REDACTED_Exception to Fair Opportunity Justification.pdf

CUI/Procurement Sensitive

JUSTIFICATON & APPROVAL FOR FEDERAL ACQUISITION REGULATION SUBPART 16.5

ACQUISITIONS EXCEPTION TO FAIR OPPORTUNITY

Multiple award Contract Orders under Fair Opportunity

Federal Acquisition Regulation (FAR) 16.505, Defense FAR Supplement 216.505-70, Procedures, Guidance, and Information 216.505-70

Purchase Request Number: To Be Determined Joint Warfighting Cloud Capability (JWCC) Contract Number: HC105023D0005 Proposed Vendor: Amazon Web Services, Inc. (AWS) Task Order Number: To Be Determined Procurement Title: Defense Counterintelligence Security Agency (DCSA) Program Executive Office (PEO) Cloud

EXCEPTION TO FAIR OPPORTUNITY

Upon the basis of the following justification, I, as the Senior Procurement Executive (SPE), hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C. 2304c(b) and Regulatory Authority of FAR 16.505(b)(2)(i)(G) utilizing FAR 6.302-1(a)(2)

FAR 6.302-1 says "When the supplies or services required by the agency are available from only one responsible source, or, for DoD, NASA, and the Coast Guard, from only one or a limited number of responsible sources, and no other type of supplies or services will satisfy agency requirements, full and open competition need not be provided for."

1. IDENTIFICATION OF THE AGENCY AND CONTRACTING ACTIVITY:

Agency:

Defense Counterintelligence and Security Agency (DCSA) Program Executive Office (PEO) 27130 Telegraph Road Quantico, VA 22314

Contracting Activity:

Contracting and Procurement Office Defense Counterintelligence and Security Agency 27130 Telegraph Road Quantico, VA 22134

2. NATURE/DESCRIPTION OF ACTION(S):

DCSA Program Executive Office (PEO) requires a task order to be awarded on a sole source basis to AWS via the Joint Warfighting Cloud Capability (JWCC), enterprise-wide acquisition vehicle that provides DoD with a direct means to acquire commercial cloud services.

In accordance with FAR 16.505(b)(2)(i)(G) and FAR 6.302-1(a)(2) DCSA deems AWS to be the only responsible source that will satisfy agency requirements.

3. DESCRIPTION OF SUPPLIES/SERVICES:

The purpose of this requirement is to enable the Defense Counterintelligence and Security Agency (DCSA) Program Executive Office (PEO), to include the National Background Investigation Service (NBIS), National Industrial Security Systems (NISS), and DITMAC System of Systems (DSoS) program management offices, to acquire commercial capabilities and services for Amazon Web Services (AWS) Cloud instances in support of its Unclassified, Secret and top-secret systems. This capability is referred to as the "PEO Cloud."

Unclassified AWS IaaS is currently procured through a third-party vendor belonging to the AWS Solution Provide Program (SPP). Classified AWS IaaS is obtained through an Interagency Agreement (IAA) with the National Geospatial-Intelligence Agency (NGA) to obtain access to Intelligence Community (IC) Cloud Services. The PEO Cloud, its tenant mission systems/applications, and NBIS High Side consume AWS services in two types of billing configurations – monthly on-demand, and reserved instances paid up-front.

The "Department of Defense Joint Warfighting Cloud Capability and Next Steps to Rationalize Cloud Use Across the Department of Defense" memorandum dated 02 AUGUST 2023 states "Office of the Secretary of Defense (OSD) Components.will use the JWCC contract vehicle for all available offerings to procure future enterprise cloud computing capabilities and services. All cloud capabilities and services currently under contract in OSD Components.will transition to the JWCC vehicle upon expiration of their current period of performance." The current period of performance for the contract through which unclassified AWS services are procured ends on May 14, 2024. This provided DCSA only nine (9) months to contract for, and transition to, the JWCC vehicle.

To ensure continued support for the current environment, reduce costs, and adhere to the requirements of the memorandum, DCSA needs to obtain its cloud services (IL2, IL4, IL5, IL6 and Top Secret XaaS) through the JWCC contract vehicle.

