SpyCloud Brand Name EFOJ Final Redacted 05012026.pdf

(Source Selection Information - See FAR 2.101 and 3.104-4) JUN 2023

Reviews: I have reviewed this justification and find it adequate to support other than full and open competition.

Program Manager:

(Source Selection Information - See FAR 2.101 and 3.104-4)

Department of the Army Justification for Exception to Fair Opportunity - Brand Name

Under Multiple Award Indefinite Delivery Contracts

1. Requiring Activity: Assistant Secretary of the Army (Acquisition, Logistics and Technology), Assistant Deputy for Acquisition and Systems Management (Data, Engineering and Software), 2530 Crystal Drive (Crystal City) Arlington, VA 22202.

2. Contracting Activity: Army Contracting Command-Aberdeen Proving Grounds, ATTN: Digital Capabilities Center of Excellence (DC3oE), 6472 Integrity Court, Building 4401, Aberdeen Proving Grounds MD 21005

3. Description of Action: Request is for a new estimated Competitive Firm-Fixed Price Delivery Order for SpyCloud: Cyber & Information Exposure Risk Monitoring brand name under Computer Hardware, Enterprise Software and Solutions (CHESS/Digital Market) with a period of performance from 9 March 2026 through 8 March 2027. Fiscal Year 2026 funding under Research, Development, Test, and Evaluation, Army (RDT&E) will be used.

4. Description of Supplies/Services:

SpyCloud is the largest collection of open-source (OSINT) enriched Identity Intelligence assets, 300+ billion records of personal information on 1/3 of the world's population, from 33,000+ data breaches, 750+ million malware infected devices, 21+ billion web cookie records, 3+ billion crypto addresses and other covert sources. 65% of data is from foreign sources with 25% of this data being personal data on Chinese, Russian and Iranian people, and institutions.

SpyCloud solves the problem and cost of continuous collection of identity data, infiltration of criminal darknet closed and offline groups, massive processing of billions of raw data assets and storage of a normalized and API accessible data lake on AWS. SpyCloud validates every source for fidelity, using AIML developed from 6 years of experience in collecting criminal data. As an example, SpyCloud can detect fake data from nuances in password formats by geographic region. Each asset is enriched with its original source for provenance. On a massive scale, SpyCloud normalize the raw files, resolves language differences, cracks passwords at scale, links assets, and parse the data into a standard data schema that provides offensive and defensive actionable intelligence to support mission outcomes. SpyCloud adheres to all US PAI laws and guidelines in the collection of data.

The highest actionable data is SpyCloud's collection of malware infected victim devices that provide a digital recording of a victim's online activity and provide unmatched visibility behind firewalls and into the dark web without any OPSEC risks. For example, SpyCloud data includes infected devices used by Chinese and Russian military and government employees. The insights derived from these infected devices include online

In accordance with Army Regulation (AR) 25-1 and Army Federal Acquisition

Enterprise Software and Solutions (CHESS) is the mandatory source for commercial information technology hardware and software purchases. The product is available through CHESS by a secondary reseller, . An RFI, RFI # 557077, Market Research also provided a Rough Order of Magnitude (ROM) received from the SpyCloud via a

a. Procurement History: This is a new procurement.

b. Other Facts: N/A

10. Technical Certification: I certify that the supporting data under my cognizance which are included in the justification are accurate and complete to the best of my knowledge and belief.

11. Requirements Certification: I certify that the supporting data under my cognizance which are included in the justification are accurate and complete to the best of my knowledge and belief.

12. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable. Competition is expected on this requirement in order to determine reasonableness. However, if reasonableness is unable to be determined by competition, a price analysis, comparison to Independent Government Cost Estimate, comparison to historical prices, and/or comparison to commercial prices may be done. Additionally, certified cost or pricing data will not be required in accordance with FAR 15.403-1(b)(3), as a commercial item is being acquired.

13. Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.