24-SIMACQ-PHD-BD3-0077_SoleSource_MS Signed Redacted_06112024.pdf

DEPARTMENT OF THE NAVY

NAVAL INFORMATION WARFARE CENTER PACIFIC

53560 HULL STREET

SAN DIEGO, CALIFORNIA 92152-5001

IN REPLY REFER TO:

NIWC PACIFIC

LSJ No. 21-0031 Originators Code: 55325

LIMITED SOURCE JUSTIFICATION

FOR MICROSOFT PRODUCTS

1. Agency and Contracting Activity.

Department of the Navy (DON), Naval Information Warfare Center Pacific (NIWC PAC)

2. Description of the Action Being Approved.

This acquisition is conducted under the authority of the Multiple Award Schedule Program under Title III of the Federal Property and Administrative Services Act of 1949. Microsoft (MS) products are required by the DON and the greater Department of Defense (DoD) to support warfighting operations and missions, protect against network vulnerabilities, ensure compatibility across network systems, and reduce costs.

This justification is to seek approval for the use of limited sources in accordance with Federal Acquisition Regulation (FAR) 8.405-6, Limited Sources, and to award a single-award Blanket Purchase Agreement (BPA) in accordance with FAR 8.405-3, BPAs, which are combined into a single document in accordance with FAR Part 8.405-3(a)(3)(iii). The proposed action is to use limited sources to procure MS perpetual and subscription software licenses for on-premises and cloud environments, software maintenance (hereafter called Software Assurance (SA)), and fit-for-purpose consumption of MS Azure. This action will reduce the administrative efforts across the DoD by eliminating the need to develop separate Limited Sources Justifications (LSJs). All BPA calls, delivery, task and purchase card orders will be issued against the Agreement in a decentralized manner by warranted Contracting Officers and purchase card holders across the DoD. Ordering authority under this Limited Source Justification (LSJ) will expire on 31 May 2026.

The continued acquisition of SA will provide sustained support for all existing perpetual licenses and will comply with the DON CIO memo1, which requires the DON to procure SA for all DON-owned software in compliance with SECNAV Instruction2. Continued SA will provide for immediate availability of version upgrades that will help to mitigate any security liabilities that

1 DON Chief Information Officer (CIO) memorandum dated 8 June 2012, Subj: “Microsoft Software Assurance for Microsoft Products”.

2 Secretary of the Navy Instruction (SECNAVINST) 5230.15 dated 10 April 2009, Subj: “Information Management IT Policy for Fielding of Commercial Off-the-Shelf (COTS) Software”.

Naval Information Warfare Center Pacific #21-0031 Source Selection Sensitive – See FAR 2.101 and 3.104 result from cyber security or compatibility concerns or from installed software that is approaching expiration or end-of-life3. Additionally, SA provides for extended mainstream support that allows for continued use of product versions well beyond what commercial support provides until the DoD has approved the use of new versions on networks. The SA correspondingly provides end-users with deployment planning, virtualization rights, mobility options, unlimited web support, training, and a home use program. It is included in the purchase price of new products as a standard commercial practice in enterprise agreements and cannot be separated from the licenses.

The new effort also supports both DoD and Navy directives and policies. The CETA will further support follow-on requirements to N66001-18-A-0006, which is a single-award BPA awarded to Insight Public Sector (IPS) Corporation via competition among MS Licensing Solution Providers (LSP) (i.e., resellers). Resellers were awarded with DoD Enterprise Software Initiative (ESI) agreements under the General Services Administration (GSA) Federal Supply Schedule (FSS) in accordance with Defense Federal Acquisition Regulation Supplement (DFARS) 208.74, Enterprise Agreements. Moving forward, the DoD EA for Commercial Software Product Management of CETAs4, the newest DON Cloud Policy5, and the “Navy Cloud First” policy6, all underscore the challenge by the Secretary of Defense to consider the DON’s holistic approach to IT initiatives and to consolidate efforts where it makes sense.

