JA25-067_852571851 JA DHA MED365 Environment_Redacted.pdf

CUI

Controlled By: DISA Controlled By: PS8511 CUI Category: PROCURE Distr

POC:

JUSTIFICATION & APPROVAL FOR FEDERAL ACQUISITION

REGULATION SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Contract

Orders under Fair Opportunity Federal Acquisition Regulation (FAR) 16.505(b), Defense FAR Supplement 216.505(b), Procedures, Guidance, and Information 216.505(b)

Military Interdepartmental Purchase Request Numbers: 12267243, 12267246, 12267244, 11267245, 12266307, 12265626 Joint Warfighting Cloud Capability (JWCC) Contract Number: HC105023D0003 Task Order (TO) Number: To Be Determined Procurement Title: Defense Health Agency (DHA) Medical (MED) Environment Estimated Value:

Statutory and Regulatory Authority: 10 United States Code (U.S.C.) 3204(a)(1) and FAR 16.505(b)(2)(i)(B)

EXCEPTION TO FAIR OPPORTUNITY

Number: JA25-067

Upon the basis of the following justification, I, as the Procuring Activity Competition Advocate (PACA), hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C. 3204(a) and Regulatory Authority of FAR 16.505(b)(2)(i)(B).

1. REQUESTING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

DHA/Program Executive Office Medical Systems/Chief Information Officer (CIO) (J-6) 7700 Arlington Blvd Falls Church, VA 22942

Contracting Activity:

Defense Information Systems Agency (DISA)/Defense Information Technology Contracting Organization (DITCO)/Cloud Capabilities Section (PS8511)

2300 East Drive Scott Air Force Base, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

This action is to issue a firm-fixed-price TO against the JWCC Indefinite Delivery/Indefinite Quantity Contract for the DHA MED Environment. This TO will be issued directly to Microsoft Corporation. The anticipated period of performance (PoP) is for a 1-year base period, plus one, 1-year option period. The total estimated value is which will be funded by Operations & Maintenance funds.

JA25-067: DHA MED Environment

Page 2 of 8 Pages

CUI

3. DESCRIPTION OF SUPPLIES/SERVICES:

DHA requires Anything as a Service (XaaS) offerings (e.g., compute, network, storage, Infrastructure as a Service (IaaS)) and cloud support services. The MED365 tenant is the DHA implementation of Department of Defense (DoD) 365-Joint (DoD365-J). This tenant is a single-shared tenant for the Fourth Estate Agencies and Combatant Commands, which are using Microsoft’s cloud offerings and services at Impact Level (IL) 4. With approval by the DoD CIO, MED365 provides critical services to over 170,000 globally distributed users on the “health.mil” domain. Services include Active Directory, email via Exchange Online (EXO), collaboration tools, virtual desktops, and advanced security tools. DHA also requires hosting and subscriptions to support log file retention and other compliance requirements. These services provide email, web content management, online office products, collaboration, and virtual remote desktops to the 170,000 globally distributed users of the health domain.

Specifically, DHA requires compute and storage resources to establish a separate virtual enclave boundary and De-Militarized Zone protections (Virtual Datacenter Security Stack (VDSS) & Virtual Datacenter Management Suite (VDMS)) for the current environment. This enclave includes cybersecurity tools, infrastructure and network foundations, core services (Active Directory, Domain Name System), and monitoring tools. These services provide security protections and shared services to the cloud environments connected to each MeetMe Point.

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity.

FAR 16.505(b)(2)(i)(B) - Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(b) Description of the Justification.

The DHA MED365 tenant is a single instance of Azure Active Directory, known as Microsoft Entra Identity, built upon the Microsoft cloud platform. The DHA MED365 tenant utilizes integrated cloud services to enable cross-tenant collaboration within the Microsoft DoD365-J Government cloud environment. MED365’s Automation Government Cloud Suite are natively integrated applications designed to support information technology service automation, resource management, collaboration, and shared support services. Azure Government Cloud is used by the current DHA hosted customers to deploy a broad range of workloads and solutions that are subject to DoD Provisional Authorization (PA) by DISA. To achieve DoD’s objectives and requirements, the DHA MED365 tenant implements configurations in accordance with (IAW) the DoD Cross-tenant Collaboration, tenant Configuration Guide to provide the following core services: Identity Access, Teams, EXO and SharePoint Online (SPO)/OneDrive for Business. MED365 applications cover all Information Technology Infrastructure Library, Page 3 of 8 Pages

CUI

Development, Security and Operations processes, and are natively integrated in a single platform providing cloud process automation. Microsoft is the only CSP capable of meeting these requirements while maintaining the cross-tenant collaboration within the DoD365-J cloud environment.

