15. Draft DHA PM Standard Isolation Architecture for Cybersecurity of FRCS.DOCX

DEFENSE HEALTH AGENCY

7700 ARLINGTON BOULEVARD, SUITE 5101

FALLS CHURCH, VIRGINIA 22042-5101

DHA-PM 18-00x January 3, 2019

MEMORANDUM FOR ASSISTANT SECRETARY OF THE ARMY (MANPOWER

AND RESERVE AFFAIRS)

ASSISTANT SECRETARY OF THE NAVY (MANPOWER

AND RESERVE AFFAIRS)

ASSISTANT SECRETARY OF THE AIR FORCE (MANPOWER

AND RESERVE AFFAIRS)

SUBJECT: Procedure Memorandum 18-00x, Standard Isolation Architecture for Cybersecurity of Facility-Related Control Systems (FRCS).

References: See Attachment 1.

Purpose. This Defense Health Agency Procedures Manual (DHA-PM), based on the authority of References (d) and (e), and in accordance with the guidance of References (a-jj), establishes the Defense Health Agency (DHA) guidance for cybersecurity of FRCS within government facilities supporting the military health system. See Attachment 2.

Applicability. This DHA-PM applies to DHA and DHA activities. See Attachment 3.

Policy Implementation. It is DHA instruction pursuant to References (d) and (e) that the DHA will implement procedures for assessing and mitigating cyber risk within existing military healthcare facilities through awareness programs, management strategies and technological solutions. See Attachment 4.

Responsibilities. See Attachment 5.

Procedures. See Attachment 6.

Releasability. Cleared for public release. This manual is available on the DHA Website at https://www.health.mil/About-MHS/OASDHA/Defense-Health-Agency/Resources-and-Management/DHA-Publications

Effective Date. This DHA-PM:

· Is effective with projects funded by Fiscal Year 2019 Appropriations

· Will expire 10 years from the date of signature if it has not been reissued or cancelled before this date in accordance with DHA-Procedural Instruction 5025.01 (Reference (m)).

Attachments:

As stated cc:

Principal Deputy Assistant Secretary of Defense for Health Affairs Surgeon General of the Army Surgeon General of the Navy Surgeon General of the Air Force Medical Officer of the Marine Corps Director, Health, Safety, and Work-Life, U.S. Coast Guard Surgeon General of the National Guard Bureau

ATTACHMENT 1

REFERENCES

a. ANSI Publications, ANSI/ISA-TR99.00.01-2007

b. ASHRAE Publications, ASHRAE 90.1-2013, -. Referenced in WBGCNSSI 1253, Security Categorization and Control Selection For National Security Systems 2014

c. BSCI Publications, https://www.bicsi.org

d. Department of Defense Instruction 8500.01, Cybersecurity, March 2014 (available online at https://iase.disa.mil/policy-guidance/Pages/index.aspx)

e. Department of Defense Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT), March 2014 (available online at https://iase.disa.mil/policy-guidance/Pages/index.aspx)

f. Department of Defense Instruction 8140 Cyberspace Workforce Management (available online at https://iase.disa.mil/policy-guidance/Pages/index.aspx)

g. Department of Defense Instruction 8530 Cybersecurity Activities Support to DoD Information Network Operations March 2016 (available online at http://www.dtic.mil/whs/directives/corres/ins1.html

h. Department of Defense Industrial Control Systems Advanced Tactics, Techniques and Procedures Feb 2017 (available online at https://www.wbdg.org/files/pdfs/aci_ttp_rev1_2017.pdf)

i. Department of Defense Handbook for Self-Assessing Security Vulnerabilities & Risks of Industrial Control Systems on DoD Installations

j. Department of Veterans Affairs Office of Information & Technology Design Guide 2011

k. Department of Veterans Affairs Telecommunications and Special Telecommunication Design Manual (TDM) 01-2016

l. DHA-Procedural Instruction 5025.01, August 21, 2015

m. EO 13636 - Improving Critical Infrastructure Cybersecurity, February 12, 2013

n. EO - On Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, May 11, 2017

o. ISA/IEC 62443 Security for Industrial Automation and Control Systems.

p. ISO Publications, ISO/NP 14813-2 Transport Information and Control Systems – Reference Model Architectures for the TICS Sector.

q. National Institute of Standards and Technology Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems, February 2010

r. National Institute of Standards and Technology Special Publication 800-82 R2 Guide to Industrial Control Systems (ICS) Security 2015

s. National Institute of Standards and Technology Special Publication 800-53 R5 Security and Privacy Controls for Federal Information Systems and Organizations

t. National Institute of Standards and Technology Special Publication SP 800-115 Technical Guide to Information Security Testing and Assessment 2008

u. National Institute of Standards and Technology Special Publication 800-12, An Introduction to Information Security

v. National Institute of Standards and Technology Special Publication 800-88 Revision 1, Guidelines for Media Sanitation, 2014

w. National Institute of Standards and Technology Special Publication 800-160, Systems Security Engineering Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems, 2016

x. National Institute of Standards and Technology Special Publication 800-41, Guidelines on Firewalls and Firewall Policy, 2009

y. National Institute of Standards and Technology Special Publication 800-116, A Recommendation for the Use of PIV Credentials in Physical Access Control Systems (PACS)

z. Unified Facility Criteria 3-580-01 Telecommunications Interior Infrastructure Planning And Design June 2016

aa. Unified Facility Criteria Design 4-510-01 Military Medical Facilities 2019

ab. Unified Facility Criteria Design 4-010-06 Cybersecurity of Facility-Related Control Systems 2016.