Furthermore, this acquisition continues to support other DON policies such as the Under Secretary of the Navy (UNSECNAV) memorandum (dated 3 Dec 2010) Subj: “DON Information Technology (IT)/Cyberspace Efficiency Initiatives and Realignment” and the Joint Assistant Secretary of the Navy Research, Development and Acquisition (ASN RDA)/ Assistant Secretary of the Navy, Financial Management and Comptroller (ASN FMC)/DON CIO memorandum, “Mandatory Use of Department of the Navy Enterprise Licensing Agreements” dated 22 Feb 2012 which drive the DON to consolidate and centralize commonly purchased information management products and services. This also will reduce contract duplication among DoD Components with MS requirements.

A single-award BPA will continue to provide MS licenses (for desktops and servers), SA, and subscriptions to meet the needs of the Naval Enterprise Networks (NEN), the Marine Corps Enterprise Network (MCEN), and many other program, tactical, or command-established networks and stand-alone systems across the DON. The DON is poised to anchor the acquisition of the new Agreement to support Navy’s continued SA on all assets when the current DON ESL Agreement expires on 31 May 2021. Using this effort to establish a baseline for all of DoD enables the other Components to leverage the lowest defensible price already established and join the agreement as it evolves into an all-inclusive CETA. Additionally, the action will also

3 See the DoD CIO Memorandum of 14 May 2020, Subj: “Department of Defense Software Lifecycle Maintenance”.

4 DoD Directive 8470.01E dated 6 September 2018, Subj: “DoD Executive Agent (DoD EA) for Commercial Software Product Management of Core Enterprise Technology Agreements (CETAs)”.

5 DON CIO Memorandum of 7 December 2020, Subj: “Department of Navy Cloud Policy”.

6 DON OPNAV Memorandum of 1 February 2017, Subj: “Navy Cloud First Policy”.

Naval Information Warfare Center Pacific #21-0031

Naval Information Warfare Center Pacific #21-0031 assist the DoD in further reducing the Total Ownership Cost (TOC) for all components and organizations that have MS requirements7.

3. Description of Supplies/Services.

MS products are required by the DON and the greater DoD to support warfighting operations and missions, protect against network vulnerabilities, ensure compatibility across network systems, and reduce costs. Currently, the DON ESL and the Joint Enterprise License Agreement (JELA) representing Army, Air Force, Defense Information Systems Agency (DISA) and the Fourth Estate have supported roughly 75% of the DoD’s MS requirements. The other 25% are made up of much smaller agreements supporting other DoD customers like the Defense Health Agency (DHA), Combatant Commands (COCOMS), and organizations supporting foreign military sales. The proposed contract action provides a means to continue the transition of Navy and USMC users to MS Office 365 (O365). This action will also continue to support the DON’s, and eventually the DoD’s, existing investment in perpetual desktop and server licenses that are already owned. This ensures no duplication in costs when transitioning to O365. It also enables existing workloads in Azure to continue operating when the current Agreement expires and, to a larger extent, also meet DoD fit-for-purpose cloud requirements. The Joint Enterprise Defense Infrastructure (JEDI) was awarded in Q1FY20 which will be an additional path to cloud computing services and workloads and will serve as the default option for general purpose cloud computing across the DoD. Although MS is the awardee of the JEDI contract, as of the approval of this document, the award is still under injunction. Given these external challenges, the CETA will be needed to fill ongoing stakeholder requirements.

At the DoD level, this requirement will form the CETA, which will complement the Defense Enterprise Office Solution (DEOS) Agreement by including on-premises product offerings (e.g.

Windows Server, SQL Server, System Center) and fill any capability gaps not offered under the DEOS acquisition vehicle. The DON intends to continue supporting all existing perpetual licenses utilized by the current Next Generation Enterprise Network (NGEN) and MCEN as well as other DON-owned networks. In terms of JELA III, it is the expectation that JELA III customers would onboard to the CETA at the expiration of JELA III in October 2022. The CETA will be able to provide a smooth transition for JELA III customers’ with sustained acquisition of SA and ongoing support for all existing perpetual licenses without duplicating costs.

In addition to SA, the CETA for MS will continue to provide a catalog of product offerings that meet the requirements of DON customers and stakeholders, and also the greater DoD8. The DoD utilizes MS software in the majority of its IT hardware, (e.g., servers, desktops, laptops, and other end-user devices) and the CETA will maintain offerings that support the DoD’s IT infrastructure. Software offered through the CETA will meet the Government’s functional

7 United States Navy Business Case Analysis (BCA) for Microsoft Office O365 for Navy Marine Corps Intranet (NMCI) Non- Secure IP Router Network (NIPRNet) Users.

