Redacted JA.pdf

Controlled By: DISA Controlled By: PS85 CUI Category: PROCURE Distribution/Dissemination Control: FEDCON POC: disa.scott.ditco.mbx.ditco-jwcc@mail.mil

Page 1 of 5 pages

JUSTIFICATION & APPROVAL FOR FEDERAL ACQUISITION REGULATION

SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Contract

Orders under Fair Opportunity Federal Acquisition Regulation (FAR) 16.505, Defense FAR Supplement 216.505-70, Procedures, Guidance, and Information 216.505-70

Joint Warfighting Cloud Capability (JWCC) Contract Number: HC105023D0005 Task Order (TO) Number: To Be Determined Procurement Title: Secure Cloud Computing Architecture (SCCA) Virtual Datacenter Security Stack (VDSS) environment

Statutory and Regulatory Authority: 10 United States Code (U.S.C.) 2304c(b) and FAR 16.505(b)(2)(i)(B)

EXCEPTION TO FAIR OPPORTUNITY

Number: JA24-054

Upon the basis of the following justification, I, as the Procuring Activity Competition Advocate (PACA), hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C. 2304c(b) and Regulatory Authority of FAR 16.505(b)(2)(i)(B).

1. REQUESTING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

Defense Information Systems Agency (DISA)/Hosting and Compute (HaC) 6910 Cooper Ave Fort Meade, MD 20755

Contracting Activity:

DISA/Defense Information Technology Contracting Organization/PS85

2300 East Drive Scott Air Force Base, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

This action is to issue a firm-fixed-price TO against the JWCC Indefinite Delivery/Indefinite Quantity Contract for SCCA VDSS. This TO will be issued directly to Amazon Web Services (AWS). The anticipated period of performance (PoP) is for a 1-year base period, plus three 1-year option periods. of FY24 Defense Working Capital Funds for the base period.

JA24-054 SCCA VDSS JA

Controlled By: PS85 CUI Category: PROCURE Distribution/Dissemination Control: FEDCON

Page 2 of 5 pages

3. DESCRIPTION OF SUPPLIES/SERVICES:

a. The Government procures software-defined instances from a commercial Cloud

Service provider (CSP) in order to host components of DISA’s SCCA inside the CSP infrastructure. DISA’s SCCA includes an enterprise suite of security services designed to secure Department of Defense (DoD) applications and data hosted in off-premises commercial cloud environments and protects DoD networks from malicious activity originating from workloads hosted in those environments. DISA does not determine where DoD mission partners select to host their cloud-based DoD workloads but is charged with protecting those workloads within the specified CSPs. DISA SCCA VDSS must place boundary defense sensors in CSPs that host actual DoD workloads and follow demand signals for where DoD workloads will be hosted in order to place sensors in those CSPs infrastructure. Those CSPs with existing and forecast workloads are the first to be integrated with the SCCA and have boundary defenses established for those DoD workloads. SCCA must continue to host security devices that are integrated within the CSP’s commercially available infrastructure. Hosting these security devices is necessary to provide boundary defense to the Department of Defense (DoD) Information Network (DISN) and protect mission owner-hosted DoD workloads.

b. DoD workloads hosted in individual CSPs are protected by placing SCCA sensors in those CSPs to monitor DoD workloads hosted therein. These sensors inspect traffic to and from those DoD workloads and route inspected traffic to the Defense Information System Network (DISN). The SCCA sensors placed in a CSP can be hosted on only that particular CSP’s commercially available infrastructure. One CSP cannot host and integrate the SCCA sensors required to secure DoD workloads hosted in another CSP’s environment. This requirement is to protect the DISN from DoD workloads hosted in AWS by continuing to host SCCA sensors in the AWS infrastructure. AWS is the only product that can be integrated in the existing AWS infrastructure to host the SCCA sensors required to protect the DISN, and DoD workloads hosted in the AWS region.

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity.

FAR 16.505(b)(2)(i)(B) - Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(b) Description of the Justification.

The SCCA VDSS is designed to protect DoD workloads hosted in CSPs by placing security devices in those CSPs. The SCCA security devices placed in a CSP must be hosted on that CSP’s commercially available infrastructure in order to protect DoD

Controlled By: PS85 CUI Category: PROCURE Distribution/Dissemination Control: FEDCON

Page 3 of 5 pages workloads in that environment. A CSP cannot host and integrate the SCCA security devices required to secure DoD workloads that are hosted in another CSP’s environment.

