JA_AMD01_Final - Redacted.pdf

CUI

Controlled by: DISA

Controlled By: HCC

CUI Category: OPSEC

Distribution/Dissemination Control: FEDCON

POC: MICHAEL RUTLEDGE,

JUSTIFICATION & APPROVAL FOR FEDERAL ACQUISITION

REGULATION SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Contract

Orders under Fair Opportunity

Federal Acquisition Regulation (FAR) 16.505(b), Defense FAR Supplement 216.505(b), Procedures, Guidance, and Information 216.505(b)

Military Interdepartmental Purchase Request: HC110426MPF0003

Joint Warfighting Cloud Capability (JWCC) Contract Number: HC105023D0003

Task Order (TO) Number: To be determined

Procurement Title: Hosting and Compute (HaC) Cyber Defender

Statutory and Regulatory Authority: 10 United States Code (U.S.C.) 3204(a) and FAR

16.505(b)(2)(i)(B)

EXCEPTION TO FAIR OPPORTUNITY

Number:

Upon the basis of the following justification, I, as the Contracting Officer, hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C. 3204(a) and

Regulatory Authority of FAR 16.505(b)(2)(i)(B).

1. REQUESTING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

Defense Information Systems Agency (DISA) / J9 - HaC

8705 industrial Blvd

Tinker AFB, OK 73135

Contracting Activity:

DISA/Defense Information Technology Contracting Organization (DITCO)/Cloud

Capabilities Section (PS8511)

2300 East Drive

Scott Air Force Base, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

AMD01: The purpose of this amendment is to increase the value by This increase is due to the Impact Level (IL) 5 and IL6 growth in Option Period 2 in which Microsoft utilized a phased approach that tied the current usage of the existing environment with a phased approach to increase in Option year 2. For the IL6 licenses, Microsoft’s solution increased the number of licenses from 55,000 to 100,000 by year two for increased capacity.

The Government requires growth but did not originally include this in their Independent

Government Cost Estimate (IGCE).

HaC Cyber Defender

Page 2 of 6 Pages

This action is to issue a firm-fixed-price TO against the JWCC Indefinite Delivery/Indefinite

Quantity Contract for HaC Cyber Defender. This TO will be issued directly to Microsoft

Corporation. The anticipated period of performance is for a 1-year base period, plus one 1-year option period and one 9-month option period. The total estimated value is which will be funded by Working Capital funds.

3. DESCRIPTION OF SUPPLIES/SERVICES:

This requirement is for the J-9 Cyber Security Division to provide endpoint protection for the

DISA Vulnerability Management Service (VMS). To perform this duty, the division requires a cloud-based security tool. This requires the data storage and data egress services that operate the cloud-based security tool on protected virtual machines, which is essential for the division to fulfill its role as a Cyber Security Service Provider (CSSP).

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity.

FAR 16.505(b)(2)(i)(B) - Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(b) Description of the Justification.

The Department of Defense Chief Information Officer (DOD-CIO) has designated use of

Microsoft Defender as the endpoint protection service. This cloud-based service can only be managed in the Microsoft Defender Portal with an existing Azure tenant. J-9 Cyber will manage the Defender service from within the existing J-6 owned Department of

Defense's Joint Microsoft 365 (DOD365J) tenant. Therefore, Microsoft is the only CSP that can meet this requirement due to the native integration of the endpoint service and the Microsoft Defender Portal.

(c) Justification.

(1) Minimum Government requirements.

DISA J-9 requires data storage and database services through a cloud-based endpoint security service tool. At a minimum, this service must be able to access the Extended

Detection and Response portal inside the existing tenant as well as configure antivirus and endpoint Firewall settings for each onboarded endpoint.

(2) Proposed sole source contractor.

Page 3 of 6 Pages

Microsoft Corporation

(3) Discussion regarding the cause of the sole source situation.

Microsoft Defender is a proprietary Microsoft cloud service, and it can only be managed from within a Microsoft Azure tenant. J-9 can utilize the current tenant to manage the

Microsoft Defender Endpoint Security Service (ESS) by using the Microsoft Defender

Portal. In addition, the use of Microsoft Defender and its associated tools such as Intune and Azure Arc are mandated by the Department of Defense Cyber Defense Command

Task Order 25-0010, 24-0006, 24-0020, 22-0003, 24-0048, and Department of Defense

Cyber Defense Command Operational Order 8600. The mandate to transition from

Trellix Endpoint Security Solution to Microsoft Defender is a strategic consolidation driven by the August 2021 DoD CIO directive to leverage the already-funded Microsoft

365 E5 enterprise license, effectively eliminating millions in redundant software costs.

This modernization replaces the resource-intensive legacy Endpoint Security Solution stack with an OS-native solution that enhances endpoint performance and natively integrates with the Department’s Zero Trust architecture. Microsoft has consolidated its entire security operations stack into a single, unified interface: the Microsoft Defender portal. This portal is not a standalone application, but a service built entirely on and managed from within the Microsoft cloud environment. The Defender portal does not have an equivalent to any other CSP offering.