8 DoD CIO Memorandum of 14 May 2020, Subj: “Department of Defense Software Lifecycle Maintenance”.

requirements and capabilities of both on-premises and off-premises environments as listed in

Table 1 below.

Table 1 - Software Functional Capabilities

Functional Category Capability

Includes financial, auditing, contracting, and customer service software Business Solutions compatible with Windows OS (examples include: Dynamics Customer

Relationship Management [ CRM])

Client Access Licenses Gives users the right to access the services of a server (examples include: User or

( CALs) or Bridge CALs Device CALs for Accessing a Windows, Exchange, Skype, SharePoint or System Center Server)

Developer Tools Assists programmers and administrators in customizing software options to meet requirements (examples include: Visual Studio)

Management Tools Provides configuration management, metrics, and asset tracking (examples include: System Center Configuration Management)

Office Email, word processing, spreadsheets, presentation program, database, note

Applications/Collaborative taking, desktop publishing, Voice Over Intemet Protocol (VOIP), Skype for Business, Sharepoint, Teams, messaging (chat) (examples include: Office

Tools Professional Plus or 0365)

Operating Systems (OS) Controls and directs computer operations and programs ( examples include, but are not limited to: Windows 10 Enterprise Secure Host Baseline)

Server Software , Desktop Provides netv.rork access to collllllon and specialty applications and back-up suppo1t (examples include: Windows, Exchange, SQL, Vi1tual Desktop

Sharing, Viitualization Infrastructw-e [VDI])

SA

Maintenance, version upgrades, extended suppo1t, training, transfers, and helpdesk

Security, firewalls, data restoration, and back-up ( examples include, but are not Utility limited to: System Center, Secure Productive Ente1prise (SPE), Forefront.

Identity Protection)

Mobility Software licenses that can be used across multiple devices ( examples include the Ente1prise Mobility Suite)

The CETA software offerings will meet stakeholders' trending requirements, such as the growth in the number of MS Core Bundles. An estimated 683,186 DON computers include a standard desktop suite of MS software that includes a Windows 10 Ente1prise Upgrade version of the OS, Office Professional Plus, and Core or Ente1prise CALs. These components are commonly bundled and known as "Microsoft Enhanced" or "Microsoft Ente1prise" Desktop Bundles. Over

344,000 of the cm-rent 683,186 computers are upgraded to the ente1prise version of the desktop

CAL bundle, which provides access to ente1prise versions of the respective se1ver software. In this situation, the CETA can offer flexibility and best pricing in providing product offerings to meet evolving stakeholder requirements.

In the first DON ESL Agreement ("DON ESL I"), the DON licensed MS software using a device-based model which included the aforementioned desktop bundles. As MS started to move

Naval Info1mation Warfare Center Pacific #21-0031

Source Selection Sensitive- See FAR 2.101 and 3.104 away from device-based licensing to user-based licensing, the desktop bundles were split into components which were more costly and, as a result, the DON, along with the greater DoD, decided to transition to user-based licensing as well. MS’s move toward user-based licensing is part of a larger industry migration away from licensing by device. The logic behind this industry trend is that it is easier to count people than devices. In the follow-on Agreement ( “DON ESL II”) device-based CALs that were once part of the bundle were switched to user-based licenses to cover the over 750,000 DON military, civilian, and contractor employees who access database, email, and SharePoint servers across the DON through multiple devices (including laptops, tablets, and mobile phones). This decision helped ease the transition effort of the DON to O365.

