JA25-110_AMD01_852572865_FINAL_Redacted.pdf

CUI

Controlled by: USMC Controlled By: MARINE CORPS SYSTEMS COMMAND/PEO DIGITAL CUI Category: PROCURE Distribution/Dissemination Control: FEDCON

POC: MIKE WRIGHT, +1 703-328-0134, MICHAEL.WRIGHT.CIV@USMC.MIL

JUSTIFICATION & APPROVAL FOR FEDERAL ACQUISITION

REGULATION SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Contract Orders under Fair Opportunity

Federal Acquisition Regulation (FAR) 16.505(b), Defense FAR Supplement 216.505(b), Procedures, Guidance, and Information 216.505(b)

Military Interdepartmental Purchase Request Number: M954505785200 Joint Warfighting Cloud Capability (JWCC) Contract Number: HC105023D0003 Task Order (TO) Number: HC105025F0051 Procurement Title: Secure Computing Architecture Impact Level (IL)6 Cloud Estimated Value: (AMD01) = Statutory and Regulatory Authority: 10 United States Code (U.S.C.) 3204(a) and FAR 16.505(b)(2)(i)(B)

EXCEPTION TO FAIR OPPORTUNITY

Number: JA25-110

Upon the basis of the following justification, I, as the Procuring Activity Competition Advocate (PACA), hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C. 3204(a) and Regulatory Authority of FAR 16.505(b)(2)(i)(B).

1. REQUESTING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

U.S. Marine Corps (USMC)/Program Executive Office (PEO) Digital/Program Management (PM) Cloud & Cybersecurity (C&CS) 2200 Lester Street Quantico, VA 22134

Contracting Activity:

Defense Information Systems Agency (DISA)/Defense Information Technology Contracting Organization (DITCO)/Cloud Capabilities Section (PS8511)

2300 East Drive Scott Air Force Base, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

AMD01: This amendment is to increase the estimated value by to support the required additional pricing for 2000GB of logs to be ingested during option years one and two that was erroneously not accounted the internal government cost estimate (IGCE).

The IGCE only provided for 200GB of log data ingestion for six months in the base period

MCCOG SACA IL6 Consumption

Page 3 of 8 Pages

CUI

Amazon Web Services (AWS) SCCA, no IL6 Google Public Sector (GPS) SCCA, no IL6 Oracle SCCA). Although all four major CSPs — AWS, GPS, Oracle, and Microsoft are technically capable of supporting classified workloads for the DoD, the USMC requires a solution that has technical compatibility with SCCA’s existing architecture. MCCOG requires a CSP that excels in expeditionary operations and offers deployable edge devices for disconnected and contested environments, which Microsoft provides. Security compliance is a baseline expectation. Furthermore, legacy system integration is required, as some CSP platforms demand extensive refactoring, which can hinder rapid deployment. Interoperability with naval systems is an essential feature of the Government’s requirement. Microsoft is the only CSP capable of transitioning MCCOG’s existing workload seamlessly to JWCC with no impact to services.

(c) Justification.

(1) Minimum Government requirements.

The cloud service offerings must continue at their current level in order to support the Marine Corps Cloud Security Service provider functions mandated by the DoD. These offerings include Security Information and Event Management (SIEM) as well as a solution for Security Orchestration, Automation, and Response (SOAR). Furthermore, this requirement includes Defender for Servers in Microsoft Defender for Cloud to reduce security risk and exposure on MCEN machines. The SCCA must be operational by the CSSP MCCOG on the MCEN. Currently, MCCOG is only operating one IL6 SCCA which is built in a Microsoft environment. There is no other Marine Corps IL6 SCCAs available for use (i.e. no IL6 AWS SCCA, no IL6 GPS SCCA, no IL6 Oracle SCCA). A migration to any other CSP would not only require significant source code refactoring, but this would also introduce risks to security as existing applications rely on Microsoft-specific services and configurations. Therefore, only Microsoft can meet the Government’s current requirement which requires the ability to seamlessly integrate with the SCCA’s existing architecture.

(2) Proposed sole source contractor.

Microsoft Corporation

(3) Discussion regarding the cause of the sole source situation.

