SSJRedacted_092520.pdf

Sole Source Justification (SSJ)

SECTION I: INTRODUCTION AND AGENCY AND CONTRACTING ACTIVITY

The Department of Education, Office of Federal Student Aid (FSA), FSA Acquisitions Group, proposes to issue a bridge of contract to Blue Canopy/Jacobs (“Jacobs”) on the basis that only one source is reasonably available. Pursuant to 20 USC 1018-Section 1018a Procurement Flexibility as a Performance Base Organization and (FAR 13.106 -1(b)(1)(i)).

This acquisition is conducted under 20 USC 1018-Section 1018e Use of simplified procedures for commercial products and commercial services and FAR Part 13.5, Simplified Procedures for Certain Commercial Items and in accordance with FAR 12.102.(a) and 12.102 (f)(1).

Pursuant to FAR 13.501(a)(1)(iii), this SSJ will be posted at the Government point of entry (FBO.gov) within 14 days after contract award.

SECTION II: DESCRIPTION OF ACTION BEING APPROVED

The action being approved is the solicitation and award of a bridge contract to Blue Canopy/Jacobs to provide services necessary to maintain the services under the FSA Cybersecurity Program currently employed at FSA. FSA’s current Cybersecurity contract with Blue Canopy/Jacobs (ED-FSA-14-O-0069) will expire on September 28, 2020 before a new contract can be put into place.

On March 6, 2020, FSA awarded a multiple-award Blanket Purchase Agreement (BPA) for Cybersecurity and Privacy Support Services (CPSS) to meet the needs of FSA’s Cybersecurity Program. FSA intended to award several task orders against the CPSS BPA before September 28, 2020 to continue the Contractor-provided services of FSA’s Cybersecurity Program. However, on March 15, 2020, the CPSS BPA awards were protested and stop work orders were issued to the awardees, thwarting FSA’s ability to compete task orders on the BPA vehicle. The contemplated bridge contract addresses only the elements of the current contract for a duration sufficient to resolve the current protest and to compete and award subsequent task orders. The work will be priced on a firm-fixed price basis.

This SSJ justifies and approves FSA’s acquisition strategy to award a sole-source contract to Jacobs for said requirements using the Simplified Procedures for Certain Commercial Items (FAR 13.5) and 20 USC 1018 –18a Procurement Flexibility. Jacobs’ local address is as follows: 11091 Sunset Hills Rd, Suite 777, Reston, VA 20190.

SECTION III: DESCRIPTION OF SUPPLIES OR SERVICES

On March 6, 2020, FSA awarded the multiple-award Cybersecurity and Privacy Support Services (CPSS) Blanket Purchase Agreement (BPA) to five awardees. FSA had planned, immediately following the award of the BPA, to compete and award four call orders for: Risk Management and Compliance; Chief Information Security Officer (CISO) Support; Security Operations Center (SOC); and Cybersecurity Tools Operations and Maintenance. These BPA call orders were planned to start August 1, 2020 before the expiration of FSA’s current cybersecurity contract (ED-FSA-14-O-0069) with Blue Canopy/Jacobs.

On March 15, 2020, several unsuccessful offerors protested the BPA awards. The Contracting Officer (CO) was notified on March 15, 2020. To comply with CICA requirements, on March 16, 2020, the CO issued stop- work orders on the BPA awards and did not proceed with planned competition of the call orders. Additionally, FSA opted to take corrective action in response to the protests requiring the re-evaluation proposals. FSA is currently implementing corrective action to award the BPA. Once the BPA is awarded, FSA will compete the four call orders to meet FSA’s Cybersecurity Program needs.

The services covered by the protested BPA are for requirements that are necessary for continued cybersecurity operations through the period of the protest. Blue Canopy/Jacobs, FSA’s current cybersecurity Contractor, is in place to perform the required services without any sort of transition or ramp-up effort. This bridge contract is justified because it is required to meet FSA’s minimal cybersecurity needs for continued operations through resolution of the protest of the BPA awards, the competition of the call orders, and the necessary transition period from the incumbent Contractor to new Contractors.

Period of Performance The base period of performance of this requirement is from September 29, 2020 through December 28, 2020 (three months). This requirement also includes nine one-month option periods to account for time to resolve protests of and necessary transition periods for the call orders. This total period of performance is one year.

Estimated Value The total estimated value of this requirement is $48,511,419 (three-month base period estimated value is $13,816,889 as shown in the Independent Government Cost Estimate (IGCE). This estimate is based on FSA’s immediate needs to remain compliant and deliver financial aid, requiring some catch-up activities as result of the COVID-19 health emergency.

Because this bridge contract will only require the minimal support required, the current training, SOC Operations, and ISSO Support will be reduced to ensure that vital services are appropriately scoped to meet the mission requirements. However, this contract includes work that was initially programmed during the third and fourth quarters of FY2020 that was delayed due to the COVID-19 restrictions and contract award delays. This critical work, particularly in the assessment area, is required by federal mandates and ensures the cybersecurity of vital information systems by identifying and remediating vulnerabilities and addressing risk. It is imperative that the delayed work is accomplished to ensure that FSA is in compliance with requirements of Federal mandates. In addition to delayed work there are a significant number of new initiatives scheduled in early FY2021, particularly under the next generation FSA umbrella and the Future Act, that requires a significant number of assessments typically resulting in a number of plans of actions and milestones that require vulnerability management activities to record, analyze, track, and remediate. Failure to ensure the successful implementation of these programs will directly impact FSA’s ability to deliver new student capabilities, retire cybersecurity risk prone systems, and reduce operational expenses through efficient systems using modern platforms.

This estimate also contemplates that there will be a cross the board reduction in services as the bridge contractor transitions the work from this contractor to the awardees of the task orders to be ordered on the new CPSS BPA.

The final three option period provide estimates that ramp down the services provided on the bridge contract with the anticipation that the new contractors will be taking over the cybersecurity operations.

Bridge Contract Scope of Work and Overview of Tasks The scope of the bridge cybersecurity contract is to procure the full range of technical and project management services to support the continuing, comprehensive, and effective operation of an integrated set of cybersecurity functions and supporting resources available to FSA Enterprise, Applications, and Stakeholders. The cybersecurity contract provides common, shared services for the assessment and continuous monitoring of FSA Applications according to FISMA and NIST guidelines.

The Cybersecurity contract’s principal purpose is to enable FSA applications to maintain and attain an Authority to Operate (ATO) which gives FSA the permission to operate a public website/application that provides grants and loans to America’s students. In order for an ATO to be granted, the Cybersecurity contractor conducts a third-party independent assessment upon approximately 75 FISMA reportable systems. Based upon the results of each assessment, our CISO presents a risk-based decision of whether or not to grant an ATO. Once that ATO is granted, another Task continuously monitors critical security controls for compliance and adherence to best practices and Federal, Departmental, and FSA guidelines and to monitor those applications for compliance with current and future security standards. CPSS serves as the enterprise cybersecurity and measure risk based on industry standards. The Enterprise and Department depend upon such services to be timely and in many cases, critical to drive the development and deployment of high-value assets (HVA) as well as FSA’s Next Generation systems.

An overview of the cybersecurity contract work requirements is provided below:

TASK A: FUTURE ACT SUPPORT

This task is to develop an IRS Security Safeguard Report (SSR) and perform a comprehensive security assessment to determine compliance with all IRS Safeguards requirements including the current version of IRS Publication 1075. The assessment must determine IRS Safeguards impacts on FSA and FSA contractors’ processing, accessing, hosting, and managing of Federal Tax Information (FTI) and specific actions FSA and FSA contractors must take to come into IRS Safeguards compliance.

TASK B: SECURITY AUTHORIZATIONS, ONGOING SECURITY AUTHORIZATIONS AND SECURITY

IMPACT ANALYSES

This task is to assess and continually monitor FSA high value assets, applications, General Support System (GSS), and subsystems to comply with FISMA, Departmental policies, and guidelines set forth by the Enterprise Cybersecurity Division. In order to deliver loan services to America’s students, FSA maintains approximately 75 information systems in various data centers and cloud deployments. To ensure the confidentiality, integrity, and availability of these systems, the Contractor shall review security controls and track adherence of remediation plans to improve overall security.

TASK C: SECURITY OPERATIONS CENTER (SOC)

This task is to operate and maintain FSA Security Operations Center (SOC) and handle incidents and breaches. FSA protects systems according to DHS and NIST standards, Departmental policies, and local guidelines and procedures set forth by the Enterprise Cybersecurity Division. In order to deliver loan services to America’s students, FSA monitors and protects approximately 75 information systems in various data centers and cloud deployments. To ensure the confidentiality, integrity, and availability of these systems, the Contractor shall monitor perimeter and internal systems, alert on potential breaches, and handle all incidents according to established procedures.

TASK D: INSTITUTES OF HIGHER EDUCATION (IHE) SECURITY SUPPORT

This task is to manage, coordinate, and respond to security incidents that occur at Institutes of Higher Education (IHE), approximately 6000 in number. FSA tracks, consults, and may assist on IHE breaches. In order to protect loan services to America’s students, FSA assures IHE are adequately protecting confidential information and the privacy of student and loan data. The Contractor shall manage IHE reporting on potential breaches and handle all incidents according to established processes and procedures.

