JA AMD 01_ZeroTrust_Redacted.pdf

JUSTIFICATION & APPROVAL FOR FEDERAL ACQUISITION REGULATION

SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Contract

Orders under Fair Opportunity Federal Acquisition Regulation (FAR) 16.505, Defense FAR Supplement 216.505-70, Procedures, Guidance, and Information 216.505-70

Purchase Request Number: A2209-097-097-029947, HC1085447830 Joint Warfighting Cloud Capability (JWCC) Contract Number: HC105023D0005 Task/Delivery Order Number: TBD Procurement Title: Zero Trust Governance Commercial Cloud Lab & Assessment Tool Estimated Value:

Statutory and Regulatory Authority: 10 United States Code (U.S.C.) 2304c(b) and FAR 16.505(b)(2)(i)(B)

EXCEPTION TO FAIR OPPORTUNITY

Number: Not Applicable

Upon the basis of the following justification, I, as the Contracting Officer, hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C. 2304c(b) and Regulatory Authority of FAR 16.505(b)(2)(i)(B).

1. REQUESTING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

Defense Information Systems Agency (DISA)/DCSC CYBER SECURITY &

ANALYTICS (ID)

6910 Cooper Ave., DBC ID2 ZT Fort Meade, MD 20755-7088 United States of America

Contracting Activity:

DISA/Defense Information Technology Contracting Organization/PS8511 2300 East Drive Scott Air Force Base, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

AMD 01: The purpose of this action is to update the estimated value of the requirement by for a revised value of . The addition of the comes from a difference in daily rate usage and units of measure that were proposed in comparison to the estimate. The mission partner utilized the AWS pricing calculator to develop the Description of Work, however when the estimate was built in the DAPPS system, the daily rates usage and units of measure had been incorrectly changed. The proposal was submitted based on the Description of Work, which lists the correct daily rates and units of measure. Additionally, the proposal included pricing IAW FAR 52.217-8, Option to Extend

Page 2 of 7 Pages

Zero Trust Governance Commercial Cloud Lab & Assessment Tool

Services. The Government requires this pricing to be submitted as stated in the Request for Proposal posted to the Cloud Service Provider. The proposed pricing for the Option to Extend Services was found acceptable to the Government. The pricing IAW FAR52.217-8 and the daily rates and units increase the estimated value by to .

This action is to issue a firm-fixed-price task order (TO) against the JWCC Indefinite Delivery/Indefinite Quantity Contract for Zero Trust Governance Commercial Cloud Lab & Assessment Tool. This TO will be issued directly to Amazon Web Services (AWS). The anticipated period of performance (PoP) is for a 1-year base period, plus one 1-year option period. The total estimated value is AMD 01) which will be funded by Operations & Maintenance funds.

3. DESCRIPTION OF SUPPLIES/SERVICES:

This requirement is for the procurement of AWS cloud services to host and maintain a cloud test environment. The UNCLASSIFIED Cloud Support Package is used to order services which will encompass but not be limited to, Cloud Service Offerings, UNCLASSIFIED Cloud Support Package, Contract Program Management Support, Transit, Central, Logging, MP1 (Red Hat, Linux), Zero Trust Assessment Tool , advisory and assistance services, help desk services, training, and documentation support from the JWCC Catalog for all UNCLASSIFIED (i.e.

Impact Levels (IL)(4, and 5) Anything as a Service. This environment is used to provide an independent test environment for validating Zero Trust (ZT) technologies.

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity.

FAR 16.505(b)(2)(i)(B) - Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(b) Description of the Justification.

Requirements for the Zero Trust Commercial Cloud Lab (ZTCCL) hosted within an AWS environment were developed based off several criteria which included strategic partner recommendations, independent research, vendor meetings, and technical evaluations. The engineering team has conducted ongoing evaluation on both existing and potential augmenting technical capabilities to meet this requirement. This environment is intended to assist in supporting proof of concept activities and validation of the reference architecture within the existing AWS lab environment. The initial deployment of this environment utilized Hosting and Compute’s Infrastructure as Code that streamlined ZTCCL’s accreditation process, allowing for this effort to provide mission partners the ability to test or assess ZT technologies, within an accredited AWS environment. In support of this mission, contract staffing decisions were based off

Page 3 of 7 Pages institutional knowledge of AWS and its respective services and capabilities that are unique to this mission.

(c) Justification.

(1) Minimum Government requirements.

ZTCCL has been successfully deployed with the intent to provide Program Executive Office Cyber and its mission partners with an integration space to develop, test, and mature ZT concepts, and capabilities within a cloud lab environment. This cloud environment was planned to be and is being utilized by Mission Partners to assess interested technologies and to help in the assessment of technology suitability and usability for the Thunderdome Project. The cloud service offerings must continue at their current level to combat the possible delay of Authorization to Operate accreditation, or actions that impact our current Interim Authority to Test-Connect and Cloud Access Point. Transition to another Cloud Service Provider (CSP) would incur and result in the risk of mission support delay/degradation.

(2) Proposed sole source contractor.

AWS

(3) Discussion regarding the cause of the sole source situation.

A significant amount of Government time and funding has been invested in the planning, creating, and the accreditation of this environment. The central factor surrounding the sole source environment revolves around the fact that all initial planning and its resulting chain of actions/decisions were based on the utilization of AWS. A change in streams at this time would drastically impact capability, continuity, and delay our support to awaiting Mission Partners. Personnel trained from 2018/2019 to present to bring the ZT environment from its infancy stage of development and new technology and testing to Thunderdome's Implementation Plan to successfully disseminate a ZT environment throughout DISA. Training consists of a many part series to develop and produce the required ZT Reference Arch rules and guidance to map to the National Institute of Standards and Technology controls to be an effective member in the development of the Assessment Tools for Heat Mapping for real-world lab technology breakthroughs for the Warfighter. Another CSP’s offering will not align with the current environment as it is relying heavily on current AWS tools and offerings.

