Justification for Other Than Full Open Competition- STRATUS Oracle- posted.pdf

Justification for Other than Full and Open Competition STRATUS Pool 1: Oracle United States Department of Agriculture

United States Department of Agriculture Justification for Other than Full and Open Competition

Federal Acquisition Regulation (FAR) Part 6.3 Control No. (if applicable) N/A

1. Identification of the agency and the contracting activity.

Agency is the U.S. Department of Agriculture (USDA), Office of Assistant Chief Information Officer (ACIO), Digital Infrastructure Services Center (DISC)

Contracting activity is USDA, Department Administration (DA), Office of Contracting and Procurement (OCP), Procurement Operations Division (POD)

2. The nature and/or description of the action being approved.

Basic Ordering Agreement IAW FAR 16.703. Multiple BOA awards issued across 3 pools. Competitive task orders will be issued within pools. Three pools are:

Pool 1: Direct hyperscale Cloud Service Providers (CSP): provide cloud provisioning services.

Pool 2: Integration and Development: provide technical expertise, labor, application development, integration, cloud strategy, etc.

Pool 3: SaaS Providers: provide commercial products and services, e.g., Salesforce, ServiceNow

This justification only focuses on Pool 1 first direct Task Order award issued to Oracle. Orders issued against this BOA will be Firm Fixed Price. This justification is only applicable to Pool 1 and will not impact Pools 2 & 3.

As negotiations with the CSPs at the BOA award level have been ongoing, it has become clear to the Stratus team, both DISC and POD, that a longer Period of Performance (POP) on the initial task order would be more advantageous to the Government. The adjusted POP will enable us to have the flexibility to accommodate the projected growth of Pool 1(Caused by increasing cloud adoption), allow us to have better negotiating leverage with the CSPs, and importantly will allow for the use of innovative products from the CSPs.

Due to the nature of the FCHS to Stratus transition, it is unlikely these products will be in effect on day 1 but will likely be set up in option years. A longer task order POP will allow for minimal disruption to DISC and Mission Areas as they manage heavy expected growth and optimize operations under Stratus.

Due to the nature of these products and the novelty of the Stratus program, it would be significantly more advantageous if the initial implementations could be on a single task order rather than spread across multiple task orders. This will reduce friction in the learning process and help DISC and POD optimize the use of various task order structures, and strategies.

3. A description of the supplies or services required to meet the agency’s needs (including the estimated dollar value).

The USDA IT environment is decentralized with a federated governance model. The department-level central Office of the Chief Information Officer (OCIO) operates the DISC as well as enterprise-wide networking, cybersecurity, and customer support services. USDA has eight Mission Areas (MAs) each with its own Assistant CIO. Each MA has multiple agencies each with varying degree of IT organizational hierarchy.

DISC provides cloud brokerage services to the USDA MAs as a consolidated point of entry, established as a mandate under USDA Departmental Regulation DR-3650-001 Cloud Computing, for hyperscale Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) procurements through the Cloud Brokerage Office (CBO). While the current DISC/CBO model has allowed for flexibility in cloud adoption, there are drawbacks. The model effectively allows each MA to have a direct line to various contracts. Silos have been raised between the various customer cloud and service implementations, causing a lack of visibility and negated scalability, metric collection, and lack of a cohesive enterprise architecture approach.

The USDA is maturing from early phases of cloud brokerage into a true cloud solutions organization that enables DISC to offer well curated managed services that are properly secured, promote reusability, and significantly increase speed to market for customers. In support of this new complex solutions capability, DISC is leveraging industry best practices to create a set of new operating models, processes, and a roadmap for the growth of both CBO and the USDA AgCloud to meet the ever-increasing demands of USDA MAs, external federal agency customers, and create a true USDA Digital Enterprise.

The complexity of the USDA cloud environment and operating models requires DISC to create highly flexible and scalable ways that Cloud Service Provider (CSP) services are acquired. Core CSP services include Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and technical support directly related to the core CSP services.

USDA requires access to CSP commercial services to achieve its organizational and IT strategic goals. CSP solutions must have a mechanism for activating and/or deactivating any cloud service offering for USDA.

There must be a mechanism to provision cloud services based on standardized, templated configurations and security policies, as well as user-friendly mechanisms to deprovision any and/or all services. The solution must also provide object and resource access control management, including data and resource tagging for billing tracking, access control, and technical policy management.

The solution must provide universally available, resilient cloud services that are reliable, durable, and can continue to operate despite failure of portions of the infrastructure. The infrastructure must be capable of supporting dispersed users at varied security levels.

