NOAA Enterprise Wide Security Services Compliance (EWSSC) - Justification for an Exception to Fair Opportunity

The NOAA Office of the Chief Information Officer’s Cybersecurity Division is soliciting a sole-source, firm-fixed-price contract modification under the GSA 8(a) STARS III vehicle, solicitation number 1305M425F0011, to continue enterprise-wide cybersecurity services with Soliel LLC. The contract, effective from March 1, 2026, through January 9, 2028, is executed as an exception to fair opportunity under FAR 16.507-6(b)(3), justified as a logical follow-on to existing services. The contractor will provide comprehensive support to enhance NOAA’s Risk Management Framework compliance, maintain and improve centralized cyber security services, and administer associated information inventories. A critical focus is the strengthening of NOAA’s Controlled Unclassified Information program through the implementation of NIST SP 800-171 and NIST SP 800-53 Rev 5 controls, ensuring CUI is properly marked, handled, and safeguarded in alignment with NARA guidelines and the DOC SPAA Handbook. The contractor will update System Security Plans, Plans of Action and Milestones, and Standard Operating Procedures to incorporate explicit CUI requirements and provide advisory support for cloud initiatives, including FedRAMP package reviews and recommendations to CSD leadership. All services are to be performed at NOAA’s facility in Silver Spring, Maryland, where the Government will conduct inspection and acceptance based on compliance with federal cybersecurity standards, documentation accuracy, and adherence to RMF processes. While no formal evaluation factors or weights are specified, the contract’s five core objectives define the scope of performance, with CUI program enhancement being the latest and most significant expansion of work under this task order. The contractor is expected to deliver artifacts including updated SSPs, POA&Ms, training materials, and control inheritance models, all aligned with DOC and NIST directives. No specific contract clauses from FAR Part 52 are included, and no formal representations, certifications, or key personnel names are listed in the documentation, though the nature of the work implies that personnel must possess expertise in federal cybersecurity compliance and be authorized to handle sensitive federal data, consistent with Secret-level clearance expectations. The procurement structure, funding source, and oversight remain under NOAA’s Acquisition and Grants Office, with Jeremy Johnson serving as the primary point of contact and the contracting officer.