JA25-021_PKI Modernization-FINAL_Redacted.pdf

Controlled By: DISA Controlled By: PS8511 CUI Category: PROCURE Distribution/Dissemination Control: FEDCON

POC:

JUSTIFICATION & APPROVAL FOR FEDERAL ACQUISITION REGULATION

SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Contract

Orders under Fair Opportunity Federal Acquisition Regulation (FAR) 16.505(b), Defense FAR Supplement 216.505(b), Procedures, Guidance, and Information 216.505(b)

Purchase Request Number: HC1085501377 Joint Warfighting Cloud Capability (JWCC) Contract Number: HC105023D0005 Task Order (TO) Number: To be determined Procurement Title: Public Key Infrastructure (PKI) Modernization - Hybrid Cloud Estimated Value:

Statutory and Regulatory Authority: 10 United States Code (U.S.C.) 3204(a)(1) and FAR 16.505(b)(2)(i)(B)

EXCEPTION TO FAIR OPPORTUNITY

Number: JA25-021

Upon the basis of the following justification, I, as the Head of Contracting Activity (HCA), hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C.3204(a)(1) and Regulatory Authority of FAR 16.505(b)(2)(i)(B).

1. REQUESTING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

Defense Information Systems Agency (DISA) / Digital Capabilities and Security Center (DCSC) Cyber Security & Analytics (ID) 6910 Cooper Ave Fort Meade, MD 20755

Contracting Activity:

DISA /Defense Information Technology Contracting Organization/PS8511

2300 East Drive Scott Air Force Base, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S): This action is to issue a firm-fixed-price TO against the JWCC Indefinite Delivery/Indefinite Quantity Contract for PKI Modernization - Hybrid Cloud. This TO will be issued directly to Amazon Web Services, Inc (AWS). The anticipated period of performance (PoP) is for a 1-year base period, plus two 1-year option periods. The total estimated value is which will be funded by Research, Development, Test & Evaluation funds.

JA25-021 PKI Modernization - Hybrid Cloud

Page 2 of 6 Pages

CUI

3. DESCRIPTION OF SUPPLIES/SERVICES: This requirement is for the Government to move PKI from all on-premise Government hosted data centers to a hybrid cloud consisting of co-location facilities and cloud components.

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity.

FAR 16.505(b)(2)(i)(B) - Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(b) Description of the Justification.

AWS is the only cloud service provider (CSP) that provides managed services for required database types on impact level (IL)5 and IL6 (MariaDB, MySQL and PostgreSQL). AWS also provides direct network connections to existing co-location facilities that are required for the hybrid component of the effort due to the Department of Defense (DoD) and National Security System policy.

(c) Justification.

(1) Minimum Government requirements.

The minimum Government requirements for PKI Modernization are the cloud offerings listed below across IL2, IL5, and IL6. The managed database services listed must have the ability to cluster and replicate. These services are required to be approved and ready for immediate usage. The cloud offerings must continue at their current level to support the PKI Modernization, which includes:

-Multi Region (or Region in progress) support -Load balancer, application gateway, firewall and Virtual Private Network services- Direct connection/transit gateway service (to boundary cloud access points) -Permission and role-based authentication (including multi-factor Authentication) -Internal private networking -Linux based compute instances (virtual machines)-Persistent volumes (various types, e.g., object, blob) -Long-term or archival storage, storage is required to be lower cost storage with longer retrieval times (10.5 year minimum retention) -Container registry service -Managed container orchestration service -Serverless compute engine service -Internal and CSP managed audit and logging service -Managed Application Monitoring Service

Page 3 of 6 Pages

CUI

-Managed MariaDB Database Service -Managed PostgreSQL Database Service -Managed MySQL Database Service -Internal Metric service with dashboards that can provide security information and event management and application metric services -Dedicated Hardware service for keyed functions -Dedicated Network Connection Service that will enable direct network connections to a co-located facility that supports all standard ports and services -Cross Domain Services

(2) Proposed sole source contractor. AWS

(3) Discussion regarding the cause of the sole source situation.

The current PKI Hybrid and Keyless parts of the PKI system are engineered in the AWS environment and only compatible with AWS infrastructure. In addition, AWS is the only CSP that provides cross domain solution (CDS) services for IL5 and IL6 that are required for the PKI modernization deployment.

(4) Demonstration of unique source.

PKI Modernization requires a fielded, robust, and approved CDS. AWS Diode fulfills this requirement, and AWS is the only CSP that currently has a fully accredited CDS, which is required based on the DISA DCSC authority to operate.

Additionally, PKI is unable to support multiple CSPs due to compatibility with the current ongoing development and testing of a related PKI infrastructure initiative.

The following services are required for the modernization effort and are only provided by AWS across all required domains, IL2 - IL6:

Managed MariaDB Database Service (IL2 - IL6) Managed PostgreSQL Database Service (IL2 - IL6) Managed MySQL Database Service (IL2 - IL6) Managed Application Monitoring Service (IL2 - IL6) Archival Storage for long term retention for at least 10.5 years (lower cost storage with longer retrieval times is desired) (IL2 - IL6) Cloud Native Private Certificate Authority and Management Service (IL2 - IL5)

Lastly, specific features that PKI Modernization requires due to compatibility constraints that only AWS can provide are:

1. Cloud Native and Managed MariaDB Service that is available across IL2 - IL6. AWS is the only CSP to offer that unique service for the length of the PKI Modernization PoP.

Other CSPs either do not offer the comprehensive required services or such services will no longer be offered within a year. MariaDB is required for custom developed

Page 4 of 6 Pages

CUI

Government Off the Shelf (GOTS) Purebred service, which provides trusted DoD derived credentials to mobile devices on both Non-Secure Internet Protocol Router and Secure Internet Protocol Router.

2. Cloud Native and Managed Postgres Service that is available across IL2-IL6. Postgres is required for the Government’s custom developed, Non-Person Entity GOTS solution, which provides agencies a means to automatically issue and re-issue trusted DoD certificates for webservers and devices. AWS is the only CSP that offers this capability.

3. CDS compatible and approved for use. AWS is the only CSP available for the PKI Modernization effort.

4. Cloud Native and managed application monitoring service. AWS is the only CSP with the required cloud native tools across all required ILs.

5. On-premise/edge adjacent hardware required for a hybrid infrastructure. AWS Outpost will allow the Government to run native AWS services in existing AWS cloud development and pre-production (Test) environments utilizing the same configurations as the on-premise production environment. This unique diversification limits configuration management drift in a hybrid posture, utilizing the least dedicated hardware possible.

(5) Procurement discussion.

Based on outreach to the four CSPs in December 2024, the only CSP that can meet the minimum needs of the Government is AWS. The Modernization efforts must be compatible with existing PKI services. Any attempt to support multiple CSPs within the project or switching entirely to another CSP, if any could meet the minimum requirements, would result in schedule delays and additional multi-cloud integration tasks, and result in additional costs; neither of which would benefit the Government.

Additionally, the engineering team would need to re-architect the deployment strategy of cloud services if PKI is not exclusively running on AWS. This would require development of additional cloud provisioning scripts for other CSPs and add more engineering/development tasks to the project; again, of no benefit to the Government.

(6) Impact.

System integration must be completed using a singular CSP. The Hybrid Cloud must be compatible with existing PKI services already running on AWS and are required to have a fully functional system. Compatibility issues would cause impacts to schedule, costs, and an increased, unacceptable risk as many services AWS provides are utilizing significant GOTS code that requires specific commercial off-the-shelf software resources that can only be provided by AWS.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION: A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the Independent Government Cost Estimate and the JWCC Catalog pricing, including any discounts, Page 5 of 6 Pages

CUI

which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

6. MARKET RESEARCH: Market research for the basic JWCC Contracts was conducted and resulted in a signed market research report on November 9, 2021, that was revalidated and recertified on July 29, 2024. After a survey of the market, it was concluded that use of the JWCC Contract is in the Government’s best interest due to technical feasibility and cost to the Government. Additional research was conducted July 2024 – December 2024 by reviewing the specific capabilities in the JWCC Contracts and it was determined that AWS is the only source capable of fulfilling the Government’s minimum needs in the manner and time frame required.

An Additional Research request was sent to all four CSPs on December 06, 2024. Oracle responded to the request, but at the time of response, did not have either cloud native managed database services across IL2 - IL6, or an approved cross domain service. Microsoft responded after the deadline, but provided no supporting details on how their solutions can perform the required work. Google did not respond. Based on the results of the request, it was determined AWS is the only CSP to offer all of the required managed database services across IL2 - IL6 and the only CSP to offer an approved CDS. Microsoft, Oracle, nor Google offered a timeline or estimation on when these same services would be available.

7. ANY OTHER SUPPORTING FACTS: None.

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History: Not Applicable

(b) To overcome future barriers to competition, future development and enhancement of IaaS components will include shifting to a containerized platform. This will enable multiple CSPs to meet the requirements which will enable the flexibility to shift workload based on financial and mission requirements. The Government will continue to conduct market research to determine if there are changes in the marketplace that would enable future competitive actions.

Page 6 of 6 Pages

CUI

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Aaron Dennington SIGNATURE: See signature page

TITLE/AGENCY/ORGANIZATION: Cybersecurity Specialist, DISA, DCSC Cyber Security & Analytics (ID)

PHONE

DATE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Michael Merrick SIGNATURE: See signature page

TITLE/AGENCY/ORGANIZATION: ID21 Program Manager, DISA, DCSC Cyber Security & Analytics (ID)

PHONE:

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: Lara Chiaurro SIGNATURE: See signature page

TITLE/AGENCY/ORGANIZATION: Contracting Officer/DISA/DITCO/PS8511

PHONE: DATE:

HEAD OF THE CONTRACTING ACTIVITY APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief. Since this justification does not exceed this review serves as approval.

NAME: Douglas W. Packard SIGNATURE: See signature page

TITLE/AGENCY/ORGANIZATION: HCA, DISA/DITCO

PHONE:

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

Darryl Boswell .