A.03.10_JnA_18-0017__Scada_(Final)_09-05-2018.pdfAES.pdf

CONTROL NO._18-0017_(1)

PROJECT/EQUIPMENT:(2) US Automation SCADA Vendor

AUTHORITY: (3) 10 U.S.C. 2304(c)(1) & FAR 6.302-1 AMOUNT:$970,000

NAME (Type or Print) TELEPHONE NO Prepared By: Mathena Richard A 816-389-2041

TITLE DATE

Contract Specialist 14-Jun-18 NAME (Type or Print) TELEPHONE NO

Contracting Officer Halterman, Delos 816-389-3503

TITLE DATE

Same as 13 & 14 in J&A (5) Contracting Officer 14-Jun-18 NAME (Type or Print) TELEPHONE NO

Technical (6) Brack, Bradley 816-389-2252

TITLE DATE

PM 14-Jun-18 NAME (Type or Print) TELEPHONE NO

Requirements (6) Wankum, Robin 816-389-5260

TITLE DATE

PM

SIGNATURES ARE REQUIRED BELOW:

I have reviewed this J&A and find the justification adequate to support other than full and open competition

SIGNATURE DATE

Deputy for Small Business (7) NAME (Type or Print) TELEPHONE NO Saulsberry, Arthur 816-389-3927

SIGNATURE DATE

Project Manager* (8) If no PM, use N/A NAME (Type or Print) TELEPHONE NO

Wankum, Robin D 816-389-5260

SIGNATURE DATE

Office of Counsel NAME (Type or Print) TELEPHONE NO Rosa, Joseph 816-3893506

SIGNATURE DATE

DCC/CCC Contracting Chf NAME (Type or Print) TELEPHONE NO Miller, Gwendolyn 816-389-3665

SIGNATURE DATE

Local Advocate for Competition NAME (Type or Print) TELEPHONE NO

Major Pevey, Ryan C. 816-389-3202

JUSTIFICATION REVIEW DOCUMENT FOR OTHER THAN FULL AND OPEN COMPETITION

Control #18-0017

JUSTIFICATION AND APPROVAL

FOR OTHER THAN FULL AND OPEN COMPETITION

1. CONTRACTING AGENCY: Kansas City District, U.S. Army Corps of Engineers, Contracting Division, 601 E. 12th St., Kansas City, MO 64106

2. DESCRIPTION OF ACTION:

Approval is being requested for a new sole source, Firm Fixed Price, contract to US Automation.

The Harry S. Truman and Stockton Controls and Protection Upgrades project includes the design and upgrade of the existing supervisory control and data acquisition system (SCADA) service contract. The services are projected to cost approximately $970,00.00 for language, programming, testing and services. The request is to use US Automation as the sole vendor for SCADA PLC programming. FY18 O&M funds will be utilized. Base plus all three options will not exceed 365 days and are estimated to be $970,000.00 including all options.

3. DESCRIPTION OF SUPPLIES/SERVICES OR NATURE OF CONSTRUCTION:

US Automation to program the new PLCs for the Truman and Stockton SCADA system. The period of performance will be 210 days. The base cost is $700,000.00 and the cost for the three options are (1) Annunciation & SER system estimated cost $200,000.00, (2) Truman main control board panel and pilot light switch supply estimated cost $50,000.00, and (3) Truman meter supply estimated cost $20,000.00. All options to be evaluated and awarded at time of award.

4. AUTHORITY CITED

10 U.S.C. 2304(c)(1), as implemented by FAR 6.302-1(a)(2)(iii). Only One Responsible Source and no other supplies or services will satisfy agency requirements.

5. REASON FOR AUTHORITY CITED:

Background: The SCADA system that is used at Truman and Stockton Lakes is in need of additional automation items and will need to be programmed once installed on the closed network. Each item added to the system will need to work in conjunction with the closed, secured system to ensure the automation works properly and will be synched with the existing system, using the same programming language and that the set-up works in conjunction with the rest of the system for control and is not susceptible to outside agencies. US Automation is the current SCADA contractor and has the requirement to provide support to the SCADA system through the year 2020, per contract number W912DQ17P1022. They have the experience from installing this equipment and understanding the exact programming language used and how the equipment must be set up to minimize any issues with the system. US Automation is required by contract to ensure the system maintains its cyber security requirements. US Automation has the qualifications, required experience with DOD Information Assurance Certification and Accreditation Process (DIACAP) and Federal Information Security Management Act / Federal Information Security Modernization Act (FISMA). US Automation is responsible for the Wonderware program and maintains the system to keep the Governments licensed version up to date.

