JA_AMD01_FINAL_Redacted.pdf

CUI

GF IL5 Continuation & IL6/TS Request

Page 2 of 7 Pages

CUI

infrastructure. The Description of Work (DoW) was updated to accurately define the more robust TS cloud infrastructure needed for the Golden Forge requirement.

This action is to issue a firm-fixed-price TO against the JWCC Indefinite Delivery/Indefinite Quantity (IDIQ) Contract for GF IL5 Continuation & IL6/TS Request. This TO will be issued directly to Microsoft Corporation. The anticipated period of performance (PoP) is for a 1-year base period, plus one 1-year option period and one 9-month option period. The total estimated value is after AMD01) which will be funded by Research, Development, Test, & Evaluation funds.

3. DESCRIPTION OF SUPPLIES/SERVICES:

This effort continues IL5 operations and introduces IL6 and Top-Secret capabilities to support a TRMC Digital Engineering Ecosystem that integrates data and digital engineering resources across multiple Services, providing enterprise-level capabilities to the Department of Defense (DoD) testing community in support of classified and unclassified missions.

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity.

FAR 16.505(b)(2)(i)(C) - The order must be issued on a sole-source basis in the interest of economy and efficiency because it is a logical follow-on to an order already issued under the contract, provided that all awardees were given a fair opportunity to be considered for the original order.

(b) Description of the Justification.

The GF program will continue to operate within Microsoft Corporation IL5 to support existing unclassified mission workloads that are currently operational and accredited, while requesting access to Microsoft SECRET IL6 and Microsoft TS environments to support new requirements involving classified processing and secure data transfer. These services are tightly coupled with TRMC’s current operational architecture and cannot be replicated in an identical, accredited form by other JWCC cloud service providers (CSPs). Microsoft is the only CSP capable of sustaining existing GF Cloud mission capabilities without re-architecture or loss of operational effectiveness. GF Cloud was developed as a digital engineering/test environment to address specific operational, security, and data sovereignty requirements for the TRMC.

IL6 access is required to host workloads that process SECRET-level data that cannot be securely or compliantly hosted in an IL5 environment due to DoD classification boundaries and mandatory security control requirements. TS access is required to support workloads and data classified above the SECRET level, which require the highest level of isolation, safeguarding, and compliance controls available only within Microsoft TS

Page 3 of 7 Pages environments.

(c) Justification.

(1) Minimum Government requirements.

The Government’s verified minimum requirements include sustaining the availability, security posture, and accreditation of the existing IL5 environment while establishing IL6 and TS environments capable of processing classified data in accordance with DoD security and classification requirements. The solution must support SECRET-level processing in IL6 and TS–level processing in an appropriately isolated environment, each with approved identity and access management, logging, monitoring, auditing, and continuous compliance capabilities.

The solution must also enable controlled, compliant data transfer mechanisms between classification levels, consistent with approved cross-domain and low-to-high transfer requirements, without compromising existing authorizations or operational security boundaries.

(2) Proposed sole source contractor.

Microsoft Corporation

(3) Discussion regarding the cause of the sole source situation.

The only source capable of performing the GF Cloud at the level of quality required is Microsoft Corporation, who currently hosts GF at the Unclassified level. Any re-architecting, re-engineering, and refactoring of any of the critical cloud offerings from Microsoft to any other CSP would not meet the Government’s need for compatibility.

TRMC’s user base is already integrated within the Microsoft environment, so native federation for identity access management and collaboration between tenants of the Microsoft Office 365 Top Secret platform is required to meet the Government’s minimum requirements. TRMC’s security posture is heavily at risk in pursuance of another CSP solution as this would require operating in a multi-cloud environment without native, out-of-the-box integration.

(4) Demonstration of unique source.

Microsoft uniquely fulfills TRMC’s requirement due to its native integration with the existing Office 365 TS platform, which is essential for seamless identity federation and collaboration within classified environments, and interoperability with other DoD tenants already leveraging Microsoft’s secure cloud offerings. Replicating this level of integration with another CSP would require complex, custom development, significantly increasing security risks while having its security certifications potentially rejected during reviews. Other CSPs lack this inherent integration, mandating costly and less secure

Page 4 of 7 Pages

CUI

workarounds simply to attempt the same functionality. Microsoft’s Azure Virtual Desktop further aligns with TRMC’s established service delivery model, providing a unified, secure solution that avoids these risks. Microsoft is the only CSP that meets the Government’s minimum requirements.

(5) Procurement discussion.

Based on Market Research conducted in January 2026, the only CSP that is currently capable of meeting the needs of the Government is Microsoft. Through multiple conversations with cloud architects, cybersecurity personnel, identity and access management specialists, and platform engineers, Microsoft is the only CSP capable of providing native integration with the Government’s existing Microsoft enterprise identity, security, and productivity ecosystem; access to Government-only and classified cloud regions; and the ability to leverage existing security controls, continuous monitoring, and approved ATOs.

(6) Impact.

The IL5 environment is already deployed, accredited, and operational, while IL6 and TS environments must be established and accredited to support classified mission requirements. Pursuing competitive procedures would require duplicating architecture, Risk Management Framework (RMF) and ATO activities, classified boundary connections, cross-domain integrations, and application certifications across IL6 and TS environments. Transitioning to another CSP would also introduce unacceptable cybersecurity risk, including loss of inherited controls, gaps in continuous monitoring, and increased exposure during transition between CSPs.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION:

A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the independent government cost estimate and the JWCC Catalog pricing, including any discounts, which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

6. MARKET RESEARCH:

Market research for the basic JWCC Contracts was conducted and resulted in a signed market research report on November 9, 2021, that was re-validated and re-certified on July 29, 2024. After a survey of the market, it was concluded that use of the JWCC Contract is in the Government’s best interest due to technical feasibility and cost to the Government.

Summary of Market Research performed regarding techniques checked above: Additional research was conducted December 01, 2025 - January 12, 2026 by reviewing the specific capabilities in the JWCC Contracts and it was determined that Microsoft Corporation is the only source capable of fulfilling the Government's minimum needs in the manner and time frame

Page 5 of 7 Pages

CUI

required. Market research was conducted through discussions with knowledgeable Government personnel and industry subject matter experts with direct experience designing, securing, operating, and authorizing mission systems on JWCC-approved cloud service providers. These discussions included cloud architects, cybersecurity personnel, identity and access management specialists, and platform engineers familiar with DoD Security Requirements Guide (SRG) requirements, IL5, IL6, and TS environments, and enterprise cloud operations.

On March 02, 2026, the Government submitted the “Additional Research to Support an Exception to Fair Opportunity” to all four JWCC CSPs that detailed the Government’s minimum technical requirements. Only Microsoft Corporation responded to the inquiry within the allotted timeframe for response. They indicated that their Microsoft Cloud solutions could meet the Governments requirements. No response was received from Google, Amazon Web Services or Oracle.

The market research determined that, while multiple cloud service providers are available under the JWCC contract, Microsoft Corporation is the only provider that satisfies all mandatory requirements without requiring architectural redesign, third-party tooling, waivers, or acceptance of additional security or operational risk. Microsoft Corporation uniquely provides native integration with the Government’s existing Microsoft enterprise identity, security, and productivity ecosystem; access to Government-only and classified cloud regions; and the ability to leverage existing security controls, continuous monitoring, and approved ATOs. Through these engagements, the Government validated that Microsoft Corporation uniquely satisfies the requirement due to its native integration with Government identity services, existing enterprise security and compliance tooling, availability of Government-only and classified SECRET and TS regions, and the ability to inherit existing Authorities to Operate (ATO). Knowledgeable personnel confirmed that alternative JWCC providers would require additional third-party tooling, reauthorization, or significant architectural changes to support IL6 and TS workloads.

Refactoring of the current environment from Microsoft to another CSP would cost an estimated and delay Golden Forge at least 12 months. In addition, there would be a duplication of costs by having to keep the solution running on one platform while refactoring it on another platform, none of which would meet the Government’s minimum need.

Through these engagements, the Government validated that Microsoft Corporation uniquely satisfies the requirement due to its native integration with Government identity services, existing enterprise security and compliance tooling, availability of Government-only and classified SECRET and TS regions, and the ability to inherit existing Authorities to Operate (ATO).

Knowledgeable personnel confirmed that alternative JWCC providers would require additional third-party tooling, reauthorization, or significant architectural changes to support IL6 and TS workloads. Refactoring of the current environment from Microsoft to another CSP would cost an estimated and delay Golden Forge at least 12 months. In addition, there would be a duplication of costs by having to keep the solution running on one platform while refactoring it on another platform, none of which would meet the Government’s minimum need.

7. ANY OTHER SUPPORTING FACTS: None.

Page 6 of 7 Pages

CUI

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) To overcome future barriers for fair competition, future development of the TRMC will focus on adopting containerization of components in a way to prevent vendor lock-in.

While the current configuration leverages Microsoft-native approaches, the containerization method will take time to implement and test in a manner that can be hosted by any CSP which will allow portions of the environment to be deployed across any CSP.

(b) Procurement History:

Contract Number: HC105023D0003 Task Order Number (if applicable): HC105025F0014 Period of Performance: March 17, 2025 - March 17, 2026 Competitive Status: Other than full and open competition Business Size: Large business

Page 7 of 7 Pages

CUI

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

TITLE/AGENCY/ORGANIZATION: TRMC Digital Engineering Lead, Department Of War

(DOW)

PHONE: DATE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

TITLE/AGENCY/ORGANIZATION: Chief Engineer Joint Mission Environment Test Capability (JMETC) Digital Test Environment, Department Of War (DOW)

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

TITLE/AGENCY/ORGANIZATION: Contracting Officer/DISA/DITCO/PS8511

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO