SSJ Over_SAT_OKTA CO Signed.pdf

Administration for Children and Families | www.acf.hhs.gov

Government Contracting Services | 330 C Street, S.W., Washington, D.C. 20201

SOLE-SOURCE JUSTIFICATION FOR

ACQUISITIONS EXCEEDING THE SIMPLIFIED ACQUISITION PROCEDURES

1. For purchases not exceeding the simplified acquisition threshold (SAT), contracting officers may solicit from one source if the contracting officer determines that the circumstances of the contract action consider only one source reasonably available.

Under Federal Acquisition Regulation (FAR 13.501(a), I hereby determine that the “Okta MFA” requirement is available from only one source, and competition is prevented for the reasons indicated below. There are no substitutes available.

2. This acquisition is restricted to the following source:

3. Vendor Information Vinny Grover Director of Sales / Talent Acquisitions Cell: 703.906.7813 Email: vinny.grover@improvixtech.com

4. Description of the service required, the estimated cost, and required delivery date:

The Contractor shall provide all staff, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to implement the Okta perform in ACF. This includes Professional Services and the annual subscription licenses required to support for 4,000 ACF Okta users. The Contractor shall perform to the standards in this contract.

The contract will encompass the following tasks to support the migration:

One-Time Professional Services: Including Deployment Planning, Configuration and Setup, and Support for integrating Okta with ACF’s existing IT infrastructure, applications, and Active Directory.

Premier Success Plan: 24/7 access to support with 30-minute Priority 1 (Critical Issues) response time, proactive management, assigned Customer Success Manager, and Access to Technical Account Managers.

Annual Subscriptions for Okta for 4,000 Users: Including Single Sign- On, Universal Directory, and Adaptive MFA.

Okta is a FedRAMP-Moderate, cloud-based, Software-as-a-Service (SaaS) Identity Provider (IdP) specializing in Multi-Factor Authentication (MFA). Okta’s approach to MFA plays a crucial role in ACF’s Zero Trust (ZT) implementation efforts, equipping ACF with the essential tools to verify every access request, enforce least privilege, and continuously monitor and adapt to evolving risk conditions. Its “adaptive MFA” capability makes implementation easier and reduces manual engagement in compliance without compromising the security goals of MFA. Okta also has an extensive library of pre-configured application integrations that make it easier to deploy to cover the full range of applications in an organization.

Estimated Cost: $699,848.23 Period of Performance: September 30, 2024 – September 29, 2025

5. Justification:

Pursuant to FAR 16.505(b)(2)(i)(B) ACF requires products and related services peculiar to the manufacturer Okta. Currently, Okta’s IDaaS platform is the industry-leading (SaaS) solution on the market that meets all of ACF’s security requirements in one platform, including:

● Achieved FedRAMP Moderate, High, and DISA IL4 authorizations

● SAML and SCIM with both custom and pre-configured connectors to over 7,600 applications

● Okta provides the ability to continuously assess risk during a user's entire journey by enabling near-frictionless integrations and real-time, post-authentication risk Assessments

● No on-premises components that need to be built or managed by the local IT staff, reducing technical and cybersecurity management costs.

Okta’s CORE business is identity management, they invest millions more on R&D than other IAM vendors. Additionally, Okta’s 7,600+ out-of-the-box integrations, unmatched authentication options, cloud-native and resilient infrastructure result in truly rapid deployments and 99.99% reliability.

ACF plans to replace its existing Red Hat SAML-based multi-factor solution with Okta.

Okta’s cloud native, modern identity Software as a Service has achieved significant milestones around implementation time, scale, performance, and seamless integrations with end-user applications. This will allow for frictionless experience for ACF users requiring access to ACF systems and services wherever they’re located allowing ACF to focus on fulfilling its mission while maintaining peace of mind with security.

Okta’s IDaaS platform was identified as the industry-leading solution on the market with the most complete identity offerings for both customer and workforce identity that has achieved FedRAMP Moderate, High, and Impact Level (IL) authorizations.

Okta is the industry leading IDaaS platform that has a Universal Directory and ability to source attributes from different identity sources, while providing ACF flexibility to add its own custom attributes.

Okta natively supports PIV/CAC authentication for compliance with HSPD-12 and supports standards-based APIs and protocols using OAuth 2, OpenID/OpenID Connect, SAML, and SCIM.

In addition, Okta FastPass is a phishing resistant authenticator that will improve ACF’s cybersecurity posture, while delivering improved customer experience.

As a key security service enabling access to ACF’s applications, services, and data, having the FedRAMP authorization is an HHS and ACF requirement for IDaaS. No other product met all these requirements in a single platform. Deploying this set of capabilities from other source(s) would require ACF to perform a detailed security assessment(s) and may require the procurement and integration of several products that may require on-premises components that do not align with ACF’s Target Architecture. Pursuing other alternatives is cost prohibitive, increases risk of project failure, and would likely prevent NSF from achieving required program timelines.

There is an urgent requirement to expand implementation of Okta as an agency wide IdP. On 12 May 2021, the President released an Executive Order (EO) on improving the nation’s cybersecurity posture, to include adoption of multi-factor authentication and encryption within 180 days. In response, ACF is transitioning its cybersecurity platforms and capabilities to a Zero-Trust Architecture (ZTA) on the cloud. A critical element is transitioning NSF’s Identity Provider (IdP) from an on-premises IdP solution to a cloud-based and ZTA-compatible IdP solution, which is Okta’s approach.

Before reaching this decision, ACF conducted extensive market research on all IDaaS platforms identified in Gartner’s annual “Magic Quadrant for Access Management” study2, including detailed product evaluations. Proofs-of-concept followed this research to determine systems and applications compatibility, supportability, and alignment to NSF requirements. The proofs-of-concept confirmed that Okta met all of ACF’s requirements for an IdP platform.

Market Research Findings:

The ACF Tech Team conducted market research by consulting with ACF staff experienced in implementing and managing Okta in HHS/OS. ACF also contacted other Government Agencies such as ARPA-H, and the National Science Foundation (NSF) to find out how they were using Cloud-Based Identity Service Providers to support Zero- Trust implementation efforts. ACF requested quotes which included Rough Order of Magnitude (ROM) quotes which were used to create the IGCE.

This award does not include option years.

6. There is no other information to support this sole source buy.

7. The Government remains committed to conducting thorough market research aimed at identifying emerging trends and needs.

CERTIFICATION

I certify that information provided above are complete and correct to the best of my knowledge.

In accordance with FAR 13.501(a). The facts of this acquisition preclude the use of full and open competition.

Contracting Officer Date