TASK E: SCANNING, TESTING, AND ANALYSIS ACTIVITIES

This task is to test systems and networks of the 75 applications within FSA’s FISMA reportable systems. These activities include continuous diagnostic monitoring (CDM), ad hoc scanning, analysis of results, and re-tests of vulnerabilities and identified issues. FSA has been working towards total coverage and continuous surveillance of all its systems to provide near-real-time situational awareness of security vulnerabilities and risk profile.

TASK F: VULNERABILITY MANAGEMENT AND PLAN OF ACTION & MILESTONE

(POA&M) SUPPORT

This task is to manage vulnerabilities from discovery to eventual remediation found in FSA’s approximately 75 FISMA reportable and other information systems. The FSA Enterprise Cybersecurity Division (ECD) tracks and reports upon all open vulnerabilities, as well as, generates reports to discover trends and enact problem-solving, systemic fixes for the purpose of improving security and assessing the overall risk using a standardized cybersecurity scorecard.

TASK G: CYBERSECURITY TOOLS OPERATIONS AND MAINTENANCE

This task is to operate and maintain cybersecurity tools located at the data center, in cloud environments that FSA uses to coordinate monitoring and defense of its high-value assets, and co-located at other partner environments in support of Federal Student Aid loan processing.

TASK H: CYBERSECURITY DOCUMENTATION SUPPORT

This task is to create, maintain, and retire all relevant security documents for FSA. The support also includes team support for FSA SOC authorization and cybersecurity tool operations and maintenance.

TASK I: AUTHORITY TO OPERATE (ATO) SUPPORT

This task is to provide ATO and cybersecurity support to FSA projects. This includes security authorization readiness support, cloud security and cloud architect support services, POA&M and vulnerability remediation support, security documentation readiness reviews and specialized security engineering support such as mainframe and database security.

TASK J: GUARANTY AGENCY SECURITY ASSESSMENTS (GASA)

This task is to provide on-site security review and self-assessments to Guaranty Agencies (GAs). FSA uses an in-house developed GASAtraq tool to collect standardized information and produce consistent documentation of security controls as implemented by the GAs that support FSA FFEL portfolio.

TASK K: CYBERSECURITY SOC SUPPORT

This task is to support operations, specifically, big data analytics and the tools that provide the mining of cybersecurity findings. This task will be accomplished by support staff that will operate and maintain Splunk, Titan, ELK, and integrate tool output with CDM and ISCM operations for the CISO, FISMA, audit, and other support services at the Enterprise Cybersecurity Division.

Major Impacts to FSA Operations If This Bridge Contract Is Not Awarded This bridge contract is necessary and justified because of the severe impacts FSA would likely suffer were there a lapse in cybersecurity services. This section details the major impacts to FSA Operations that would occur without the cybersecurity support services to be provided by the bridge contract:

• The current Security and Privacy contract operates and maintains over 25 commercial and custom products and tools, which correlate security information at the FSA SOC. Currently, approximately 40 applications reside in data centers that are monitored by these cyber tools. These applications include critical applications, like Free Application for Federal Student Aid (FAFSA). If there is a lapse in contractor support in this key operations and maintenance area, these critical applications may risk incidents, breaches, interruption to services, and degradation of services. Without support from our cyber teams, the number of security vulnerabilities will increase, worsening the size of FSA’s attack posing as an even more viable target to potential hackers, criminal organizations, and foreign state actors.

• Failure to have qualified independent assessors perform System Accreditation and Ongoing Security Authorization would critically hamper FSA’s mission and reliance upon automated information systems.

The services provided by the Security and Privacy contract supports all seventy (70) FISMA reportable FSA information systems, maintaining a $1.4 trillion-dollar financial portfolio and 120 million student records. The program annually averages 20 new full scope assessments and nearly 120 quarterly assessments under the Ongoing Security Authorization (OSA) program. OSA would be terminated resulting in systems rapidly failing to meet compliance with Federal mandates and vulnerable to new cyber-attack vectors. These non-compliant systems would therefore have to shut down operations due to the risk of exposing all those student records and jeopardizing the processing FSA’s massive loan portfolio. If OSA ceased, then it would take another six to nine months, per system, to undergo re-authorization and undergo a full scope assessment to be allowed to continue to process Federal information. Additionally, key components of the DHS mandated Continuous Diagnostics and Monitoring program will create an increased risk for FSA, the Department, and the Federal government. Likely, this increased risk would not be tolerated and force FSA systems to cease services for loan payments and loan servicing to students and schools. system enhancements or a Next Generation FSA program to support delivery of loans to nearly 19 million students.

