Class JA 25-36 ALC redact.pdf

DEPARTMENT OF THE NAVY

NAVAL FACILITIES ENGINEERING SYSTEMS COMMAND, HAWAII

400 MARSHALL ROAD

JBPHH, HAWAII 96860-3139

J&A No. 25-36

CUI

CLASS JUSTIFICATION AND APPROVAL

FOR USE OF OTHER THAN FULL AND OPEN COMPETITION

1. Contracting Activity.

Naval Facilities Engineering Systems Command, Hawaii (NAVFAC HI), Construction Contract Division, Joint Base Pearl Harbor-Hickam (JBPHH), Hawaii.

2. Description of the Action Being Approved.

This Class Justification and Approval (CJ&A) authorizes and approves the use of brand name commercial equipment by manufacturer, Automated Logic Corporation (ALC), for Facility Related Control Systems (FRCS) programmable building controllers in contract actions requiring interface with the identified Installations networked facilities control and monitoring system and integrated into the Control System Platform (CSPE) at and Pacific Missile Range Facility

(Installations). Authority to act under this class justification is authorized from 01 October 2025 to 30 September 2030.

3. Description of Supplies/Services.

The use of ALC programmable building controllers in Section 2 will be required for all projects (existing or currently under development) that require a connection to the identified Installations’ networked FRCS and CSPE Building-level programmable controllers are categorized as FRCS and include, but are not limited to, network controllers and routers, digital controllers, zone controllers, variable air volume controllers, unitary and equipment controllers, and expansion modules. Network-capable programmable digital controllers include, but are not limited to network controllers and routers, building level supervisory controllers, zone controllers, variable air volume controllers, unitary and equipment controllers, and expansion modules. It does not include the physical system components (such as air handling units, chillers, boilers, condensing units, actuators, dampers, wiring, and similar). The ALC controllers will be configured and programmed using Government-licensed ALC software. This requirement does not restrict who can install, commission, test, maintain, or operate the controllers, and there are several known sources who can provide such services.

The total estimated cost for the use of the ALC controllers through 30 September 2030 is not expected to exceed approximately $13,000,000 based on the estimated number of projects expected to utilize this equipment. A non-exhaustive listing of the projected projects that will utilize this equipment is provided in Appendix A. All required

CUI

CUI J&A No. 25-36 programmable building controllers are authorized under this CJ&A regardless of method of execution or procurement strategy (i.e., contracted, in-house shop forces, base operating support contracts, or materials supply chain contractor).

4. Statutory Authority Permitting Other Than Full and Open Competition.

This request is submitted pursuant to the authority of 10 U.S.C.

2304(c)(1), only one responsible source and no other supplies or services will satisfy agency requirements.

5. Rationale Justifying Use of Cited Statutory Authority.

The Installations have a reasonable need for standardization and interoperability of its existing building control systems that will require a connection to the identified installations CSPE Network.

Applicable United States Government Accountability Office (GAO) Comptroller General decisions have acknowledged the authority of a federal agency to use other than competitive procedures when there is a reasonable need for standardization or interoperability with existing agency equipment or software. GAO has concluded that the overnment may use other than competitive procedures when there is reasonable need for standardization or interoperability with existing equipment or software, and when it is likely that award to other sources would result in substantial duplication of cost to the government that is not expected to be recovered through competition.

To assess the need for standardization and interoperability, a rigorous Business Case Analysis (BCA) was performed in August 2024 on the existing inventory of building control systems connected to the CSPE Network. This BCA evaluated the standardization of building programmable controllers and quantified the annual costs associated with procurement, sustainment of operation and maintenance, and establishment and sustainment of Department of the Navy cybersecurity requirements. The results of this BCA demonstrate that in order to minimize costs and potential cyber vulnerabilities, the use of the indicated ALC controllers will be required for all projects that require a connection to the CSPE Network.

Additionally, in support of future Smart Grid programs, all new building control systems, unless identified by exception, shall be required to connect to the CSPE Network. The Installations require that programmable controllers and front-end interfaces be manufactured by ALC in order to meet their need for, and achieve the benefits of, standardization and interoperability as follows:

a. Establish and maintain a defensible cybersecurity posture. The rapid emergence of cyber incidents on critical Industrial Control Systems (ICS), which include FRCS, with the potential to debilitate mission critical assets has catalyzed the need to establish a defensive cybersecurity posture across the shore enterprise. The Installations’ are currently pursuing a Risk Management Framework

CUI

(RMF) Authority to Operate (ATO) per Department of Defense Instruction

8510.01. The indicated manufacturer’s programmable controllers and their associated application software will be authorized per the ATO and provide for the following:

(1) Cost-effectively reduce government information technology cybersecurity risks. Avoid the significant costs and delays associated with obtaining a new ATO for the Direct Digital Control (DDC) system, due to government information technology cybersecurity risks, is required when additional nonconforming hardware or software is added to the system with resultant changes in the security posture of the system. The process of obtaining a new ATO would unacceptably delay the operational use of programmable controllers for the affected facility and connection of the facility to the CSPE Network, resulting in a significant degradation in accomplishment of mission. Similarly, if additional non-conforming equipment and software were added to the CSPE Network the associated cybersecurity costs to sustain the inventory of equipment and software and to maintain the ATO would significantly increase. Additionally, minimizing the different types of equipment and software permitted on the CSPE Network avoids incurring additional risks to system operational availability should the Naval Facilities Engineering Systems Command (NAVFAC) Functional Authorizing Official (FAO) determine that the additional equipment or software has security vulnerabilities precluding obtaining or maintaining an ATO.