(4) Demonstration of unique source.

AWS provides uniquely more specialized offerings such as specific modules that focus on management and governance such as CloudWatch, CloudTrail, and CloudFormation.

The deployment of our environment heavily utilized these pre-existing AWS templates.

The access and management of the lab environment utilized AppStream, a sole AWS service, allowing for the full administration of the ZTCCL. Also, the execution of

Page 4 of 7 Pages capabilities also leaned on AWS native services such as machine learning, packet inspection, containerization, and lambda functions. Vital pre-existing audit data is also at risk as these logs would have to be exported and then in some way, re-integrated into a new system.

(5) Procurement discussion.

a. The ZT Program Management Office (PMO) has determined that JWCC is the best for this requirement. The ZT current environment and services governed by DoD Chief Information Officer have established a successful strategic directorate's direction to validate this mission seamlessly through end of year 2027 with the current CSP. The ZT PMO will provide the DoD Cyber Council with a combined Scorecard upon completion of transitioning to Thunderdome, a full DoD Implementation plan of the ZT environment throughout DISA. Acquiring no decrease in agency savings, and no mission lag due to retraining, and rebuilding of a group synergy of ZT operations.

b. Since there is already an existing environment, the CSP is immediately able to shirt to supporting the resultant award associated with this contract action. In addition, another CSP would require additional support to integrate with the current environment.

(6) Impact.

The impact of the movement to a new CSP would result in the delay of the continued accreditation of the environment (and lose current accreditation), and drastically impact schedule, cost, and ZTCCL’s mission success in providing our Mission Partners an integration space to develop, test and mature ZT concepts and provide an environment that could provide the ability to simulate standard Information Technology domains, three tiered applications and “gold images” for common Operating Systems. A change in CSP would also impact the mission as it would require the retraining of personnel and rebuilding the Synergy level.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION:

A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the independent government cost estimate and the JWCC Catalog pricing, including any discounts, which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

6. MARKET RESEARCH:

Market research for the basic JWCC Contracts was conducted and resulted in a signed market research report on November 9, 2021. After a survey of the market, it was concluded that the JWCC Contract is in the Government’s best interest due to technical feasibility and cost to the Government.

Page 5 of 7 Pages

Additional research was conducted July 3, 2024 - July 11, 2024 by reviewing the specific capabilities in the JWCC Contracts and it was determined that AWS is the only source capable of fulfilling the Government’s minimum needs in the manner and time frame required. Pamela Shamel, ID74 Program Manager sent out four Additional Research to Support Exception to Fair Opportunity on June 28, 2024 to Microsoft, Amazon, Oracle, and Google. ID74 received responses from all four CSPs by July 11th, 2024. The CSP's responses were reviewed and discussed within the ZT Team: Ms. Shamel, Mr. Lee, and Mr. Smoyer. After thorough review of the existing requirement and needs, as well as conducting extensive market research, we found that AWS emerged as the optimal choice for our organization's cloud computing needs. Our comprehensive review highlighted that AWS provides a robust suite of services and tools that align with our immediate and on-going technical and operational requirements. AWS provides uniquely more specialized offerings such as specific modules that focus on management and governance such as CloudWatch, CloudTrail and CloudFormation. The deployment of our current environment heavily utilized these pre-existing AWS templates. The access and management of the lab environment utilized AppStream, a sole AWS service, allowing for the full administration of the Zero Trust Commercial Cloud Lab. Also, the execution of capabilities leaned on AWS native services such as machine learning, packet inspection, containerization, and lambda functions. Vital pre-existing audit data is also at risk as these logs would have to be exported and then in some way, re-integrated into a new system. The impact of use of AWS on our mission success is immense compared to other providers. This is because AWS’s platform integrates seamlessly with our existing systems, resources, and workflows, thereby ensuring continuity and minimizing disruptions. Another important factor is that, as we work with mission partners and their work relies on our test environment to match their needs, which centers on use of AWS. Competing this requirement amongst the remaining CSPs would provide the Government with an unacceptable amount of risk and would cause the Government to incur significant cost increases. In summary, after careful consideration and analysis, it became clear that AWS presents the least significant impact on our mission support and success.

This decision supports our strategic objectives and ensures that we can effectively leverage cloud technology to enhance our operations and achieve our mission goals. AWS also provides mission continuity as it is currently accredited and has an existing connection approval and changing CSPs would cause substantial delays to the mission execution.

7. ANY OTHER SUPPORTING FACTS: None.

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History:

Contract Number: 000NNG15SC83B Task Order Number: HC102821F1139 Period of Performance: September 15, 2023 - September 14, 2024 Competitive Status: Full and open competition Business Size: Large business

Page 6 of 7 Pages

(b) The ID2 ZT environment will be absorbed into Thunderdome ID7 effective Fiscal Year (FY) 2026/2207. The current J&A request is to deploy ZT to the implementation/deployment phase to allow for Thunderdome to deploy and install to all DISA Programs by FY2027, Per DISA Directive FY19 DoD DISA Zero Trust Strategy Guidance, DoD and DISA Reference Architecture Plan, Zero Trust Capability Timelines, and implementation Milestones. The Government will continue to conduct market research to determine if there are changes in the marketplace that would enable future competitive actions.