60643730_Ederle_Final_SPECS_Print VOL 3 DC4signed.pdf

WORK ORDER NO.

At the

PREPARED BY:

Mechanical:

Electrical:

Architectural:

Civil:

Structural:

APPROVED BY:

Specifications:

For Commander, NAVFAC:

Date:

Submitted By: Date:

VOLUME 3 OF 3

nancy.wroten Line

FY20 ERCIP Project: Replace Combined Heat and Power & Add Thermal Storage 60643730

SEALS PAGE 1

Civil Only Electrical Only

Architecture Only

Mechanical Only

Fire Protection Only

Structural Only

SEALS PAGE 2

Geotechnical Only

HOST NATION SEALS PAGE

FOR HN COMPLIANCE ONLY

HAVING PARTICIPATED IN THE DESIGN OF THE REPLACE COMBINED HEAT AND POWER & ADD THERMAL STORAGE AND HAVING THOROUGHLY REVIEWED THE COMPLETED PROJECT DOCUMENTS, I DECLARE THAT THE FACILITY DESIGN INCLUDED HEREIN COMPLIES WITH ALL APPLICABLE CODES AND LAWS / AVENDO PARTICIPATO ALLA PROGETTAZIONE DEL PROGERTTO “REPLACE COMBINED HEAT AND POWER & ADD THERMAL STORAGE” E AVENDO REVISIONATO ACCURATAMENTE I DOCUMENTI DEL PROGETTO COMPLETO, DICHIARO CHE LA PROGETTAZIONE DEGLI EDIFICI QUI INCLUSA E’CONFORME A TUTTE LE

NORME E LE LEGGI ITALIANE APPLICABILI

Date Signature

07/27/2022

THIS PAGE INTENTIONALLY LEFT BLANK

FY20 ERCIP Project: Replace Combined Heat and Power 60643730 & Add Thermal Storage

PROJECT TABLE OF CONTENTS

DI VI SI ON 00 - PROCUREMENT AND CONTRACTI NG REQUI REMENTS

00 01 15 02/11 LIST OF DRAWINGS

DI VI SI ON 01 - GENERAL REQUI REMENTS

01 11 00 08/15 SUMMARY OF WORK

01 14 00 11/22 WORK RESTRICTIONS

01 20 00 11/20, CHG 2: 08/21 PRICE AND PAYMENT PROCEDURES

01 30 00 11/20, CHG 2: 05/22 ADMINISTRATIVE REQUIREMENTS

01 31 23.13 20 05/17 ELECTRONIC CONSTRUCTION AND FACILITY

SUPPORT CONTRACT MANAGEMENT SYSTEM

01 32 17.00 20 05/18 COST-LOADED NETWORK ANALYSIS SCHEDULES

(NAS)

01 33 00 08/18 SUBMITTAL PROCEDURES

01 35 26 11/20, CHG 3: 02/22 GOVERNMENTAL SAFETY REQUIREMENTS

01 42 00 02/19 SOURCES FOR REFERENCE PUBLICATIONS

01 42 15 02/14 METRIC MEASUREMENTS

01 45 00.00 20 11/11 QUALITY CONTROL

01 45 23.10 42 11/20 CERTIFICATIONS OF COMPLIANCE WITH

ITALIAN LAWS

01 45 35 11/20 SPECIAL INSPECTIONS

01 50 00 11/20, CHG 2: 08/22 TEMPORARY CONSTRUCTION FACILITIES AND

CONTROLS

01 57 19 11/15 TEMPORARY ENVIRONMENTAL CONTROLS

01 57 19.01 20 11/15 SUPPLEMENTAL TEMPORARY ENVIRONMENTAL

CONTROLS

01 58 00 08/19, CHG 5: 08/22 PROJECT IDENTIFICATION

01 74 19 02/19 CONSTRUCTION WASTE MANAGEMENT AND

DISPOSAL

01 78 00 05/19 CLOSEOUT SUBMITTALS

01 78 23 08/15 OPERATION AND MAINTENANCE DATA

01 78 24.00 20 02/15 FACILITY ELECTRONIC OPERATION AND

MAINTENANCE SUPPORT INFORMATION (eOMSI)

01 91 00.15 20 02/21, CHG 1: 05/21 TOTAL BUILDING COMMISSIONING

DI VI SI ON 02 - EXI STI NG CONDI TI ONS

02 41 00 05/10, CHG 2: 02/19 DEMOLITION

02 81 00 11/18 TRANSPORTATION AND DISPOSAL OF

HAZARDOUS MATERIALS

DI VI SI ON 03 - CONCRETE

03 30 00 02/19, CHG 2: 05/21 CAST-IN-PLACE CONCRETE

DI VI SI ON 05 - METALS

05 12 00 08/18, CHG 2: 05/21 STRUCTURAL STEEL

05 30 00 05/15, CHG 2: 08/18 STEEL DECKS

05 50 13 05/17, CHG 1: 08/18 MISCELLANEOUS METAL FABRICATIONS

05 51 33 02/16, CHG 2: 02/18 METAL LADDERS

DI VI SI ON 07 - THERMAL AND MOI STURE PROTECTI ON

07 60 00 05/17, CHG 2: 11/18 FLASHING AND SHEET METAL

07 84 00 05/10 FIRESTOPPING

PROJECT TABLE OF CONTENTS Page 1

DI VI SI ON 08 - OPENI NGS

08 91 00 08/20 METAL WALL LOUVERS

DI VI SI ON 09 - FI NI SHES

09 97 13.16 05/11, CHG 2: 08/19 INTERIOR COATING OF WELDED STEEL WATER

TANKS

DI VI SI ON 11 - EQUI PMENT

11 24 23 02/11 FALL PROTECTION SYSTEM

DI VI SI ON 13 - SPECI AL CONSTRUCTI ON

13 34 19 08/20, CHG 1: 02/21 METAL BUILDING SYSTEMS

13 48 73 05/20, CHG 1: 08/20 SEISMIC CONTROL FOR MECHANICAL

EQUIPMENT

DI VI SI ON 23 - HEATI NG, VENTI LATI NG, AND AI R CONDI TI ONI NG ( HVAC)

23 03 00.00 20 08/10, CHG 3: 08/18 BASIC MECHANICAL MATERIALS AND METHODS

23 05 15 02/14 COMMON PIPING FOR HVAC

23 05 48.00 40 08/15 VIBRATION AND SEISMIC CONTROLS FOR

HVAC PIPING AND EQUIPMENT

23 05 93 11/15 TESTING, ADJUSTING, AND BALANCING FOR

HVAC

23 07 00 02/13, CHG 7: 05/20 THERMAL INSULATION FOR MECHANICAL

SYSTEMS

23 08 00.00 20 02/21, CHG 1: 05/21 COMMISSIONING OF MECHANICAL SYSTEMS

23 09 00 02/19, CHG 3: 05/21 INSTRUMENTATION AND CONTROL FOR HVAC

23 09 13 11/15, CHG 2: 05/21 INSTRUMENTATION AND CONTROL DEVICES

FOR HVAC

23 09 23.02 02/19, CHG 1: 02/20 BACNET DIRECT DIGITAL CONTROL FOR HVAC

AND OTHER BUILDING CONTROL SYSTEMS

23 11 20 05/20 FACILITY GAS PIPING

23 21 13.23 20 07/07, CHG 1: 11/19 HIGH AND MEDIUM TEMPERATURE WATER

SYSTEM WITHIN BUILDINGS

23 21 23 08/17 HYDRONIC PUMPS

23 25 00 05/21 CHEMICAL TREATMENT OF WATER FOR

MECHANICAL SYSTEMS

DI VI SI ON 25 - I NTEGRATED AUTOMATI ON

25 05 11 05/21 CYBERSECURITY FOR FACILITY-RELATED

HVAC AND GENERATOR CONTROL SYSTEMS

25 08 10 05/21 UTILITY MONITORING AND CONTROL SYSTEM

TESTING

25 10 10 02/19, CHG 1: 05/21 UTILITY MONITORING AND CONTROL SYSTEM

(UMCS) FRONT END AND INTEGRATION

DI VI SI ON 26 - ELECTRI CAL

26 05 19.10 10 05/16 INSULATED WIRE AND CABLE

26 05 48.00 10 10/07 SEISMIC PROTECTION FOR ELECTRICAL

EQUIPMENT

26 08 00 08/08 APPARATUS INSPECTION AND TESTING

26 20 00 08/19 INTERIOR DISTRIBUTION SYSTEM

PROJECT TABLE OF CONTENTS Page 2

26 28 01.00 10 10/07 COORDINATED POWER SYSTEM PROTECTION

26 29 23 02/20 ADJUSTABLE SPEED DRIVE (ASD) SYSTEMS

UNDER 600 VOLTS

26 32 17.00 05/20 GAS-FIRED COGENERATOR UNIT 1400-1600

KW, WITH AUXILIARIES

26 41 00 11/13 LIGHTNING PROTECTION SYSTEM

26 51 00 05/20, CHG 1: 05/21 INTERIOR LIGHTING

26 56 00 08/21 EXTERIOR LIGHTING

DI VI SI ON 27 - COMMUNI CATI ONS

27 10 00 08/11 BUILDING TELECOMMUNICATIONS CABLING

SYSTEM

DI VI SI ON 28 - ELECTRONI C SAFETY AND SECURI TY

28 31 70 08/20 INTERIOR FIRE ALARM SYSTEM, ADDRESSABLE

DI VI SI ON 31 - EARTHWORK

31 00 00 08/08, CHG 2: 02/21 EARTHWORK

31 23 00.00 20 02/11 EXCAVATION AND FILL

31 63 16 11/20 AUGERED CAST-IN-PLACE PILES

DI VI SI ON 32 - EXTERI OR I MPROVEMENTS

32 11 23 08/17 AGGREGATE BASE COURSES

32 12 13 05/17 BITUMINOUS TACK AND PRIME COATS

32 12 16.16 11/20 ROAD-MIX ASPHALT PAVING

32 31 13 11/16, CHG 1: 05/17 CHAIN LINK FENCES AND GATES

DI VI SI ON 33 - UTI LI TI ES

33 16 15 11/20 WATER STORAGE STEEL TANKS

33 40 00 02/10, CHG 6: 02/19 STORM DRAINAGE UTILITIES

33 60 02 04/08 ABOVEGROUND HEAT DISTRIBUTION SYSTEM

33 61 13.13 02/16 PREFABRICATED UNDERGROUND HYDRONIC

ENERGY DISTRIBUTION

33 63 13.19 02/16 CONCRETE TRENCH HYDRONIC AND STEAM

ENERGY DISTRIBUTION

33 63 23 04/06 EXTERIOR ABOVEGROUND STEAM DISTRIBUTION

33 71 02 02/15 UNDERGROUND ELECTRICAL DISTRIBUTION

-- End of Project Table of Contents --

PROJECT TABLE OF CONTENTS Page 3

SECTION 25 05 11

CYBERSECURITY FOR FACILITY-RELATED HVAC AND GENERATOR CONTROL SYSTEMS

05/21

PART 1 GENERAL

This section includes requirements in support of DoD Risk Management Framework (RMF) for implementing cybersecurity requirements for Facility-Related Control System Equipment. Risk Management Framework Authorization to Operate (ATO) work for any Facility Related Control System is the responsibility of the Government designated Authorizing Official and the designated System Owner. Text in curly braces are not Contractor requirements.

Since this Section covers a wide range of control systems and their interfaces may have different capabilities and requirements for the control systems specified below, the cybersecurity requirements identified in this Specification will require coordination with the project site, the System Owner(s)(SO)/Information System Security Officer (ISSO), the Authorizing Official (AO), the Control System Cybersecurity Subject Matter Expert, and/or the Control System(s) Contractor/Integrator of the specific control system(s) being installed.

Refer to UFC 4-010-06, Cybersecurity for Facility-Related Control Systems, for requirements on incorporation into control cystem design and for general information on the RMF process as it applies to control systems.

Assistance for control system cybersecurity is available from the following Service organization:

Army: Control System Cybersecurity Mandatory Center of Expertise (CSC-MCX), Huntsville, AL Engineering and Support Center (CSC-MCX@usace.army.mil).

Many subparts in this Section contain text in curly braces ("{" and "}") indicating which cybersecurity control and control correlation identifier (CCI) the requirements of the subpart relate to. The text inside these curly braces is for Government reference only and enables coordination of the requirements of this Section with the RMF process throughout the design and construction process. Text in curly braces are not contractor requirements.

This Section refers to Security Requirements Guide (SRGs) and Security Technical Implementation Guide (STIGs). STIGs and SRGs are available online at the Information Assurance Support Environment (IASE) website at https://public.cyber.mil/stigs/downloads/ and an SRG/STIG Applicability Guide and Collection Tool is available at https://public.cyber.mil/stigs/SCAP/. Not all control system components have applicable STIGs or SRGs. The "Control Systems SRG" does not apply to work performed under this Section; all requirements within this section to apply applicable SRGs DO NOT include the "Control Systems SRG".

1.1 CONTROL SYSTEM APPLICABILITY

There are multiple versions of this Section associated with this project.

Different versions have requirements applicable to different control systems. This specific Section applies only to the following control

SECTION 25 05 11 Page 1 systems: .

1. Section 23 09 23.02 BACNET DIRECT DIGITAL CONTROL FOR HVAC AND OTHER

BUILDING CONTROL SYSTEMS herein after referred to as "BMS PLC" and also "GAS METERS".

2. Section 23 09 00 INSTRUMENTATION AND CONTROL FOR HVAC herein after referred to as "DDC TEMPERATURE CONTROLS".

3. Section 23 21 23 HYRDRONIC PUMPS herein after referred to as "Chiller Pumps".

4. Section 26 29 23 ADJUSTABLE SPEED DRIVE (ASD) SYSTEMS UNDER 600 VOLTS herein after referred to as "Pumps".

5. Section 26 32 17.00 GAS-FIRED COGENERATOR UNIT 1400-1600 KW, WITH AUXILIARIES herein after referred to as "GENERATOR(S)".

The C-I-A Impact Ratings Provided by the client for the Control Systems have been determined to be:{(Confidentiality=LOW), (Integrity=LOW), (Availability=LOW)}

1.2 CONTROL SYSTEM PLATFORM INFORMATION TECHNOLOGY (PIT) DESIGNATION

Application of the Cybersecurity requirements for the control system(s) listed in this specification will be performed from Level 1 through Level 2A based on the control system Platform Information Technology (PIT) level diagram in Appendix E of the UFC 4-010-06, Figure E-1 as it applies to the

ARMY.

1. BMS PLC(s) PIT LEVEL 2A connection only adding new equipment connections to exsting using BACNET/IP ETHERNET

2. GAS METERS PIT LEVEL 1 connection to the exsting BMS PLC using BACNET over LONWORKS

3. DDC TEMPERATURE CONTROLS PIT LEVEL 1 connection controlling the HVAC END DEVICES and connecting to the existing BMS PLC using BACNET over

LONWORKS

4. CHILLER PUMPS PIT LEVEL 1 connection to HVAC DDC using BACNET over

LONWORKS

5. PUMPS PIT LEVEL 1 connection to HVAC DDC using BACNET over LOWNWORKS

6. GENERATORS PIT LEVEL 1 connection to existing PLC using MS/TP

The Control System Integrator is responsbile for securing the control system(s) to the lowest, practical Level as indicated in the diagram.

Securing the control system(s) includes disabling all unneeded ports, protocols and services all the way down to level 0 of the control system.

If an exposed port or protocol cannot be disabled the integrator must employ a means to make the port or protocol inaccessible without damaging the control system, (e.g. locking the cover).

1.3 BASE-WIDE CONNECTIVITY REQUIREMENTS FOR CONTROL SYSTEMS

The following control system(s) will connect to a base wide platform for either monitoring, control, or both monitoring and control: Existing BMS PLC Contractor is to refer to the Engineering Drawings of the project for connection points or information technology infrastructure.

1.4 TRADITIONAL IT INFRASTRUCTURE SUPPORT REQUIREMENTS

Traditional IT requirements are defined as computers, switches, daisy chains, etc.

The following Control System(s) listed below require Traditional IT Infrastructure support, (e.g. computers, switches, daisy chains, etc):

SECTION 25 05 11 Page 2

NONE.

1.5 RELATED REQUIREMENTS

This section does not contain sufficient requirements to procure a control system and must be used in conjunction with other Sections which specify control systems. This Section adds cybersecurity requirements to the control systems specified in other Sections, and as these requirements are conditioned on the control system being provided, there may be requirements in this Section that will not apply to this project. All Sections containing facility-related control systems or control system components are related to the requirements of this Section. Review all specification sections to determine related requirements.

In cases where a requirement is specified in both this Section and in another Section, the more stringent requirement must be met. In cases where a requirement in this Section conflicts with the requirements of another Section such that both requirements cannot be met at the same time, request direction from the Contracting Officer Representative to determine which requirement applies to the project.

1.6 REFERENCES

The publications listed below form a part of this specification to the extent referenced. The publications are referred to within the text by the basic designation only.

AMERICAN SOCIETY OF HEATING, REFRIGERATING AND AIR-CONDITIONING

ENGINEERS (ASHRAE)

ASHRAE 135 (2020; Errata 2021) BACnet—A Data Communication Protocol for Building Automation and Control Networks

INSTITUTE OF ELECTRICAL AND ELECTRONICS ENGINEERS (IEEE)

IEEE 802.1x (2010) Local and Metropolitan Area Networks - Port Based Network Access Control

INTERNET ENGINEERING TASK FORCE (IETF)

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST)

NIST FIPS 140-2 (2001) Security Requirements for Cryptographic Modules

NIST FIPS 201-2 (2013) Personal Identity Verification (PIV) of Federal Employees and Contractors

U.S. DEPARTMENT OF DEFENSE (DOD)

DODI 8551.01 (2014) Ports, Protocols, and Services Management (PPSM)

DTM 08-060 (2008) Policy on Use of Department of Defense (DoD) Information Systems - Standard Consent Banner and User Agreement

SECTION 25 05 11 Page 3

DODD 8140.01 (2020) Cyberspace Workforce Management

U.S. ARMY (DA)

AR 380-67 (2014) Personnel Security Program

AR 380-49 (2013) Industrial Security Program

AR 25-2 (2019) Information Management: Army Cybersecurity

1.7 DEFINITIONS

1.7.1 Administrator Account

An administrator account is an account with full permissions to a device, application, or operating system, including the ability to create and modify other user accounts.

Note that the operating system Administrator Account may be different than Administrator Accounts for applications hosted on that operating system.

Also, most controllers will not have any support for accounts and will therefore not have an 'Administrator Account'.

1.7.2 Computer

A computer is one of the following:

a. a device running a non-embedded desktop or server version of Microsoft Windows

b. a device running a non-embedded version of MacOS

c. a device running a non-embedded version of Linux

d. a device running a version or derivative of the Android Operating System, where Android is considered separate from Linux

e. a device running a version of Apple iOS

Unless otherwise indicated or clear from context use of the word "device" in this Section includes computers.

1.7.3 Controller

A device other than a computer or Ethernet switch.

1.7.4 Mission Space

A device or media is in mission space if physical access to the device or media is controlled by the organization served by the device. For example, a VAV box controller in a suspended ceiling is in mission space if the VAV box serves that room; an electrical switchgear in an electrical room or an AHU in a mechanical room or on a rooftop may still be considered to be in mission space if the organization (mission) served by that switchgear or AHU controls access to the electrical room, mechanical room or rooftop.

SECTION 25 05 11 Page 4

1.7.5 Network

A network is a group of two or more devices that can communicate using a network protocol. Network protocols must provide a method for addressing devices on the network; a communication method that does not provide an addressing scheme is not a networked form of communication. Devices that communicate using a method of communication that does not support device addressing are not using a network.

1.7.6 Network Connected

A component is network connected (or "connected to a network") only when the device has a network transceiver which is directly connected to the network and implements the network protocol. A device lacking a network transceiver (and accompanying protocol implementation) can never be considered network connected. Note that (unlike many IT definitions of "Network Connected") a device connected to a non-IP network is still considered network connected (an IP connection or IP address is not required for a device to be network connected).

1.7.6.1 Wireless Network Connected

Any device that supports wireless network communication is network connected to a wireless network, regardless of whether the device is communicating using wireless. Unless physically disabled, devices with wireless transceivers support wireless, it is not sufficient to disable the wireless in software.

1.7.7 Network Media

The thing that provides the communication channel between the devices on a network. Typically wire, but might include wireless, fiber optic, or even power line (some network protocols allow sending network signals over power wiring).

1.7.8 User Account Support Levels

The support for user accounts is categorized in this Section as one of three levels:

1.7.8.1 FULLY Supported

Device supports configurable individual accounts. Accounts can be created, deleted, modified, etc. Privileges can be assigned to accounts.

These devices support user-based (as opposed to role-based) authentication.

1.7.8.2 MINIMALLY Supported

Device supports a small, fixed number of accounts (perhaps only one).

Accounts cannot be modified. A device with only a "User" and an "Administrator" account would fit this category. Similarly, a device with two PINs for logon - one for restricted and one for unrestricted rights would fit here (in other words, the accounts do not have to be the traditional "username and password" structure). These devices typically only support role-based authentication.

Examples of devices which MINIMALLY support accounts are a) a variable frequency drive with a single account which requires a PIN for access to

SECTION 25 05 11 Page 5 configuration; and b) a room lighting control touchpad interface that has a single account.

1.7.8.3 NOT Supported

Device does not support any Access Enforcement therefore the whole concept of "account" is meaningless.

1.7.9 Manual Local Input

Manual Local Inputs are system analog or binary inputs that are adjustable by a person but are, by intrinsic hardware design, very limited in potential capabilities. Manual Local Inputs do not have touch screens or full keyboards, but may have a few buttons or dials to allow input.

Manual Local Inputs do not have full graphic screens or dot-matrix displays, but may have simple lights (LEDs) or 7-segment displays. Manual Local Inputs do not have any sort of menu structure, each button has a single well-defined function.

Examples of Manual Local Inputs are H-O-A switches, simple thermostats, and disconnect switches.

1.7.10 Card Reader

A card reader is an input/output device whose primary function is to assist in two-factor authentication. A card reader must have an interface to read data from a card and may be able to write data to a card. A card reader may have a means (such as buttons, keypad, touchscreen, etc.) for a user to input a PIN or password, as well as a limited display.

1.7.11 User Interface

A User Interface (UI) is something other than a Manual Local Input or Card Reader that allows a person to interact with the system or device. Note that while a Card Reader is not by itself a User Interface, a User Interface may contain a Card Reader in order for it to authenticate its user. Within control systems, there are a wide range of User Interfaces.

Two important distinctions are 1) whether the user interface is Local or Remote, and 2) the effective capabilities of the User Interface to alter data, which is the "privilege" of the user interface (where effective privilege available to a specific user at a specific user interface is the combination of the greatest privilege offered by the user interface and the specific account the user is logged into).

1.7.11.1 Local User Interface

A Local User Interface is a user interface where the physical hardware the user interacts with (keyboard, buttons, display, etc.) is physically part of the device being affected. All of the relevant characteristics of the user interface are embodied within a single device.

Note that a Local UI may be able to access data in a different device, Local versus Remote in this context refers to the user interface itself;

the capability to access data in a different device is covered under "Full User Interface".