In 2021, the Defense Enterprise Office Solutions (DEOS) program began to migrate users to Microsoft’s cloud-based 365 suite of products referred to as DoD365. The DEOS program offered the DoD365-J tenant to provide a dedicated instance of the Microsoft 365 services. The DHA report identified several areas of concern with access into the Microsoft O365 and Azure ecosystems. These concerns revealed there was significant risk that compromised security and a sizable spillage of protected health information.

Based on this report, DHA requested a waiver to establish a separate tenant within the DoD365 environment to mitigate these risks. On April 28, 2022, the DoD CIO approved a waiver for a separate tenant. Microsoft is currently providing our solution and is the only CSP capable of providing a tenant within the DoD365-J cloud environment.

(c) Justification.

(1) Minimum Government requirements.

The cloud service offerings (CSOs) must continue at current level in order to support XaaS offerings including compute, network, storage, IaaS services at IL4, and cloud support to continue provisioning the existing workloads in the MED365 environment as approved by DHA. The Government requires virtual private circuits connecting DHA MeetMe Points to the cloud environments at Ashburn, VA, Dallas, TX, and San Jose, CA.

The circuits will provide the connection from the Microsoft CSOs to the DHA network via the DHA MeetMe Points. A production environment comprised of Windows and Redhat Enterprise License (RHEL) servers is required to connect to the Ashburn and San Jose MeetMe Points. A pre-production environment comprised of Windows and RHEL servers is required to connect to the Ashburn MeetMe Point along with a VDSS/VDMS comprised of Windows and RHEL servers to support and protect the environments connected to the Ashburn, Dallas, and San Jose MeetMe Points.

The Government also requires the cloud service provider (CSP) to provide the following services:

-A secure Common Access Card enabled user remote access solution.

-A key management service -A database migration solution -A Security Information Event Management (SIEM) system and Security Orchestration Automated Response integrated solution.

-Pre-built artificial intelligence models and Application Programming Interfaces to add intelligence to applications, without data science expertise.

The environment will need to support the following metrics for data flow:

Page 4 of 8 Pages

CUI

-Inbound or outbound streaming data -Monitoring ingestion -Monitoring retrieval -Cloud performance monitoring -Cloud financial monitoring capability to monitor and report on services used.

The CSP must comply with the DoD Risk Management Framework (RMF) set forth by DoD Instruction 8510 and National Institute of Standards and Technology Special Publication 800 series. The CSP must be able to obtain an Authority to Operate (ATO) granted by the DHA Authorizing Official, IAW the DoD standards to operate on the DHA Medical Community of Interest (Med-COI) network, which is DHA’s authorized network separate from the Non-Secure Internet Protocol Router Network.

(2) Proposed sole source contractor. Microsoft.

(3) Discussion regarding the cause of the sole source situation.

The DoD CIO has multiple policies in place that require specific use of communication and data storage. These mandates include Deputy Secretary of Defense Memorandum, "Records Management Responsibilities for Text Messages," August 3, 2022. Also, in 2022 the DHA received DoD CIO approval to operate its own O365 tenancy, but the tenancy must remain within the DOD365-J environment. This designation mandates the use of the Microsoft 365 capabilities and services offered only through the Microsoft CSO, and migration to another CSP would result in mission failure.

