JEFO -Redacted

Justification for Exception to Fair Opportunity, Exceeding the Micro-purchase Threshold, Governance Communications Assessments & Classified Services (GCACS) III / Cybernamic, LLC
REFERENCE: Justification Log Number: FY27-0008 and PR Number: 1. Agency and Contracting Activity.
The Department of Homeland Security (DHS), U.S. Citizenship and Immigration Services (USCIS), Office of Contracting (OCON), proposes to modify an existing task order on behalf of the Office of Information Technology (OIT), Information Security Division (ISD), Risks Information Systems & Classified Operations (RISCO) Branch, pursuant to RFO 16.507-6(b), Exceptions to the fair opportunity process. 1
2. Nature and/or Description of the action Being Approved. This action seeks approval for a sole source extension to Cybernamic LLC (Cybernamic) via modification No. P00027 to Task Order No. 70SBUR22F00000242 to continue the GCACS III services currently performed by Cybernamic to maintain continuity of critical classified-systems security, communications, assessment, compliance, and program-management support. The current task order was competitively awarded in September 2021 to Cybernamic, under General Services Administration (GSA) 8(a) STARS III Governmentwide Acquisition Contract (GWAC) No. 47QTCB21D0381, through a fair-opportunity process under the 8(a) STARS III GWAC for the period September 21, 2022, through April 20, 2026. The task order was subsequently modified under FAR 52.217-8 Option to Extend Services and extended for a total of six (6) months via modifications No. P00023 (04/21/2026 to 08/20/2026), P00025 (08/21/2026 to 09/20/2026), and P00026 (09/21/2026 to 10/20/2026), to maintain continuity of services, while USCIS conducted the GCACS IV recompete.
3. Description of Supplies/Services.
GCACS III provides cybersecurity governance, assessment, engineering, classified-system, and secure-communications support for USCIS. This justification seeks approval to continue the following work unique to 70SBUR22F00000242 to include:
Program and project management, quality management, reporting, and process improvement.
RMF security control assessments, authorization package development, continuous monitoring, and vulnerability-management support.
In this document, citations to, RFO Part 16, RFO Part 10, RFO Part 11 and RFO Part 15 are citations specifically to Federal Acquisition Regulation (FAR) Class Deviation 26-04, Rev. 1 for FAR Part 16, FAR Class Deviation 26-12, Rev. 1 for FAR Part