JA23-069 MOD 02 - 852366807 EM5_FINAL_Redacted.pdf

Enterprise Messaging-JA23-069 MOD 02

JUSTIFICATION & APPROVAL FOR FEDERAL ACQUISITION

REGULATION SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Contract

Orders under Fair Opportunity Federal Acquisition Regulation (FAR) 16.505 (b), Defense FAR Supplement 216.505(b), Procedures, Guidance, and Information 216.505(b)

Purchase Request Number: HC1085340317 Contract Number/Task Order Number: HC105023D0003/HC105023F0022 Procurement Title: Enterprise Messaging (EM5) Estimated Value:

Statutory and Regulatory Authority: 10 United States Code (U.S.C.) 2304c(b) and FAR 16.505(b)(2)(i)(B)

EXCEPTION TO FAIR OPPORTUNITY

Number: JA23-069 MOD 02

Upon the basis of the following justification, I, as the Procuring Activity Competition Advocate, hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C.

2304c(b) and Regulatory Authority of FAR 16.505(b)(2)(i)(B).

1. REQUESTING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

Defense Information Systems Agency (DISA) SD44 6910 Cooper Ave.

Fort Meade. MD 20755

Contracting Activity:

DISA/Defense Information Technology Contracting Organization (DITCO)/PS8511 2300 East Drive Scott Air Force Base, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

MOD 02: This modification is to increase the value by in support of two changes.

The first increase amount of is to account for unanticipated consumption increase in the amount of for Unclassified Cloud (CLIN 0101), and for Secret Classified Cloud (CLIN 0103). The second increase is to add 15% surge in the amount of

. The increases are required due to heavier than anticipated workloads since the completion of EM4 Migration. All EM4 Mission Partners have joined the EM5 which rapidly increased daily usages for test events and activities. Additionally, the original estimates for the EM5 cloud environment did not foresee future expansion of workloads, therefore surge was not originally included in the estimate. Based on current usage and known requirements, it is clear that growth for cloud is needed for this task order to address the usage of all EM4 Mission Partners as they have migrated to the EM5 cloud environment.

EM5 system CSP needs to be the same for both IL5 and IL6 due the utilization of the same EM code base and application. Per the Joint Emergent Operational Need (JEON ST-00100), EM5 must use a CSP that offers more than one availability zone in IL6.

(c) Justification

(1) Minimum Government requirements. The Government requires multiple regions of service availability, with a significant geographical separation between the primary and secondary region in both IL5 and IL6 environments.

(2) Proposed sole source contractor. Microsoft

(3) Discussion regarding the cause of the sole source situation.

The only source capable of performing the EM5 at the level and quality required is Microsoft based on Microsoft’s multi-region infrastructure for IL6. Microsoft Azure is the only CSP that meets the requirement of multiple regions that provide geo-redundancy dispersed locations on IL6, which are designed to offer protection against localized disasters with availability zones and protection from regional or large geography disasters with disaster recovery, by making use of another region not in the same geographic location. The requirement is also the same for IL5. Although, there are other CSPs that meets this requirement on IL5, the CSP needs to be the same for both IL5 and IL6 due to the utilization of the same EM code base and application. Per the JEON-ST-0010 requirements, deploying EM5, multiple regions of service must maintain availability.

(4) Demonstration of unique source.

EM5 does not have a current contract/task order with JWCC; however, we do have a current contract with Defense Enterprise Office Solution (DEOS)/General Services Administration (GSA) in which we have procured and are utilizing Microsoft Azure Government Cloud for IL5 and IL6 following the determination that only Microsoft was capable of meeting the geo-redundancy at geographically separated regions.

Microsoft alone possesses the capabilities, certification, authorizations, and clearance required to continue the program without a break or degradation in critical mission services. Given these critical mission requirements, Microsoft Azure is the only CSP capable of performing the necessary services for the Department of Defense within the current required timeline.

(5) Procurement discussion.

a. During the planning stage, it was determined that only Microsoft Azure met the EM5 requirement of active-active configuration across geographical dispersed locations. As such, EM5 is currently deployed with the DEOS contract vehicle in which the team has designed an Azure cloud-native architecture and have implemented 75-80% of the necessary Infrastructure as Code (IaC) automation in Terraform. Pivoting to a new CSP will have a substantial schedule impact of seven to nine months, optimistically, across the entire EM5 program, which is tied to a two-year Joint Emergent

Operational Need (JEON) and the first year will be completed in August 2023. In addition to time, estimated duplicative and unrecoverable costs in the amount of will be incurred by switching CSPs. Another factor to this decision is the implication of the current Platform Engineering. The platform would need a substantial rework of the platform baseline. This was awarded as a Platform as a Service (PaaS)/CSP-native solution. It would require re-architecture of a compliant cloud-native platform, investigation of the optimal PaaS services available in all IL5 and IL6 regions, and re-implementation of IaC for the new CSP. Notwithstanding the aforementioned extensive time period and duplication of cost, there simply is no other CSP that offers the required geographical separation at IL6.

Cybersecurity implications include: Requirement for all cloud specific Interim Authorization to test (IATT)/Authority to Operate (ATO) artifacts to be re-implemented or at least a substantial rework.

All IATT controls would require re-analysis. Architecture, access control, auditing, and high availability solutions for a new CSP. Also, the Cybersecurity Service Provider solution needs to be reinvestigated and appropriate solutions procured. Only one other CSP offers IL5 and IL6 environments, however they do not offer multiple regions of service availability at a considerable geographical distance. Other similar IL6 environments do not meet, nor can be modified to meet, the Government’s requirements due to the fact that there are no other CSP environments currently available to meet this need.

(6) Impact. The EM5 mission provides critical support for STRATCOM, NORTHCOM, DISA, NAVY, and SPACECOM, with 80% of missions supported are on the SIPRNet (which is IL6). Selecting another CSP that doesn’t have multiple regions of availability spread across a wide geographical area can negatively impact critical mission support.

(7) A sole source award to Microsoft is necessary, as noted above, in order to meet the Description of Work requirements. Currently, Microsoft is the only CSP that provides a geographically dispersed, multi-region capability at IL6.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION: A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the independent government cost estimate and the JWCC Catalog pricing, including any discounts, which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

6. MARKET RESEARCH:

Market research was conducted and resulted in a signed market research report on 9 Nov 2021 for the basic JWCC contracts. After a survey of the market, it was concluded that the JWCC Contract is in the Government’s best interest due to technical feasibility and cost to the Government.

Additional research was conducted 2 Mar 2023 by reviewing the specific capabilities in the JWCC Contracts and it was determined that Microsoft is the only source capable of fulfilling the Government’s minimum needs in the manner and time frame required. Microsoft is the only CSP to offer a second IL6 region which necessitates EM5 use Microsoft Azure to fulfil this requirement.

EM5 has a multi-region IL6 requirement per JEON ST-0010 that can only be met with a CSP that offers multiple IL6 regions.

Further research was conducted 2 Mar 2023 by reviewing the JWCC contractor's catalogs to determine if other similar offerings (to include a geographically dispersed multi-region capability in IL6) meet or can be modified to satisfy the Government’s requirements. The results of our market research indicated that no other CSP offering is suitable, due to no other CSP providing the required capability at this time. Therefore, it was determined that Microsoft is the only source capable of fulfilling the Government’s minimum needs in the manner and time frame required.

7. ANY OTHER SUPPORTING FACTS: None

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS THAT

LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History. The EM5 PMO began Market Research in NOV 2022 and it was confirmed that only Microsoft Azure meets the EM5 requirement of multiple regions providing geo-redundancy dispersed locations on IL6.The requirement is also the same for IL5. Although, there are other CSPs that meets this requirement on IL5, the CSP needs to be the same for both IL5 and IL6 due the utilization of the same EM code base and application. Following this determination, the EM5 PMO started procurement with DEOS/GSA Azure CSP at the end of FEB 2023 and the contract was awarded in APR 2023. The EM5 team received Azure accounts at the end of APR 2023. Thus far, the EM5 team has designed an Azure cloud-native architecture and have implemented 75-80% of the necessary IaC.

(b) Briefly describe the actions proposed to remove barriers to fair opportunity and explain the results thereof, if a J&A was prepared to support any related prior procurement(s).

No J&A was required to procure the DEOS contract vehicle. Therefore, the actions that the EM5 team plans to take in the future to remove barriers to fair opportunity are prior to executing the option period, the team will conduct Market Research to identify if there is more than one vendor that is able to provide the geographically dispersed multi-region capability in IL6, recompete the existing requirement and/or any future requirements , and select the CSP that provides the best value based on the EM5 solution.