FAR Part 8: Sole Source on FSS Orders
When you order from GSA Federal Supply Schedules, you normally give multiple schedule holders a fair shot. This page walks through GSAM 538.7104-3 where the ordering agency has adopted the RFO/agency-deviation framework.
Sole Source on Federal Supply Schedules
The five statutory exceptions, what the file actually has to show, and where the RFO/agency-deviation text lives.
1 Where this lives under the RFO/agency-deviation framework
For agencies that have adopted the RFO Part 8 deviation, the streamlined FSS ordering framework directs users to GSAM Subpart 538.71. The former limited-sources lane is addressed at GSAM 538.7104-3 as a sole source justification. Under the codified baseline, FAR 8.405-6 remains the governing cite.
Within the RFO/GSAM framework, the text is significantly leaner than the codified FAR baseline. Most notably: the old eleven-element verbatim list and the FAR-driven dollar-threshold approval ladder are not in GSAM 538.7104-3. The content standard is "in writing and include sufficient detail and supporting rationale to support the exception used." Approval levels are set by agency or local policy. You still need a defensible file, the justification still has to be posted publicly, and a thin justification is still a problem.
Each acquisition framework has its own lane for restricting competition. Under an adopted RFO deviation, some names and citations differ from the codified FAR baseline:
FAR Part 6: Justification and Approval (J&A). Non-commercial, open market procurements above the SAT.
FAR Part 8: FAR 8.405-6 under the codified baseline; GSAM 538.7104-3 when the RFO/agency-deviation framework applies.
FAR Part 12: Commercial sole source path. Commercial item buys using simplified procedures.
FAR Part 16: Exception to Fair Opportunity. Task and delivery orders off IDIQ and requirements contracts.
When someone says "sole source on a schedule," a sharp CO first confirms whether FAR 8.405-6 or GSAM 538.7104-3 governs the ordering agency. It is not a FAR Part 6 action.
2 Above MPT, at or below the SAT
This is the lighter of the two tiers. GSAM 538.7103-2(c) routes a sole source action in this range to GSAM 538.7104-3(a), which says the ordering activity CO must determine in writing that the circumstances of the acquisition deem only one source reasonably capable of providing the products, services, or solutions. The GSAM gives examples: urgency, exclusive licensing agreements, and items particular to one manufacturer (brand name).
There is no formal statutory-exception list at this tier. The file standard is the CO's written determination plus the underlying facts that support it. Document who you considered, what made them not capable, why the one source you picked is capable, and how price reasonableness is established. The shorter the dollar figure, the shorter the file can be, but it still needs to be defensible if a reviewer pulls it.
3 Above the SAT — the five statutory exceptions
Above the SAT, GSAM 538.7104-3(b)(1) lists five statutory exceptions. You have to cite which one applies and support it in the file.
(i) Unusual urgency. The need is of such unusual urgency that following the normal procedures would result in unacceptable delays in fulfilling that need. Genuine and unforeseen, not poor planning.
(ii) Only one source capable. Only one source is capable of providing the products, services, or solution required at the level of quality required because the offering is unique or highly specialized. The key word is "capable." If only one schedule holder can actually meet the specific technical requirements, this is your exception.
(iii) Logical follow-on to a competitively issued FSS order. The order should be issued on a sole source basis in the interest of economy and efficiency because it is a logical follow-on to an FSS order already issued on a competitive basis. Note the qualifier: the prior FSS order has to have been competed. A sole source follow-on to a sole source order does not stack.
(iv) FSS BPA minimum guarantee. It is necessary to place the order with a particular FSS contractor to satisfy a minimum guarantee established in the FSS BPA. Narrow, but it exists in the GSAM.
(v) Law expressly authorizes or requires the specified source. A statute names the source or directs that the purchase be made from a specified source. Rare, and when it shows up it usually shows up clearly.
4 The content standard: sufficient detail and supporting rationale
Within the RFO/GSAM framework, GSAM 538.7104-3(b)(2) does not enumerate elements: justifications must be in writing and include sufficient detail and supporting rationale to support the exception used.
What "sufficient detail and supporting rationale" looks like in practice for an above-SAT sole source file is not a regulatory checklist. It is a defensibility question. A thorough above-SAT file generally still ends up covering:
- Who the agency and ordering activity are, and that this document is a sole source justification under GSAM 538.7104-3
- What the action is (new order, FSS BPA, modification) and against which FSS contract
- What you are buying, with enough specificity that a reviewer can understand it, plus the estimated value
- Which of the five statutory exceptions applies, and the rationale that supports it with verifiable facts and references
- What market research you did among FSS contractors, and what it showed
- How you established price reasonableness
- Signatures: CO, technical or requirements personnel certifying the technical claims, and the approving official whose level is set by agency or local policy
None of those are GSAM-mandated line items the way the old FAR's eleven elements were. They are the working parts of a file that holds up under review. Build the file to the underlying logic, not to a checklist.
5 Approval level
GSAM 538.7104-3 does not contain dollar-threshold approval levels within the RFO/agency-deviation framework. Under the codified baseline, apply the approval requirements in FAR 8.405-6.
Approval authority for a sole source justification is now whatever your agency or component supplement and your local delegation matrix say it is. For DAF activities that may run through DAFFARS, MAJCOM supplements, and the local SCO or Senior Contracting Official delegation. For other components it runs through their agency supplements. Pull the actual delegation document and have the right approver named in the file before you ask anyone to sign.