This requirement will result in a task order against the DISA contract vehicle, JWCC, which will provide the DCSA PEO with consolidated cloud services on both unclassified and classified domains. DCSA requires AWS GovCloud resources "as a service", XaaS, billed on a consumption basis. This is a non-personal services requirement.

The period of performance under this requirement will be a twelve (12) month base period and three (3) twelve (12) month option periods, for a total of forty-eight (48) months if all options are exercised. This requirement also includes Federal Acquisition Regulation (FAR) 52.217-8, Option to Extend Services, six-month extension period. The estimated cost of this requirement for the base, three (3) option years plus the six-month extension is

The Government requires surge capabilities during the base or any option period (OP), and surge requirements will be within the scope of the task order for the defined task areas of the Description of Work (DoW) document. Surge capabilities over the life of the TO will not exceed 50% of the contractor's total proposed price for the base and all option periods, excluding any six-month extension of services pursuant to Federal Acquisition Regulation (FAR) 52.217-8.

The current task order for the unclassified cloud services expires on May 14, 2024. Due to the involvement of the current unclassified account holder to transition accounts, the task order must be awarded no later than May 5, 2024, to provide a suitable window to schedule the account transition meeting prior to current task order expiration.

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE PROPOSED

CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE ACQUISITION

REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity.

FAR 16.505(b)(2)(i)(G) utilizing FAR 6.302-1(a)(2)

FAR 16.S0S(b)(2)(i)(G):

For DoD, NASA, and the Coast Guard, the order satisfies one of the exceptions permitting the use of other than full and open competition listed in 6.302 (10 U.S.C. 3406(c)(5)). The public interest exception shall not be used unless Congress is notified in accordance with 10 U.S.C.

3204(a)(7)

FAR 6.302-1(a)(2):

(iii) When the supplies or services required by the agency are available from only one responsible source, or, for DoD, NASA, and the Coast Guard, from only one or a limited number of responsible sources, and no other type of supplies or services will satisfy agency requirements, full and open competition need not be provided for.

(b) Description of the Justification.

In accordance with FAR 16.505(b)(2)(i)(G) utilizing FAR 6.302-1(a)(2), DCSA deems AWS to be the only responsible source that will satisfy agency requirements.

(c) Justification.

(1) Minimum Government Requirements.

The minimum requirement is to continue receiving the Impact Level (IL) 2, 4, 5 and Top Secret cloud services with no duplication of cost and no time lost for development of programs. As a cloud system, PEO Cloud is subject to the standards set forth by the DoD Cloud Computing Security Requirements Guide (CCSRG). To meet CCSRG requirements, the PEO Cloud leverages DISA Secure Cloud Computing Architecture (SCCA) services, specifically DISA Virtual Datacenter Security Service (VDSS), Vulnerability Management Service – Cloud Extension (VMS-CE), and Cloud Access Points (CAPs). The PEO Cloud currently supports Impact Level (IL) 2, IL4, and IL5 requirements. Top Secret cloud services are obtained from AWS via an interagency agreement with an Intelligence Community Partner. DCSA requires that Secret cloud services be within the same vendor as existing unclassified and Top-Secret services to maintain alignment in order to support cross domain functionality.

(2) Proposed sole source contractor. AWS

(3) Discussion regarding the cause of the sole source selection.

DCSA deems AWS, the agency's current cloud service provider, as the only responsible source to provide these services to DCSA based upon the potential challenges and adverse consequences the Government would endure migrating to a different Cloud Service Provider at this time and the significant duplication of work, time, and resources required for such a transition.

The PEO Cloud and NBIS form a complex porfolio that is built upon AWS IaaS, leverages approximately 50 native AWS service offerings, supports up to IL5 workloads, is dependent upon DISA SCCA services, and is integrated with on-premises systems and external data sources.

The government recognizes the significant impact that transitioning to a different CSP would have on its operations, including but not limited to:

• Disruption to business continuity and operations during the migration process.

• Potential loss or corruption of data during the migration process.

