JA 852674572 AMD01 Redacted.pdf

CUI

Controlled by: DISA Controlled By: J-92 CUI Category: OPSEC Distribution/Dissemination Control: FEDCON

POC: DAVID LAGO,

JUSTIFICATION & APPROVAL FOR FEDERAL ACQUISITION

REGULATION SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Contract

Orders under Fair Opportunity Federal Acquisition Regulation (FAR) 16.507-6(b), Defense FAR Supplement 216.507-65(b), Procedures, Guidance, and Information 216.507-65(b)

Purchase Request Number: HC110426MPC0135 Joint Warfighting Cloud Capability (JWCC) Contract Number: HC105023D0003 Contract Support System Tracking Number: 852674572 Procurement Title: Olympus: Foundations II

Statutory and Regulatory Authority: 10 United States Code (U.S.C.) 3204(a) and FAR 16.507- 6(b)(2)

EXCEPTION TO FAIR OPPORTUNITY

Number: Not Applicable

Upon the basis of the following justification, I, as the Contracting Officer, hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C. 3204(a) and Regulatory Authority of FAR 16.507-6(b)(2)

1. REQUESTING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

Defense Information Systems Agency (DISA) / J9 - HOSTING & COMPUTE (HC) 2530 Crystal Drive, Suite 3E26 Arlington, VA 22202

Contracting Activity:

DISA/Defense Information Technology Contracting Organization (DITCO)/Cloud Capabilities Section (PS8511) 2300 East Drive Scott Air Force Base, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

AMD01: The purpose of this amendment is to increase the value by This increase is due to Mission Partner not accounting for max usage of virtual machines for potential future growth of the requirement. Microsoft’s solution increased the number of licenses from 162 to 309. The Government requires growth but did not originally include this in their Independent Government Cost Estimate (IGCE).

Olympus: Foundations II

Page 2 of 6 Pages

CUI

This action is to issue a firm-fixed-price TO against the JWCC Indefinite Delivery/Indefinite Quantity Contract for Olympus: Foundations II. This TO will be issued directly to Microsoft Corporation. The anticipated period of performance (PoP) is for a 1-year base period, plus one 1-year option period and one 7-month option period. The total estimated value is which will be funded by Working Capital fund.

3. DESCRIPTION OF SUPPLIES/SERVICES:

Olympus is a managed platform and common services provider in the commercial cloud. The goal of Olympus is to make it easier for customers to adopt the commercial cloud by managing the underlying infrastructure and services on their behalf, allowing them to focus on their workload's applications and data.

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity.

FAR 16.507-6(b)(2) - Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(b) Description of the Justification.

Microsoft is uniquely qualified to be a foundational Cloud Service Provider (CSP) for Olympus due to its capabilities in identity, cloud native application protection platform services, cloud posture management, security event information management and multi-tenant constructs and automation.

(c) Justification.

(1) Minimum Government requirements.

The cloud service offerings must continue at their current level in order to support Olympus. These offerings include Security Information Event Management (SIEM) and Security Orchestration and Automation Response (SOAR) tool, Cloud Native Application Protection Platform (CNAPP), Cloud Posture Management, Entitlement Management, NIST 800-53 & CIS Benchmarks Policy as Code (PaC) baseline, Organizational Constructs and automation, Generative Artificial Intelligence, Virtual Machines, Managed Kubernetes, and Managed Databases.

(2) Proposed sole source contractor.

Microsoft Corporation

Page 3 of 6 Pages

CUI

(3) Discussion regarding the cause of the sole source situation.

The only source capable of providing the required foundational capabilities for DOD Olympus is the incumbent contractor, Microsoft. The refactoring of the current environment from the Microsoft environment to another CSP would result in additional cost of and delay the project 6-9 months to develop approximately 25,0000 lines of automation code that is unique to that CSP as well as the cost of third party tools to fill the gap in areas where there is no CSP native offering. In addition, Olympus would have to be shut down which would impact the modernization of a critical customer, Enterprise Email Security Gateway (EEMSG) which secures the daily email of millions of Department of War users.

(4) Demonstration of unique source.

