E20 SteelCloud Software (JA)_Redacted..pdf

CUI

JUSTIFICATION FOR EXCEPTION TO FAIR OPPORTUNITY

Revolutionary FAR Overhaul (RFO) Federal Acquisition Regulation (FAR) Subpart 16.5

Justification and Approval (J&A), Supporting Procurements under RFO FAR 16.507-7(a) (Brand Name)

Purchase Request Number: HQ0516629919 Contract Number: TBD (To be assigned at award) Task/Delivery Order Number: TBD Procurement Title: SteelCloud Cybersecurity Software Services Estimated Value: (including options) Statutory and Regulatory Authority: 10 U.S.C. 3406(c)(5) and RFO FAR 16.507-7(a)

Justification Number: 26-1046

Upon the basis of the following justification, I, as the Agency Competition Advocate, hereby approve this brand-name justification for the proposed contractual action pursuant to the authority of RFO FAR 16.507-7(a) as the particular brand-name, product, or feature is essential to the Government’s requirements; and market research indicates other companies’ similar products, or products lacking the particular feature, do not meet, or cannot be modified to meet, the agency’s needs.

1. REQUIRING ACTIVITY AND CONTRACTING ACTIVITY:

Requiring Activity:

War Media Activity Mission Support/Network Operations 6700 Taylor Ave Fort Meade, MD 20755

Contracting Activity:

War Media Activity Headquarters Acquisition and Procurement Directorate 6700 Taylor Avenue Fort Meade, MD 20755

2. NATURE/DESCRIPTION OF ACTION(S):

The War Media Activity (WMA), Acquisition and Procurements (A&P) Directorate in support of Mission Support, Network Operations (MS/NetOps), proposes to issue a new delivery order on a brand-name commercial basis under NASA SEWP for commercial of the shelf (COTS) software licenses, maintenance, and technical support services for SteelCloud ConfigOS. This is a Firm-Fixed Price (FFP) delivery order utilizing fiscal year 2026 (FY26) Operations and Maintenance (O&M) funds.

Page 1 of 7 Pages

Controlled By: WMA Controlled By: Mission Networks CUI Category: PROCURE Distribution/Dissemination Control: FEDCON

POC:

Page 2 of 7 Pages

Period of Performance: One (1) 12-Month Base Period from Sep 30, 2026, through Sep 29, 2027with four (4) 12-Month Option Periods through Sep 29, 2031, plus an evaluated six-month option to extend services pursuant to FAR 52.217-8.

3. DESCRIPTION OF THE SUPPLIES OR SERVICES:

There is an absolute mandate from the Department of War (DoW) to continuously enforce hardened cybersecurity configurations across all operational assets. In accordance with this directive, all War Media Activity (WMA) workstations, enterprise servers, and network infrastructure must strictly adhere to the Defense Information Systems Agency (DISA) standards outlined in the Security Technical Implementation Guides (STIGs). Executing automated STIG compliance and generating validated readiness telemetry is an ongoing operational requirement to maintain WMA's Authority to Operate (ATO), mitigate vulnerabilities, and ensure mission-critical media broadcasts without risk of cyber intrusion. The current manual hardening process is labor-intensive and prone to human error, creating a need for an automated solution.

In accordance with FAR 52.217-8 (Option to Extend Services), an option to extend services for up to six (6) months is included in this procurement to ensure mission continuity and uninterrupted DISA STIG policy compliance during any transition period. For the purposes of evaluation, the Government will evaluate the Option to Extend Services by adding one-half (1/2) of the total proposed price for the final option period to each offeror's total price for the basic requirement and all other priced options. This creates the Total Evaluated Price (TEP). As stated in FAR 52.217-8, if the Government elects to exercise this option, the contractor shall provide the services for the extended period at the rates in effect at the time the option is exercised. The evaluation of this option does not obligate the Government to execute the option.

4. SUPPORTING RATIONALE FOR BRAND-NAME JUSTIFICATION: (FAR 16.505(b)(2)(ii)(B)(4))

WMA must maintain rigid compliance with DISA STIGs to retain its ATO on DoW networks.

Currently, WMA suffers from an intensive, manual hardening process that is prone to human error and consumes substantial technical labor. WAM requires the following specific brand-name items from SteelCloud to meet its automation and compliance needs:

Item # Part Number Manufacturer Description Qty

004 54

Page 3 of 7 Pages

(a) SteelCloud's ConfigOS is uniquely qualified to satisfy this requirement for the following reasons:

• Patented Remediation Engine: Unlike basic compliance scanners (such as DISA's SCAP Compliance Checker), ConfigOS does not merely identify compliance failures; it automatically remediates and hardens non-compliant configurations in seconds without disrupting operating system stability. Market research confirms that while other tools can scan for compliance, no other available tool provides this essential, automated remediation and hardening capability in a manner that integrates with WMA's approved architecture.

• eMASS Integration: ConfigOS features native integration with the Enterprise Mission Assurance Support Service (eMASS), allowing it to translate scans into fully populated compliance packages, eliminating hundreds of manual administrative hours.

• Direct Architecture Approval: SteelCloud is already vetted, approved, and operating within several external enclaves of the WMA. Utilizing a non-approved tool would introduce security vulnerabilities, violate DISA architecture guidelines, and delay automation implementation by 12–18 months during the approval process.

(b) After conducting market research, the government did not identify any other cybersecurity compliance tools that utilize a patented ConfigOS software. SteelCloud software is the only automated compliance utility approved and operated within WMA's Net Ops enclaves.

