JA24-146 AMD 01_DBCE HCA Signed_Redacted.pdf

CUI

Controlled By: DISA Controlled By: PSD/PS8511 CUI Category: PROCURE Distribution/Dissemination Control: FEDCON POC: Lara Chiaurro, JWCC Mailbox: disa.scott.ditco.mbx.ditco-jwcc@mail.mil

JUSTIFICATION & APPROVAL FOR FEDERAL ACQUISITION REGULATION

SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Contract

Orders under Fair Opportunity Federal Acquisition Regulation (FAR) 16.505, Defense FAR Supplement 216.505-70, Procedures, Guidance, and Information 216.505-70

Military Interdepartmental Purchase Request Number: HQ0894413513 Joint Warfighting Cloud Capability (JWCC) Contract Number: HC105023D0003 Task Order Number: To be Determined Procurement Title: Defense Finance and Accounting Services (DFAS) Blue Cloud Environment

(DBCE)

Estimated Value:

Statutory and Regulatory Authority: 10 United States Code (U.S.C.) 2304c(b) and FAR 16.505(b)(2)(i)(B)

EXCEPTION TO FAIR OPPORTUNITY

Number: JA24-146

Upon the basis of the following justification, I, as the Head of Contracting Activity (HCA), hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C. 2304c(b) and Regulatory Authority of FAR 16.505(b)(2)(i)(B).

1. REQUESTING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

DFAS Cloud Program Management Office 8899 E 56th St Indianapolis, IN 46249 United States of America

Contracting Activity:

Defense Information Systems Agency (DISA)/Defense Information Technology Contracting Organization/PS8511

2300 East Drive Scott Air Force Base, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

AMD 01: This amendment is to increase the value by This amendment is due to multiple omissions in the Independent Government Cost Estimate (IGCE) that did not

JA24-146 AMD 01 DFAS Blue Cloud Environment contemplate the anticipated growth; the necessary amount of Infrastructure as a Service (IaaS) and Compute, and ExpressRoute solutions; and other solutions such as encrypted storage and the amount of Virtual Machines (VMs) required under Unclassified Cloud.

The 20% anticipated growth is for compute and data storage for option years 1 and 2 for a total increase in the amount of a higher quantity of IaaS and Compute and ExpressRoute solutions resulting in an increase of and last, for multiple solutions not included in the original IGCE, such as Azure Data Explorer, Microsoft Defender, standard encrypted Block Blob storage, and 146 additional VMs, an increase of

This action is to issue a firm-fixed-price task order (TO) against the JWCC Indefinite Delivery/Indefinite Quantity Contract for DBCE. This TO will be issued directly to Microsoft.

The anticipated period of performance (PoP) is for a 1-year base period, plus two, 1-year option periods. The total estimated value is of which will be funded by Defense Working Capital funds.

3. DESCRIPTION OF SUPPLIES/SERVICES:

This requirement is to support DBCE, which resides in the Microsoft cloud. DCBE is comprised of over 202 Infrastructure as a Service (IaaS) servers, significant cloud storage accounts, over 750TB of Netapp Filer data, logic apps, load balancing, development, and test and production enclaves as well as housing the DFAS Cyber Security Service Provider (CSSP) Sentinel environment. Per the Office of Management and Budget (OMB) Memorandum M-21-31, the DFAS CSSP receives a resource log (record of events) from within the DBCE environment, but also from on premise DFAS security and production equipment as well as from DISA and General Services Administration (GSA) hosted resources from various sites and locations around the world to defend the Department of Defense Information Network (DODIN).

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity.

FAR 16.505(b)(2)(i)(B) - Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(b) Description of the Justification.

DFAS acquired the existing DBCE services to modernize prior MilCloud 2.0 hosted solutions in order for the DFAS CSSP to utilize the Microsoft hosted Sentinel Security Information and Event Management (SIEM) environment. This security monitoring environment has been configured to provide the primary sensing and operational view for the DFAS CSSP's mission to monitor and protect the DODIN. This is accomplished by the DFAS CSSP ingesting all DFAS system logs into the Microsoft hosted Sentinel environment. This includes log ingest from all DFAS physical locations, GSA hosted MyPay environments, and DFAS mission environments hosted at DISA Defense Enterprise Computing Centers locations. The scope of monitoring includes all DFAS pay environments for all of active duty and retired military personnel and civilian personnel, as well as the payment of invoices to Department of Defense (DoD) contractors. This comprises approximately 4.7TB a day of log ingest into the customized CSSP SIEM instance of Sentinel. This mission requirement from the DFAS CSSP incorporates information from multiple external agents and traditional workloads and represents three plus years of DFAS CSSP dedicated work. It also took several years to customize and create specifically tuned attack sensing and receiving indicators to respond to the DFAS mission need.

(c) Justification.

(1) Minimum Government requirements.

DBCE must continue to support this DoD accredited cloud computing environment to ensure the continued operation of critical financial applications, Virtual desktops, COGNOS services, robotics processes and to support the CSSP’s mission to protect the DODIN by utilizing the Sentinel SIEM, which can only be accomplished through Microsoft.

Failing to maintain this environment would result in critical mission failures and missed DFAS payments to service members and civilian personnel, and contractors.

Impacted DFAS systems fall into the following three categories:

Financial Systems Systems that directly report or interact with personnel pay services and payments to contractors.

DFAS Administrative Systems Systems that support the daily mission of the agency and cover internal processes, document review programs, and business continuity planning.

DFAS Information Technology Resources Systems that support the DFAS mission by providing Information Technology infrastructure to support the mission of the agency. These directly support virtual desktop environments, the DFAS CSSP team, Artificial Intelligence, DFAS Information Technology process reporting and interfaces.

(2) Proposed sole source contractor. Microsoft.

(3) Discussion regarding the cause of the sole source situation.

Microsoft is the only source capable of performing the DBCE at the level of quality required. The refactoring of the current environment from the Microsoft environment to another CSP would result in additional time as migration from one platform to another would delay the project by 36 months. In addition, there would be a duplication of costs during this significant timeframe to transition of having to maintain the solution running on one platform while refactoring it on another platform.

Microsoft’s Sentinel is unique to Microsoft and the product is essential to the Government’s requirements due to all of the log sources for DFAS CSSP being sent from multiple sources (GSA hosted sites, DISA hosted environments, DFAS on-premise hosted environments, as well as Microsoft hosted environments). Other similar products do not meet, nor can be modified to meet, the Government’s requirements.

(4) Demonstration of unique source.

Microsoft provides a unique cloud environment that houses the application Microsoft Sentinel. Sentinel is programmed by the Kusto Query Language (KQL), and DFAS’s CSSP has utilized KQL to create a complex security monitoring and defense environment for DFAS that would require approximately 12,480 resource hours (~ 36 Months) to create the required programming in a new environment. KQL is not provided by other JWCC CSPs.

Microsoft possesses the knowledge, skills, capabilities, certification, clearance, and experience required to continue the program with seamless integration without a break or degradation in critical mission services. Given DBCE’s critical mission requirements to comply with OMB Memorandum M-21-31, as well as DoD Directive 5118.05, DoD Instruction 8320.02 and DoD Directive 8000.01, Microsoft is the only contractor that can provide the Sentinel application used by CSSP within the current deadline of September 2024.

(5) Procurement discussion.

Schedule constraint: The current Microsoft deployment of DCBE is scheduled to end on September 29, 2024. A new Order must be placed, and with Microsoft as prime contractor, DFAS must stand up and migrate the functionality for the existing sensing platform and 202 IaaS servers, as well as coordinating with multiple systems residing in the enclave in order to update and modify existing firewall and ports and protocol requirements.

(6) Impact.

If this enclave were not allowed to continue as it is on the current Microsoft platform, DFAS would lose the following, which would constitute mission failure:

1. DFAS CSSP sensing and monitoring of the DoDIN (this includes over 5,760 hours from the DFAS CSSP analyst team to customize, deploy, and maintain a custom SIEM) as well as 24x7 support; loss would result in mission failure, rendering the CSSP analyst team unable to monitor the DFAS DoDIN mission area.

2. All DFAS mission and related systems would be halted.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION:

A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the independent government cost estimate and the JWCC Catalog pricing (including any discounts), which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

6. MARKET RESEARCH:

Market research for the basic JWCC Contracts was conducted and resulted in a signed market research report on November 9, 2021. After a survey of the market, it was concluded that the JWCC Contract is in the Government’s best interest due to technical feasibility and cost to the Government.

Additional research was conducted May 13, 2024, by reviewing the specific capabilities in the JWCC Contracts and it was determined that Microsoft is the only source capable of fulfilling the Government’s minimum needs in the manner and time frame required.

Further research was conducted on June 13, 2024, by reviewing the JWCC contractor's catalogs to determine if other similar offerings (to include the use of the KQL query language) meet or can be modified to satisfy the Government’s requirements.

The additional research to support Exception to Fair Opportunity was issued to all JWCC CSPs.

Three responses were received from Amazon Web Services (AWS), Microsoft, and Oracle;

Google did not respond.

Microsoft captured the Government requirements through use of Microsoft’s Sentinel which allows for the continued use of the KQL customizations the DFAS CSSP has created to perform support to secure the DoDIN for the DFAS mission.

Oracle’s response did not address the requirement to support KQL, and the product offering documented (OC Logging) is not a SIEM, but a log host for Commercial SIEM.

AWS’s response did not address the requirement to support KQL, and the product offering documented (CloudWatch) is not listed on Gartner 2024 Magic Quadrant, as required by the Government. CloudWatch is not a SIEM, but a log monitoring service.

Based on the results of market research it has been determined that no other offering is suitable;

Microsoft Sentinel is essential to the Government’s requirements and Microsoft is the only source capable of fulfilling the Government’s minimum needs in the manner and time frame required.

7. ANY OTHER SUPPORTING FACTS: None.

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History:

Incumbent Contractor: Minburn Technology Group Contract Number: 47QFSA21F0129 Task Order Number: Not applicable PoP: September 29, 2021 - September 29, 2024 Competitive Status: Full and open competition Business Size: Large business

(b) To overcome future barriers to competition, future development and enhancement of IaaS components will include shifting to a containerized platform. This will enable multiple CSPs to meet the requirements, which will enable the flexibility to shift workload based on financial and mission requirements.

DFAS is committed to promoting fair and open competition in procurement. To overcome the barriers for exception to fair opportunity, DFAS will conduct continuous and thorough market research to identify emerging CSPs and technological advancements, monitor industry trends, assess new entrants, and evaluate evolving capabilities of existing CSPs will help identify potential competitors and reduce reliance on a single source.

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

TITLE/AGENCY/ORGANIZATION:

PHONE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

HCA APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief. Since this justification does not exceed $100M, this review serves as approval.

NAME: Mr. Douglas Packard SIGNATURE:

TITLE/AGENCY/ORGANIZATION: HCA, DISA/DITCO

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO: