JA24-142 AFLCMC Defensive Cyber Cloud Infrastructur_v2_Redacted.pdf

Controlled By: DISA Controlled By: PS8511 CUI Category: PROCURE Distribution/Dissemination Control: FEDCON POC: disa.scott.ditco.mbx.ditco-jwcc@mail.mil

CUI

Page 1 of 8 Pages

JUSTIFICATION & APPROVAL FOR FEDERAL ACQUISITION REGULATION

SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Contract

Orders under Fair Opportunity Federal Acquisition Regulation (FAR) 16.505, Defense FAR Supplement 216.505-70, Procedures, Guidance, and Information 216.505-70

Military Purchase Request Number: F2MTN74169GW01 Joint Warfighting Cloud Capability (JWCC) Contract Number: HC105023D0005 Task Order Number: To Be Determined Procurement Title: Air Force Life Cycle Management Center / Air Force Defensive Cyber Systems Branch (AFLCMC/HNCD) Defensive Cyber Cloud Infrastructure Estimated Value:

Statutory and Regulatory Authority: 10 United States Code (U.S.C.) 2304c(b) and FAR 16.505(b)(2)(i)(B)

EXCEPTION TO FAIR OPPORTUNITY

Number: JA24-142

Upon the basis of the following justification, I, as the Head of Contracting Activity (HCA), hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C. 2304c(b) and Regulatory Authority of FAR 16.505(b)(2)(i)(B).

1. REQUESTING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

U.S. Air Force (USAF) / AFLCMC/HNCD 3133 General Hudnell Dr, Suite 314 San Antonio, TX 78226 United States of America

Contracting Activity:

Defense Information Systems Agency/Defense Information Technology Contracting Organization/PS8511

2300 East Drive Scott Air Force Base, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

This action is to issue a firm-fixed-price task order (TO) against the JWCC Indefinite Delivery/Indefinite Quantity Contract for AFLCMC/HNCD Defensive Cyber Cloud Infrastructure. This TO will be issued directly to Amazon Web Services (AWS). The anticipated

JA24-142 AFLCMC/HNCD Defensive Cyber Cloud Infrastructure

Page 2 of 8 Pages period of performance is for a 9-month base period. The total estimated value is which will be funded by Operations & Maintenance funds.

3. DESCRIPTION OF SUPPLIES/SERVICES:

This requirement is critical to supporting the development, testing, and production stages of various pipelines

These pipelines include essential cybersecurity components which are used across development, testing, and production environments.

The required cloud services include compute resources such as Virtual Machines and Containers, which facilitate the deployment of applications across different environments, Elastic Load Balancing to ensure high availability, while auto-scaling dynamically adjusts resources based on workload demands. Additionally, AFLCMC/HNCD requires a range of storage solutions, including Object Storage for large volumes of data, Block Storage for high-performance databases, and File Storage for shared file systems.

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity:

FAR 16.505(b)(2)(i)(B) - Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(b) Description of the Justification:

AWS is the only Cloud Service Provider (CSP) capable of meeting AFLCMC/HNCD technical and minimum requirements. The Air Force is unique to AWS and has provided scalable and secure platforms.

Beginning in 2019, AWS provided AFLCMC HNCD services and infrastructure to enable significant sustained growth

. These services are vital for managing and analyzing data at PB scales, which is critical for Air Force Defensive Cyberspace Operations (AFDCO) mission success.

AWS is the only CSP that has the capability to meet the government’s requirements due to several critical factors. No other CSP can meet AFLCMC/HNCD’s real-time mission requirements, even with adequate lead time. The Air Force environment, built and refined over the past five years in AWS, is integral to the AFDCO mission and

Page 3 of 8 Pages cannot be replicated by another provider in the required time frame. AWS is the only CSP with an Air Force-accredited real-time Authorization to Operate (ATO), a process that has taken significant time and effort to achieve at multiple Impact Level (IL)/classification levels.

Additionally, AWS's unique features, such as its specialized automation, integration into AWS S3 buckets, and sophisticated artificial intelligence/machine learning (AI/ML) analytics, ensure the reliability of its cloud compute and store environment. The specialized automation and integrations have taken over 5 years to develop, and the capabilities have proven essential in addressing threats to both the Air Force Network enterprise and the Department of Defense Information Network enterprise. The combination of AWS's unique features and the short time frame supports AWS as the only CSP to support AFLCMC/HNCD and AFDCO ongoing mission-critical operations.

(c) Justification.