SECTION 25 05 11 Page 6

1.7.11.2 Remote User Interface

A Remote User Interface implements a Client/Server model where the physical hardware the user interacts with (Client) is physically distinct from the device being affected (Server). Most or all of the security and functionality characteristics of the user interface are defined by the Server, not the Client. The Client and Server communicate via a network connection. A common example of a remote user interface is a web-based interface where the browser (client) is generally on different hardware than the web server (server). A Remote UI remains a Remote UI even if the user happens to be at a Client on the same hardware as the Server. What is important is that a) the Client may be on different hardware than the Server and b) the majority of the security and functional characteristics of the interface are defined at the Server.

Note that this definition of "remote" is consistent with that generally used in the control industry but is not aligned with the NIST 800-53 definition of "Remote", which refers to "outside the system". The term "Remote" here better aligns with the NIST 800-53 definition of "Network" (remote from within the system) Access.

1.7.11.3 Types of User Interface (by capability)

User interfaces are also categorized by their capabilities as being Read Only, Limited, or Full.

1.7.11.3.1 Read-Only User Interface

A Read Only User Interface (also referred to as a View-Only User Interface) is a user interface that only allows for reading data, it does not allow (have the capability to) modify data. A Read Only User Interface may be either Local or Remote. A User Interface that is configured to be Read Only (by some other means than the interface itself, such as using configuration software on a laptop) is a Read-Only Interface. Note a Read Only User Interface may have buttons (or touch screen, etc.) allowing the user to navigate through the presentation of data.

Examples of a Read Only User Interfaces are a) a publicly viewable "energy dashboard" showing weather data and energy usage within a building and b) digital wayfinding signage.

1.7.11.3.2 Limited User Interface

A Limited User Interface is a user interface that - by design - can only alter information local to the user interface. Note that the determination of "alter" includes only direct interactions, it explicitly excludes interactions that might occur as secondary effects. For example, an interface changing the flow setpoint in a pump controller is a direct interaction, the subsequent change in flow (as well as any subsequent downstream changes in valve position) are not direct interactions.

Two examples of LIMITED UIs are: a) a variable speed drive has a Limited Local User Interface which allows the user to change properties within the drive, but does not allow affecting things outside the drive; and b) a typical home WiFi Router has a Limited Remote User Interface which allows configuration of the Router, but does not allow direct interaction with other devices.

SECTION 25 05 11 Page 7

1.7.11.3.3 Full User Interface

A Full User Interface can alter information in devices outside the device with the user interface. For example, a typical Local Display Panel is a Full Local User Interface while a browser-based front end is a Full Remote User Interface.

1.7.11.3.4 View-Only User Interface

See Read-Only User Interface

1.7.11.4 Other User Interface Terminology

In addition to defining whether a user interface is a Hardware Limited, Read-Only, Limited or Full, and whether it is Local or Remote, user interfaces are classified by whether they are writable or privileged.

1.7.11.4.1 Writable User Interface

Any User Interface that is not Read-Only is Writable. (Limited User Interfaces and Full User Interfaces are both writable user interfaces (as they are capable of changing a value)).

1.7.11.4.2 Privileged User Interface

A Privileged UI is a UI that has sufficient capabilities or functionality that it requires specific cybersecurity measures to be put in place to limit its unauthorized use. Ultimately, whether a specific user interface is considered a Privileged User Interface must be determined by usage.

Unless otherwise specified, user interfaces can be determined to be privileged or not using the following:

a. Read-Only User Interfaces are not privileged user interfaces.

b. Full User Interfaces are privileged user interfaces.

c. User interfaces that allow for configuration of auditing or allows for modification or deletion of audit logs are privileged user interface.

d. User interfaces that allow for reprogramming a network connected device is a privileged user interface.

e. Except as specified above, a Limited User Interface must be determined to be privileged or not based on the specific capabilities and use case of the user interface. In general however, user interfaces that do not offer significant capabilities above and beyond those available at that location via other means (e.g. such as a disconnect switch, breaker, or hand-off-auto switch, or physical attack) are not privileged.

1.7.12 Wireless Network

Any network that communicates without using wires or fiber optics as the communication media. Wireless networks include: WiFi, Bluetooth, ZigBee, cellular, satellite, 900 MHz radio, 2.4 GHz, free space optical, point-to-point laser, and IR.

{For Government Reference Only: This subpart (and its subparts) relates to AC-18(a), AC-18(b); CCI-001438, CCI-001439, CCI-002323, CCI-001441}

SECTION 25 05 11 Page 8

Unless specifically authorized by the AO, the use of wireless is not used for this project. All wireless capabilities for any controller or device must be disabled from the manufacturer and a statement provided from the contractor verifying this disablement.

1.7.13 Wired Broadcast Network

Wired Broadcast Networks are any network, such as powerline carrier networks and modem (wired telephony), that use wire-based technologies where there is not a clearly defined boundary for signal propagation.

1.8 ADMINISTRATIVE REQUIREMENTS

1.8.1 Points of Contact

Coordinate with the following Points of Contact as indicated in this Section and as required. Not all projects will require coordination with all Points of Contact. When coordination is required and no Point of Contact is indicated, coordinate with The Contracting Office Representative (COR).

a. Password Point of Contact: The Contracting Office Representative (COR)

1.8.2 Coordination

Coordinate the execution of this Section with the execution of all other Sections related to control systems as indicated in the paragraph RELATED REQUIREMENTS. Items that must be considered when coordinating project efforts include but are not limited to:

a. Within 60 calendar days after contract award, the Cybersecurity Representative must schedule a Cybersecurity Kickoff Meeting with the Contracting Office Representative, system owner(s), system program manager(s), and Information System Security Manager (ISSM) responsible for the project/project site. The meeting will be located at a specific time and place to be determined by the Contracting Officer Representative (COR).

b. If requesting permission for wireless or wired broadcast communication, the Wireless and Wired Broadcast Communication Request submittal must be approved prior to control system device selection and installation.

c.

d. If requesting permission for the use of a device with multiple physical connections to IP networks, the Multiple IP Connection Device Request must be approved prior to control system device selection and installation.

e. Wireless testing may be required as part of the control system testing. See requirements for the Wireless Communication Test Report submittal.

f. The Cybersecurity Interconnection Schedule must be coordinated with other work that will be interconnected to, and interconnections must be approved by the Government before relying on them for system

SECTION 25 05 11 Page 9 functionality.

g. Cybersecurity testing support must be coordinated across control systems and with the Government cybersecurity testing schedule.

h. Passwords must be coordinated with the indicated contact for the project site.

i. Contractor Computer Cybersecurity Compliance Statements must be provided for each contractor using contractor owned computers.

1.9 SUBMITTALS

Government approval is required for submittals with a "G" or "S" classification. Submittals not having a "G" or "S" classification are for Contractor Quality Control approval. Submit the following in accordance with Section 01 33 00 SUBMITTAL PROCEDURES:

SD-01 Preconstruction Submittals Device Account Lock Exception Request; G , DO

Multiple Ethernet Connection Device Request; G , DO

Contractor Computer Cybersecurity Compliance Statements; G , DO

Contractor Temporary Network Cybersecurity Compliance Statements; G , DO

Cybersecurity Interconnection Schedule; G , DO

Proposed STIG and SRG Applicability Report; G , DO

Control System Integrator And Network Administrator; G , DO

SD-02 Shop Drawings

Network Communication Report; G , DO

Cybersecurity Riser Diagram; G , DO

SD-03 Product Data

Control System Cybersecurity Documentation; G , DO

SD-06 Test Reports

Control System Cybersecurity Testing Procedures; G , DO

Control System Cybersecurity Testing Report; G , DO

SD-07 Certificates

Software Licenses; G , DO

SD-11 Closeout Submittals

Confidential Password Report; G , DO

SECTION 25 05 11 Page 10

Enclosure Keys; G , DO

Software and Configuration Backups; G , DO

Auditing Front End Software; G , DO

Device Audit Record Upload Software; G , DO

System Maintenance Tool Software; G , DO

Control System Scanning Tools; G , DO

STIG, SRG and Vendor Guide Compliance Result Report; G , DO

Control System Inventory Report; G , DO

1.10 QUALITY CONTROL

For the positions listed below resumes should be submitted to the Government within 14 days after notice to proceed. All certifications must be in effect prior to being hired. These positions may serve accross the contract.

1.10.1 Control System Integrator and Network Administrator

This individual will oversee all work within this specification for the control system(s) being installed. This position requires that the individual currently meet DODD 8140.01 requirements for Information Assurance Manager (IAM) Level II.

The individual will complete all work at the computing, network, and/or the control system integration level environment as applicable. This position requires that the individual meet Information Assurance Technical Level II Certification in accordance with Information Workforce Improvement Program DODD 8140.01 . Individuals for this position should have experience in securing DoD Systems, Security Technical Implementation Guides (STIGs), Security Requirements Guides (SRGs), and associated tools and practices. Cybersecurity Control System experience is highly desirable.

1.10.2 Duties

The Control System Integrator and Network Administrator is responsible for coordinating with Client designated System(s) Owner(s) (SOs) and/or Information System Security Officer(s) (ISSOs)installing installing and configuring the Control System(s). He/She will serve as the primary point of contact between the government and the Contractor regarding all cybersecurity work related to the control systems specified in this section.

Systems may be located within controlled access areas. Access request procedures and requirements for access must be followed for these locations. Escorts may be necessary in many if not all circumstances. The Control System Integrator and Network Administrator will be responsible

SECTION 25 05 11 Page 11 for coordinating access and escorts with the Government.

1.10.3 Qualifications

All Cybersecurity Control System Contractor/Integrator Personnel installing or interacting with new or existing systems hardware and software are required to be United States citizens. Personnel requesting access to the project site, existing systems for the purpose of installing new software, programming/configuring software, or modifying code for existing software are required to have a favorable security background check and do not have a Felony record.

Individuals installing or interacting with new or existing control systems equipment will be required to submit documentation showing compliance with the following requirements:

1. Meet all requirements as outlined in ARMY REGULATION AR 380-49 , Industrial Security program which which addresses contractor operations on Army installations or at Army facilities.

2. Contractor employees who require access to government IT and/or government control systems must be determined to be trustworthy by designated Government official prior to grant of IT access in ccordance with AR 25-2 and AR 380-67 .

3. Complete and submit the appropriate DD FORM 2875 - SYSTEM AUTHORIZATION ACCESS REQUEST SAAR 30 days prior to system access.

4. Submit completed DoD CYBER AWARENESS Challenge training at https://public.cyber.mil/training/ no less than 30 days prior to base access.

5. Submit complete DoD CUI Mandatory Training at https://www.dodcui.mil/Home/Training/ no less than 30 days prior to base access.

6. Individuals developing or using Security Controls documentation, or other documents that are designated "Controlled Unclassified Information" (CUI), will be required to complete and submit a signed Non-Disclosure and Data Handling Agreement for CUI information.

1.11 DELIVERY, STORAGE, AND HANDLING

The Contractor is responsible for coordinating with the Contractor Officer Representative (COR) for the safe DELIVERY, STORAGE, and HANDLING of all equipment.

1.12 CYBERSECURITY DOCUMENTATION

{For Government Reference Only: This subpart (and its subparts) relates to PL-7, RA-3(a); CCI-003071, CCI-001048}

1.12.1 Control System Cybersecurity Documentation Format

In general, and when requested from the System Owner (SO) and/or the client designated Cybersecurity POC, Contractor shall provide all requested cybersecurity documentation for review as follows for each

SECTION 25 05 11 Page 12 control system:

1. Final documents shall be furnished both as a soft copy burned to a CS/DVD and as hard copy printouts, single-sided and bound for each control system.

2. Network mappings shall be provided in .dwg CAD format in addition to PDF hard copies.

3. Tabular data shall be provided in Microsoft Excel format available at https://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/ufgs-25-05-11 in addition to PDF and hard copies. Summary information may be provided in Microsoft Word format or Microsft Excel format in addition to PDF and hard copies.

4. Alternative formats will be acceptable at the sole discretion of the client designated Cybersecurity POC.

1.12.2 Proposed STIG and SRG Applicability Report

For each model of network connected or network infrastructure device, use the DISA SRG/STIG Applicability Guide and Collection Tool (available at https://public.cyber.mil/stigs/SCAP/ to identify applicable STIGs or SRGs and provide a report indicating applicable STIGs and SRGs for each model.

The report should include all computers, switches and software that runs on each device. If a device does not have an individual STIG a corresponding generic STIG should be applied to meet the requirement. The applicability report should be a cross reference of hardware/software to the appropriate STIG/SRG.

The Contractor shall compile a list of all available software patches and updates that were provided on the system. The patch and update list shall include the hardware and software to which the patch or update applies.

Each line item shall include the patch or update's type and version. The contractor is NOT required to provide a list of the patches and updates that were NOT installed during construction or warranty period. If no software patches and updates were provided on the control system the Contractor shall submit documentation to the Government stating such.

Contractor shall provide documentation and information to the System Owner (SO) the likelihood and magnitude of harm from the unauthorized access, disruption, modification, or disabling of functional control systems as a part of their overall Cybersecurity documentation for the SO's use in their System Security Plan (SSP). Contractor is not responsible for any part of the execution of, nor provision of, any control system's SSP for Risk Assessment. Contractor is only to provide SO with the likelihood and magnitude of harm should the control system(s) fail to function.

1.12.3 Cybersecurity Interconnection Schedule

{For Government Reference Only: This subpart relates to CA-3(b), PL-8, SC-7(9), SC-7(11); CCI-000258, CCI-003072, CCI-003073, CCI-003075, CCI-002398, CCI-002399, CCI-002401, CCI-002402, CCI-002403.}

Provide a completed Cybersecurity Interconnection Schedule documenting network connections between the installed system and other systems.

SECTION 25 05 11 Page 13

Provide the following information for each device directly communicating between systems: Device Identifier, Device Description, Transport layer Protocol, Network Address, Port (if applicable), MAC (Layer 2) address (if applicable), Media, Application Protocol, Service (if applicable), Descriptive Purpose of communication.

If other control system Sections used on this project include submittals documenting this information, provide copies of those submittals to meet this requirement.

In addition to the requirements of Section 01 33 00 SUBMITTAL PROCEDURES, provide the Cybersecurity Interconnection Schedule as an editable Microsoft Excel file (a template Cybersecurity Interconnection Schedule in Excel format as stated above.

1.12.4 Network Communication Report

{For Government Reference Only: This subpart (and its subparts) relates to CA-9, PL-8; CCI-003075; CCI-002102, CCI-002103, CCI-002104, CCI-002105, CCI-003072, CCI-003073, CCI-003075 and also the submittal requirements associated with CM-6, CM-7, SC-8 and SC-41 including CM-7(3), CCI-000388. }

Provide a network communication report. For each networked device, document the communication characteristics of the device including communication protocols, services used, encryption employed, and a general description of what information is communicated over the network. For each device using IP, document all TCP and UDP ports used. For non-IP communications, document communication protocol and media used. If other control system Sections used on this project include submittals documenting this information, provide copies of those submittals to meet this requirement.

In addition to the requirements of Section 01 33 00 SUBMITTAL PROCEDURES, provide the Network Communication Report as an editable Microsoft Excel file.

1.12.5 Control System Inventory Report

{For Government Reference Only: This subpart (and its subparts) relates to CM-8(a), SI-17, IA-3; CCI-000389, CCI-000392, CCI-000398, CCI-002773, CCI-002774, CCI-002775, CCI-000777, CCI-000778, CCI-001958}

Provide a Control System Inventory report using the Inventory Spreadsheet listed under this Section at https://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/ufgs-25-05-11 documenting all devices, including networked devices, network infrastructure devices, non-networked devices, input devices (e.g.

sensors) and output devices (e.g. actuators). For each device provide all applicable information for which there is a field on the spreadsheet in accordance with the instructions on the spreadsheet.

The final cybersecurity Control System Inventory Report shall be representative of the system(s) and devices/modules/equipment in their final states after completion of any control system-specific, commissioning, (e.g. ASHRAE Commissioning etc.). All Cybersecurity updates, patches, scans, STIGs, etc. are to be applied prior to that system(s)' commissioing if required by that control system(s)'

SECTION 25 05 11 Page 14 specification. No alterations shall be made to systems or devices/modules/equipment after submission of final cybersecurity documentation without the express written consent of the Government and/or Government designated System Owner(SO). Documentation shall be updated for such alterations until final acceptance of the control system by the Government. Upon acceptance of the control system by the Government, future updates to the Control System(s)' cybersecurity documentation shall be the responsibility of the Government.

In addition to the requirements of Section 01 33 00 SUBMITTAL PROCEDURES, provide the Control System Inventory Report as an editable Microsoft Excel file as stated above.

1.12.6 Software and Configuration Backups

{For Government Reference Only: This subpart (and its subparts) relates to CM-2, CP-10, IR-1(a), PM-5; CCI-000293, CCI-000550, CCI-000551, CCI-000552, CCI-002776, CCI-000207}

For each control device on which software is installed under this project and the device has the ability, provide a recovery image of the final as-built. If the control device as-built image is part of another submital note that in an as-built report documenting under what submission the as-built is being submitted. The intent is to provide an image that allows the system owner to restore back to original state. As-built, baseline configuration of the control system should include, drawings, software licenses, source code, hardware, etc.; anything necessary to restore the control system to full-functionality should an incident occur requiring restoration of the control sytem.

For Control Systems, the definition of "incident" must include non-security related control system failures, (e.g. broken fan belt, sensor out of calibration). Contractor is not responsible for writing/developing full Incident Response Plan however, Contractor is to provide input to the System Owner (SO) for Incident Response plan to help document the types of incidents which may occur and how to address any control system specific actions to be taken.

