JA25-070 AMD01 - 852572235 JS J6 JAD Gov Cloud Final_Redacted.pdf

CUI

Controlled by: DOD Controlled By: JAD CUI Category: PROCURE Distribution/Dissemination Control: FEDCON

POC: MATTHEW HOLLEY, +1 8508859507, MATTHEW.D.HOLLEY.CIV@MAIL.MIL

AMDENDMENT JUSTIFICATION & APPROVAL FOR FEDERAL

ACQUISITION REGULATION SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Contract

Orders under Fair Opportunity Federal Acquisition Regulation (FAR) 16.505(b), Defense FAR Supplement 216.505(b), Procedures, Guidance, and Information 216.505(b)

Purchase Request Number: H91269523691 Joint Warfighting Cloud Capability (JWCC) Contract Number: HC105023D0003 Task Order (TO) Number: To be Determined Procurement Title: Joint Staff (JS) J6 Joint Assessment Division (JAD) Government Cloud Estimated Value:

Statutory and Regulatory Authority: 10 United States Code (U.S.C.) 3204(a) and FAR 16.505(b)(2)(i)(B)

EXCEPTION TO FAIR OPPORTUNITY

Number: JA25-070 AMD01

Upon the basis of the following justification, I, as the Procuring Activity Competition Advocate (PACA), hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C. 3204(a) and Regulatory Authority of FAR 16.505(b)(2)(i)(B).

1. REQUESTING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

Joint Chiefs of Staff / JS J6 JAD 104 Biscayne Road B637 Eglin Air Force Base (AFB), FL 32542

Contracting Activity:

Defense Information Systems Agency (DISA) / Defense Information Technology Contracting Organization (DITCO) / Cloud Capabilities Section (PS8511)

2300 East Drive Scott AFB, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

AMD01: This amendment increases the estimated value by . This increase is due to the unintentional omission of CLIN 0001 on the Independent Government Cost Estimate. CLIN 0001 is required for Impact Level 4 assessments using cloud-based tools and networks, equating to approximately 900 hours and per month.

JA25-070 AMD01 - JS J6 JAD Government Cloud

Page 2 of 6 Pages

This action is to issue a firm-fixed-price task order (TO) against the JWCC Indefinite Delivery/Indefinite Quantity Contract for JS J6 JAD Government Cloud. This TO will be issued directly to Microsoft Corporation. The anticipated period of performance (PoP) is for a 12-month base period, plus one, 12-month option period. The total estimated value is of which will be funded by Research, Development, Test, & Evaluation funds.

AMD01 increases the total estimated value by for a new estimated total of

, which will be funded by Research, Development, Test, & Evaluation funds.

3. DESCRIPTION OF SUPPLIES/SERVICES:

JS J6 JAD requires the ability to provide Impact Level (IL)4 and IL6 domains that support JAD Combined Joint All-Domain Command & Control (CJADC2) assessments using cloud-based tools and networks.

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity.

FAR 16.505(b)(2)(i)(B) - Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(b) Description of the Justification.

JAD has invested three years migrating its JAD network (JADNET) to the cloud, decommissioning on-premises infrastructure in the process. This migration has resulted in a fully operational IL4 (Test/Development) and IL6 (Production) environment, directly supporting CJADC2 objectives. These two independent networks are used to develop JAD IL4 assessments tools and deploy those tools on IL6. JADNET is tightly integrated with the United States Air Force (USAF) networks, which necessitates leveraging Microsoft’s robust capabilities for secure interoperability with existing base enterprise Microsoft-based networks. Shifting to another Cloud Service Provider (CSP) would result in an estimated in additional cost and approximately a 12–18-month delay. Given the critical security requirements, Microsoft is the only CSP capable of performing JAD’s CJADC2 requirement without significant risk of critical mission failure for data collection and assessment support for the JAD and over 100 mission partners.

(c) Justification.

(1) Minimum Government requirements.

Page 3 of 6 Pages

CUI

JADNET has a requirement for the following cloud offerings that perform data collection and assessment support for JAD that must continue at their current IL4 & IL6 level to support hosting JAD’s JADNET domain-based assessment network using Infrastructure as a Service (IaaS): two Active Directory (AD) domain controllers, a Windows Server 2019 file server Virtual Machine (VM), Two Windows MySQL 2019 database server VMs, a Microsoft Windows Server Update Services server for updates and patching, the Assured Compliance Assessment Solution Security Suite (one MS Server 2019 and one Red Hat Enterprise Linux 9 server for vulnerability scanning), 20+ Windows 11 VM workstations, pre-configured with JAD's proprietary tools, hardened with DISA Security Technical Implantation Guides, and serving as the standard VM workstation baseline. All offerings must include IaaS offerings that JADNET uses for intranet websites, fully functioning intranet domains, and database hosting. Additionally, JADNET IL4 includes many VMs used for software development of the JAD proprietary tools and applications.

JAD leverages Microsoft’s robust security features, including Microsoft Sentinel and Cloud Defender, which are crucial for protecting sensitive data and maintaining the integrity of assessment operations. Given the interdependence to the DISA and USAF enterprise networks, dependencies on Structured Query Language (SQL) 2022, Microsoft Sentinel and Cloud Defender, the required cloud services must be able to provide a fully functioning IaaS cloud-based AD domain with Microsoft integration and interoperability.

(2) Proposed sole source contractor.

Microsoft Corporation

(3) Discussion regarding the cause of the sole source situation.

The only source capable of ensuring the continued operational viability of JADNET domains (IL4 & IL6) is Microsoft. Additionally, Microsoft is the only source capable of hosting the JADNET domain networks at the level and quality required due to the complexity of JADNET’s Microsoft’s AD-based domains.

Due to the mission-critical nature of JADNET, any deviation from the current solution would result in unacceptable risks to system integrity, security, and operational effectiveness. Therefore, Microsoft is the only authorized provider for the required network infrastructure.

Further, the only source capable of performing the JADNET domain networks at the level and quality required is Microsoft. Transitioning to another solution would necessitate significant retooling and application redevelopment efforts, resulting in unacceptable delays and increase risk to mission-critical operations to an unacceptable level.

(4) Demonstration of unique source.

Microsoft possesses the knowledge, skills, capabilities, certification, clearance, and experience required to continue the program without a break or degradation in critical mission requirements. Given these critical mission requirements, Microsoft is the only

Page 4 of 6 Pages

CUI

CSP that can perform the necessary services to support JADNET domains for the CJADC2 assessment tasks from the Chairmen of the Joint Chiefs of Staff. Microsoft is the only CSP that can ensure uninterrupted continuation of JAD's essential assessment operations which are vital for CJADC2 support.

While alternative CSPs offer computing capabilities, they lack the security features and seamless integration that JAD currently requires. Microsoft Entra Connect provides seamless synchronization between on-premises and cloud environments for Common Access Card authentication and granular role-based access control, significantly reducing administrative overhead. Additionally, the horizontal integration of Microsoft products within the Microsoft environment is essential for the deployment and operation of JAD’s proprietary tool application suites.

(5) Procurement discussion.

Based on the Market Research conducted in March 2025, the only CSP that is currently capable of meeting the minimum needs of the Government is Microsoft. JADNET is a fully functioning IaaS cloud-based AD domain with horizontal integration and interoperability with Microsoft. Other CSPs such as Oracle can host and manage AD servers, but do not provide an AD domain service. With JADNET’s interdependence to DISA and USAF networks, Google Public Sector (GPS) lacks the capability to fully integrate with all required Microsoft products across IL4 and IL6. Similarly, Amazon Web Services (AWS) offer computing capabilities, but lack integration with Microsoft security tools that JAD currently relies upon. Additionally, migrating to AWS would necessitate converting Microsoft-based VMs to VMware-based VMs, introducing significant technical challenges and compatibility issues. The time required to retool and reconfigure on AWS would directly impact the JAD’s ability to perform mission critical assessments and meet the contract deadline of May 31, 2025. None of these alternative solutions meet the need to operate a fully functioning IaaS cloud-based AD domain as required to support the mission.

(6) Impact.

Transitioning to another CSP is not feasible based on an unacceptable risk of failure to mission-critical operations. The impact of not procuring these required capabilities through Microsoft would result in crippling the assessment capabilities of the Chairmen of the Joint Chiefs of Staff.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION:

A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the independent government cost estimate and the JWCC Catalog pricing, including any discounts, which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

6. MARKET RESEARCH:

Page 5 of 6 Pages

CUI

Market research for the basic JWCC Contracts was conducted and resulted in a signed market research report on November 9, 2021, that was revalidated and recertified on July 29, 2024.

After a survey of the market, it was concluded that the JWCC Contract is in the Government’s best interest due to technical feasibility and cost to the Government.

Additional research was conducted in March 2025, by reviewing the specific capabilities in the JWCC Contracts and CSP catalogs and it was determined that Microsoft is the only source capable of fulfilling the Government’s minimum needs in the manner and timeframe required.

JAD also requested Additional Research to Support Fair Opportunity in March 2025, from the four JWCC CSPs. The Government only received a response from Microsoft. Oracle declined to participate due to time constraints. Amazon Web Service and Google did not respond to the Additional Research request.

Upon conclusion of the market research techniques highlighted, it was determined that Microsoft is the only CSP that can meet JAD’s requirements. Microsoft provides IaaS cloud-based AD network domains that are fully compatible with JAD’s existing environment and was the only CSP to provide a response to the Government’s request for research to support an exception to fair opportunity. Due to the mission-critical nature of JADNET and its dependence on Microsoft's proprietary technologies, any deviation from a Microsoft-exclusive solution would introduce unacceptable risks to system integrity, security, operational effectiveness, and mission success.

7. ANY OTHER SUPPORTING FACTS: None.

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History:

Incumbent Contractor: MINBURN Technology Group LLC Contract Number: 47QTCA21A0003 Task Order Number: 47QFSA22F0091 Period of Performance: June 1, 2022 - May 31, 2025 Competitive Status: Full and open competition Business Size: Small business

(b) In order to support fair opportunity efforts, the JAD Team has identified the time, cost, and effort to move from a Microsoft-centric approach to a hybrid approach using products of different vendors. This will enable multiple CSP’s to meet the requirements which will enable the flexibility to shift workload based on financial and mission requirements.

The previous procurement was not based upon an exception to fair opportunity.

Page 6 of 6 Pages

CUI

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Mr. Robert G Young SIGNATURE:

TITLE/AGENCY: JAD Lead Computer Scientist, DoD

PHONE:

DATE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Mr. Randy Green SIGNATURE:

TITLE/AGENCY: JAD Resource Analyst, DoD

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: Jacob R. Benhoff SIGNATURE:

TITLE/AGENCY/ORGANIZATION: DISA/DITCO/PS8511

PROCURING ACTIVITY COMPETITION ADVOCATE APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief.

Since this justification does not exceed $15M, this review serves as approval and my written determination that the aforementioned FAR circumstances apply.

NAME: Andrea Horstmann SIGNATURE:

TITLE/AGENCY/ORGANIZATION: Procuring Activity Competition Advocate/DISA/DITCO

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

Contract Specialist, Jacob M. Sopiars,