JA25-012 852571063-Security Stack Redacted.pdf

Controlled By: DISA Controlled By: PS8511 CUI Category: PROCURE Distribution/Dissemination Control: FEDCON POC: disa.scott.ditco.mbx.ditco-jwcc@mail.mil

CUI

JUSTIFICATION & APPROVAL (J&A) FOR FEDERAL ACQUISITION

REGULATION (FAR) SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Schedule/Multiple Award Contract (MAC)

Orders under MAC/ Fair Opportunity – FAR 16.505(b), Department of Defense FAR Supplement (DFARS) 216.505(b), Procedures, Guidance, and Information (PGI) 216.505(b)

Military Interdepartmental Purchase Request Number:

Joint Warfighting Cloud Capability (JWCC) Contract Number: HC105023D0004 Task Order (TO) Number: To be Determined Procurement Title: Security Stack and Defense Agencies Initiative (DAI) Requirements Estimated Value:

Statutory and Regulatory Authority: 10 U.S.C. 3204(a)(1) and FAR 16.505(b)(2)(i)(B)

Exception to Fair Opportunity Number: JA25-012

Upon the basis of the following justification, I, as the Head of Contracting Activity (HCA), hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C. 3204(a)(1) and Regulatory Authority of FAR 16.505(b)(2)(i)(B).

1. REQUESTING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

Defense Logistics Agency (DLA) / J6 Information Operations / J62-Program Executive Office / J62A-DAI 8725 John J Kingman Road Fort Belvoir, VA 22060

Contracting Activity:

Defense Information Systems Agency/Defense Information Technology Contracting Organization/PS85 2300 East Drive

Scott Air Force Base, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION: This action is to issue a firm-fixed-price TO against the JWCC Indefinite Delivery/Indefinite Quantity Contract for Security Stack and DAI Requirements. This TO will be issued directly to Oracle America, Inc. The anticipated period of performance (PoP) is for a base period of 12 months with two, 12-month option periods. The total estimated value is which will be funded by Working Capital funds.

3. DESCRIPTION OF SUPPLIES/SERVICES:

This requirement is to acquire an Oracle Cloud Infrastructure (OCI) tenancy for the DAI application migration and also to build out a Secure Cloud Computing Architecture (SCCA)

JA25-012 Security Stack and Defense Agencies Initiative Requirements

Page 2 of 7 Pages

CUI

for cloud security, management and scanning services to support the DAI and future DLA applications.

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF

THE ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity.

FAR 16.505(b)(2)(i)(B) - Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(b) Description of the Justification.

The DAI application was built exclusively on an Oracle eBusiness suite (EBS) application and Oracle constructed database solution. As a result, the required SCCA security stack must be built into the OCI, otherwise it would introduce cross cloud processing and cause potential technical issues, latency, and additional costs due to ingress/egress data processing rules.

The DAI Program Management Office (PMO) is looking to continue the migration effort from on-premises to the OCI.

(c) Justification

(1) Minimum Government requirements.

The cloud service offerings must continue at their current level to support and obtain OCI tenancy for the DAI application migration. In addition, DAI requires to build out a SCCA for cloud security, management and scanning services to support the DAI and future DLA applications. These offerings include:

SCCA:

Cloud Access Point Virtual Datacenter Security Stack

- Next Generation Fire Wall

- Web Application Firewall

- Intrusion Detection System/Intrusion Prevention System

- Flow Logs and Flow Process Charts

- Deep packet inspection

- Break and inspect

- Micro-segmentation

- Virtual Datacenter Management Stack

- Assured Compliance Assessment Solution

- Host Based Security System

Page 3 of 7 Pages

CUI

- Active Directory (AD), Lightweight Directory Access Protocol, Single Sign On, Online Certificate Status Protocol

- Dynamic Host Configuration Protocol, Domain Name System, Network Time Protocol

- Patch Management

- Log Management

- Trusted Cloud Credential Manager

DAI cloud requirements:

- Cloud infrastructure Impact Level 5

- DAI requires environments for Production, Stage/Quality Assurance (Test &

Development), and Continuity of Operations Plan

- Main application tenancy will be configured and supported by DAI

- Two security stacks will be required to provide High Availability/Redundancy

- Zone B not required as currently DAI operates only in Zone A

- 99.99% uptime required

- Prefer native security services from service provider

- Network/environment must be capable of supporting 200K total users/20K at peak hour

- System storage currently greater than 1Petabyte (PB)

(2) Proposed sole source contractor. Oracle America, Inc.

(3) Discussion regarding the cause of the sole source situation.

The DAI cloud effort was originally scheduled to Go-Live in the OCI cloud in November 2024. Due to unanticipated technical challenges, the DAI PMO had to adjust the approach. The DAI PMO plans to continue its cloud migration to OCI and utilize all work previously completed.

In addition, Oracle Linux is a proprietary Operating System used with OCI. Several servers/workloads have already been built on Oracle Linux. If the OCI is not used, these workloads would need to be rebuilt. This is also the reason why DAI requires use of an Oracle Enterprise Security Stack (ESS). Oracle Linux is only compatible with Oracle. Security Technical Implementation Guides (STIG) type violations for cross cloud computing would result, along with latency for cross cloud Oracle ESS computing, if not using OCI.

