J&A No. 25-015

EMCS Network the associated cybersecurity costs to sustain the inventory of equipment and software and to maintain the ATO would significantly increase.

Additionally, minimizing the different types of equipment and software permitted on the EMCS Network avoids incurring additional risks to system operational availability should the NAVFAC Functional Authorizing Official (FAO) determine that the additional equipment or software has security vulnerabilities precluding obtaining or maintaining an ATO.

2) Control Systems (such as networked FRCSs) are classified as Platform Information Technology (PIT) systems. DoD Instruction 8500.01 requires that all PIT systems have their cybersecurity controls documented and validated prior to operation and/or deployment. All PIT systems on Navy networks must obtain an ATO from the FAO.

Additionally, connection or integration into the Control Systems Platform Enclave (CSPE) and subsequently Smart Grid requires that the FRCS obtain an ATO from the

NAVFAC FAO.

ATOs remain valid for three years as long as the cybersecurity posture of the system does not change. A cybersecurity posture change includes, but is not limited to, system architecture changes or any other changes that increase risk or degrade the security posture. Any cybersecurity posture change must be provided to the Navy Validation Group that approved/authorized the ATO for impact review on that risk approval. When a cybersecurity posture changes, the PIT system normally will be required to complete the authorization process again to obtain a new ATO for the new configuration. The use of different brand programmable controllers or associated configuration or programming software on the EMCS Network results in an undesirable, higher number of changes to the cybersecurity posture of the system.

Obtaining an ATO is not the end of the process; maintaining an ATO is also very resource intensive and the effort increases exponentially when additional hardware or software is added to the system (that is, requires maintaining cybersecurity controls, vulnerability management, system scans/tests, and similar).

b. Be able to maximize utilization of existing government-licensed software from the existing manufacturers to configure and program the controllers. Other contractors do not offer programmable controllers that can be configured/programmed with the specified manufacturer software. Although the BACnet open protocol is the required communications protocol for all manufacturers' controllers, it only allows for different manufacturers' equipment to share basic point data. It does not allow for configuration and programming functions to take place between different manufacturers' controllers.

For example, Manufacturer A's software cannot be used to program Manufacturer B's controller. Each manufacturer's proprietary software tools must be used to configure or change the program within a controller.

c. Maintain installation networked facilities control and monitoring system so that all controllers can be programmed from a central station versus a hybrid system composed of many different controllers and associated configuration/programming software, This will further operational efficiency and decrease installation maintenance, repair, and energy costs. Using hardware products from the same vendor that produced the configuration/programming software eliminates multi-vendor disputes regarding conflicts, standards, protocols, or performance characteristics should the controller not function as required.

d. Avoid the significant operational burden and cost of having maintenance and engineering staff become proficient with the configuration, programming, commissioning, operation, and maintenance of controllers from different manufacturers. Standardization reduces personnel training costs and decreases procurement costs related to additional equipment, maintenance, and support contracts for another manufacturer's hardware and software, as well as the maintenance of an additional parts inventory. Maintaining multiple solutions is inefficient and creates unnecessary work and overhead that increases the total costs of ownership and manpower costs.

NAVFAC Pacific technical personnel who performed this BCA have determined that for the Installations, the contract actions authorized by this CJ&A will avoid substantial duplication of cost that is not expected to be recovered through competition. Assuming other brand name controllers could be integrated into the installation's EMCS Network so as to be fully functional, the significant cyber security risks, operational challenges, added costs (including the costs to re-procure the Installation's existing inventory), and other disadvantages arising from the use of different brands of controllers outlined above are not expected to be recovered through competition.

6. Description of Efforts Made to Solicit Offers from as Many Offerors as Practicable:

On 19 February 2025, an announcement was issued on the System for Award Management (SAM) website, in accordance with DFARS 206.302-1 to identify other potential responsible source of supply that can provide a DDC that has equal performance and listing/approval requirements compatible to the JCI METASYS Building Automation System. The announcement closed on 5 March 2025 – two responses were received:

did not meet the technical requirements/salient characteristics requested. The equipment described by “uses the Niagara framework for the programming language and they have the drivers available for operating and using the JCI software”.

however did not provide detailed technical data in order for the Government to conduct a comprehensive evaluation of the product to ensure full compatibility and interoperability with JCI, as required by the announcement.

responded that they were an interested vendor. The firm stated that they were working on the requested information and would share it with the Government soon. No further responses were received.

The Project Manager and Contracting Officer that reviewed the announcement responses above determined that the submission did not meet the salient characteristics specified by the sources sought notice.

Therefore, there are currently no other responsible sources of supply, other than JCI, that can meet the Government’s requirements.

7. Determination of Fair and Reasonable Cost:

The Contracting Officer has determined the anticipated cost to the Government of the supplies/services covered by this CJ&A will be fair and reasonable. The cost associated with a complete replacement is not practicable or cost effective.

8. Actions to Remove Barriers to Future Competition:

There will be no barriers to competition to evaluate the use of full and open competition for acquiring the same or similar supplies in the future. Market research will be conducted for future projects to ascertain the availability of new technology that may provide for other sources to meet the government’s needs. The government will consider, as applicable, should any other potential sources of supply for a compatible product be submitted during the source selection process.

Since the previous CJ&A was approved, NAVFAC Pacific monitored the industry through a sources sought market analysis in February 2025. As indicated in paragraph 6, the market does not contain any other sources of supply for the Government’s PBC requirement.