JA16-087 MOD 04 METSS II Oct 2024 002_Redacted.pdf

MODIFICATION (MOD) JUSTIFICATION FOR OTHER THAN FULL

AND OPEN COMPETITION (OTFAOC)

Federal Acquisition Regulation (FAR) Part 6 Justification, Supporting Procurements under FAR Part 12 and FAR Part 15

Purchase Request Number: METSS-II Contract Number: HC1028-17-D-0001 Procurement Title: Microsoft Enterprise Technical Support Services-II (METSS-II) Estimated Value:

Statutory Authority: 10 United States Code (U.S.C.) § 2304(c)(1) MOD 03 Statutory Authority: revises to 10 U.S.C. § 3204(a)(1) FAR 6.302-1/Defense Federal Acquisition Regulation Supplement 206.302-1, Only One Responsible Source

JUSTIFICATION FOR OTFAOC

Number: JA16-087 MOD 04

Upon the basis of the following justification, I, as the Senior Procurement Executive, hereby approve the use of other than full and open competition of the proposed contractual action pursuant to the statutory authority 10 U.S.C. 2304(a)(1) only one responsible source and no other supplies or services will satisfy agency requirements.

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

a. Requiring Agency:

Defense Information Systems Agency (DISA) / Acquisitions Center (ACQ), Logistics and Contracts Division (BDL) 6910 Cooper Ave.

Fort Meade, Maryland 2075

b. Contracting Office:

DISA/Defense Information Technology Contracting Organization (DITCO)/PS8311 2300 East Drive Scott Air Force Base, Illinois 62225

NOTE: New revisions to the Justification for OTFAOC, referred to as “J&A” through the remainder of the document, are prefaced by “MOD 04” and identified in bold text.

Revisions to the original J&A and previous modification are prefaced by “MOD 01”, “MOD 02”, or “MOD 03”, respectively, throughout the document.

2. NATURE/DESCRIPTION OF ACTION(S): The DISA and its Department of Defense (DoD) mission partners have a requirement to obtain direct and rapid access to Microsoft Consulting Services (MCS) and Microsoft Premier Services (MPS) expertise, which will provide: enterprise service support, operational engineering and maintenance support, baseline configuration management, upgrades, integration, test and evaluation with the necessary

Reference No: METSS-II Title of Effort: J&A for METSS-II-JA16-087 MOD 04

Page 3 of 20 pages approach for METSS-II was contemplated to provide continued support prior to expiration of METSS-II in December 2021; however, this extension to the current contract is in lieu of establishing a separate contract and allows the Government to leverage existing agreements with Microsoft, as well as to incorporate updated technologies and labor categories, resulting in cost effective solutions.

MOD 03: This modification is to extend the ordering period of the established indefinite delivery indefinite quantity (IDIQ) METSS-II contract from December 20, 2023 to December 20, 2024.

The extension will ensure continued support for DISA and Non-DISA mission partners the ability to procure MCS and MPS, as well as Microsoft’s replacement of MPS, Unified Support.

The current ceiling of is sufficient for the extended ordering period and will not be increased at this time as the lifecycle value of awarded task orders is , leaving million in ceiling available. The extension mitigates the chance of a high-risk gap or decline in quality of services to DISA and DISA’s mission partners, in anticipation of the March 2024 Naval Information Warfare Center Pacific (NIWC PAC) award of the follow-on contract to the current Department of Defense Enterprise Software Initiative (DoD ESI) Microsoft Enterprise Services (MES) contract (N66001-19-D-0019). This extension to the current contract is in lieu of establishing a separate contract and allows the Government to leverage existing agreements with Microsoft, as well as to incorporate updated technologies and labor categories, resulting in cost effective solutions.

MOD 04: This modification is to extend the ordering period expiration of the established indefinite delivery indefinite quantity (IDIQ) METSS-II contract from December 20, 2024 to December 20, 2025. The one-year extension will increase the METSS-II contract ceiling by , from to . The extension and ceiling increase is the result of the need for continued support beyond December 20, 2024, and in anticipation of 100% exhaustion of the ceiling prior to December 2024. A surge of new requirements has resulted in awards totaling (98%) of the billion contract ceiling. Demand has continued to increase across the base of mission partners external to DISA due to the advantageous pricing structure available under the contract and the expiration of the NIWC PAC DoD ESI contract (N66001-19-D- 0019), in addition to the growth in requirements for support of Microsoft-based networking, computing and storage, cybersecurity, and network operations technologies for which Microsoft’s direct proprietary expertise is required. A follow-on acquisition approach for METSS-II was contemplated to provide continued support prior to expiration of METSS-II in December 2024; however, as noted in MOD 03, DITCO plans to utilize the NIWC PAC DoD ESI MES award once it is available for these types of requirements. The MES-II award is projected for December 2024. The one-year extension to METSS-II will allow for a logical transition to MES-II once available and mitigates risks associated with potential further delays in the award of MES-II. This extension to the current contract is in lieu of establishing a separate contract and allows the Government to leverage existing agreements with Microsoft, resulting in cost effective solutions.

3. DESCRIPTION OF SUPPLIES/SERVICES: The Government has a need for the continuing technical expertise and access to proprietary Microsoft closed-source code to support on-going projects and to continuously improve existing and newly invented technology features, Page 4 of 20 pages capabilities, transformation initiatives, and services; including, but not limited to, mainframe and server consolidations which include planning, site surveys, detailed designs, configurations, staging and installation of new and upgraded client communications infrastructures for new project starts and implementation within the continental United States (CONUS) and at specified outside the continental United States (OCONUS) locations. This on-going effort is largely driven by the fact that the DoD customers’ needs are continually evolving to meet their own operational challenges.

The required engineering and professional technical support services for Microsoft technology to assist in supporting the DoD’s IT transformation efforts which include: operational architecture, design, implementation, systems consulting and maintenance support, oversight to ensure the baseline configuration, upgrades, integration, test and evaluation of the DISA and DoD’s global IT enterprise services to ensure they are provided with the necessary emergency messaging, situational awareness, crisis action, and operational capabilities to fulfill DISA and DoD’s missions. These services are necessary to help the government maximize their investment in Microsoft technologies, reduce risk, accelerate deployment and optimize solutions to meet government requirements and build the framework for repeatable processes.

The solutions, assistance, and consultation work will require direct and rapid access to Microsoft’s proprietary data and closed-source code for current and future enterprise applications and technical support. This access is obtained through “Microsoft Blue Badge cardholder-support” services direct from Microsoft that include access rights to Microsoft (closed-source) code, which is licensed under the exclusive legal right of the Microsoft Corporation. “Microsoft Blue-Badge contractors” have direct access to several restricted Microsoft internal websites, proprietary data, closed-source code and portals.

Additionally, DISA and DoD mission partners require access to MCS and MPS expertise to fulfill requirements listed in the DEPSECDEF memo “Implementation of the Microsoft Windows 10 (WIN10) Secure Host Baseline,” dated February 26, 2016. These services will allow DISA and DoD to align their IT infrastructure with the objectives of the DISA Strategic Plan as well as meet DoD’s efficiency initiatives of enabling a joint information environment.

Services obtained via this contract will be considered “in-scope” when requirements dictate capabilities needed for: “Microsoft Blue Badge cardholder-support” services direct from Microsoft that require access rights to Microsoft (closed-source) code, which is licensed under the exclusive legal right of the Microsoft Corporation. The following technical requirements, included in the METSS-II performance work statement (PWS), will utilize the expertise and skills of MCS and MPS. The requirements include, but are not limited to:

a. IT Strategic Architecture and Planning. Microsoft software is an integral part of DoD’s architecture within its tactical and non-tactical environments. Microsoft software is a key component in achieving the DoD’s vision and migrating to a more secure environment.

The DoD’s vision is to build a joint information enterprise-based network-centric organization that utilizes the synergy of technology and human capital to achieve decision dominance in support of network-centric warfare as described in the DISA Strategic Plan and DoD’s initiatives for enabling a joint information environment. This

Page 5 of 20 pages support includes but is not limited to collaboration design and support of the agency’s IT transformation, enterprise design and prototyping, implementation and deployment of enterprise services, facilitation of problem resolution in support of the government’s infrastructure development and architectural planning.

b. Architecting and Deploying Core Infrastructure Technologies. MCS and MPS are required to assist DISA and DoD with the architecture and troubleshooting of DoD’s enterprise services portfolio. This architecture includes, but is not limited to, the service infrastructure, security architecture, as well as maintenance and troubleshooting during deployment and operation. Failure to have MCS and MPS available would significantly and adversely impact DISA’s ability to field quality service to the warfighter in a timely and cost-conscious manner. Deployment of these services requires access to closed-source code changes, and MPS is the only means of obtaining the required modification of Microsoft products after release. MCS and MPS are essential for all implementation of enterprise services for DISA and are required by all of DoD for this purpose.

c. Application Development Project Services. This includes, but is not limited to, collaboration design and deployment services as well as enterprise design and deployment services. DISA has invested in a joint enterprise license agreement (JELA) with Microsoft for their software products, which extends through October 31, 2016, and covers all Army, Air Force, and DISA elements. A follow-on Microsoft JELA may be issued in the future. DISA’s requirement is to enhance security by migrating to the Microsoft software product version that is most secure, migrating away from non-supported products such as Microsoft NT4 and Exchange 5.5 and moving to an enterprise model in order to meet DISA Strategic Plan Goal 1, Provide joint command and control (C2) and leadership support and Goal 3, operate and assure the enterprise. MCS and MPS services are required to complete the migration and fine-tune the secure architecture. In addition, multiple DoD agencies have requirements for direct access to Microsoft source code and expressed interest in obtaining MCS and MPS services under this contract.

d. Cyber Security Services and Cyber Security Incident Response Services. The DISA network operations procedures were established to manage, protect, and defend a Microsoft-centric network infrastructure and Microsoft-centric cyber vulnerabilities.

This Microsoft infrastructure serves as DISA’s foundation, enabling DISA to consistently execute its IT mission. The government requires MCS to assist in implementation of large systems including but not limited to, methodology, design approaches and architectural infrastructure and engineering considerations; assisting to implement cybersecurity strategies, technologies and implement tools and services to increase resilience; develop intelligence, warning, and operational capabilities to mitigate malicious cyber-attacks.

e. Other DoD Specialized/Emerging Projects. DISA will be fully engineering, designing, implementing, and deploying an enterprise Identity and Access Manager (IdAM), email system (DoD Enterprise Email (DEE), and a web content and documentation management collaboration solution Defense Enterprise Portal Services (DEPS), across

Page 6 of 20 pages the entire DoD Information Network infrastructure, both in the CONUS and OCONUS.

IdAM establishes a standard directory structure allowing users to access resources globally, which can be leveraged by all organizations in support of the warfighter. MCS are required to support the mission of DISA as it seeks to implement Active Directory (AD) and Exchange. MCS is also required to aid in the migration of users and applications from the multi-environment AD legacy to a single, enterprise environment.

MCS is required to support the mission of DISA as it seeks to sustain the system center in support of IdAM, DEPS and DEE capabilities, to recommend technologies, solutions and architectures that reduce the total cost of ownership of DoD-owned systems and enable DISA to manage the DISA IdAM, DEPS and DEE infrastructure as an enterprise. DISA requires access to emerging Microsoft products, source code, Microsoft factory consultants and trained support personnel (“Blue Badges”).

The government requires MCS to assist in developing, integrating, and deploying IT architectures, designs, and solutions related to AD/Exchange, or in support of other related DISA enterprise infrastructure activities. The job of DISA is to ensure that the deployed solution is integrated across the DoD enterprise and then to manage, operate, and provide continued improvement and configuration management of the systems.

DISA requires MCS to assist in this process, provide highly skilled experts with deep product knowledge of all Microsoft AD/Exchange and Windows applications components, instant reach back to Microsoft product support, and reach across to other programs employing Microsoft products. MCS will assist in providing an enterprise product delivering global situational awareness and a common operational picture by reconciling and consolidating inventory, and integrating with AD. Support includes standard configuration management, monitoring licenses, identifying applications, assessing mission readiness and information assurance vulnerability alert status per device, organization, and across the enterprise, in near real-time.

f. WIN10 Support. METSS-II will support the requirement listed in the DEPSECDEF memo “Implementation of the WIN10 Secure Host Baseline”. The memo requires the entire DoD to transition to Microsoft WIN10 Secure Host Baseline by December 31, 2017. Both MCS and MPS are required in order to meet this mandate in order to ensure built-in identity, threat and malware protection features are modified in the original source code of WIN10 in accordance with Security Technical Implementation Guides produced by DISA.

MOD 01: The estimated life cycle value is , an increase of as a result of this modification. The ordering period is unchanged as a five-year IDIQ contract, December 21, 2016 – December 20, 2021. However, METSS-III, the anticipated follow-on acquisition approach for METSS-II efforts, is anticipated to be awarded by the end of calendar year 2019.

MOD 02: The estimated life cycle value is , an increase of as a result of this modification. The ordering period is extended by two years, from December 20, 2021 to December 20, 2023. As identified in Section 2, this ceiling increase and extension to the

Page 7 of 20 pages current contract is in lieu of establishing a separate contract and allows the Government to leverage existing agreements with Microsoft, as well as to incorporate updated technologies and labor categories, resulting in cost effective solutions.

MOD 03: The ordering period is extended by one year, from December 20, 2023 to December 20, 2024. As identified in Section 2, this extension to the current contract is in anticipation of the March 2024 NIWC PAC award of the follow-on contract to the current DoD ESI MES contract.

The extension allows the Government to leverage existing agreements with Microsoft, as well as to incorporate updated technologies and labor categories, resulting in cost effective solutions.

MOD 04: The estimated life cycle value is , an increase of as a result of this modification. The ordering period is extended by one year, from December 20, 2024 to December 20, 2025. As identified in Section 2, this ceiling increase and extension to the current contract is in lieu of establishing a separate contract and allows the Government to leverage existing agreements with Microsoft, resulting in cost effective solutions.

4. IDENTIFICATION OF STATUTORY AUTHORITY: The statutory authority permitting other than full and open competition for this acquisition is 10 U.S.C. Section 2304(c)(1), MOD 03 revises to 10 U.S.C. 3204(a)(1) as implemented by FAR 6.302-1(a)(1), only one responsible source and no other supplies or services will satisfy agency requirements.

5. DEMONSTRATION OF CONTRACTOR’S UNIQUE QUALIFICATIONS:

a. Description of Events. DISA and the DoD have utilized direct and rapid access to Microsoft services to identify architecture change impacts and security risks associated with current and future product releases that could impact DISA and DoD infrastructures.

Moreover, MCS and MPS personnel (“blue badges”) have unfettered and unique access to tools and intellectual property designed to assess, defend, and recover from C2 breakdowns, denial of service, redirection to counterfeited web sites (malware), socially engineered emails (phishing attacks), key loggers, spyware, and an overall loss of network integrity that may be specific to Microsoft products.

DISA and the DoD have a strategic partnership with Microsoft regarding MCS and MPS, which allows for direct and rapid access to Microsoft’s proprietary data and closed-source code for current and future enterprise applications and technical support. The “blue badge” direct access is critical to DISA and the DoD. This direct access to both current and future products play a key role in allowing DISA to have unique enterprise services insight into the architecture of current solutions that can facilitate smooth migrations to future unreleased products/versions based on in-depth access to Microsoft internal resources. ISC/IM and the DoD requires access to Microsoft's inherent expertise with all facets of installation and configuration of their products as well as a fully/constantly trained and skilled matrixes workforce to support DISA’s enterprise services. Furthermore, DISA realized Microsoft’s ability to provide quick reaction to resolve any issues related with Microsoft products and/or expedite resolution on critical risk situations. DISA requires MCS’s direct access to Microsoft software developers to

Page 10 of 20 pages specialized support for MCS and MPS/Unified.

(4) Demonstration of unique source. Microsoft maintains strict control over its proprietary source code and does not allow resellers access to that code, allowing them to provide MCS and MPS. Therefore, the Microsoft Corporation is the only source to provide direct and unique access to the various Microsoft product teams, software developers and source code for current and future products, enabling (a) specialized insight into the architecture of current solutions that can facilitate smooth migrations to existing and future unreleased products/versions; (b) quick and comprehensive resolution of product support, trouble-shooting and hot-fix type issues; and (c) immediate and focused technology feedback link between the DoD and the product development teams to help shape the direction, features, and functionality of future products.

(5) Procurement discussion. This requirement is for consulting and technical services that involve solutions requiring access to Microsoft proprietary information. The access to this proprietary information defines the necessity for this acquisition to be executed via a sole source. Historically, these services were procured via the original METSS IDIQ under the authority of FAR 6.302-1(a)(1); only one responsible source and no other supplies or services will satisfy agency requirements.

MOD 01: There have been 115 task orders issued against the METSS-II contract.

Of the 115 task orders awarded, nine of those orders were issued to DISA mission partners, while the remaining 106 were issued to external partners including the Armed services and individual agencies across all of DoD.

MOD 02: There have been 119 task orders issued against the METSS-II contract.

Of the 119 task orders awarded, ten of those orders were issued to DISA mission partners, while the remaining 109 were issued to external partners including the Armed services and individual agencies across all of DoD.

MOD 03: There have been 195 task orders issued against the METSS-II contract.

Of the 195 task orders awarded, 24 of those orders were issued to DISA mission partners, while the remaining 171 were issued to external partners including the Armed services and individual agencies across all of DoD. There are currently 65 active orders.

MOD 04: There have been 234 task orders issued against the METSS-II contract. Of the 234 task orders awarded, 24 of those orders were issued to DISA mission partners, while the remaining 210 were issued to external partners including the Armed services and individual agencies across all of DoD. There are currently 77 active orders.

(6) Impact: If the MCS and MPS services are not procured from Microsoft, DISA and

DoD would be significantly impacted with a lapse in service and would ultimately have to entertain the total replacement of the Microsoft infrastructure and software

Page 11 of 20 pages products. DISA has successfully built a defense infrastructure of its cyberspace, relying on the security standards, multi-layered defensive technologies, and training principles and technologies of Microsoft. The cyber defense infrastructure will be severely jeopardized if DISA is not permitted to procure support for the Microsoft products within their existing infrastructure. Failure to maintain and fortify cyberspace defenses will expose DISA and the DoD to significant and potentially irreparable harm.

If MCS and MPS are not procured, existing Microsoft software applications, with a historical investment value of over by the Army, Navy, DISA and multiple other DoD agencies, will have to be replaced. The cost to do so would be unacceptable, especially with the current uncertainty regarding budgetary restrictions.

