Attachment 07 IDIQ attachment ADM 7002.1 GSA Smart Buildings 2024 12 26.pdf

GENERAL SERVICES ADMINISTRATION

Washington, DC 20405

ADM 7002.1

December 16, 2021

GSA ORDER

SUBJECT: GSA Smart Buildings

1. Purpose.

The purpose of this Order is to uphold consistency in the application, evaluation and implementation of smart buildings (SB) system technology, consistent with the following SB program’s strategic goals:

a. Modernize facility management operations and maintenance to generate cost savings and best value for the taxpayers;

b. Support energy conservation and limit environmental impact;

c. Use technology to quantify and manage drivers of building occupant comfort to improve building occupant satisfaction;

d. Empower U.S. General Services Administration (GSA) staff and contract employees with data to make informed facility management decisions;

e. Promote interoperability between devices through open protocol systems with the objective of converging normalized data on, at least, a facility-wide tool;

f. Implement and maintain cybersecurity best practices within GSA national, regional and local offices for consistency within GSA Internet Protocol (IP) network based systems, including downstream devices; and

g. Protect against threats to the U.S. Government through the inclusion of cyber supply chain risk management (C-SCRM) principles.

Consistency achieved through this Order will enable opportunities in resource sharing, propagating best practices and advancing appropriate guides for project delivery of innovative new systems.

2. Background.

Starting around 2005, GSA’s SB program focused on advanced metering and fault detection and diagnostics (FDD) technology, with an emphasis specifically on GSA’s FDD application, GSALink. Advancements in operational technology and broader implementation of computer-based building control systems has propagated opportunities in SB technologies. A group of SB specialists within the GSA SB community identified the need for a directive to support consistency within the program and to achieve alignment on the implementation approach as technology offerings continue to be adopted within the Public Buildings Service (PBS) portfolio. This Order is needed to incorporate consistency across the inventory of federally owned buildings under GSA’s jurisdiction, custody and control for effective long-term support and adherence to enhanced security requirements. This Order assists in the modernization and unification of GSA’s building control systems portfolio, and applies not only to GSALink facilities, but also to other facilities with new emerging IP-based technology, building automation systems (BAS), device-based control systems, or any combination of the foregoing.

3. Definitions.

a. GSA Smart Buildings. Convergence of a building’s management, monitoring or control systems, or any combination of the foregoing, on common GSA-supported network infrastructure to enable access to real-time controls systems performance data (i.e., data points) towards the goal of interoperability for enhanced operations, cost savings and optimal building environments to increase building occupant comfort.

b. Building Monitoring and Control System. Building monitoring and control (BMC) systems are designed to operate building equipment or obtain data from the building equipment or environment, or both. BMC systems include their controllers, devices and sensors.

(1) Examples include, but are not limited to, systems for FDD or GSA’s analytical application - GSALink; utility or advanced metering; heating, ventilation and air conditioning; on-site renewable energy generation; BAS and building management systems; smart sensors; occupancy sensors; single pane of glass; smart energy systems, including photovoltaic systems, smart grid technology or grid interactive technology, or both; digital signage; irrigation control; machine learning (ML) and artificial intelligence on building control systems, lighting controls or network/connected electric vehicle charging stations, or any combination of the foregoing.

(2) The following systems will typically be excluded or otherwise will have limited integration/interconnections with BMC systems: fire alarms, smoke control and life-safety systems; physical access control systems; security cameras; and elevator systems.

c. Operational Technology. Operational technology (OT) are programmable systems or devices that interact with the physical environment (or manage devices that interact with the physical environment). These systems or devices detect or cause a direct change through the monitoring or control, or both, of devices, processes and events. Examples include industrial control systems, building management systems, fire control systems, and physical access control mechanisms, as applicable.

(Source(s): NIST SP 800-37 Rev. 2)

d. Internet of Things. The Internet of Things (IoT) is a name for the aggregate collection of network-enabled devices, excluding traditional computers like laptops and servers. Types of network connections can include Wi-Fi connections, Bluetooth connections and near-field communication.

4. Scope and Applicability.

a. This Order applies to all GSA PBS employees and contractor employees in performance of their duties related to federally owned facilities under GSA’s jurisdiction, custody and control. This Order includes all BMC systems, OT or IoT, including IP-network-based systems, cellular- or mobile-based systems and their downstream devices. This Order applies to all duties in support of design, construction or maintenance on BMC systems, OT or IoT, on small projects, capital projects, reimbursable work authorization projects, or maintenance requests. All projects, regardless of origin or threshold, that modify, connect to or affect BMC systems, OT or IoT require the involvement of the designated SB stakeholders, as described in greater detail in section 6 of this Order.

b. This Order does not apply to leased facilities. This Order only applies to federally owned facilities under GSA’s jurisdiction, custody and control. The PBS Leasing Alert on Cybersecurity Measures for Leased Facilities (LA-FY18-05) may serve as a reference for leased facilities. However, the PBS Office of Leasing must be consulted on any guidance related to leased facilities.

c. This Order does apply to delegated facilities. However, the process for execution of work should be confirmed with GSA and may vary from the Technology Policy or subsequent program guides, or both.

d. This Order does not apply to occupant agency systems or networks.

5. Policy.

This Order supports existing federal mandates and policies, including the PBS-P100, GSA Technology Policy for PBS-Owned BMC Systems, Building Technologies Technical Reference Guide (BTTRG), and other existing policies and guides, as such mandates, policies and guides may be revised from time to time.

https://csrc.nist.gov/glossary/term/operational_technology https://www.gsa.gov/real-estate/design-construction/engineering-and-architecture/facilities-standards-p100-overview https://insite.gsa.gov/organizations/staff-offices/office-of-gsa-it/office-of-public-buildings-services-ip/public-buildings-information-technology-services/building-and-energy-systems/library-of-documentation-guidance-and-resources#BACnet%20Resources https://insite.gsa.gov/organizations/staff-offices/office-of-gsa-it/office-of-public-buildings-services-ip/public-buildings-information-technology-services/building-and-energy-systems/library-of-documentation-guidance-and-resources#BACnet%20Resources

6. Procedures.

The PBS Facilities Management SB program works closely with the Office of Public Buildings Information Technology Services. Implementation of IP systems is reliant on close collaboration among PBS regional representatives, contractors and the GSA Office of the Chief Information Officer (OCIO). Procedures identified within this Order are intended as a starting point for PBS employees initiating an installation of IP systems on behalf of PBS within its federally owned inventory. The following guides or reference documents should be applied in consultation with PBS SB intelligent building industry experts (IBIE), regional facility management SB specialists and regional Building Technology System Division (BTSD) technical project managers (PM):

a. PBS Procedures.

(1) Requirements for BAS work must include the GSA Data Normalization for Building Automation Systems for consistency in naming convention. This will enable efficient integration of information across PBS systems, as necessary.

(2) In addition, the following two program guides support consistency in framework and system configuration to enable interoperability of data, if necessary, within the PBS portfolio.

(a) GSA Smart Buildings Implementation Guide

(b) GSA Smart Buildings Program Guide

(3) C-SCRM principles are supported through the implementation of the PBS SCRM Organizational Level Plan.

b. OCIO Procedures.

(1) The following building technology guides serve to align with OCIO on requirements and installation of building systems under the scope and applicability of this Order.

(a) Building Technologies Technical Reference Guide

(b) Telecommunications Distribution Design Guide

(c) Guidance for drafting a BMC Configuration Management and Hardening Plan

(2) Cybersecurity and Hardening Guides

(a) BAS_Security_Assessment_Process

(b) CIO-IT Security-09-48 Security & Privacy Requirements for IT Acquisition Efforts https://insite.gsa.gov/cdnstatic/GSA%20Data%20Normalization%20for%20Building%20Automation%20Systems_v25.pdf https://insite.gsa.gov/cdnstatic/GSA%20Data%20Normalization%20for%20Building%20Automation%20Systems_v25.pdf https://insite.gsa.gov/cdnstatic/GSA%20Smart%20Buildings%20Implementation%20Guide_v12.pdf https://insite.gsa.gov/cdnstatic/GSA%20Smart%20Buildings%20Program%20Guide_v11.pdf https://insite.gsa.gov/cdnstatic/PBS%20SCRM%20Org%20Plan%20Signed.pdf https://insite.gsa.gov/cdnstatic/PBS%20SCRM%20Org%20Plan%20Signed.pdf https://preview-insite.gsa.gov/organizations/staff-offices/office-of-gsa-it/office-of-public-buildings-services-ip/public-buildings-information-technology-services/building-and-energy-systems/library-of-documentation-guidance-and-resources https://preview-insite.gsa.gov/organizations/staff-offices/office-of-gsa-it/office-of-public-buildings-services-ip/public-buildings-information-technology-services/building-and-energy-systems/library-of-documentation-guidance-and-resources https://drive.google.com/file/d/0B39aGyo3bI4GNmtTdndhM0ZrWVk/view?resourcekey=0-l7shJPZVLcTu6gJnEw9mjw https://drive.google.com/file/d/0B39aGyo3bI4GNmtTdndhM0ZrWVk/view?resourcekey=0-l7shJPZVLcTu6gJnEw9mjw https://preview-insite.gsa.gov/node/158012?term= https://preview-insite.gsa.gov/cdnstatic/insite/Security_and_Privacy_Requirements_for_IT_Acquisition_Efforts_%5BCIO_IT_Security_09-48_Rev_6%5D_04-15-202.pdf

(c) CIO 2100.1M GSA IT Security Policy

(d) CIO-IT Security-06-30 Managing Enterprise Cybersecurity Risk

(e) CIO IT Security-06-32 Media Protection (MP)

(3) Application Programming Interface (API) and Web Security Guides

(a) CIO IT Security-17-81 Web Browser Technologies Hardening

(b) CIO IT Security-07-35 Web Application Security

(c) CIO IT Security-19-93 Application Programming Interface(API) Security

c. Signoff Process.