End users are estimated at 150,000+ and scheduled to increase to over 200,000.

There are 20,000 peak users, utilizing 1 PB and growing daily. This enclave will support the entire Department of Defense (DoD) 4th Estate and US Marine Corps.

Added latency and cross cloud interoperability will be a detriment to the enclave and to the DAI application. DAI is also a critical application providing financials to the entire DoD 4th Estate and United States Marine Corps.

(4) Demonstration of unique source.

Page 4 of 7 Pages

CUI

The Oracle Cloud realms are the only certified realms for EBS. Support is complicated in DoD Impact Level (IL)4/5 Cloud realms as there is no interconnect like that which exists in commercial realms, nor are there services available outside of the commercial realms. These services are not available in the FedRAMP or IL2/4/6 Cloud realms.

Oracle Cloud is a Fit for Purpose cloud to run EBS and provides single contractor accountability in support of EBS and Cloud. The Oracle EBS product group fully tests, supports, and certifies EBS functionality only on the Oracle Cloud. Oracle Support has well established processes for collaboration across different product teams, designed to promote quicker resolution of issues. Oracle Cloud is a consistent, known, platform for EBS that is low risk to the Government.

Oracle Cloud is the only DoD Cloud that supports Exadata Cloud Service. DAI has a six node Real Application Cluster (RAC) which has extremely high transaction rates.

No other cloud service provider (CSP) has Database Platform as a Service that supports an Oracle certified RAC configuration or can support the performance, transactionality, and scalability of the Oracle Cloud Exadata Cloud Service. DAI continues to grow, and Oracle Cloud Exadata Cloud Service is the only solution for Cloud tooling and scaling related to workload requirements for the Oracle Database.

DAI will also be able to transition to Oracle Autonomous Database on Oracle Cloud, as well as auto tuning, auto scaling, auto patching while all running on Exadata infrastructure.

If DAI were to move to another CSP, the immediate licensing costs for Oracle tech products such as Database and Weblogic would be more than . Oracle Cloud licensing is the same as on-prem licensing, consisting of one licensed processor for two Central Processing Unit (CPU) cores. In contrast, Oracle licensing for other CSPs is one licensed processor for one CPU core. In order to run on the same number of CPU cores utilizing another CSP, DAI would need to double current licensing. DAI would need to continue paying support for current licenses in addition to additional licenses to run on an alternative CSP at a cost of .

The current security architecture that aligns to the Defense Cloud Computing Security Requirements Guide and STIG would have to be redeveloped due to changes to DLA’s Portfolios. The development of a new Authority to Operate (ATO) with Authorizing Official approval would take approximately 180 business days (based on previous ATO timelines).

(5) Procurement discussion.

Oracle is the only CSP that meets all the Government’s requirements and can be seamlessly integrated with the Security Stack and DAI workload hosted in the Oracle infrastructure.

Page 5 of 7 Pages

CUI

Since there is already an existing environment, Oracle is immediately able to shift to supporting the award associated with this contract action, minimizing any associated transition costs for the Government. In addition, another contractor would not be positioned to leverage investments made to date to meet the objectives of the task order for the anticipated PoP.

(6) Impact.

The DAI cloud effort was originally scheduled to go-live in the OCI cloud in November 2024. Due to unanticipated technical challenges, the DAI PMO had to adjust the approach. The DAI PMO plans to continue its cloud migration to OCI and utilize work completed to date. If a sole source task order is not awarded to Oracle, previous migration efforts in the amount of would be forfeited. The migration would need to be restarted and all of the pre-migration effort workload would have to be rebuilt resulting in a delayed cloud solution delivery and unnecessary costs to the Government.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION: A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the Independent Government Cost Estimate and the JWCC Catalog pricing, which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

6. MARKET RESEARCH: Market research for the basic JWCC Contracts was conducted and resulted in a signed market research report on November 9, 2021, that was revalidated and recertified on July 29, 2024. After a survey of the market, it was concluded that the use of the JWCC Contract is in the Government’s best interest due to technical feasibility and cost to the Government.

DAI requested Additional Research to Support Fair Opportunity from the four JWCC CSPs on January 1, 2024. DAI received responses from: Microsoft, Oracle, and AWS. As a result, Oracle is the only CSP that meets all the Government’s requirements and can be seamlessly integrated with the Security Stack and DAI workload hosted in the Oracle infrastructure. Market research completed on September 17, 2024, indicates other companies’ similar services do not meet, or cannot be modified to meet, the Agency’s needs because they lack the specific features that are required. Other cloud services cannot be extended into the Oracle environment and, thus, do not meet the Government’s minimum requirements.

7. ANY OTHER SUPPORTING FACTS: None.

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History. None.

(b) To overcome future barriers to competition, DLA will continue to conduct market research to determine if there are changes in the marketplace, i.e., there are similar cloud

Page 6 of 7 Pages

CUI

offerings and/or product support in the marketplace that provides the same functionality, or it is economically feasible to procure a new system.