Other impacts include, but are not limited to, potentially of dollars, based on current department expenditures, in duplication of costs and unacceptable delays in services. Additionally, an estimated cost in the would be required for investment in research and development to determine another operating system and application software standard that duplicates the current secure standard operating system and application configuration. Furthermore, the Government would be at a near stoppage of work and inability for DISA and other DoD organizations to operate.

MOD 01: Failure to increase the ceiling would result in a disruption of DISA and DoD mission partner operations. Also, it would restrict the DISA and DoD mission partners’ ability to meet the DEPSECDEF Windows 10 migration requirement and would reduce responsiveness to emerging requirements. The METSS-II contract offers the best available labor rate pricing for direct and rapid support for MCS and MPS expertise with “Microsoft Blue Badge” access currently on the market. To ensure continued support for DISA and Non-DISA mission partners’ ability to procure timely and cost effective MCS and MPS expertise, a ceiling increase is in the best interest to the Government.

MOD 02: At the pace of orders being placed, the current METSS-II ceiling will not be adequate for the necessary ordering capacity through December 2021. Further, MCS and MPS solutions will continue to be needed beyond the current December 2021 expiration of METSS-II and failure to provide continued support through December 2021 and beyond would result in a disruption of DISA and DoD mission partner operations. In addition, as discussed in MOD 01, concern remains that failure to provide continued support would restrict the DISA and DoD mission partners’ ability to meet the DEPSECDEF Windows 10 migration requirement and would reduce responsiveness to emerging requirements. The METSS-II contract offers the best available labor rate pricing for direct and rapid support for MCS and MPS expertise with “Microsoft Blue Badge” access currently on the market. To ensure continued support for DISA and Non-DISA mission partners’ ability to procure timely and cost effective MCS and MPS expertise, a two-year contract extension and subsequent ceiling increase is in the best interest to the Government.

Page 12 of 20 pages

MOD 03: MCS and MPS/Unified solutions will continue to be needed beyond the current December 2023 expiration of METSS-II and failure to provide continued support through December 2023 and beyond would result in a disruption of DISA and DoD mission partner operations. In addition, as discussed in MOD 01 and 02, concern remains that failure to provide continued support while NIWC PAC procures a follow-on contract would restrict the DISA and DoD mission partners’ ability to meet the DoD requirements and reduce responsiveness to emerging requirements.

The METSS-II contract offers the best available labor rate pricing for direct and rapid support for MCS and MPS/Unified expertise with “Microsoft Blue Badge” access currently on the market. To ensure continued support for DISA and Non- DISA mission partners’ ability to procure timely and cost effective MCS and MPS/Unified expertise, a one-year contract extension is in the best interest to the Government.

MOD 04: MCS and MPS/Unified solutions will continue to be needed beyond the current December 2024 expiration of METSS-II and failure to provide continued support through December 2024 and beyond would result in a disruption of DISA and DoD mission partner operations. In addition, as discussed in MODs 01, 02, and 03, concern remains that failure to provide continued support while NIWC PAC procures a follow-on contract vehicle would restrict the DISA and DoD mission partners’ ability to meet the DoD requirements and reduce responsiveness to emerging requirements. The METSS-II contract offers the best available pricing construct for direct and rapid support for MCS and MPS/Unified expertise with “Microsoft Blue Badge” access currently on the market. To ensure continued support for DISA and its external mission partners’ ability to procure timely and cost effective MCS and MPS/Unified expertise, a one-year contract extension is in the best interest to the Government.

6. FEDBIZOPPS ANNOUNCEMENT/POTENTIAL SOURCES. This requirement was advertised via a combined sources sought and notice of intent to award a sole source contract posted to FedBizOpps on June 1, 2016 through June 15, 2016. The combined sources sought and notice of intent to award a sole source contract meets the requirements of FAR 5.201 and DISA Acquisition Regulation Supplement 206.302-1. Three responses were received, two being after the closing date and time. On June 8, 2016, GSA provided a capabilities statement for their 8(a) Streamlined Technology Application Resource for Services (STARS) II GWAC. Although the 8(a) STARS II GWAC offers multiple Microsoft products and services, it does not offer MCS and MPS specifically. On June 15, 2016, New Tech Solutions, Inc. submitted a capabilities statement indicating they were authorized resellers of MCS and MPS. In confirming with Microsoft directly on June 24, 2016, although Microsoft has authorized resellers for many of their products and services, no company other than Microsoft can provide MCS and MPS specifically, as defined in the Government’s requirement. On June 17, 2016, TrueTandem submitted a capabilities statement. That statement indicates they are an authorized provider of “orange-badge” MCS. This requirement is specifically for “blue badge” MCS. Additionally, the statement provides TrueTandem is a Microsoft Premier Reseller, however, not an authorized reseller of MPS. The contracting office received a letter provided by Microsoft, dated May 4, Page 13 of 20 pages

2016 and another dated June 24, 2016, stating no authorized resellers of MCS or MPS have been established. The letter further stated that Microsoft only permits its own cleared and certified personnel access to its proprietary information and source code. Microsoft has no authorized resellers for the MCS and MPS requirement.