Microsoft’s unique capability to support the IL6 SCCA stems from its Azure Government Secret cloud, which is the only commercial platform with full DoD IL6 Provisional Authorization at the highest confidentiality and integrity levels. Unlike other CSPs, Microsoft offers native connectivity to classified networks like Secret Internet Protocol Router Network (SIPRNet) through ExpressRoute, enabling secure, high-bandwidth access without complex workarounds. Its Secure Azure Computing Architecture (SACA) fully implements all four mandated SCCA components— Boundary Cloud Access Point (BCAP), Virtual Datacenter Security Stack (VDSS), Virtual Datacenter Managed Services (VDMS), and Trusted Cloud Credential Manager (TCCM)—using modular, Page 4 of 8 Pages

CUI

automated deployment templates that integrate seamlessly with third-party tools. The other CSPs are all recently capable of performing the four components, however Microsoft’s operational maturity under IL6 provides the necessary solution without an interruption to service. This allows mission owners to rapidly deploy secure, scalable workloads across hybrid and on-prem environments. Other CSPs are often infeasible because they are not compatible with the SCCA’s existing architecture, offer limited-service scope, and cannot match Microsoft’s deep integration with DoD infrastructure or its flexible, mission-ready architecture.

A task order was issued utilizing the Department of Navy Enterprise Service Initiative (dated January 31, 2025). Funds are forecasted to be consumed by mid-August 2025 as the task order is not funded sufficiently for the required operations and Defender for Server consumption needed for the MCCOG environment.

(4) Demonstration of unique source.

Microsoft possesses the knowledge, skills, certification, clearance, experience, and bridging capabilities required to continue the existing requirement without a break or degradation in critical mission services. Given these critical mission requirements, Microsoft is the only CSP that can perform the necessary services for the DoD within the current required timeline. Delays in cloud deployment, Zero Trust implementation, or tactical edge enablement could directly impact mission execution, cybersecurity posture, and strategic deterrence. Microsoft’s maturity, automation, and cleared support teams make it uniquely positioned to meet these deadlines without compromising security or performance. Only Microsoft can provide the IL6 SCCA environment due to its unmatched combination of technical capabilities, compliance posture, and native integration with classified networks. Microsoft’s Azure Government Secret is the first and only commercial cloud platform to receive the highest possible DoD IL6 Provisional Authorization with high confidentiality, high integrity, and customer-determined availability categorization. It delivers over 60 IL6 authorized services across Infrastructure as a Service, Platform as a Service, and Software as a Service enabling mission owners to build complex, scalable, and secure classified workloads. Microsoft’s SACA fully implements all four required SCCA components (BCAP, VDSS, VDMS, and TCCM)—using modular, automated templates that integrate with native Azure services and third-party tools like Palo Alto and Citrix. Critically, Azure Government Secret offers native, resilient connectivity to SIPRNet and other classified networks via ExpressRoute and ExpressRoute Direct, eliminating the need for costly, time-consuming custom integrations. The other three CSPs lack this depth of authorization, service breadth, and network integration, making them unable to perform the mission requirements. Microsoft’s unique combination of compliance, automation, and mission-ready architecture makes them the only viable provider for IL6 SCCA.

(5) Procurement discussion.

Based on outreach to the four CSPs in June 2025, the only CSP that is currently capable of meeting the minimum needs of the Government is Microsoft. The Marine Corps

Page 5 of 8 Pages

CUI

requires continued legal access to consume Microsoft IL6 services to operate and defend Secret Marine Corps data. The MCEN-Secret is secured by a SCCA utilizing Microsoft Cloud Native Services. A migration to any other CSP would not only require significant source code refactoring, but this would also introduce risks to security as existing applications rely on Microsoft-specific services and configurations. Refactoring with any other CSP would increase this timeline, resulting in duplicative efforts that are cost-prohibitive to the Government. Oracle responded that they are unable to meet the IL6 alignment, and GPS was unresponsive during market research, which supported the determination that Microsoft is the only CSP capable of supporting USMC’s IL6 environment.

A task order was issued utilizing the Department of Navy Enterprise Service Initiative (dated January 31, 2025). Funds are forecasted to be consumed by mid-August 2025 as the task order is not funded sufficiently for the required operations and Defender for Server consumption needed for the MCCOG environment.

(6) Impact.

Transitioning to another CSP is not feasible based on an unacceptable risk of failure to mission-critical operations. The impact of not procuring these required capabilities through Microsoft would result in MCCOG being unable to conduct SIEM and SOAR functions, resulting in failure to mission-critical operations on the IL6 SCCA requirement. Only Microsoft can provide the IL6 SCCA environment because it is the sole CSP with full DoD IL6 Provisional Authorization and native integration with classified networks like SIPRNet. These capabilities are essential for real-time threat detection, incident response, and operational continuity across classified workloads.

Without Microsoft’s IL6-authorized services—such as Microsoft Sentinel, Defender for Cloud, and Log Analytics—MCCOG would lack the telemetry, automation, and analytics required to maintain cyber situational awareness and defend the MCEN. The result would be blind spots in threat visibility, delayed incident response, and increased vulnerability to adversarial actions, undermining the integrity of the integrated mission and data fabric, which greatly jeopardizes national security operations.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION:

A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the independent government cost estimate and the JWCC Catalog pricing, including any discounts, which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

6. MARKET RESEARCH:

Market research for the basic JWCC Contracts was conducted and resulted in a signed market research report on November 9, 2021, that was revalidated and recertified on July 29, 2024.

After a survey of the market, it was concluded that use of the JWCC Contract is in the Government’s best interest due to technical feasibility and cost to the Government.

Page 6 of 8 Pages

CUI

Additional research was conducted in June 2025, by reviewing the specific capabilities in the JWCC Contracts and CSP catalogs and it was determined that Microsoft is the only source capable of fulfilling the Government’s minimum needs in the manner and time frame required.

Market research included direct engagement with the PEO Digital/Marine Corps System Command and MCCOG Teams for expert insights. USMC PEO Digital PM C&CS also requested additional research to support fair opportunity from the four JWCC CSPs. The Government received responses from Microsoft and AWS. AWS responded with a new SCCA solution that would cause an interruption in the IL6 environment, which would not meet the program requirements need. If MCCOG accepted the AWS proposed SCCA solution that interrupts the IL6 environment, it would violate critical program requirements around operational continuity, classified data protection, and compliance. The IL6 environment supports mission-critical, SECRET-level workloads, and any downtime or architectural changes that jeopardize uninterrupted access would break continuity mandates and risk loss of Authority to Operate.

Modifying key SCCA components—like BCAP or VDSS—could destabilize pre-authorized systems, delay revalidation by DISA, and disrupt existing third-party integrations. Additionally, such interruptions would derail timeline commitments tied to Zero Trust implementation and Joint All-Domain Command and Control readiness. If the new solution fails to preserve edge deployment capabilities, cross-domain functionality, or credential management processes, it will directly conflict with the program's unique operational constraints and strategic goals. Oracle declined to participate as they could not meet the requirement. GPS did not provide a response.

Upon conclusion of the market research techniques highlighted, it was determined that Microsoft is the only CSP that can meet USMC’s requirement. Due to the mission-critical nature of the IL6 environment and its dependence on Microsoft's proprietary technologies, any deviation from a Microsoft-exclusive solution would introduce unacceptable risks to system integrity, security, and operational effectiveness.

7. ANY OTHER SUPPORTING FACTS: None.

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

a) Procurement History:

Incumbent Contractor: Dell Contract Number: N6600121A0083 TO Number: M6785425F4638 PoP: January 31, 2025 - January 30, 2026 Competitive Status: Other than full and open competition Business Size: Large business

b) To overcome future barriers to competition, PEO Digital and MCCOG will assess and analyze market research and trends to allow USMC the best position to protect the MCEN. This analysis will include examining other CSP features and offerings that could advance the Marine Corps’ ability to perform SIEM and SOAR operations. The analysis may also identify gaps that need to be addressed by senior leadership to remove future

Page 7 of 8 Pages

CUI

barriers to competition. The Marine Corps will continue its relationship with Microsoft, GPS, AWS, and Oracle to field the best capabilities to our Warfighters within cost, schedule, performance, and manpower limits.

To support N6600121A0083/M6785425F4638, a justification and approval (J&A) for an exception to fair opportunity was signed on March 9, 2021, by Assistant Secretary of the Navy Research, Development & Acquisition. The previous J&A was based on authority outlined in FAR 8.405-6(b), “Items peculiar to one manufacturer”. To overcome those barriers, PEO Digital conducted extensive market research and found that Microsoft products in the DoD infrastructure are so pervasive that implementing any alternative would negatively impact the mission of the DoD. However, an additional exception to fair opportunity is required because Microsoft software continues to be an integral part of the DoD Information Technology (IT) infrastructure whereby the DoD’s military, civilian, and contractor personnel who perform IT and business functions utilize these products, tools, and capabilities to execute their missions.

Page 8 of 8 Pages

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

TITLE/AGENCY: Program Analyst, USMC

PHONE: DATE:

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE:

TITLE/AGENCY: PM C&CS, USMC

PHONE: DATE:

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: SIGNATURE

TITLE/AGENCY/ORGANIZATION: JWCC Contracting Officer, DISA/DITCO/PS8511

PHONE: DATE:

PROCURING ACTIVITY COMPETITION ADVOCATE APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief.

Since this justification does not this review serves as approval and my written determination that the aforementioned FAR circumstances apply.

NAME: SIGNATURE:

TITLE: PACA

PHONE: DATE:

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO