JA24-073 ICAM 852469178 REDACTED.pdf

JUSTIFICATION & APPROVAL FOR FEDERAL ACQUISITION

REGULATION SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Contract

Orders under Fair Opportunity Federal Acquisition Regulation (FAR) 16.505, Defense FAR Supplement 216.505-70, Procedures, Guidance, and Information 216.505-70

Military Interdepartmental Purchase Request Number:

Joint Warfighting Cloud Capability (JWCC) Contract Number: HC105023D0003 Task Order (TO) Number: To be Determined Procurement Title: Identity, Credential, and Access Management (ICAM) Estimated Value:

Statutory and Regulatory Authority: 10 United States Code (U.S.C.) 2304c(b) and FAR 16.505(b)(2)(i)(B)

EXCEPTION TO FAIR OPPORTUNITY

Number: JA24-073

Upon the basis of the following justification, I, as the Head of Contracting Activity (HCA), hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C. 2304c(b) and Regulatory Authority of FAR 16.505(b)(2)(i)(B).

1. REQUESTING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

Defense Information Systems Agency (DISA) Development and Business Center Logistics and Contracts Division and DISA Operations Center 6910 Cooper Avenue Fort Meade, Maryland 20755-7088

Contracting Activity:

DISA/Defense Information Technology Contracting Organization/PS8511

2300 East Drive Scott Air Force Base, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

This action is to issue a firm-fixed-price task order (TO) against the JWCC Indefinite Delivery/Indefinite Quantity Contract for Identity, Credential, and Access Management (ICAM).

This TO will be issued directly to Microsoft Corporation. The anticipated period of performance (PoP) is for a base period of twelve months with three, 12-month option periods. The total estimated value is of which will be funded with Operations & Maintenance funds.

JA24-073 Identity, Credential, and Access Management

Page 2 of 7 Pages

3. DESCRIPTION OF SUPPLIES/SERVICES:

This requirement is for the procurement of Microsoft IL4, IL5, and IL6 licenses, web application, storage, networking, security, database, and identity management services in support of the ICAM program and transfer of the current cloud environment. The ICAM team is focused on building a standardized and scalable cloud-based identity solution that will support hundreds of Department of Defense (DoD) mission partner applications. In addition, the ICAM Program Management Office (PMO) must satisfy high availability and redundancy requirements. In order to support incoming requirements and to scale ICAM to an enterprise solution, the ICAM PMO requires Microsoft cloud licensing as well.

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity.

FAR 16.505(b)(2)(i)(B) - Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(b) Description of the Justification.

DISA PEO Cyber is developing an enterprise wide ICAM capability to centrally monitor, manage, secure, and audit identity, access, and authorization seamlessly across the DoD.

The challenge faced by the DoD is to integrate and monitor data ingress and egress seamlessly between diverse cloud service provider (CSP) capabilities to meet broad enterprise requirements, including the ability to audit who has access to what (and when) across diverse organizational boundaries. In July 2020, DISA’s solution was formally approved as the DoD’s Enterprise ICAM capability in a memo issued by the Deputy Secretary of Defense.

In 2022, the DISA ICAM program deployed its capabilities in the Microsoft cloud to enable the ability to provide authentication, authorization, and identity to customer applications across a dynamic and disjointed computing environment. The DISA ICAM capability is a standardized and scalable cloud-based solution that is comprised of three primary components including Automated Account Provisioning (AAP) - SailPoint, Master User Record (MUR) – Radiant Logic, and an Identity Provider (IdP) – Global Federated User Domain (GFUD). Microsoft serves as a part of the current ICAM’s infrastructure which is hosting the ICAM components and applications for all mission partners. Presently, ICAM is supporting authentication services to over 300 customer applications, serving 3 million authentication requests daily and 100 million authentication requests monthly.

In February 2023, DISA intended to leverage the JWCC contract; however, due to ICAM mission requirements, the program was unable to shift efforts to meet a JWCC task order

Page 3 of 7 Pages award timeline in 2023. No other CSP can provide similar functionality, as the cloud architecture cannot be integrated into a program environment other than Microsoft’s.

CSPs other than Microsoft would need to support not only the infrastructure, the 400+ VMs/Devices configured, the transfer of data & DoD Records from Microsoft to their environment, the full time equivalent (FTE) hours configuring systems, validation of all network & firewall paths, re-engineer interfaces with the other six ICAMs in the DoD, re-authorization from the Authorizing Official (AO), and thousands of hours of direct customer interaction to migrate their applications’ dependencies to the new cloud. The current operating systems and infrastructure to centrally monitor, manage, secure, and audit identity, access, and authorization seamlessly across the DoD, has already been implemented by Microsoft to support and maintain operations. Only Microsoft meets the required need for operational support and compatibility with existing architecture.

Introducing alternative products would not meet the Government’s need for interoperability.

The DoD Enterprise-ICAM is a complete and operational program in Microsoft hosting.

ID2 has over 300 applications leveraging the unclassified environment and ramping up on-boarding for the classified environment. It is technically not feasible to rebuild a production environment in a new cloud and migrate 300+ DoD-wide applications in the current timeframe. In addition to capital investments, there are also an exorbitant amount of direct customer engagements that would have to go into moving connections, IPs, and service account certificates.

(c) Justification.

(1) Minimum Government requirements.

This requirement is for the procurement of Microsoft IL4, IL5, and IL6 licenses, web application, storage, networking, security, database, and identity management services in support of the ICAM program and transfer of the current cloud environment. The ICAM team is focused on building a standardized and scalable cloud-based identity solution that will support hundreds of DoD mission partner applications. In addition, the ICAM PMO must satisfy high availability and redundancy requirements. In order to support incoming requirements and to scale ICAM to an enterprise solution, the ICAM PMO requires Microsoft cloud licensing.

