BNJ_MS Sentinel Implementation FY26_KO_COR Signed.pdf

CUI//SP-PROCURE//FEDCON

Control No: MICC-CB-2026 - 15<SAT

Memorandum for Record – Limiting Competition at or below the Simplified Acquisition Threshold

1. Requiring Activity: United States Army War College Chief Information Office

(USAWC CIO)

2. Contracting Activity: Mission and Installation Contracting Command - Carlisle Barracks (MICC-CB), 13 Lovell Ave., Carlisle PA 17013-5072

3. Description of Action:

Nature of Requirement: ☒ New ☐ Follow-on ☐ Extend

Brand Name: ☒ Yes ☐ No

Contract Vehicle: ☒ Purchase Order

☐ Blanket Purchase Agreement (BPA)

☐ Order/BPA against FSS Contract #

☐ Order against multiple award IDIQ Contract

☐ Order against a single award IDC Contract

☐ Modification to existing PO/TO/DO/Call Order

Pricing/Contract Type: ☒ Fixed Price

☐ Cost Reimbursable

Funds: FY: 2026

☒ Operations & Maintenance, Army (OMA)

☐ Other Funds:

Name of Proposed Contractor(s) and Address:

Microsoft Sentinel

4. Description of Services or Supplies: This procurement is for professional services to design, implement, and operationalize the Microsoft Sentinel platform within the USAWC’s Microsoft 365 (M365) higher education tenant. The requirement includes all labor, expertise, and deliverables necessary to provide a fully operational Microsoft Sentinel Security Information and Event Management (SIEM) solution, including:

• Discovery and assessment of the current M365/Azure environment

• System architecture and design, including a Solution Design Document (SDD)

• Full deployment and configuration of Microsoft Sentinel, onboarding of ~350 endpoints, analytics rule creation, and automation playbook development

• Knowledge transfer and administrator training, including all “as-built” documentation

Period of Performance:

Period Period of Performance (POP) Estimated Value

Base 15 Sep 2026 — 14 Sep 2027 $82,000.00

Total Value: $82,000.00

5. Authority: Select the appropriate authority below:

☒ FAR 12.201-1 For commercial acquisitions valued at or below the simplified acquisition threshold

6. Reasons for Authority Cited:

Microsoft Sentinel is the only SIEM platform that is fully integrated and natively supported within the USAWC’s existing M365 A5 tenant. The Government’s security, compliance, and operational requirements mandate a solution that leverages the full capabilities of the M365 A5 security stack, including seamless integration with Entra ID, Intune, and Microsoft Defender. Only Microsoft Sentinel provides this level of native integration, automated data ingestion, and compliance with NIST SP 800-53 and OMB M-21-31 event logging mandates without the need for third-party connectors or custom development.

Failure to approve this brand name justification would result in significant mission risk, including delayed threat detection, increased cost and complexity, and potential non-compliance with Federal cybersecurity mandates. Attempting to implement a non- Microsoft SIEM would require extensive reengineering, introduce integration gaps, and duplicate discovery/assessment efforts, leading to unacceptable delays and increased risk to the organization’s security posture.

7. Publicizing Contract Actions:

a. The public display and synopsis requirements of FAR 5.101(a) and FAR 5.101(d)

☐ do not apply, less than $20K threshold

☒ apply and will be followed

☐ do not apply due to an exception at FAR 5.101(b)(1)( )

8. Market Research: Extensive market research was conducted, including review of the existing M365 A5 contract, discussions with the current Microsoft 365 provider and analysis of the technical and operational requirements. The research confirmed that while the market for SIEM/SOAR services is competitive, only Microsoft Sentinel meets the Government’s need for a natively integrated, compliant, and supportable solution within the existing M365 tenant. No other product or service can be modified to meet these requirements without unacceptable duplication of cost and schedule.

Two Requests for Information (RFIs) were run on the CHESS platform, on the ITES- SW2 platform from 21 July 2026 until 28 July 2026 and the ITES-4H platform from 4 August 2026 until 10 August 2026; neither request produced any results. A Statement of Non-Availability on CHESS has been placed in the PCF cabinet. No other required platform (GSA, AbilityOne or UNICOR) supports the needs of this requirement.

9. Other Facts: N/A

10. Technical/Requirements Certification: I certify that the supporting data under my cognizance which are included in the justification are accurate and complete to the best of my knowledge and belief.

RYAN P. GRIMES

IT Procurement Analyst

11. Contracting Officer Certification/Approval: I hereby determine that the anticipated cost or price to the Government for this contract action will be fair and reasonable based upon price analysis. The basis for the determination will be based on the use of one of the price analysis techniques listed in RFO FAR 12.204. As a part of this basis, certified cost or pricing data is not required because the item and/or services being acquired are considered commercial.

I certify that this justification is accurate and complete to the best of my knowledge and belief, and that completing this purchase as a brand name specific acquisition is in the best interest of the Government. Additionally, I approve this justification to limit competition subject to the availability of funds and provided that the services or supplies herein described have otherwise been authorized for acquisition.

CHRISTINE CAIRO.

Contracting Officer

GRIMES.RYAN.PA

TRICK.1288030037 30037

CAIRO.CHRISTINE.

ANN.1039874390