20. DRAFT - DHA FRCS Baseline Categorization Memorandum-1 Oct 2020.pdf

UNCLASSIFIED // FOR OFFICIAL USE ONLY

DEFENSE HEALTH AGENCY

7700 ARLINGTON BOULEVARD, SUITE 5101

FALLS CHURCH, VIRGINIA 22042-5101

MEMORANDUM FOR RECORD

SUBJECT: DHA FE PMO Baseline Categorization Memo for Facility-Related Control Systems

(FRCS)

References: (a) DoDI 8510.01, “Risk Management Framework (RMF) for Department of Defense (DoD) Information Technology (IT),” March 12, 2014

(b) NIST SP 800-60 Volume I Revision 1, “Guide for Mapping Information and Information Systems to Security Categories,” August, 2008

(c) NIST SP 800-60 Volume II Revision 1, “Appendices to Guide for Mapping Information and Information Systems to Security Categories,” August 2008

(d) Committee on National Security Systems (CNSSI) Number 1253, Security Categorization and Control Selection for National Security Systems, dated March 27, 2014

(e) Administrative Instruction (AI) 77, “Security Categorization (SC) and Control Selection for Information Technology (IT),” dated May 28, 2015

The Defense Health Agency, Facilities Enterprise (FE) has identified the following Information Types and the corresponding Security Categories in accordance with references (b),

(c) and (e) as being applicable to the FRCS. This memorandum serves as concurrence and approval of the baseline impact ratings for FRCS Information Types listed in the attached Enclosure.

All CNSSI 1253 security controls apply to DoD systems. Any system identified as a

“Control System” must have the FRCS Overlay applied in eMASS at the MMM level. If approved by the System Owner, Information Systems Security Manager (ISSM) and Authorizing Official (AO), non-applicable controls can be tailored out. Removal of specific NSS controls from the baseline must include justification as supporting documentation. An asterisk indicates the Impact Level has been elevated based on a SP 800-60 “Special Factors” review.

The FRCS Program Manager signature indicates all internal RMF stakeholders are aware of the Categorization. The Point of Contact for this action is the DHA Facility Enterprise (FE) Lead IT Program Manager. Ms. Kimberly D. Curlee can be contacted at 703-275-6108 or via email at Kimberly.D.Curlee.Civ@Mail.Mil

Kimberly D. Curlee, CISSP, PMP DHA Facility Enterprise (J1/J8) Defense Health Agency

Financial Operations (J-8) mailto:Kimberly.D.Curlee.Civ@Mail.Mil

ENCLOSURE 1

Direct Digital Control of HVAC (Control System) Criteria Reference:

UFC 3-401-0 I Mechanical Engineering UFC 4-510-0 I Design: Military Medical Facilities

Specifications Reference:

UFGS 23 09 23.13 20 BACnet Direct Digital Control Systems for HVAC and Other Local Building Systems UFGS 23 09 23.0 I LONWORKS Direct Digital Control for HY AC and Other Building Control Systems

Information Type Confidentiality Integrity Availability D.7.1 Energy Supply Information Type L M M D.7.2 Energy Conservation and Preparedness Information Type

L

D.7.4 Energy Production Information Type L L L C.2.8.12 General Information L L L C.3.1.1 Facilities, Fleet, and Equipment Management Information Type*

M

C.3.5.8 System and Network Monitoring Information Type Moderate

Categorization M M M

Utility Monitoring and Control Systems (Control System)

UFC 3-401-01 Mechanical Engineering, "Associated Mechanical Systems Criteria" UFC 4-SI0-01, "Heating, Ventilation, and Air Conditioning"

Specifications Reference:

25 10 10 Utility Monitoring and Control System (UMCS) Front End and Integration

Information Type Confidentiality Integrity Availability D.7.1 Energy Supply Information Type L M M

C.2.8.12 General Information L L L

Electronic Security System (Control System)

UFC 3-501-0 I Electrical Engineering UFC 4-021-02 Security Engineering Electronic Security Systems UFC 4-510-01 Design: Military Medical Facilities

Specification Reference:

UFGS 28 08 10 Electronic Security System 28 00 00 Electronic Safety and Security

Information Type Confidentiality Integrity Availability C.2.8.12 General Information L L L

Automatic Guided Vehicle System (Other System)

UFC 4-510-01 Design: Military Medical Facilities Specifications Reference:

41 21 13 Automatic Guided Vehicle Systems Information Type Confidentiality Integrity Availability

C.2.8.12 General Information L L L

Management Information Type

C.3.4.2 Inventory Control Information Type L L L Categorization L L L

Electrical Systems (Control System)

UFC 3-520-01 Interior Electrical Systems UFC 4-510-01 Design: Military Medical Facilities

Specifications Reference:

26 36 00.00 10 Automatic Transfer Switch and By-Pass/ Isolation Switch

Information Type Confidentiality Integrity Availability D.7.1 Energy Supply Information Type L M M

C.2.8.12 General Information L L L

Categorization L M M

Electronic Message Signage – Wayfinding (Other System)

Criteria Reference: N/ A Specification Reference:

10 14 63 Electronic Message Signage Information Type Confidentiality Integrity Availability

C.2.8.12 General Information L L L Categorization L L L

Elevators Systems (Control System) Criteria Reference:

UFC 1-200-0 I General Building Requirements UFC 4-510-01 Design: Military Medical Facilities

Specifications Reference:

UFGS 14 21 13 Electric Traction Freight Elevator UFGS 14 21 23 Electric Traction Passenger Elevators

Information Type Confidentiality Integrity Availability C.2.8.12 General Information L L L

Categorization L M M

Fire Detection and Alarm System (Control System)

UFC 4-510-0 I Design: Military Medical Facilities Specifications Reference:

UFGS 28 31 00.00 10 Fire Detection and Alarm Reporting System, Digital Communicators UFGS 28 3 1 13.00 40 Fire Detection and Alarm Control, GUI and Logic Systems UFGS 28 31 64.00 IO Fire Detection and Alarm System, Addressable

Information Type Confidentiality Integrity Availability D.4.4 Emergency Response Information Type L H H D.16.5 Property Protection Information Type L L L C.2.8.12 General Information L L L C.3.1.1 Facilities, Fleet, and Equipment Management Information Type*

L M M

C.3.5.8 System and Network Monitoring Information Type Moderate

M M L

Categorization M H H

Fume Hood Alarm System (Control System)

UFC 4-510-01 Design: Military Medical Facilities Specifications Reference:

11 53 00 Laboratory Equipment Information Type Confidentiality Integrity Availability

Generator Monitoring and Alarm System (Control System)

UFC 3-501-0 I Electrical Engineering UFC 3-540-0 I Engine-Generator Systems for Backup Power Applications UFC 4-510-01 Design: Military Medical Facilities

Specifications Reference:

26 32 15.00 10 Diesel Generator Set Stationary 100-2500 KW, wl Aux

Information Type Confidentiality Integrity Availability D.7.1 Energy Supply Information Type L M M

C.2.8.12 General Information L L L

Internal Cellular Antenna Systems (Other System)

UFC 4-510-01 Design: Military Medical Facilities Specification Reference:

27 53 19 Internal Cellular, Paging, and Antenna Systems Information Type Confidentiality Integrity Availability

C.2.8.12 General Information L L L C.3.1.1 Facilities, Fleet, and Equipment Management Information Type

L L L

Lighting Control System (Control System)

UFC 3-501-01 Electrical Engineering UFC 3-530-01 Design: Interior and Exterior Lighting Controls UFC 4-510-01 Design: Military Medical Facilities

Specifications Reference:

UFGS 26 09 23.00 40 Lighting Control Devices

Information Type Confidentiality Integrity Availability D.7.2 Energy Conservation and Preparedness Information Type

L L L

C.2.8.12 General Information L L L

Gas and Vacuum System for Healthcare Facilities (Control System) Includes Medical Gas Alarm Systems, Medical Gas Control Systems, and Medical Gas Production Plant Systems Criteria Reference:

UFC 4-510-0 I Design: Military Medical Facilities Specifications Reference:

UFGS 22 60 70 Gas and Vacuum Systems for Healthcare Facilities Information Type Confidentiality Integrity Availability

C.2.8.12 General Information L L L

Clock System (e.g. Network Time Synchronization) (Other System)

UFC 4-510-01 Design: Military Medical Facilities Specifications Reference:

27 53 13 Clock System Information Type Confidentiality Integrity Availability

C.2.8.12 General Information L L L

Nurse Call System (Other System)

UFC 3-501-01 Electrical Engineering UFC 4-510-0 I Design: Military Medical Facilities

Specifications Reference:

UFGS 27 41 00.00 10 Nurse Call Audio-Visual (NCAV) System UFGS 27 52 32.00 10 Nurse Call Tone-Visual (NCTV) System

Information Type Confidentiality Integrity Availability D.14.4 Healthcare Delivery Services Information Type

M H M

C.2.8.12 General Information L L L

Categorization M H M

Pneumatic Tube System (Control System)

UFC 4-510-0 I Design: Military Medical Facilities Specification Reference:

UFOS 14 92 00 Pneumatic-Tube System Information Type Confidentiality Integrity Availability

C.2.8.12 General Information L L L

Point of Sale (Other System)

UFC 4-510-01 Design: Military Medical Facilities Specification Reference:

27 42 I 3 Point of Sale Systems Information Type Confidentiality Integrity Availability

D.20.2 General Purpose Data and Statistics

C.3.4.2 Inventory Control Information Type L L L

Radio and Public Address Systems (Control System)

UFC 4-510-0 I Design: Military Medical Facilities Specification Reference:

UFGS 27 51 16 Radio and Public Address Systems Information Type Confidentiality Integrity Availability

C.2.8.12 General Information L L L C.3.1.1 Facilities, Fleet, and Equipment Management Information Type*

L M M

D.4.4 Emergency Response Information Type L H H D.20.4 Knowledge Dissemination Information Type

Categorization L H H

Cable Television Premises Distribution System (Other System)

UFC 3-501-01 Electrical Engineering UFC 3-580-01 Telecommunications Building Cabling Systems UFC 4-510-01 Design: Military Medical Facilities

Specifications Reference:

UFGS 27 05 14.00 10 Cable Television Premises Distribution System 27 05 14 Communication Services

Information Type Confidentiality Integrity Availability C.2.8.12 General Information L L L

D.20.4 Knowledge Dissemination Information Type

Uninterruptible Power Supply (UPS) (Other System)

UFC 3-501-01 Electrical Engineering UFC 3-520-01 Interior Electrical Systems UFC 4-510-01 Design: Military Medical Facilities

Specifications Reference:

UFGS 26 32 33.00 10 Uninterruptible Power Supply (UPS) System above 15 KVA

Capacity UFGS 26 33 53.00 20 Uninterruptible Power Supply (UPS)

Information Type Confidentiality Integrity Availability D.7.1 Energy Supply Information Type L M M

D.7.4 Energy Production Information Type L L L C.2.8.12 General Information L L L