DHA enterprise's infrastructure and environment is a crucial part of the unique functions of how the DHA communicates internally and externally with other DoD agencies and other external stakeholders. Any efforts to overhaul this environment would require DHA to re-architect, re-engineer, and re-factor critical CSOs. This would take 12-24 months to connect, configure, and accredit/authorize through the DHA RMF process for use by DHA users. The effort would also include extra engineering support, independent verification & validation, and additional CSP costs for network transport and security services. The current environment consists of a massive amount of data, over 210 petabytes (in both private and public CSOs) along with express routes and interconnections that cannot be reconstituted in a feasible manner to satisfy the requirements of the DHA. This drives the Government’s current need for compatibility, as these mitigation efforts present unacceptable risk to the Government.

(4) Demonstration of unique source.

Microsoft possesses the knowledge, skills, capabilities, certification, clearance, and experience required to continue the existing requirement without the risk of mission failure within DHA’s critical services. The current environment is a key part of the Microsoft 365 infrastructure that services the 170,000 globally distributed users.

Microsoft’s CSOs are exclusively capable and uniquely qualified to fulfill the DHA requirements due to the ability to natively integrate with the current DHA environment.

Page 5 of 8 Pages

CUI

Microsoft 365 Collaboration and Cloud capabilities are only offered as part of the CSO Med365 tenant within the DoD 365-J Environment. Due to the unique requirements of DHA, it is imperative that Microsoft continue to provide the current features used across the enterprise.

The current cloud environment houses unique DoD mandated Microsoft DoD365-J services and products that other CSPs cannot provide and are not compatible with products used by other 365 tenants. This includes email via EXO, collaboration tools such as Teams, OneDrive, and SPO, device management capabilities, virtual desktop through Administrative Virtual Desktop, and advanced security tools in the Defender suite. DHA also requires hosting and subscriptions to support log file retention and other compliance requirements using Sentinel and Purview within the IL4 environment. These unique services can only be provided by Microsoft due to the integration requirements with Microsoft 365, and with the DoD 365-J tenant services. These unique features cannot be reasonably found with other CSPs and are required to remain compliant with DHA RMF accreditations granting ATO within the Med-COI network. Only Microsoft can provide the DoD365-J services.

Only one CSP is capable of supporting the online version of the email, content management, collaboration tools, and office productivity tools required by the MED365 tenant. The MED365 tenant is the DHA implementation of Microsoft 365 in a DoD-approved IL4 Microsoft cloud environment. DHA has implemented standard operating procedures and processes that include tools inside this CSP's environment that store data at a secured and accessible location. The basis for the sole source is the ability of only one CSP to support the online version of the email, content management, collaboration tools, and office productivity tool directed by DoD and implemented in a separate tenant by DHA. The CSOs are only provided by Microsoft, which is the only CSP that can support the Microsoft Office 365 product suite.

Selecting another CSP would create compatibility issues with other DoD mission partner environments that DHA’s MED365 tenancy integrates with. All CSPs would be able to provide limited pieces of the solution such as compute, storage, SIEM, or remote access solution, but each of the pieces would not directly integrate with the DoD365 components, as required. Therefore, none of the other three CSPs are capable of meeting the Government’s minimum needs.

(5) Procurement discussion.

Based on the Additional Research request to the four JWCC CSPs on February 20, 2025, the only CSP that is currently capable of meeting the minimum needs of the Government is Microsoft. Microsoft is the only source capable of seamlessly integrating into the Government’s current infrastructure and providing a compatible solution that is compliant with the DoD mandates that require the use of specific and unique features.

Microsoft is the only CSP that can support the unique mission and requirements.

Page 6 of 8 Pages

CUI

(6) Impact.

Migration to another CSP from Microsoft is not feasible based on the inability of the other three CSPs to seamlessly integrate with the existing environment. The impact of not procuring through Microsoft would result in a loss of MED365 products that would cause significant degradation and disrupt the ability for DHA users to communicate, collaborate, and share information. This impact will cause issues across the entire DoD losing access to critical readiness data. The DoD's medical mission will affect all branches of the military and cause critical impact to the warfighter’s ability to address health and welfare. This would have severe impact on the 170,000 users across the DHA enterprise. Without this environment in place, DHA will also become non-compliant with DoD regulations and policies, since they will no longer be connected to the DoD mandated Microsoft DoD365-J and will no longer have required software support for the Microsoft 365 capabilities. DHA would no longer be able to collaborate with cyberspace defenders and DoD365-J Cybersecurity Service Providers.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION:

A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the Independent Government Cost Estimate and the JWCC Catalog pricing, including any discounts, which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

6. MARKET RESEARCH:

Market research for the basic JWCC Contracts was conducted and resulted in a signed market research report on November 9, 2021, that was revalidated and recertified on July 29, 2024.