MOD 01: A notice to synopsize the proposed sole source contract modification for this ceiling increase was published to the Federal Business Opportunities (FBO) website on September 6, 2018 with responses due September 21, 2018. A statement was included instructing responsible parties to submit a capability statement or proposal, which will be considered by the Government in determining the procurement approach for future requirements within scope of the contract and in consideration for follow-on procurement activities. A sources sought notice for the METSS program was later posted to FBO.gov on September 24, 2018 with responses due October 15, 2018. To date only one formal written capabilities statement submission was received. The submission was an overview of the company’s capabilities, which lacked specificity regarding any access to Microsoft Proprietary Closed Source Code or Blue-Badge Support with direct reach back to Microsoft engineers, product developers and product teams for swift problem resolution. Outside of the one written response, no other responses were received from potential offerors that could meet the scope of work under METSS-II.

MOD 02: A notice to synopsize the proposed sole source contract modification for this extension was published to the FBO website on April 25, 2019 with responses due May 10, 2019. A statement was included instructing responsible parties to submit a capability statement or proposal, which will be considered by the Government in determining the procurement approach for future requirements within scope of the contract and in consideration for follow-on procurement activities. A sources sought notice for the METSS program was also previously posted to FBO.gov on September 24, 2018 with responses due October 15, 2018. Similar to previous market research efforts, the only responses received provided generic capabilities statements and were unable to demonstrate the capability to meet the scope of work provided by the METSS program. In particular, no other sources have established the capability to access to Microsoft Proprietary Closed Source Code or Blue-Badge Support with direct reach back to Microsoft engineers, product developers and product teams for swift problem resolution. As such, the recent efforts to identify other potential sources through FBO.gov has confirmed that Microsoft Corporation continues to be the only source capable of meeting the scope of the METSS program.

MOD 03: A notice to synopsize the proposed sole source contract modification for this extension was published to the SAM.gov website on June 5, 2023, with responses due June 20, 2023. As in previous sources sought/synopsis noted above, a statement was included instructing responsible parties to submit a capability statement, which will be considered by the Government in determining the procurement approach for future requirements within scope of the contract and in consideration for follow-on procurement activities. Like previous market research efforts, there were no responses received. Therefore, no other sources have established the capability to access the Microsoft Proprietary Closed Source Code or Blue-Badge Support with direct reach back to Microsoft engineers, product developers and product teams for swift problem resolution.

As such, the recent efforts to identify other potential sources through SAM.gov has confirmed that Microsoft Corporation continues to be the only source capable of meeting the scope of the

Page 14 of 20 pages

METSS program.

MOD 04: A notice to synopsize the proposed sole source contract modification for this extension was published to the SAM.gov website on September 30, 2024, with responses due October 14, 2024. As in previous sources sought/synopsis noted above, a statement was included instructing responsible parties to submit a capability statement, which will be considered by the Government in determining the procurement approach for future requirements within scope of the contract and in consideration for follow-on procurement activities. Like previous market research efforts, there were no responses received.

Therefore, no other sources have established the capability to access the Microsoft Proprietary Closed Source Code or Blue-Badge Support with direct reach back to Microsoft engineers, product developers and product teams for swift problem resolution.

As such, the recent efforts to identify other potential sources through SAM.gov has confirmed that Microsoft Corporation continues to be the only source capable of meeting the scope of the METSS program.

7. DETERMINATION OF FAIR AND REASONABLE COST. The contracting officer will establish price reasonableness in accordance with FAR Subpart 15.404, as applicable; and in conjunction with customary commercial terms and conditions, historical prices and other than cost or pricing data may be utilized. The contracting officer will ensure contract terms, conditions, and prices are commensurate with the government’s need and best interest.

8. MARKET RESEARCH. Market research was conducted by the contracting officer’s representative (COR) and the contracting office in January 2015, August 2015 and May 2016, determining no other contractors can provide the required services. In addition, no resellers have become authorized to provide these Microsoft proprietary services. Letters provided from Microsoft, dated May 4, 2016 and June 24, 2016, confirms they are the only company able to perform the necessary MCS and MPS. Web searches further identified Microsoft is still the only source capable of providing these proprietary services. Microsoft currently has no other existing contracts for these services. Thus, the only contract vehicle that is currently active is DITCO’s METSS contract that does not expire until June 14, 2018 if all options are exercised. However, the government anticipates insufficient ceiling to last through contract expiration, thus the need for an award of METSS-II before expiration of the current METSS vehicle.

