Class_Justification_and_Approval - BAS Redacted.pdf

OFFICE OF ACQUISITION MANAGEMENT

CLASS BRAND NAME JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION

41 U.S.C. 3304

Pursuant to the requirements of the Competition in Contracting Act (CICA) as implemented by the Federal Acquisition Regulation (FAR) and in accordance with the requirements of FAR

6.303 and 6.304, this Class Brand Name Justification is based on the following facts under FAR 6.302-1(c) Application for brand name descriptions as follows:

1. Agency and Contracting Activity.

The U.S. General Services Administration (GSA), Public Buildings Service (PBS), Office of Facilities Management (OFM).

2. Nature and/or description of the action being approved.

a. This is a class Brand Name Justification and Approval (J&A) authorizing Other than Full and Open Competition for an enterprise-wide Building Automation System (BAS) integration software and equipment solution.

b. This new requirement will be incorporated into the P100 as a standard for all GSA buildings. Resulting contracts may be used specifically for the BAS or the BAS may be ancillary to the overall scope.

c. The total estimated value for the associated projects is $85M.

d. This J&A is valid for five (5) years from date of signature. Annually, GSA PBS will publish via the official government system, SAM.gov, a Request for Information and this fully executed Brand Name Justification to determine if there are new entrants into the BAS Industry. Should the results of the RFI and published Brand Name Justification determine that the market conditions have changed, this J&A will be rescinded.

3. Description of Supplies/Services.

GSA PBS is seeking to implement an enterprise-wide BAS solution since Operational Technologies (OT) rely heavily upon information technology (IT) infrastructure to ensure that cyber security requirements are met. This would streamline Operations and Maintenance (O&M) contracts and training by reducing the number of disparate BAS systems across the portfolio. Establishing an enterprise-wide BAS solution would involve the integration software and equipment solution (to include installation and maintenance) across its building inventory for all new BAS installations in new construction, and upgrading/replacing existing BAS as the end of useful life is reached in a facility.

An enterprise-wide BAS solution is needed to reduce cyber security risk. The determination to transition to an enterprise-wide BAS solution was made in accordance with 1) the GSA PBS Supply Chain Risk Management (SCRM) Organizational Plan1, 2) the Federal Information Technology Acquisition Reform Act (FITARA), and 3) total cost of ownership (TCO) considerations and supporting readiness for future IT initiatives.

1 The SECURE Technology Act of 2018, requires each agency to implement a supply chain risk management plan that 1) encompasses risk identification, 2) assesses the criticality and impact of those risks, and 3) mitigates and monitors throughout the acquisition life cycle.

BAS Integration Software and Equipment Solution Requirements

GSA PBS’s requirements and associated reasoning and supporting objectives for the BAS enterprise-wide solution are as follows:

3.1.Must be available as a commercial off-the-shelf (COTS) and over the counter non-proprietary solution from multiple suppliers for both installation and ongoing maintenance.

○. Increase competition among resellers and allow for additional small business contracting opportunities for new installations, upgrades/replacements, and ongoing maintenance.

○. Reduce IT security risk through procurement of Software Maintenance Agreements (SMAs). SMAs allow GSA to better upgrade and support systems and keep them up-to-date with IT security vulnerabilities.

○. Streamline national-level Smart Buildings Program integrations which include but are not limited to GSAlink, National Computerized Maintenance & Management System (NCMMS), Unified User Interface (UUI), Advanced Metering (AMS), American Society of Heating, Refrigerating and Air-Conditioning Engineers (ASHRAE) Guideline 36, and net zero and Greenhouse Gas (GHG) emission reduction efforts.

3.2.Does not require secondary or third party programming software tools to support or commission controllers.

○. Reduce the IT security risk associated with having third party (or manufacturer provided) proprietary software tools which rarely meet IT security requirements but must be utilized to support field devices, programming, and break/fix needs.

3.3.Utilizes embedded, block-logic (wiresheet) programming methodology which requires no additional software tools or licensing to operate.

3.4.Ability to fully support, program, and commission the BAS Global Network Controllers and field level controllers must be embedded into the BAS solution.

No third party or additional manufacturer-provided software applications shall be necessary.

3.5.Support of GSA IT Cyber Security Requirements:

○. Internet Protocol version 6 (IPv6) as required by Office of Management and

Budget (OMB) Memo M-21-07.

○. Reduce cost to GSA for server licensing fees, patching, updates and man-power by requiring fewer Virtual Machines (VM), to also meet the server reduction requirement in OMB Memo M-19-19.

○. Reduce GSA IT personnel time and added risks associated with the scanning and remediation of existing software and hardware platforms by manufacturers for use on the Building Systems Network (BSN).