After a survey of the market, it was concluded that the JWCC Contract is in the Government’s best interest due to technical feasibility and cost to the Government.

Additional market research was conducted on December 12, 2024, by reviewing the specific capabilities in the JWCC Contracts and it was determined that Microsoft Corporation is the only CSP capable of fulfilling the Government’s minimum needs in the manner and time frame required. IAW FAR Part 10, market research was conducted by researching and consulting with the civilian and military healthcare organizations in both Government and industry to identify alternatives as well as reviewing existing contracts. Market research was conducted by meeting with all four JWCC CSPs concerning their recent acquisitions of commercial cloud, catalog pricing sheets, and other acquisition artifacts.

The four CSP’s on JWCC were sent the Additional Research to Support an Exception to Fair Opportunity document on February 20, 2025, with responses due by February 24, 2025. Two of the four CSPs provided a response, Oracle and Microsoft. Google Public Sector and Amazon Web Services did not respond.

Oracle’s response stated that the DHA MED Environment request had requirements that are an extension of and related to an existing Microsoft 365 cloud solution, therefore Oracle was not

Page 7 of 8 Pages

CUI

able to submit a formal whitepaper. They indicated they were able to provide enterprise services, operating at FedRAMP+/High, IL4 authorized cloud data centers supporting DoD mission workloads. Oracle’s response confirmed that it cannot meet the Government’s minimum needs.

Microsoft’s response stated they were able to meet all the requirements and provided documentation to support the response. Knowledge of the existing environment shows the ability to comply with FedRAMP, DoD PA’s and DHA RMF. Based on the results of the additional research, it was determined that Microsoft is the only CSP currently capable of providing all required services needed for the DHA MED Environment.

7. ANY OTHER SUPPORTING FACTS: None.

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History:

Incumbent Contractor: DH Technologies Contract Number: NNG15SC70B TO Number: HT001524F0079 PoP: September 20, 2024 - September 19, 2025(The current task order was recently extended from May 2025 to September 19, 2025, to ensure there is no gap in service as it is critical to the DHA mission.)

Competitive Status: Small business (SB) set-aside Business Size: SB

(b) To support NNG15SC70B/HT001522F0155, a justification and approval (J&A) for an exception to fair opportunity was signed on June 16, 2022, by the Contracting Officer, Enterprise Medical Services Contracting Division. The previous J&A was based upon a Limited Sources brand name justification FAR 16.505(a)(4) for items peculiar to one manufacturer. To overcome those barriers, if the other CSPs have available options that integrate with DoD 365-J during the planning for a follow-on, DHA will prepare a competitive requirement anticipated to be completed, solicited, and awarded by September 2027. However, an additional exception to fair opportunity is required because DHA continues to maintain the MED365 tenant within the Microsoft DoD365-J Government cloud environment and no other CSP has a complete solution that meets the unique features offered by Microsoft at this time.

Page 8 of 8 Pages

CUI

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Mr. Robert Hutton SIGNATURE: See separate signature page

TITLE/AGENCY: Data Center Operations Hardware Section Chief, DHA

PHONE:

DATE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Mr. Robert Hutton SIGNATURE: See separate signature page

TITLE/AGENCY: Data Center Operations Hardware Section Chief, DHA

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: Lara Chiaurro SIGNATURE: See separate signature page

TITLE/AGENCY/ORGANIZATION: Contracting Officer/DISA/DITCO/PS8511

PROCURING ACTIVITY COMPETITION ADVOCATE (PACA) APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief. Since this justification does not exceed this review serves as approval and my written determination that the aforementioned FAR circumstances apply.

NAME: Andrea Horstmann SIGNATURE: See separate signature page

TITLE/AGENCY/ORGANIZATION: PACA/DISA/DITCO

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

Darryl Boswell .