In this current Agreement (“DON ESL III”) the DON transitioned its Office desktop to O365 while still maintaining SA on the licensing on-premises. The proposed CETA will continue to advance the transition of the rest of the DoD population to O365 while maintaining the flexibility for on-premises Office and Windows installed on disconnected and OCONUS networks based on mission requirements. This overall strategy secures licensing at pre-set prices for the period of performance from 1 June 2021 through 31 May 2026

The estimated value of this acquisition is $3.4B (including all option years). Table 2 provides DON funding estimates for its requirements over the next five years; this data was obtained from the requirements validation tasker distributed by N2N6 in June 2020. The delta between the overall estimated value and what has been identified in the funding table are DoD requirements acquired from DoD ESI sales data for the past two years (which includes JELA III and other DoD needs). When projected over a three-year period (FY23 – FY 25), these additional JELA III and DoD requirements amount to $1.8B.

Table 2 DON Funding Estimates

APPN Total FY21 FY22 FY23 FY24 FY25

OMN

OMNMC

Total

The types of Navy and DoD funding used will primarily be Operations & Maintenance (O&M).

However, Procurement (PROC), Shipbuilding and Conversion, Navy (SCN), or Research, Development, Test & Evaluation (RDT&E) may be used when applicable; along with non-appropriated dollars such as Working Capital (WC). The decentralized funding and ordering approach under this acquisition means only Navy and USMC funding has been identified.

4. Identification of Justification Rationale.

The authority for the use of limited sources is FAR Part 8.405-6(b), “Items peculiar to one manufacturer.” The rationale for selecting this authority is that the use of MS products in the DoD infrastructure is so pervasive that implementing any alternative would negatively impact

Naval Information Warfare Center Pacific #21-0031 Source Selection Sensitive – See FAR 2.101 and 3.104

(b)(4) the mission of the DoD. MS software is an integral part of the DoD IT infrastructure whereby the DoD’s military, civilian, and contractor personnel who perform IT and business functions utilize these products, tools, and capabilities to execute their missions. As a result, Microsoft is essential to the Government’s requirements.

Market research has demonstrated in several acquisitions that other companies’ with similar products either lack a particular feature(s) or do not meet or cannot be modified to meet, the DoD’s needs. For example, the DoD has made a substantial investment in Microsoft Products, namely Microsoft O365. Part of the latest cybersecurity baseline for the DoD is Azure Active Directory Premium Plan 2 (AADP2), which is a MS only product. In addition, the DoD’s (currently the DON) requirement to enable Flow 3 (automated flow capabilities in Microsoft Office O365) as well as its security initiative for Zero Trust rely heavily on Microsoft Defender Advanced Threat Protector, Office 365 Advanced Threat Protection, and InTune. As of this writing, there are no other DoD or DON approved application(s) that can meet these requirements.

Market research was also conducted by the DOD against other companies’ cloud capabilities.

The outcome of this research led to the release of the DOD CIO Memo – “Federated Implementation of Office Collaboration Capabilities for the Department of Defense” This memo states that the DoD leaders have adopted a federated approach to execute migration to Microsoft Office 365. To support this federated approach and mitigate security risks the memo speaks to the requirement of establishing and maintain at minimum a DoD M365 IL5 tenant.

Cloud service requirements would not be met as efficiently with alternative products other than MS. According to the DOD Cloud Authorization Services Catalog, Cloud Service Providers such as Amazon Web Services provide Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) for ILs 4-6; however, AWS is not approved to deliver Software as a Service (SaaS). While AWS and other similar cloud services such as Google G-Suite are compatible with the cyber security baseline for Azure Active Directory Premium Plan 2 (AADP2), those products have not been granted PA above IL2.

This acquisition must be conducted on a brand name basis in order to eliminate a disruption in DoD operations and to avoid a substantial duplication of costs that could not reasonably be recovered through a competition at this time based on salient characteristics. Since MS is the sole owner of its Intellectual Property (IP) inclusive of its software source code, MS is the only one who can provide SA on its perpetual software licenses and subscriptions to its online offerings (i.e. the cloud). It is not anticipated that NIWC PAC will take any action to remove the requirement for establishing future agreements for MS on a brand name basis.

In addition to the aforementioned DON policies, this brand name acquisition will support the Government’s requirement to meet DoD policies and directives such as:

• DoD CIO memorandum, "Supplemental Guidance to the Federated Implementation of Office Collaboration Capabilities for the Department of Defense," 25 November 2020 and “Federated Implementation of Office Collaboration Capabilities for the Department of Defense,” 25 September 2020 which establishes the goal of interoperability with DoD entities in the IL5 environment and mandates the minimum mandatory cybersecurity baseline tools that these entities must procure which are MS Azure Active Directory Premium 2, Azure Sentinel and Lighthouse.