The cloud service offerings and licenses must be compatible with and seamlessly integrate into the scalable cloud-based identity solution that is currently in production. These offerings include Microsoft licensing in support of six subscription services that are currently deployed in the ICAM production environment.

(2) Proposed sole source contractor. Microsoft Corporation

(3) Discussion regarding the cause of the sole source situation.

Page 4 of 7 Pages

The other CSPs' offerings will not work for DISA ICAM since the IdP component is Microsoft-based and heavily relies on the Microsoft environment to provide the authentication services for customer applications and O365 tenants. Moving to another cloud services would require ICAM to build another IdP, which is not cost effective or in the best interest of the government. No other CSP can seamlessly integrate with the ICAM infrastructure to meet the Government’s minimum requirement of compatibility.

The only source capable of providing the ICAM at the level and quality required is Microsoft.

(4) Demonstration of unique source.

Microsoft possesses the knowledge, skills, capabilities, certification, clearance, and experience required to continue the program without a break or degradation in required mission services and licenses. The ICAM architecture cannot be seamlessly integrated into another CSPs’ environment and would not be functional in the Microsoft GovCloud infrastructure. Microsoft is the only CSP that is capable of performing the necessary services and providing the required licenses for the DoD within the current required timeline of June 1, 2024.

(5) Procurement discussion.

a. The ICAM PMO has determined that JWCC is the best fit for this requirement. The

DoD ICAM has deployed its three primary components in the Microsoft cloud hosted environment with the potential to deploy in IL5 to include the IdP, AAP, and the MUR.

DoD ICAM promotes centralization of identity and credential management, including attribute management and credential issuance and revocation. DoD ICAM is a cloud hosted Authentication and Authorization solution that contains all DoD identities. With the DoD ICAM feeding provisioning and deprovisioning information authoritatively, aggregating authorized access, and reports that could provide adversaries against targeted attacks.

b. Since there is already an existing environment, the CSP is immediately able to shift to supporting the resultant award associated with this contract action. In addition, another contractor would not be able to integrate with the current ICAM architecture.

(6) Impact.

The Government would be required to re-write all the programs and modules within the current environment to ensure compatibility with a different CSP. This includes development, testing, accreditation, and interoperability considerations at a significant cost to the Government. This drives the Government’s current need for compatibility. If another CSP is chosen that cannot seamlessly integrate with the existing architecture the result would be a loss of defensive cyberspace capabilities for the DoD and potentially failure of our national defense mission.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION:

Page 5 of 7 Pages

A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the independent government cost estimate and the JWCC Catalog pricing, including any discounts, which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

6. MARKET RESEARCH:

Market research for the basic JWCC Contracts was conducted and resulted in a signed market research report on 9 Nov 2021 for the basic JWCC contracts. After a survey of the market, it was concluded that the JWCC Contract is in the Government’s best interest due to technical feasibility and cost to the Government.

Further research was conducted in March 2023 by reviewing the JWCC CSPs’ catalogs to determine if other similar offerings to procure IL4/IL5/IL6 licensing meet or can be modified to satisfy the Government’s requirements. The results have determined that no other offering is suitable. Therefore, it was determined the Microsoft IL4/IL5/IL6 licenses as identified in paragraph 4(c)(3) above is essential to the Government’s requirements and Microsoft Corporation is the only source capable of fulfilling the Government’s minimum needs in the manner and time frame required.

In April 2024 a request for additional research was sent to the other three CSPs, Amazon Web Services, Google Public Sector, and Oracle. It was determined that other CSPs may provide similar functionality, but the cloud architecture cannot be integrated into a competing environment. Existing ICAM infrastructure is located inside of Microsoft cloud and is technically infeasible to modify those applications to work within another CSP environment.

Moving to another CSP would require not only the infrastructure, but the 400+ Virtual Machines/Devices configured, the transfer of data and DoD records from Microsoft to their environment, the FTE hours configuring systems, validation of all network & firewall paths, re-engineer interfaces with the other six ICAMs in the DoD, re-authorization from the AO, and thousands of hours of direct customer interaction to migrate their applications’ dependencies to the new cloud. This solution took 2-years to develop and implement into production.

Transferring to another CSP will require a similar timeframe and an in additional cost. The current operating systems and infrastructure have been implemented using the CSP proprietary tools and service offerings which are required to support and maintain operations. Only Microsoft meets the required need for operational support and compatibility with the existing architecture and introducing alternative products would not meet the Government’s minimum need for interoperability.

7. ANY OTHER SUPPORTING FACTS: None.

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History

(1) Contract Number: 47QFSA23K0047

(2) Task Order Number: 47QFSA23F0048

Page 6 of 7 Pages

(3) PoP: June 1, 2023 to May 31, 2024

(4) Business Size: Large Business

(b) To overcome future barriers to competition, future development and enhancement of

Infrastructure as a Service components will include shifting to a containerized platform.

This will enable multiple CSPs to meet the requirements which will enable the flexibility to shift workload based on financial and mission requirements. The Government will continue to conduct market research to determine if there are changes in the marketplace that would enable future competitive actions.

Page 7 of 7 Pages

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

TITLE/ORGANIZATION:

PHONE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

TITLE/ORGANIZATION:

PHONE:

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

TITLE/ORGANIZATION:

HEAD OF THE CONTRACTING ACTIVITY APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief. Since this justification does not exceed $100M, this review serves as approval.

NAME: Mr. Douglas Packard SIGNATURE:

TITLE/ORGANIZATION: HCA, DISA/DITCO

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO