Class JA for Dormakaba Redacted.pdf

DEPARTMENT OF THE NAVY

NAVAL FACILITIES ENGINEERING SYSTEMS COMMAND, PACIFIC

258 MAKALAPA DRIVE, SUITE 100

JBPHH, HI 96860-3134

IN REPLY REFER TO

J&A No. 21-0002

CLASS JUSTIFICATION AND APPROVAL

FOR USE OF OTHER THAN FULL AND OPEN COMPETITION

1. Contracting Activity.

Naval Facilities Engineering Systems Command Pacific (NAVFAC PAC), Architect-Engineer (A-E) Contracts Branch

2. Description of the Action Being Approved.

This Class Justification and Approval (CJ&A) authorizes and approves, on a brand-name basis, the use of Radio Frequency Identification (RFID) Locking Systems manufactured by Dormakaba for all Bachelor Enlisted Quarters (BEQ) and Bachelor Officer Quarters (BOQ) to be constructed at Marine Corps Base Camp Blaz (MCB CB) under the Marine Corps' Defense Policy Review Initiative (DPRI) Program.

All Dormakaba RFID Locking Systems, as specified under Paragraph 3 below, are authorized under this CJ&A regardless of method of execution or procurement strategy (i.e., contracted, in-house shop forces, base operating support contracts, or materials supply chain contractors).

The authority to act under this CJ&A expires on 09/30/2026.

3. Description of Supplies/Services.

The Dormakaba RFID Locking System is a "touchless" door locking system typically used in lodging facilities which allows authorized guests and staff members to access various rooms through the use of a keycard that activates the locking mechanism through proximity signal receipt from a data chip embedded in the keycard transmitted via radio-frequency. The programming of the data in the keycards are done through the "stand-alone" centralized access control unit that contains the firmware necessary to code the keycards.

The Dormakaba RFID Locking System covered under this CJ&A consists of two main components:

Page 1 of13

J&A No. 21-0002

• The Dormakaba Ilea 790 Mortise Lockset, which includes the RFID reader and locking mechanisms. These locksets will be installed on all doors where controlled access is required such as individual guest or staff rooms.

• The Dormakaba FDU G4 model which serves as the "stand alone" centralized access control unit for various Dormakaba brand locksets including the Ilea 790 Mortise Lockset. This unit is typically situated at the facility's front desk lobby where programming of the keycards are performed.

It should be noted that while there are other Dormakaba Locksets that are compatible with the Dormakaba FDU G4 model such as the Confidant RFID and Q90 RFID, the Dormakaba Ilea 790 Mortise Lockset was selected to be covered by this Class J&A as it was determined to be best suited for Government use.

Review of various technical specifications identified that the Dormakaba Ilea 790 Mortise Lockset was capable of having lock firmware upgraded and is certified and in compliance to the highest level of security (Grade 1) in accordance to the American National Standards Institute/Builders Hardware Manufacturers Association, (ANSI/BHMA Al56.13 mortise locks (Grade 1) and ANSI/BHMA A156.25 electrified locks (Grade 1)).

Other Dormakaba Locksets such as the Confidant RFID is not certified to either of these standards, however is certified and compliant to European Standards (i.e. EN 179, DIN 18273, EN 1906, ON 1634-1) which does not meet the Government's need.

With regards to the Q90 RFID, the Government found that it will be a discontinued model resulting in limited parts and support and is not compatible with an Exit Device Operator (aka panic bar). As such, the Dormakaba Ilea 790 Mortise Lockset is the only known Dormakaba RFID Lockset that can meet the Government's requirement.

The Marine Carp's DPRI Program will require the construction of eight (8) new BEQs and two (2) new BOQs which are expected to be completed by the end of Fiscal Year (FY) 2026:

• Each BEQ will require 330 Dormakaba Ilea 790 Mortise Locksets and two (2) Dormakaba FDU G4 model.

• Each BOQ will require 220 Dormakaba Ilea 790 Mortise Locksets and two (2) Dormakaba FDU G4 model.

As a result, ten (10) total Dormakaba RFID Locking Systems are required which consists of 3,080 Dormakaba Ilea 790 Mortise Locksets and 20 Dormakaba FDU G4 models.

