852572898 - JA AMD01 - Final_Redacted.pdf

CUI

Controlled by: DISA Controlled By: PEO CYBER CUI Category: OPSEC Distribution/Dissemination Control: FEDCON

POC: HENRY HUYNH, +1 6678906331, HENRY.HUYNH.CIV@MAIL.MIL

JUSTIFICATION & APPROVAL FOR FEDERAL ACQUISITION

REGULATION SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Contract

Orders under Fair Opportunity Federal Acquisition Regulation (FAR) 16.505, Defense FAR Supplement 216.505(b), Procedures, Guidance, and Information 216.505(b)

Purchase Request Number: HC108925CDD5150 Joint Warfighting Cloud Capability (JWCC) Contract Number: HC105023D0005 Task/Delivery Order Number: To be determined Procurement Title: Domain Name System Data Lake (DNSDL) Estimated Value:

Statutory and Regulatory Authority: 10 United States Code (U.S.C.) 3204(a) and FAR 16.505(b)(2)(i)(B)

EXCEPTION TO FAIR OPPORTUNITY

Number: Not Applicable

Upon the basis of the following justification, I, as the Contracting Officer, hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C. 3204(a) and Regulatory Authority of FAR 16.505(b)(2)(i)(B).

1. REQUESTING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

Defense Information Systems Agency (DISA) Program Executive Office (PEO)/ Perimeter Defense Division 6910 Cooper Ave Fort Meade, MD 20755 United States of America

Contracting Activity:

DISA/Defense Information Technology Contracting Organization (DITCO)/Cloud Capabilities Section (PS8511)

2300 East Drive Scott AFB, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

AMD01; This amendment increases the estimated value by . This increase is due to the inclusion of several service offerings included on the proposal that were not included in the IGCE to include scanning/monitoring services and regional hosting. These services are important components to the infrastructure build to meet the DNSDL mission requirements as specified in the Description of Work.

AMD01 - Domain Name System Data Lake (DNSDL)

Page 2 of 7 Pages

This action is to issue a firm-fixed-price task order (TO) against the JWCC Indefinite Delivery/Indefinite Quantity Contract for DNSDL. This TO will be issued directly to Amazon Web Services, Inc. (AWS). The anticipated period of performance (PoP) is for a 1-year base period, plus two 1-year option periods. The total estimated value is , which will be funded by Working Capital funds.

3. DESCRIPTION OF SUPPLIES/SERVICES:

This requirement is for the uninterrupted delivery of enterprise-level cloud services, infrastructure, and platform capabilities vital to supporting the DISA Domain Name System (DNS) Hardening Program's existing mission-critical applications and data assets. The DNSDL project was originally established to provide Data Lake services for DNS Hardening assets throughout the Department of Defense Information Network (DoDIN). The system has collected significant data over the past 3 years, and the scope of the services required has increased.

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity.

FAR 16.505(b)(2)(i)(B) - Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(b) Description of the Justification.

Over the past 3 years, significant investment has been made in migrating, developing, and optimizing a vast array of mission-critical applications, sensitive data, and operational capabilities within the current environment. This includes extensive refactoring of legacy applications, development of new cloud-native solutions leveraging AWS-specific cloud capabilities, AWS architecture, security, and operations.

This requirement does not introduce fundamentally new or unrelated requirements but rather sustains, expands, and optimizes the existing cloud footprint to meet evolving mission demands within the established AWS environment. This includes continued access to the same core services, but with potential for growth in usage and adoption of new, integrated AWS features.

(c) Justification.

(1) Minimum Government requirements.

The Government requires continued access to a comprehensive suite of cloud computing services, including Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and

Page 3 of 7 Pages

CUI

Software as a Service (SaaS) component. These services, which span critical functionalities such as compute, storage, networking, database management, security services, analytics, machine learning, and developer tools, are essential for the operation, maintenance, and ongoing development of the DISA DNS Hardening Program's protective systems. Specifically, this includes the following: a) scalable compute resources for manual analysis of data b) development of web applications for managing DNSDL records c) compiling of custom virtual machine images, container images, and software packages d) hosting of continuity of operation plan (COOP) sites for web and infrastructure components e) hosting of scalable clusters that are integrated with on-premises systems.

