JA 20-30 CISCO P-4007 624- Redacted.pdf

DEPARTMENT OF THE NAVY

NAVAL FACILITIES ENGINEERING COMMAND, HAWAII

400 MARSHALL ROAD

JBPHH, HAWAII 96860-3139

J&A No. 20-30

JUSTIFICATION AND APPROVAL FOR OTHER THAN FULL AND OPEN

COMPETITION FOR ONLY ONE RESPONSIBLE SOURCE

SOLICITATION FOR P-4007 CONSOLIDATED TRAINING CENTER,

JOINT BASE PEARL HARBOR-HICKAM, HAWAII AND RENOVATE 624 RSG/ASTS

FACILITY, B4100H, JOINT BASE PEARL HARBOR-HICKAM, HAWAII

1. Contracting Activity.

Naval Facilities Engineering Command, Hawaii (NAVFAC HI), Architect- Engineer Acquisition Division, Joint Base Pearl Harbor-Hickam (JBPHH).

2. Description of the Action Being Approved.

Request approval for the use of the CISCO Industrial Ethernet 2000 Series switches manufactured by CISCO Systems, Inc., for the following combined projects: P-4007 Consolidated Training Center, Joint Base Pearl Harbor-Hickam, Hawaii and Renovate 624 RSG/ASTS Facility, B4100H, Joint Base Pearl Harbor-Hickam, Hawaii.

3. Description of Supplies/Services.

The scope of work for P-4007 is to construct a training annex at Building 4100H, and to perform incidental related work, including HVAC and Direct Digital Control (DDC). The scope of work for Renovate 624 RSG/ASTS Facility is to provide interior and exterior renovations of the existing building, 4100H, and to perform incidental related work to replace the existing HVAC system, including the chiller, air handling unit, pumps, and Direct Digital Controls (DDC). The plan is to connect these buildings to the NAVFAC Hawaii Control System Platform Enclave (CPSE).

As a NAVFAC Hawaii CIO requirement, the NAVFAC Hawaii Control System Platform Enclave (CPSE) is part of NAVFAC’s Enterprise Cybersecure Smart Grid Solution for all NAVFAC maintained industrial control systems, including Direct Digital Control (DDC) systems. The use of CISCO Industrial Ethernet Series switches are required for all projects connecting to the CPSE as the approved Risk Management Framework (RMF)/Authorities to Operate (ATO)-compliant solution.

Devices from other manufacturers do not comply with the RMF/ATO and are not authorized to connect to the CSPE. These switches will be configured and programmed using government-licensed CISCO software.

The estimated cost of construction for the P-4007 project is , of which will be for the procurement of one (1) switch. The estimated cost of construction for the Renovate 624 RSG/ASTS Facility project is , of which will be for the procurement of one (1) switch. The total estimated procurement is .

4. Statutory Authority Permitting Other Than Full and Open Competition.

This request is submitted pursuant to the authority of FAR 6.302-1 and Title 10 U.S.C. 2304(c)(1) – Only one responsible source and no other supplies or services will satisfy the agency requirements.

5. Rationale Justifying Use of Cited Statutory Authority.

In order to provide standardization and interoperability of building control systems, and in support of the Navy’s Smart Grid program, all new building control systems shall be required to connect to the CSPE, which provides cybersecurity services to Facility Related Control Systems (FRCS), and hosts the Smart Grid applicable suite and FRCS software.

The use of CISCO Industrial Ethernet Series switches should be used in order to meet the need for, and achieve the benefits of, standardization and interoperability as follows:

a. Establish and maintain a defensible cybersecurity posture. The rapid emergence of cyber incidents on critical information control systems (ICS), which include FRCS, has the potential to debilitate JBPHH installation mission critical assets, and has catalyzed the need to establish a defensive cybersecurity posture across the shore enterprise. CISCO Industrial networking equipment and their associated applicable configuration is authorized per the ATO and provide for the following:

(1) Cost-effectively reduce Government information technology cybersecurity risks. Avoid the significant costs and delays associated with obtaining a new ATO for the JBPHH FRCS systems connected to CSPE, which due to government information technology cybersecurity risks, is required when additional nonconforming hardware or software is added to the system with resultant changes in the security posture of the system. The process of obtaining a new ATO would significantly delay the operational use of programmable controllers for the affected facility and connection of the facility to the CSPE, resulting in a significant degradation in accomplishment of mission. Similarly, if additional non-conforming equipment and software are added to the CSPE, the associated cybersecurity costs to sustain the inventory of equipment and software to maintain the ATO would increase significantly. Additionally, minimizing the different types of equipment and software permitted on the CSPE avoids incurring additional risks to system operational availability should the NAVFAC Functional Authorizing Official (FAO) determine that additional equipment or software has security vulnerabilities precluding obtaining or maintaining an ATO.

(2) Control Systems (such as networked FRCS) are classified as Platform Information Technology (PIT) systems. Department of Defense Instruction 8500.01 requires that all PIT systems have their cybersecurity controls documented and validated prior to operation and/or deployment. All PIT systems must maintain an ATO from the FAO. Additionally, connection or integration into the CSPE and subsequent Smart Grid requires that FRCS obtain an ATO from the NAVFAC FAO.

ATO’s remain valid for three years as long as the cybersecurity posture of the system does not change. A cybersecurity posture change includes, but is not limited to, system architecture changes or any other changes that increase risk or degrade the security posture. Any cybersecurity posture change must be provided to the FAO that approved/authorized the ATO for impact review on that risk approval. When a cyber posture changes, the PIT system is required to complete the authorization process to obtain a new ATO for the new configuration. The use of different brand programmable controllers or associated configuration or programming software on the CSPE, results in an undesirable, higher number of changes to the cybersecurity posture of the system. Obtaining an ATO is not the end of the process;

maintaining an ATO is also resource intensive, and the effort increases exponentially when additional hardware or software is added to the system (i.e. requires maintaining cybersecurity controls, vulnerability management, system scans/tests, etc.).

b. Maintain a single installation network facilities control and monitoring system so that all controllers and network equipment (i.e. switches) can be monitored, maintained, and programmed from a single central station versus a hybrid system composed of numerous different human machine interfaces (HMI’s) and associated configuration/programming software. A single central station increases operational efficiency, and decreases installation, maintenance, repair, and energy costs. Utilizing hardware products from the same vendor that produced the configuration/programming software eliminates multi-vendor disputes including conflicts, standards, protocols, or performance characteristics if the controller does not function as required.

c. Avoid the significant operational burden and the additional training costs for the maintenance and engineering staff on the configuration, programming, commissioning, operation, and maintenance of controllers from different manufacturers.

Additionally, standardization decreases procurement costs related to the equipment, maintenance, and support contracts for additional manufacturer’s hardware and software, and reduces the maintenance of an additional parts inventory. Maintaining multiple solutions creates unnecessary work and overhead that increases the total costs of ownership and manpower costs.

Assuming other brand name network equipment could be integrated into the installation’s CSPE so as to be fully functional, the significant cyber security risks, operational challenges, added costs (including the costs to reprocure the Installation’s existing inventory), and other disadvantages arising from the use of different brands of controllers outline above are not expected to be recovered through competition.

6. Description of Efforts Made to Solicit Offers from as Many Offerors as Practicable.

Other manufacturers that can provide RMF/ATO-compliant solution for this project include BELDEN, RLH, REDLION, and PERLE. While these manufacturers were considered, they provide their own propriety systems. The only manufacturer that can provide a maintainable and expandable RMF/ATO-compliant solution for JBPHH-wide is CISCO Systems, Inc.

7. Determination of Fair and Reasonable Cost.

The estimated price ( per switch) is comparable and consistent with past prices, and other manufacturers of similar items. The Contracting Officer has determined the anticipated cost to the Government of the supplies/services covered by this J&A to be fair and reasonable.

8. Market Research.

Market research was conducted on 27 August 2020 to determine if there are any vendors who could provide similar items, and to perform a price comparison. The market research found five companies who could provide a similar Ethernet Switch: BELDEN, CISCO, RLH, REDLION and PERLE. Out of all of these switches, the CISCO IE-2000-4TS-G-B Ethernet Switch was the lowest in terms of cost per switch.

Additionally, the CISCO switch is a previously approved RTF/ATO-compliant solution.

9. Other Supporting Facts for Use of Other than Full and Open.

The NAVFAC Hawaii Control System Platform Enclave (CPSE) is part of NAVFAC’s Enterprise Cybersecure Smart Grid Solution for all NAVFAC maintained industrial control systems, and is a highly specialized system. CISCO Industrial networking equipment and their associated applicable configuration is authorized per the RTF/ATO. If other band name equipment were to be integrated into the CPSE, it would result in significant cyber security risks, operational challenges, and additional costs. Additional supporting facts for the cost to the Government that would be duplicated and how the estimate was derived are addressed in above paragraph 5. Rationale Justifying Use of Cited Statutory Authority.

10. List of Sources Interested in the Acquisition. There were no interested sources for this acquisition.

11. Actions taken to remove barriers to future competition.

To evaluate the use of full and open competition for acquiring the same or similar supplies in the future, market research will be conducted for each future project that includes a universal controller configuration to ascertain the availability of new technology that may be capable in meeting the Government’s needs. Should any other potential sources of supply becomes available during the source selection process, the Government will consider each as applicable.

CERTIFICATIONS AND APPROVAL

TECHNICAL/REQUIREMENTS CERTIFICATION

I certify that the facts and representations under my cognizance which are included in this Justification and its supporting acquisition planning documents, except as noted herein are complete and accurate to the best of my knowledge and belief.

Technical Cognizance:

Code Phone Date

Requirements Cognizance:

LEGAL SUFFICIENCY REVIEW

I have determined this Justification is legally sufficient.

CONTRACTING OFFICER CERTIFICATION/APPROVAL

I certify that this Justification is accurate and complete to the best of my knowledge and belief.

Code Phone Date

31 Aug 2020

02 Sep 2020

02 Sep 2020

08 Sep 2020