○. CISA “Binding Operational Directives (BODs)”, CISA “Emergency Directives (EDs), and GSA policy requirements for flaw remediation. Notable CISA BODs corresponding to flaw remediation and GSA policy requirements are as follows:

■. BOD 23-02: Mitigating the Risk from Internet-Exposed Management Interfaces

■. BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities - remediate Known Exploitable Vulnerabilities (KEV) identified in the CISA KEV Catalog within 14 days

■. BOD 19-02: Vulnerability Remediation Requirements for Internet- Accessible Systems - remediate critical vulnerabilities within 15 calendar days of initial detection and High vulnerabilities within 30 calendar days of initial detection

■. GSA Policy - All other vulnerabilities are required to be corrected within 30 Day for High, 90 Days Moderate, and 180 Days for Low.

○. Ability to receive an Authority to Operate within the GSA BSN boundary in compliance with NIST 800-53 R5B Moderate Impact security and privacy requirement and the GSA IT Security Procedural Guide 06-30, Managing Enterprise Risk

3.6.Meet or exceed GSA IT and Smart Building requirements as described in the following documents:

○. GSA P100

○. ADM 7002.1 GSA Order GSA Smart Buildings ○. GSA Smart Building Implementation Guide ○. GSA Smart Buildings Program Guide ○. GSA Data Normalization Guide for BMCS ○. Building Technologies Technical Reference Guide ○. GSA Technology Policy for PBS-Owned Building Monitoring and Control

Systems ○. PBS Key Sustainable Products Initiative 1096.1

BAS Manufacturers/Vendors Scorecard Note: All 6 major manufacturers listed below offer a Niagara solution along with their flagship BAS product. All rebrand and resell the Niagara solution as their own product.

BAS Integration Software and Equipment Solution Requirements

J&A Req #

BAS Manufacturers/Vendors Scorecard

Niagara Platform

Must be available as a commercial off-the-shelf (COTS) and over the counter non-proprietary solution from multiple suppliers for both installation and ongoing maintenance.

3.1 Yes No No No No No No

Increase competition and allow for additional small business contracting opportunities for new installations, upgrades/replacements, and ongoing maintenance.

3.1.1 Yes No No No No No No

Reduce risk associated with installing a BAS that can only be supported and maintained by the supplying original equipment manufacturer (OEM) of the system.

3.1.2 Yes No No No Yes Yes No

Streamline Operations and Maintenance (O&M) contracts and training by reducing the number of disparate BAS systems across the portfolio.

3.1.3 Yes Yes Yes Yes Yes Yes Yes

Reduce IT security risk through procurement of Software Maintenance Agreements (SMAs). SMAs allow GSA to better upgrade and support systems and keep them up-to-date with IT security vulnerabilities.

3.1.4 Yes No Yes No No Yes No

Streamline national-level Smart Buildings Program integrations which include but are not limited to GSAlink, National Computerized Maintenance & Management System (NCMMS), Unified User Interface (UUI), Advanced Metering (AMS), American Society of Heating, Refrigerating and Air-Conditioning Engineers (ASHRAE) Guideline 36, and net zero and Greenhouse Gas (GHG) emission reduction efforts.

3.1.5 Yes Yes Yes Yes Yes Yes Yes

Does not require secondary or third party programming software tools to support or commission controllers. 3.2 Yes No No No No No Yes

Reduce the IT security risk associated with having third party (or manufacturer provided) proprietary software tools which rarely meet IT security requirements but must be utilized to support field devices, programming, and break/fix needs.

3.2.1 Yes No No No No No Yes

Utilizes embedded, block-logic (wiresheet) programming methodology which requires no additional software tools or licensing to operate.

3.3 Yes No No No No No Yes

Ability to fully support, program, and commission the BAS Global Network Controllers and field level controllers must be embedded into the BAS solution.

No third party or additional manufacturer-provided software applications shall be necessary.

3.4 Yes No No Yes Yes Yes Yes

Support of GSA IT Cyber Security Requirements: Internet Protocol version 6 (IPv6) as required by Office of Management and Budget (OMB) Memo M-21-07.

3.5.1 Yes No Yes No Yes No Yes

Support of GSA IT Cyber Security Requirements: Reduce cost to GSA for server licensing fees, patching, updates and man-power by requiring fewer Virtual Machines (VM), to also meet the server reduction requirement in OMB Memo M-19-19.

3.5.2 Yes Yes Yes Yes Yes Yes Yes

Support of GSA IT Cyber Security Requirements: Reduce GSA IT personnel time and added risks associated with the scanning and remediation of existing software and hardware platforms by manufacturers for use on the Building Systems Network (BSN).

3.5.3 Yes Yes Yes Yes Yes Yes Yes

Meet or exceed GSA IT and Smart Building requirements as described in GSA Project Documentation

3.6 Yes No No Yes Yes No Yes

Manufacturer/Vendor Compliance Scores 100% 29% 43% 43% 57% 50% 71%

As shown from the table above, Niagara is the only brand name capable of meeting all requirements.

Per requirements 3.2, 3.3, and 3.4 above, Niagara utilizes a combination of embedded Wiresheet and Block Logic programming environments with industry standard and manufacturer specific drivers and programming wizards that are all embedded into the

Niagara software environment. There is no need for third party programming or commissioning tools.

Per requirement 3.1 above, Niagara can not only be installed, licensed, programmed, and supported by any vendor signing up as a Vykon System Integrator (VSI) or Distributor (VSD), but nearly all of the major BAS Manufacturers that offer a flagship proprietary solution also offer a Niagara product line that they install and support. Both large BAS manufacturers and small businesses/integrators can submit proposals utilizing this enterprise standard.

Niagara also has a very large footprint in the automation industry with currently over one million instances of the product in use. Niagara utilizes an open framework model that allows manufacturers to use the Niagara code in its products or to simply rebrand and/or resell Niagara products as its own. There are no other BAS controls companies offering a similar sales and support model which increases competition on projects and maintenance contracts.

Additionally, per requirements 3.5 and 3.6 above, Niagara is one of the only BAS manufacturers that currently supports the IPv6 protocol and GSA policy as stated in OMB Memo M-19-19 and is fully capable of meeting the listed GSA documentation for Smart Buildings and GSA PB-ITS.

The market research discussed in Section 8 below supports that no other brand name solution is capable of meeting the requirements.

If an enterprise-wide BAS solution is not provided, there would be multiple negative impacts which include:

1. continued and increased cyber security risk due to the number of CISA advisories related to connected products;

2. continued, unnecessary labor and costs from GSA IT scanning and remediation required as a result of disparate systems;

3. continued cyber security challenges and ensuring vulnerabilities in hundreds of different hardware/software solutions are mitigated;

4. continued challenges related to ongoing support, training, and maintenance of so many disparate systems;

5. continued IT risk associated with BAS solutions that do not support Multi-Factor Authentication (MFA) and their ability to remain connected to the GSA BSN through the existing Authority To Operate (ATO);

6. continued risk associated with installing BAS solutions that can only be supported, programmed, and maintained by the supplying OEM of the system.

4. Identification of statutory authority permitting other than full and open competition.

The statutory authority permitting other than full and open competition is 41 U.S.C. §3304 as implemented by:

☒ FAR 6.302-1 (c): Only one responsible source (brand name) and no other supplies or services will satisfy agency requirements.

☐ 6.302-2: Unusual and compelling urgency.

☐ 6.302-3: Industrial mobilization; engineering, development, or research capability; or expert services.

☐ 6.302-4: International agreement.

☐ 6.302-5: Authorized or required by statute.

☐ 6.302-6: National security.

☐ 6.302-7: Public interest.

5. Demonstration that the nature of the acquisition requires use of the authority cited.

As illustrated in the BAS Manufacturers/Vendors Scorecard in section 3 above, the Niagara Platform meets all of the requirements. Whereas the other brands can only meet 29%-71% of the salient characteristics.

The two common characteristics that the other brands do not meet are:

1. They are not available as a commercial off-the-shelf (COTS) and over the counter non-proprietary solution from multiple suppliers for both installation and ongoing maintenance.

2. They do not allow for additional small business contracting opportunities for new installations, upgrades/replacements, and ongoing maintenance. Therefore, this significantly reduces competition.

There is substantial cyber security risk associated with keeping the more than 200 disparate, IP-capable products connected to the BSN and the level of effort required for GSA IT to continue supporting the growing number of product requests. Presently, there are

Cybersecurity and Infrastructure Security Agency (CISA) advisories for currently connected products presenting real cyber vulnerabilities and costly mitigation measures. Utilizing a single enterprise-wide solution that meets the requirements laid out above in Section 3 and thus reducing the number of disparate products permitted to connect to the network will lower cyber risk and enhance GSA’s ability to effectively mitigate and respond to issues. Failure to adopt an enterprise-wide BAS solution meeting the above requirements will lead to an increase in disparate products connected to the network and thereby increase the agency’s cyber security risk over time.

1. The GSA PBS SCRM Organizational Plan

● Version 1.1 of the GSA PBS SCRM Organizational Plan was developed in order to comply with the SECURE Technology Act, and incorporate National Institute of Standards and Technology (NIST) Special Publication 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations and 80 separate SCRM-related requirements identified by CISA.

The GSA PBS SCRM Organization Plan provides the structure, framework and governance for processes and procedures in GSA PBS’s SCRM risk management processes and ensures sound SCRM practices are embedded in all phases of the construction and facilities management lifecycle. As part of the GSA PBS SCRM Maturity Model, GSA PBS identified the following risks within its Smart Building Program, all of which will be mitigated through use of one, enterprise-wide BAS solution:

● disparate products are currently permitted to be connected to the

BSN. These products then enter into a life cycle in which any updated software versions must be assessed, monitored for CISA advisories, and re-assessed at minimum every 3 years.

● Existing BAS solutions that have reached end of life are no longer supported and cannot be upgraded to patch known vulnerabilities. As a result, there are a number of vulnerable systems connected to the network which has increased the risk of cyber attack attempts against GSA's infrastructure.

● The use of third party (or manufacturer provided) proprietary software tools in support of field devices or programming needs requires that each of these software tools must also be scanned and remediated by GSA IT for use on the BSN. Additionally, these tools frequently require the use of out-dated operating systems or plug-ins that may have known IT security vulnerabilities.

2. FITARA

● The FITARA and associated policy issued through OMB Memorandum M-19-19, Data Center Optimization Initiative, directs agencies to analyze “what applications are running in their data centers to facilitate further consolidation and optimization.” Adopting an enterprise-wide solution will allow for the consolidation of BAS Virtual Servers to meet the server reduction requirement in

OMB M-19-19.

3. TCO & Supporting Readiness for Future IT Initiatives

● In addition to consolidation and optimization efforts, OMB M-19-19 instructs agencies to consider the TCO, which includes not only hardware and software acquisition but management and support, communications, training and other productivity losses. Transitioning to an enterprise-wide solution will lower the TCO of the Smart Buildings Program. The current approach is inefficient and requires considerable resources (both in dollars and personnel) to implement and maintain. To date, GSA IT has assessed/scanned hardware and software products since the inception of the BSN, with products in active assessment. Of the assessed, products were permitted to access the BSN. For each disparate product, GSA IT personnel must scan for vulnerabilities, develop Security Assessment Reports, work in conjunction with the manufacturer to correct vulnerabilities and ensure that the devices remain compliant with every system upgrade. Moreover, the lack of an enterprise approach has led to inconsistent maintenance practices which increase not only costs, but potential security vulnerabilities. Implementing an enterprise approach will allow GSA PBS to leverage programmatic Software Maintenance Agreements (SMAs). SMAs allow GSA to better upgrade and support systems and keep them up-to-date with IT Security vulnerabilities. An enterprise-wide BAS solution would make the normalization, planning, and execution of procuring long-term SMAs more efficient and cost effective.

6. Description of efforts made to ensure that offers are solicited from as many potential sources as is practicable.

The current requirement will be solicited using a brand name description for the reasons set forth above. After approval of the justification, OAM intends to post the approved/signed justification pursuant to FAR 6.305. GSA PBS also anticipates adding this to the P100 as a brand name requirement. Annually, GSA PBS will publish via the official government system, SAM.gov, a RFI and this fully executed Brand Name Justification to determine if there are new entrants into the BAS Industry. Should the results of the RFI and published Brand Name Justification determine that the market conditions have changed, this J&A will be rescinded.

7. Determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

Determination of fair and reasonableness of cost will be based upon a complete price analysis and Independent Government Cost Estimate (IGCE) at the individual solicitation level.

Purchases of the Niagara solution will be made on a competitive basis and contracting history has proven to generate fair and reasonable pricing when competitive forces exist.

Tridium releases standard pricing models for all their products every year around March to April. They provide list pricing for each product or software license/feature that is honored by any other manufacturer or vendor who sells Niagara products and services. GSA receives a standard .40 multiplier for these products which translates to 60% off of list price. Any vendor purchasing Niagara products for GSA projects also receives this multiplier nationally.

8. Description of market research conducted and the results.

Market research has been conducted through a Request for Information (RFI) released on March 10, 2023 and posted to GSA Advantage and eBuy (561210 - Facilities Support Services). The RFI was open to responses for twenty-one (21) days and closed on March 31, 2023. There were a total of nine (9) responses to the RFI, five (5) of which responded with a Niagara Framework solution that met the requirements as stated in the RFI. Two (2) responses that failed to meet several of the RFI requirements, while the remaining two (2) responses were from firms that did not propose a solution, and did not meet the RFI requirements, but instead offered teaming solutions with other contractors stating they could meet the requirements.

In addition to the RFI, other PBS led efforts that tie directly to supporting this enterprise-wide BAS solution are as follows:

● GSA PBS and GSA PB-ITS have maintained relationships with the product development and IT security teams of major BAS manufacturers for years which has provided insight and experience with many BAS solutions. Quarterly meetings are held with each manufacturer to track timelines and roadmaps for feature requests, IT security vulnerability mitigation issues, product end of sales/support, bug fixes, and regional problems/issues with software that have been identified. These interactions support that Niagara is the only brand name BAS solution capable of meeting the requirements described above.

● GSA PBS and IT have attended and led discussions at various trade shows over the years that have added additional insight into the various BAS solutions on the market as well as the different IT Security aspects of the systems. These annual and bi-annual trade shows include RealComm/IBCon/CORETech, ASHRAE, CRETech, AHR, and the Niagara Summit.

● GSA has one of the largest and most diverse portfolios of BAS solutions when compared to other Corporate Real Estate owners, with connected facilities in 11 regions.

Both GSA PBS and GSA PB-ITS personnel have accumulated vast experience with all of the various systems connected to the BSN and their capabilities. This experience supports that the Niagara Framework is the only enterprise-wide BAS solution that meets GSA requirements.

The results of this market research showed that the only available solution that could meet both the requirements of GSA PBS and IT for an enterprise-wide BAS solution is the Niagara Framework. All other products fall short on multiple requirements, with the primary concerns being the lack of ability to provide a non-proprietary, wiresheet programming environment, that doesn’t require 3rd party software tools, supports IPv6, and a solution that can be maintained and supported by non-OEM providers and be purchased over the counter and off the shelf. None of the other solutions can meet, nor can they be modified to meet all these requirements at this time. To do so would require the overwhelmingly complicated task of restructuring the sales and support models that these manufacturers currently adhere to as well as incurring the costs associated with creating an external facing training and certification program.

Market research and in-depth systems knowledge of both PBS Smart Buildings and IT has shown that any proprietary flagship offerings from BAS vendors other than Niagara will not meet the requirements of this effort because such platforms can only be serviced and supported by the manufacturer of the product, severely limiting GSA’s ability to openly compete on projects and more importantly on-going support and maintenance of the systems.

GSA PBS has determined the Niagara Framework is the only brand currently on the market that meets all of the requirements listed in Section 3 above.

9. Any other facts supporting the use of other than full and open competition.

Not applicable.

10. A listing of the sources, if any that expressed, in writing, an interest in the acquisition.

See Section 6. As new vendors present themselves to the contracting officer, we will provide them with information which outlines the requirements and provide further information as requested.

11. A statement of the actions, if any, the agency may take to remove or overcome any barriers to competition before any subsequent acquisition for supplies or services required.

GSA PBS will continue to conduct market research to verify that no other products can meet the salient characteristics GSA PBS has identified in Section 3 above. GSA PBS will continue to meet with BAS manufacturers, and, no less than annually, GSA PBS will publish via the official government system, SAM.gov, a RFI and this fully executed Brand Name Justification to determine if there are new entrants into the BAS Industry. Should the results of the RFI and published Brand Name Justification determine that the market conditions have changed, this J&A will be rescinded. Upon determining that there are new entrants into the BAS Industry that meet the salient characteristics outlined in Section 3 above, the P100 and all ancillary Building Automation guidance will be amended to remove the Niagara brand requirement and replaced with a qualified products list.

The Niagara Framework is sold and serviced by nearly every major, large BAS manufacturer, as well as BAS service providers and vendors of all sizes. This enterprise-wide solution will open more doors for small business contract opportunities and encourage more competition, especially related to BAS service contracts. This solution is designed to limit the number of disparate systems connected to the GSA network, but it does not limit the number of contractors or manufacturers who may submit proposals for BAS related projects.

It simply requires these manufacturers and contractors to propose a Niagara Framework BAS solution.

12. Head of Contracting Activity Certification.

I certify that the data supporting the recommended use of other than full and open competition is accurate and complete to the best of my knowledge and belief.

Head of Contracting Activity Date

13. Technical/Requirements Personnel Certification.

I certify this requirement meets the Government’s minimum need and that the supporting data, which forms a basis for this justification, is complete and accurate.

Assistant Commissioner Date Facilities Management

GSA IT - Associate CIO Date

GSA IT - CISO Date

14. Approval.

Competition Advocate Date

Assistant Commissioner Date Acquisition

Senior Procurement Executive Date