United States Department of Agriculture Limited Sources Justification for an Order/BPA Exceeding the Simplified Acquisition Threshold Federal Supply Schedules/Multiple Award Schedule Program FAR 8.405 Control No. FNS-LSJ-22-0003

1. Identification of the agency and the contracting activity. Agency: U.S. Department of Agriculture, Food and Nutrition Service (FNS) Contracting Activity: FNS Contracts Management Division 2. Nature and/or description of the action being approved. The USDA/FNS intends to limit competition by modifying firm fixed price task order, GS-35-F- 122BA, 12319819F0154, to add additional funding and requirements to address the new Federal cybersecurity requirements issued in FY2021, after the current contract was awarded. 3. Description of the supplies or services required to meet the agency's needs (including the estimated value). The current period of performance for option year 2 is 09/27/2021 to 09/26/2022. The final end date for the contract is 09/26/2024. The new Federal cybersecurity requirements that must be addressed, per the May 2021 Executive Order on Improving the Nation's Cybersecurity (14028) and related OMB memos and NIST standards, are similar in nature to those covered within the scope of the existing contract, but require an expansion in the breadth and scope of the services provided. Specifically: - Task 3 will need to incorporate support related to ensuring the implementation of new NIST SP 800-53 Rev. 5 security and privacy control requirements, as well as supply chain risk management requirements, critical software security requirements, and software supply chain security requirements; - Task 4 will need to incorporate support related to new cloud migration requirements, zero-trust architecture implementation requirements, and audit logging, retention, analysis, and management requirements for FNCS systems and applications; - Task 5 will need to incorporate support related to new incident response coordination and vulnerability management requirements. 4. The authority and supporting rationale. The following circumstance justifies limiting the source under FAR 8.405-6: FAR 8.405-6(a)(1)(i)(C) - In the interest of economy and efficiency, the new work is a logical follow-on to an original Federal Supply Schedule. 5. A statement demonstrating the unique qualifications of the proposed contractor or the nature of the action requiring the use of the authority. The rationale for limiting the competition is that the new Federal cybersecurity requirements do not change the nature or scope of the activities currently being performed under the existing contract, which was awarded through a competitive procurement. The only change is the addition of a few new requirements for the deliverables required under the existing contract. These new requirements increase the number of FNS IT applications needing cybersecurity support from this vendor, and add additional cybersecurity requirements that must be addressed within the current contract's deliverables. B&M Consulting Group, Inc is capable of providing the services required at the level of quality and within the timeframe required which is February 01st 2022 to September 2022. The initial Task Order was openly competed and B&M Consulting Group, Inc, a small business provider, was selected as providing the best technical solution at the best price. It is a duplication of effort and inefficient to attempt to have a second vendor fulfill the services required. A new vendor may not be familiar with USDA systems, processes and procedures. Moreover, there would be a significant upfront learning curve for a new vendor to learn the Agency's systems and processes which will impede completion of the activities required within the established period of performance. 6. Description of the market research conducted among schedule holders and the results or a statement of the reason market research was not conducted. A competitive procurement was used for the initial selection of the current vendor. Market research was performed as part of the initial contract solicitation process. The request for contract modification does not substantively alter the existing contract. 7. Any other facts supporting the justification. NA 8. Statement of actions the agency may take to remove or overcome any barriers to competition if subsequent acquisitions are anticipated. Due to the nature of the change in the contract, which was due to new Federal cybersecurity requirements issued in FY2021, after the current contract was awarded, the agency best choice is to modify the current contract. This action is determined to be the most effective as far as costs, quality and meeting the deadline for the required changes.