852571989 JA AMD01 FINAL_REDACTED.pdf

Marine Corps Red Team Cloud Infrastructure

This action is to issue a firm-fixed-price TO against the JWCC Indefinite Delivery/Indefinite Quantity Contract for MCRT Cloud Infrastructure. This TO will be issued directly to Amazon Web Services, Inc (AWS). The anticipated period of performance (PoP) is for a 1-year base period, plus one 1-year option period. The total estimated value is which will be funded by Operation & Maintenance.

3. DESCRIPTION OF SUPPLIES/SERVICES:

This requirement is for the continued infrastructure to evaluate and assess the security and defense of USMC protected cyberspace against adversarial tactics and techniques. In summary, the MCRTs requirement is to faithfully emulate adversarial techniques and the infrastructure must be external to the Marine Corps Enterprise Network.

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity.

FAR 16.505(b)(2)(i)(B) - Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(b) Description of the Justification.

The MCRT implemented emerging technologies as part of the Cyber Red Teams mission critical Department of Defense (DoD) security and defense measures utilizing AWS cloud infrastructure since December 2014. Impact Level (IL) 2 emulation operations have been developed over time to serve as the primary Command-and-Control infrastructure.

These services have been utilized in the conduct of more than 300 missions since 2014 and played a vital role in their success. In addition, the National Security Agency (NSA), and United States Cyber Command (USCYBERCOM) have reviewed the MCRT's use of AWS cloud infrastructure since that time. Each of the reviews consist of a full evaluation of the Red Team's documents, procedures, and infrastructure against the NSA’s "DoD Cyber Red Team Certification & Accreditation Handbook" and associated "Evaluator Scoring Metrics." At the conclusion of each of these reviews, the NSA strongly recommended (and USCYBERCOM approved) the certification and accreditation of the Red Team's infrastructure on AWS in accordance with (IAW) DoD Instruction (DoDI) 8585.01) DoD Cyber Red Teams.

The continued utilization of AWS for cloud services to conduct operations is IAW with requirements previously established in the following references:

a) Department of Navy Cloud Policy, December 7, 2020

b) DoDI 8500.01, “Cybersecurity,” Change 1, October 7, 2019

c) Marine Corps Order (MCO) 5239.2B, “Marine Corps Cybersecurity,” November 5, 2015

d) DoDI 8585.01, “Department of Defense Cyber Red Teams,” January 11, 2024

(c) Justification.

(1) Minimum Government requirements.

The cloud service offerings must continue at their current level in order to support the MCRT's mission to securely conduct DoD Cyber Red Team Operations across the DoD Information Network (DoDIN). The MCRT is the DoD Cyber Red Team for the USMC tasked with performing all cross-DoDIN adversarial threat emulation IAW DoDI 8500.01, MCO 5239.2B, and DoDI 8585.01. The Red Team requires certain mission critical capabilities (which shall not be divulged based on the critical nature) to support an adversarial team to act as a cyber-aggressor presenting multiple cyber intrusion vectors consistent with the validated threat.

The MCRT is the USCYBERCOM accredited, NSA certified Red Team that supports Cybersecurity Service Provider (CSSP) functions for the USMC. The formal mission of the MCRT is to assess effectiveness of the security and defense of USMC and DoD protected cyberspace against adversarial tactics, techniques, and procedures. The MCRT’s current infrastructure is critical to support the faithful emulation of adversarial attacks of our nation's adversaries.

These offerings include:

(a) Non-Attribution: Must not be identifiable by Marine Corps network defenders as being part of Red Team operations.

(b) Flexibility: Must support MCRT's need to adjust to changing conditions in cyberspace and generate effects that closely emulate those of a given cyberspace adversary.

(c) Security: Must support MCRT's ability to protect the information handled resulting from penetration tests or threat emulation operations.

(d) Operational Integrity: Must allow MCRT to prevent access to the solution's configuration information by everyone but MCRT personnel.

(e) Compatibility: Data logging solutions offered by the Cloud Service Provider (CSP) must be capable of ingesting data from MCRT’s current logging solution.

(f) Generality: Must offer generalized computing resources to allow for the development of new capabilities.

(g) Offensive Operations: Must allow MCRT-generated network traffic of an offensive nature to enter and depart its network. This may include outbound network or application scanning or inbound "beaconing" from compromised hosts.

(h) Access Control: Must offer the ability to exclude access configuration information to everyone but MCRT members.

(2) Proposed sole source contractor. AWS

(3) Discussion regarding the cause of the sole source situation.

The infrastructure to date includes more than 180 Elastic Compute Cloud machines, 7 security groups and 40 domain registrations. The MCRT’s on premises infrastructure comprises two hypervisor hosts and eight virtual machines. Provisioning another CSP would require all existing infrastructure to be migrated, to include transfer costs, in addition to the costs typically associated with establishing new infrastructure. The IL2 environment is tied to the new IL4 environment that is being deployed and would require the IL2 environment to be rebuilt in order to proceed.

Dating back to 2015, the MCRT has been required to complete a triennial NSA recertification which consists of highly detailed review for the team’s practices, procedures, and infrastructure. The recertification includes review and approval of the AWS infrastructure and associated documentation IAW the NSA's "DoD Cyber Red Team Certification & Accreditation Handbook”. The initial certification and accreditation, which included review and approval through NSA and USCYBERCOM, took approximately 18 months to obtain the necessary recommendation and approval to use AWS cloud infrastructure. AWS is the only contractor NSA and USCYBERCOM have approved for certification and accreditation for MCCOG’s Red Team IL2 infrastructure. Additionally, re-certification requires a minimum of six months to complete.

The MCRT conducts an average of 30 named operations each year, all of which solely rely on the existing AWS infrastructure continuously and is custom built to suit each of the critical operations through a rigorous and constant evaluation and improvement process. Ongoing and scheduled operations would be negatively impacted if newly provisioned infrastructure has to be adjusted for the unique nature of the Red Teams’ operations. Provisioning to a new CSP would cause MCRT operations to fail due to re-engineering, re-certifications, and additional cost requirements.

(4) Demonstration of unique source.

The only source capable of performing the MCRT Cloud Infrastructure at the level and quality required is AWS. AWS’s GovCloud was specifically designed for the MCRT that provides the required specifications, enhanced security and compliance certifications for the Red Team. Additionally, AWS GovCloud is an isolated AWS region with additional security measures, compliance certifications, and located within the U.S., ensuring data residency and sovereignty. Furthermore, there is already an existing AWS GovCloud environment. Shifting from the current environment would negatively affect MCCOG’s mission; another CSP would not be positioned to leverage investments already made due to requiring re-engineering, re-certification and the use of additional resources.

(5) Procurement discussion.

Based on outreach to the four JWCC CSPs in March 2025, the only CSP that can meet the minimum needs of the Government is AWS. To support another CSP within the project or switching entirely, would result in unacceptable schedule delays, additional multi-cloud integration tasks, and result in additional costs. Furthermore, the continued utilization of AWS for cloud services to conduct operations must remain IAW with DON, DoDI and MCO requirements previously established. The deployment strategy of cloud services if MCRT operations is not exclusively running on AWS would require re- engineering of the complete infrastructure. This would require development of additional cloud provisioning scripts for other CSPs and additional re-engineering/development of specific tasks to the project.

(6) Impact.

MCRT supports various entities such as CSSPs, Programs of Record (PoR), and USMC garrison and tactical exercises. Failure to deliver proper cyber vulnerability assessments against PoRs, weapons systems, and key terrain in cyberspace is likely to result detrimental effects and in the failure of multiple Category I systems. If PoRs fail, in some cases, USMCs have increased probability of casualties and loss of life. If assessments of operational Marine Corps networks are incomplete, cyber adversaries are far more likely to gain access to sensitive military data to degrade USMC missions during times of crisis and conflict. Therefore, the detrimental impact to known costs, NSA certification, and mission and operations is complete mission failure. MCRT would be unable to perform the mission to faithfully emulate the attacks of our nation's adversaries which will detrimentally affect USMC, DoD, USCYBERCOM and U.S. national security.

4. COST/PRICE FAIR AND REASONABLE DETERMINATION:

A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the independent government cost estimate and the JWCC Catalog pricing, including any discounts, which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

5. MARKET RESEARCH:

Market research for the basic JWCC Contracts was conducted and resulted in a signed market research report on November 9, 2021, that was revalidated and recertified on July 29, 2024.

After a survey of the market, it was concluded that the JWCC Contract is in the Government’s best interest due to technical feasibility and cost to the Government.

Additional research was conducted March 10, 2025 - March 21, 2025 by reviewing the specific capabilities in the JWCC Contracts and it was determined that AWS is the only source capable of fulfilling the Government’s minimum needs in the manner and time frame required. The Additional Research to Support Exception to Fair Opportunity was issued directly to each of the four JWCC CSPs via email on March 10. 2025 with a response request of March 21, 2025.

AWS, Oracle and Microsoft acknowledged receipt; Google Public Sector (GPS) did not. AWS and Oracle provided white paper responses, Microsoft and GPS did not. Although, AWS GovCloud and Oracle Cloud Infrastructure (OCI) both offer cloud computing services, the focus and target markets differ. AWS GovCloud is specifically designed for U.S. government agencies, offering enhanced security and compliance certifications. Additionally, AWS GovCloud is an isolated AWS region with additional security measures, compliance certifications, and located within the U.S., ensuring data residency and sovereignty.

6. ANY OTHER SUPPORTING FACTS: None.

7. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

a. Procurement History:

Incumbent Contractor: AWS.

Contract Number: HC105023D0005 TO Number: HC105023F0014 PoP: June 22, 2023 - June 21, 2025 Competitive Status: Other than full and open competition Business Size: Large business

b. To support HC105023D0005/HC105023F0014, a justification and approval (J&A) for an exception to fair opportunity was signed on May 16, 2023 by a JWCC Contracting Officer (KO). The previous J&A was based on, FAR 16.505(b)(2)(i)(B) - only one awardee is capable of providing the services because they are unique or highly specialized. To overcome those barriers, MCCOG has, and will continue to monitor the market in an effort to identify emerging technologies that may satisfy future requirements, DoD information technology, as well as the pursuit of training and certification for Government engineers in other technologies, and continuous cybersecurity policies (i.e. 8500,etc.). However, an additional exception to fair opportunity is required because the MCRT must utilize the AWS infrastructure (GovCloud) which provides the required, isolated AWS region located within the U.S.

and has the required additional security measures and compliance certifications (certifications and accreditation).