Microsoft is uniquely qualified to be a foundational CSP for Olympus due to its capabilities in identity (Azure Entra), cloud native application protection platform services (Microsoft Defender for Cloud), cloud posture management (Azure Policies), security event information management (Microsoft Sentinel), Generative AI (Azure OpenAI), multi-tenant constructs and automation (Azure Organizations and Lighthouse).

No other CSP has all these offerings, making Microsoft the only contractor capable of performing the necessary services.

(5) Procurement discussion.

The only source capable of performing Olympus at the level of quality required is the incumbent contractor, Microsoft. Rebuilding all the automation from the current environment to another CSP would result in additional cost and schedule. Migration from one platform to another would cost and delay the project 6-9 months.

(6) Impact.

If the exception to fair opportunity were not to be approved and a different provider was selected, Olympus would have to be shut down and refactored. The refactoring would require approximately 25,000 lines of terraform infrastructure automation code to be rewritten. Also, the Risk Management Framework (RMF) Body of Evidence would have to be regenerated and another Authority to Operate (ATO) issued from DISA RME. In total, the change would cost approximately and take 6-9 months. Olympus' customer base would also be impacted, including Enterprise Email Message Security Gateway (EEMSG), a critical capability for the department. The shutdown of Olympus would impact EEMSG’s modernization efforts in migrating to the commercial cloud.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION:

A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the independent government cost estimate and the JWCC Catalog

Page 4 of 6 Pages

CUI

pricing, including any discounts, which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

6. MARKET RESEARCH:

Market research for the basic JWCC Contracts was conducted and resulted in a signed market research report on November 9, 2021. This market research was subsequently revalidated and recertified on July 29, 2024, and most recently on February 6, 2026. After a survey of the market, it was concluded that use of the JWCC Contract is in the Government’s best interest due to technical feasibility and cost to the Government.

Additional research was conducted on March 1, 2026, by reviewing the specific capabilities in the JWCC Catalogs and it was determined that Microsoft Corporation is the only source capable of fulfilling the Government's minimum needs in the manner and time frame required. Research was conducted March 1, 2026, by reviewing the JWCC contractors’ catalogs to determine if other similar offerings were available under other CSPs that could immediately meet or be modified to satisfy the Government’s requirements. The results have determined that Microsoft is uniquely qualified to be a foundational CSP for Olympus due to its capabilities in identity (Azure Entra), cloud native application protection platform services (Microsoft Defender for Cloud), cloud posture management (Azure Policies), security event information management (Microsoft Sentinel), Generative AI (Azure OpenAI), multi-tenant constructs and automation (Azure Organizations and Lighthouse).

A Request for Additional Research to support exception to fair opportunity email was sent to all four JWCC CSPs: Microsoft, Amazon Web Service (AWS), Oracle, and Google. Responses were received from Microsoft and AWS. Google declined to respond and Oracle did not respond to the email. The findings were that Microsoft met the requirements and that while AWS listed solutions as the “foundation” of a SIEM/SOAR capability but not and of itself one. AWS also does not identify an end-point solution for CNAPP. Only Microsoft is capable of satisfying all the requirements identified in this Task Order.

7. ANY OTHER SUPPORTING FACTS: None.

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History:

Incumbent Contractor: Microsoft Corporation Contract Number: HC105023D0003 Task Order Number: HC105025F0047 Period of Performance: August 29, 2025 - August 28, 2026 Competitive Status: Other than full and open competition Business Size: Large business

Page 5 of 6 Pages

CUI

To support HC105023D0003/HC105025F0047 a justification and approval (J&A) for an exception to fair opportunity was signed on August 1, 2025, by the Contracting Officer. The previous J&A was based on Microsoft being uniquely qualified due to its capabilities in identity, cloud native application protection platform services, Security Event Information Management and other services. To overcome those barriers, market research was conducted regularly to identify any new services and offerings from the other cloud providers that could be potentially leveraged to fill capability gaps in security and identity. No new services or offerings were identified during the task order’s previous PoP.

To overcome future barriers, DISA will conduct Market Research on a regular basis to identify any new services and offerings from the CSPs that could be leveraged to fill capability gaps in security and identity for Olympus.