852675435_JA_Final_Redacted.pdf

CUI CUI

JUSTIFICATION FOR EXCEPTION TO

FAIR OPPORTUNITY OR BRAND NAME

Federal Acquisition Regulation (FAR) Part 16.5 Justification & Approval (J&A)

CSS Tracking Number: 852675435 Military Interdepartmental Purchase Request: HC1085606478 Joint Warfighter Cloud Capability (JWCC) Contract: HC105023D0003 Procurement Title: Continuous Monitoring and Risk Scoring (CMRS) Cloud Estimated Value:

Regulatory Authority: FAR 16.507-6(b)(2)

J&A Exception to Fair Opportunity Number: JA26-071

1. REQUIRING AGENCY AND CONTRACTING ACTIVITY:

Requiring Agency: Defense Information Systems Agency (DISA) / Acquisition – Portfolio Acquisition Executive Cyber (Identity) Contracting Activity: DISA/Defense Information Technology Contracting Organization (DITCO)/Cloud Capabilities Section (PS8511)

2. NATURE/DESCRIPTION OF ACTION(S):

Type of Action: New Task Order (TO) Type of Contract: Firm-fixed-price

This action is to issue a TO against the JWCC Indefinite Delivery/Indefinite Quantity Contract for CMRS Cloud. This TO will be issued directly to Microsoft Corporation. The anticipated period of performance (PoP) is for a 1-year base period, plus one 1-year option period.

3. DESCRIPTION OF SUPPLIES/SERVICES:

Cloud hosting environment to support the data ingestion CMRS, Endpoint Security Solutions and Innovations (ESSI) Lab, and Logs1. This will provide support to a pre-production cloud lab for CMRS and also support data collection from Microsoft Defender reporting across the Department of War.

4. IDENTIFICATION OF EXCEPTION TO FAIR OPPORTUNITY:

FAR 16.507-6(b)(2) - Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

5. DEMONSTRATION THAT THE PROPOSED CONTRACTOR’S UNIQUE

QUALIFICATIONS OR THE NATURE OF THE ACQUISITION REQUIRES USE OF THE

EXCEPTION CITED:

Page 1 of 5 Pages

CUI

J&A: CMRS Cloud

Page 2 of 5 Pages

CUI

CUI

J&A: CMRS Cloud

Page 2 of 5 Pages

1. UNIQUE QUALIFICATIONS: Microsoft is the only source capable of fulfilling this requirement due to the highly specialized, proprietary technical architecture of the ESSI lab and its deep integration with Microsoft specific cloud services. The ESSI infrastructure relies heavily on specialized Microsoft Platform-as-a-Service (PaaS) offerings such as Azure Event Hubs for high throughput CMRS data ingestion and Azure Structured Querly Language for complex compliance data normalization. These offerings possess no direct 1-to-1 equivalents in other cloud environments without extensive and costly re-engineering. Furthermore, the lab's security architecture is tied to the Microsoft Defender suite and Microsoft Entra ID (formerly Azure Active Directory). These native security integrations are strictly required to seamlessly federate with the broader Department of Defense Enterprise Email and Collaboration Services tenant. This federation enables the precise simulation of endpoint behavior, automated Assured Compliance Assessment Solution vulnerability correlations, and conditional access policies that cannot be accurately replicated or natively ingested by third-party infrastructure.

In addition to these technical dependencies, the current Interim Authorization to Test - Cloud (IATT-C) for the ESSI Lab is specifically bounded by Microsoft Azure Government proprietary security controls and encryption methodologies. The lab’s data protection framework relies heavily on Azure Key Vault Managed Hardware Security Modules, configured exclusively for Microsoft's Impact Level (IL)5 and IL6 boundaries, to secure continuous monitoring data in transit and at rest. Transitioning to an alternative Cloud Service Provider (CSP) would not only sever the native Application Programming Interface (API) hooks required for real-time CMRS risk reporting, but it would also completely invalidate the existing IATT-C. Achieving a new authorization on a non- Microsoft platform would force a complete rebuild of the encryption boundary, PaaS data pipelines, and identity federation models, introducing unacceptable mission delays and severely disrupting the deployment timeline for enterprise CMRS integration. as the ESSI Lab's current security posture is certified under an active platform specific IATT-C.

2. IMPACT: Introducing a new CSP at this stage of the lifecycle, would require the complete re-engineering of security pipelines, nullify the current IATT-C, and necessitate a protracted re-authorization cycle. This process introduces a 6-24 month timeline that is unacceptable for continuous operations of the environment. Consequently, a transition to any other platform would result in an estimated duplication of taxpayer funds, introduces unacceptable delays, and directly compromises active tactical cyber defense capabilities utilized by the warfighter. This drives the Government’s current need for compatibility with the existing architecture.

6. DETERMINATION OF FAIR AND REASONABLE COST:

A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the independent government cost estimate and the JWCC Catalog pricing, including any discounts, which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

7. MARKET RESEARCH:

Page 3 of 5 Pages

CUI

CUI

J&A: CMRS Cloud

Page 3 of 5 Pages

Market research for the basic JWCC Contracts was conducted and resulted in a signed market research report on November 9, 2021. This market research was subsequently revalidated and recertified on July 29, 2024, and most recently on February 6, 2026. After a survey of the market, it was concluded that use of the JWCC Contract is in the Government’s best interest due to technical feasibility and cost to the Government.

From June 2, 2026, to June 26, 2026, DISA/PAE Cyber conducted targeted market research to evaluate capabilities within the JWCC contract vehicle. This review confirmed that Microsoft is the sole cloud service provider capable of satisfying the Government’s minimum mission requirements within the mandatory timeframe. To validate these findings, the Cyber Data Analytics Portfolio conducted additional market research and reviewed various commercial vendor websites. Furthermore, a query of the DISA Market Research Repository (MRR) yielded no alternative compatible service offerings.

On June 20, 2026, the Cyber Data Analytics Portfolio issued a request for information to support an exception to fair opportunity, with responses due on June 24, 2026. Microsoft was the sole respondent. Following a comprehensive technical evaluation of the response, the Program Management Office (PMO) confirmed that Microsoft’s cloud service offerings fully satisfy all government requirements and represent the most cost-effective solution.

8. ANY OTHER SUPPORTING FACTS: None

9. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

Reviewing officials and the approval authority have reviewed the previous J&A, which was routed with this J&A, and determined any planned actions to remove barriers to competition listed on the previous justification were considered. The PMO is continuously researching cloud neutral data aggregation solutions across various CSPs to foster a competitive future acquisition environment. Because a transition of this scale requires a phased, multi-year engineering effort, this sole-source contract allows the Government to prevent substantial duplication of costs and maintain critical mission continuity. This also ensures the program remains fully compliant with existing cybersecurity authorizations (including the active IATT-C) while the PMO thoroughly evaluates and architects the most secure, cost-effective transition pathway to alternative Cloud Service Offerings (CSOs). After reviewing the actions taken, it is determined that a sole source environment still exists.

JA24-112 CMRS

DPMS.pdf

Procurement History.

• Contract Number: HC105023D0003

• Task Order Number: HC105024F0030

• September 11, 2024 – September 10, 2028

• Exception to Fair Opportunity

Page 4 of 5 Pages

CUI

CUI

J&A: CMRS Cloud

Page 4 of 5 Pages

The PMO is actively evaluating cloud-agnostic data aggregation solutions across various CSPs.

To overcome the technical barriers that currently necessitate this exception to fair opportunity, the Government is developing a comprehensive transition plan toward open-standards-based platforms. By strategically decoupling our core CMRS infrastructure from Microsoft-specific dependencies, the PMO aims to eliminate existing interoperability constraints and foster robust competition in future acquisitions.

Page 5 of 5 Pages

CUI

CUI

J&A: CMRS Cloud

Page 5 of 5 Pages

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Dee Rider SIGNATURE/DATE:

TITLE/ORGANIZATION: Program Manager, DISA, ACQ - CYBER PROGRAM

ACQUISITION EXECUTIVE (ID)

PHONE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Dee Rider SIGNATURE/DATE:

TITLE/ORGANIZATION: Program Manager, DISA, ACQ - CYBER PROGRAM

ACQUISITION EXECUTIVE (ID)

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: Darryl Boswell SIGNATURE/DATE

TITLE/ORGANIZATION: Contracting Officer/DISA/DITCO/PS8511

PROCURING ACTIVITY COMPETITION ADVOCATE (PACA) APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief. Since this justification does not exceed $100M, this review serves as approval and my written determination that the aforementioned FAR circumstances apply.

NAME: Andrea Horstmann SIGNATURE/DATE:

TITLE/ORGANIZATION: PACA

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

Jacob Sopiars, , jacob.m.sopiars2.civ@mail.mil