JA24-032 Fit for Purpose_Redacted.pdf

Controlled By: DISA Controlled By: PS85(Provisional) CUI Category: PROCURE Distribution/Dissemination Control: FEDCON POC: disa.scott.ditco.mbx.ditco-jwcc@mail.mil

Page 1 of 8 pages

JUSTIFICATION & APPROVAL FOR FEDERAL ACQUISITION REGULATION

SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Contract

Orders under Fair Opportunity Federal Acquisition Regulation (FAR) 16.505, Defense FAR Supplement 216.505-70, Procedures, Guidance, and Information 216.505-70

Purchase Request Number: To be determined (TBD) Joint Warfighting Cloud Capability (JWCC) Contract Number: HC105023D0004 Task Order Number: TBD Procurement Title: Fit-For-Purpose Cloud Estimated Value:

Statutory and Regulatory Authority: 10 United States Code (U.S.C.) 2304c(b) and FAR 16.505(b)(2)(i)(B)

EXCEPTION TO FAIR OPPORTUNITY

Number: JA24-032

Upon the basis of the following justification, I, as the Head of Contracting Activity (HCA), hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C. 2304c(b) and Regulatory Authority of FAR 16.505(b)(2)(i)(B).

1. REQUESTING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

Defense Human Resources Activity Headquarters (DHRA)/Defense Manpower Data Center (DMDC) 4800 Mark Center Dr.

Alexandria, VA 22350-4000 United States of America

Contracting Activity:

Defense Information Systems Agency/Defense Information Technology Contracting Organization/PS85 - Provisional

2300 East Drive Scott Air Force Base, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

This action is to issue a firm fixed price task order (TO) against the JWCC Indefinite Delivery/Indefinite Quantity Contract for Fit-for-Purpose Cloud, which shall include infrastructure for additional capabilities required to meet mission requirements. This TO will be

Fit-For-Purpose Cloud-JA24-032

Page 2 of 8 pages issued directly to Oracle America. The anticipated period of performance (PoP) is for a 1-year base period, plus three 1-year option periods. The total estimated value is

3. DESCRIPTION OF SUPPLIES/SERVICES:

Defense Manpower Data Center (DMDC) is a Department of Defense (DoD) data center that provides joint information sharing and support on DoD human resource issues. DMDC is the central source for identifying, authenticating, authorizing, and providing information on personnel during and after their affiliation with DoD; and the one, central access point for information and assistance on DoD entitlements, benefits, and medical readiness for uniformed service members, veterans, and their families.

The contractor shall provide Infrastructure-as-a-Service (IaaS) for DMDC Seaside & Defense Enterprise Computing Center (DECC) Columbus, and the Civilian Personnel Information Technology (IT) Portfolio at the DoD Cloud Computing Security Requirements Guide (SRG) Impact Level 4 (IL4) or above.

This requirement is a continuing effort to migrate DMDC applications from physical data centers to the current infrastructure. DMDC requires cloud space for the continued hosting of the DoD Civilian Human Resources (HR) IT portfolio and hosting of persistent Non-classified Internet Protocol Router Network (NIPRNet) systems, currently hosted at the DMDC enclave at the Columbus, OH DECC and the Seaside, CA data center. The infrastructure allows for additional capabilities required to support the next generation transactional Civilian HR system, Defense Civilian Human Resources Management System (DCHRMS).

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity.

FAR 16.505(b)(2)(i)(B) - Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(b) Description of the Justification.

This requirement builds upon an initial Government investment in cloud storage solutions and is a continuing effort to migrate DMDC applications from the on-premise data centers to the IaaS. Additional storage capacity is required to support the infrastructure migration and to migrate the remainder of the HR system applications to the current IaaS, co-located with the Human Capital Management (HCM) platform to ensure interoperability, performance, and security. These systems interoperate with the central HR data, and as such, the DoD can only achieve acceptable levels of network optimization by retaining the current cloud environment. Only the current infrastructure

Page 3 of 8 pages will facilitate HR mission requirements by enabling the different applications to efficiently interface the transactions which occur daily.

(c) Justification.

(1) Minimum Government requirements.

The services must continue at their current level to support the migration of two geographically separated data centers. The current environment provides a highly reliable and scalable infrastructure platform in the cloud. Additionally, it provides DMDC users the ability to utilize, stand up, and take down IT infrastructure (both programs and platforms) on demand. For this acquisition, additional Oracle capacity is required to support the infrastructure migration and to facilitate closure of the

Minimum Performance includes:

Provide Compute, Storage, Network, and other cloud capabilities in the current environment. The follow-on solution must be compatible to seamlessly integrate with the Government’s existing environment.