Justification:

Facts:

• US. Automation has the existing SCADA contract. They are responsible for the cyber security, maintaining the Governments software licensing for the system, maintaining all DOD information security requirements for automation and maintaining contracted personnel that meet the requirements to work on the system.

• US Automation would have to expend funds to verify the work and to correct any conflicts with the system once the hardware was installed and would need the programming language to run tests on the additional components and possibly have to write new language to correct faults. This would cost the Government additional funds not covered by this contract nor be part of the contract US Automation currently has.

• US Automation is the contractor currently responsible for the Harry. S. Truman and Stockton Power Plants.

• US Automation already has all the certification and experience required to install, program and link the new equipment to the existing system.

• US Automation presently maintains the cyber security system for the SCADA system and is charged with maintaining the system.

• Any other contractor would have to work with US Automation to ensure the programming of the equipment, computer language used and the set-up was compatible with the existing system. This is outside the original contract with US Automation and would incur an additional cost and negotiation to their existing contract.

• Contractor other than US Automation would have to have their personnel vetted to ensure there employees are registered in the ATCTS (Army Training Certification Tracking System) and complete DOD Information Assurance Awareness prior to access of the information system.

Assumptions:

• Finding other contractors that have the DOD requirements and letting them have access to the system may interfere with the operation of the system and cause greater or longer system outage based on conflicts with programming language issues.

• That another contractor would not be able to install and program the additional items without causing a disruption and leaving the system vulnerable and having to have the current contractor for the SCADA system correct and sequence the additional components (double work).

• The system would be more vulnerable to cyber-attacks because of differences in company software, and programming differences.

• The contractor may not be familiar with Wonderware program or be current on the upgrades, patches or service packs if they are not working with the software.

• It would be cost prohibitive to hire an outside source to install, program, and configure the additional equipment not covered in the original contract.

Impacts: A delay in the installation or having to work through two separate contracts and contractors to find the issue with the system may leave the power plant in a vulnerable situation.

Paying two separate contractors to work together to de-conflict the system and trouble shoot the system is not acceptable and is not an efficient use of funds. Additional down time to the system will cause the current contractor, US Automation, to come in after the fact to review and verify the programming then fix any problems. This would be estimated at a minimum of three months or longer. For three months this would result in a loss of $150k by creating additional work for US Automation to review the programming and connection points, plus plant staff personnel labor (three persons, one month each). Also, we would have to recertify our Authority to Operate (ATO), which would cost the Government an additional $200k. The total additional cost at a minimum is $350,000.00, not to include review lost from lack of production for three months.

Warranty issues may cause a delay once installation is complete if the programming is not allowing the system to work correctly. According to the PM, Bradley Brack, when multiple programming languages are used it creates problems that become hard to identify which system is causing the issue with components if they are not programmed with the same language. The PM also stated that this will cause delay in identifying warranty issues because it will take longer to identify program issues versus installation/hardware issues.

Additional impacts caused by allowing another contractor to upgrade the SCADA PLC’s include the potential of exposing the system to a cyber security vulnerability. It could take up to a year to scan the full system and show the vulnerabilities. When vulnerabilities are found, the system is down while the units are being repaired. The loss of revenue is approximately $50K per unit, per day. It is estimated a minimum of two months of down time to troubleshoot the issue, which is approximately $3 Million in revenue loss per unit. There are 6 units at Truman and 1 unit at Stockton. By using the current contractor who is familiar with the system and understands how to mitigate the vulnerabilities, the Government is dramatically reducing the risk of down time to the system, and reducing the chances of introducing potential cyber hacks into the system by maintaining one source.

6. EFFORTS TO OBTAIN COMPETITION:

The reason for sole sourcing US Automation is due to the cyber security risks, the specific programming language on the secure system detailed in their contract and the Governments reliability on US Automation to maintain the Governments certifications for those programs. The additional details are described in section 5 above, and impact on the SCADA system. The increased cost associated with correcting a system where another companies initial programming that would need to be de conflicted is cost prohibitive and therefore, no other contractors were considered.

A sources sought was posted to FBO on the 16th of August for 15 days and there were ten responses. Of the ten responses to the sources sought, nine did not have power plant experience that is required or did not meet the requirements for DOD cyber security (DIACAP). Out of the ten only one meets the full requirements, thus there is not an expectation of have adequate competition. The FBO announcement with scope of work is contractor responses are attached.

The contractor emails followed by their capability statements/submittals are provided following the FBO attachment (labeled SCADA JnA Sources Sought annex).

The J&A will be posted in accordance with PGI 206.305 within 14 days of award.

7. ACTIONS TO INCREASE COMPETITION:

If the cyber security impacts and risks can be mitigated by using more than one contractor in the future then the Government will open competition. If Government did a complete full SCADA system replacement instead of replacing parts of the system, like we are doing now, then

Government would have no reason to sole source. However, the scope is not for a completely new SCADA system, just an upgrade to certain components. When the contract for SCADA services is competed it will be competed as 100% small business based on past market research.

The current contractor will be able to submit a bid to continue the service or will have to transition the service to a new contractor that will be responsible for the certification, Government requirements and maintainence of the system. Only the authorized contractor personnel and required Government personnel will be able to have access to the system. When the SCADA system is next advertised it will be determined at that time if a new system is required, or if the current system still meets the requirement, and will be solicited accordingly.

The contractor personnel will have the responsibility for maintaining the system and providing the software and hardware updates, upgrades, fixes, patches and service packs to bring and keep the Government’s licensed versions up to date in accordance with the terms and conditions of the contract and DOD information assurance certifications. The current contract is scheduled to be re-solicited at the end of 2020.

8. MARKET RESEARCH:

Due to the cyber security risk and justification based on the issues described in paragraph 5 above, market research was not performed.

9. INTERESTED SOURCES:

Due to the cyber security risk and justification, market research was not performed.

10. OTHER FACTS:

The current SCADA maintenance contract scope is different from this project’s scope. A review of the contract W912DQ-17-P-1002 shows the contract was competed 100% small business and no further exclusions were used. US Automation as a small business does not subcontact this work. The additional systems upgrade the Government does not have an existing contract to compare it to. We are adding additional components to the system which are not covered in the original contract.

11. TECHNICAL CERTIFICATION: Include the following statement:

I certify that the supporting data under my cognizance which are included in the justification are accurate and complete to the best of my knowledge and belief.

NAME: _ Bradley T. Brack ________________ DATE: _________________________

TITLE: _Project Manager ___ SIGNATURE: ___________________

12. REQUIREMENTS CERTIFICATION: Include the following statement:

I certify that the supporting data under my cognizance which are included in the justification are accurate and complete to the best of my knowledge and belief.

NAME: _ Bradley T. Brack ____________ DATE: _________________________

TITLE: __Project Manager____ SIGNATURE: ___________________

13. FAIR AND REASONABLE COST DETERMINATION:

"I hereby determine that the anticipated cost or price to the Government for this contract action will be fair and reasonable. Based on the anticipated cost, a determination of fair and reasonableness will be made in accordance with FAR 15.404(b)(2)(iv) and FAR 15.404(b)(2)(v)”

NAME: _Delos C. Halterman_ DATE: _________________________

TITLE: Contracting Officer SIGNATURE: _________________

14. CONTRACTING OFFICER CERTIFICATION:

"I certify that this J&A is accurate and complete to the best of my knowledge and belief."

NAME: __Delos C. Halterman__________ DATE: _________________________

TITLE: Contracting Officer SIGNATURE: ___________________

5 September 2018

5 September 2018

APPROVAL

Based on the foregoing justification, I hereby approve the procurement of SCADA PLC Upgrades for Harry S. Truman and Stockton Lake Power Plants, on an other than full and open competition basis pursuant to the authority of 10 U.S.C. 2304(c)(1) FAR 6.302-1(a)(2)(iii), Only One Responsible Source and no other supplies or services will satisfy agency requirements, and provided property and services. herein described have otherwise been authorized for acquisition.

NAME: DENVER S. HEATH DATE: _________________________

TITLE: Alternate Advocate for Competition SIGNATURE: ___________________