(2) Proposed sole source contractor. AWS

(3) Discussion regarding the cause of the sole source situation.

The current requirement is for the continuation and expansion within an existing, deeply integrated environment. The associated phase-in/phase-out requirements and the complexity of migrating the entire operational environment to another Cloud Service Provider (CSP) would be prohibitive regarding operational risk and cost.

Migrating DNS systems from AWS to another CSP’s cloud service offering cannot be considered a simple "lift and shift" of virtual machines, but a complete re-platforming effort due to the deep integration with AWS-native services. The current cloud environment is not a monolithic application but a complex ecosystem of interconnected systems, services, and data pipelines. The interdependencies and custom integrations built within AWS make a rapid, clean break from the AWS platform exceptionally challenging.

The disruption to ongoing operations, data integrity risks, and the need for parallel operations during transition make this approach impracticable within the required timeframe.

(4) Demonstration of unique source.

A significant portion of the Agency's applications have been specifically designed and optimized to leverage AWS-native services (e.g., AWS Lambda for serverless computing, Amazon Simple Storage Service for object storage, Amazon Relational Database Service for managed databases, Amazon Kinesis for data streaming, AWS Security Hub for security posture management). These services offer unique capabilities, performance characteristics, and cost efficiencies that are not directly transferable or functionally equivalent to other CSPs. Refactoring these applications to run on a different cloud provider environment would necessitate a complete re-architecture and re-development effort, effectively rebuilding the applications from the ground up. This would involve years of effort and immense cost, diverting critical resources from mission execution.

Page 4 of 7 Pages

Due to the deep integration with AWS-specific Application Programming Interfaces (APIs), Software Development Kits, and managed services, a simple "lift and shift" migration of the entire environment to another CSP is technically infeasible without significant re-engineering. Data gravity, complex network configurations, specific security controls, and operational automation built around AWS tools and services create a substantial compatibility risk that cannot be overcome without a complete re-platforming initiative.

The existing security posture and compliance frameworks are deeply embedded with AWS-native security services (e.g., AWS Web Application Firewall, GuardDuty, Macie, Identity and Access Management) and established security best practices within the AWS ecosystem. Migrating these would require a complete re-evaluation and re-implementation of the security architecture.

(5) Procurement discussion.

Market research was thoroughly conducted during the initial award process for cloud services. For this requirement, market research has focused on the feasibility, cost, and time implications of migrating the existing, deeply integrated AWS environment to an alternative CSP. This research consistently indicates that such a migration would be technically complex, financially prohibitive, and would introduce unacceptable risks and delays to mission operations.

An additional Market Research Request to Support an Exception to Fair Opportunity was issued to all four CSPs included in the JWCC contract vehicle: AWS, Oracle America, Inc., Google Public Sector LLC, and Microsoft Corporation. Responses were received from all four CSPs and the DISA DNS Hardening Program conducted a thorough analysis of each response against the minimum requirements that included the anticipated cost considerations, anticipated security considerations, and any extenuating circumstances.

Upon conclusion of the analysis conducted on each CSP response, AWS is the only CSP capable of meeting the needs of the government, without significant refactoring and increased risk for DISA DNS Hardening’s security posture. One area of focus when reviewing the CSP responses was in relation to serverless computing. DISA DNS Hardening relies heavily upon AWS Lambda, a proprietary function-as-a-service offering. While other CSPs have similar services (Azure Functions, Google Cloud Functions), they are not interchangeable and require significant code refactoring.

Additionally, managed services through AWS like Amazon Aurora or DynamoDB, have their own specific APIs and architectures that don’t have direct drop-in equivalents in other CSP environments. The Government may be forced to accept loss of functionality for AWS-specific services or features that have no direct equivalent if any other CSP is considered.

(6) Impact.