• Downtime and service interruptions because of reconfiguration and adaptation to the new CSP environment.

• Increased costs associated with the migration process, including but not limited to labor, running of duplicate services, and data migration cost.

• Loss of development time for programs within the environment.

(4) Demonstration of unique source.

Selecting another CSP would result in significant duplication of costs.

ARCHITECTURE, DEVELOPMENT AND SUPPORT COSTS

The utilization of an alternative CSP would require DCSA PEO to revise the existing architecture and operational environments at significant costs. DCSA PEO has made a significant investment in the infrastructure of the current CSP. This strategic approach is based on mission objectives to deliver automated operations while reducing cost to implement critical systems and capabilities. To transition or expand CSPs would require a significant investment to rebuild or transition this same level of automated Infrastructure as Code (IaC) and developer experience capabilities to another CSP environment. DCSA estimates that it would take 18 months to transition to another CSP at a total cost of approximately

DCSA estimates that the total architecture, development, and training labor costs during the 18-month transition to migrate PEO Cloud to another CSP is as detailed in the market research report (MRR) and Cloud Labor Migration IGCE. DCSA would also be required to maintain the existing infrastructure for an 18-month period, for a cost of

(if the current contracting arrangement is maintained).

The PEO Cloud, its tenant systems, and NBIS High Side combine to leverage approximately fifty (50) native AWS service offerings at the appropriate impact level for the respective workload. The native AWS services are customized, configured and integrated throughout the cloud and system level infrastructure, and although alternative CSPs may have similar products there would be an extensive effort necessary to systematically re-work the configurations and customizations in the alternative CSP products. Utilizing an alternate CSP would require rearchitecting and re-engineering of the cloud enclave and each of those tenant systems that utilize AWS native offerings to translate these configurations and functionality to the alternate CSP.

To properly rearchitect the environments and systems to be hosted by an alternate CSP, given the size and complexity of the environment, DCSA estimates this effort to take approximately eighteen (18). During that time there will be significant duplication of cost. This timeline includes at a minimum the following anticipated key activities:

1. Identify and resolve gaps in civilian knowledge and contract support, to ensure appropriate level of expertise in the alternate CSP technology.

2. Alternative analysis of replacement products/services for the approximately 50 native AWS service offerings utilized by the PEO Cloud and its tenant systems.

3. Design and build a cloud enclave utilizing the alternate CSP, meeting all existing requirements built into the current environment, including integrations with DISA SCCA services and Cloud Cyber Security Services Provider (CSSP).

4. Obtain an Authorization to Operate (ATO) on the cloud hosting plaform.

5. Re-architect, re-build, or migrate (depending upon utilization of native AWS services) every tenant system in the new cloud environment.

6. Obtain an ATO on every tenant system in the new cloud environment.

7. Complete decommission of the original cloud environment.

For the bulk of this estimated period, Steps 3 to 7 represents a period of time during which DCSA will be required to manage, maintain, and support two complete environments in parallel duplicating cost while maintaining these duplicate systems. The duration estimate requires the assumption that DCSA would be able to fully staff, both in terms of civilian and contractor support, an expanded and dedicated team appropriate in size and skill set to architect, develop, manage, migrate, and maintain the cloud and systems on the alternate CSP throughout the transition period.

The Government does not expect to recoup duplicated costs through competition. A transition to a new CSP would require DCSA PEO to incur resource costs above those already expended in the analysis, planning, re-architecting, development, configuration, hardening, testing, authorization, operationalization and sustainment of the existing PEO Cloud, its tenant systems inclusive of NBIS, and NBIS High Side. During the majority of this transition period DCSA will need to operate the as-is and to-be environments in parallel, as well as maintain sufficient staffing levels proficient in both CSP technologies, until such time migration is complete, and the as-is environment is decommissioned.

Due to the mission critical nature of the PEO Cloud and NBIS, existing contract labor resources cannot be utilized as that would introduce unacceptable risk of mission failure.

