CUI_ JA26-059_CCMD_28SEP26_Redacted.pdf

Source Selection Info1ma� See FAR 2.101 and 3.104

JUSTIFICATION FOR OTHER THAN FULL AND

OPEN COMPETITION (OTF AOC)

Federal Acquisition Regulation (FAR) Prut 6 Justification & Approval (J&A), Supporting Procurements tmder FAR Part 12 and FAR Part 15

CSS Tracking Number: Not Applicable Funding Document Number: Not Applicable Contract Number: HC104722D0002 Task/Delivery Order Number: Not Applicable Procurement Title: Defense Enclave Se1vices (DES) Estimated Value: $0.00 (action does not change the ceiling value of $11,504,145,490.57). The estimated value for the Combatant Coll1lllands (CCMD) discove1y and migration activities is ., based on the estimated value of previous Depaiiment of Wru· (DoW) Fotu1h Estate Agency and Field Activities (DAF A) migrations.

Regulatory Authority: l0U.S.C. 3204(a)(l ), FAR 6.103-1, Only one responsible source and no other supplies or services will satisfy agency requirements.

J&A Number: JA26_059

1. REOUffiING AGENCY AND CONTRACTING ACTMTY:

Requiring Agency: Defense Information Systems Agency (DISA)

Contracting Activity: Defense Info1mation Systems Agency (DISA) Defense Infonnation Technology Contracting Organization (DITCO) / PS64

2. NATIJRE/DESCRIPTION OF ACTJON(S):

Type of Action: Modification to expand the scope of the DES contract, HC104722D0002, to include the CCMDs.

Type of Contract: Single-award indefinite delive1y / indefmite quantity (ID/IQ) contract with £inn-fixed-price, labor-hour, and cost reimbursable line items.

3. DESCRIPTION OF SUPPLIES/SERVICES:

The DES ID/IQ contrnct is the enabling contract vehicle for DISA's consolidation of Collllllon Use fuformation Technology (IT) and services for the Non-classified Internet Protocol Router Network (NIPRNet) and Secure Internet Protocol Router Network (SIPRNet) domains for the Do W's Fomth Estate Agencies and Field Activities (DAF A). This centralization effort was directed by Deputy Secretaiy of Defense (DEPSECDEF) memorandum, dated 15 August 2019, entitled "Fomih Estate Network Optimization Execution Guidance", in which the DEPSECDEF

Page 1 of 8 Pages

J&A: HC104722D0002 Defense Enclaves Services (DES) ID/IQ granted DISA the authority to direct the transition of each DAFA from disparate, legacy Common Use IT services and assets into a single service provider (SSP) environment. DISA’s Common Use IT network is known as Department of Defense (DoD) Network (DoDNet).

Design, planning, and execution of migrations from legacy DAFA IT networks to the DoDNet occurs exclusively under the DES ID/IQ contract.

Expanding upon the Fourth Estate Network Optimization initiative, the DoW Chief Information Officer (CIO) issued a memorandum, dated 22 May 2026, (CIO000196-36), titled “Combatant Command (CCMD) Network Optimization Execution Guidance,” attached hereto, which provides, “DISA will execute migrations for all unclassified (NIPR) and classified (SIPR) Common Use Information Technology (IT) across Fiscal Years (FY) 2027 through 2028.” In November 2022, the then DoW CIO published a memorandum, “Zero-Trust Strategy1.0,” directing all Military Departments, Agencies and Defense Industrial Base partners to achieve zero-trust compliance by the 30 September 2027 deadline, with operational technology currently targeting FY2030. ” The zero-trust environment is an essential capability and requirement that provides the DoW the highest level of cybersecurity and drives the fundamental need and speed for CCMDs migration to the DoDNet environment. The DoDNet architecture is designed with a secure-by-design principle that integrates a zero-trust compliant network and provides seamless compliance once an organization migrates.

Additionally, the network security DoDNet gives the DoW is a foundational requirement, the need of which has only been intensified by the rapid acceleration and availability of frontier AI models. AI is fundamentally changing the execution of cybersecurity, and this change occurs at a different speed, scope, and scale than what was apparent even six months or a year ago. This change in threat is evidenced by Executive Order 14409, “Promoting Advanced Artificial Intelligence Innovation and Security”, dated 02 June 2026, which marks a critical shift toward hardening national security infrastructure against Artificial Intelligence (AI) driven threats. The DoDNet is essential to meeting this threat. The DoDNet is aimed at quickly reducing complexity of the operational and cyber environments through migration to a single service provider to respond to rapidly evolving technology, to include the enhanced threat aided by AI. The swift adoption of DoDNet positions the DoW to better secure, operate, and defend against the exponentially increasing cyber threat.

DoDNet standardizes the common IT network architecture, ensuring compliance with zero-trust requirements, while integrating with enterprise tools that enhance security, operations, and defense of the overall DoW Information Network (DOWIN). Based on the timeframe to complete migrations of CCMDs to DoDNet by the end of FY2028, as directed by the DoW CIO, and the need to keep pace with AI enable cyber adversaries, Leidos Corporation (Leidos) is the only responsible source to complete the migrations for the CCMDs. Utilizing the DES ID/IQ, would facilitate the accelerated execution of the CCMD migrations, at the speed, scope, and scale necessary. CCMDs that are not leveraging DoDNet risk non-compliance with the zero-trust mandate, which weakens the strength of a unified Warfighter network and compromises national security.

Upon completion of migration, the preponderance of operations and sustainment activities will be transitioned to the Government.

Page 2 of 8 Pages

Page 3 of 8 Pages

4. IDENTIFICATION OF STATUTORY AUTHORITY:

The United States Code (U.S.C.) and FAR reference permitting other than full and open competition: 10 U.S.C. 3204(a)(1), FAR 6.103-1, Only one responsible source and no other supplies or services will satisfy agency requirements.

5. DEMONSTRATION OF CONTRACTOR’S UNIQUE QUALIFICATIONS:

A. UNIQUE QUALIFICATIONS:

The single-award DES ID/IQ contract was competitively awarded to Leidos on 28 February 2022 in response to the above-referenced memorandum of 15 August 2019 by the Deputy Secretary of Defense titled “Fourth Estate Network Optimization Execution Guidance”. The memorandum authorized DISA to direct the transition of each DAFA from disparate, legacy Common Use IT services and assets into the SSP shared network environment.

Incumbent Expertise: Leidos is uniquely qualified to provide the highly specialized services required to execute the CCMD migrations due to its embedded and specialized knowledge of the DoDNet architecture. Leidos has gained this knowledge through migrating over 40,000 users to DoDNet in four years. Since the award of DES to Leidos in 2022 and through execution of innovative engineering task orders, the program incorporated automation scripts that ultimately resulted in the successful scaling to migrate 14 DAFAs concurrently (in some cases utilizing a regional approach) and supporting over 40,000 users across approximately 900 sites.

The DoDNet architecture and services required include performing both network and endpoint discovery; migration planning; executing migration activity in parallel with physical hardware refresh; conducting automated endpoint migration; and implementing training and adoption measures that support uninterrupted mission operations. Leidos possesses the crucial requisite institutional knowledge of the "as-built" environment and utilizes automation scripts adapted for DoDNet, that have been developed specifically to enable faster user migration and onboarding to DoDNet baseline than traditional methods. In 2022, DoDNet was deployed across the Defense POW/MIA Accounting Agency (DPAA), onboarding approximately 800 users within three months. Comparatively, Defense Contract Management Agency (DCMA) was one of the first DAFAs to be migrated using developed endpoint automation and ~800 users were onboarded in only two weeks. The DCMA migration was executed at least six times faster than without the automation of endpoint migrations and the overall production endpoint migration of ~5000 users DCMA was completed in three months. This approach ultimately ensures the necessary technical continuity required for DISA and the CCMDs to meet the DoW CIO’s FY2028 migration timeline.

Page 4 of 8 Pages

B. IMPACT:

1) Mitigation of Critical Schedule Risks:

DoDNet migrations are mission critical as they deliver the standardized, zero trust architecture required to safeguard the DoWIN and execute high-speed defensive cyber operations. Immediate adoption of DoDNet across all CCMDs is critical to national defense, particularly in light of sophisticated AI-driven cyber threats targeting the DoW. Therefore, rapid migration is no longer optional; it is an immediate operational requirement Transitioning to a unified service provider via DoDNet eliminates operational friction and simplifies complex cyber ecosystems in response to fast-evolving threats. Timely implementation bolsters the DoW’s overall cyber readiness, ensuring our forces can confidently operate, adapt, and fulfill the mandate of defending the Nation amid an exponentially compounding threat landscape.

The DoDNet architecture is highly complex, and a new vendor would face an unacceptably steep learning curve necessary to assume full technical responsibility, introducing high risks of operational disruption and further schedule slips as they ramp-up to onboard technical Subject Matter Experts after award, and gain understanding of the complexities of the DoDNet environment and architecture which, as the incumbent contractor, Leidos currently understands. This is proven by the agency’s previous attempts to leverage other vendors with knowledge of the existing user-base to migrate at a smaller scale. It has been demonstrated that in order to migrate without any delay, any other vendor would need access to the migration script author in order to effectively adapt the DoDNet automation scripts, Active Directory schemas, and Identity, Credential, and Access Management (ICAM) structures that currently exist within DoDNet. Even with institutional knowledge of an existing user-base, any vendor other than Leidos would inevitably face this exact technical discovery barrier and code-refactoring requirement. The code-refactoring of the DoDNet architecture would need to occur first before any adaption of automation scripts could occur, which under the current compressed timeline is technically infeasible and introduces an unacceptable risk of operational failure to the CCMDs migrations. This learning curve and adapted-engineering efforts would delay network and user migrations beyond 2028 and jeopardize the CCMD modernization mandate, which are both intolerable operational outcomes.

Leidos has the institutional knowledge of the DoDNet architecture that enables them to rapidly adapt the DoDNet automation scripts to accelerate migrations. As such, Leidos is the only responsible source capable of meeting the DoW CIO migration deadlines (FY2027/FY2028), in place to migrate the DoW to a zero-trust compliance environment and provide network security that has been exacerbated by AI. Transition to a new contractor would result in unacceptable delays in fulfilling the agency's critical requirements. These delays will limit the successful and timely completion of the expanded migration tasks to the CCMDs.

2) Avoidance of Duplicative Costs and Effort:

Awarding this effort under full and open competition will result in a duplication of cost of approximately $15M. This estimate is based on the cost of adapting engineering efforts to existing configurations, and the recreation of tools, techniques, and processes (TTPs). The configurations and TTPs that have led to the successful migrations of the DAFAs to the DoDNet thus far, were established under DES Task Orders HC104722F0022, HC104723F0004, and HC104724F0005.

Competing the requirements to migrate CCMDs, as mandated by the DoW CIO, would require duplicate engineering activities, referenced above, to automate the endpoint migrations and for which have a direct impact on the ability to accelerate migrations. Additionally, activities to integrate, train, and perform knowledge transfer between Government and a new contractor would be required, directly impacting the ability to meet the DoW CIO mandated timeline and also adding cost to the Government that cannot be reasonably mitigated through competition. Consequently, opening the migration of CCMD to competition would be inefficient and impractical.

6. DESCRIPTION OF THE EFFORTS MADE TO ENSURE THAT OFFERS ARE

SOLICITED FROM AS MANY SOURCES AS POSSIBLE:

No previous announcement has been publicized for this contract action. A Sources Sought Notice (SSN) and Amendment 01 was posted to SAM.gov with additional details provided in Section 8 below.

In accordance with FAR 6.103-1, Only one responsible source and no other supplies or services will satisfy agency requirements.

7. DETERMINATION OF FAIR AND REASONABLE COST:

This contract action does not increase the existing DES ID/IQ ceiling value or the established ceiling labor rates, which were previously determined fair and reasonable via adequate price competition. The estimated value for the CCMD discovery and migration activities is , based on the estimated value of previous DAFA migrations. Task orders supporting CCMD requirements will be negotiated on an individual basis, with the Contracting Officer determining price reasonableness in accordance with FAR 15.404.

8. MARKET RESEARCH:

DISA conducted comprehensive market research to identify potential sources capable of performing complete CCMD migrations to DoDNet. This assessment focused on whether these sources could execute the migrations within the aggressive timeframe mandated by the DoW CIO to ensure the defense-wide cyber readiness that is required to equip our forces with the agility and resilience required to operate effectively and defend the Nation across an increasingly volatile cyber domain.

Page 5 of 8 Pages

Market research leveraged Government knowledge and a survey of the market to ascertain vendors’ capabilities of conducting migrations based on their institutional knowledge of the active user-base. The objective was to determine if this existing user-base expertise was sufficient to seamlessly migrate DAFAs to DoDNet, without operational delays. This review demonstrated that without institutional knowledge of the DoDNet architecture, governance processes, and automation scripts, the Government would be required to dedicate time towards training and facilitating the adoption of these processes, and in the cases reviewed, resulted in either schedule delays or incomplete processes. This includes capabilities such as re-imaging and configuring devices into the DoDNet architecture. While the capability to re-image and configure devices is a capability many vendors have and should be able to perform at an existing/active user-base, has proven to be a complex process within the DoDNet architecture, requiring Government provided training and access to the automation script authors.

Furthermore, a SSN was posted on SAM.gov on 27 July 2026 and closed on 04 August 2026 in order to obtain information directly from industry regarding their capabilities to meeting five capability areas: (1) Foundational Technical Capabilities (e.g., ability to use and leverage existing DoDNet tools, automation scripts, and migration execution; (2) Technical and Schedule Feasibility (e.g., ability to provide risk informed master schedule supporting migration of all CCMDs by FY2028); (3) Transition, Ingestion, and Ramp-Up Timeline (e.g., ability to rapidly field a globally deployable workforce and limit transition risk); (4) Comprehensive Cost Estimate; and, (5) Risk Mitigation and Experience. Responses were reviewed and based on the information provided, Amendment 01 to the SSN was posted on SAM.gov on 27 August 2026 and closed on 28 August 2026. This Amendment was given a quick turnaround time as it only requested follow-up examples in three areas that supplemented responses initially submitted against the five aforementioned capability areas. The examples were requested to further review the capabilities of the market and emphasized the need for (1) demonstrated capability in migrating an environment a vendor does not currently manage and timelines associated with that successful example; (2) an example of performing automated migrations; and, (3) the vendor’s existing training and adoption strategy that could be deployed to accelerate migrations.

In each of the submitted responses other than Leidos, either an example was not provided; the information provided was not to the scale required; tools were referenced that indicated a lack of understanding of the requirement; a risk mitigation or capabilities response included a piecemeal approach to either migrating endpoints or migrating the network; and/or the response did not include the necessary automations to accelerate migrations.

Based on the market research conducted, the Government identified only one source having both automated endpoints and networks migration capability, with the specialized knowledge to DoDNet, necessary to meet the Government’s requirement within the required timeframe.

9. ANY OTHER SUPPORTING FACTS:

None.

Page 6 of 8 Pages

Page 7 of 8 Pages

10. LISTING OF INTERESTED SOURCES:

After reviewing the information provided by the twenty-four respondents, no other vendor provided responses that demonstrated it could provide these services to the scale, magnitude, and speed required by the Government. More specifically, no other respondent, other than Leidos, was able to illustrate an approach that mitigated technical risk associated with conducting both automated endpoint and network migrations and implementing training and adoption measures that support uninterrupted mission operations.

Twenty-four (24) companies responded to the Sources Sought including: Accenture Federal Services LLC; Age Solutions LLC; Aventec Systems; Booz Allen Hamilton; C4 Planning Solutions LLC; Capgemini Government Solutions LLC; DH Technologies Inc.; DivineGuard IT Services LLC; Enhanced Veterans Solutions Inc.; Enspyre Management Services; Empower AO Inc.; General Dynamics Information Technology Inc.; Leidos Inc.; Kaiyuh Information Technologies; Peraton Inc.; Pivotal Point LLC; Project Cues; Resolute Solutions; Science Applications International Corporation; Semper Made LLC; Shield Protocol LLC; SHR Consulting Group LLC; TFG Technology Solutions LLC; and ValidaTek Inc.

11. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FULL AND OPEN COMPETITION:

1. Procurement History.

a) HC104722D0002, 05 July 2022 through 04 July 2032. Ceiling value of $11,504,145,490.57.

b) Full and open competition in accordance with FAR Parts 12 and 15.

2. Actions to remove or overcome barriers that led to the exception of full and open competition: Not applicable.

Page 8 of 8 Pages

SIGNATURE/DATE:

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME:

TITLE/ORGANIZATION:

PHONE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE/DATE:

TITLE/ORGANIZATION:

PHONE:

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: Silvia Molinillo-Corral SIGNATURE/DATE:

TITLE/ORGANIZATION: Contracting Officer/SS/PSD/PS64

PHONE:

SENIOR PROCUREMENT EXECUTIVE APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief. This review serves as approval.

NAME: Christopher Barnhurst SIGNATURE/DATE:

TITLE/ORGANIZATION: Deputy Director, DISA

PHONE:

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

Silvia Molinillo-Corral, at silvia.molinillo-corral.civ@mail.mil.