e., BigFix, Tenable and Invicti) to enable the Continuous Diagnostic and Mitigation (CDM) program to correlate and pass data to the

CDM dashboard from all security tools on behalf of the department, managing inventory, patching, and updates; and operates and maintains Tenable for vulnerability management, scanning, and compliance across the enterprise.

This effort is required in accordance with OMB Memorandum 21-31 Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents in conjunction with Execution Order (EO) 14028, Improving the Nation's Cybersecurity, to ensure logging, log retention, and log management, with a focus on providing centralized access and visibility for the DOT Cybersecurity Operations Center

(SOC).

This effort is of paramount importance during the ongoing IT modernization throughout the Federal government to increase the sharing of such information, as needed and appropriate;

to accelerate incident response efforts; and to enable more effective defense for DOT Networks, information systems, and applications.

Deloitte provides critical support to comply with the cybersecurity and privacy requirements, including identifying associated risks and impacts and prioritizing alternatives. Additionally, Deloitte is on track to develop automations to improve security posture reporting and prioritization of cybersecurity weakness remediations and is developing modernization plans for risk management modernization, leveraging super intelligence (SI) and automation to improve timeliness of compliance activities.

DOT is developing suitable strategies with the application managers and infrastructure leaders on cybersecurity matters, developing audit recommendations for tactical implementation, and reducing costs to ensure information systems hardening, data protection, and mission resiliency.

The proposed modification P00010 to order 693JJ320A000013_693JJ322F00228N will extend the order by an additional two (2) additional months through 12/31/2026 at an anticipated value of iv.) The Authority and Supporting Rationale:

This Justification is prepared as required by FAR 8.401(b) and GSAR 538.7104- 3(b)(1)(iii). The applicable rationale for the sole source for this action is:

The order should be issued on a sole source basis in the interest of economy and efficiency because it is a logical follow-on to an FSS order already issued on a competitive basis.

The original acquisition was conducted as a competitive call order under the multiple-award Cyber Security Information & Program Services (CSIPS) BPAs issued against the General Services Administration (GSA) Multiple Award Schedule (MAS).

Deloitte has a management and subject matter team in place providing these services and is familiar with the DOT environment. Over the span of this engagement, DOT has increased its cybersecurity posture and compliance contributing to the Department’s Cybersecurity