JA Class 22-14 ALC 16Aug2022_Redacted.pdf

1.

DEPARTMENT OF THE NAVY

NAVAL FACILITIES ENGINEERING SYSTEMS COMMAND, HAWAII

400 MARSHALL ROAD

JBPHH, HAWAII 96860-3139

J&A No_ 22-14

CLASS JUSTIFI CATION AND APPROVAL

FOR USE OF OTHER THAN FULL AND OPEN COMPETITION

Contracting Activity .

Naval Facilities Engineering Systems Command, Hawaii (NAVFAC HI) , Archi t ect- Engineer Contract Division, Jo i nt Base Pearl Harbor Hickam

(JB!:'HH) .

2 . Descri pt i on of the Action Being Approved .

This Cl ass Justification and Approval (CJ&A) authorizes and approves the use of WebCTRL® web-based building aut omat i on system by Automated Logi c Corporation (ALC) on the Contro l System Platform Enclave (CSPE) for Facil i ty Re l ated Control Systems (FRCS) programmable b u ilding controllers . All other aspects of a procurement process is not included in this CJ&A . This CJ&A may support multiple contract actions requiring interface with the identifi ed Instal l ation networked facilities contr ol and monitorin g system at Joint Base Pearl Harbor Hickam (JBPHH) , which includes Pacific Missile Range Faci li ty (PMRF) , l ocated in the State of Hawaii . Authority to act under this class justificati on is authori zed from 01 October 2022 to 30 September 2025 .

3. Description of Supplies/Services.

NAVFAC HI' s Control System Platform Enclave (CSPE) is part of NAVFAC ' s enterprise authorized enclave solution for a l l NAVFAC maintained industrial control systems including Heating, Ventilating , and Air Condi tioning (HVAC) Direct Digital Control (DOC) systems . The use of WebCTRL® web- based building automation system by Automated Logic Corporation (ALC) will be required for all projects that require a connection to the CSPE . The ALC controllers wil l be configured and programmed using government - licensed ALC software . Programmable controllers are categorized as FRCS ' s.

The total est imated cost for the use of ALC equipment through 30 September 2025 is expected not - to- exceed . The cost of programmable building controllers typically represents approximate ly 20 percent of the cost of the total controls installation effort , and is a miniscule percentage of the total cost of any building construction effort . All r equi r ed programmable building controllers are authorized under this CJ&A regardless of method of execution or procurement strategy (i.e., contracted, in- house shop forces , base operating support contracts , or materials supply chain contractor).

Class J&A No. 22-14

4. Statutory Authority Permitting Other Than Full and Open Competition.

This request is submitted pursuant to the authority of 10 U.S.C.

2304(c) (1), only one responsible source and no other supplies or services will satisfy agency requirements.

5. Rationale Justifying Use of Cited Statutory Authority.

JBPHH has a reasonable need for standardization and interoperability of its existing building control systems that will require a connection to the identified installation networked facility control and monitoring system commonly referred to as the CSPE. Applicable United States Government Accountability Office (GAO) Comptroller General decisions have acknowledged the authority of a federal agency to use other than competitive procedures when there is a reasonable need for standardization or interoperability with existing agency equipment or software. GAO has concluded that the government may use other than competitive procedures when there is reasonable need for standardization or interoperability with existing equipment or software, and when it is likely that award to other sources would result in, among other things, substantial duplication of cost to the government that is not expected to be recovered through competition.

To assess the need for standardization and interoperability, JBPHH performed a rigorous Business Case Analysis (BCA) in October 2019 on existing inventory of building control systems connected and not connected to the CSPE. This 2019 business case analysis evaluated the standardization of building HVAC programmable controllers and quantified the annual costs associated with procurement, sustainment of operations and maintenance, and establishment and sustainment of Department of the Navy (DON) cybersecurity requirements. The results of this business case analysis demonstrated that in order to minimize cost and potential cyber vulnerability, the use of ALC brand name programmable building controllers were required for all projects that required a connection to the CSPE and was part of the rationale and justification for the prior CJ&A # 19-18 to use ALC. Per P-804 Facilities Related Control Systems Standardization Strategy (March 2022), the BCA is required to be reviewed every 5 years unless there are significant changes in the business environment. To date, there does not appear to be any significant changes to the environment, and a review of the BCA will be conducted in 2024. The use of ALC brand name will continue to be the required brand for all projects that require a connection to the CSPE.

Additionally, in support of the Navy's Smart Grid program, all new building control systems, unless identified by exception, shall be required to connect to the CSPE, which provides cybersecurity services to FRCS and hosts the Smart Grid applicable suite and the ALC software.

JBPHH requires that programmable building controllers be ALC in order to meet this need for, and achieve the benefits of, standardization and interoperability as follows:

a. Establish and maintain a defensible cybersecurity posture. The rapid emergence of cyber incidents on critical Industrial Control Systems (ICS), which include FRCS, with the potential to debilitate our installation mission critical assets has catalyzed the need to establish a defensive cybersecurity posture across the shore enterprise. JBPHH performed a risk assessment using NIST's Risk Management Framework (RMF) process to obtain an Authority to Operate (ATO) per Department of Defense Instruction 8510.01. An ATO was granted (eMASS ID 14764) on 12 May 2021. ALC programmable controllers and their associated applicable software are authorized per the ATO and provide for the following:

(1) Cost-effectively reduce government information technology cybersecurity risks. Avoid the significant costs and delays associated with obtaining a new ATO for the JBPHH HVAC DOC systems which, due to government information technology cybersecurity risks, is required when additional nonconforming hardware or software is added to the system with resultant changes in the security posture of the system.

The process of obtaining a new ATO would unacceptably delay the operational use of programmable controllers for the affected facility and connection of the facility to the CSPE, resulting in a significant degradation in accomplishment of mission. Similarly, if additional non-conforming equipment and software were added to the CSPE, the associated cybersecurity costs to sustain the inventory of equipment and software to maintain the ATO would significantly increase.

Additionally, minimizing the different types of equipment and software permitted on the CSPE avoids incurring additional risks to system operational availability should the Naval Facilities Engineering Systems Command (NAVFAC) Functional Authorizing Official (FAO) determine that additional equipment or software has security vulnerabilities precluding obtaining or maintaining an ATO.

(2) Control Systems (such as networked FRCS) are classified as Platform Information Technology (PIT) systems. Department of Defense Instruction 8500.01 requires that all PIT systems have their cybersecurity controls documented and validated prior to operation and/or deployment. All PIT systems must maintain an ATO from the FAO.

Additionally, connection or integration into the CSPE and subsequent Smart Grid requires that FRCS obtain an ATO from the NAVFAC FAO.

ATOs remain valid for three years as long as the cybersecurity posture of the system does not change. CIO is continuously monitoring the cybersecurity posture. The ATO is still valid, as the security posture has not changed. A cybersecurity posture change includes, but is not limited to, system architecture changes or any other changes that increase risk or degrade the security posture. Any cybersecurity posture change must be provided to the FAO that approved/authorized the ATO for impact review on that risk approval. When a cyber posture changes, the PIT system normally will be required to complete the authorization process again to obtain a new ATO for the new configuration. The use of different brand programmable controllers, associated configuration or programming software on the CSPE results in an undesirable, higher number of changes to the cybersecurity posture of the system. Obtaining an ATO is not the end of the process;

and maintaining an ATO is also very resource intensive and the effort increases exponentially when additional hardware or software is added to the system (i.e. requires maintaining cybersecurity controls, vulnerability management, system scans/tests, etc.)

b. Be able to maximize utilization of existing government licensed ALC software to configure and program the controllers.

Alternatives, such as those using Java Application Control Engine (JACE) technology can initially provide an RMF/ATO-compliant connection to the CSPE; however, any future maintenance or system expansion will violate their existing RMF/ATO accreditation because the underlying technology and related software connected to the JACE is not accredited. Other contractors do not offer programmable controllers that can be configured/programmed with ALC software.

Although the Building Automaton and Control (BACnet) open protocol is the required communications protocol for all manufacturers' controllers, it only allows for different manufacturers' equipment to share basic point data. It does not allow for software configuration and programming functions to take place between different manufacturers' controllers. For example, manufacturer A's software cannot be used to program manufacturer B's controller. Each manufacturer's proprietary software tools must be used to configure or change the program within a controller.

c. Maintain a single installation network facilities control and monitoring system so that all controllers can be programmed from a single central station versus a hybrid system composed of many different controllers and associated configuration/programming software. This will further operational efficiency and decrease installation, maintenance, repair and energy costs. Utilizing hardware products from the same vendor that produced the configuration/ programming software eliminates multi-vendor disputes regarding conflicts, standards, protocols, or performance characteristics, should the controller not function as required. ALC satisfies JBPHH's requirement, whereas the other JACE type systems do not.

d. Avoid the significant operational burden and cost of having maintenance and engineering staff become proficient with the configuration, programming, commissioning, operation, and maintenance of controllers from different manufacturers. Standardization reduces personnel training costs and decreases procurement costs related to additional equipment, maintenance, and support contracts for another manufacturer's hardware and software, as well as the maintenance of an additional parts inventory. Maintaining multiple solutions is inefficient and creates unnecessary work and overhead that increases the total costs of ownership and manpower costs.

NAVFAC Hawaii technical personnel who performed this business case analysis have determined that for JBPHH and PMRF, the contract actions authorized by this CJ&A will avoid substantial duplication of cost that is not expected to be recovered through competition. Assuming other brand name controllers could be integrated into the installation's CSPE so as to be fully functional, the significant cyber security risks, operational challenges, added costs (including the costs to re-procure the Installation's existing inventory}, and other disadvantages arising from the use of different brands of controllers outlined above are not expected to be recovered through competition.

6. Description of Efforts Made to Solicit Offers from as Many Offerors as Practicable.

A Sources Sought Notice (No. N62478ACQ33FY2212) was issued on 25 April 2022 in SAM.gov in the Contract Opportunities domain. The sources sought requested interested parties to respond to the Notice if they are able to provide a DDC system that can minimize cost and potential cyber vulnerability through standardization and interoperability with the existing CSPE. One response was received; however, the company did not demonstrate meeting the requirements identified in the Notice.

Market research also revealed that other vendors that can provide RMF/ATO-compliant solutions for this project, each with their own proprietary systems, include

However, none of these vendors are able to provide a maintainable and expandable RMF/ATO-compliant solution for JBPHH-wide. Per the BCA and with 60% of the DDC equipment already using the ALC systems and having an existing ATO, switching to any other system will be difficult to install and maintain a new system, and would be very costly.

7. Determination of Fair and Reasonable Cost.

The estimated price is , which is based on a current independent Government Estimate and reflective of current market conditions. Price analysis techniques in accordance with FAR 15 will be utilized by the Contracting Officer to determine price fairness and reasonableness and will be provided and installed through competitively awarded contracts. Should any formal negotiations be required, the Contracting Officer will only accept prices covered by this CJ&A that will be fair and reasonable.

8. Market Research.

a. Market research was conducted between 25 April 2022 to 15 June 2022 to determine if there were any vendors who could provide similar items, and to perform a price comparison. As mentioned in Paragraph 6 above, there were no alternate sources found from the Sources Sought.

b. As discussed in Paragraph 6 above, additional market research found alternate sources for

However, all of these vendors have their own unique proprietary systems that cannot be easily integrated with the existing CSPE upfront without significant initial investment/outlay. The recoverable costs to provide a maintainable and expandable RMF/ATO-compliant system will not be realized at all due to the uncertainties from integrating unknown vendors into the existing CSPE. None of these vendors are able to minimize cost and potential cyber vulnerability through standardization and interoperability with the existing CSPE due to the added costs of maintaining different systems, including maintenance costs, training, parts, vendor support, etc.

9. Actions taken to remove barriers to future competition.

For the reasons set forth in Paragraph 5, NAVFAC Hawaii has no plans at this time to compete future contracts for the types of supplies/services covered by this document. NAVFAC Hawaii will continue to monitor the controls industry to determine if a universal controller configuration becomes available, and if other potential sources emerge, NAVFAC Hawaii will assess whether competition for future requirements is feasible.

CERTIFICATIONS AND APPROVAL

TECHNICAL/REQUIREMENTS CERTIFICATION

I certify that the facts and representations under my cognizance which are included in this Justification and its supporting acquisition planning documents, except as noted herein are complete and accurate to the best of my knowledge and belief.

LEGAL SUFFICIENCY REVIEW

I have determined this Justification is legally sufficient.

CONTRACTING OFFICER CERTIFICATION

I certify that this Justification is accurate and complete to the best of my knowledge and belief.

ECHELON IV COMMANDING OFFICER APPROVAL

Upon the basis of the above justification, I hereby approve the solicitation of the proposed procurement(s) described herein using other than full and open competition, pursuant to the authority of 10 u.s.c. 2304 (cl (1).