DDC CJA_redacted.pdf

DEPARTMENT OF THE NAVY

NAVAL FACILITIES ENGINEERING SYSTEMS COMMAND EUROPE AFRICA CENTRAL

PSC 817 BOX 51 FPO AE 09622-0001

IND/RIZZO ITALIANO:

- Viale Porto, Box 51 ', .,J / Aeroporto Capodichino

80144 Napoli, Italia

J&A-2311

CLASS JUSTIFICATION AND APPROVAL

FOR USE OF OTHER THAN FULL AND OPEN COMPETITION

LContracting Activity.

Department of the Navy, Naval Facilities Engineering Systems Command (NAVFAC) Europe, Africa, Central (EURAFCENT).

2. Description of the Action Being Approved.

Request approval for the use of other than full and open competition, upon the basis of the following class justification and approval (CJ&A) document to use of brand name commercial equipment from Siemens Desigo for Building Control Systems (BCS), a subtype of Facility Related Control Systems (FRCS). This request includes the use of Siemens's programmable building controllers in contract actions requiring interface with the identified Installation networked facilities controls and monitoring systems at Naval Station (NAVSTA) Rota (referred to in this document as "the Installation"). Authority to act under this class justification expires on 10 May 2026.

3.Description of Supplies/Services.

Programmable building controllers are necessary to ensure automatic operations of HVAC equipment (i.e. chillers, air handling units, dampers, valves, etc.). Standardized programmable building controllers are required for all projects that require a connection to the identified installation networked facilities control and monitoring system commonly known as the NAVSTA Rota Facilities DDC System.

Standardized controllers are necessary to improve cybersecurity; to increase operational effectiveness and consistency; and to achieve maximum efficiency by eliminating duplicate training, parts, certificates, and support contracts to comply with NAVFACINST 11000.2.

The Siemens Desigo controllers will be configured and programmed using government-licensed Siemens Desigo software. Programmable building controllers include, but are not limited to, network controllers and routers, digital controllers, zone controllers, VAV controllers, unitary and equipment controllers, and expansion modules.

The total estimated value for the use of Siemens Desigo brand name equipment through 10 May 2026 is $2,800,000.

4. Statutory Authority Permitting Other Than Full and Open Competition.

The statutory authority permitting other than full and open competition is Title 10, U.S.C. 3204(a)(1), as implemented by the Federal Acquisition Regulation (FAR) 6.302-1, "Only one responsible source and no other supplies or services will satisfy agency requirements."

5.Rationale Justifying Use of Cited Statutory Authority.

Standardization of FRCS is required per NAVFACINST 11000.2 for three primary reasons, as further explained below.

Controller standardization is required principally to improve cybersecurity. Programmable building controllers are particularly vulnerable to cybersecurity attacks due to the reach and impact that access to that network could provide an adversary. NAVSTA Rota will significantly improve its cybersecurity posture by creating a standardized environment in which authorization, scanning, testing, monitoring, and patching can be conducted more effectively for cyber defense and response. Additionally, standardization will allow the Government to more efficiently program the controllers from a single central station versus a hybrid system composed of many different controllers from different manufacturers, each requiring its own configuration/programming software. Finally, standardization will assist the Government to achieve maintenance efficiency by eliminating duplicative training, parts, certificates, and support contracts. Based on the above, there is a reasonable need to standardize the controllers at the Installation with both existing and future Navy equipment and software to a single FRCS for the installation.

Siemens brand name controllers are the only logical brand name source available to achieve the required standardization. Siemens currently has the largest percentage of any single brand name at the Installation, with slightly over 70% of all controllers. The remaining percentage is composed ofmultiple different brand names and is not dominated by any single brand name. Over the next three years, the on-going and planned construction projects could add over

This would result in unacceptable delays in meeting the required hardening of the cybersecurity posture per NAVFAC1NST 11000.2.

It is critical for all controllers to be standardized in order to establish and maintain a defensible cybersecurity posture. The rapid emergence of cybersecurity incidents on critical Industrial Control Systems (ICS), which include FRCS, has the potential to debilitate our installation mission critical assets. This, in turn, has catalyzed the need to establish a defensive cybersecurity posture across the shore enterprise.

Inclusion of disparate controllers from multiple manufacturers within a system could change the cybersecurity posture of the system to an extent that delays the ability of the Installation to obtain an Authority to Operate (ATO) for the NAVSTA Rota Facilities DDC System. This is already a time -intensive process, and its delay has the potential to interfere with system operation, as a system cannot be connected to the Control System Platform Enclave (CSPE) before that system has an ATO. This would degrade the mission of the Installation by hindering its ability to utilize the advanced operation monitoring features of IIJ 1. thereby making the whole system vulnerable to cyber attacks.

In order to achieve the optimal effects from the required standardization, all controllers must be the same brand name. Other manufacturers do not offer controllers that can be programmed with Siemens brand name software while still providing full control capability. Although the Building Automation Control Networks (BACnet) open protocol is the required communications protocol for all manufacturers' controllers, it only allows for different manufacturers' equipment to share basic point data. It does not allow for configuration and programming functions to take place between different manufacturers' controllers. The inclusion of controllers from other manufacturers that do not have full compatibility and/or control capability would

In addition, it is critical that all controllers be programmed from a central station in order to enhance operational efficiency, as well as to decrease installation, maintenance, repair, and energy costs.

Inclusion of controllers from disparate manufacturers could result in multi -vendor disputes regarding conflicts, standards, protocols, or performance characteristics should the controller not function as required. Improper functionality would also compromise the cybersecurity posture at the Installation.