(4) Demonstration of unique source.

Microsoft is the only CSP that provides the unified interface required by DISA J9 for its

VMS endpoint security. This is delivered via the Defender Portal, which manages the

Microsoft Defender for Endpoint offering.

As a cloud-native service, Defender for Endpoint is only available and managed by a

Microsoft Azure Tenant. Management can be seamlessly integrated into the existing

Government DoD 365J tenant, making it the only viable solution.

(5) Procurement discussion.

Based on the Additional Research request to the four JWCC CSPs on September 22, 2025, the only CSP that is currently capable of meeting the minimum needs of the

Government is Microsoft. Google declined to provide a comparable solution. Amazon

Web Services (AWS) and Oracle did not respond to the request.

Mandates necessitate the use of an ESS, and the use of Microsoft Defender, therefore no other CSP can meet the mandatory requirement for the VMS. Microsoft can instantly meet the Government requirement with a seamless and compatible solution that does not rely on third-party software which will create duplicative and unnecessary costs, since the

Government can integrate this requirement into the current DOD365J Tenant.

(6) Impact.

Page 4 of 6 Pages

No other CSP can meet the J-9 requirement for endpoint security, and there is no comparable offering that can natively integrate with Microsoft Defender and its Defender portal due to the current infrastructure being native to Microsoft and the DOD365J tenancy. Defense Agencies and DoD Field Activities (DAFA) currently relying on the existing DOD365J Tenant would be without the required endpoint protection and will not achieve compliance, resulting in a failure of J-9’s CSSP objectives.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION:

A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the independent government cost estimate and the JWCC Catalog pricing, including any discounts, which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

6. MARKET RESEARCH:

Market research for the basic JWCC Contracts was conducted and resulted in a signed market research report on November 9, 2021, that was revalidated and confirmed on July 29, 2024.

After a survey of the market, it was concluded that use of the JWCC Contract is in the

Government’s best interest due to technical feasibility and cost to the Government.

Additional research was conducted on Sep 22, 2025, by reviewing the specific capabilities in the

JWCC Catalogs and it was determined that Microsoft Corporation is the only source capable of fulfilling the Government's minimum needs in the manner and time frame required. Research was conducted September 22, 2025, by reviewing the JWCC contractors’ catalogs to determine if other similar offerings were available under other CSPs that could immediately meet or be modified to satisfy the Government’s requirements. The results have determined that no other offering is suitable to support managing Microsoft Defender, as Defender and its associated management portal are native to Azure. Defender is the supported offering for the current environment, which is hosted in a Microsoft environment.

A Request for Additional Research to support exception to fair opportunity email was sent to all four JWCC CSPs: Microsoft, Amazon, Oracle, and Google. Google provided a response, in which they declined to provide a solution while Amazon and Oracle did not respond. Microsoft responded with the required documents (Crosswalk, Roadmap, and Opsgility training).

7. ANY OTHER SUPPORTING FACTS: None.

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

To overcome the barriers that led to this exception to fair opportunity, the Government will implement a multi-faceted strategy focused on enabling future competition. The

Government will establish an annual market intelligence review and issue a biennial

Request for Information (RFI) to continuously assess the viability of alternative endpoint

Page 5 of 6 Pages

CUI

solutions and third-party management tools. The primary long-term goal is to redefine future requirements based on performance outcomes rather than specific tools, effectively decoupling the endpoint agent from its management plan. Should a viable alternative be identified, the Government will commit to validating it via a limited-scope proof-of-concept to ensure it meets DoD CIO mandates and can integrate with the existing enterprise architecture.

(a) Procurement History:

Not Applicable

Page 6 of 6 Pages

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Michael Rutledge

TITLE/AGENCY: Chief, Cyber Operations Branch, DISA, J9 - HOSTING & COMPUTE (HC)

PHONE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Michael Rutledge

TITLE/AGENCY: Chief, Cyber Operations Branch, DISA, J9 - HOSTING & COMPUTE (HC)

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: Darryl Boswell

TITLE/AGENCY/ORGANIZATION: Contracting Officer/DISA/DITCO/PS8511

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

Morgan Bauer,