The total estimated cost of ten (10) RFID Locking Systems is A detailed breakdown is provided in the following table by specific projects:

FISCAL PROJECT PROJECT

YEAR ID NAME ITEM U/I QTY

FY20 P-459 BEQ H Dormakaba Ilco 790 Mortise Lockset Each 330

Dormakaba Front Desk Unit G4 Model Each 2

FY20 J-031 BEQ D Dormakaba Ilco 790 Mortise Lockset Each 330

Dormakaba Front Desk Unit G4 Model Each 2

FY20 J-033 BEQ F Dormakaba Ilco 790 Mortise Lockset Each 330

Dormakaba Front Desk Unit G4 Model Each 2

FY21 J-036 BEQ C Dormakaba Ilco 790 Mortise Lockset Each 330

Dormakaba Front Desk Unit G4 Model Each 2

FY21 J-032 BEQ E Dormakaba Ilco 790 Mortise Lockset Each 330

Dormakaba Front Desk Unit G4 Model Each 2

FY21 J-037 BEQ G Dormakaba Ilco 790 Mortise Lockset Each 330

Dormakaba Front Desk Unit G4 Model Each 2

FY21 J-038 BEQ J Dormakaba Ilco 790 Mortise Lockset Each 330

Dormakaba Front Desk Unit G4 Model Each 2

FY21 J-039 BEQ K Dormakaba Ilco 790 Mortise Lockset Each 330

Dormakaba Front Desk Unit G4 Model Each 2

FY21 J-023 BOQ A Dormakaba Ilco 790 Mortise Lockset Each 220

Dormakaba Front Desk Unit G4 Model Each 2

FY22 J-034 BOQ B Dormakaba Ilco 790 Mortise Lockset Each 220

Dormakaba Front Desk Unit G4 Model Each 2 *Unit prices obtained from manufacturer's price guide located on Dormakaba's website.

Total funds in the amount of will be made available for the ten (10) Dormakaba RFID Locking Systems required at the new BEQs and BOQs. MAMIZU funds (Government of Japan funded projects) will cover the Dormakaba Ilco 790 Mortise Locksets and Operation & Maintenance (O&M) funds from Marine Corps Forces, Pacific (MARFORPAC) will cover the Dormakaba Front Desk Unit G4 model. The following table provides specific amounts by fiscal year between the two sources:

FUNDING

MAMIZU

O&M

TOTAL

4. Statutory Authority Permitting Other Than Full and Open Competition.

The statutory authority permitting other than full and open competition is Title 10 U.S.C. 2304(c) (1), as implemented by the Federal Acquisition Regulation (FAR) 6.302-1, "Only one responsible source and no other supplies or services will satisfy agency requirements".

5. Rationale Justifying Use of Cited Statutory Authority.

Page 3 of13

The installation of different types of RFID Locking Systems from different manufacturers across the ten (10) BEQs and BOQs would not satisfy the Government's requirements, and would also result in substantial duplication of costs to the Government that is not expected to be recovered by competition.

a. There are no other known RFID Locking Systems that allows for the programming of keycards without access to a computer. Consideration of alternative products in which computer access is required would result in increased cybersecurity risks in addition to increased cost to establish and maintain an Authority to Operate (ATO) for each new RFID Locking Systems that is not manufactured by Dormakaba.

The Joint Region Marianas (JRM) Command is responsible for overseeing and managing the Quarters Operations Program which include procurement and maintenance of the BEQ and BOQ facilities' RFID Locking System.

Oversight of the Quarters Operations Program's funding fall under the purview of Command, Navy Installations Command (CNIC) Unaccompanied Housing (UH) Program managed by the UH Division (N93) that are responsible for the central management of funding across the CNIC Enterprise.

Due to its physical makeup and operational capabilities to perform its designed functional use, an RFID Locking System, including the supporting firmware, are considered Information Technology (IT) and falls under the auspices of DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT), which requires the authorization for its use to be processed through the Risk Management Framework (RMF) process.

The RMF is the DoD process for applying cybersecurity to IT, including FRCS due to its vulnerability to cyberattacks posing negative impacts to our military operational missions. The methods used for obtaining cybersecurity through the application of the RMF process are promulgated in the Unified Facilities Criteria (UFC) 4-010-06 and is comprised of the following 6 steps:

1. Categorize the System

2. Select Security Controls

3. Implement Security Controls

4. Assess Security Controls

5. Authorize the System

6. Monitor Security Controls

The 5th step (Authorize the System) grants "Authorization" of the system's use by the Authorizing Official (AO) via issuance of an Authorization to Operate (ATO) upon successful completion of Steps 1-4.

The 6th step (Monitor Security Controls) is the continual monitoring in support of maintaining certification of the ATO for the system's continual authorized use and is a required function to support ATO recertification every 3 years. The associated annual costs to support "monitoring" efforts are centrally managed by CNIC and granted specifically for systems that already have an ATO in place. Because the Dormakaba RFID Locking System already has an ATO established and is a "stand alone" system (i.e. Serial FRCS & IP-Capable Device that is not connected and not fully programmable), the NAVFAC Marianas (NFM) Command Information Officer (CIO) has determined that an estimated standard breakdown of this system's performance level has an annual recurring cost of approximately - per year. For any new system other than Dormakaba that does not have an ATO, the NFM CIO estimated that it will cost for initializing each system (Steps 1-5). These costs are derived from a blend of labor support from CIO, Public Works, and Base Operations Support Contract (BOSC) or Wage Grade (WG) labor, including Vendor Support Contracts associated with both the development of the RMF (Steps 1-5) and the continual monitoring of the system (Step 6). It also includes System Front-end and hardware refresh.

By limiting competition and only procuring the Dormakaba RFID Locking System for the ten (10) BEQs and BOQs, cybersecurity risk would be significantly diminished since it is the only known "stand-alone" system that can fully operate without connection to a computer. Furthermore, the Government would only incur the annual ATO monitoring cost of Consideration of alternative products that require access to computers would pose unnecessary

Page 5 of13 cybersecurity securit~the Government in addition to incurring--to establish the ATO and -for the annual ATO monitoring which would be required for each different RFID Locking System brand.

b. The Government would incur additional training costs for each new RFID Locking Systems that is not manufactured by Dormakaba.

The installation of multiple different manufacturers' RFID Locking System would result in additional costs for system operations and maintenance training as Unaccompanied Housing (UH) Personnel would be burdened to retain working knowledge on multiple systems. This would inherently require UH Personnel to hire each new RFID Locking System manufacturer to provide on-site training to Government Personnel. Using training costs from Dormakaba and assuming it would be the same across different manufacturer-s the Government estimates an on-site cost of for training to operate and maintain the RFID Locking System in addition to airfare and lodging for the trainer. The training is assumed to be one (1) day or eight (hours).

As stated in the beginning of this Paragraph 5, the installation of different types of RFID Locking Systems from different manufacturers across the ten (10) BEQs and BOQs would result in substantial duplication of costs to the Government that is not expected to be recovered by competition. Since the Dormakaba RFID Locking System is the only known "stand-alone" system that is fully capable of operating without access to a computer, the Government would minimize cybersecurity risks and reduce the associated ATO cost if alternative products were considered. For every new RFID L~stem other than Dorm-akaba the Government would incur --in the initial ATO, for annual ATO sustainment, and~o hire the manufacturer to provide training to Government staff members. Assuming a 25-year expected lifecycle for an RFID Locking System, the total additional cost to the Government would be for each new RFID Locking System:

EXTENDED

ITEM U/I QTY

Initial ATO System l ATO Sustainment Year 25 Manufacturer Training System l

Considering that there are a total of 10 BEQs and BOQs, competition may result in a maximum of 10 different RFID Locking Systems from different manufacturers. Since it was estimated to cost the Government an additional over a 25-year lifecycle for each different RFID Locking System manufacturer other than Dormakaba, the Government could incur an additional if the RFID Locking System was not limited to Dormakaba.

6. Description of Efforts Made to Solicit Offers from as Many Offerors as Practicable

a. On 12/14/2020, a Sources Sought Notice was posted to the beta.SAM website under Notice ID# N6274221DPRIRFID to determine the availability of Radio Frequency Identification (RFID) Locking Systems, other than the Dormakaba brand, that can meet the Government's need. The Sources Sought Notice also identified the Government's intent to issue a Class Justification & Approval (CJ&A) along with the preliminary rationale to support it. The deadline to respond was 12/29/2020 and the Government received four (4) responses prior to this deadline.

Attachment 1 is a copy of the posting.

(1) On 12/15/2020, from The Saucedo Company responded to the Sources Sought Notice by providing a technical data sheet for the VingCard Classic RFID Electronic Lock manufactured by Assa Abloy Global Solutions. However, the VingCard Classic RFID could not meet the Government's requirement of programming keycards without the use of a computer (i.e. stand alone unit) since operation required the use of their Visionline software along with a computer and monitor.

Furthermore, the Government could not consider just the VingCard RFID Lockset since it is not compatible with the Dormakaba Front Desk Unit G4 model.

Page 7 of13

On 12/21/2020, an email was provided to informing him of this determination (Attachment 2) and no additional relevant information was received.

It is worth mentioning that The Saucedo Company is a dealer/distributor for various manufacturers which includes Dormakaba. commented that Dormakaba products are offered at a lower price point than the Assa Abloy Global Solutions products.

(2) On 12/28/2020, from Diamond Technologies responded to the Sources Sought Notice by requesting to be placed on a Request for Quote (RFQ) list. Based on this initial response, the Government provided clarification that there are no RFQ list for the RFID Locking System since the Government did not intend to procure them separately from the BEQ/BOQ construction.