Provide expertise in supporting the configuration and operations of the current environment per the standard Original Equipment Manufacturer (OEM) Service Level Agreement (SLA).

Provide IaaS environment for Test and Development (non-Production).

Maintain Federal Risk and Authorization Management Program (FedRAMP) moderate and DoD Impact Level 4 (IL4) minimum certification for the current IaaS environment with no break in service.

Secure optimized network configuration options between Oracle Cloud Infrastructure (OCI) and Oracle Fusion. Enabling connectivity between the HCM and IaaS clouds for the DMDC applications.

Provide a single hosting, unimpeded application integration, data sharing, and improved security.

(2) Proposed sole source contractor.

Oracle America

(3) Discussion regarding the cause of the sole source situation.

DMDC is migrating its data centers to the cloud using Oracle OCI as the primary cloud platform for DMDC’s portfolio, serving as the IaaS component due to its compatibility with existing Oracle infrastructure. DMDC has used a lift and shift strategy to migrate existing workloads to target cloud platforms with minimal modifications. DMDC has already established governance and infrastructure to support this approach.

DMDC's plan to migrate from on-prem data centers to the cloud was initially estimated to take two (2) years but changes in DoD Chief Information Officer’s (CIO’s) security

Page 4 of 8 pages certification and accreditation policies and processes caused unforeseen delays. The project's initial cost, financial, and timeline estimates were based on preliminary knowledge of policies related to Authority to Operate (ATO) and Authority to Connect (ATC) status approvals. Clarification from the DoD CIO revealed that each individual DMDC system or application needed to be reviewed for their target cloud environment's ATO/ATC statuses. This led DMDC to refocus resources, budget, and personnel to support this priority, and the actual impact on DMDC's cloud migration roadmaps was greater than expected. Moreover, as DMDC was one of the first federal clients to utilize Oracle OCI, additional configuration was required.

DMDC has invested significant time and effort to clearly define its ATO and ATC processes. With these processes in place, migrations of systems have become much more streamlined.

No other cloud service provider can meet the high Oracle dependencies on technology and transactional interfaces at this time nor would it be feasible to attempt to run DMDC’s core structure in multiple environments. Current DMDC infrastructure is built around Oracle technologies that are leading the market; such as, Real Application Clusters (RAC), unique to Oracle, which allows DMDC to serve high volume data requirements of the DoD. No other CSP can seamlessly integrate with the DMDC infrastructure to meet the Government’s minimum requirement of compatibility.

In addition, the Fit for Purpose cloud strategy must comply with the DoD Cloud Computing Security Requirements Guide (CC SRG) IL4 and the cloud service provider must have a provisional authorization (PA) and obtain a Component ATO.

This technical strategy will eliminate the legacy footprint and coalesce on the common Oracle cloud-based solution to meet the objectives of the functional business owner’s organizational execution plan. The complete transition and migration out of the physical data centers must be accomplished by 2025/2026 before complete decommissioning to allow for an orderly shutdown and removal of the legacy infrastructure by the 2027 deadline. The Oracle solution is uniquely positioned to support the DoD DMDC operational needs within their product offerings. The Enterprise Human Resources Information Systems (EHRIS) portfolio runs in the OCI IaaS enclave and are closely integrated via Application Programming Interfaces (APIs) and data exchanges with the DCHRMS portfolio running in Oracle SaaS. If the EHRIS portfolio was transitioned into another CSP enclave the integration would be severed which would impact the DHRA mission to seamlessly provide human resource capabilities to the civilian population of the Department of Defense. Over time the EHRIS portfolio of systems will be transitioned into the SaaS solution and no longer run in the IaaS enclave.

Most recently, the DOD CIO approved DMDC’s Business Case Analysis (BCA) “DMDC Application and System Cloud Migration”, dated 21 June 2023, which reviewed DMDC’s current strategy of migrating systems from data centers to the current IaaS while re-evaluating cloud migration alternatives previously assessed. The DOD CIO

Page 5 of 8 pages approved the decision to remain status quo, continuing current migration of DMDC systems with IaaS platform solution.

(4) Demonstration of unique source.

The unique qualifications that this solution provides are a single hosting, unimpeded application integration, data sharing, and improved security. This would not be possible with the introduction of another CSP’s IaaS environment. The homogeneous environment minimizes risk to operational performance and security of data in transit.

The Oracle solution is the only solution that is compatible and can seamlessly integrate with the Government’s existing environment.

Oracle is the only CSP that possesses the knowledge, skills, capabilities, certification, clearance, and experience required to continue the program without a break or degradation in critical mission services. Given these critical mission requirements, Oracle is the only contractor that can perform the necessary services for the DoD to meet the Government’s minimum needs.

(5) Procurement discussion.

a. The required PoP start date is 29 April 2024 to allow for a 30-day transition period prior to the completion of the current task order, which ends 28 May 2024.

(6) Impact.

There is no interoperability or portability between CSPs, as such, moving between CSPs would require DHRA’s systems to undergo a major migration and re-engineering, which would erase the invested across the various systems discussed below. The refactoring of the current environment from OCI IaaS to a different CSP would risk system availability, and based on the amount of time it has taken to reach the current state, could cause up to six years’ delay before achieving Full Operational Capability.

If DHRA must start the Civilian HR IT Portfolio Cloud Migration project over with a new CSP, they will have to build an entire new set of infrastructure at the new CSP, reengineer the BCAP and Cybersecurity Service Provider (CSSP) services, and achieve Cyber Security Certifications and ATO decisions. The time lost would cause irreparable damage to the DoD and the customers it serves

. Investment lost is comprised of contract engineering labor and Government labor, with a small percentage being from Cloud usage credits/access fees.

This drives the Government’s current need of compatibility with the current infrastructure.

Since DoD has relied on a Federal version of the Commercial-Off-the-Shelf (COTS) Oracle E-Business Suite Enterprise Resource Planning system, by staying within the

Page 6 of 8 pages

Oracle environment the DoD can achieve the acceptable levels of network optimization and reduce the number of network connections to improve cybersecurity posture and reduce exposure of critical Personal Identifiable Information (PII) data.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION:

A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the independent government cost estimate and the JWCC Catalog pricing, including any discounts, which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

6. MARKET RESEARCH:

Market research was conducted and resulted in a signed market research report on 9 Nov 2021 for the basic JWCC contracts. After a survey of the market, it was concluded that the JWCC Contract is in the Government’s best interest due to technical feasibility and cost to the Government.

Market research was conducted in July 2023 by reviewing the specific capabilities in the JWCC Contracts and it was determined that OCI IaaS can be obtained through the streamlined vehicle.

Further research was conducted by reviewing the JWCC contractor's catalogs to determine if other similar offerings meet or can be modified to satisfy the Government’s requirements. The results have determined, while there are other CSPs capable of providing IaaS, no other offering can meet the Government’s minimum requirements. Only Oracle can seamlessly integrate with the existing architecture and meet the Government’s current need of compatibility.

Only by staying within the Oracle environment can DoD reduce the number of network connections to meet the Secretary of Defense’s (SECDEF) direction to improve the cybersecurity posture and reduce exposure of Solutions with other CSPs are not compatible with the existing structure and do not allow for a seamless integration among current network connections and data interfacing between multiple environments.

Therefore, it was determined the OCI IaaS is essential to the Government’s requirements and Oracle is the only source capable of fulfilling the Government’s minimum needs.

7. ANY OTHER SUPPORTING FACTS: None

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History:

Contract Number: NNG15SC33B Task Order Number: 47QFMA23F0011

Page 7 of 8 pages

Period of Performance: May 29, 2023 - May 28, 2024 Competitive Status: Other than full and open competition Business Size: Large business

Contract Number: NNG15SC10B Task Order Number: 47QFMA20F0015 Period of Performance: July 23, 2020 – May 28, 2023 Competitive Status: Other than full and open competition Business Size: Small business

Contract Number: NNG15SC10B Task Order Number: H9821019F0226 Period of Performance: May 29, 2019 - May 28, 2021 Competitive Status: Other than full and open competition Business Size: Small business

(b) In compliance with the Federal Data Center Closure Initiative and as mandated by the DoD CIO, this requirement will continue to move toward a Government Cloud solution.

DMDC plans to analyze the portfolio for rationalization once the migration of the two (2) on-premises data centers is complete. Post migration, DMDC will be in a better position to understand what level of dependency will remain and another study can be conducted, if needed. For new requirements, DMDC will conduct a thorough review of the marketplace to locate additional sources to identify and remove any barriers to competition so that competition can be obtained to the maximum extent practicable.