If any or all of these are provided under another Section, provide documentation indicating this and referencing those submittals.

1.12.7 Cybersecurity Riser Diagram

{For Government Reference Only: This subpart (and its subparts) relates to PL-2(a), PL-8; CCI-003051, CCI-003053, CCI-003072, CCI-003073, CCI-003075}

Provide a cybersecurity riser diagram of the complete control system including all network and device hardware. If the control system specifications require a riser diagram submittal, provide a copy of that submittal as the cybersecurity riser diagram. Otherwise, provide a riser diagram in one-line format.

1.12.8 STIG, SRG and Vendor Guide Compliance Result Report

For every component (device or software) with an applicable STIG or SRG in the Proposed STIG and SRG Applicability Report, provide a result report documenting compliance with the STIG or SRG requirements. For components which are scannable by the SCAP (security content automation protocol)

SECTION 25 05 11 Page 15 tool (available online at https://public.cyber.mil/stigs/scap ), provide the SCAP report and raw scan results.

Provide copies of all manual STIG Checklist that were applied. Submission shall be in electronic format.

For all SCAP/NESUS/ACAS scans document all findings that could not be corrected. Include in the report the finding, mitigation, and any impact on the system if the finding is implemented or not implemented to inlcude possible risk and damage to the control system.

For every component (device or software) with manufacturer provided cybersecurity documentation, procedure, or method for secure configuration or installation, provide a report documenting how the component was configured and any deviation from the manufacturer instructions.

For STIG requirements that cannot be met include reason(s) as to why the device could not meet compliance. Describe any affects implementing the STIG would have on the control system. Also list any mitigations that were taken to reduce the vulnerability caused by the non-complaince. This report should be completed and provided to the Government in electronic format.

1.12.9 Control System Cybersecurity Documentation

{For Government Reference Only: This subpart (and its subparts) relates to SA-5 (a),(b),(c); CCIs: CCI-003124, CCI-003125, CCI-003126, CCI-003127, CCI-003128, CCI-003129, CCI-003130, CCI-003131}

Provide a Control System Cybersecurity Documentation submittal containing the indicated information for each device and software application.

1.12.9.1 For HVAC Control System Devices

1.12.9.1.1 HVAC Control System Devices FULLY Supporting User Accounts

For all HVAC Control System Devices which FULLY support user accounts, provide:

a. Documentation that describes secure configuration of the device {For Government Reference Only: relates to CCI-003124}

b. Documentation that describes secure operation of the device {For Government Reference Only: relates to CCI-003124}

c. Documentation that describes effective use and maintenance of security functions or mechanisms for the device {For Government Reference Only:

relates to CCI-003127}

d. Documentation that describes known vulnerabilities regarding configuration and use of administrative (i.e. privileged) functions for the device {For Government Reference Only: relates to CCI-003128}

e. Documentation that describes user-accessible security functions or mechanisms in the device and how to effectively use those security functions or mechanisms; or a specific indication that there are no user-accessible security functions or mechanisms in the device {For Government Reference Only: relates to CCI-003129}

SECTION 25 05 11 Page 16

f. Documentation that describes methods for user interaction which enables individuals to use the device in a more secure manner {For Government Reference Only: relates to CCI-003130}

1.12.9.1.2 All Other HVAC Control System Devices

For all HVAC Control System Devices which do not FULLY support user accounts, provide:

a. Documentation that describes secure configuration of the device; or a specific indication that there are no secure configuration steps that apply {For Government Reference Only: relates to CCI-003124}

b. Documentation that describes effective use and maintenance of security functions or mechanisms for the device; or a specific indication that there are no security functions or mechanisms in the device {For Government Reference Only: relates to CCI-003127}

c. For devices which include a user interface, documentation that describes methods for user interaction which enables individuals to use the device in a more secure manner {For Government Reference Only:

relates to CCI-003130}

1.12.9.2 Default Requirements for Control System Devices

For control system devices where Control System Cybersecurity Documentation requirements are not otherwise indicated in this Section, provide:

a. Documentation that describes secure configuration of the device {For Government Reference Only: relates to CCI-003124}

b. Documentation that describes secure installation of the device {For Government Reference Only: relates to CCI-003125}

c. Documentation that describes secure operation of the device {For Government Reference Only: relates to CCI-003124}

d. Documentation that describes effective use and maintenance of security functions or mechanisms for the device {For Government Reference Only:

relates to CCI-003127}

e. Documentation that describes known vulnerabilities regarding configuration and use of administrative (i.e. privileged) functions for the device {For Government Reference Only: relates to CCI-003128}

f. Documentation that describes user-accessible security functions or mechanisms in the device and how to effectively use those security functions or mechanisms {For Government Reference Only: relates to

CCI-003129}

g. Documentation that describes methods for user interaction which enables individuals to use the device in a more secure manner {For Government Reference Only: relates to CCI-003130}

h. Documentation that describes user responsibilities in maintaining the security of the device {For Government Reference Only: relates to

CCI-003131}

SECTION 25 05 11 Page 17

1.13 SOFTWARE LICENSING

{For Government Reference Only: This subpart (and its subparts) relates to SI-2(a), SI-2(c), SI-7(14); CCI-001227, CCI-002605, CCI-002737}

For all software provided that has not already been licensed to the government or project site, provide a license to the Government for a period of no less than 5 years, and the license must also include the following software updates:

a. Security and bug-fix patches issued by the software manufacturer.

b. Security patches to address any vulnerability identified in the National Vulnerability Database at http://nvd.nist.gov with a Common Vulnerability Scoring System (CVSS) severity rating of MEDIUM or higher.

Provide a single Software Licenses submittal with documentation of the software licenses for all software provided

1.14 CYBERSECURITY DURING CONSTRUCTION

{For Government Reference Only: This subpart (and its subparts) relates to

AC-18, SA-3; CCI-000258}

In addition to the control system cybersecurity requirements indicated in this section, meet following requirement throughout the construction…