Instead, the purpose was to determine the feasibility of limiting competition for the RFID Locking System to only those manufactured by Dormakaba and to consider alternatives that could meet the Government's requirement. Based on this clarification, provided several product sheets from MIWA Lock Company Limited and from Zephyr Lock. However, the email from did not provide any explanation and did not specifically clarify if any of these products could meet the Government's requirement as specified in the Sources Sought Notice. After clarification was requested by the Government concerning these products, a call was received from~t Sunrise Security who stated that he was referred to by Based on the telephone discussion, which included clarification on the purpose of the Sources Sought Notice,_ could not propose an alternate product that could meet the Government's need for a "stand-alone" device that was capable of programming keycards without connecting to a computer. Based on this discussion with and no further explanation provided by concerning products from the MIWA Lock Company Limited and Zephyr Lock, a determination was made that the products could not satisfy the Government's requirement.

On 12/30/2020, an email was provided to and

- from Sunrise Security informing them of this determination and no additional relevant information was received (Attachment 3).

Similar to the discussion with from The Saucedo Company, -from Sunrise Security mentioned that he was familiar with Dormakaba products and acknowledged that their products were "cheaper" compared to other manufacturers.

( 3 ) On 12 / 2 8 / 2 0 2 0 , from The Product Solutions responded to the Sources Sought Notice by providing product information for the SALTO XS4 Ansi Door Locks manufactured by SALTO Systems. Initially, stated that their product could satisfy the Government's requirement which included the capability of being a "stand-alone" device. Upon review of the product information provided by _, the Government identified that the SALTO Door Lock System was reliant on interfacing with a computer utilizing the SALTO ProAcess SPACE software to run the system using their Portable Programming Device (PPD).

While it is acknowledged that SALTO's products do offer a variety of options to increase the convenience for the equipment operators, it is anticipated to come with a higher cost to the Government since it would require a higher degree of Authority to Operate (ATO) reviews/certification since these options involve more Information Technology (IT) integration and oversight by the Government.

On 12/30/20~ry determination was provided to----stating that their product did not appear to meet the Government's need for a "stand-alone" system for reasons stated in the ~raph. Upon receipt of this email, -requested, and was granted, additional time to discuss this preliminary determination with SALTO Systems and their technical team. On ~2021, a follow-up email was sent to -requesting status but no response was received

(Attachment 4) .

(4) On 12/29/2020, an unnamed representative from Dubai Enterprises responded to the Sources Sought Notice by providing a "formal offer" along with the specification sheet for the Dormakaba Confidant RFID Lockset. Upon receipt of this response, the Government provided clarification that the Sources Sought Notice was not intended to solicit quotes for

Page 9 of13

Dormakaba products. In addition, a breakdown of the "formal offer" was requested for market research purposes since it was not clear what the actual price was due to a typo and no further details were provided concerning the exact quantities to be included in the price. (Attachment 5). No follow-up responses were provided by Dubai Enterprises.

b. Based on the responses to the Sources Sought Notice, it was determined that no other product other than the Dormakaba RFID Locking System could address the Government's need.

Furthermore, responses to the Sources Sought Notice identified that Dormakaba products, when compared to other manufacturers of RFID Locking Systems, are typically more cost effective, thereby satisfying the Government desire to reduce the overall lifecycle cost.

7. Determination of Fair and Reasonable Cost

The Contracting Officer has determined that the anticipated cost to the Government for the Dormakaba RFID Locking System covered by this J&A will be fair and reasonable.

8. Actions to Remove Barriers to Future Competition

For the reasons set forth in Paragraph 5, NAVFAC Pacific does not intend to compete future contracts for the types of supplies/services covered by this document. The NAVFAC Pacific A-E Contracts Branch will continue to monitor the RFID Locking System industry to determine if a "stand-alone" unit capable of programming keycards without a computer becomes available and if another potential source emerges, NAVFAC Pacific A-E Contracts Branch will assess whether competition for future requirements is feasible.

Page 10 of13

CLASS JUSTIFICATION AND APPROVAL #21-0002

CONTRACT #N/A

CERTIFICATIONS AND APPROVAL

TECHNICAL/REQUIREMENTS CERTIFICATION

I certify that the facts and representations under my cognizance which are included in this Justification and its supporting acquisition planning documents, except as noted herein are complete and accurate to the best of my knowledge and belief.

11 Jan 2021

Signature Name (Printed) Date

LEGAL SUFFICIENCY REVIEW

I have determined this Justification is legally sufficient.

11 Jan 21

Signature Name (Printed) Date

CONTRACTING OFFICER CERTIFICATION

I certify that this Justification is accurate and complete to the best of my knowledge and belief.

11 Jan 2021

Signature Name (Printed) Date

Page 11 of13

ECH III CHIEF OF CONTRACTING OFFICE ENDORSEMENT

I endorse that this Justification is accurate and complete to the best of my knowledge and belief.

1/12/2021

Signature Name (Printed) Date

Page 12 of13