JA AMD01 - Final (Signed)_Redacted.pdf

CUI

Controlled by: DOD Controlled By: OUSD(A&S) / DIRECTOR BUSINESS OPERATIONS CUI Category: OPSEC Distribution/Dissemination Control: FEDCON

POC: BRIAN FROST, +1 5713726255, BRIAN.A.FROST.CIV@MAIL.MIL

JUSTIFICATION & APPROVAL FOR FEDERAL ACQUISITION

REGULATION SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Contract

Orders under Fair Opportunity Federal Acquisition Regulation (FAR) 16.505, Defense FAR Supplement 216.505(b), Procedures, Guidance, and Information 216.505(b)

Purchase Request Number: HQ06425131669 Joint Warfighting Cloud Capability (JWCC) Contract Number: HC105023D0003 Task/Delivery Order Number: To be determined Procurement Title: Secret Internet Protocol Router (SIPRNet) Migration from Defense Information Systems Agency (DISA) Stratus Estimated Value:

Statutory and Regulatory Authority: 10 United States Code (U.S.C.) 3204(a)(1) and FAR 16.505(b)(2)(i)(B)

EXCEPTION TO FAIR OPPORTUNITY

Number: Not Applicable

Upon the basis of the following justification, I, as the Contracting Officer, hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C. 3204(a) and Regulatory Authority of FAR 16.505(b)(2)(i)(B).

1. REQUESTING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

Office Secretary of Defense (OSD) / Office of the Under Secretary of Defense for Acquisition and Sustainment 4800 Mark Center Drive, STE 17G19 / Mailbox #55 Alexandria, VA 22350

Contracting Activity:

Defense Information Systems Agency/Defense Information Technology Contracting Organization/PS8511

2300 East Drive Scott Air Force Base, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

AMD01; This amendment increases the estimated value by , This increase is due to the addition of items not included on the IGCE, specifically SIPR egress, 25600 GB outbound data transfer from US Sec West routed via SIPRNet. Additionally, when preparing the IGCE, the secure regions were not functioning properly on the calculator

AMD01 - SIPR Migration from DISA Stratus

Page 2 of 7 Pages

CUI

and therefore the proposal’s inclusion of specific secure regions increased the line items cost by approximately 15%. Both additions are considered necessary and acceptable for the fulfillment of this requirement.

This action is to issue a firm-fixed-price task order (TO) against the JWCC Indefinite Delivery/Indefinite Quantity Contract for SIPRNet Migration from DISA Stratus. This TO will be issued directly to Microsoft Corporation. The anticipated period of performance is for a 1-year base period. The total estimated value is which will be funded by Operations & Maintenance funds.

3. DESCRIPTION OF SUPPLIES/SERVICES:

The Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) / Director of Business Operations / Data Services office operates a Non-Classified Internet Protocol Router (NIPRNet) Azure environment and a SIPRNet environment that is currently an enclave within DISA Stratus. The SIPRNet Acquisition and Sustainment Mission Application Enclave (SIPRNet AS-MAE) hosts approximately 20 applications that support mission essential functions on an infrastructure of Windows and Linux-based virtual machines. The enclave provides all applications and server support as well as all non-enterprise information technology services. Enterprise and network services for the enclave are provided by DISA. The Cyber Security Service Provider is the Army Futures Command/Command, Control, Communications, Computers, Combat Systems, Intelligence, Surveillance, and Reconnaissance. OUSD(A&S) is the business owner for most of the mission applications hosted in the SIPRNet AS-MAE. The SIPRNet AS-MAE applications consist of applications developed under the Business Application Support Services (BASS) contract, as well as applications developed by third-party teams under other OUSD(A&S) contracts. All security controls associated with DISA Stratus are inherited by the SIPRNet AS-MAE, with non-enterprise service controls identified and validated by the OUSD(A&S) Information Systems Security Manager.

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity.

FAR 16.505(b)(2)(i)(B) - Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(b) Description of the Justification.

OUSD(A&S) began operating its unclassified AS-MAE in Microsoft’s Azure Government in April 2022. In 2024, the recompete of A&S’s BASS contract was specifically aligned toward supporting A&S mission applications within a Microsoft environment, and current operational processes are optimized using Microsoft toolsets.

Migrating the classified version of the AS-MAE from DISA Stratus to a Microsoft

Page 3 of 7 Pages

CUI

capability enables the A&S program office to leverage the existing BASS contract for operational support and security compliance tasks. Conversely, migrating the classified AS-MAE to an environment other than a Microsoft capability would require the A&S program office to increase the BASS contract size by at least 30% or to acquire additional support services, which would also be an added cost to the Government, to provide the appropriate level of mission operations and security compliance support for a second cloud technology.

(c) Justification.

(1) Minimum Government requirements.

OUSD(A&S) seeks to migrate its current SIPRNet AS-MAE (Impact Level (IL)6) environment from DISA’s Stratus cloud offering to a JWCC cloud service provider (CSP)by the end of Fiscal Year 2025. Because AS-MAE applications are developed, tested, and staged within the NIPRNet AS-MAE then cloned to the SIPRNet AS-MAE, the AS-MAE platforms must be compatible without needing to retool the production-level applications or services as part of the standard deployment process. The NIPRNet AS-MAE utilizes a Hub-and-Spoke networking service model (i.e., A central hub serves as the coordinating entity, connecting to various spokes, which are capabilities directly linked to the hub. Each spoke interacts directly with the hub but not necessarily with each other.) and maximizes use of containerization and native cloud services. The SIPRNet AS-MAE must use a similar model and services to enable a seamless promotion of applications from the existing lower environments (e.g.., Development, Pre-Production) in NIPRNet to the higher classification Production environment in SIPRNet.

Additionally, a compatible structure implemented in the SIPRNet AS-MAE environment will realize efficiencies by leveraging the support services provided by the existing BASS support contract.

(2) Proposed sole source contractor.

Microsoft Corporation

(3) Discussion regarding the cause of the sole source situation.

The primary causes for a sole-source are (1) the requirement to have a seamless promotion of applications from the AS-MAE lower environments on NIPRNet to the SIPRNet AS-MAE production environment using the same Cloud Environment, (2) leveraging the expertise and skillset of the existing BASS support contract, and (3) impact to resource and schedule on subsequent high-priority projects (e.g., Identity/Credentialing/Access Management Implementation, Zero Trust Implementation).

A&S competed the BASS support contract (including NIPRNet and SIPRNet AS-MAE support) and aligned the Performance Work Statement toward supporting A&S mission applications within Microsoft’s Azure Government environment and optimizing operational processes using Microsoft’s Azure toolsets. The awarded support contractor has since tuned NIPRNet AS-MAE operations using native Microsoft Azure services

Page 4 of 7 Pages

CUI

including, but not limited to Azure Baston, Azure App Service, Azure SQL Elastic Pool, Azure Defender, Azure Sentinel, Azure Virtual Desktop, Azure Data Factory, and Azure Cognitive Services. For these reasons, refactoring SIPRNet AS-MAE to a platform other than a Microsoft capability is infeasible.

(4) Demonstration of unique source.

Because OUSD(A&S)’s NIPRNet AS-MAE is currently operating in and tuned to use Microsoft’s native services, Microsoft is the only CSP capable of providing the highly compatible environment needed for the SIPRNet AS-MAE requirement. This conclusion is supported by the fact that Microsoft was the only vendor to provide a crosswalk of DoD IL5 to DoD IL6 services in response to OUSD(A&S)’s recent request for Additional Research to Support Exception to Fair Opportunity. Amazon Web Services and Google Support Services did not respond. Oracle responded by formally declining to submit a direct whitepaper response.

(5) Procurement discussion.