(2) Control Systems (such as networked FRCS) are classified as Platform Information Technology (PIT) systems. Department of Defense Instruction 8500.01 requires that all PIT systems have their cybersecurity controls documented and validated prior to operation and/or deployment. All PIT systems on Navy networks must obtain an ATO from the FAO. Additionally, connection or integration into the CSPE and subsequently Smart Grid requires that FRCS obtain an ATO from the

NAVFAC FAO.

ATOs remain valid for three years as long as the cybersecurity posture of the system does not change. A cybersecurity posture change includes, but is not limited to, system architecture changes or any other changes that increase risk or degrade the security posture. Any cybersecurity posture change must be provided to the Navy Validation Group that approved/authorized the ATO for impact review on that risk approval. When a cybersecurity posture changes, the PIT system normally will be required to complete the authorization process again to obtain a new ATO for the new configuration. The use of different brand programmable controllers or associated configuration or programming software on the CSPE Network results in an undesirable, higher number of changes to the cybersecurity posture of the system.

Obtaining an ATO is not the end of the process; maintaining an ATO is also very resource intensive and the effort increases exponentially when additional hardware or software is added to the system (that is, requires maintaining cybersecurity controls, vulnerability management, system scans/tests, and similar).

b. Be able to maximize utilization of existing overnment-licensed ALC software to configure and program the controllers. Other contractors do not offer programmable controllers that can be configured/programmed with the ALC software. Alternatives, such as those using Java Application Control Engine (JACE) technology can initially provide an RMF/ATO-compliant connection to the CSPE;

however, any future maintenance or system expansion will violate their existing RMF/ATO accreditation because the underlying technology and related software connected to the JACE is not accredited. Other contractors do not offer programmable controllers that can be configured/programmed with ALC software. Although the Building Automaton and Control (BACnet) open protocol is the required communications protocol for all manufacturers' controllers, it only allows for different manufacturers' equipment to share basic point data. It does not allow for software configuration and programming functions to take place between different manufacturers' controllers.

For example, Manufacturer A's software cannot be used to program Manufacturer B's controller. Each manufacturer's proprietary software tools must be used to configure or change the program within a controller.

c. Maintain Installations’ networked facilities control and monitoring system so that all controllers can be programmed from a central station versus a hybrid system composed of many different controllers and associated configuration/programming software. This will further operational efficiency and decrease Installations’ maintenance, repair and energy costs. Using hardware products from the same vendor that produced the configuration/ programming software eliminates multi-vendor disputes regarding conflicts, standards, protocols, or performance characteristics, should the controller not function as required.

d. Avoid the significant operational burden and cost of having maintenance and engineering staff become proficient with the configuration, programming, commissioning, operation, and maintenance of controllers from different manufacturers. Standardization reduces personnel training costs and decreases procurement costs related to additional equipment, maintenance, and support contracts for another manufacturer's hardware and software, as well as the maintenance of an additional parts inventory. Maintaining multiple solutions is inefficient and creates unnecessary work and overhead that increases the total costs of ownership and manpower costs.

JBPHH and PMRF technical personnel who performed this BCA have determined that for the Installations, the contract actions authorized by this CJ&A will avoid substantial duplication of cost that is not expected to be recovered through competition. Assuming other brand name controllers could be integrated into the nstallation's CSPE Network so as to be fully functional, the significant cyber security risks, operational challenges, added costs (including the costs to re-procure the Installation's existing inventory), and other arising from the use of different brands of controllers outlined above are not expected to be recovered through competition.

6. Description of Efforts Made to Solicit Offers from as Many Offerors as Practicable.

A Sources Sought Notice (No. N62478CON33FY2502) was issued on 27 November 2024 in SAM.gov, to determine if there are other controllers capable of full functional interface with the existing ALC Government icensed software. The Sources Sought Notice closed on 11 December 2024. There were no responses received from the market.

Receiving no other responses from competing vendors indicates that there may not be any substitute or equivalent products that would fulfill the requirement.

7. Determination of Fair and Reasonable Cost.

The Contracting Officer has determined the anticipated cost to the overnment of the supplies/services covered by this CJ&A will be fair and reasonable. The cost associated with a complete replacement is not practicable or cost effective.

8. Actions to Remove Barriers to Future Competition.

For the reasons set forth in Paragraph 5, NAVFAC Hawaii does not intend to compete future contracts for the types of supplies/services covered by this CJA. NAVFAC Hawaii will continue to monitor the controls industry to determine if a universal controller configuration becomes available and if another potential sources emerges, NAVFAC Hawaii will continually assess whether competition for future requirements is feasible.

CUI

CERTIFICATIONS AND APPROVAL

TECHNICAL/REQUIREMENTS CERTIFICATION

I certify that the facts and representations under my cognizance which are included in this Justification and its supporting acquisition planning documents, except as noted herein are complete and accurate to the best of my knowledge and belief.