The solution must offer efficient self-service of cloud services enabling rapid development and deployment of new applications and advanced capabilities. Additionally, the solution must support the portability of data and applications both out of and into their solution. USDA must retain ownership of its data at all times.

Advanced data analytics services are required that securely enable data-driven and timely decision making both within a single data domain and across data domains. Advanced data analytics capabilities must support batch and streaming analytics; predictive analytics; machine learning; and Artificial Intelligence (AI). Advanced data analytics must be available at all security levels, including disparate and disconnected environments operating on multiple datasets. These capabilities must, at a minimum, be able to import and export streaming and batch data in common data formats.

DISC customers require cloud computing available at all classifications and impact levels (IL). To achieve this, and provide the necessary level of scalability, security oversight, and centralized management; the CSP must have direct full control and unmitigated access to their environment (virtual and physical infrastructure) and the ability to act upon security requirements and/or incidents in a prompt manner.

Infrastructure and networks supporting classified services must be physically separate from the infrastructure and networks supporting unclassified services. Secure and highly deterministic one-way data transfer capability is required between logical enclaves and tenants within the cloud offering, to external destinations, including multi-tenant peering gateways, and across classification levels, while limiting any additional threats. Unclassified and classified (both Secret and Top Secret) data centers may be co-located so long as the classified data center meets the DD Form 254 requirements.

The solution must provide security capabilities that enable enhanced cyber defenses for strong identity access management and security from the application layer through the data layer. Fortified security capability requirements include continuous monitoring and auditing, automated threat identification, resilience and elasticity, encryption at rest and in transit, secure data transfer capabilities, and an operating environment that meets or exceeds information security requirements.

4. Identify the exception to competition.

41 U.S.C. 3304(a)(1), as implemented by FAR 6.302-1, titled "Only one responsible source and no other supplies or services will satisfy agency requirements."

5. Rationale or circumstances for limiting competition.

The USDA intends to issue a department-wide Basic Ordering Agreement (BOA), formally known as USDA STRATUS, to Oracle America, Inc. for Oracle Cloud Infrastructure (OCI) as a uniquely qualified hyperscale CSP. The enterprise cloud market is an innovative and rapidly growing industry segment. A Hyperscale CSP is directly targeted as they are exclusively capable of meeting USDA’s requirements described below. For the purpose of this requirement, Hyperscale indicates capacity to provide significant breadth, availability, resilience, and ability to scale to meet the requirements described below.

This justification specifically addresses the intent to award a BOA Task Order without full and open competition to Oracle America, Inc. to obtain rapid direct access to hyperscale CSP services and capabilities. The supporting justification demonstrates the need to contract directly with a CSP as opposed to a reseller, as well as the need to contract specifically with OCI.

Per USDA Departmental Regulation DR-3650-001 Cloud Computing, the ACIO DISC serves as the Department Cloud Broker, as described in NIST SP 500-291, Version 2, NIST Cloud Computing Standards Roadmap (Cloud Broker is an entity that manages the use, performance and delivery of cloud services, and negotiates relationships between cloud providers and cloud consumers). The ACIO DISC must also partner with Mission Areas, agencies, and staff offices to ensure the effective and efficient use of cloud services.

To support this role and comply with USDA policy, DISC requires a direct relationship with OCI for the following primary reasons.

Specific Technical Capabilities

USDA has a new but critical pilot program on OCI cloud that is likely to grow significantly. This pilot and the anticipated future growth is based on the unique nature of the OCI services. OCI offers all the layers of IaaS, PaaS and SaaS, however, OCI is the only vendor able to offer a complete technology stack in which all layers are optimized and designed to work together as a single system, i.e., integrated cloud applications and platform services for workloads that traditionally run on on-premises Oracle database systems and other suites of Oracle applications. Oracle entered the public cloud market by offering their market leading Oracle database as a SaaS and evolved this service to include integration across all 3 layers for hybrid (private and public) cloud environments like the one USDA operates. OCI includes tooling and automation specifically for Oracle applications, which are ingrained in many USDA programs, that automates application migration, creates instances much faster than manual efforts, and improves lifecycle management. For workloads that are Oracle database centric but also need IaaS and PaaS capacities to run related third party or homegrown applications, OCI is the only unique solution that provides the needed functionality with built-in security and at high performance. OCI’s unique Exadata Cloud service enables DISC to match different performance, security, and service-level agreements (SLAs) required by the MAs.