ac. USACE Technical Criteria for the Installation Information Infrastructure Architecture, February 2010

ad. UFGS 25 10 10, Utility Monitoring And Control System (UMCS) Front End And Integration (available online at www.wbdg.org)

ae. National Fire Protection Association (NFPA) 101 Life Safety Code 2015

af. Industrial Internet Consortium, industrial Internet Reference Architecture, Version 1.7, 2015.

ag. Industrial Internet of Things Volume G4: Security Framework, 2016

ah. RAMI - 4.0, The Platform Industrie 4.0 (I4.0) 2015

ai. Department of Defense Instruction 3020.40, Mission Assurance (MA), November 29, 2016 (available online at www.dtic.mil)

aj. Department of Defense Manual 3020.45, Defense Critical Infrastructure Program (DCIP), May 24, 2010 (available online at www.dtic.mil)

ATTACHMENT 2

PURPOSE

This DHA-PM:

a. Provides the Standards for Cybersecurity of Building Communications, Electronic Safety and Building Control Systems in the planning, design, construction of FRCS in facilities hosting DHA activities and/or operations.

b. Defines the procedures to establish Standard Isolation Architecture for DHA FRCS and implements the DoDI 8530.01 Cybersecurity Activities Support to DoD Information Network Operations.

c. Is based on the Risk Management Framework (RMF) process outlined in Department of Defense Instruction (DoDI) 8500.01- Cybersecurity, DoDI 8510.01 - Risk Management Framework (RMF) for DoD Information Technology (IT), UFC 04-010-06 – Cybersecurity of FRCS, and additional RMF guidance posted on the DoD CIO RMF Knowledge Service Energy, Installations and Environment FRCS webpage.

d. Standardizes the processes within DHA to achieve costs savings, improve overall quality installation, and maximize returns on information technology and facility investments. Reduces costs and improves cybersecurity for DHA FRCS by focusing on planning, programming standards and criteria, and outfitting facilities to provide the most strategic cybersecurity defense in depth for the DHA.

e. Is based on best practices within cybersecurity such as safety, security and resilience.

f. Establishes cybersecurity techniques and procedures that utilize a common set of policies for people, processes, strategy, and technology for protecting FRCS.

g. Provides training and education guidance for Facilities Workforce members on the knowledge and tools needed to effectively manage and protect mission critical and/or life safety systems within the DHA.

DHA will:

a. Make every effort to protect facilities from cyber-attacks by requiring facilities in design, construction or operational status to adhere to a dynamic set of cybersecurity principles based on latest thinking and cybersecurity industry best practices. Guidance for this document can be found in Attachment 1 and through input offered by functional experts within the tri-services and industry partners.

b. Carry out its mission to implement a Cybersecurity program based on the availability of funding within the program under which the control system was purchased and/or is maintained.

c.

ATTACHMENT 3

APPLICABILITY

This DHA-PM applies to:

a. DHA occupied, sustained or maintained on-base assets containing systems that monitor and control building operations. These systems control access, monitor alarms and regulate building climate.

b. A designer, developer or operator, who is either military, civilian, or contractor, who supports work in the development, maintenance and operation of DHA FRCS systems and Military Construction (MILCON) Projects.

c. Personnel who manage risk and protect DHA networks and Information Systems (IS).

ATTACHMENT 4

POLICY IMPLEMENTATION

This DHA-PM:

a. Updates assigned responsibilities. Establishes procedures for DHA FRCS.

b. Establishes common business practices in design, implementation and management of DHA FRCS.

c. Follows the policy and guidance documents that lay out Cybersecurity process and procedures, including the National Institute of Standards and Technology (NIST) Standards in the enclosed references (See Attachment 1).

ATTACHMENT 5

RESPONSIBILITY

1. CHIEF, CYBERSECURITY DIVISION FOR DHA. The Chief shall:

a. Implement procedures to process Authority to Operate (ATO) packages and assist in developing guidance, procedures, and requirements related to achieving DoD Cybersecurity goals and objectives.

b. Provide consulting services for use by DHA Facilities Division and assist with certification requirements for the DHA IT/FRCS workforce as well as implementation and sustainment requirements, including the necessary supporting tools and resources.

c. Provide IT support for the necessary security features of the Isolation Architecture (IA).

d. Ensure that the Medical Community of Interest (Med-COI) configuration and the Isolation Architecture will provide a defendable and monitored space protecting the DHA FRCS network from vulnerabilities with Defense-in Depth (DiD) configurations.

e. Draft, maintain and administer security policies related to FRCS, to include the following:

· Access Policy;

· Connection Policy;

· Change Management Policy. Note: Local Change Management Policies must consider Mission Assurance categorization as documented on an approved Mission Assurance Asset List (MAAL);

· Threat Development Policy; and

· Overall, coordinated Incident Response Procedure Policy.

f. Collaborate with DHA Facilities Enterprise and Health Information Technology (HIT) to ensure proper implementation of features unique to DHA FRCS that are atypical within traditional IT systems.

