Attachment E - JA.pdf

DEPARTMENT OF THE NAVY

NAVAL FACILITIES ENGINEERING SYSTEMS COMMAND, MID-ATLANTIC

9324 VIRGINIA AVENUE

NORFOLK, VIRGINIA 23511-3095

Class J&A No. ML-22-02

FACILITIES RELATED CONTROLS SYSTEMS

CLASS JUSTIFICATION AND APPROVAL FOR USE OF OTHER THAN FULL AND

OPEN COMPETITION

1. Contracting Activity.

Naval Facilities Engineering Systems Command (NAVFACSYSCOM), Mid-Atlantic

2. Description of the Action Being Approved.

This Class Justification and Approval (CJ&A) authorizes and approves the use of brand name commercial equipment from Automated Logic Corporation (ALC) WebCTRL for Facility Related Control Systems (FRCS) programmable building controllers in contract actions requiring interface with the identified Installation networked facilities control and monitoring system at JEB Little Creek - Ft Story (referred to in this document as "the Installation"). Authority to act under this class justification is authorized from 1 November 2021 to 31 October 2024.

3. Description of Supplies/Services.

The use of the indicated brand name programmable building controllers in Section 2 will be required for all projects that require a connection to the identified installation networked FRCS commonly referred to as the PWD Little Creek Energy Management and Control System (EMCS). The ALC controllers will be configured and programmed using government-licensed ALC WebCTRL software. Programmable building controllers include, but are not limited to, network controllers and routers, digital controllers, zone controllers, VAV controllers, unitary and equipment controllers, and expansion modules. The requirement to use ALC WebCTRL software to program ALC WebCTRL brand name commercial equipment does not restrict who can install, commission, test, maintain, or operate the controllers and there are several known sources who can provide such services.

The total estimated value for the use of ALC WebCTRL brand name equipment through 31 October 2024 is $1,813,552. The cost of programmable building controllers typically represents approximately 20 percent of the cost of the total controls installation effort, and is a miniscule percentage of the total cost of any building construction effort. A non-exhaustive listing of the projected projects that will utilize this equipment is provided in Appendix A. All required programmable building controllers are authorized under this CJ&A regardless of method of execution or procurement strategy (i.e., contracted, in-house shop forces, base operating support contracts, or materials supply chain contractor).

Class J&A No. ML-22-02

Estimated Dollar Value of Brand Name Equipment ($K)

FY21 – FY24

MILCON $1,601

O&M, N $213

TOTAL $1,814

4. Statutory Authority Permitting Other Than Full and Open Competition.

The statutory authority permitting other than full and open competition is Title 10, U.S.C.

2304(c)(1), as implemented by the Federal Acquisition Regulation (FAR) 6.302-1, "Only one responsible source and no other supplies or services will satisfy agency requirements."

5. Rationale Justifying Use of Cited Statutory Authority.

The Installation has a reasonable need for standardization and interoperability of its existing building control systems that will require a connection to the PWD Little Creek EMCS.

Applicable United States Government Accountability Office (GAO) Comptroller General decisions have acknowledged the authority of a federal agency to use other than competitive procedures when there is a reasonable need for standardization or interoperability with existing agency equipment or software. GAO has concluded that the government may use other than competitive procedures when there is a reasonable need for standardization or interoperability with existing equipment or software, and when it is likely that award to other sources would result in substantial duplication of cost to the government that is not expected to be recovered through competition.

To assess the need for standardization and interoperability, a rigorous business case analysis (BCA) was performed on the existing inventory of building control systems connected to the PWD Little Creek EMCS. This business case analysis evaluated the standardization of building programmable controllers and quantified the annual costs associated with procurement, sustainment of operation and maintenance, and establishment and sustainment of Department of the Navy cybersecurity requirements. The results of this business case analysis demonstrate that in order to minimize costs and potential cyber vulnerabilities, the use of the indicated brand name programmable building controllers will be required for all projects that require a connection to the PWD Little Creek EMCS. Additionally, in support of the Navy Smart Grid program, all new building control systems, unless identified by exception, shall be required to connect to the Little Creek EMCS.

The Installation requires that programmable building controllers be ALC WebCTRL brand name in order to meet its need for, and achieve the benefits of, standardization and interoperability as follows:

a. Establish and maintain a defensible cybersecurity posture. The rapid emergence of cyber incidents on critical Industrial Control Systems (ICS), which include FRCS, with the potential to debilitate our installation mission critical assets has catalyzed the need to establish a defensive cybersecurity posture across the shore enterprise. A Risk Management Framework (RMF) Authority to Operate (ATO) is required per DoD Instruction 8510.01. The PWD Little Creek EMCS is currently in the planning stages of the RMF process as performed by NAVFACSYSCOM. The indicated manufacturer's programmable controllers and their associated application software will be authorized per the ATO and provide for the following:

(1) Cost-effectively reduce government information technology cybersecurity risks.

Avoid the significant costs and delays associated with obtaining a new ATO for the PWD Little Creek EMCS which, due to government information technology cybersecurity risks, is required when additional nonconforming hardware or software is added to the system with resultant changes in the security posture of the system. The process of obtaining a new ATO would unacceptably delay the operational use of programmable controllers for the affected facility and connection of the facility to the PWD Little Creek EMCS, resulting in a significant degradation in accomplishment of mission. Similarly, if additional non-conforming equipment and software were added to the PWD Little Creek EMCS, the associated cybersecurity costs to sustain the inventory of equipment and software and to maintain the ATO would significantly increase.

Additionally, minimizing the different types of equipment and software permitted on the PWD Little Creek EMCS avoids incurring additional risks to system operational availability should the NAVFACSYSCOM Functional Authorizing Official (FAO) determine that the additional equipment or software has security vulnerabilities precluding obtaining or maintaining an ATO.

(2) Control Systems (such as networked FRCSs) are classified as Platform Information Technology (PIT) systems. DoD Instruction 8500.01 requires that all PIT systems have their cybersecurity controls documented and validated prior to operation and/or deployment. All PIT systems on Navy networks must obtain an ATO from the FAO. Additionally, connection or integration into the Control System Platform Enclave (CSPE) and subsequently Smart Grid requires that the FRCS obtain an ATO from the NAVFACSYSCOM FAO.

ATOs remain valid for three years as long as the cybersecurity posture of the system does not change. A cybersecurity posture change includes, but is not limited to, system architecture changes or any other changes that increase risk or degrade the security posture. Any cybersecurity posture change must be provided to the FAO that approved/authorized the ATO for impact review on that risk approval. When a cybersecurity posture changes, the PIT system normally will be required to complete the authorization process again to obtain a new ATO for the new configuration. The use of different brand programmable controllers or associated configuration or programming software on the PWD Little Creek EMCS results in an undesirable, higher number of changes to the cybersecurity posture of the system. Obtaining an ATO is not the end of the process; maintaining an ATO is also very resource intensive and the effort increases exponentially when additional hardware or software is added to the system (that is, requires maintaining cybersecurity controls, vulnerability management, system scans/tests, and similar).

b. Be able to maximize utilization of existing government-licensed ALC WebCTRL software to configure and program the controllers. Other contractors do not offer programmable controllers that can be configured/programmed with the ALC software. Although the BACnet open protocol is the required communications protocol for all manufacturers' controllers, it only allows for different manufacturers' equipment to share basic point data. It does not allow for configuration and programming functions to take place between different manufacturers' controllers. For example, manufacturer A's software cannot be used to program manufacturer B's controller. Each manufacturer's proprietary software tools must be used to configure or change the program within a controller.

c. Maintain installation networked facilities control and monitoring system so that all controllers can be programmed from a single central station versus a hybrid system composed of many different controllers and associated configuration/programming software. This will further operational efficiency and decrease installation, maintenance, repair, and energy costs. Utilizing hardware products from the same vendor that produced the configuration/programming software eliminates multi-vendor disputes regarding conflicts, standards, protocols, or performance characteristics should the controller not function as required.

d. Avoid the significant operational burden and cost of having maintenance and engineering staff become proficient with the configuration, programming, commissioning, operation, and maintenance of controllers from different manufacturers. Standardization reduces personnel training costs and decreases procurement costs related to additional equipment, maintenance, and support contracts for another manufacturer's hardware and software, as well as the maintenance of an additional parts inventory. Maintaining multiple solutions is inefficient and creates unnecessary work and overhead that increases the total costs of ownership and manpower costs.

NAVFACSYSCOM Mid-Atlantic technical personnel who performed this business case analysis have determined that for the Installation, the contract actions authorized by this CJ&A will avoid substantial duplication of cost that is not expected to be recovered through competition.