MOD 01: Market research was conducted by the COR and the Contracting Officer in August 2018. It was determined that no authorized resellers have become available, and confirmed the METSS-II pricing still provides the Government discounted rates at or below the commercial rates for Consulting Services and Premier Support. Additionally, web searches identified that Microsoft is still the only source capable of providing these services. A notice to synopsize the proposed sole source contract modification for this ceiling increase was published to the FBO website on September 6, 2018 with responses due September 21, 2018. A sources sought notice was posted to FBO.gov on September 24, 2018 with responses due October 15, 2018. As discussed above, only one contractor submitted a written response the sources sought notice.

The information provided an overview of the company’s capabilities, which lacked specificity regarding any access to Microsoft Proprietary Closed Source Code or Blue-Badge Support with direct reach back to Microsoft engineers, product developers and product teams for swift

Page 15 of 20 pages problem resolution.

MOD 02: Market research was conducted by the COR and the contracting officer August 2018 through May 2019. It was determined that no authorized resellers have become available, and confirmed the METSS-II pricing still provides the Government discounted rates at or below the commercial rates for Consulting Services and Premier Support.

MOD 03: Market research was conducted by the NWIC PAC contracting office January 2023 through May 2023. Although it was determined that there are possible authorized resellers, for the purpose of this extension, it has been determined that the METSS-II pricing still provides the Government discounted rates at or below the commercial rates for Consulting Services and Premier/Unified Support, as well as the most efficient means of continuing support until award of and transition to the DoD ESI MES follow-on is completed.

MOD 04: Market research was conducted by the NWIC PAC contracting office January 2023 through May 2023. DITCO conducted market research in posting a combined sources sought/synopsis to SAM.gov in October 2024 but did not receive any responses indicating capability or interest. Although there are possible authorized resellers that may provide partial solutions, no other source exists that can provide the full solutions available under the METSS-II vehicle. For the purpose of this extension, it has been determined that the METSS-II pricing still provides the Government discounted rates at or below the commercial rates for Consulting Services and Premier/Unified Support, as well as the most efficient means of continuing support until award of and transition to the DoD ESI MES follow-on is completed.

9. ANY OTHER SUPPORTING FACTS. The DISA network (DISANet) is the agency’s administrative C2 network, bringing office automation and connectivity solutions to DISA personnel in both the classified and unclassified arenas. The network services over 13,000 users in more than 40 locations worldwide. Microsoft Windows and Exchange are the current operating systems, and the Microsoft Office Suite is in use on the DISANet. Extensive work and resources have gone into establishing and securing the Microsoft platform. The DISA IT Services Division (SE6) has over 100 contract personnel and nearly as many government and military employees trained in operating a Microsoft-based network. In FY16, the SE6 division of DISA invested of its budget towards operating and maintaining both DISANet hardware and software that is built upon this pre-existing Microsoft architecture. Since that time, an additional has been invested in DISANet maintenance and upgrades. The Microsoft operating system has been in place on DISANet desktops and servers for over 23 years. That equates to over 23 years of moving this network forward with Microsoft compliant applications, network monitoring tools, and a workforce that is trained and certified in Microsoft products.

Furthermore, DISA supports the Army, Air Force and other DoD agencies and services, which have a significant investment of over in Microsoft software licenses procured under the current Microsoft JELA.

MOD 01: The investment and replacement value of the infrastructure has increased from over

Page 16 of 20 pages to nearly .

10. LISTING OF INTERESTED SOURCES. Not applicable.

MOD 01: The synopsis required by FAR 5.2 resulted in one interested contractor for this requirement to date which did not demonstrate ability to satisfy the scope of work under METSS-II, thus further justifying Microsoft Corporation to be the sole source of these services.

Should any additional sources identify themselves; the Government will conduct further research to adjudicate their capabilities prior to proceeding.

MOD 02: The synopsis required by FAR 5.2 resulted in one interested contractor for this requirement to date, which did not demonstrate ability to satisfy the scope of work under METSS II, thus further justifying Microsoft Corporation to be the sole source of these services. Should any additional sources identify themselves, the Government will conduct further research to adjudicate their capabilities prior to proceeding with further contracted efforts directly with Microsoft Corporation for the METSS program beyond December 2023.

MOD 03: The synopsis required by FAR 5.2 resulted in no responses or interested contractors for this requirement. Should any additional sources identify themselves, the Government will conduct further research to adjudicate their capabilities prior to proceeding with further contracted efforts directly with Microsoft Corporation for the METSS program beyond December 2024.

MOD 04: The synopsis required by FAR 5.2 resulted in no responses or interested contractors for this requirement. Should any additional sources identify themselves, the Government will conduct further research to adjudicate their capabilities prior to proceeding with further contracted efforts directly with Microsoft Corporation for the METSS program beyond December 2025.

Page 17 of 20 pages

11. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS THAT

LED TO THE EXCEPTION TO FULL AND OPEN COMPETITION.

a. Procurement History.

