HHS awards $2M for Industrial Control System network remediation to ML Hunter LP, focusing on security and reliability

Contract Overview

Contract Amount: $2,038,107 ($2.0M)

Contractor: ML Hunter LP

Awarding Agency: Department of Health and Human Services

Start Date: 2023-09-28

End Date: 2026-02-15

Contract Duration: 871 days

Daily Burn Rate: $2.3K/day

Competition Type: NOT AVAILABLE FOR COMPETITION

Number of Offers Received: 1

Pricing Type: FIRM FIXED PRICE

Sector: IT

Official Description: C115749- CUP INDUSTRIAL CONTROL SYSTEM (ICS) NETWORK REMEDIATION- THE OBJECTIVE OF THIS PROJECT IS TO RECONFIGURE THE CUP INDUSTRIAL CONTROL SYSTEM NETWORK TO IMPROVE ITS SECURITY, RELIABILITY, PERFORMANCE, AND REDUNDANCY.

Place of Performance

Location: BETHESDA, MONTGOMERY County, MARYLAND, 20892

State: Maryland Government Spending

Plain-Language Summary

Department of Health and Human Services obligated $2.0 million to ML HUNTER LP for work described as: C115749- CUP INDUSTRIAL CONTROL SYSTEM (ICS) NETWORK REMEDIATION- THE OBJECTIVE OF THIS PROJECT IS TO RECONFIGURE THE CUP INDUSTRIAL CONTROL SYSTEM NETWORK TO IMPROVE ITS SECURITY, RELIABILITY, PERFORMANCE, AND REDUNDANCY. Key points: 1. Contract aims to enhance security, reliability, performance, and redundancy of critical industrial control systems. 2. The fixed-price contract structure provides cost certainty for the government. 3. ML Hunter LP is the sole awardee, raising questions about competition. 4. The project duration of 871 days suggests a comprehensive and potentially complex undertaking. 5. Geographic location in Maryland may indicate a focus on specific NIH facilities. 6. The contract falls under Computer Systems Design Services, a common IT support category.

Value Assessment

Rating: fair

The contract value of $2,038,106.51 for industrial control system network remediation appears to be within a reasonable range for a project of this scope and duration. Without specific benchmarks for ICS network remediation, direct comparison is difficult. However, the firm-fixed-price nature suggests that the initial pricing was deemed acceptable. Further analysis would require understanding the specific technical requirements and the complexity of the existing network infrastructure.

Cost Per Unit: N/A

Competition Analysis

Competition Level: sole-source

This contract was awarded on a sole-source basis, meaning it was not competed. This limits the opportunity for multiple vendors to bid, potentially impacting price discovery and the government's ability to secure the most competitive pricing. The justification for a sole-source award would need to be thoroughly reviewed to understand why full and open competition was not feasible.

Taxpayer Impact: Sole-source awards can lead to higher costs for taxpayers as competition is absent, potentially reducing the incentive for the contractor to offer the lowest possible price.

Public Impact

The primary beneficiaries are the National Institutes of Health (NIH) facilities relying on the industrial control systems. The services delivered will improve the security posture and operational reliability of critical infrastructure. The geographic impact is concentrated in Maryland, where the NIH facilities are located. The contract supports the IT and cybersecurity workforce, potentially involving specialized engineers and technicians.

Waste & Efficiency Indicators

Waste Risk Score: 50 / 10

Warning Flags

Lack of competition due to sole-source award may result in suboptimal pricing.
The complexity of ICS systems requires specialized expertise, and the sole awardee's capability needs to be validated.
Potential for scope creep if initial requirements are not clearly defined, given the project's long duration.

Positive Signals

Focus on improving security and reliability addresses critical operational needs.
Firm-fixed-price contract provides budget certainty.
The project's objective to enhance ICS network performance is a positive step towards modernization.

Sector Analysis

The contract falls within the Information Technology (IT) sector, specifically focusing on computer systems design and cybersecurity for industrial control systems (ICS). The market for ICS cybersecurity is growing rapidly due to increasing threats to critical infrastructure. Spending in this area is often driven by regulatory requirements and the need to protect essential services. Comparable spending benchmarks are difficult to establish without detailed project scope, but IT services for government agencies represent a significant portion of federal IT budgets.

Small Business Impact

This contract does not appear to involve a small business set-aside, as indicated by the 'sb': false field. There is no information provided regarding subcontracting plans or their impact on the small business ecosystem. Given the sole-source nature, it is unlikely that small businesses would be involved as prime contractors.

Oversight & Accountability

Oversight for this contract would typically be managed by the contracting officer and program officials within the National Institutes of Health. The firm-fixed-price contract type provides a degree of financial oversight by establishing a set cost. Transparency would depend on the agency's policies regarding the release of sole-source justifications and contract performance details. Inspector General jurisdiction would apply if any fraud, waste, or abuse were suspected.

Related Government Programs

Federal Information Security Modernization Act (FISMA) compliance
Critical Infrastructure Protection programs
NIH IT Modernization Initiatives
Cybersecurity Enhancement Act of 2015

Risk Flags

Sole-source award raises concerns about competition and potential cost overruns.
Lack of detailed performance metrics in the provided data makes outcome assessment difficult.
The long duration of the contract warrants close monitoring for scope creep and efficiency.

Frequently Asked Questions

What is this federal contract paying for?

Department of Health and Human Services awarded $2.0 million to ML HUNTER LP. C115749- CUP INDUSTRIAL CONTROL SYSTEM (ICS) NETWORK REMEDIATION- THE OBJECTIVE OF THIS PROJECT IS TO RECONFIGURE THE CUP INDUSTRIAL CONTROL SYSTEM NETWORK TO IMPROVE ITS SECURITY, RELIABILITY, PERFORMANCE, AND REDUNDANCY.

Who is the contractor on this award?

The obligated recipient is ML HUNTER LP.

Which agency awarded this contract?

Awarding agency: Department of Health and Human Services (National Institutes of Health).

What is the total obligated amount?

The obligated amount is $2.0 million.

What is the period of performance?

Start: 2023-09-28. End: 2026-02-15.

What is the specific justification for awarding this contract on a sole-source basis?

The provided data indicates the contract was awarded as 'NOT AVAILABLE FOR COMPETITION,' which is synonymous with a sole-source award. The specific justification for this determination is not included in the provided data. Typically, sole-source awards are justified under circumstances such as only one responsible source being available, or an urgent and compelling need that precludes full and open competition. Without the official justification document, it is impossible to ascertain the precise reasons. This lack of competition is a key area for further investigation, as it can impact cost-effectiveness and potentially limit the government's access to the best available solutions.

How does the $2.04 million cost compare to similar ICS network remediation projects in the federal government?

Directly comparing the $2.04 million cost to similar Industrial Control System (ICS) network remediation projects is challenging without access to a comprehensive database of federal ICS projects, their specific scopes, and their contract values. The provided data indicates this is a firm-fixed-price contract for Computer Systems Design Services, awarded to ML Hunter LP by the National Institutes of Health (NIH) in Maryland. The project duration is 871 days. The value seems reasonable for a multi-year IT infrastructure project, but without detailed technical specifications, the complexity of the network, and the specific security enhancements required, a precise benchmark is not feasible. Further research into publicly available contract awards for ICS modernization or cybersecurity within federal agencies could provide comparative data points.

What are the key performance indicators (KPIs) for this contract, and how will success be measured?

The provided data outlines the objective of the contract: 'to reconfigure the CUP INDUSTRIAL CONTROL SYSTEM NETWORK to improve its security, reliability, performance, and redundancy.' While these are the desired outcomes, specific Key Performance Indicators (KPIs) and measurement methodologies are not detailed. Typically, for such a project, KPIs might include metrics related to system uptime, reduction in security vulnerabilities (e.g., number of critical vulnerabilities patched), improvement in network latency or throughput, and successful completion of system integrity tests. The contracting officer's representative (COR) would be responsible for monitoring performance against the contract requirements, but the exact metrics are not publicly available in this dataset.

What is the track record of ML Hunter LP in performing similar government IT security and network remediation contracts?

Information regarding ML Hunter LP's specific track record in performing similar government IT security and network remediation contracts is not provided in the dataset. To assess their capability, one would typically look at past performance evaluations (e.g., Contractor Performance Assessment Reporting System - CPARS), the value and complexity of previous similar contracts awarded to them, and any relevant certifications or past performance questionnaires. Given this is a sole-source award, the agency likely conducted some level of due diligence on ML Hunter LP's capabilities. However, without access to that specific information or a broader contract database, a detailed assessment of their track record is not possible from the given data.

What is the potential impact of this contract on the overall cybersecurity posture of the NIH?

This contract is intended to directly enhance the cybersecurity posture of the specific NIH facilities where the CUP Industrial Control System (ICS) network is deployed. By improving security, reliability, performance, and redundancy, the project aims to reduce the attack surface, prevent unauthorized access, and ensure the continuous operation of critical systems. ICS networks often control physical processes and are increasingly targeted by sophisticated cyber threats. A successful remediation of this network would therefore contribute to the overall resilience and security of NIH's operational technology (OT) environment, mitigating risks associated with potential disruptions or data breaches affecting these critical systems.

Industry Classification

NAICS: Professional, Scientific, and Technical Services › Computer Systems Design and Related Services › Computer Systems Design Services

Product/Service Code: IT AND TELECOM - INFORMATION TECHNOLOGY AND TELECOMMUNICATIONS › IT AND TELECOM - IT MANAGEMENT

Competition & Pricing

Extent Competed: NOT AVAILABLE FOR COMPETITION

Solicitation Procedures: ONLY ONE SOURCE

Offers Received: 1

Pricing Type: FIRM FIXED PRICE (J)

Evaluated Preference: NONE

Contractor Details

Address: 2112 DEER RIDGE DR, STONE MOUNTAIN, GA, 30087

Business Categories: Black American Owned Business, Category Business, DoT Certified Disadvantaged Business Enterprise, Joint Venture Economically Disadvantaged Women Owned Small Business, Joint Venture Women Owned Small Business, Minority Owned Business, Partnership or Limited Liability Partnership, Self-Certified Small Disadvantaged Business, Small Business, Special Designations, U.S.-Owned Business, Woman Owned Business

Financial Breakdown

Contract Ceiling: $2,038,107

Exercised Options: $2,038,107

Current Obligation: $2,038,107

Actual Outlays: $1,891,816

Contract Characteristics

Commercial Item: COMMERCIAL PRODUCTS/SERVICES PROCEDURES NOT USED

Cost or Pricing Data: YES

Timeline