JA25-074 AMD 01_852571967 DoD Olympus_Redacted.pdf

CUI

Controlled by: DISA Controlled By: HC23 CUI Category: PROCURE Distribution/Dissemination Control: FEDCON

POC: DAVID LAGO, +1 571-422-8590, DAVID.C.LAGO.CIV@MAIL.MIL

JUSTIFICATION & APPROVAL FOR FEDERAL ACQUISITION

REGULATION SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Contract

Orders under Fair Opportunity Federal Acquisition Regulation (FAR) 16.505, Defense FAR Supplement 216.505(b), Procedures, Guidance, and Information 216.505(b)

Military Interdepartmental Purchase Request Number: To Be Determined Joint Warfighting Cloud Capability (JWCC) Contract Number: HC105023D0003 Task Order Number: To be Determined Procurement Title: Department of Defense (DoD) Olympus: Foundations Estimated Value:

Statutory and Regulatory Authority: 10 United States Code (U.S.C.) 3204(a) and FAR 16.505(b)(2)(i)(B)

EXCEPTION TO FAIR OPPORTUNITY

Number: JA25-074 AMD 01

Upon the basis of the following justification, I, as the Procuring Activity Competition Advocate (PACA), hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C. 3204(a) and Regulatory Authority of FAR 16.505(b)(2)(i)(B).

1. REQUESTING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

Defense Information Systems Agency (DISA) / Hosting and Compute (HaC) 2530 Crystal Drive, Suite: 2E26 Arlington, VA 22202

Contracting Activity:

DISA / Defense Information Technology Contracting Organization (DITCO) / Cloud Capabilities Section (PS8511)

2300 East Drive Scott Air Force Base, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

AMD 01: This amendment is to increase the value by due to multiple omissions in the Independent Government Cost Estimate (IGCE) that did not contemplate the anticipated growth, and Generative Artificial Intelligence (Gen AI) tokens. The anticipated growth of 20% in 4.1.1 of the Description of Work (DoW) and the Gen AI tokens in section

3.5 of the DoW account for of the variance. Lastly, the Flexible Server

JA25-074 AMD 01-DoD Olympus: Foundations

CUI

Deployment was underestimated by and the difference of is due to the higher percentage proposed for surge.

This action is to issue a firm-fixed-price task order (TO) against the JWCC Indefinite Delivery/Indefinite Quantity Contract for DOD Olympus: Foundations. This TO will be issued directly to Microsoft Corporation. The anticipated period of performance (PoP) is for a 1-year base period. The total estimated value is of which will be funded by Defense Working Capital and Operations & Maintenance funds.

3. DESCRIPTION OF SUPPLIES/SERVICES:

DoD Olympus requires a combination of infrastructure as a service (IaaS), platform as a service (PaaS), and software as a service (SaaS) offerings from a commercial cloud provider. These services must be Federal Risk and Authorization Management Program (FedRAMP) approved as well having a DISA Provisional Authorization.

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity.

FAR 16.505(b)(2)(i)(B) - Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(b) Description of the Justification.

DoD Olympus is a DISA initiative, developed to support cloud adoption for DISA, 4th Estate, and the DoD overall. It is a managed platform that builds and manages secure cloud environments to host customer applications and data. As such, DISA HaC has identified DISA, 4th Estate and Military Services as potential customers. DISA, 4th Estate, and Military Services have signed up to participate in DISA HaC’s upcoming DoD Olympus beta tests and completed demand surveys expressing interest in the emerging service.

Microsoft Azure is uniquely qualified as the only capable Cloud Service Provider (CSP) for DoD Olympus due to its end-to-end native security tooling in Azure Defender for Cloud that does not require the purchase or configuration of third-party security products.

Microsoft Defender for cloud is an end-to-end native security solution from the endpoints such as virtual machines and containers to Cloud Security Posture Management ensuring that cloud services are properly configured. It also offers Microsoft Sentinel as a Security Information Event Management (SIEM) tool that examines millions of logs to identify and visualize threats and a Security Orchestration Automated Response (SOAR) tool that automatically thwarts attacks. Azure also offers Entra (formerly Azure Active Directory) a full featured identity and authentication platform for applications as well as cloud

CUI

provisioning. There are no equivalent or similar services in the other cloud providers for Azure Defender for Cloud and Azure Entra.

(c) Justification.

(1) Minimum Government requirements.

The key functional requirements are CSP native offerings for the following:

1.) SIEM/SOAR: A comprehensive SIEM and SOAR tool that integrates cloud posture management and cloud native application protection. The SIEM examines and correlates millions of audit logs to find and visualize threats. The SIEM/SOAR will be employed by the DISA Cybersecurity Provider to avoid exporting log data which consumes network bandwidth, increases storage costs, and may incur egress fees.

2.) Cloud Native Application Protection Platform (CNAPP): an integrated set of security and compliance capabilities designed to help secure and protect cloud-native infrastructure and applications across development. Includes host-based security, container scanning, and cloud posture management.

3.) Cloud Posture Management: identifies and remediates risk by automating visibility, uninterrupted monitoring, threat detection, and remediation workflows to search for misconfigurations across diverse cloud environments/infrastructure including: (IaaS, PaaS, and SaaS.

4.) Identity Access Management: an identity provider and access management for people (workforce, consumer, and other users) and machines into protected applications in a streamlined and consistent way that enhances user experience.

5.) Entitlement Management: Grants, resolves, enforces, revokes, and administers fine-grain rights across platforms, applications, network components, and devices.

6.) National Institute of Standards and Technology IST 800-53 & Center for Internet Services (CIS) Benchmarks policy as code baseline: express governance and compliance rules as code, so they can be enforced programmatically by automation tools. These rules need to be mapped to NIST 800-53 and CIS Foundations Benchmarks.

7.) Organizational Constructs and automation: A means to manage multiple accounts/subscriptions from a single point and to enforce configuration or controls.

8.) Generative Artificial Intelligence (GenAI): capability for code completion and suggestions to support the automation development across CSPs.

9.) Virtual Machines, Managed Kubernetes, Managed Databases, and other services.

(2) Proposed sole source contractor. Microsoft Corporation.

(3) Discussion regarding the cause of the sole source situation.

The only source capable of providing the required foundational capabilities for DoD Olympus is Microsoft, as none of the other JWCC CSPs have the required capabilities or offerings, such as Azure Defender for Cloud and Azure Entra. The refactoring of the current environment from the Microsoft Azure environment to another CSP would not meet the Government’s minimum requirements. Migration from one CSP to another would cost and delay the project 6-9 months to develop the automation that is unique to that CSP as well as the cost of third-party tools to fill the gap in areas where there is no CSP native offering.

(4) Demonstration of unique source.

Microsoft Azure is uniquely qualified to be a foundational CSP for Olympus due to its capabilities in identity (Azure Entra), CNAPP services (Microsoft Defender for Cloud), cloud posture management (Azure Policies), security event information management (Microsoft Sentinel), Generative AI (Azure OpenAI), multi-tenant constructs and automation (Azure Organizations and Lighthouse).

Microsoft is the only source at this time because Amazon Web Services (AWS) lacks the following:

- A native SIEM/SOAR capability. AWS Security Hub is a cloud posture management offering and not a complete SIEM/SOAR

- A complete CNAPP that includes end point security and container scanning

- A GenAI service with Impact Level (IL) 5 DISA Provisional Authorization

- Amazon Verified Access for entitlement management is under Third Party Assessment Organization (3PAO) review and does not yet have FedRAMP or DISA IL5 authorization

- AWS has no equivalent to Azure Active Directory Access Packages to limit access to applications

Microsoft is the only source at this time because Oracle Cloud Infrastructure lacks the following:

- A native SIEM/SOAR capability that is as mature as Microsoft Defender for Cloud

- A GenAI service with an IL5 DISA Provisional Authorization

- Entitlement Management: OCI has no equivalent to Azure Active Directory Access Packages to limit access to applications

- A native endpoint security solution

Microsoft is the only source at this time because Google Public Services Cloud Platform lacks the following:

- A native SIEM/SOAR with an IL5 DISA Provisional Authorization

- A Load Balancer IL5 DISA Provisional Authorization

- A CNAPP Services

- A GenAI service with an IL5 DISA Provisional Authorization

- Entitlement Management: Google has no equivalent to Azure Active Directory Access

CUI

Packages to limit access to applications

- Policy as code baseline that enforces CIS Foundations Benchmark and is mapped to NIST 800-53 requirements

(5) Procurement discussion.

Based on Market Research conducted from November 11 to December 6, 2024, the only CSP that is currently capable of meeting the minimum needs of the Government is Microsoft. DoD Olympus requires capabilities in identity, CNAPP services, cloud posture management, security event information management, and multi-tenant constructs and automation. The other three CSP’s offerings such as AWS Security Hub are not adequate compared to Microsoft offerings Azure Sentinel, Azure Defender, or Azure Active Directory due to lack of comprehensive CNAPP capabilities including endpoint security, SIEM/SOAR, or identity.

(6) Impact.

Migration to another CSP from Microsoft is not feasible based on the amount of time needed to refactor Olympus, which would result in noncompliance with DISA’s cloud adoption initiatives. This migration would impact the DoD’s software modernization efforts and would have critical ramifications to the warfighter user-experience. If the exception to fair opportunity is not approved and a different provider were to be selected, Olympus would have to be refactored and delayed, impacting software modernization efforts across the department, and negatively impacting the warfighter user experience.

Having to integrate, third party tools to fill the gaps for CSP native offerings would not meet the Government’s minimum needs. Doing this is unfeasible because it would increase the workload to DISA HaC as the service provider and make it more difficult for customers to adopt the offering as a platform by having to deploy or obtain their own tooling to cover these gaps. This would increase risk of unsuccessful performance to an unacceptable level.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION:

A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the Independent Government Cost Estimate and the JWCC Catalog pricing, including any discounts, which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

6. MARKET RESEARCH:

Market research for the basic JWCC Contracts was conducted and resulted in a signed market research report on November 9, 2021, that was revalidated and recertified on July 29, 2024.

After a survey of the market, it was concluded that the JWCC Contract is in the Government’s best interest due to technical feasibility and cost to the Government.

CUI

Additional research was conducted November 11, 2024 - December 6, 2024, by reviewing the specific capabilities in the four JWCC Base Contracts and it was determined that Microsoft Corporation is the only source capable of fulfilling the Government’s minimum needs.

Additional Research to Support Exception to Fair Opportunity was requested from each CSP.

DISA HaC received two Market Research responses from the CSPs: AWS and Oracle. Google and Microsoft did not respond to the request for Market Research. The responses were reviewed, and the following was determined:

Analysis of the responses resulted in a determination that neither AWS nor Oracle is capable of meeting the Government’s minimum need. Specifically, both platforms lack mature and comprehensive solutions for CNAPP and SIEM capabilities. Additionally, their entitlement management features are limited to platform-specific resources and do not extend to applications. While both offer Artificial Intelligence/Machine Learning solutions, AWS lacks a DISA-approved generative AI tool, and Oracle's Apex AI does not meet the required IL5 standard. As such Microsoft is the only source capable of performing this requirement.

7. ANY OTHER SUPPORTING FACTS: None.

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History: Not Applicable

(b) Market research will be conducted on a regular basis to identify new services and offerings from the other cloud providers that could be leveraged in the future to fill capability gaps in security and identity.

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

DoD Olympus: Foundations

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

TITLE/AGENCY/ORGANIZATION:

PHONE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

TITLE/AGENCY/ORGANIZATION:

PHONE:

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

TITLE/AGENCY/ORGANIZATION:

PHONE:

PROCURING ACTIVITY COMPETITION ADVOCATE APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief.

Since this justification does not exceed $15M, this review serves as approval and my written determination that the aforementioned FAR circumstances apply.

NAME: Andrea Horstmann SIGNATURE:

TITLE/AGENCY/ORGANIZATION: PACA/DISA/DITCO

PHONE:

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO: