138CES - CONTROLS SYSTEM CONTRACTING LANGUAGE and RESPONSIBILITIES.docx

138CES Controls System Contracting Language and Responsibilities (Created from AFGM2018-32-01)

Procurement, installation and configuration must follow AFGM2018-32-01 9 May 2018 (Provided by the Tulsa ANG). All references, paragraphs and sections listed herein refer back to the primary document (AFGM2018-32-01). This document is not all inclusive of the requirements set forth in the AFGM2018-32-01, but is provided to define the responsibilities of each party “Vendor” and “Tulsa ANG” respectively and in cooperation in meeting the requirements stipulated in the primary document.

3.3.2. “Projects (e.g., MILCON, SRM, etc.) must follow existing standards and policies to incorporate cybersecurity and associated costs into all phases of product/service delivery: contract language, design, development, test and evaluation, integration, execution, construction, operation, maintenance, sustainment, upgrade, or replacement. These existing standards and policies include DFARS 252.204-7012, this Guidance Memorandum(AFGM2018-32-01) , UFC 4- 010-06, NIST SP 800-82r2, NIST SP 800-53r4 and r5 (draft), and the best practices from the Department of Homeland Security (DHS)’s Cyber Security Procurement Language for Control Systems.”

3.3.3. Add newly-installed or acquired Controls System, CS, to the installation’s inventory (section 3.1). (Vendor to provide complete installation inventory)

3.3.5. Contractor is to comply with required on-site maintenance per section 3.9.

3.3.6. Tulsa ANG prohibits the connection of removable media (refer to section 3.11) to a CS or CS network enclave other than as described in section 3.9.4.

3.3.7. Vendor is to provide (1) copies of operator, administrator, and/or maintenance manuals, (2) copies of the system’s topology, hardware/software inventory, and configuration, as well as (3) training described in specifications. (Vendor to provide)

3.3.8. Vendor is to perform an initial security assessment, a scan of vulnerabilities, to provide a copy of the scan results, and to mitigate the identified vulnerabilities prior to final acceptance of the Tulsa ANG. . (Vendor to provide)

Do not procure new CS using a Part 15 radio frequency device. (Vendor to provide fully functional system without reliance on RF)

[ If RF is employed: Check radio frequency devices to ensure data is encrypted;

Any data transmitted by Wi-Fi devices, services, and technologies shall follow IEEE Standard 802.11-2016 per DoDD 8100.02, DoDI 8420.01, NIST SP 800-97, and DHS’s Guide to Securing Networks for Wi-Fi.

ATOs will not be approved for systems using Bluetooth. (Vendor to provide fully functional system without reliance on Bluetooth)

For use of radio frequency, approval is required before the purchase, testing, deployment, and usage of the system. ]

3.4.3.5. All commercial Internet connections are prohibited(Vendor to provide fully functional system without reliance on commercial internet connections)

3.4.4. Unnecessary Protocols. Any form of connectivity or communication protocol that is not used, not necessary for the function of the system, and not explicitly approved shall be disabled across all components of the CS down to the end device (Vendor to provide list of all ports & protocols used, their function to the system, at what locations they are employed in the system, and what detriment would be caused if not utilized. Vendor will work with Tulsa ANG to ensure any unneeded protocols are turned off.)

3.6.1. Hubs. The use of hubs is not permitted. (Vendor to provide fully functional system without reliance on hubs)

3.6.2. Unmanaged switches are not permitted. (Vendor to provide fully functional system without reliance on unmanaged switches)

3.6.2.1. Switches shall have physical security measures (refer to section 4.3). Ensure switches are stored in a lockable, secure area/cabinet.

3.6.4. For any device that has a Security Technical Implementation Guide applicable to them, follow the guide to apply the proper security controls and configurations. (Vendor to configure according to STIG or relay sufficient information to Tulsa ANG as to why STIG requirements cannot be used.) (STIGs will be provided by the Tulsa ANG)

3.7.1. Use whitelisting software as a preferred mitigation approach per NSA’s Guidelines for Application Whitelisting Industrial Control Systems. (Vendor to configure according to whitelisting guidance or relay sufficient information to Tulsa ANG as to why requirements cannot be used.)

3.7.4. Ports / Services. Because the specific function of dedicated CS devices shall be determined and documented,

3.7.4.1. (U) Disable all unused ports and services on CS devices after testing to ensure the CS’s operation is not affected. (Vendor to provide list of all ports & services used, their function to the system, at what locations they are employed in the system, and what detriment would be caused if not utilized.)(Vendor will test systems before and after disabling ports or services to ensure functionality needed is still present.)

3.7.5. (U) Eliminate these applications from back-up or recovery software. (Vendor responsibility during install, configuration, and testing, until acceptance) (Tulsa ANG responsibility to maintain after acceptance of system)

3.8. (U//FOUO) no patching is allowed for CS unless directed by the AO in consultation with the SCA.

3.9. (U//FOUO) On-site Maintenance. At this time, unless specifically authorized per section 3.8, on-site maintenance cannot include patching or upgrading software.

3.9.1. Vendor shall leave a copy of their maintenance service record with the ISO detailing the work done on the CS and any repairs. (Vendor responsibility to provide detailed logs & Service records)

If authorized, on-site maintenance using a government-owned asset shall be accomplished using the following procedures:

3.9.4.1. (U) Download digitally-signed or hashed software from trusted authoritative sources to a CD/DVD. (Vendor responsibility to provide)

Remote Maintenance.

3.10. When on-site maintenance and support (per section 3.9) cannot be accommodated, remote maintenance access to CS is allowed as an option of last resort only and if included as part of an approved ATO for the CS. Additionally, at this time, unless specifically authorized per section 3.8, remote maintenance cannot include patching or upgrading software. (Tulsa ANG wishes to follow this with strict adherence.) (Vendor responsibility to provide irrefutable justification as to why remote maintenance should be allowed before being granted this permission. Vendor to acknowledge this would be a case by case basis, and NO remote access pathways would be left in place. They would need to be established for each occurrence of remote maintenance.)

3.11. – 3.12. Removable media is not to be connected to a CS or CS network enclave Handheld Personal Devices. The use of a Personal Data Assistant, Portable Electronic Device, or other handheld devices (e.g., smart phones, thumb drives, or solid state hard drives…) to access, monitor or control CS is not authorized. (Vendor to acknowledge)

Password / User Accounts.

4.2.1 Ensure all personnel are educated on their responsibility for password/account protection. (Vendor responsibility during install, configuration, and testing, until acceptance) (Tulsa ANG responsibility to maintain after acceptance of system)

4.2.2. Eliminate the use of default usernames and passwords. (Vendor responsibility during install, configuration, and testing, until acceptance) (Tulsa ANG responsibility to maintain after acceptance of system)

4.2.2. all new passwords will follow requirements in DoDI 8520.03 and AFMAN 17-1301 para 8.5. (Vendor responsibility during install, configuration, and testing, until acceptance) (Tulsa ANG responsibility to maintain after acceptance of system)

4.2.3 Do not share passwords. (Requires individual authentication) (Vendor responsibility during install, configuration, and testing, until acceptance) (Tulsa ANG responsibility to maintain after acceptance of system)

4.2.4. Review all user accounts and delete those accounts that are unused(Vendor responsibility during install, configuration, and testing, until acceptance) (Tulsa ANG responsibility to maintain after acceptance of system)

4.2.5. Apply the “principle of least privilege” to limit(Vendor responsibility during install, configuration, and testing, until acceptance) (Tulsa ANG responsibility to maintain after acceptance of system)

4.2.6. Authentication mechanisms and lock out controls shall not be diminished(Vendor responsibility during install, configuration, and testing, until acceptance) (Tulsa ANG responsibility to maintain after acceptance of system)

Physical Access.

Data Storage and Disposal.

4.4.1. Apply security techniques such as encryption and/or cryptographic hashes to CS data storage and communications where determined appropriate(Vendor responsibility to provide a mechanism for doing this and to maintain during install, configuration, and testing, until acceptance) (Tulsa ANG responsibility to maintain after acceptance of system)

Response and Recovery Plans.