Recovery - Security Testing & Evaluation for HITECH

IRS Contract #TIRNO-99-D-00005 was initially awarded to the MITRE Corporation, a Federally Funded Research and Development Center (FFRDC), as a competitive Cost-Plus-Fixed-Fee contract. This contract action is not available for competition because it is a modification to a task order under an IDIQ contract that was awarded to a FFRDC, which is the mandatory source. In addition, the work to be performed under this task order is part of the CMS Integrated Information Technology (IT) Investment & System Life Cycle Framework. As part of this program, all CMS systems must undergo a Security Test & Evaluation (ST&E) prior to accreditation or reaccreditation, before it is placed into an operational state, when a significant change has been made to an existing system, or at least every three years. Since the ST&E's required for each specific CMS system vary, it is impossible to predict the number, types and specific systems that will require testing during a contract year. Also, due to legislative mandates, such as the National Level Repository and new ST&E requirements, the price of each ST&E performed is subject to adjustments. Per FAR Subpart 16.2, a firm-fixed-price contract type provides for a price that is not subject to adjustment on the basis of the contractor's cost experience in performing the contract. Thus, due to the nature of this requirement, a fixed-price modification would not be appropriate.