The DoD workloads hosted in the current AWS infrastructure can only be protected by placing SCCA security devices in that same AWS infrastructure in which those workloads are hosted.

(c) Justification.

(1) Minimum Government requirements.

a. The Government procures software-defined instances from a commercial Cloud Service provider (CSP) in order to host components of DISA’s SCCA inside the CSP infrastructure.

b. DoD workloads hosted in individual CSPs are protected by placing SCCA sensors in those CSPs to monitor DoD workloads hosted therein. These sensors inspect traffic to and from those DoD workloads and route inspected traffic to the Defense Information System Network (DISN).

(2) Proposed sole source contractor. AWS

(3) Discussion regarding the cause of the sole source situation.

The Government cannot secure DoD applications and data in the AWS environments or protect DoD networks from malicious activity originating from workloads hosted in the AWS environment without hosting security devices in that environment.

(4) Demonstration of unique source.

AWS is the only CSP that can offer the infrastructure required to host SCCA VDSS security devices within the AWS infrastructure. In addition, AWS possesses the knowledge, skills, capabilities, certification, clearance, and experience required to continue the program without a break or degradation in critical mission services. The SCCA is designated a mission critical system by DISA to protect the DISN.

(5) Procurement discussion.

a. AWS is the only CSP that meets all the Government’s requirements and can be seamlessly integrated with the SCCA suite of security devices to protect DoD workloads hosted in the AWS infrastructure. Market research indicates other companies’ similar products do not meet, or cannot be modified to meet, the Agency’s needs. Other products cannot be extended into the AWS environment and, thus, do not meet the Government’s minimum requirements.

Controlled By: PS85 CUI Category: PROCURE Distribution/Dissemination Control: FEDCON

Page 4 of 5 pages

b. Since there is already an existing environment, the CSP the Government is immediately able to shift to supporting the resultant award associated with this contract action. In addition, another CSP would not be positioned to leverage investments made to date to most efficiently meet the objectives of the TO for the anticipated PoP.

(6) Impact.

This acquisition allows the Government to maintain its current SCCA portfolio in the CSP environment. DoD users will be able to continue to leverage their workloads in the CSP environment and connect their workloads to the DISN. The impact of not having AWS would make all of the DoD hosted applications in the AWS environment cease to operate.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION:

A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the independent government cost estimate and the JWCC Catalog pricing, including any discounts, which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

6. MARKET RESEARCH:

Market research for the basic JWCC Contracts was conducted and resulted in a signed market research report on November 9, 2021. After a survey of the market, it was concluded that the JWCC Contract is in the Government’s best interest due to technical feasibility and cost to the Government.

Additional research was conducted in November 2023 by reviewing the specific capabilities in the JWCC Contracts and it was determined that AWS is the only source capable of fulfilling the Government’s minimum needs in the manner and time frame required. Supplementary research was conducted October 2023 by DISA HaC through reviewing the specific capabilities in the JWCC Contracts and it was determined that AWS is the only source capable of fulfilling the Government’s minimum needs in the manner and time frame required. No competitor functional replacement products exist in the market at this time to meet the Government's need.

Further inquiry was conducted by reviewing the JWCC contractor's catalogs to determine if other similar offerings such as AWS can meet or could be modified to satisfy the Government’s requirements. The results have determined that no other offering is suitable.

7. ANY OTHER SUPPORTING FACTS: None.

Controlled By: PS85 CUI Category: PROCURE Distribution/Dissemination Control: FEDCON

Page 5 of 5 pages

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History:

Contract Number: NNG15SC90B TO Number: HC108422F0119 PoP: April 05, 2022 - April 04, 2025 Competitive Status: Other than full and open competition Business Size: Small business

(b) To overcome future barriers to competition, future development and enhancement of IaaS components will include shifting to a containerized platform. This will enable multiple CSPs to meet the requirements which will enable the flexibility to shift workload based on financial and mission requirements. The Government will continue to conduct market research to determine if there are changes in the marketplace that would enable future competitive actions.