2. DIRECTOR, FACILITIES DIVISION FOR DHA. The Director shall:

a. Support facilities capabilities at the Med-COI Network Operations Security Center

(NOSC).

b. Develop guidance, procedures, and requirements related to achieving DoD Cybersecurity goals and objectives with respect to facility-related control systems.

c. Inform Cybersecurity Division of new facility projects. Standardize the format and process to submit ATO packages to Cybersecurity division.

d. Draft, maintain and administer security policies related to DHA FRCS. Collaborate with DHA Cybersecurity Division and Health Information Technology to ensure proper implementation of features unique to FRCS that are atypical within traditional IT systems.

e. Develop policies and procedures to enable:

· FRCS training;

· Password Policy;

· FRCS Incident Response Procedure Policy; and

· Inventory Management.

f. Develop, in collaboration with other Directorates as required, RMF packages and necessary artifacts to obtain an ATO.

g. Maintain an accurate and detailed inventory of FRCS, their interconnections and the mission or function they serve.

3. DIRECTOR, HEALTH INFORMATION TECHNOLOGY (J6) FOR DHA. The Director shall:

a. Serve as the Authorizing Official (AO) for ATO packages as delegated in DoDI 8500.01.

b. Advise Facility and Cybersecurity Divisions on IT engineering, architecture and other related services in addition to providing general, traditional IT services such as storage and cryptography.

c. Design, implement, manage and operate the Level 3 Boundary Protection Demilitarized Zone (DMZ) and FRCS Levels 4 and 5.

d. Design, implement, manage and operate the Test and Development Environment (TDE) used for Factory Acceptance Testing (FAT) and Site Acceptance Testing (SAT) testing, to validate patches, software updates, other approved changes and revised Security Technical Implementation Guide (STIG) configurations.

4. COMMANDER or DIRECTOR. The Commander or Director shall:

a. Defend information networks, secure data, and mitigate risks to the mission by adhering to the DHA guidelines when implementing facility cybersecurity measures for existing buildings.

b. Implement a program to ensure adherence to DHA Cybersecurity guidelines. Implement periodic inventories, and audits to identify vulnerabilities and gaps in the DHA FRCS as well as enforce the local change management procedures.

c. Advocate for funding to implement DHA Cybersecurity guidelines, close Cybersecurity gaps and mitigate Cybersecurity vulnerabilities.

5. DHA FACILITY MANAGERS. The Facility Managers shall:

a. Coordinate, conduct and maintain accurate inventories of all devices within the IA in accordance with applicable policies and standards for FRCS inventories. This may include hardware (physical devices and systems) and software (communications platforms and applications) Level 2 to Level 0 within the IA. Maintain accurate documentation of the network boundary, data flow diagrams and ports, protocols and services used within the FRCS.

b. Follow the RMF process outlined in UFC 4-010-06, DoDI 8500.01, and DoDI 8510.01.

c. Be responsible for the system and data of FRCS.

d. Reference the Energy, Installations and Environment (EI&E) Platform IT (PIT) Control System Master List for determining the preliminary impact values for the RMF “Step 1 -Categorize System” process.

e. Collaborate with the Acquisitions community to accurately define security requirements and prioritize FRCS acquisitions with cybersecurity measures already incorporated into the design of the asset.

6. DHA PROGRAM MANAGERS. The DHA Program Managers shall:

a. Be responsible for the DHA Facilities Installation Contractor submittals, FAT, SAT, Penetration Test (PENTEST), and Commissioning reports provided by the Agent.

b. Be responsible for these procedures and guidelines as the minimum standard Level of Cybersecurity Service for the DHA operated, or managed on-base and lease assets.

c. Be responsible for following the RMF process outlined in UFC 4-010-06, DoDI 8500.01, and DoDI 8510.01.

d. Collaborate with the Acquisitions community to accurately define security requirements and prioritize FRCS acquisitions with Cybersecurity measures already incorporated into the design of the asset.

e. Advocate for funding to implement DHA Cybersecurity guidelines, close Cybersecurity gaps and mitigate Cybersecurity vulnerabilities.

ATTACHMENT 6

PROCEDURES

1. FACILITY-RELATED CONTROL SYSTEMS BACKGROUND

a. FRCS are integrated hardware and software designed to monitor and control, the operation of equipment, infrastructure, or associated devices. FRCS consist of a combination of technology such as computers / servers and Human-Machine Interfaces (HMI) plus control components such as electrical switches, mechanical actuators, and sensors that act together upon underlying equipment to achieve a physical objective. Various categories of FRCS include the following:

1) Supervisory Control and Data Acquisition (SCADA) Systems. Highly distributed systems used to monitor and control geographically-dispersed assets where centralized data acquisition, control, and status reporting are critical to system operation.

2) Distributed Control Systems (DCS). Used to control specific processes within a facility. DCS are integrated control architectures that provide supervisory-level control and integration over subsystems responsible for local process control.

3) Programmable Logic Controller (PLC). Proprietary processor-based, solid-state devices found in almost all control equipment and processes to provide logic algorithms for connected input and output devices. They can vary in sophistication from simple, stand-alone microcontrollers to sophisticated, multi-processor controllers that provide advanced motion control, network capability, error detection, diagnostics, process recovery, and fail-safe redundancy. While a PLC is a component of DCS and SCADA systems, it is often the solitary control device for smaller FRCS configurations used to provide operational control of separate processes.

b. Historically, FRCS were neither automated nor networked and, in general, fundamentally lacked desired IT features such as cryptographic capabilities, logging, and password protection. Devices used for monitoring or control had no computing resources and those that were digitized typically used proprietary protocols and PLCs rather than full computer control. As controllers became interconnected, they were not designed with traditional IT system and security considerations, as they were expected to operate as isolated systems running on their own dedicated network with proprietary communication protocols and specialized hardware and software. This intentional separation from traditional IT (e.g., email, web access, networked printing, or remote access) allowed FRCS to be easily connected, open and accessible, highly stable, deterministic and readily serviced. Today, however, FRCS are designed using standard platforms, operating systems, network protocols, and access controls commonly found in traditional IT systems. The ever increasing connectedness of FRCS allows for greater operational capabilities, efficiencies, and automation. However, this integration also introduces new vulnerabilities that expose both the FRCS and the underlying network to threats.

c. Special precautions must be taken when introducing IT security controls and solutions to FRCS environments because of the unique ways FRCS communicate and operate. Interconnections between FRCS and organizational networks/business systems are a particular point of focus for security and should be carefully considered. In all cases, security solutions must be tailored to the specific FRCS environment and verified to ensure their impact to the FRCS is not detrimental to the operation of FRCS.

d. FRCS can have long life spans (often exceeding 20 years) and can be comprised of technology that suffers rapid obsolescence. This longevity introduces several issues. Most importantly, older hardware and software may no longer be supported by the manufacturer. Companies can go out of business or terminate their support for an installed product. Because of this, patches and forward support for compatibility with new operating systems may no longer be available as new vulnerabilities are discovered.

e. In the traditional IT domain, where data is the preeminent priority, cyber defenders often focus on preventing the disclosure of information to unauthorized individuals or processes. Consequently, confidentiality tends to be the most important attribute among the three properties of the confidentiality-integrity-availability (CIA) triad. However, with FRCS, it is paramount to actively manage or monitor physical processes and maintain high availability and positive control of the system. Therefore, availability and integrity of the FRCS take precedent over confidentiality. It is this difference in cybersecurity priorities that impacts what security controls and procedures are appropriate to implement for FRCS compared with those of traditional IT.

f. Networked FRCS are those systems which have multiple controllers and can have both traditional IP traffic at Level 3 and up, and traditional IP along with other ethernet and serial traffic at the lower levels. Depending on the age and type of CS, these CS may have the capability for remote monitoring, and/or existing vendor service level agreements may recommend remote access. A Business to Business (B2B) agreement is required for remote access and monitoring. There are two types of networked FRCS:

1) Internally Networked (IN), also designated as Stand-alone Information Systems (SIS) which have multiple components networked together but does not have a network connection to anything that is not part of the control system; and

2) Externally Networked (EN), where the control system has multiple components networked together and does connect to a network that is not part of the control system.

g. Non-networked FRCS are generally those that consist of a single controller and do not have the capability for remote monitoring.

2. SYSTEMS CATEGORIZATION AND DEFINITIONS

a. Systems are defined by the Office of the Assistant Secretary of Defense (OSD) for Energy, Installations, and Environment (EI&E) eMASS Control Systems Master List. Systems not listed are not exempt from categorization.

b. System designers and system owners will develop a list of systems requirements that will support the functional operations of the facility.

c. Data shall be classified in accordance with NIST SP 800-60.

(1) Most common FRCS information types with escalated handling or separate security control overlay requirements include:

· C.3.2.5 Payments Information Type. Credit card and financial transactions.

· C.3.3 Human Resource Management. Personally Identifiable Information (PII).

· D.14 Heath Information Types. Health Insurance Portability and Accountability Act of 1996 (HIPAA) Protected Health Information (PHI).

(2) Other FRCS information types may include:

· C.2.8.12 General Information

· C.3.1.1 Facilities, Fleet, and Equipment Management Information Type

· C.3.4.2 Inventory Control Information Type

· C.3.5.8 System and Network Monitoring Information Type

· D.4.4 Emergency Response Information Type

· D.7.1 Energy Supply Information Type

· D.7.2 Energy Conservation and Preparedness Information Type

· D.7.4 Energy Production Information Type

· D.13.1 Training and Employment Information Type

· D.13.3 Worker Safety Information Type

· D.14.3 Healthcare Administration Information Type

· D.16.5 Property Protection Information Type

· D.20.2 General Purpose Data and Statistics Information Type

· D.20.4 Knowledge Dissemination

· D.22.3. Public Resources, Facility, and Infrastructure Management

d. Standard Isolation Architecture system categorization is:

(1) Zone: Med-ICS. Zone contains systems and subnets that control the function of the facility and do not access, use and / or manipulate data / information categorized as PII, Payments Information or PHI and where adverse cyber operation of the system does not immediately endanger human well-being.

Subnet Med-UMCS. Contains the following systems:

· Cathodic Protection Systems (CPS)

· Direct Digital Control for HVAC (Mission Essential)

· Direct Digital Control for HVAC (Mission Support)

· Electrical Systems (ES)

· Generator Monitoring and Alarm System

· Lighting Control Devices

· Natural Gas System

· Potable Water System

· Pure Water Systems

· Sanitary Sewer / Wastewater System

· Shade Control System

· Facility Underground Fuel-Oil, Storage Tanks

· Uninterruptible Power Supply (UPS) System

· Utility Monitoring and Controls Systems (UMCS)

· Vehicle Charging System

· Weather Monitoring System

Subnet Med-VTS. Contains the following systems:

· Elevators (Controls)

Subnet Med-SIS. Contains the following systems:

· Airfield Control

· Automatic Guided Vehicle Systems (AGVs)

· Cable Television Premises Distribution System

· Cart Wash System

· Clock System (Network Time Synchronization (NTS))

· Electronic Message Signage (Wayfinding)

· Fume Hood Alarm System

· Infrared and Radio Frequency Tracking Systems

· Integrated Audio-Video Systems and Equipment (AV)

· Internal Cellular and Antenna Systems

· Pneumatic Tube System (PTS)

· Radio and Public Address Systems

· Refrigerator Monitoring Systems

Subnet Med-GAS. Contains the following systems:

· Gas and Vacuum Systems for Healthcare Facilities

(2) Zone: Med-LIFE. Zone contains systems and subnets that control the function of critical facility systems that are life safety in nature or use, access and / or manipulate data / information categorized as Life Safety and where adverse cyber operation of the system will endanger human well-being. These systems do not access, use or manipulate data / information categorized as PII, Payments Information or PHI.

Subnet Med-FAS. Contains the following systems:

· Fire Detection and Alarm System

(3) Zone: Med-ESS. Zone contains systems and subnets that control the function of facility electronic security systems. These systems may require access to and manipulate data / information categorized as PII and / or PHI and where adverse cyber operation of the system may endanger human wellbeing.

Subnet Med-ESS. Contains the following systems:

· Electronic Security System (ESS)

(4) Zone: Med-MED. Zone contains systems and subnets that control the clinical and clinical support systems of a facility not to include PP Medical Devices (except where integrated into a system). These systems may require access to and manipulate data / information categorized as PII, Payments Information and / or PHI and where adverse cyber operation of the system may endanger human wellbeing.

Subnet Med-MED. Contains the following systems:

· Integrated Operating Room System

· Interactive Television System (ITV)

· Nurse Call System (NCS)

· Patient Bed Service Walls

· Patient Monitoring and Telemetry Systems

· Patient Queuing and Clinical Workflow System

· Point of Use Supply System

· Radio Communications (Paging) Equipment

· Radiology Equipment

· Surgical Instrument Tracking System

· Point of Sale (POS) System

(5) Zone: Med-PWR. Zone contains systems and subnets that control facility power generation systems. These systems may use, access and / or manipulate data / information categorized as Life Safety and where adverse cyber operation of the system may endanger human well-being. These systems do not access, use or manipulate data / information categorized as PII, Payments Information or PHI.

Subnet Med-PWR Contains the following systems:

· Microgrid

· Utility Metering System (Advanced Meters, AMI, etc.)

(6) Zone: Med-QUAR. Zone contains existing legacy systems that cannot meet modern security standards and may be completely isolated from connectivity with other systems. These systems shall not use, access and / or manipulate data / information categorized as PII, Payments Information or PHI.

3. RISK MANAGEMENT FRAMEWORK.

All military construction shall adhere to the UFC 4-010-06, NIST SP 800-53A Rev 5 and NIST SP 800-82; DoD RMF guidance outlined in DoDI 8510.01 and DoDI 8530.01 to the greatest extent possible in order to sufficiently manage the life cycle cybersecurity risk of FRCS.

4. RISK CATEGORIZATION

a. UFC 4-010-06, in conjunction with MIL-STD-882 and FERC Order 706, shall determine overall risk categorization.

b. Preliminary C-I-A determination of systems shall be per OSD EI&E eMASS Control Systems Master List then finalized by the System Owner and Authorizing Official.

c. Variations are permitted with approval of AO.