Page 5 of 7 Pages

The uninterrupted availability of these specific capabilities is paramount to avert severe disruption to ongoing operations and avoid jeopardizing national security objectives. Any attempt to migrate or refactor the existing AWS environment to another CSP would result in estimated delays of 12 months or more for the full transition, during which time mission-critical capabilities would be severely degraded or completely offline. The cost associated with such a migration, including parallel operations, data transfer, and re-development, will be significant, presenting an unacceptable expenditure of taxpayer funds given the existing, fully functional AWS environment.

The circumstances are a critical operational urgency driven by the need for uninterrupted support to mission-essential functions. A failure to secure this task order would create an immediate and severe disruption to DNS Hardening efforts as specified in the DISA DNS Analytic Scheme of Maneuver effort. This situation arises from the fundamental nature of cloud services as a utility for continuous operations, coupled with the inherent difficulty of rapidly migrating complex, deeply integrated environments.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION:

A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the independent government cost estimate and the JWCC Catalog pricing, including any discounts, which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

6. MARKET RESEARCH:

Market research for the basic JWCC Contracts was conducted and resulted in a signed market research report on November 9, 2021, that was revalidated and recertified on July 29, 2024.

After a survey of the market, it was concluded that the JWCC Contract is in the Government’s best interest due to technical feasibility and cost to the Government.

The DISA DNS Hardening Program conducted market research July 29, 2025 - August 04, 2025, by reviewing the specific capabilities in the JWCC Cloud Service Provider (CSP) catalogs and other similar Cloud Services contracts. It was determined that Amazon Web Services, Inc.

(AWS) is the only source capable of fulfilling the Government’s minimum needs in the manner and time frame required. DISA DNS Hardening also requested Additional Research to Support Exception to Fair Opportunity from the four JWCC CSPs: AWS, Oracle America, Inc., Google Public Sector LLC, and Microsoft Corporation. All four CSPs responded to this request.

Upon conclusion of the market research techniques highlighted, it was determined that AWS is the only CSP that can meet DISA DNS Hardening’s minimum requirements without significant refactoring and increasing risk to the current security posture.

7. ANY OTHER SUPPORTING FACTS: None.

Page 6 of 7 Pages

CUI

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History:

Incumbent Contractor: New Tech Solutions Inc.

Contract Number: HC108422F0278 Task Order Number: Not applicable Period of Performance: September 29, 2022 - September 30, 2025 Competitive Status: Other than full and open competition Business Size: Small business

(b) To overcome future barriers to competition, the DISA DNS Hardening Program team has focused on two key areas: Vendor Agnostic Solutions and a DOD Olympus Migration Strategy. The DISA DNS Hardening Program is actively investigating and prioritizing vendor-agnostic solutions for all new development and future enhancements. This approach will ensure that solutions are more portable across CSPs, reducing vendor lock-in.

(c) To support HC108422F0278, a Justification and Approval (J&A) for an exception to fair opportunity was signed on September 22, 2022, by the Agency Competition Advocate at DISA/DITCO. The previous J&A was a Brand Name justification citing FAR 16.505(a)(4) as the regulatory authority. At the time AWS was the only available CSP that had implemented a custom data transport path from the DISA Enterprise on-premise systems through the - DISA Secure Cloud Computing Architecture to an accredited Impact Level (IL) 5 cloud environment without compromising security or performance and with compatibility to the current AWS operating system. These same challenges exist today as other cloud service offerings lack compatibility within the existing AWS environment. An additional exception to fair opportunity is required due to the lack of viable alternatives that would not require complete re-architecture of the existing cloud environment. Doing so only introduces duplicative efforts and increases risk to the current security posture.

Page 7 of 7 Pages

CUI

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE

TITLE/AGENCY/ORGANIZATION: Program Manager, DISA

PHONE: DATE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

TITLE/AGENCY/ORGANIZATION: Program Manager, DISA

PHONE: DATE:

CONTRACTING OFFICER APPROVAL: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: Darryl Boswell SIGNATURE:

TITLE/AGENCY/ORGANIZATION: DISA/DITCO/PS8511

PHONE: DATE:

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

Contract Specialist,