(1) Minimum Government Requirements:

The cloud services minimum requirements must comply with Department of Defense (DoD) Security Requirements Guide IL4/IL5/IL6/TOP SECRET, FedRAMP, and other security standards, ensuring robust encryption, identity and access management, and real-time threat detection. It must provide elastic scaling and high-performance compute resources for intensive tasks, alongside high availability, disaster recovery, and multi-region deployment to ensure continuous operation. Additionally, it must integrate advanced AI/ML, and big data analytics technologies and seamlessly connect with existing DoD systems while supporting an Air Force multi-cloud strategy.

In addition, the minimum Government requirements for the AFLCMC/HNCD's Command & Control functions must integrate seamlessly with existing legacy systems and provide efficient data ingestion tools for streamlined operations. The solution should minimize additional infrastructure needs, maintain operational efficiency, and ensure continuity. It must also include a fully functional BDP with necessary ATO for AFDCO. Moreover, requirements need to consolidate data across key platforms—ELICSAR, Vault, Signus, Blade, Unified Data Library, and Project Brown Heron—while ensuring that all data is secure, accessible, and interoperable to support comprehensive cybersecurity efforts.

(2) Proposed sole source contractor: AWS.

(3) Discussion regarding the cause of the sole source situation.

Multiple factors prompted only one source. These factors include the complexity of the requirement, phase-in/phase-out considerations, and the urgent need to meet critical mission timelines.

Phase-In/Phase-Out Considerations: Transitioning to a new CSP involves significant challenges, including migrating data, reconfiguring systems, and maintaining security and

Page 4 of 8 Pages compliance standards. The risks and potential downtime associated with such a transition will cause a delay that effects the seamless and continued need for these mission requirements.

Unacceptable Delays to AFLCMC/HNCD Mission: The current cloud environment is deeply integrated with specific security protocols, data management systems, and operational workflows tailored to mission requirements. Migrating to a different CSP would be complex, time-consuming, and introduce unacceptable delays, jeopardizing the timely support of the mission.

(4) Demonstration of unique source:

This requirement is crucial for supporting and sustaining the development, testing, and production stages of various pipelines

. These pipelines encompass essential cybersecurity components such as which are critical for maintaining robust security measures and efficient operations across development, testing, and production environments.

AWS is the only source capable of supporting AFLCMC/HNCD in developing and integrating the BDP, which is exclusively compatible with AWS cloud environment. This ensures a seamless continuation of operations, leveraging AWS's infrastructure and expertise. Even with sufficient lead time, no other CSP has a turn-key solution that can meet AFLCMC/HNCD’s real-time requirements. The existing Air Force environment, which is critical for AFDCO, U.S. Cyber Command, and sister-service missions, has been developed and refined over the course of 5+ years within AWS. This includes obtaining the necessary ATOs at multiple IL’s. The time and effort invested in developing this environment, as well as the unique operational dependencies on it, make it irreplaceable in the current context. No other CSP could replicate the environment or meet these real-time mission requirements, even with extended lead time.

Proprietary Considerations: Data and applications include proprietary configurations and security protocols. Transitioning to another CSP would require extensive re-engineering, introducing significantly high risks. Transitioning to another CSP would introduce significant security risks, potential downtime, and operational delays. These risks are mitigated through established infrastructure, proven methodologies, and existing compliance with DoD requirements, ensuring uninterrupted and secure operations.

AWS’s understanding of AFDCO-specific requirements and their operational environment, gained through years of innovative collaborations, positions AWS to support these unique and ongoing initiatives.

Page 5 of 8 Pages

Development of Custom Solutions. AWS has developed and tailored to the distinctive needs of the Air Force Cyber Warfighter, such as enhancing data throughput and automating data workflows. This extensive experience and deep integration into the existing systems makes AWS the only CSP capable of providing a comprehensive, turn-key solution for the

(5) Procurement discussion.

AWS is the only source capable of meeting the AFLCMC/HNCD procurement of cloud compute and storage services due to critical constraints: schedule, compatibility, standardization, and proprietary considerations.

Schedule Requirements: AWS can meet AFDCO’s urgent and short timelines due to seamless integration, with proven DoD deployment experience. Estimated timeline for deployment:

• Initial Setup and Configuration: 2-4 weeks

• Integration and Customization: 4-6 weeks

• Testing and Validation: 3-4 weeks

• Final Deployment and Rollout: 2 weeks

• Estimated Total Timeline: 11-16 weeks

Compatibility: Services must seamlessly integrate with existing AFLCMC/HNCD and DoD systems, including security protocols and data management. AWS offers seamless integration without extensive reconfiguration.

(6) Impact.

Using another CSP is not feasible for AFLCMC/HNCD cloud compute and storage services and would have detrimental effects on AFDCO mission such as operational delays, security risks, loss of compatibility and seamless integration, at significant costs to the Government.

Operational Delays: Rapid deployment is critical, and delays could compromise national security. Transitioning to a new CSP would involve substantial re-engineering and integration work, estimated to take 18-24 months for refactoring and obtaining an approved ATO by Approving Official. This process would cause unacceptable delays in deploying critical cyber operations technology. Given the urgent nature of AFLCMC/HNCD's mission, such delays could result in operational downtime and compromise national security.

Security Risks: Current configurations and security protocols are optimized for AWS.

Shifting to another CSP would introduce unacceptable vulnerabilities during the transition period.

Page 6 of 8 Pages

Loss of Compatibility and Integration: Existing systems and workflows are deeply integrated with AWS services. Changing CSPs would disrupt these integrations, leading to potential incompatibilities.

Increased Costs: Migrating to a new CSP would incur significant costs, including reconfiguration, testing, and validation expenses. These additional costs would strain the budget and divert resources from other critical areas, reducing overall mission effectiveness.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION:

A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the independent government cost estimate and the JWCC Catalog pricing, including any discounts, which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

6. MARKET RESEARCH:

Market research for the basic JWCC Contracts was conducted and resulted in a signed market research report on November 9, 2021. After a survey of the market, it was concluded that the JWCC Contract is in the Government’s best interest due to technical feasibility and cost to the Government.

Additional research was conducted April 1, 2024 - July 24, 2024 by reviewing the specific capabilities in the JWCC Contracts and it was determined that AWS is the only source capable of fulfilling the Government’s minimum needs in the manner and time frame required.

AFLCMC/HNCD market research included a comprehensive Analysis of Alternatives of Oracle, Microsoft, and Google Public Sector (GPS). The results demonstrated that no other CSP could meet all the essential features and requirements without significant risks or delays. Key findings included security and compliance gaps, scalability limitations, technological shortcomings, and integration challenges with other CSPs.

To identify the most suitable CSP for AFLCMC/HNCD, comprehensive market research was conducted to assess how CSP capabilities align with AFLCMC/HNCD’s unique requirements.

Additional Research to Support Exception to Fair Opportunity was issued to all CSPs on July 01, 2024 of which two CSPs responded, AWS and Microsoft, (Oracle and GPS did not respond).

AWS: AWS met all minimum requirements outlined and demonstrated the necessary capabilities, including an ATO for BDP used by AFDCO. AWS’s existing infrastructure and services align with the government’s unique qualifications.

Microsoft: Microsoft did not meet all the technical and minimum requirements. Specifically, Microsoft lacks a current ATO for the Big Data Platform, which is a critical requirement for the

AFLCMC/HNCD.

7. ANY OTHER SUPPORTING FACTS: None.

Page 7 of 8 Pages

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History: None.

(b) AFLCMC/HNCD is committed to promoting fair and open competition in procurement.

To overcome the barriers for exception to fair opportunity, AFLCMC/HNCD will conduct continuous and thorough market research to identify emerging CSPs and technological advancements, monitor industry trends, assess new entrants, and evaluate evolving capabilities of existing CSPs that will help identify potential competitors and reduce reliance on a single source. In addition, AFLCMC/HNCD will be reviewing overall requirements to determine future strategy.

Page 8 of 8 Pages

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Mr. Marc Baskin SIGNATURE: See Signature Page

TITLE/AGENCY/ORGANIZATION:

Infrastructure Team Lead, AFLCMC/HNCD, USAF

PHONE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Ms. Teri Rodriguez SIGNATURE: See Signature Page

TITLE/AGENCY/ORGANIZATION:

Business Integration Chief, AFLCMC/HNCD, USAF

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: Lara Chiaurro SIGNATURE: See Signature Page

TITLE/AGENCY/ORGANIZATION:

Contracting Officer, DISA/DITCO/PS8511

HEAD OF THE CONTRACTING ACTIVITY APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief. Since this justification does not exceed $100M, this review serves as approval.

NAME: Douglas Packard SIGNATURE: See Signature Page

TITLE/AGENCY/ORGANIZATION: HCA, DISA/DITCO/PSD

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

Darryl Boswell

Page 8 of 8 Pages

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Mr. Marc Baskin SIGNATURE:

TITLE/AGENCY/ORGANIZATION:

Infrastructure Team Lead, AFLCMC/HNCD, USAF

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Ms. Teri Rodriguez

Business Integration Chief, AFLCMC/HNCD, USAF

SIGNATURE:

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: Lara Chiaurro SIGNATURE:

Contracting Officer, DISA/DITCO/PS8511

HEAD OF THE CONTRACTING ACTIVITY APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief. Since this justification does not exceed $100M, this review serves as approval.

NAME: Douglas Packard SIGNATURE:

TITLE/AGENCY/ORGANIZATION: HCA, DISA/DITCO/PSD

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

Darryl Boswell