JA for Insider Threat Tool RedactionsApplied

Navy Marine Corps Acquisition Regulation Supplement
MARCH 2026 (Change 26-03)

ANNEX 1 – JUSTIFICATION AND APPROVAL

UNITED STATES MARINE CORPS

MARINE CORPS INSTALLATIONS COMMAND

3000 MARINE CORPS PENTAGON

WASHINGTON, DC 20350-3000

MCICOM-JA-26-007

JUSTIFICATION AND APPROVAL

FOR USE OF OTHER THAN FULL AND OPEN COMPETITION

1. Contracting Activity.
Marine Corps Installations Command (MCICOM) Headquarters (HQ) Contracting; Arlington, VA
2. Description of the Action Being Approved.
Award of a contract on a sole source basis for User Activity Monitoring (UAM) from Everfox, LLC (Everfox).
3. Description of Supplies/Services.
The Secretary of War (SecWar) approved an Operations Security (OPSEC) Campaign directing the Department of War Chief Information Officer (DoW CIO), in conjunction with the Under Secretary of War for Intelligence and Security (USW I&S) and the DoW General Counsel to establish a UAM pilot. The goal of the activity is to understand the extent of unauthorized disclosures and exfiltration of
information using DoW networks. The UAM tool comprises the continuous and full-time observation and logging of unclassified computer activity by DoW personnel. Services and Agencies are required to participate and independently resource the DoW designated tool set outlined in the “ENHANCED MONITORING PILOT AT THE PENTAGON RESERVATION CONCEPT OF OPERATIONS (CONOPS), NOV 2020.” On 30 September 2021, MCICOM executed a Task Order (M9549421F0010) with Forcepoint Federal LLC (now Everfox, LLC) to implement the UAM capability
the Marine Corps.
UAM is a structured, consistent, and continuous collection and reporting process at the device level for identifying, assessing, deciding upon responses to, and acting upon specific analysis of employee threat behaviors. The purpose of UAM is to gather detailed and substantive content about behavioral activity, which may be indicative of an insider threat. The USMC is required to maintain a UAM capability that contains the following technical ability to collect user activity data:
Controlled by: DON, USMC, I&L HCA
Controlled by: MCICOM HQ Contracting
CUI Category(ies): PROCURE
Limited Dissemination Control: DL ONLY
POC: MCICOM Contracting

CUI//SP-PROCURE//DL ONLY

Navy Marine Corps Acquisition Regulation Supplement
MARCH 2026 (Change 26-03)

•
•
Federal and DoW Insider Threat policies require UAM on unclassified networks in suppo1i of Insider Threat. This UAM platfo1m operates exclusively on the unclassified network. Logging,