In addition to meeting the critical requirement for a high degree of compatibility between the existing NIPRNet AS-MAE environment in Azure Government and the target SIPRNet AS-MAE, Microsoft is the only CSP able to address the procurement constraint of offering an environment that corresponds with the expertise and skillsets of the current AS-MAE support contractor. The OUSD(A&S) BASS support contractor that migrated the NIPRNet AS-MAE to Azure Government is also expected to lead and execute the SIPRNet AS-MAE migration project, as well as continue to operate the NIPRNet and the SIPRNet AS-MAE environments as a cohesive platform.

(6) Impact.

If the services of SIPRNet AS-MAE are migrated to another CSP environment OUSD(A&S) would experience the detrimental effects of near-term schedule delays, as well as near-term and long-term cost increases. The target schedule to migrate SIPRNet AS-MAE from DISA Stratus to a JWCC cloud offering begins in April 2025 and concludes in September 2025. On Oct 1, 2025, OUSD(A&S) is initiating high-priority projects that must be completed by the timeframes mandated by the DoD Chief Information Officer and Comptroller (e.g., Identity/Credentialing/Access Management Implementation due by September 2026, Zero Trust Implementation due by September 2027). The new AS-MAE platform must be stood up, tuned, and applications migrated by Sep 30, 2025. No other CSP can meet the Government requirement for the SIPRNet AS- MAE without causing a delay in the migration schedule start date to the point that the target end date cannot be achieved, and therefore, will adversely impact the subsequent mission projects. An extended migration schedule will incur the added costs of maintaining the source environment and the target environment for a longer period of time. OUSD(A&S) would also need to solicit for a new support contract to address the non-Microsoft requirements; this solicitation would delay the SIPRNet AS-MAE migration project by at least 6 months and add approximately in contractor support

Page 5 of 7 Pages

CUI

labor costs to acquire the additional expertise needed in the areas of Cyber Security, Release Management, and Infrastructure Management.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION:

A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the independent government cost estimate and the JWCC Catalog pricing, including any discounts, which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

6. MARKET RESEARCH: Market research for the basic JWCC Contracts was conducted and resulted in a signed market research report on November 9, 2021, that was revalidated and recertified on July 29, 2024. After a survey of the market, it was concluded that the JWCC Contract is in the Government’s best interest due to technical feasibility and cost to the Government.

Additional research was conducted Mar 03, 2025 - Mar 18, 2025 by reviewing the specific capabilities in the JWCC Contracts. Beginning on Mar 03, 2025, the Acquisition and Sustainment Mission Application Enclave (AS-MAE) Contracting Officer’s Representative reviewed Market Research Reports within the Supplier Performance Risk System from the Procurement Integrated Enterprise Environment to determine if any items being procured present an unacceptable level or risk based on technical compatibility, technical integration, or cyber security factors. The OUSD (A&S) Data Services Technical Architect provided a summary of comparable services between the four JWCC CSPs for review by the AS-MAE Authorizing Official (AO) and AO's Designated Representative (AODR). The Data Services Director and Deputy Director released an Additional Research to Support Exception to Fair Opportunity request to the four JWCC CSPs on Mar 14, 2025 to determine which CSPs could provide a technical solution that complements the Non-Classified Internet Protocol Router Network (NIPRNet) AS-MAE by enabling a seamless method to promote applications from the AS-MAE lower environments (i.e., Development, Pre-Production) into SIPRNet AS-MAE without needing to retool the production-level applications or services.

7. ANY OTHER SUPPORTING FACTS: None.

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History:

Not Applicable

(b) To overcome future barriers to competition, OUSD(A&S) is preparing a fair opportunity competitive follow-on requirement for both the NIPRNet AS-MAE and the SIPRNet AS- MAE environments that will be competed at the same time. The follow-on is expected to be competed, solicited, and awarded by May 2026.

Page 6 of 7 Pages