5. STANDARD ISOLATION ARCHITECTURE

a. Standard Reference Model. Designers and system owners shall implement the features of the UFC Reference Architecture, and IEC 62443 to the greatest extent possible.

b. Usage of Med-COI Infrastructure. Services of the Med-COI shall be leveraged to greatest extent possible in support of mission assurance. To include:

(1) Department of Defense Information Network (DoDIN) protection procedures, features and practices required per DoDI 8530.01, and the Advanced Industrial Control Systems Tactics, Techniques and Procedures.

(2) Help desk and support.

(3) Network time synchronization.

(4) Domain Name Server (DNS) service.

(5) All communication with external networks.

(6) System to system communication across zone boundaries of varied risk categorizations.

(7) Patch and change management of Med-COI assets.

c. Segregated Responsibilities and Ownership.

(1) A Memorandum of Agreement (MOA) shall be developed for each installation that clearly and completely defines the separation of responsibilities between IT and Facility organizations.

(2) To the greatest extent possible, physical and operational ownership of the Personal and Real Property architecture components shall be segregated between traditional IT and traditional facility functions.

· Owned and operated by Med-COI – “Traditional IT”.

· Owned and operated by Facilities – “FRCS Isolation Architecture”.

(3) A Boundary Protected DMZ shall be implemented at Level 3 to facilitate data transfer between Med-COI and FRCS Isolation Architecture(s). Devices and services shall be built by Med-COI as necessary and may include:

· Med-COI side firewall.

· FRCS side firewall.

· Usage of uni-directional gateway devices. Uni-directional gateways may not be used as drop-in replacements for firewalls.

· Asynchronous reporting historian.

· Anti-Virus (AV) / Malware deployment server.

· Security Information and Event Management (SIEM) aggregator.

· Patch deployment server.

· Jump host.

(4) Access to Internet, enterprise email systems and all other business services is prohibited in the FRCS network or beyond the Level 3 Boundary Protection DMZ.

(5) Direct trust relationship(s) between FRCS and other business networks is prohibited. System owners are encouraged to provide reasonable means to access business networks, on separate machines from FRCS, to allow for adherence to this requirement.

(6) The following figure graphically represents the logical interface of Med-COI and Facilities for the Standard Isolation Architecture.

Figure 6.1: Segregation of Med-COI and FRCS Isolation Architecture

i. Adherence to DoDI 8530.01, DoDI 8510.01, maintenance and operation of the following shall be the responsibility of Med-COI.

1. Level 3: Boundary Protection and DMZ. This includes activities outlined in the JIE Cybersecurity Reference Architecture as required for a Special Purpose Processing Node (SPPN).

2. Level 4: FRCS Logical Processors, including servers and workstations.

3. Level 5: Enterprise Gateway, including all components.

ii. Adherence to DoDI 8530.01, DoDI 8510.01, maintenance and operation of Level 0, 1 and 2 devices and components for FRCS shall be the responsibility of Facilities.

iii. Facilities shall own, maintain and operate all cabling and devices up to the Level Boundary Protection DMZ.

(7) Communications between systems that are life safety in nature or mandated by code shall be wholly owned and operated by facilities.

d. System, Subnet and Zone Assembly.

(1) The following figures graphically represent the assembly of demonstrative systems, subnets and zones.

Figure 6.2: System, Subnet and Zone Assembly Representation

(2) FRCS shall be designed and installed to operate in a code-driven, minimal or reduced functionality state, independently using components of Level 0, 1 and 2.

(3) FRCS may interface, without crossing Level 3 Boundary Protection DMZ, within zone.

(4) Systems should interface at a common Level 2B Field Point of Connection (FPOC).

(5) FRCS interface with Med-COI infrastructure shall occur at the Level 3 Boundary Protection DMZ.

(6) A group of one or more systems of same categorization and similar risk, connected by layer 2 network infrastructure comprise a subnet.

(7) FRCS domain controller is to be provided at Level 2 with the intent to maintain survivability in the event of an outage.

(8) Inbound and outbound zone communication shall pass through Level 3 Boundary Protection DMZ at the facilities side firewall. Circumventing this logical communication flow is prohibited.

(9) Zones shall be separated to allow for group policy, patch and change management customization at the zone level.

e. Adapted 5-Level Architecture.

(1) UFC 4-010-06, Appendix E governs elements not modified by the following requirements:

i. Derived from UFC 4-010-06, Figure 2-1. (https://www.wbdg.org/ffc/dod/unifiedfacilities-criteria-ufc/ufc-4-010-06)

ii. Simplification of Level 3 to allow for improved ownership severability.

iii. Additional FPOC’s at Level 2 to allow for multi-zone implementations.

iv. Added representative DMZ architecture for Med-COI and FRCS network data exchange.

(2) The following is a simplified representation of the Adapted 5-Level architecture for a multi-zone, multi-subnet, multi-system installation leveraging Med-COI for infrastructure.

Figure 6.3: Adapted 5-Level Architecture

f. System to System Communication.

(1) UFC 4-010-06, Chapter 4 shall be utilized.