6 Publication
For above-SAT sole source justifications, GSAM 538.7104-3(b)(3) requires the justification to be made publicly available within 14 days after award. Urgency-based justifications under 538.7104-3(b)(1)(i) have 30 days. Posting goes on the Government-wide Point of Entry (currently SAM.gov) or the ordering activity website, and the minimum posting period is 30 days.
Before posting, screen the justification. The GSAM requires you to identify and remove contractor proprietary data, and to evaluate whether the justification or portions of it are exempt from disclosure under the Freedom of Information Act or FAR Part 24. Where publication would compromise national security or otherwise involves extraordinary circumstances, the GSAM provides an exception.
Check the Sole Source Examples tab to see what a defensible above-SAT file looks like, and how it falls apart when the rationale is thin.
Sole Source Justification Examples
Same scenario, two very different justifications. A base Communications Squadron needs to order a SIEM/SOAR cybersecurity platform through GSA MAS. The order is above the SAT, so a written sole source justification under GSAM 538.7104-3(b) applies. The GSAM content standard is "sufficient detail and supporting rationale to support the exception used" — the good example shows what that looks like in a thorough file; the bad example shows what falls apart. Click highlighted sections for coaching notes. Blue borders = strong. Red borders = problems.
Sole Source Justification
GSAM 538.7104-3(b)
Estimated value (base year): $315,000.00 ($4,200/license x 75 users).
Option Year 1: $315,000.00. Option Year 2: $315,000.00.
Total potential value including all option years: $945,000.00.
Rationale: The 633d CS SOC operates a Palo Alto-native security stack: Cortex XDR v3.8 for endpoint detection (Contract FA4800-24-F-0092, period of performance through 30 Sep 2027) and Panorama v11.1 for firewall management across 47 perimeter devices (Contract FA4800-23-F-0147, period of performance through 30 Sep 2026).
CyberShield Pro is the only SIEM/SOAR platform on GSA MAS SIN 54151HACS that provides native bidirectional API integration with both Cortex XDR and Panorama through the unified Cortex Data Lake. This native integration enables automated playbook execution (threat detection to containment action) in under 1 second without middleware.
Alternative SIEM/SOAR platforms evaluated on GSA MAS:
- SolarWinds Security Event Manager (GS-35F-0674P): Does not offer SOAR automation or Cortex XDR integration. Confirmed via email from M. Torres, Federal Sales, 12 Feb 2026 (Exhibit C).
- Splunk Enterprise Security + SOAR (GS-35F-0822R): Requires custom REST API connector for Cortex XDR. J. Ramirez, Federal Sales Engineer, confirmed in writing (14 Feb 2026, Exhibit D) that a native Cortex XDR connector is not on the FY26 development roadmap.
- Datadog Cloud SIEM (GS-35F-0299U): Supports log ingestion from Cortex XDR but not bidirectional automated response. T. Okafor, DoD Programs, confirmed by phone (15 Feb 2026, 571-555-0183, memorialized in Exhibit E) that automated playbook integration with Palo Alto products is in beta, not production-ready.
Using a non-natively integrated platform would require custom middleware connectors at an estimated additional cost of $47,000/year (Exhibit F, cost estimate from 633 CS/SCOO), introduce 30-60 second latency per automated response action, and create an additional attack surface through the middleware layer.
CyberShield Pro's native Cortex integration provides quantified advantages: (a) eliminates $47,000/year in custom middleware development and maintenance, (b) reduces automated incident response time from 30-60 seconds (middleware) to under 1 second (native API), and (c) avoids the additional cybersecurity risk of a middleware integration layer. These advantages directly support compliance with USCYBERCOM TASKORD 22-0187 (15-minute total incident containment).
I have determined that this order represents best value to the Government per GSAM 538.7102-2(b)(4), based on equivalent pricing, $47,000 annual cost avoidance, and superior operational performance.
/s/ Capt Sarah M. Okonkwo, Contracting Officer, 633 CONS/LGCB, 20 Feb 2026
Technical/Requirements Personnel Certification: I certify that the supporting technical data and requirements described herein, including the Cortex XDR/Panorama integration dependency and the alternatives analysis, are accurate and complete.
/s/ TSgt David R. Nguyen, Cyber Operations Flight Chief, 633 CS/SCOO, 19 Feb 2026
Approving Official Determination: Based on the information provided, I determine that the circumstances described in GSAM 538.7104-3(b)(1)(ii) apply to this order. Only one source on the GSA MAS schedule is capable of providing SIEM/SOAR services with native Cortex XDR and Panorama integration at the level of quality required. Approval authority verified against the 633 CONS local delegation matrix dated 02 Jan 2026.
/s/ Capt Sarah M. Okonkwo, Contracting Officer, 633 CONS/LGCB, 20 Feb 2026
GSAM 538.7104-3 — Sole Source Justifications
The operative text for agencies using the RFO/agency-deviation framework. It includes the above-SAT exceptions, the above-MPT/below-SAT written-determination standard, publication rules, and screening requirements.
Open GSAM 538.71GSAM 538.71 — Full FSS Ordering Procedures
The full GSAM subpart used by the RFO model and agency-adopted deviations. It includes MPT, above-MPT/below-SAT, and above-SAT ordering procedures, plus BPAs, OLMs, brand-name rules, and disputes.
Open GSAM 538.71RFO Part 8 Deviation Guide
The official deviation guide explaining what changed in FAR Part 8 under the Revolutionary FAR Overhaul and where the procedures moved. Cross-reference this before citing pre-RFO FAR Part 8 sections.
Open Part 8 Deviation GuideGSA eBuy
The online Request for Quote (RFQ) tool for GSA Schedule orders. Where you post schedule solicitations.
Visit GSA eBuy