(c) While standalone enclaves within WMA have previously purchased standalone, ad-hoc

SteelCloud software subscriptions on an individual basis, this acquisition integrates and consolidates the Net Ops compliance footprint under a single, unified enterprise delivery order.

(d) If the Government is unable to obtain the brand-name SteelCloud ConfigOS MPO software suite, the War Media Activity (WMA) will face immediate, severe, and detrimental impacts to its cybersecurity readiness and operational broadcasting mission.

Specifically, the loss of this brand-name capability will result in the following mission-critical failures:

a. Loss of Authority to Operate (ATO) and Mission Shutdown: Without SteelCloud's rapid automation, WMA will be unable to maintain continuous compliance with the hundreds of mandatory DISA STIG controls required for its workstations, Windows/Linux servers, and Cisco network devices. Failing to meet these strict DoW compliance windows will result in the immediate revocation of WMA's ATO, forcing a complete shutdown of secure military media broadcasts and communication networks.

b. Severe Cybersecurity Vulnerability Window: SteelCloud ConfigOS is the only COTS tool capable of remediating and rolling back STIG controls in

. Without this specific brand, WMA’s systems will remain exposed to cyber-attack vectors for weeks or months while administrative staff

Page 4 of 7 Pages attempt manual hardening—creating an unacceptable security risk to the Department of War (DoW) information network.

c. Catastrophic Administrative and Manual Labor Burden: Hardening a single enterprise server or database against DISA STIGs manually requires between 40 to 80 highly skilled engineering hours. For WMA's footprint (550 workstations, 195 enterprise servers, and Cisco network infrastructure), manual remediation would require a massive, unsustainable surge in cybersecurity personnel. The loss of SteelCloud would divert critical IT staff away from operational network defense to perform manual checklist entry, paralyzing WMA’s technical support office.

d. Inability to Integrate with DoW eMASS: SteelCloud ConfigOS holds the unique, brand-specific capability to natively output validated compliance telemetry directly into formatted CKL checklist files. These files are required for direct ingestion into the DoW Enterprise Mission Assurance Support Service (eMASS) repository. The loss of this automated integration would break WMA’s compliance pipeline, forcing manual transcription of thousands of security controls, resulting in human error, delayed reporting, and non-compliance status.

In summary, denying the procurement of the brand-name SteelCloud ConfigOS MPO software directly threatens WMA’s ability to secure its systems, sustain its ATO, and execute its core mission of broadcasting secure, uninterrupted military media.

(e) This requirement is not for a bridge contract or contract extension.

5. PRICE FAIR AND REASONABLE DETERMINATION:

The Contracting Officer will determine the proposed pricing to be fair and reasonable in accordance with RFO FAR 15.404-1(b) by evaluating competitive price quotations obtained through a brand-name competitive Request for Quote (RFQ) issued across authorized commercial resellers on the NASA SEWP V GWAC, leveraging adequate price competition among certified small-businesses. Also, price reasonableness will be substantiated by comparing proposed quotes against the Independent Government Cost Estimate (IGCE)..

6. MARKET RESEARCH:

The market research confirmed that while SteelCloud LLC is the sole developer and owner of the intellectual property for the required ConfigOS software, the product is commercially distributed through an extensive network of authorized resellers. A query of the NASA SEWP V Government-Wide Acquisition Contract (GWAC) identified thirty-eight (38) total authorized vendors. This competitive pool includes twenty-one (21) approved small businesses across various socioeconomic categories, confirming that a competitive small business set-aside is a viable acquisition strategy.

This requirement is for a proprietary product and its associated support, and no other competitor's product provides a functionally equivalent, automated remediation engine that is already approved for use on WMA networks. The Government will continue to conduct market

Page 5 of 7 Pages research for future requirements to determine if there are changes in the marketplace that would enable future competitive actions, such as the emergence of similar products, the release of proprietary rights by the manufacturer, or if it becomes economically feasible to procure and accredit an entirely new system.

7. ANY OTHER SUPPORTING FACTS:

No other supporting facts are necessary. The information provided in the preceding sections is sufficient to justify this brand-name action.

8. ACTIONS THE AGENCY MAY TAKE TO OVERCOME BARRIERS THAT LED TO THE

UTILIZATION OF A BRAND-NAME PRODUCT:

a. Lifecycle of the current architecture.

The current requirement is for enterprise-wide implementation of SteelCloud's ConfigOS software to meet a DoW mandate for automated cybersecurity compliance and STIG remediation. The planned total contract lifecycle of five years (a 12-month base period plus four 12-month option years), which aligns with the standard technology refresh cycle for enterprise cybersecurity tool.

While market research has confirmed that no functional equivalent currently exists that can meet the Government's immediate and unique technical requirements, the Government is committed to fostering future competition. We will conduct market research annually to identify new and emerging technologies. It is anticipated that the follow-on acquisition, planned for award in approximately five (5) years, will be conducted on a full and open competitive basis, assuming the marketplace has produced viable alternatives that have obtained the necessary DoW security approvals.

b. Actions to remove barriers

The Government will take the following actions to overcome any barriers that led to this brand name justification:

The Government is committed to ongoing market research throughout the lifecycle of this contract. We will continue to monitor the marketplace for new and emerging cybersecurity compliance tools. If an alternative product is identified that can provide the same patented, automated STIG remediation and native eMASS integration as SteelCloud's ConfigOS, the Government will conduct a technical review to assess it as a viable competitor for future requirements.

Prior to exercising the final option year on this contract, the Government will conduct a comprehensive market analysis to determine if the marketplace has evolved. If other products have emerged that meet the agency's technical requirements and have obtained the necessary security approvals for use on DoW networks, the follow-on requirement will be competed on a full and open basis.