• DoD CIO Memorandum, "Interim Guidance for Implementation of the Department of Defense Cloud Strategy," 16 April 2020 which enables DoD components to continue “accelerating digital modernization efforts” and “cloud adoption in alignment with the DoD Cloud Strategy”, while acknowledging the delays with DEOS and JEDI.

• DoD CIO memorandums, "Authorized Telework Capabilities and Guidance," 13 April 2020 and " COVID-19 Response: Remote Work Capability," 19 March 2020 supported the establishment of the Commercial Virtual Remote (CVR) environment in response to COVID-19 by utilizing an already contracted for capability MS O365 Teams. Since the issuance of these memos, the need for this required capability across the DoD has been extended to June 2021.

• DoD mandate for all systems running Windows to run DISA’s Secure Host Baseline (SHB) version of Windows 10 OS as directed by the Deputy Secretary of Defense (DEPSECDEF) in a memorandum dated 26 February 2016, Subj: “Implementation of Microsoft Windows 10 Secure Host Baseline.”

• DoD CIO’s 2011 Unified Capabilities Master Plan which implements DoD Instruction (DoDI) 8100.04, DoD Unified Capabilities; this mandates that beginning in FY14, DoD Components shall be responsible for ensuring compliance with the operational framework contained therein. This plan highlights requirements for the unified capabilities vision to include (but not be limited to) collaboration, user mobility, and unified messaging. MS products and O365 provide proven secure interoperability between the Services and with other Federal Agencies and work in conjunction to meet these requirements.

• DoD Cloud Computing Security Requirements Guide (CC SRG) published by DISA, details the requirements for cloud systems hosting data categorized as Impact Level (IL) 4, 5 and 6 which any office productivity suite hosted in the cloud would be required to meet. O365 is the only cloud hosted office productivity suite that meets this requirement.

Additional Federal Risk and Authorization Management Program (FedRAMP), DoD Provisional Authorization (PA), and CC SRG information can be accessed at the following DISA link: https://public.cyber.mil/dccs/

This limited source justification is also seeking approval to competitively issue a single-award BPA to a MS LSP that has a GSA FSS contract in accordance with FAR Part 8.405-3(a)(3)(ii) and (iv). The DON will be moving from a Navy centric single-award BPA (DON ESL III) to a much broader single-award Agreement encompassing all of DoD . The intent is to consolidate the multiple EA’s across the DoD (JELA, DHA, COCOMS, etc.) into one CETA that will offer lowest defensible pricing, favorable licensing terms and conditions, and meet DoD mandated requirements. This single-award BPA will be established using the competitive procedures outlined in FAR 8.405-3(b) and will only provide for firm-fixed price orders for products with unit prices established in the BPA.

A single award BPA is necessary to obtain the best possible price from MS through its LSP.

Through years of discussion and negotiation with MS for the previous three Navy ESLs, MS has made clear that the best prices, and licensing terms and conditions will be offered when a customer establishes an EA which consolidates requirements, streamlines administration, and utilizes MS products across its EA. Market research has supported that DON ESL EAs have obtained more favorable pricing, and licensing terms and conditions than other DoD agreements.

An EA can only be obtained with one MS LSP; this has been the case for both DoD EAs and in the commercial sector. A single award BPA is necessary to leverage all DoD requirements in one EA to achieve the best pricing and licensing terms possible. The anticipated unit price reductions and other concessions are due to economies of scale and streamlined purchasing processes that yield reductions in administrative costs to MS and its LSP.

On the DoD side, the management of software licenses under one Agreement will continue to improve oversight, requirements tracking, and budget validation. These enhancements will also reduce unnecessary license purchases and result in added cost avoidance.

5. Determination of Best Value.

This single-award BPA will be established using the competitive procedures outlined in FAR 8.405-3(b). Best value will be determined on the basis of low price and whether the quote is in compliance with the BPA Ts&Cs per FAR 8.405-3(a)(2). This award will be in compliance with Defense Procurement Acquisition Policy (DPAP) Class Deviation-2014-O0011, entitled “Determination of Fair and Reasonable Prices When Using Federal Supply Schedule Contracts.”9

Subsequently, and at least on an annual basis, a determination will be conducted in accordance with FAR Part 8.405-3(e) to determine whether the BPA still represents best value and whether more price reductions can be negotiated if estimated quantities have been exceeded. Based on the information provided herein, the Contracting Officer has determined that the proposed action is in the best interest of the Government and will allow the BPA to be established on the basis of best value consistent with the principles described in FAR 8.404(d).

6. Description of Market Research Conducted.

In accordance with DFARS 208.7402, departments and agencies shall fulfill requirements for commercial software and related services, such as software maintenance, through DoD ESI Agreements. (see website at: https://www.esi.mil/). The DoD ESI also promotes the use of Enterprise License Agreements (ELAs) that allow DoD organizations to obtain favorable terms

9 The Defense Procurement Acquisition Policy (DPAP) Class Deviation-2014-O0011, entitled “Determination of Fair and Reasonable Prices When Using Federal Supply Schedule Contracts,”.

and pricing for commercial software and related services. Almost all the DoD ESI Agreements are BPAs awarded against the FSS, and by utilizing the buying power of the DoD, these Agreements have secured discounts below the GSA Schedule.

MS sells its software through GSA resellers, but only offers EAs through their six LSPs. These LSPs are Dell, Insight Public Sector, CDWG, Minburn Technology Group, SHI International Corporation, and Connection Public Sector Solutions (formerly known as GovConnection). Per the GSA e-Library website, at: http://www.gsaelibrary.gsa.gov/ElibMain/ home.do, each of these firms has a current FSS Contract. Only one of the LSPs is a small business; therefore, no opportunities exist to set the requirement aside for small businesses.

Based on this research, it is determined that there is a reasonable expectation of competition from at least three vendors per FAR 8.405-3(b)(1)(ii)(B)(2). Besides, this requirement will be solicited via the GSA e-Buy tool in accordance with FAR 8.405-3(b)(1)(ii)(B)(1) to “…afford all schedule contractors offering the required supplies or services under the appropriate multiple award schedule(s) an opportunity to submit a quote.”

7. Other Facts Supporting the Justification.

As stated in Section 2, the CETA will support MS products and obligatory SA installed on all desktops and associated servers in use throughout the DON and DoD, including major DON networks under NEN and the MCEN. Included in Table 2 (Section 3, above) were the estimated projections for how the CETA will sustain acquisition of SA for the DISA JELA III customers whose existing BPA expiration is in October 2022. Allowing a lapse in SA would require the various DoD Agencies to repurchase licenses to reinstate SA and remain compliant. Specifically, the DEPSECDEF requirement of 26 February 2016 for U.S. Cyber Command mandates deployment of MS Windows 10 SHB (which requires SA on the operating system (OS)) across the enterprise to strengthen the cyber security posture.

Beyond mitigating duplication of costs to the DoD, the DEPSECDEF requirement forms the baseline for MS software compatibility on servers and client devices across the network and its related systems (e.g., the use of Outlook for email and for SharePoint portals that are in extensive use throughout the DoD). The technical implications of transitioning to alternate OSs and associated applications at this time would contradict DoD direction and create potential cyber security concerns, many of which have already been tested and approved using MS platforms through the Certification and Accreditation (C&A) process. From a C&A perspective, it is important to note that DoD Components have identified different MS products and versions on their own component core software builds. For example, Army identified 11 MS products on their core build, whereas both PMW-205 and the Marine Corps have identified 24 different MS products and versions on their Core Software build list for deployment on NGEN desktop or laptop devices throughout the DON.

8. Actions to Remove Barriers to Future Competition.

Naval Information Warfare Center Pacific #21-0031

The DoD is always evaluating new technologies that are more advantageous in terms of cost, product offerings, and security, but the DoD has not yet found a competitor to MS that warrants a transition. Case-in-point is the DEOS BPA, awarded in October 2020. The DEOS solicited the DoD requirements using functional capabilities from MS and MS competitors by issuing a brand agnostic solicitation for any technology solution. MS was the selected technology.

(b)(6)