The CSP market generally separates into two categories. One is a small set of providers referred to as “hyperscalers” which includes OCI. The other category is CSPs with a significantly smaller scale of infrastructure, operations and services. The hyperscalers offer IaaS, PaaS, Software-as-a-Service (SaaS) and a wide range of provisioning, security, consumption, and billing models. The most similarity is in IaaS services which sit at the bottom of the service “stack” in terms of complexity and dependency on other services. Going up the stack into PaaS, and especially SaaS, the differentiation between the hyperscalers becomes significant and each offer unique models for provisioning, consumption, and billing.

USDA currently utilizes services from all hyperscalers. Migrating applications and development projects between them will not be possible in the intermediate term and as the department targets to migrate from legacy contracts to STRATUS. Some new future projects within a Mission Area may continue to use their current CSP because of the expertise and ease of integration.

Based on these considerations and extensive market research, the Government has determined that Oracle America, Inc. is the only source responsible and capable of providing direct access and satisfying the Government’s requirements.

6. Other facts supporting the use of other than full and open competition.

Security Requirements

To be in compliance with OMB, NIST and USDA policies, such as OMB M-22-09 Moving the U.S.

Government Toward Zero Trust Cybersecurity Principles, USDA must maintain root account access control for its CSP user accounts. There is an unacceptable level of risk when USDA cannot directly and immediately implement security controls. For example, phishing resistant multi-factor authentication for root account access is required, however USDA has experienced difficulty enabling this functionality with CSP reseller accounts due to a lack of direct control over the cloud security environment. A recent GAO audit also provided recommendations for USDA to resolve such cloud security policies.

As stated in Section 1 above, DISC customers require cloud computing available at all classifications and impact levels (IL). To achieve this, and provide the necessary level of scalability, security oversight, and centralized management; the provider, Oracle, must have direct full control and unmitigated access to their environment (virtual and physical infrastructure) and the ability to act upon security requirements and/or incidents in a prompt manner.

DISC CBO must adequately manage security risks and response actions. Developing a direct relationship with OCI will reduce the threat of breaches or attacks significantly. A direct relationship is the only way to establish and maintain complete control over USDA CSP accounts and enables USDA-led use of cutting-edge technologies that impose security controls, use algorithms to audit and remediate issues, and can automate additional security features like cross-cloud single sign-on. This will ensure full control of the cloud environment (virtual and physical infrastructure) and USDA can act upon security requirements and/or incidents in a prompt manner.

Business Model Dynamic

The USDA organizational structure is inherently distributed across eight MAs and 29 agencies. The organizational structure, OCIO business model, and USDA cloud broker policy requirements result in the DISC serving as the de facto reseller of CSP services. It would be an inappropriate and wasteful use of Government resources and taxpayer funds to duplicate DISC’s role by contracting with additional Oracle resellers.

In addition to DISC serving as the broker for all cloud services within USDA per DR-3650-001 described above, it also serves as an Manage Service Provider (MSP) for cloud, hosting, and software development services to customers. While a few DISC customers are only using DISC’s public cloud services, many are using a combination of DISC’s data center hosting, private cloud, and public cloud services. DISC can only manage this highly complex environment efficiently and securely if the management and operational systems it uses are uniform and consistent across these multiple domains of infrastructure, some owned by itself and some owned by OCI.

To fulfill its MSP role in design, implementation, and operation of public cloud services, DISC needs to have direct access to all relevant CSP tools, dashboards and operational support services OCI provides to their resellers because for all practical purposes DISC is reselling hyperscale CSP services to its customers often as part of a broader complex solution. In particular, DISC needs direct access to tools and dashboards for pricing, ordering, and invoicing. Only through this direct access and full transparency can DISC provide consistent and accurate cost estimates and invoicing for complex solutions involving both public cloud and private cloud/hosting services. DISC also needs to have direct communications with OCI pre-sales engineering and solutioning resources, and direct access to technical support services throughout the delivery and ongoing support phases of its customer projects. Therefore, DISC needs to have direct privity of contract with OCI.

7. Description of the market research conducted and the results or a statement of the reason Market Research was not conducted.

Open Source and Government Source Research. The USDA performed open-source research of commercially available information published on the internet and vendor websites regarding their capabilities, ability to meet the Government's requirement, and compliance with federal regulations and/or commercial standards. Additionally, USDA met with two other Government organizations who had executed similar contracts with CSPs, which allowed for Government-to-Government communication with groups responsible for existing cloud contracts resulting in access to lessons learned, confirmation of vendor capabilities, understanding of issues encountered, access to contract strategies, and review of future plans.

Vendor Meetings. The Government conducted virtual one-on-one vendor meetings between January – April 2023 with those vendors that the Government was aware operate on the scale required to meet the requirements. Meeting discussions included CSP business model, reseller model, pricing and billing considerations, types of CSP services available, as well as technical qualifications such as availability, resiliency, and security controls.

Request for Information. An RFI was issued on April 16, 2023, to inform the public about the STRATUS requirement. Interested vendors were asked to submit capability statements by May 4, 2023, explaining how they are capable of meeting the USDA’s requirements, provided with the posting on www.sam.gov. The Government received 15 capability statements from 4 small business vendors and 11 large business vendors. NAICS code 518210 Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services was used to determine size status. These efforts provided the government with information for identifying contracting and subcontracting opportunities and helped inform the Government’s market research efforts.

A multi-functional team of experts representing technical and acquisition functions reviewed all received capability statements in order to assess each vendor’s capabilities to meet the Government’s requirements.

Results of Market Research. Vendor capabilities were assessed to determine if they could reasonably meet the Government's requirements as described in this justification. Four of the RFI responses were submitted by U.S.-based hyperscale CSPs. The majority of vendor responses were from MSPs or Value-Added Resellers (VARs). Market research demonstrated that only the direct hyperscale CSP, i.e., Oracle, is capable of meeting the requirements, as the required level of security, oversight, and centralized management necessitates direct contracting with a vendor that has full control of the environment. As a result of this market research and analysis, it was determined that no other vendor was capable of meeting the USDA’s requirements, as they did not have full control of the environment (virtual and physical infrastructure) that would allow them to act upon any security requirements and/or incidents in a prompt manner, nor could they provide the scale, elasticity, high availability, resiliency and direct access the USDA requires.

In addition, consideration was given to whether other brand name products (AWS, Microsoft, Google) could be modified or improved to meet the requirements. While market research has shown that there are no other viable sources currently, even with potential modifications, the cloud market evolves rapidly. To that end, the USDA is enabling an on-boarding mechanism to evaluate whether additional vendors can meet the requirements in future years.

8. Provide a statement of actions, if any, that can be taken to remove or overcome barriers to competition if subsequent acquisitions are anticipated.

The STRATUS pool 1 (Hyperscale CSPs) BOAs will enable task order competition. Each DISC customer requirement for CSP services will be competed amongst BOA holders, unless otherwise justified. No funds are obligated at the BOA level. Therefore, at the point of fund obligation, i.e., the task order level, competition will still be obtained.

The STRATUS BOAs will also have an onboarding mechanism. As part of the annual BOA review, the USDA will determine if additional vendors are capable of meeting the requirements and should be onboarded to STRATUS.

9. Recommended Source(s).

Oracle America, Inc.

10.Certifications & Approvals

Supporting data that form the basis for and included in this justification are certified accurate and complete.

Robert Boucher Chief, Cloud Broker Office

The information contained in this Justification for Other Than Full and Open Competition is certified accurate and complete to the best of my knowledge and belief.

Frederick Freeman Contracting Officer

ROBERT

BOUCHER 11:53:37 -06'00'

Frederick Freeman

Justification for Other than Full and Open Competition STRATUS Pool 1: Oracle

United States Department of Agriculture

Additional Reviews & Approvals

Signatures are required at each threshold up to the total estimated dollar value of the acquisition.

Advocate for competition for the procuring activity. I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief. Therefore, unless additional approvals are required as prescribed below, as advocate for competition for the procuring activity/ MASCO, I hereby approve this justification. If required, my approval constitutes clearance for submission to the Head of the Procuring Activity.

Richard Jiron Title: Chief of Procurement Operations Division Procuring Activity Advocate for Competition

Head of the Procuring Activity. I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief. Therefore, unless additional approvals are required as prescribed below, as Head of the Procuring Activity, I hereby approve this justification.

If required, my approval constitutes clearance for submission to the Senior Procurement Executive.

Hilary (Cole) Erickson Head of the Procuring Activity United States Department of Agriculture

Senior Procurement Executive of the Agency. I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief. Therefore, as the Senior Procurement Executive, I hereby approve this justification.

Donald W. Baker, Jr.

Senior Procurement Executive United States Department of Agriculture

RICHARD

JIRON

Digitally signed by

RICHARD JIRON

Date: 2024.05.10 08:16:46 -06'00'

HILARY

ERICKSON

Digitally signed by

HILARY ERICKSON

Date: 2024.05.29 18:47:19 -05'00'

DONALD

BAKER

Digitally signed by

DONALD BAKER

Date: 2024.05.29 16:30:15 -04'00'