• The ISSO support effort, which includes Vulnerability Management and direct ISSO duties, ensures that the risks for all FSA information are properly identified and safeguards are properly implemented daily.

The Contractor continuously updates and configures products to discover, address, and resolve security vulnerabilities that are identified through scheduled scans, through vendor announcements, through NIST/FISMA/EDCIRC, or through other mechanisms. Without the Contractor’s support, the number of security vulnerabilities across all 70 information systems will increase. Because these security vulnerabilities will not be resolved, there will be increases in the risks, impacts, and severity of security incidents occurring, including loss of PII data, loss of non-PII data, denial of services attacks (which cease an application temporarily), and other security breaches.

• Without the ISSO support provided under the planned bridge contract, FSA will be operating at risk when using unsupported software and software that is not being maintained with the latest security patches.

Failure to maintain daily situational awareness and activity may result in systems being vulnerable to both external attacks as well as potential insider threats against information systems and student information.

• The FSA Cybersecurity Security Operations Center (SOC) will suffer an 80% reduction in services and capabilities exposing information systems to attacks without a mechanism in place to prevent, monitor, or react to the attacks. Systems may be compromised, and extensive personal and financial information may be stolen leaving FSA and the Department at risk for millions of dollars in damages and recovery efforts.

• The technical expertise provided by the Contractor is a lynchpin in the effectiveness of the SOC operations in its ability to monitor, detect, and react to cyber events for the 70 information systems and nearly 6500 schools that are required to report breaches of privacy information. Without the continued support of the SOC SME and the institutional knowledge retained by the incumbent, incident and breach activities would be impossible to meet current guidelines provided by DHS, e.g., response times, architectural knowledge, and correlation with enterprise systems.

• The FUTURE Act also enables FSA to leverage Federal Tax Information (FTI) for reducing the net cost of improper payments, managing oversight activities, and conducting analyses and forecasts.

The current contractor is currently providing FSA the following support for the agency’s implementation of the FUTURE Act to: (1) Analyzing FSA security policies and procedures for Future Act implementation impacts; (2) Reviewing Future Act PMO Proposed Solutions and Implementation plans against 1075 requirements and prepare briefings as requested; and (3) Identifying Safeguards implementation, impacts, milestones, dependencies and deltas in relation to the Future Act requirements. If FSA fails to continue to make timely progress in implementing all Publication 1075 required security safeguards, the IRS will not provide FTI to FSA. Failure to continue to have SMEs provide this support would significantly delay the FUTURE Act Project with the IRS and result in FSA missing the deadline for receipt of FTI as agreed to by FSA and the IRS.

There will be major business impacts to administering the Free Application for Federal Student Aid (FAFSA®) form, income-driven repayment (IDR) plans, total and permanent disability (TPD discharge), and income verification programs.

SECTION IV: IDENTIFICATION OF THE SINGLE SOURCE SOLICITATION AUTHORITY

This action is being taken under the authority of 41 U.S.C. 1901(e)(2) and 20 USC 1018a(e), as implemented by FAR 13.106-1(b)(1)(i) and FAR 13.501(a).

SECTION V: DEMONSTRATION THAT THE PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS

OR THE NATURE OF THE ACQUISITION REQUIRES USE OF THE AUTHORITY CITED.

In accordance with FAR 13.106-1(b)(1)(i), the circumstances that show that only one source is reasonably available to meet FSA’s needs are as follows:

FSA is in immediate need of interim services to meet its Cybersecurity and Privacy Support Services (CPSS) requirements while FSA implements the corrective action of re-evaluating proposals and competing the cybersecurity call orders against the resultant CPSS BPA. As such, the precise duration of the need met by this bridge contract cannot be determined at this time.

FSA does not have the internal capabilities or staffing resources to perform the required CPSS operational support without contractor support.

As the incumbent, Blue Canopy/Jacobs, is the only contractor that can immediately provide FSA with the needed CPSS services for a period of 3 months to one year. Blue Canopy/Jacobs is currently in-place and ready to provide immediate services. Blue Canopy/Jacobs is the only Contractor that can immediately provide cleared and qualified staff for the required period of performance. Past experience indicates that it would take approximately three months for a new contractor to recruit staff and complete mandatory Department of

Education background investigations for staff assigned to support the CPSS functions. Further, to properly transition from Blue Canopy/Jacobs to a new Contractor, FSA anticipates a two-month transition period would be needed once the staff was recruited and cleared. Blue Canopy/Jacobs and the new contractor would need to conduct knowledge-sharing activities, allow existing projects to be phase-out or be transferred to the new Contractor, and allow new projects to start timely. In total, the transition period could be up to three months.

