ETFO - NIPR Cloud Data Platform - Redacted.pdf

DEFENSE THREAT REDUCTION AGENCY

8725 JOHN J. KINGM AN ROAD, STOP 6201

FORT BELVOIR, VA 22060-6201

EXCEPTION TO FAIR OPPORTUNITY JUSTIFICATION

1. Nature and/or Description of the Action

The Defense Threat Reduction Agency’s Information Technology Directorate (ITD) has a need to procure cloud services to support the DTRA Enterprise Data Platform (DEDP) through the DoD’s Joint Warfighter Cloud Capability (JWCC) contract. The JWCC is a multiple-award Indefinite-Delivery, Indefinite Quantity (IDIQ) contract vehicle that provides DoD-wide access to Cloud Service Offerings (CSO). The DoD Chief Information Officer (CIO) issued a memorandum on 02 August 2023 requiring Defense Agencies and Field Activities (DAFAs) to use the JWCC contract vehicle for all available offerings to procure future enterprise cloud computing capabilities and services.1

DISA awarded JWCC contracts to four Cloud Service Providers (CSP): Amazon Web Services (AWS), Google Support Services LLC, Microsoft Corporation, and Oracle America. The ordering agency’s requirements are competed among all four CSPs unless exceptions to JWCC’s fair opportunity process under FAR 16.505(b)(2) apply.2

2. Description of the Supplies/Services Required

This is a new requirement to implement a DTRA enterprise-wide data platform on a modernized cloud platform by leveraging cloud services for DevSecOps, Data Services, Artificial Intelligence (AI), Machine Learning, Data Science, and Business Continuity/Disaster Recovery (BC/DR). This requirement is the initial phase of cloud services implementation within a cohesive architecture that spans NIPRNet (Unclassified/CUI) to SIPRNet (Secret), JWICS (TS- SCI), on-premises and off-premises, to provide a hybrid-cloud data platform that extends seamlessly across domains. Requirements for SIPRNet and JWICS cloud services will be addressed in separate FY26 and FY27 JWCC requests, which must be architecturally consistent with the base NIPRNet service. While this initial procurement starts with unclassified cloud services to build a base capability, the overarching programmatic and technical requirement is to achieve architecture parity at all three levels of cloud service.

The DEDP’s fundamental purpose is to ingest, extract, translate, load and serve data from disparate databases, systems, and files currently stored in disconnected, segregated, or otherwise incompatible systems and networks across the DTRA enterprise. The system includes a requirement to ingest data irrespective of sensitivity or restriction, allowing the DEDP to provide a single source of data and analytics to DTRA mission operations. At the same time, DEDP and the underlying cloud infrastructure must support handling data according to the originating

1 DoD CIO Memorandum for Senior Pentagon Leadership, Commanders of the Combatant Commands, Defense Agency and DoD Field Activity Directors, “Department of Defense Joint Warfighting Cloud Capability and Next Steps to Rationalize Cloud Use Across the Department of Defense,” 02 August 2023.

2 JWCC Base Contract, Section G4: Task Order Procedures, page 164.

organization’s (e.g., Department of Energy, combatant command, etc.) data source policies. AI-enabled analytical applications will reach into the DEDP data lake to serve responses that contain value-add analysis, inferences, and data aggregation. This capability will relieve users of the current burden and limitations associated with locating and leveraging disparate data repositories.

Unique or specialized requirements at cloud Impact Level (IL) 4 or higher:

1. CSP with experience and authorization to process nuclear and restricted data types according to Department of Energy (DOE) specifications (i.e., an RD/FRD technical controls overlay currently is in process) and a current path towards DOE data handling authorization. This is essential to creating the ability to ingest and serve all DTRA CWMD data and products, regardless of sensitivity or restriction.

2. Availability of bi-directional cross-domain services to transfer data, code, and other artifacts between classification levels, which will enable DTRA’s build-low, deploy-high software and data sciences development models that span all classification levels.

3. DTRA requires a minimum of “seven 9s” (i.e., .9999999 of annual data durability and service availability) or higher for data durability and service availability at higher levels to provide reliable service to CWMD combat support and crisis operations.

4. Consistent architecture design and services mirrored across all classification levels to enable effective and efficient extension of capabilities seamlessly across all domains and between on-premises and cloud infrastructures.

Anticipated Periods of Performance (PoP):

The TO will consist of a base year plus two option years with performance anticipated to begin 9/26/2025. Total Firm-Fixed Price (FFP) for each year is . Total TO cost will be for all three years.

3. Exception to Fair Opportunity

Pursuant to FAR 16.505(b)(2)(i)(B), the order must be issued on a sole-source basis because only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

4. Justification Rationale

Market research indicates that AWS is the only CSP that satisfies DTRA’s complete set of CWMD data platform requirements.

1. Key to this requirement is DOE authorization to store and process CWMD data sets that include restricted data types, such as DOE Restricted Data (RD) and Formerly Restricted Data (FRD). Market research indicates that only AWS will meet this requirement. DOE granted DTRA authority to process those data types in on-premises systems. Given that this is a hybrid system with components on premises and in the cloud, the extension to the cloud must have the same data authorizations as on-premises systems. In a cloud environment, processing restricted data types requires additional approvals based on a control overlay that is not applied to the base cloud infrastructure. The additional approvals can take years to obtain.

Inability to create a comprehensive data set of all DTRA CWMD data types could render the DEDP ineffective and could reduce the effectiveness of DTRA operations that utilize the DEDP. User queries and AI-enabled analytics would return incomplete or potentially misleading responses that omit critical data. Users would be required to manually search and incorporate data from other repositories located across the DTRA enterprise.

Limitations such as these could defeat the purpose of having a DEDP and could negate the value of DTRA’s investment in this system.

2. Market research indicates that only AWS offers the required bi-directional cross-domain services to transfer data, code, and other artifacts between classification levels. Cross-domain services exist on premises. Lack of those services in the cloud will impede DTRA’s build-low, deploy-high development models that span all classification levels.

Developing and training Large Language Models (LLM) and AI applications require rapidly iterative development. Rapid bi-directional transfer is essential to moving code to the domains where the data are stored.

3. Market research indicates that only AWS provides a minimum of “seven 9s” (i.e., .9999999 of annual data durability and service availability) or higher for data durability and service availability at higher levels. This availability requirement provides reliable service to DTRA CWMD combat support. It reduces the risk of data loss, interruption of services, and reduces the need for complex or lengthy restoration procedures that could interrupt system availability during critical or crisis operations.

4. AWS is the only service that consistently meets overarching programmatic, technical, and architectural requirements across all three classification levels. A lack of consistency, defined by operating different CSPs at each classification level, will impact migration to the cloud and can introduce unnecessary complexity, costs, risks, and workforce training requirements. Each CSP provides tools, operating procedures, applications, and services that are uniquely designed for the CSP’s proprietary service offering. By carefully planning and implementing a migration strategy that focuses on achieving architectural consistency, DTRA can reduce risk, enhance business continuity, and maximize efficient, secure operations.3

5. Market Research

This J&A is based on technical requirements for DTRA’s DEDP. IT conducted market research and technical reviews to determine which, if any, JWCC CSPs can meet DTRA’s requirements.

Market research activities included the following:

Review published JWCC CSP technical documentation and distilled the information into a service comparison between the four CSPs.

3 A 2024 HashiCorp State of Cloud Strategy Survey indicates that only 8% of organizations achieve high cloud maturity, defined in part by adopting and standardizing best practices across the infrastructure lifecycle. The survey suggests that a significant portion of organizations may experience challenges in maintaining consistent cloud architectures, leading to "architecture drift." Architecture drift occurs when the implemented architecture diverges from the intended design, potentially causing performance issues, security vulnerabilities, or increased costs.

Technical exchanges and discussions with CSP technical personnel to confirm CSO capabilities relative to DTRA’s requirements.

Verified and captured DEDP cloud service requirements in the DISA DAPPS tool and in DISA’s published pricing calculators.

Use of existing IT organizational experience with cloud services and providers.

6. Other Supporting Facts

N/A

7. Subsequent Actions

There are no actions the Agency can take to remove or overcome any barriers that led to restricting consideration before any subsequent acquisition of the supplies or services was made.

The requirements are the minimum essential requirements to meet mission criteria. As the Government is directed to use JWCC for these types of services and had no influence over what is provided on JWCC, AWS is the only company on that platform that can meet DTRA’s requirements. Market research indicated that the other JWCC CSPs have not begun or have not made significant progress on the multi-year effort to gain required data handling authorizations.

This suggests that required services will not be available on a timeline that meets DTRA’s technical and procurement schedules.

Technical Certification I certify that the data and information forming the basis for this determination are accurate and complete to the best of my knowledge and belief.

Program Manager/Project Officer

Contracting Officer Certification and Determination I certify that this justification is accurate and complete to the best of my knowledge and belief.

Additionally, I determine that the order represents the best value consistent with Federal Acquisition Regulations.

Contracting Officer

General Counsel Coordination This justification is legally sufficient.

Associate General Counsel

Approval Based on the above justification, I hereby approve accomplishment of this acquisition as an exception to fair opportunity.

Head of the Contracting Activity