(2) Minimize FRCS operational reliance on Med-COI services so that when operating in an isolated mode, FRCS functionally is not unacceptably diminished.

(3) Direct communication between systems and subnets within a single zone permitted without restriction.

(4) For Level 0, 1 and 2 direct communication to external networks, as defined as any network that is not directly responsible for the supervision, monitoring or control of the FRCS, is prohibited.

(5) Zone to zone communication requires logical validation by the Level 3 Boundary Protection and / or Level 4 Logical Servers for acceptability in addition to typical screening procedures.

i. Typical Screening. In accordance with DoDI 8530.01.

ii. Logical Screening. Level 4, Logical FRCS servers / workstations, shall actively screen data calls and commands of lower level systems that seek responses from systems in other zones by white listing, leveraging the following logical communication flow. DHA SME’s shall develop specific whitelisting procedures on a project by project basis.

1. Logs of request handling shall be maintained as required by DoDI 8530.01.

2. System controller in a zone makes the data call / command directly, and only, to the Level 4, FRCS logical Server.

3. Level 4, FRCS logical Server, deconstructs the packet and reviews the request against programmed white list procedures with one of the following results:

a. Requests on white list are processed accordingly.

b. Requests not on white list are passively denied and alarm displayed.

4. Level 4, FRCS Logical Server, the packet is reassembled, if required, into the receiving system communication port and protocol then issued directly to that system.

5. The receiving system processes the request with one of the following results:

a. Single direction request is processed. Communication complete.

b. Feedback requests are routed directly back to the Level 4, FRCS Logical Server to be handled the same as an initial request.

6. STANDARD ISOLATION ARCHITECTURE ADAPTATIONS

a. For facilities projects, variations to the architecture are permitted with approval coordinated through DHA Facilities Division.

b. As authorized by the AO, installations may provide an independent DoDIN in substitution of leveraging Med-COI infrastructure. Requirements of DoDI 8530.01 for standalone DoDIN shall be met. Circuits must be procured via the DHA Circuit Management Office as part of the DHA portfolio.

7. TEST AND DEVELOPMENT ENVIRONMENT

a. The Systems Integrator will build or augment and maintain a TDE within HIT’s TDE that replicates the Production Environment to the highest degree possible starting with the Level 4 Workstations, Servers, FRCS software and with at least one of each of the Level 3-0 major components, devices, and actuators. The TDE shall be used to perform FAT of the FRCS to ensure the system has end-to-end functionality; has been properly configured using the Security Content Automation Protocol (SCAP) tool and the STIGS; and has had all applicable patches installed and properly configured.

b. The TDE shall be used to conduct SAT of the completed FRCS, and if required, penetration testing.

8. GUIDANCE FOR LEASED FACILITIES. Reserved.

GLOSSARY

PART I. ABBREVIATIONS AND ACRONYMS

PART II. DEFINITIONS

Term & Definition

Authorizing Official (CNSS Glossary) A senior (federal) official or executive with the authority to formally assume responsibility for operating an information system at an acceptable level of risk to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation.

Building Automation System (BAS) The system consisting of a UMCS Front End, connected Building Control Systems which control building electrical and mechanical systems, and user interfaces for building control supervision. The BAS is a subsystem of the Utility Monitoring and Control System. This term is being phased out in favor of UMCS.

Building Control System (BCS) A system that controls building electrical and mechanical systems such as HVAC (including central plants), lighting, vertical transport systems, and irrigation systems. Building Control Systems generally do not have a full‐featured user interface; they may have “local display panels” but typically rely on the UMCS front end for full user interface functionality. BCS is a subsystem of the Utility Monitoring and Control System, and is a class of Field Control System.

Closed Circuit Television System (CCTV) An ESS that allows video assessment of alarm conditions via remote monitoring and recording of video events. Video monitoring may also be incorporated into other systems which are not CCTV.

Control Correlation Identifier (CCI) The Control Correlation Identifier (CCI) provides a standard identifier and description for each of the singular, actionable statements that comprise a security control.

Control System (CS) A system of digital controllers, communication architecture, and user interfaces that monitor, or monitor and control, infrastructure and equipment.

Controller An electronic device – usually having internal programming logic and digital and analog input/output capability – which performs control functions. Two primary types of controller are equipment controller and supervisory controller.

Distributed Control System This term is being phased out in preference of BCS, UCS, and/or

UMCS.

Electronic Security System (ESS) The integrated electronic system that encompasses interior and exterior (physical) intrusion detection systems (IDS), CCTV systems for assessment of alarm conditions, access control systems, data transmission media, and alarm reporting systems for monitoring, control, and display.

Energy Monitoring Control System (EMCS) Another name for a Utility Monitoring and Control System. See UMCS.

Equipment Controller (EC) A controller implementing control logic to control a piece of equipment. Note: a controller is defined by use, and many ECs also have the capability to act as supervisory controllers (SC). Some examples of equipment controllers are air handler controllers, protective relays, and pump controllers. Note that some devices, such as power meters or smart sensors, which only perform monitoring functions are still considered equipment controllers (despite not actually controlling anything).

Facility-Related Control System (FRCS) A controls system which controls equipment and infrastructure that is part of a DoD building, structure, or linear structure. Facility-Related Control Systems (FRCS), a subset of Platform Information Technology is defined as including but not limited to; Buildings and their associated control systems (building automation systems or building management systems, energy management systems, fire and life safety, elevators, etc.), utility distribution systems (such as electric, water, waste water, natural gas and steam), telecommunications systems designed specifically for industrial control systems including supervisory control and data acquisition, direct digital controls, programmable logic controllers, other control devices and advanced metering and sub-metering devices. DoD FRCS are clearly delineated from other types of industrial control systems by being physically located on DoD property.

Field Control System (FCS) A Building Control System, Utility Control System, Access Control System, etc. within the Facility and "downstream" of the FPOC.

Field Control Network (FCN) The network used by the Building Control System, Utility Control System, etc., within a facility "downstream" of the FPOC. This includes IP, Ethernet, RS-485, TP/FT-10 and other network infrastructure that support control system(s) in a given facility.

Field Point of Connection (FPOC) The FPOC is the point of connection between the ICS IP network and the field control network (an IP network, a non-IP network, or both). The hardware which provides the connection at this location is an IT device such as a switch, IP router, or firewall.

Impact The effect on organizational operations, organizational assets, or individuals due to a loss of Confidentiality, Integrity, or Availability in the control system. Impact is categorized as one of three levels:

· LOW: limited adverse effect

· MODERATE: serious adverse effect

· HIGH: severe or catastrophic adverse effect

The impact level of a system is generally written in ALL CAPS for clarity.

Incident (FIPS 200) An occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies

Industrial Control System (ICS) One type of control system. Most specifically a control system, which controls an industrial (manufacturing) process. Sometimes also used to refer to other types of control systems, particularly utility control systems such as electrical, gas, or water distribution systems.

Information Technology (IT) Any equipment or interconnected system or subsystem of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the executive agency.

Intrusion Detection System (IDS) [Physical/ESS] A system consisting of interior and exterior sensors, surveillance devices, and associated communication subsystems that collectively detect an intrusion of a specified site, facility, or perimeter and annunciate an alarm.

Intrusion Detection System (IDS) [Cyber] A device or software application that monitors network or system activities for malicious activities or policy violations, and produces reports to management.

Isolation Architecture is the physical protection, and systematic encapsulation of information exchanges internal to a system component. This is done through the hierarchical organization of information exchanges until the inadequate legacy systems with obscure proprietary communication are secured.

Life Safety is data and /or a cyber physical activity that endeavors to protect human well-being. Local Area Networks (LAN) The local engineering function is responsible for CS LANs and other associated stand-alone networks. For DHA projects that require use of the DoDIN, the Project Team/System Integrator should ensure that the CS cross-domain connections are secured; most CS are cross-connected to other facility or building control systems such as the Fire Alarm, Fire Suppression, and HVAC fire dampers; Stairwell and Elevator safe haven and Smoke Purge systems; Patient Comfort; and Weather systems, etc.

Mobile Code (NIST SP 800-53r5) Software programs or parts of programs obtained from remote information systems, transmitted across a network, and executed on a local information system without explicit installation or execution by the recipient.

Mobile Code Technology (NIST SP 800-53r5) Software technologies that provide the mechanisms for the production and use of mobile code (e.g. Java, JavaScript, ActiveX, VBScript)

Non-Local Maintenance (NIST SP 800-53r5) Maintenance activities conducted by individuals communicating through a network; either an external network (e.g., the Internet) or an internal network.

Operational Technologies (OT) Throughout industry, and informally within DoD, the term Operational Technology (OT) is used to differentiate control systems from traditional information systems (IS). Operational technology (OT) is hardware and software that detects or causes a change through the direct monitoring and/or control of physical devices, processes and events in the enterprise. (Gartner OT http://www.gartner.com/itglossary/operational-technologyot/).

Platform IT (PIT) IT, both hardware and software, which is physically part of, dedicated to, or essential in real time to the mission performance of special purpose systems.

Ports, Protocols and Services (PPS) DoDI 8551.01, Ports, Protocols, and Services Management (PPSM), establishes PPSM support requirements for configuration management and continuous monitoring. This includes discovery and analysis of PPS to support near real time command and control of the DOD Information Network (DODIN) and Joint Information Environment (JIE), and coordination with the local network and communications community to ensure they add control system PPS. Examples of CS PPS include:

· Modbus: Master/Slave – Port 502

· BACnet: Master/Slave – Port 47808

· LonWorks/LonTalk: Peer to Peer – Ports 1628, 1629

· DNP3: Master/Slave – Port 20000

· ZigBee: Peer to Peer 2.4 GHz

· Bluetooth: Master/Slave 2.4 GHz

Remote Access (NIST SP 800-53r5) Remote access is access to organizational information systems by users (or processes acting on behalf of users) communicating through external networks (e.g.,…