Even if there was a contractor willing to compete for a bridge contract with a three-month base period of performance, such a contractor could not possibly begin providing effective services until at least three months.

FSA’s need is immediate and cannot reasonably wait for two or three months. Further, once the CPSS BPA is awarded, FSA will no longer require the interim CPSS services provided by this bridge contract and will procure those services from the BPA.

Blue Canopy/Jacobs is the only Contractor available to immediately provide full support for all cybersecurity tasks for FSA’s minimum requirement of three months of services.

SECTION VI: DESCRIPTION OF EFFORTS MADE TO ENSURE THAT OFFERS ARE SOLICITED FROM

AS MANY POTENTIAL SOURCES AS IS PRACTICABLE

As described above, only one source can perform the requirements due FSA’s immediate need for a short duration bridge contract. FSA has not solicited from other potential Offerors because they would not be reasonable sources under the circumstances of this procurement.

This requirement is proceeding under FAR 13.5 simplified acquisition procedures and, in accordance with FAR 13.501(a)(1)(iii), this justification will be made publicly available within 14 days after contract award.

SECTION VII: DETERMINATION BY THE CONTRACTING OFFICER THAT THE ANTICIPATED COST

TO THE GOVERNMENT WILL BE FAIR AND REASONABLE.

Award to Jacobs is contingent upon the Contracting Officer’s determination of price reasonableness. The Contracting Officer anticipates evaluating the price for fair and reasonableness by comparing the resultant proposed pricing with Historical pricing found in past Cybersecurity contracts as well as the current contract with Jacobs and the IGCE prepared for the bridge contract.

SECTION VIII: MARKET RESEARCH DESCRIPTION

FSA conducted market research for award of the CPSS BPA by collecting product and service information from the vendors within the marketplace to satisfy FSA needs. Such needs were adapted from CDM, NIST, and GSA’s Highly Adaptive Cybersecurity Services (HACS). Specifically, there were 5 areas identified within the Cybersecurity Framework (CSF), which include five high-level functions: Identify, Protect, Detect, Respond, and Recover. FSA’s market research resulted in the determination that multiple small businesses with the GSA IT-70 Schedule can meet FSA’s cybersecurity needs. The limiting factor on reasonable offerors for the bridge contract is not the nature of the services but the immediate need and uncertain, limited duration of the bridge contract.

FSA is confident that once the CPSS BPA is awarded, all of FSA’s future cybersecurity requirements will be competed on that contracting vehicle.

SECTION IX. ANY OTHER FACTS SUPPORTING THE USE OF OTHER THAN FULL AND OPEN

COMPETITION

None.

SECTION X: A LISTING OF THE SOURCES, IF ANY THAT EXPRESSED, IN WRITING, AN INTEREST

IN THE ACQUISITION.

None.

SECTION XI: A STATEMENT OF THE ACTIONS, IF ANY, THE AGENCY MAY TAKE TO REMOVE OR

OVERCOME ANY BARRIERS TO COMPETITION BEFORE ANY SUBSEQUENT ACQUISITION FOR

SUPPLIES OR SERVICES REQUIRED.

FSA anticipates that the resolution of the protest of the CPSS BPA will permit FSA to proceed with competing the related BPA call orders. Future CPSS call orders will be competitively solicited under the multiple-award CPSS

BPA.

SECTION XII: TECHNICAL OR REQUIREMENTS PERSONNEL CERTIFICATION

I certify that this requirement meets the Government’s minimum need and that the supporting data, which forms a basis for this justification, is complete and accurate.

Cheng Tang

Name Signature Date

SECTION XIII: CONTRACTING OFFICER’S CERTIFICATION

I certify that this justification is accurate and complete to the best of my knowledge and belief. Based on the facts and findings described herein, I hereby approve the strategy to negotiate a contract award on a sole-source basis with Jacobs.

Marlon Holland

SECTION XIV: REVIEWS AND APPROVALS

Program Senior Official (or designee):

I certify that the facts and representations under my cognizance, which are included in this justification and which form a basis for this justification, are complete and accurate.

Dan Commons

Activity Advocate for Competition (if over $700,000):

I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief. Since this JOFOC does not exceed $13.5M, this review serves as approval.

JD Cutlip

Head of Contract Activity (if over $13.5M):

I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief.

Since this JOFOC does not exceed $68M.

James Davis