Contract Number: HC1028-13-D-0013 Brief Description: METSS IDIQ Contractor: Microsoft Corporation Business Type: Large Business (LB) Life Cycle Contract Value: (DISA and DoD agencies) Period of Performance (including all options):

June 15, 2013 – June 14, 2018

Contract Type: FFP Basis of Award: Sole Source with OTFAOC Justification and

Approval (J&A)

Previous protests/Congressional inquiries:

None

Task Order Number: W91QUZ-09-D-0037/KH14 Brief Description: Army Computer Hardware, Enterprise Software and Solutions IDIQ Microsoft IT Services Worldwide

Contractor: Microsoft Corporation Business Type: LB Life Cycle Contract Value:

Period of Performance (including all options):

December 15, 2013 – June 14, 2013

Contract Type: FFP Basis of Award: Sole Source with OTFAOC J&A Previous protests/Congressional inquiries:

None

b. The government will actively research the market environment throughout the IDIQ ordering period to determine if Microsoft has opened their source code to authorized resellers. Additionally, research will be conducted to determine if alternatives exist to Microsoft offerings meeting the Government’s need.

12. REFERENCE TO THE APPROVED ACQUISITION PLAN (AP). A combined AS/AP is currently in the approval phase.

MOD 01: The combined AS/AP was approved on July 7, 2016. The AS/AP will be revised to reflect this modification.

MOD 02: The combined AS/AP was approved on July 7, 2016 and the first revision of the AS/AP, Version 1.1 dated August 2018, was approved February 25, 2019. The AS/AP will be revised to reflect this modification.

Page 18 of 20 pages

MOD 03: The combined AS/AP was approved on July 7, 2016. The first revision of the AS/AP, Version 1.1 dated August 2018, was approved February 25, 2019, and the second revision of the AS/AP, Version 1.2 dated July 2019, was approved July 17, 2019. The AS/AP will be revised to reflect this modification.

MOD 04: The combined AS/AP was approved on July 7, 2016. The first revision of the AS/AP, Version 1.1 was approved February 25, 2019. The second revision of the AS/AP, Version 1.2 was approved July 17, 2019. The third revision of the AS/AP, Version 1.3 was approved September 8, 2024. The AS/AP will be revised to reflect this modification.

Page 19 of 20 pages

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: DeOnna S. Collins SIGNATURE/DATE: See Signature Page

TITLE/ORGANIZATION: Chief, Lifecycle Planning and Enterprise Contracts Branch

PHONE: (667) 890-4518

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Colleen M. Rumsey SIGNATURE/DATE: See Signature Page

TITLE/ORGANIZATION: Chief, Logistics and Contracts Division

PHONE: (667) 890-3399

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: Annette L. Aamodt SIGNATURE/DATE: See Signature Page

TITLE/ORGANIZATION: Contracting Officer, PS8311

PHONE: (667) 890-1080

SENIOR PROCUREMENT EXECUTIVE APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief. Since this justification for OTFAOC exceeds , this review serves as approval.

NAME: Christopher M. Barnhurst SIGNATURE/DATE: See Signature page

TITLE/ORGANIZATION: SENIOR PROCUREMENT EXECUTIVE/DISA

PHONE: 301-225-6036

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

ANNETTE L. AAMODT, 667-890-1080, ANNETTE.L.AAMODT.CIV@MAIL.MIL

Page 20 of 20 pages

ACROYMNS

AD Active Directory AP Acquisition Plan ANC Alaskan Native Company AS/AP Acquisition Strategy/Acquisition Plan C2 Command and Control CHESS Computer Hardware, Enterprise Software and Solutions CONUS Continental United States COR Contracting Officer’s Representative DEE Defense Enterprise Email DEPS Defense Enterprise Portal Service DEPSECDEF Department of the Secretary of Defense DISA Defense Information Systems Agency DISANet Defense Information Systems Agency Network DoD Department of Defense DOS Denial of Service DECC Defense Enterprise Computing Centers DEE DoD Enterprise Email DEPS Defense Enterprise Portal Service DITCO Defense Information Technology Contracting Office GSA General Services Administration ES Enterprise Services FFP Firm Fixed Price IDIQ Indefinite Delivery Indefinite Quantity IdAM Identity and Access Management IGCE Independent Government Cost Estimate IM Implementation and Maintenance ISC Implementation and Sustainment Center IT Information Technology IP Intellectual Property JELA Joint Enterprise License Agreement with Microsoft JOTFAOC Justification for Other Than Full and Open Competition METSS-II Microsoft Enterprise Technical Support Services-II MCS Microsoft Consulting Services MPS Microsoft Premier Support NAICS North American Industry Classification System OCONUS Outside the Continental United States OTFAOC Other Than Full and Open Competition PMO Program Management Office PWS Performance Work Statement WIN10 Windows 10 Secure Host Baseline