REDACTED JA24-152 AMD 01 JA_SPAN Cloud Services FINAL_.pdf

Controlled By: DISA Controlled By: PS8511 CUI Category: PROCURE Distribution/Dissemination Control: FEDCON POC: disa.scott.ditco.mbx.ditco-jwcc@mail.mil

JUSTIFICATION & APPROVAL FOR FEDERAL ACQUISITION REGULATION

SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Contract

Orders under Fair Opportunity Federal Acquisition Regulation (FAR) 16.505, Defense FAR Supplement 216.505-70, Procedures, Guidance, and Information 216.505-70

Military Interdepartmental Purchase Request Number:

Joint Warfighting Cloud Capability (JWCC) Contract Number: HC105023D0003 Task Order (TO) Number: To Be Determined Procurement Title: Security Policy Automation Network (SPAN) Cloud Services Estimated Value:

Statutory and Regulatory Authority: 10 United States Code (U.S.C.) 2304c(b) and FAR 16.505(b)(2)(i)(B)

EXCEPTION TO FAIR OPPORTUNITY

Number: JA24-152 AMD 01

Upon the basis of the following justification, I, as the Procuring Activity Competition Advocate (PACA), hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C. 2304c(b) and Regulatory Authority of FAR 16.505(b)(2)(i)(B).

1. REQUESTING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

Office of the Secretary of Defense / Defense Technology Security Administration

(DTSA)

4800 Mark Center Drive Alexandria, VA 22350 United States of America

Contracting Activity:

Defense Information Systems Agency / Defense Information Technology Contracting Organization/PS8511

2300 East Drive Scott Air Force Base, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

AMD 01: This amendment is to increase the value by . This is due to multiple omissions on the Independent Government Cost Estimate (IGCE) that DTSA did not adequately estimate: the amount of network infrastructure components required to support the cloud services and resources which account for an increase of ; all

JA24-152 AMD 01 SPAN Cloud Services

Page 3 of 7 Pages integration was furthered with the adoption of Microsoft cloud-based services and toolsets since onboarding DTSA’s applications onto the Microsoft IL5 environment in 2022 under OUSDP Enterprise Information Service (EIS) hosting TO. Since onboarding, application development efforts have focused on maximizing the use of cloud-based capabilities which included Artificial Intelligence and Machine Learning (AI/ML);

Analytics; Compute; Databases; Developer tools; DevOps; Identity management;

Management and governance; Virtual desktop infrastructure. The culmination of this integration has provided the foundation for all development efforts for both unclassified and classified systems which includes the modernization of all NSS systems.

DTSA’s classified systems are currently hosted on-premises utilizing Microsoft technologies which includes Compute; Databases; Developer tools; DevOps; Identity management; Management and governance; Virtual desktop infrastructure. As such, a IL6 environment is being sought to host these systems as well as modernized systems that have been developed within the IL5 environment integrating Microsoft cloud-based services and toolsets.

While technically feasible to transition to another cloud service provider (CSP), there is an unacceptable risk associated with such a move. 1) DTSA will be required to halt all development efforts to allow for migration and testing of the new environment, 2) DTSA will be required to refactor current deployments which has a high risk of introducing system instability, and 3) DTSA will have to refactor planned deployments. Together, this will require DTSA to suspend all application modernization efforts until such time other capabilities and services could be evaluated and integrated. With an anticipated delay of roughly 36-months for full operation capability, DTSA would be unable to fulfill deliverables to mission partners and meet DoD requirements such as, the implementation of zero trust by 2027. As such, Microsoft is the only source capable of fulfilling these requirements without significant cost or delay to the Government.

(c) Justification.

(1) Minimum Government requirements.

The cloud service offerings (CSOs) must continue at their current level in order to support the transition of current on-prem classified systems and services to a cloud-based IL6 environment that mirrors capabilities of the OUSDP DTSA’s current IL5 environment. OUSDP DTSA requires a lift and shift, without any impact in capability uptime and with zero impact of the operating environment, applications, security and risk management framework (RMF).

The transition of current CSOs for IL5 must continue at their current level of support of mission application environments and development pipelines. OUSDP DTSA requires a lift and shift, without any impact in capability uptime and with zero impact of the operating environment, applications, security and RMF.

In addition, the CSOs include services and Application Programming Interface (APIs) for

Page 4 of 7 Pages

AI/ML; Analytics; Compute; Databases; Developer tools; DevOps; Identity management;

Management and governance; Virtual desktop infrastructure.

(2) Proposed sole source contractor. Microsoft.

(3) Discussion regarding the cause of the sole source situation.

The only source capable of performing the IL5 and IL6 lift and shift at the level of quality and specialization required is the incumbent contractor, Microsoft. The refactoring of the current environment, applications, and development pipelines from a Microsoft ecosystem to another CSP would result in additional cost and time to deliver mission enabling capabilities. Migration from one platform to another platform would result in a significant loss of investment and a suspension of all planned modernization efforts targeting DoD Chief Information Officer initiatives. In addition, there would be a need to duplicate efforts and associate costs to sustain and develop against two platforms simultaneously.

a) OUSDP DTSA leverages a Microsoft Resource Manager code feature, which would have to be completely re-written, not reused if re-hosted in another platform, requiring at least 18 months to complete across 3-4 engineers.

b) OUSDP DTSA stores all code and agile system management data within the Microsoft-exclusive Azure DevOps Software as a Service, which requires a Microsoft enrollment. Transitioning out of the Azure DevOps environment would halt OUSDP DTSA software development for 3-6 months to affect a migration and will require reengineering efforts across its entire application portfolio, delaying the system 36 months or more.

c) OUSDP DTSA applications are inseparably integrated into Microsoft specific services such as Microsoft Identity management, AI and Cognitive Services such that migrating to a different CSP would require 12-24 month to reengineer if not eliminate the capability altogether if parallel capacities are not found.

d) OUSDP DTSA applications are built on Microsoft technologies such as SPFx, SharePoint REST API, Fluent UI React, ASP.NET and the aforementioned Azure DevOps Continuous Integration/Continuous Delivery pipeline, all of which provide faster capability and reduced engineering effort when paired with Microsoft. The entire OUSDP DTSA policy platform would need to be reengineered at unacceptable and unattainable burden to the government, driving the Government’s current need for compatibility.

e) OUSDP DTSA’s application portfolio includes multiple unclassified and classified NSS applications which require an elevated security posture, availability, and agility to meet mission requirements for multiple DoD entities and Embassies. Due to the critical nature of these system in the protection of government information and sensitive

Page 5 of 7 Pages technologies, DTSA considers the migration to another CSP as a significant risk to its ability to deliver capabilities in a timely manner and provide a stable system.

(4) Demonstration of unique source.

Microsoft’s Cloud componentry integrates seamlessly into the OUSDP DTSA existing environment and development pipelines, can be easily upgraded as needs evolve and can be expanded into other product capabilities and components while maintaining the same framework, without the need for separate add-ons or additional integration service efforts. Microsoft is the only CSP that has this unique ability that the other CSPs do not have at this time. Microsoft has the necessary RMF development, continuous RMF operations, applications, as well as Infrastructure as a Service (IaaS) and application pipelining.

Other CSPs are not able to implement and transition seamlessly in order to meet the Governments requirements. Microsoft possesses the knowledge, skills, capabilities, certification, clearance, and experience required to continue the program without a break or degradation in critical mission services. Given these critical mission requirements and preexisting investments, Microsoft is the only contractor that is capable of performing the necessary services for the DoD without increasing the risk of mission failure.

(5) Procurement discussion.

OUSDP DTSA's current IL5 Microsoft environment has allowed OUSDP DTSA to have an operational Microsoft cloud-based system since 2022. Since OUSDP DTSA has an existing environment and a mature development pipeline, Microsoft is immediately able to shift the supporting resultant award associated with this contract action, minimizing any transition, and forgoing interruption to the Government. In addition, any another CSP would not be positioned to leverage OUSDP DTSAs investments made to date to meet the objectives of the task order most efficiently for the anticipated PoP.

(6) Impact.

Microsoft capabilities and services have been integrated into its applications and infrastructure since inception. This integration was furthered with the adoption of capability sets provided with the IL5 implementation under OUSDP EIS’s hosting contract. A transition to another CSP would require DTSA to shift resources away from the modernization of its application portfolio and dedicate them to refactoring existing functions and capabilities to operate with a new environment. This would require the establishment of new development pipelines. To accomplish this, DTSA would be required to suspend all application modernization efforts until which time other capabilities and services could be evaluated and integrated. With an anticipated delay of about 36-months till full operational capability, DTSA would be unable to fulfill deliverables to mission partners and meet DoD requirements such as the implementation of zero trust by 2027.

Page 6 of 7 Pages

5. COST/PRICE FAIR AND REASONABLE DETERMINATION:

A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the independent government cost estimate and the JWCC Catalog pricing, including any discounts, which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

6. MARKET RESEARCH:

Market research for the basic JWCC Contracts was conducted and resulted in a signed market research report on November 9, 2021, with a recertified market research report signed on 29 Jul

24. After a survey of the market, it was concluded that the JWCC Contract is in the Government’s best interest due to technical feasibility and cost to the Government.

Additional research was conducted May 06, 2024 - Jul 09, 2024, by reviewing the specific capabilities in the JWCC Contracts and it was determined that Microsoft Corporation is the only source capable of fulfilling the Government’s minimum needs in the manner and time frame required. Beginning in May 2024, DTSA technical staff utilized vendor published capability lists and technical documentation to assess the level of effort and viability of refactoring current applications to support dissimilar platforms. In addition to this effort, DTSA conducted additional market research from JWCC CSPs in July 2024.Additional research was issued to all four CSPs but only two CSPs responded. Microsoft was the only respondent with transition strategy that provided for a seamless transition and integration.

7. ANY OTHER SUPPORTING FACTS: None.

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History:

Incumbent Contractor: Minburn Technology Group LLC.

Contract Number: N6600119A0006 TO Number: HQ003423F0429 PoP: August 1, 2023 - August 1, 2025 Competitive Status: Full and open competition Business Size: Service-Disabled Veteran-Owned Small Business

(b) To overcome future barriers to competition, future development and enhancement of IaaS components will include shifting to a containerized platform. This will enable multiple CSPs to meet the requirements which will enable the flexibility to shift workload based on financial and mission requirements.