JA24-112 CMRS DPMS Redacted.pdf

CUI

JUSTIFICATION & APPROVAL FOR FEDERAL ACQUISITION

REGULATION SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Contract Orders under Fair Opportunity

Federal Acquisition Regulation (FAR) 16.505, Defense FAR Supplement 216.505-70, Procedures, Guidance, and Information 216.505-70

Military Interdepartmental Purchase Request Numbers:

Joint Warfighting Cloud Capability (JWCC) Contract Number: HC105023D0003 Task Order Number: To Be Determined Procurement Title: Defense Information Systems Agency (DISA) ID31 Continuous Monitoring Risk Scoring (CMRS) / Digital Policy Management System (DPMS) Cloud Estimated Value:

Statutory and Regulatory Authority: 10 United States Code (U.S.C.) 2304c(b) and FAR 16.505(b)(2)(i)(B)

EXCEPTION TO FAIR OPPORTUNITY

Number: JA24-112

Upon the basis of the following justification, I, as the Procuring Activity Competition Advocate (PACA), hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C. 2304c(b) and Regulatory Authority of FAR 16.505(b)(2)(i)(B).

1. REQUESTING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

Defense Information Systems Agency (DISA) / DCSC Cyber Security and Analytics (ID) 6910 Cooper Avenue Fort Meade, MD 20755 United States of America

Contracting Activity:

DISA / Defense Information Technology Contracting Organization/PS85 2300 East Drive Scott Air Force Base, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

This action is to issue a firm-fixed-price task order (TO) against the JWCC Indefinite Delivery/Indefinite Quantity Contract for DISA ID31 CMRS/DPMS Cloud. This TO will be issued directly to Microsoft (MS) Corporation. The anticipated period of performance (PoP) is for a 1-year base period, plus three 1-year option periods. The total estimated value is which will be funded by Operations & Maintenance.

Controlled By: DISA Controlled By: DISA/EII/EC1 CUI Category: PROCURE Distribution/Dissemination Control: FEDCON

POC: disa.letterkenny.eiic.list.re-io-od-cor@mail.mil

JA24-112 DISA ID31 CMRS/DPMS Cloud

Page 2 of 6 Pages

3. DESCRIPTION OF SUPPLIES/SERVICES:

Establish an endpoint division subscription in the same cloud (MS) as the Department of Defense (DoD) primary sensor grid data repositories, which include MS Defender for Endpoint (MDE) and Intune. Provide initial capacity for deployment of the CMRS and DPMS infrastructure servers in infrastructure as a service (IaaS) as an initial capability with flexibility to transition to using SQL as a Service and transition applications to cloud hosting to eliminate IaaS cost and maintenance requirements. Both systems reside in DISA’s on-premise data centers (ECOSYSTEMS) that are in the process of being decommissioned and require Unclassified and Classified environment with alternate disaster recovery/Continuity of Operations (COOP) warm site. The environment should support Impact Levels (IL) 4, 5, and 6.

Additionally, the Program Management Office (PMO) requires migration from on-premise DISA Hosting and Compute to MS cloud environment and co-located with existing Secure Endpoint Data Repository (SEDR) (Synapse). Workload per each site (Primary, COOP) is composed of 15 Windows/SQL Server Virtual Machines (VMs) and 10 Red Hat Enterprise Linux (RHEL) VMs. These VMs require Unclassified and Classified environment with alternate disaster recovery/COOP site.

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity.

FAR 16.505(b)(2)(i)(B) - Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(b) Description of the Justification.

The Program Executive Office CYBER ID3 requires the migration of the DPMS Portfolio to MS. All the programs are built on .NET, utilize MS SQL and reside on MS IIS assets. The applications have a tight dependency on MS 365 data feeds. With multiple portfolio programs within ID3 built primarily on MS technology, MS compatibility with the existing infrastructure is required. Therefore, Microsoft is the only cloud service provider (CSP) that can perform the work.

Additionally, migration of the CMRS workload to MS is required due to new endpoint sensor requirements that are predicated on the current MS Gov Cloud environment.

CMRS is operationalizing SEDR in order to ingest MDE data.

(c) Justification.

(1) Minimum Government requirements.

Page 3 of 6 Pages

DPMS: The cloud service offerings (CSOs) must continue at their current level in order to support three Windows servers (2019) and one MS SQL server (2019). MS licensing for the assets is required. The minimum storage requirements for the Windows Server is 800 GB and 2300 GB is required for the SQL Server. There is a need for managed services to include vulnerability management, patching and general operation system maintenance. System Performance Monitoring infrastructure also required for administration purposes.

All requirements will utilize an IaaS solution for seamless transition. This will include 3 Windows VMs migrated from a VMware infrastructure (DC, IIS, and SQL).

CMRS/SEDR: The CSOs must continue at their current level in order to support 7 Web Servers (Windows Server 2019 based), 7 MS SQL Servers (2019) and 10 RHEL (VM breakdown is per each site: Primary and COOP). On-prem DISA Licensing for the assets is required. Managed services including vulnerability management, patching and general OS maintenance are also required to support the mission. System Performance Monitoring infrastructure is also required for administration purposes. ESS and ACAS monitoring is required as well. Microsoft Synapse is also a requirement for the Government to continue utilizing SEDR, which is its current need.

Disaster Recovery warm site is a requirement to support a mirrored production.

(2) Proposed sole source contractor. Microsoft Corporation

(3) Discussion regarding the cause of the sole source situation.

The DoD purchased MDE E5 licenses for the entire department to deploy and utilize to satisfy numerous missions to include vulnerability management, zero trust and comply to connect. As a result, DoD began to divest from current endpoint security solutions that overlapped with the new capability. Along with MDE, other Microsoft technologies are required in order to meet Master Endpoint Record requirements. Namely, MS Intune and the MS Endpoint Configuration Manager (MECM). MS was selected because of its compatibility with these technologies that will provide a seamless transition.

Additionally, the data that is collected will be published to a central repository known as Microsoft SEDR that will exist on the unclassified and classified sides requiring DoD Impact Levels 4-6. Other CSPs either cannot meet the requirements or do not have capabilities that integrate seamlessly given the required solutions set. To be able to continue using SEDR, which is built on Synapse, both programs must utilize Microsoft since Synapse is not available in any other environment as it is Microsoft “cloud native”.

The MS environment is the only provider that is postured of the solution set that will be deployed. Given the complexity of data normalization and de-duplication, MS support is required to meet the Government’s minimum needs .

Page 4 of 6 Pages

(4) Demonstration of unique source.

Given the data sets that will be reported to DISA will be the same, it’s required from a technical perspective to operate in the MS environment as those data sets being reported to SEDR. Only MS possesses the knowledge, skills, capabilities, certification, clearance, and experience required to continue the program without a break or degradation in critical mission services. Additionally, MS operates within all required Impact Levels to support the classified environment and is the only environment that can support Synapse which SEDR is built upon. Other CSPs either cannot meet the requirements or do not have capabilities that integrate seamlessly given the required solutions set. Given these critical mission requirements, MS is the only CSP that is capable of performing the necessary services for the DoD within the current required timeline.

(5) Procurement discussion.

Initial Operating Capability is required to be in place by Sep 30, 2024.

(6) Impact.

The Government is on the glide path to consolidate the CMRS and DPMS programs into the MS Cloud environments. Currently, both systems reside in DISA’s on-premise data centers (ECOSYSTEMS) that are in the process of being decommissioned. The Government completed the full Assessment & Authorization process for Microsoft based on SEDR which currently resides in a PEO-CYBER Tenant . Selecting another environment other than Microsoft will cause a significant delay in reaching Full Operational Capability. The other CSPs do not currently have anything similar to SEDR which is essential to meeting the Government’s current requirements. Additionally, the Government would incur major integration, schedule delays, and mission risk if a CSP other than MS was selected. If competition procedures were pursued for this effort, it would jeopardize the operation of the SEDR system which is key to collecting the various MS product data. All of these issues would impact the data reporting mission required by the DoD Chief Information Office.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION:

A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the independent government cost estimate and the JWCC Catalog pricing, including any discounts, which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

6. MARKET RESEARCH:

Market research for the basic JWCC Contracts was conducted and resulted in a signed market research report on 9 Nov 2021. After a survey of the market, it was concluded that the JWCC Contract is in the Government’s best interest due to technical feasibility and cost to the Government.

Page 6 of 6 Pages

JA24-112 CRMS DPMS

Additional research was conducted Jun 01, 2023 – Mar 05, 2024, by reviewing the specific capabilities in the JWCC Contracts and it was determined that MS Corporation is the only source capable of fulfilling the Government’s minimum needs in the manner and time frame required.

The PMO reviewed the information provided by all CSPs under the JWCC vehicle. The type of classifications that are currently supported were considered in the selection.

7. ANY OTHER SUPPORTING FACTS: None.

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS THAT LED

TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History: Not Applicable

(b) As we look toward architecting the future, the PMO is researching different data aggregate solutions across CSPs. The Government is actively seeking how to transition to an alternative product, so it will be in a better position to utilize the other CSOs outside of MS.

Page 6 of 6 Pages

JA24-112 CRMS DPMS