Assuming other brand name controllers could be integrated into the PWD Little Creek EMCS so as to be fully functional, the significant cyber security risks, operational challenges, added costs (including the costs to re-procure the Installation's existing inventory), and other disadvantages arising from the use of different brands of controllers outlined above are not expected to be recovered through competition.

6. Description of Efforts Made to Solicit Offers from as Many Offerors as Practicable.

Per FAR 5.201, a Sources Sought announcement was synopsized on the sam.gov website on 9 Sept 2021 to determine if there are other controllers capable of fully functional interface with the existing ALC WebCTRL Government licensed software. The Sources Sought Notice closed on 24 Sept 2021. There was one (1) response from Thermo-Trol Systems and no other responses were received from the market. Thermo-Trol Systems is an Automated Logic dealer that can program and supply part compatible with the existing Automated Logic front end and software. By receiving no responses from competing vendors, it indicates that there may not be any substitute or equivalent products that would fulfill the requirement.

7. Determination of Fair and Reasonable Cost.

The Contracting Officer has determined that the anticipated cost to the Government of the supplies/services covered by this CJ&A will be fair and reasonable. The cost associated with a complete replacement is not practicable or cost effective.

8. Actions to Remove Barriers to Future Competition.

For the reasons set forth in Paragraph 5, NAVFACSYSCOM Mid-Atlantic does not intend to compete future contracts for the types of supplies/services covered by this document.

NAVFACSYSCOM Mid-Atlantic will continue to monitor the controls industry to determine if a universal controller configuration becomes available and if another potential source emerges, NAVFACSYSCOM Mid-Atlantic will continually assess whether competition for future requirements is feasible.

CERTIFICATIONS AND APPROVAL

TECHNICAL/REQUIREMENTS CERTIFICATION

I certify that the facts and representations under my cognizance, which are included in this justification and its supporting acquisition planning documents, except as noted herein, are complete and accurate to the best of my knowledge and belief.

Eric J. Allen Date Design and Construction Business Line Coordinator NAVFACSYSCOM Mid-Atlantic

LEGAL SUFFICIENCY REVIEW

I have determined this justification is legally sufficient.

Adrianne Mittelstaedt Date Assistant Counsel NAVFACSYSCOM Mid-Atlantic

CONTRACTING OFFICER CERTIFICATION

I certify that this justification is accurate and complete to the best of my knowledge and belief.

Heather Race Date Supervisory Contract Specialist, PWD Little Creek NAVFACSYSCOM Mid-Atlantic

CHIEF OF THE CONTRACTING OFFICE CERTIFICATION

I certify that this justification is accurate and complete to the best of my knowledge and belief.

Kimberly Kahler Date NAVFACSYSCOM Mid-Atlantic

APPROVING OFFICIAL (NPGI 6.304)

Upon the basis of the above justification, I hereby approve the class justification for proposed contract actions described herein using other than full and open competition, pursuant to the authority of 10 U.S.C. 2304 (c)(1).

CAPT G. E. MEEK, III, CEC, USN Date Commanding Officer NAVFACSYSCOM Mid-Atlantic

ALLEN.ERIC.J.10724997

Digitally signed by

ALLEN.ERIC.J.1072499790

Date: 2021.10.07 09:32:04 -04'00'

MITTELSTAEDT.ADRIANN

E.MICHE.1138280728

Digitally signed by

MITTELSTAEDT.ADRIANNE.MICHE.1138280728

Date: 2021.10.07 13:02:17 -04'00'

RACE.HEATHER.L.

1019542307

Digitally signed by

RACE.HEATHER.L.1019542307

Date: 2021.10.07 20:08:16 -04'00'

Appendix A

List of large projects using ALC WebCTRL family controls.

PROJECT

NO.

DESCRIPTION

PROGRAM

YEAR

FUNDING

TYPE

CWE COST

(000)

MILCON

(Y/N)

Cost of Controllers

RM371 08

GALLEY MECH. SYSTEMS &

LIFE SAFETY

IMPROVEMENTS

2023 MILCON $15,143 Y $118,155

RM20-2017 REPAIR/RENOVATE

BUILDING 3604 (UPH-BQ) 2024 O&M, N $27,266 N $212,746

P-1261

EOD EXPEDITIONARY MCM &

MOBILE DIVING & SALVAGE

COMPLEX

2024 -25 MILCON $110,810 Y $864,607

P-650 PHYSICAL TRAINING AND

READINESS COMPLEX 2024 MILCON $79,210 Y $618,044