A.02 Single Source Determination ( SISCO Licensing) Redacted Version.pdf

OJL-21-026

MULTI YEAR MAINTENANCE RENEWAL – AXS4-ICCP-132-095-DEV; AXS4-

ICCP-SECURE-132-095-DEV; ICCP-Lite-Plus-801-001

SINGLE SOURCE DETERMINATION

1. CONTRACTING AGENCY:

Portland District, U.S. Army Corps of Engineers, Contracting Division, 333 SW First Avenue, OR 97204- 3495.

2. DESCRIPTION OF ACTION:

This requirement is for the renewal of the software license support and version upgrades for the SISCO AXS4-ICCP software product.

3. DESCRIPTION OF SUPPLIES/SERVICES OR NATURE OF

CONSTRUCTION:

This acquisition is for a Firm-Fixed Price (Supply) contract for a multi-year (3 year) renewal of software license support and version upgrades for the annual software maintenance support and version upgrades for the SISCO AXS4-ICCP Software product. This includes free upgrades to the software and assistance with problems associated with the SISCO AXS4-ICCP software. SISCO, Inc. assistance may include emails, phone conversations, access to their software support portal, and/or specific patches to resolve a problem.

This contract is for the renewal of support for the products we have purchased from SISCO, Inc. which is for the AXS4-ICCP-132-095-DEV, ASX4-ICCP-SECURE-132-095-DEV, and the ICCP-Lite-Plus-801- 001 for the period of performance starting 26 September 2021 to 26 September 2024.

(1) AXS4-ICCP-132-095-DEV – Renewal Qty 3 Years @ $2,000.00. Total cost $6,000.00

(2) ASX4-ICCP-SECURE-132-095-DEV - Renewal Qty 3 Years @ $2,600.00. Total cost $7,800.00

(3) ICCP-Lite-Plus-801-00 – Renewal Qty 3 Years @ $6,000.00. Total cost $18,000.00

(4) Total amount for this requirement is: $31,800.00

The SISCO AXS4-ICCP software is used to establish communication between the COE Plants with GDACS installed and the Power Marketing Administrations we work with for Automatic Generation Control (AGC), Bonneville Power Administration (BPA), and Southeastern Power Administration (SEPA).

At that time, products were compared, and SISCO was selected as the product that would best meet the requirements for ICCP communications and compatibility with software at the BPA side. The AXS4-ICCP software was integrated into the GDACS SCADA software. The GDACS (Generic Data Acquisition Control System) system is installed at 12 Northwest Division Plants (Bonneville, The Dalles, John Day, Chief Joseph, McNary, Ice Harbor, Lower Monumental, Little Goose, Lower Granite, Dworshak, Libby, and Albeni Falls), and at 4 South Atlantic Plants (Allatoona, Hartwell, Russell, and Thurmond). GDACS is the Plant’s main automated control system for controlling and monitoring power production. In 2009, a Memorandum of Agreement was established between the U.S. Army Corps of Engineers (USACE) and the U.S. Bureau of Reclamation (USBR) to have USACE install, and provide the maintenance and support of GDACS installed at the Grand Coulee Project.

a. Annual software maintenance support and version upgrades for the SISCO software supporting the GDACS program.

b. Option quantities and/or performance periods:

(1) The performance period of this contract is 26 September 2021 through 26 September 2024.

(2) Both FAR clauses 52.237-3 (Continuity of Services) and/or 52.217-8 (Option to Extend Services) will be not included in this noncompetitive contract because this requirement is not a service contract; it is a supply contract for software licenses.

4. AUTHORITY CITED:

FAR 13.106-1(b)(1) Soliciting from a Single Source. For purchases not exceeding the simplified acquisition threshold, contracting officers may solicit from one source if the contracting officer determines that the circumstances of the contract action deem only one source reasonable available.

5. REASON FOR AUTHORITY CITED:

(1) Background: GDACS is the automated power plant monitoring and control system for controlling power generation from Corps Northwestern Division (NWD) hydropower plants and other federal power plants that may be linked to the NWD GDACS system.

The origin of the system was the necessity to develop automated control systems to work with Corps hydropower facilities as they were converted from analog to digital control systems starting in the 1980’s.

Early attempts to acquire an entirely commercial automated control system resulted in a series of commercial contract failures due to the unique technical challenges of the NWD hydropower facilities.

After these failed commercial efforts, the Corps management team decided to develop an in-house “GDACS” system, using available commercial software to assist the effort.

The associated GDACS software and hardware constitutes automated power control systems that fall under the requirements of Title 6 USC for cyber security, including 6 USC 131-134, protection of critical infrastructure information. Highlighted portions of the following sections indicate key definitions applicable to the cyber security required for GDACS.

(2) Justification:Title 6 USC- Domestic Security, Part B- Critical Infrastructure Information, Sec. 131(3),

(4) & (6). Definitions

(3) Critical infrastructure information

The term "critical infrastructure information" means information not customarily in the public domain and related to the security of critical infrastructure or protected systems -

(B) the ability of any critical infrastructure or protected system to resist such interference, compromise, or incapacitation, including any planned or past assessment, projection, or estimate of the vulnerability of critical infrastructure or a protected system, including security testing, risk evaluation thereto, risk management planning, or risk audit; or

(4) Critical infrastructure protection program The term "critical infrastructure protection program" means any component or bureau of a covered Federal agency that has been designated by the President or any agency head to receive critical infrastructure information.

(6) Protected system The term "protected system" - (A) means any service, physical or computer-based system, process, or procedure that directly or indirectly affects the viability of a facility of critical infrastructure; and (B) includes any physical or computer-based system, including a computer, computer system, computer or communications network, or any component hardware or element thereof, software program, processing instructions, or information or data in transmission or storage therein, spective of the medium of transmission or storage.

Title 6 USC- Domestic Security, Part B- Critical Infrastructure Information, Sec. 133.(a) (A)&(D) Protection of voluntarily shared critical infrastructure information

(a) Protection

(1) In general Notwithstanding any other provision of law, critical infrastructure information (including the identity of the submitting person or entity) that is voluntarily submitted to a covered Federal agency for use by that agency regarding the security of critical infrastructure and protected systems, analysis, warning, interdependency study, recovery, reconstitution, or other informational purpose, when accompanied by an express statement specified in paragraph (2) –

(A) shall be exempt from disclosure under section 552 of title 5 (commonly referred to as the Freedom of Information Act);

(D) shall not, without the written consent of the person or entity submitting such information, be used or disclosed by any officer or employee of the United States for purposes other than the purposes of this part, except -

(i) in furtherance of an investigation or the prosecution of a criminal act; or

(ii) when disclosure of the information would be -

(I) to either House of Congress, or to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint committee thereof or subcommittee of any such joint committee; or (II) to the Comptroller General, or any authorized representative of the Comptroller General, in the course of the performance of the duties of the Government Accountability Office.(!1)

(3) Impact: As a result of these provisions of Title 6 USC, and because knowledge of the GDACS code renders the GDACS system vulnerable to all sorts of external interference and damage, with consequent disruption of major portions of the Nation’s power supply, GDACS information and code are strictly restricted in their disclosure to as few persons and parties as possible, consistent with their use and operation.

The potential harm of outside hackers is well known from the existing barrage of outside hackers against DOD software systems.

The powerhouses controlled by GDACS represent the largest single source of electricity for the Pacific Northwest, and any disruption of GDACS software would cripple the Pacific Northwest power supply network, managed by the BOR, BPA, and COE through the common Federal Columbia River Power System (FCRPS).

As a result, access to GDACS cannot be legally offered to a wide range of competitors for GDACS support services. Moreover, as stated elsewhere in the supporting J&A, the interfaces between GDACS and SISCO software currently in use are also protected by SISCO’s legal proprietary rights.

And the cost and time of any effort to build an alternative GDACS system from a competitor’s software is prohibitive and contrary to essential operational needs of the FCRPS.

6. EFFORTS TO OBTAIN COMPETITION:

The SISCO AXS4-ICCP software was configured and customized to provide communications between the COE Plants and BPA for Automatic Generation Control. SISCO Inc. holds proprietary rights to this software. It is integrated into the GDACS software. All previous purchases of the SISCO AXS4-ICCP software product were from SISCO, Inc.

7. ACTIONS TO INCREASE COMPETITION:

Because they own the proprietary rights to the software, SISCO is the only authorized supplier of technical support services and version upgrades for the SISCO AXS4-ICCP Software.

8. MARKET RESEARCH:

Searched GSA Advantage, and there was no other provider found to provide the SISCO AXS4-ICCP software.

A complete replacement of the SISCO AXS4-ICCP software with equivalent performance combined with the additional cost associated with installation and modification of the software to meet the current needs would not be cost effective.

9. INTERESTED SOURCES:

No other vendors have expressed an interest in this project or as a possible source in the near future.

10. OTHER FACTS:

SISCO AXS4-ICCP software is required to meet GDACS monitoring and control system for controlling power generation from Corps Northwestern Division (NWD) and South Atlantic Division (SAD) hydropower plants and other federal power plants that may be linked to the NWD GDACS system.

a. Procurement history:

(1) Previous Awards:

W9127N-10-P-0387 03 Aug 2010 $13,250.00 W9127N-11-P-0311 20 Aug 2011 $13,250.00 W9127N-12-P-0314 19 Sep 2012 $13,250.00 W9127N-13-P-0172 19 Sep 2013 $13,250.00 W9127N-14-P-0172 23 Jun 2014 $13,250.00 P00001 W9127N-15-P-0172 01 Sep 2015 $13,250.00 P00003 W9127N-16-P-0172 25 Aug 2016 $13,250.00 P00004 W9127N-17-P-0172 23 Aug 2017 $13,250.00 P00005 W9127N-18-P-0122 18 Sept 2018 $13,250.00 W9127N-19-P-0114 04 Sept 2019 $23,500.00 W9127N-20-P-0121 28 Aug2020 $13,500.00

11. TECHNICAL CERTIFICATION:

I certify that the supporting data under my cognizance which are included in the justification are accurate and complete to the best of my knowledge and belief.

NAME: Showin Fu TITLE: Electrical Engineer SIGNATURE:

12. REVIEWED BY:

I hereby determine that the above information, to the best of my knowledge, is correct and accurate.

NAME: Robbie R Newland TITLE: Contract Specialist SIGNATURE:

13. CONTRACTING OFFICER CERTIFICATION:

Based on the foregoing determination, I hereby approve the procurement of (supply/service here) on an other than full and open competition basis pursuant to the authority 13.106-1(b) subject to the availability of funds, and provided the (supply/service) herein described has otherwise been authorized for acquisition.

I certify that this Determination is accurate and complete to the best of my knowledge and belief.

NAME: Barbara V. Byam TITLE: Contracting Officer SIGNATURE: