JA24-122 DISA CSSP 365 Redacted.pdf

Controlled By: DISA Controlled By: DISA/EII/EC1 CUI Category: PROCURE Distribution/Dissemination Control: FEDCON POC: disa.letterkenny.eiic.list.re-io-od-cor@mail.mil

Page 1 of 7 Pages

CUI

JUSTIFICATION & APPROVAL FOR FEDERAL ACQUISITION

REGULATION SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Contract

Orders under Fair Opportunity Federal Acquisition Regulation (FAR) 16.505, Defense FAR Supplement 216.505-70, Procedures, Guidance, and Information 216.505-70

Universal Purchase Request Number: HC108924J34R20 Joint Warfighting Cloud Capability (JWCC) Contract Number: HC105023D0003 Task Order Number: To be determined Procurement Title: Defense Information Systems Agency (DISA) Cybersecurity Service Provider (CSSP) Department of Defense 365-Joint (DOD365-J) Tenant Defender for Server Estimated Value: $5,245,426 Statutory and Regulatory Authority: 10 United States Code (U.S.C.) 2304c(b) and FAR 16.505(b)(2)(i)(B)

EXCEPTION TO FAIR OPPORTUNITY

Number: JA24-122

Upon the basis of the following justification, I, as Procuring Activity Competition Advocate, hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C. 2304c(b) and Regulatory Authority of FAR 16.505(b)(2)(i)(B).

1. REQUESTING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

DISA/Operations Center CYBERSPACE-OPERATIONS One Overcash Ave, Bldg. 1 Chambersburg, PA 17201 United States of America

Contracting Activity:

DISA/Defense Information Technology Contracting Organization/PS85

2300 East Drive Scott Air Force Base, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

This action is to issue a firm-fixed-price task order (TO) against the JWCC Indefinite Delivery/Indefinite Quantity Contract for DISA CSSP DOD365-J Tenant Defender for Server.

This TO will be issued directly to Microsoft Corporation. The anticipated period of performance

JA24-122 DISA CSSP DOD365-J Tenant Defender for Server

Controlled By: DISA/EII/EC1 CUI Category: PROCURE Distribution/Dissemination Control: FEDCON POC: disa.letterkenny.eiic.list.re-io-od-cor@mail.mil

Page 2 of 7 Pages

CUI

(PoP) is for a 1-year base period, plus three 1-year option periods. The total estimated value is $5,245,426 of which will be funded with Working Capital funds.

3. DESCRIPTION OF SUPPLIES/SERVICES:

The DISA CSSP intends to onboard server assets to Defender for Server, Plan 2, within the existing DOD365-J Software as a Service (SaaS) Tenant at Impact Level 4 and Impact Level 5.

The DISA CSSP will fund an initial capability for onboarding up to 1,000 servers, during the base period The Defender for Server capability will include: Defender for Server Plan 2, Defender for Server data ingest into the Log Analytic Workspace, deployment of Sentinel workspace, and retention of the server data for 365 days.

The DISA CSSP requires a new billing account number to associate with the Defender for Server capability and will provide funding to purchase the Defender for Server, data ingest, and data retention fees, to include Sentinel.

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity.

FAR 16.505(b)(2)(i)(B) - Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(b) Description of the Justification.

This requirement must be satisfied within the existing DOD365-J SaaS Tenant, a Microsoft cloud offering. The only source capable of performing the requirement at the level and quality required is Microsoft based on the required Microsoft Defender for Server and Microsoft Sentinel services being specific to Microsoft and the Azure cloud.

Microsoft Defender for Server and Microsoft Sentinel are essential to the Government’s requirements to achieve the following objectives: collect the detailed security relevant data associated with server activity logging and connections; integrate server host Defender alerts with client/user host Defender endpoint alerts; and achieve full Microsoft Sentinel security capabilities across all security data collected in defense of the DOD365- J Tenant and its users. Other cloud service providers (CSPs) can provide similar server detection and defense, but would not achieve full integration of Microsoft Sentinel capabilities or integration of Microsoft Threat Intelligence. Attempting to enable and provision comparable Defender for Server and Sentinel capabilities within an alternate CSP’s offering would result in significantly increased and duplicated costs since the DOD365-J Tenant has already been established and configured to accommodate

Controlled By: DISA/EII/EC1 CUI Category: PROCURE Distribution/Dissemination Control: FEDCON POC: disa.letterkenny.eiic.list.re-io-od-cor@mail.mil

Page 3 of 7 Pages

CUI

Defender for Server and Sentinel. Additionally, attempting to achieve the requirements using an alternate CSP would not allow for the full integration of server alerting and logging with client/host endpoint alerts which are collected within the DOD365-J Tenant.