(1) GSA employees, contractors and representatives must work with regional SB contacts or their designees to initiate projects and confirm official signoff has been obtained through key project milestones.

(a) Coordination should be initiated through the regional SB contacts or their designees to align stakeholders.

(b) Stakeholders will include the regional facility management SB specialists, PBS SB IBIEs and GSA-IT regional BTSD technical PMs.

(2) In accordance with the Federal Information Security and Management Act, GSA IT must be engaged before the acquisition package is submitted for all procurements that include information technology (IT) components (e.g., IP-enabled devices, network connectivity, cloud components, and wireless).

d. GSA SB Advisory Board. The intent of this Order is not to stifle innovation within GSA, but rather to align experts within GSA for initiatives to be successful. As such, this Order will establish a new GSA SB Advisory Board (Advisory Board), composed of GSA national and regional representatives, for evaluation of new or innovative solutions in SB technology. Initiatives or solutions should be presented and approved by the Advisory Board prior to acquisition of products or services. The objective of this Advisory Board is to promote compliance with pertinent policies and guides. The Advisory Board will also identify gaps that prohibit successful and efficient implementation of SB technologies. The main goal of this board is to support consistency in broad deployment of technology across the GSA portfolio. This is in contrast to the more narrow deployment of experimental technology through the Green Proving Ground (GPG) Program. Technologies for GPG will be evaluated independently through the defined Authority to Operate (ATO) process, and once proven for broad deployment, then they can be considered for further adoption with the SB Advisory Board.

https://preview-insite.gsa.gov/directives-library/gsa-information-technology-it-security-policy-21001m-cio?term= https://preview-insite.gsa.gov/cdnstatic/insite/Managing-Enterprise-Cybersecurity-Risk-%5BCIO-IT-Security-06-30-Rev-21%5D-07-21-2021docx.pdf https://preview-insite.gsa.gov/cdnstatic/insite/Media_Protection_%28MP%29_%5BCIO_IT_Security_06-32_Rev_5%5D_03-27-2020_1607023612.pdf https://preview-insite.gsa.gov/cdnstatic/insite/Web_Browser_Technologies_Hardening_%5BCIO_IT_Security_17-81_Rev_2%5D_12-01-2020docx_%281%29.pdf https://preview-insite.gsa.gov/cdnstatic/insite/Web_Application_Security_%5BCIO_IT_Security_07-35_Rev_4%5D_08-20-2018.pdf https://preview-insite.gsa.gov/cdnstatic/insite/Application_Programming_Interface_%28API%29_Security_%5BCIO_IT_Security_19-93%5D_04-29-2019_signed_BB.pdf

7. Responsibilities.

a. The PBS Office of Facilities Management (OFM) will direct and manage compliance processes, provide technical guidance and support to executing offices.

PBS regional offices, service centers and field offices must coordinate with SB stakeholders, as outlined in section 6, above, and comply with requirements in the issuance of any duties related to BMC or OT systems.

(1) The SB national program manager will oversee compliance with this Order, provide support to PBS staff to facilitate compliance and report on the effectiveness of this Order in furtherance of the SB program goals. The SB national program manager will support establishment and program operations related to supporting the GSA SB Advisory Board, as outlined in section 6.d, above.

(2) SB regional program managers or SB regional program specialists will oversee regional compliance with this Order, provide support to regional PBS staff to facilitate compliance and report on the effectiveness of this Order in furtherance of the SB program goals.

(3) Other OFM or regional facilities management program managers, including energy, sustainability, operations, and supporting program leads, must coordinate initiatives involving BMC systems with SB representatives to help promote alignment across PBS for GSA.

b. OCIO will direct and manage IT and IT security requirements in coordination with OFM. Impacts of OCIO policies and procedures must be coordinated and communicated by the program office responsible for project delivery, as outlined in Section 4 Scope and Applicability.

c. The PBS Office of Design and Construction (ODC) must verify that design and construction project requirements adhere to the policies and processes described in this Order.

(1) Regardless of who is supervising a design or installation related to an SB project, that group must confirm that all SB components and designs adhere to ODC standards in design and documentation, including the inclusion of SB system components into the building information modelling (BIM) following BIM standards, as applicable, as part of the project’s requirements;

(2) Regardless of who is supervising a design or installation related to an SB project, that group must verify that all components are named per the GSA Construction Operations Building Information Exchange (COBie) and National Computerized Maintenance Management System (NCMMS) requirements, and have room, space and location names coordinated with those of the building model to verify coherence with the overall building room- and floor-naming system.

(3) SB system components must carry information attributes according to the GSA requirements at the time of construction so that they may be tracked, as needed, by the NCMMS.

d. Coordination and communication with the SB Advisory Board, representatives and their designees must occur in the project development phase and prior to issuance of official procurement requests. This applies to both large and small projects.

9. Records and Forms Management Information.

Records, including guides, manuals and forms, can be found at GSA.gov. An SB representative can also be contacted for access to other consolidated internal GSA resources.

10. Signature.

/S/___________________

ROBIN CARNAHAN

Administrator