It would also present a significant operational burden if maintenance and engineering staff were required to be proficient with the configuration, programming, commissioning, operation, and maintenance of controllers from different manufacturers. Standardization, as planned here, reduces personnel training costs and decreases procurement costs related to additional equipment, maintenance, and support contracts for another manufacturer's hardware and software, as well as the maintenance of an additional parts inventory. Maintaining multiple solutions is inefficient and creates unnecessary work and overhead that increases the total costs of ownership and labor costs.

Finally, the contract actions authorized by this CJ&A will avoid substantial duplication of cost that is not expected to be recovered through competition. As stated above, these added costs include the cost to obtain and maintain an Authority to Operate (ATO), maintenance effort by the Utility and Energy Management department, programmer training, managing accounts, and evaluating controllers for cybersecurity and interoperability in future projects. Standardizing around a manufacturer or product line other than Siemens Desigo would also include the cost to re-procure the Installation's existing inventory. These additional costs are not expected to be recovered through competition. Additionally, even if other brand name controllers could be integrated into the NAVSTA Rota Facilities DDC Systems so as to be fully functional, the significant cybersecurity risks, operational challenges, and other disadvantages arising from the use of different brands of controllers outlined above present an unacceptable risk of mission failure.

6. Description of Efforts Made to Solicit Offers from as Many Offerors as Practicable.

In accordance with FAR 5.201, a Sources Sought announcement was synopsized on the Federal Business Opportunities website at https://beta.sam.gov on 6 JUL 2021, to determine if there are other controllers capable of full functional interface with the existing Siemens Desigo Government licensed software.

The Sources Sought Notice closed on 3 AUG 2021. There were zero responses received from the market, indicating Siemens as the only viable source. Technical expert review conducted in April of 2023 indicates that there have been no significant changes in the market since the sources sought announcement has closed.

7.Detennination of Fair and Reasonable Cost.

An assessment was performed to determine the number of controllers at the Installation and the replacement value of those controllers. The replacement value of the existing controllers at the Installation is approximately $1,200,000.

Furthermore, a business case analysis was performed which evaluated the lifecycle costs associated with operating a system with standardized controllers versus non-standardized controllers. This analysis determined that the annual cost to maintain a standardized system will save the Government over $740,000 per year as compared to a non-standardized system.

The Contracting Officer has determined the anticipated cost to the Government of the supplies/services covered by this CJ&A will be fair and reasonable. The pricing received in response to the request for proposal will be standardized and should not be more than the pricing as annotated on the GSA schedules for which the pool of contractors already provides pricing. Those prices have already been determined as fair and reasonable through the competitive process. The cost associated with a complete replacement is not practicable or cost effective.

8. Actions to Remove Barriers to Future Competition.

For the reasons set forth in Section 5, NAVFAC EURAFCENT does not intend to compete future contracts for the types of supplies/services covered by this document through 10 May 2026. NAVFAC EURAFCENT will continue to monitor the controls industry to determine if a universal controller configuration becomes available. If another potential source emerges, NAVFAC EURAFCENT will assess whether sufficient competition exists and compete the action

The requirement to use Siemens Desigo software to program Siemens Desigo brand name commercial equipment does not restrict who can install, configure, commission, test, maintain, or operate Siemens Desigo controllers. It is the Government's position that there are sufficient providers in the competitive market capable of performing these tasks.

CLASS JUSTIFICATION AND APPROVAL

FOR USE OF OTHER THAN FULL AND OPEN COMPETITION

CERTIFICATIONS AND APPROVAL SIGNATURE PAGE

TECHNICAL I REQUIREMENTS CERTIFICATION:

I certify that the facts and representations under my cognizance which are included in this justification and its supporting acquisition planning documents, except as noted herein, are complete and accurate to the best of my knowledge and belief

TECHNICAL COGNIZANCE:

11 MAY2023

Heather Dorer, PE Date Industrial Control Systems Program Manager

NAVFAC EURAFCENT

REQUIREMENTS CERTIFICATION:

Barry, Forbes Date Design and Construction Business Line Leader

NAVFAC EURAFCENT

LEGAL SUFFICIENCY REVIEW

I have determined this justification is legally sufficient.

NAVFAC EURAFCENT

23 MAY 2023

24May23 Date

Lisa R. Simon Associate Counsel

CLASS JUSTIFICATION AND APPROVAL

FOR USE OF OTHER THAN FULL AND OPEN COMPETITION

CERTIFICATIONS AND APPROVAL SIGNATURE PAGE

CONTRACTING OFFICER CERTIFICATION

I certify that this justification is accurate and complete to the best of my knowledge and belief.

05/24/2023 Date

ECHELON IV CHIEF OF THE CONTRACTING OFFICE CERTIFICATION

I certify that this Justification is accurate and complete to the best of my knowledge and belief.

5/24/2023 Andrew Harris Chief of the Contracting Office

NAVFAC EURAFCENT

Date

ECHELON IV COMMANDING OFFICER CERTIFICATION

Upon the basis of the above justification, I hereby approve the solicitation of the proposed procurement(s) described herein using other than full and open competition, pursuant to the authority of 1OU.S.C.2304(c)(1).

Joseph Harder, Captain, CEC, USN Commanding Officer

NAVFAC EURAFCENT

5/30/2023 Date

Matthew Lewis Contracting Division Director/Officer

NAVFAC EURAFCENT