The PEO and NBIS workforce (both contractor and civilian) are trained on and maintain an AWS knowledge base to support the current operational environment. Transitioning the environment to an alternative CSP would require a new government and contractor team versed in the alternate technology stack, to conduct the analysis, re-engineering, build and migration to a new CSP without impacting current requirements. The estimated increase in contractor labor to support the migration to an alternate CSP, calculated as detailed in the MRR, is over 18 months.

Conversely, an account realignment from the current AWS account holders to the JWCC master payer, is completed in a single day per top level account. At no time can a given account draw duplicate charges from both the current account holder and the JWCC. No duplication of contract labor and civilian support resources are necessary to support this transfer.

Based on the information available through market research, the government does not anticipate recouping the estimated transition cost through competition.

S. COST/PRICE FAIR AND REASONABLE DETERMINATION:

A determination that the price is fair and reasonable will be based on a comparison of the contractor's proposal to the independent government cost estimate and the JWCC Catalog pricing, including any discounts, which was previously found to be fair and reasonable and based on the contractor's commercial pricing. The basis for this determination will also include a comparison of the proposed price with prices already paid on current and historical procurements for this same service.

6. MARKET RESEARCH:

Market research was conducted to analyze the available sources which can meet DCSA PEO cloud requirements. Various research efforts and techniques were utilized to identify technical solutions and potential sources. The primary research source was the official Defense Information Systems Agency (DISA) J9 Hosting and Compute (HaC) JWCC portal. From here, appropriate knowledge articles, guides, and FAQs were reviewed. The JWCC individually linked CSP information portals were reviewed. To confirm accuracy of posted information, some questions were posed directly to the JWCC Program Management Office (PMO).

This research, as detailed in the MRR, resulted in only AWS and Microsoft being the only viable CSPs on JWCC potentially able to support the PEO Cloud and NBIS High Side. For the reasons detailed in this document, DCSA has determined that AWS is the only responsible source that can meet the Government's requirement.

7. ANY OTHER SUPPORTING FACTS:

DCSA funds this requirement, in part, out of working capital fund operating authority derived from the sale of personnel vetting products and services to DoD Components and other Federal Agencies. DCSA sets the rates charged for services provided under the working capital fund annually in August during the Budget Estimate Submission.

Critically, the National Background Investigative Service transferred to the DCSA Working Capital Fund beginning in FY24. DCSA did not build the cost of transitioning NBIS to another Cloud service provider into its FY24 and FY25 rates, published in its annual Federal Investigations Notice (FIN). Therefore, transitioning at this time would result in the inability of the DCSA working capital fund to fully recover its costs as required by 10 U.S.C. 2208. DCSA is in the process of establishing the FIN rates and budgetary resources for FY26 and beyond to include appropriate adjustments for NBIS capital costs, which can support a future transition to another CSP.

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS THAT LED

TO THE EXCEPTION TO FAIR OPPORTUNITY:

The Government acknowledges and understands that migrating to a different CSP would result in substantial duplication of cost. DCSA would have to contract a transition team to move the current environment. However, awarding DCSA's first task order under to AWS does not preclude future task orders from being awarded to other JWCC CSPs. DCSA will continually evaluate the Cloud Service Provider market as future needs arise to determine if the competition of future requirements will result in cost savings to the Government. Additionally, the Government intends to continue to conduct market research and assessments for CSP's emerging technologies possessing authorized ILs and security capabilities. This may result in awarding task orders to additional CSPs when demand and capabilities justify expansion or transition of workloads between CSPs. DCSA will look for ways to make the cloud environments more cloud agnostic in the future while working towards multi-cloud capability with new Task Orders in the future.

• Procurement History:

Unclassified AWS IaaS for PEO Programs including NBIS, NISS, RPA, ESD, SETS, and DSOS are obtained from the following contract:

Contract Number: HS00212190001 PoP: May 15, 2021 - May 14, 2024 Other Transaction Authority Contractor: Peraton Inc.

Business Size: Large business

Classified AWS IaaS for Program NBIS is obtained through an Interagency Agreement (IAA) with the National Geospatial-Intelligence Agency (NGA) to obtain access to Intelligence Community