No other CSPs can provide the required Microsoft capabilities and resources within the existing DOD365-J Tenant at the level of quality required.

(c) Justification.

(1) Minimum Government requirements.

The DISA CSSP continues to build out its endpoint detection and response capabilities within the DoD365-J SaaS Tenant. Microsoft Defender for Endpoint has been implemented within the Agency and incorporated into the CSSP security operations in defense of the DoD Network and the DoD365-J Tenant. Implementing Defender for Server will allow the CSSP team to extend endpoint detection and defense capabilities to server hosts. A separate, CSSP capability within the tenant is the most advantageous method of enabling Defender for Server onboarding.

A CSSP-specific Defender for Server capability with a separate billing account number within the existing tenant are the minimum requirements required to allow the Defender for Server implementation to continue.

(2) Proposed sole source contractor.

Microsoft Corporation

(3) Discussion regarding the cause of the sole source situation.

The only source capable of performing the DISA CSSP DOD365-J Defender for Server requirement at the level of quality required is the incumbent contractor, Microsoft. The refactoring of the current environment from the Microsoft environment to another CSP would result in additional time, effort, costs, and performance impacts. Migration from one platform to another platform would delay the project two years.

Further, the only source capable of performing the DISA CSSP DOD365-J Defender for Server requirement at the level and quality required is Microsoft based on Government engineers and security operators being trained and certified in Microsoft Azure - M365 - DoD365-J SaaS Tenant. Microsoft Azure and M365 were the cloud and SaaS solution selected for the DoD Joint office productivity and services requirement. The DISA Defense Enterprise Office Solutions (DEOS) and CSSP teams have trained and developed proficiency in the existing DOD365-J Tenant and the variety of security solutions and capabilities that it offers. Retraining in another cloud SaaS platform would incur additional time and effort which would delay the implementation of server defense capabilities. Additionally, attempting to integrate different security solution into the

Controlled By: DISA/EII/EC1 CUI Category: PROCURE Distribution/Dissemination Control: FEDCON POC: disa.letterkenny.eiic.list.re-io-od-cor@mail.mil

Page 4 of 7 Pages

CUI

Microsoft Defender suite and Azure tenant will likely involve significant engineering challenges and unavoidable tradeoff and sacrifices of required security capabilities.

The only source capable of performing the DISA CSSP DOD365-J Defender for Server requirement at the level and quality required is Microsoft based on the required Microsoft Defender for Server and Microsoft Sentinel services being specific to Microsoft. These products are essential to the Government’s requirements to achieve the following objectives: collect the detailed security relevant data associated with server activity logging and connections; integrate server host Defender alerts with client/user host endpoint alerts; and achieve full Microsoft Sentinel security capabilities across all security data collected in defense of the DOD365-J Tenant and its users. Other CSPs can provide similar server detection and defense, but would require additional, significant resources to fully integrate with the existing DOD365-J Tenant and its security capabilities. The integration of a different cloud provider product would also likely result in the tradeoff or sacrifice of required security capabilities (e.g. full integration of Microsoft Sentinel capabilities, applicability of Microsoft Threat Intelligence, etc).

(4) Demonstration of unique source.

Microsoft possesses the knowledge, skills, capabilities, certification, clearance, and experience required to continue the program without a break or degradation in critical mission services. Given these critical mission requirements, Microsoft is the only contractor that is capable of performing the necessary services for the DoD within the current required timeline.

(5) Procurement discussion.

a. Satisfying this requirement no later than August 31, 2024 is vital to ensure the progress of the DISA CSSP incorporation of Defender for Server into our security operations.

b. Since there is already an existing environment (i.e. DoD365-J Tenant), the CSP is immediately able to support the resultant award associated with this contract action, it would minimize any associated transition costs for the Government. In addition, another contractor would not be positioned to leverage investments made to date to most efficiently meet the objectives of the task order for the anticipated PoP.

(6) Impact.

Award to an alternate CSP would result in excessive schedule delay, up to 24 months, significant cost increase in excess of $250,000 to integrate new capabilities into the existing 365-J tenant, and would still not achieve the required security capabilities to meet the Government need.

Controlled By: DISA/EII/EC1 CUI Category: PROCURE Distribution/Dissemination Control: FEDCON POC: disa.letterkenny.eiic.list.re-io-od-cor@mail.mil

Page 5 of 7 Pages

CUI

5. COST/PRICE FAIR AND REASONABLE DETERMINATION:

A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the independent government cost estimate and the JWCC Catalog pricing, including any discounts, which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

6. MARKET RESEARCH:

Market research for the basic JWCC Contracts was conducted and resulted in a signed market research report on 9 Nov 2021. After a survey of the market, it was concluded that the JWCC Contract is in the Government’s best interest due to technical feasibility and cost to the Government.

Additional research was conducted from March 1, 2024 to April 1, 2024 by reviewing the specific capabilities in the JWCC Contracts. At that time, it was determined that Microsoft is the only source capable of fulfilling the Government’s minimum needs in the manner and time frame required. The DISA CSSP and the DISA DEOS Engineering and Cyber teams met on multiple occasions to determine the most advantageous method to implement Microsoft (MS) Defender for Server capabilities or alternate capabilities within the DOD365-J Tenant. It was determined that the most efficient method was to onboard to MS Defender for Server within the existing tenant by way of a dedicated, CSSP Defender for Server capability.

The DISA CSSP team consulted with Microsoft representatives supporting the DISA DOD365-J Tenant to discuss the most efficient method of contracting to achieve the desired Defender for Server capabilities. It was determined that an award under the JWCC contract would be advantageous to achieve the desired cost, schedule, and performance objectives.

The DISA CSSP team reviewed the JWCC Ordering Guide and Microsoft JWCC webpage to gain familiarization with the products available on the JWCC contract, the estimated costs, and the ordering process.

Further research was conducted from March 1, 2024 to April 1, 2024 by reviewing the JWCC contractor's catalogs to determine if other similar offerings (to include: Microsoft Defender for Server and Microsoft Sentinel) meet or can be modified to satisfy the Government’s requirements. The Microsoft catalog contains the required MS Defender product. Therefore, it was determined that Microsoft is the only source capable of fulfilling the Government’s minimum needs in the manner and time frame required.

Market research revealed that an award to the JWCC contract offers the most advantageous option to achieve the desired cost, schedule, and performance objectives.

7. ANY OTHER SUPPORTING FACTS: None.

Controlled By: DISA/EII/EC1 CUI Category: PROCURE Distribution/Dissemination Control: FEDCON POC: disa.letterkenny.eiic.list.re-io-od-cor@mail.mil

Page 6 of 7 Pages

CUI

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History: None

(b) The DISA CSSP team seeks to leverage cloud defensive capabilities to the maximum extent possible when defending cloud deployments regardless of the CSP. In planning to incorporate new security capabilities, the DISA CSSP consistently examines and considers all available CSPs and the security capabilities each offers in an effort to maximize competition. The DISA CSSP team will continue to examine and consider all available sources of defensive cyber capabilities to assess the effectiveness of each capability to meet security requirements, regardless of the vendor.

Controlled By: DISA/EII/EC1 CUI Category: PROCURE Distribution/Dissemination Control: FEDCON POC: disa.letterkenny.eiic.list.re-io-od-cor@mail.mil

Page 7 of 7 Pages

CUI

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

Digitally signed by

CRUMBACKER.LUCAS.ROBERT

03 .1038233439 Date: 2024.08.19 14:51:21 -04'00'

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

CRUMBACKER.LUCAS.

ER ROBERT.1038233439

Date: 2024.08.19 14:51:34 -04'00'

CONTRACTING OFFICER APPROVAL: I certify that this justification is accurate and complete to the best of my knowledge and belief.

BOSWELL.DARRYL.JR.1

27 027994349 Date: 2024.08.19 14:32:23 -05'00'

PROCURING ACTIVITY COMPETITION ADVOCATE APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief. Since this justification does not exceed $15M, this review serves as approval and my written determination that the aforementioned FAR circumstances apply.

ARNOLD.GAY.D.123035

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

Jacob Benhoff, Contract Specialist, jacob.r.benhoff.civ@mail.mil. (667) 890-6640

.LU

ER

ARNOLD.GAY.

D

NAME: Gay Arnold SIGNATURE:

TITLE/AGENCY/ORGANIZATION: Procuring Activity Competition Advocate/DISA

PHONE: (618) 418-6517

NAME: Mr. Lucas Crumbacker SIGNATURE:

TITLE/ORGANIZATION: IT Project Manager

CRUMBACKE

CAS.ROBERT.

PHONE: +1 (223) 220-4337 8233439

NAME: Mr. Lucas Crumbacker SIGNATURE:

TITLE/ORGANIZATION: IT Project Manager

CRUMBAC

LUCAS.RO

PHONE: +1 (223) 220-4337 T.10382334

NAME: Darryl Boswell SIGNATURE:

TITLE/ORGANIZATION: JWCC Contracting Officer, DISA/DITCO, BOSWELL

PS8511 RRYL.JR.1

PHONE: 667-890-3972 994349

mailto:jacob.r.benhoff.civ@mail.mil