Exhibit C - Security Requirements (Level III) 06.2018.pdf

EXHIBIT C

LESSOR: ________ GOVERNMENT: ________ SECURITY REQUIREMENTS (LEVEL III)

REV (06/22/18)

SECURITY REQUIREMENTS - FACILITY SECURITY LEVEL III

THESE PARAGRAPHS CONTAIN ADDITIONAL SECURITY REQUIREMENTS THAT MAY BE

INSTALLED IN THE LEASED SPACE, AND UNLESS INDICATED OTHERWISE, ARE TO BE

PRICED AS PART OF THE BUILDING SPECIFIC AMORTIZED CAPITAL (BSAC). BECAUSE

EACH BUILDING IS UNIQUE, THE FINAL LIST OF SECURITY COUNTERMEASURES WILL BE

DETERMINED DURING THE DESIGN PHASE AND IDENTIFIED IN THE DESIGN INTENT

DRAWINGS AND CONSTRUCTION DOCUMENTS. AFTER COMPLETING THE

CONSTRUCTION DOCUMENTS, THE LESSOR SHALL SUBMIT A LIST OF THE ITEMIZED

COSTS. SUCH COSTS SHALL BE SUBJECT TO NEGOTIATION.

WHERE THEY ARE IN CONFLICT WITH ANY OTHER REQUIREMENTS OF THIS LEASE, THE

STRICTEST SHALL APPLY.

DEFINITIONS:

CRITICAL AREAS AND SYSTEMS- The areas that house systems that if damaged and/or compromised could have significant adverse consequences for the facility, operation of the facility, or mission of the agency or its occupants and visitors. These areas may also be referred to as “limited access areas,” “restricted areas,” or “exclusionary zones.” Critical areas do not necessarily have to be within Government-controlled Space (e.g., generators, air handlers, electrical feeds, utilities, telecom closets or potable water supply that may be located outside Government-controlled Space).

SENSITIVE AREAS – Sensitive areas include vaults, SCIFs, evidence rooms, war rooms, and sensitive documents areas. Sensitive areas are primarily housed within Government-controlled space.

FACILITY ENTRANCES, LOBBY, COMMON AREAS, NON-PUBLIC, AND UTILITY

AREAS

If the leased Space is greater than 75% of the space in the Building (based upon ABOA measurement), the requirements of FACILITY ENTRANCES AND LOBBY Section below shall apply to the entrance of the Building. If the leased Space is less than or equal to 75% of the space in the Building (based upon ABOA measurement), then the requirements of FACILITY ENTRANCES AND LOBBY Section below shall apply to the entrance of the leased Space.

FACILITY ENTRANCES AND LOBBY

LIMITING LOBBY QUEUING

The Lessor and the Government shall create a separate foot traffic flow pattern for employees and visitors at entrances to minimize lobby queuing caused by screening, visitor processing, and access control systems.

PHYSICAL BOUNDARIES TO CONTROL ACCESS TO PUBLIC AND NON-PUBLIC AREAS – LEVEL III

The Government reserves the right to use stanchions, counters, furniture, knee walls or product-equivalents, as determined by the Government, to establish physical boundaries to control access to non-public areas.

The Lessor shall post directional signs as appropriate.

SCREENING REQUIREMENTS

VISITOR SIGN-IN/OUT AFTER HOURS

The Lessor shall provide a system, acceptable to the Government, that after hour visitors to the Building shall be required to sign in and sign out either electronically or in a Building register.

MAGNETOMETERS AND X-RAYS AT PUBLIC ENTRANCES

Magnetometers and X-ray machines will be installed by the Government at the public entrance. Armed security guards, provided by the Government, will direct the occupants and visitors through the screening equipment. Appropriate lobby and entrance/exit space shall be made available for this purpose. This space shall be considered part of the lease common area and not ABOA square footage. The Government requires visitors to non-public areas to display a visitor’s identification badge. If there are other non-Government tenants, the Lessor shall notify them of this requirement and assist those tenants in obtaining ID acceptable to the Government.

ACCOMMODATION OF RETAIL/MIX USE SPACE

All non-Government personnel entering from retail or public space must enter through a screening point.

COMMON AREAS, NON-PUBLIC, AND UTILITY AREAS

PUBLIC RESTROOMS ACCESS (SHELL)

The Lessor shall provide a means to control access to public restrooms within Government controlled space that is acceptable to the Government.

SECURING CRITICAL AREAS

Areas designated as Critical Areas shall be locked using HSPD-12 compliant electronic access control equipment (see IDS requirements). The Government shall have the right to monitor and limit access to these areas. Access shall be limited to authorized personnel, as determined by the Government.

VISITOR ESCORT AND ID REQUIREMENTS

The Government shall require the Lessor to escort contractors, service personnel, and visitors to all non-public areas. The Lessor shall require visitors to non-public areas to display a visitor ID at all times.

SECURING COMMON BUILDING UTILITIES AND ACCESS TO ROOF

The Lessor shall secure utility, mechanical, electrical telecommunication rooms, and access to interior space from the roof using locks and an Intrusion Detection System (IDS).

RESTRICT CONTACT FROM PUBLIC AREAS WITH PRIMARY VERTICAL LOAD MEMBERS

The Lessor shall implement architectural or structural features, or other positive countermeasures that deny contact with exposed primary vertical load members in the public areas. A minimum standoff of at least 100 mm (4 inches) is required.

RESTRICT CONTACT FROM MAIL AREA WITH PRIMARY VERTICAL LOAD MEMBERS

The lessor shall implement architectural or structural features, or other positive countermeasures in the mail screening and receiving areas that deny contact with exposed primary vertical load members. A minimum standoff of at least 150 mm (6 inches) is required.

INTERIOR OF SPACE

WEARING PHOTO ID IN GOVERNMENT SPACE

The Lessor and his contractors shall be required to wear a photo ID to be visible at all times when in Government- controlled Space.

SECURE EMPLOYEE ENTRANCE DOORS

The Lessor shall provide a means to secure, as determined by the Government, doors identified by Government as employee entrance doors. The Government may elect to post guards to verify ID badges via visual and physical inspection before entry to Government occupied Space.

LIMIT ON ENTRY POINTS (SHELL)

The Government may elect to limit the number of entry points to the Building or to the Government occupied Space to the fewest number practicable.

FORMAL KEY CONTROL PROGRAM (SHELL)

The Government reserves the right to implement a formal key control program. The Lessor shall have a means of allowing the electronic disabling of lost or stolen access media, if electronic media is used.

ELECTRONIC ACCESS FOR EMPLOYEES

The Lessor shall provide electronic access control for employee entry doors without a guard post (including after-hours access) in conjunction with CCTV coverage.

SITE AND EXTERIOR OF THE BUILDING

SIGNAGE

POSTING OF SIGNAGE IDENTIFYING THE SPACE AS GOVERNMENTAL (SHELL)

The Lessor shall not post sign(s) or otherwise identify the facility and parking areas as a Government, or specific Government tenant, occupied facility, including during construction, without written Government approval.

POSTING OF REGULATORY SIGNAGE (SHELL)

The Government may post or request the Lessor to post regulatory, statutory, sensitive areas, and site specific signage.

LANDSCAPING AND ENTRANCES

LANDSCAPING REQUIREMENTS (SHELL)

Lessor shall maintain landscaping (trees, bushes, hedges, land contour, etc,) around the facility. Landscaping shall be neatly trimmed in order to minimize the opportunity for concealment of individuals and packages/containers. Landscaping shall not obstruct the views of security guards and CCTV cameras, or interfere with lighting or IDS equipment.

CRIME PREVENTION THROUGH ENVIRONMENTAL DESIGN (SHELL)

The Lessor shall separate from public access, restricted areas as designated by the Government, through the application of Crime Prevention Through Environmental Design (CPTED) principles by using trees, hedges, berms, or a combination of these or similar features, and by fences, walls, gates and other barriers, where feasible and acceptable to the Government.

HAZMAT STORAGE

If there is HAZMAT storage, Lessor shall locate it in a restricted area or storage container away from loading docks, entrances, and uncontrolled parking.

PLACEMENT OF RECEPTACLES, CONTAINERS, AND MAILBOXES – LEVEL III

Trash receptacles, containers, mailboxes, vending machines, or other fixtures and features that could conceal packages, brief cases, or other portable containers shall be located _10_ feet away from the Building.

VEHICLE BARRIERS

The Lessor shall provide vehicle barriers to protect pedestrian and vehicle access points, and Critical Areas from penetration by a 4700 pound vehicle traveling at 35 mile per hour.

PARKING

NUMBER OF PARKING ENTRANCES

The number of parking entrances shall be limited to the minimum required for efficient operations or local code. Entrances to parking areas shall be equipped with vehicle gates to control access to authorized vehicles (employee, screened visitor and approved Government vehicle).

ILLUMINATION OF ENTRANCES, EXITS, PARKING LOTS AND GARAGES (SHELL)

Facility entrances, exits, parking lots and garages shall be illuminated to a minimum of __5___ lumens, at all times.

AUTHORIZED ACCESS TO PARKING (SHELL)

Lessor shall limit parking and access to parking to authorized individuals.

VEHICLE SCREENING

The Government may elect to screen all visitor vehicles as prescribed by the Government. This screening shall include ID verification and visual inspection of the vehicle, including undercarriage. The Lessor shall provide adequate lighting in screening area to illuminate the vehicle exterior and undercarriage. CCTV coverage of the screening area shall be provided by the Lessor (see CCTV requirements).

PUBLIC ACCESS TO GOVERNMENT PARKING AREAS

Where there is Government controlled parking the area shall be controlled by limiting pedestrian access to the controlled parking areas. Pedestrian and vehicle access points to all parking areas shall be monitored by CCTV camera(s) at all times.

SECURITY SYSTEMS

CLOSED CIRCUIT TELEVISION SYSTEM (CCTV)

LESSOR PROVIDED DESIGN, INSTALLATION, AND MAINTENANCE – LEVEL III

The Lessor shall design, install, and maintain a Closed Circuit Television (CCTV) system as described in this section. The CCTV system will support the entry control system (at entrances and exits to the space), with time lapse video recording, that will allow Government employees to view and communicate remotely with visitors before allowing access to the Space. As determined by the Government the CCTV system shall provide unobstructed coverage of designated pedestrian entrances and exits. Technical review of the proposed system shall be coordinated with the Government security representative, at the direction of the Contracting Officer, prior to installation. CCTV system testing and acceptance shall be conducted by the Government prior to occupancy. The CCTV system shall comply with the Architectural Barriers Act, section F230.0. The Government will centrally monitor the CCTV system. Government specifications are available from the Lease Contracting Officer. CCTV system components which fail or require maintenance or which fail during testing should be serviced in accordance with the Security System Maintenance Criteria listed below.

Security System Maintenance Criteria: The Lessor in consultation and coordination with a security provider, either internal or external, as determined by the Lease Contracting Officer, and the Government security representative shall implement a preventive maintenance program for all security systems the Lessor has installed. Any critical component that becomes inoperable must be replaced or repaired by the Lessor within 72 hours. Critical components are those required to provide security (IDS, CCTV, access control, etc.)

for a perimeter access point or critical area. "Replacement" may include implementing other temporary measures in instances where the replacement or repair is not achievable within the specified time frame (e.g.

a temporary barrier to replace an inoperable pop-up vehicle barrier, etc.). Failure by the Lessor to provide sufficient replacement measures within the timeframe identified above may result in the Government’s providing guard service, the cost of which must be reimbursed by the Lessor.

GOVERNMENT PROVIDED PRODUCT, INSTALLATION, AND MAINTENANCE

The Government shall provide and install an entry control system, with time lapse video recording, that will allow Government employees to view and communicate remotely with visitors before allowing access. This Closed Circuit Television (CCTV) system shall provide the Government with unobstructed coverage, as determined by the Government, of designated pedestrian entrances and exits. The Lessor shall permit twenty-four hour CCTV coverage and recording, provided and operated by the Government. The Government will centrally monitor the CCTV surveillance. Government specifications are available from the Contracting Officer. The Lessor shall post necessary regulatory, statutory, and/or site specific signage, as determined by the Government.

The Lessor, at the notice to proceed stage of the procurement, shall advise the Government of the appropriate time to install the equipment during the construction of the Space and shall facilitate the installation, including access to electrical panels and other areas of the building, as necessary.

INTRUSION DETECTION SYSTEM (IDS)

LESSOR PROVIDED DESIGN, INSTALLATION, AND MAINTENANCE – LEVEL III

The Lessor shall design, install, and maintain an Intrusion Detection System (IDS) as described in this section. The Government requires an IDS, which will cover perimeter entry and exit doors, and operable ground-floor windows. Basic Security-in-Depth IDS components include: magnetic door switch(s), alarm system keypad, passive infrared sensor(s) (PIR), an alarm panel (to designated monitoring center) and appropriate communication method i.e. telephone and/or Internet connection, glass-break detector, magnetic window switches or shock sensors. Technical review of the proposed system shall be coordinated with the Government security representative, at the direction of the Lease Contracting Officer, prior to installation.

System testing and acceptance shall be conducted by the Government prior to occupancy.

Basic Security-in-Depth IDS shall be connected to and monitored at a central station operated by the Department of Homeland Security Megacenter. Emergency notification lists shall be coordinated with the monitoring station to include all applicable Government and Lessor points of contact. Monitoring shall be designed to facilitate a real-time detection of an incident, and to coordinate an active response to an incident.

The Lessor must complete the Megacenter Alarm Requirements (MAR) application process specified by the Government to meet the monitoring requirements for a functional IDS. Components which fail or require maintenance or which fail during testing shall be serviced in accordance with the Security System Maintenance Criteria listed below.

Security System Maintenance Criteria: The Lessor in consultation and coordination with a security provider, either internal or external, as determined by the Lease Contracting Officer, and the Government security representative shall implement a preventive maintenance program for all security systems the Lessor has installed. Any critical component that becomes inoperable must be replaced or repaired by the Lessor within 72 hours. Critical components are those required to provide security (IDS, CCTV, access control, etc.)

for a perimeter access point or critical area. "Replacement" may include implementing other temporary measures in instances where the replacement or repair is not achievable within the specified time frame (e.g.

a temporary barrier to replace an inoperable pop-up vehicle barrier, etc.). Failure by the Lessor to provide sufficient replacement measures within the timeframe identified above may result in the Government’s providing guard service, the cost of which must be reimbursed by the Lessor.

GOVERNMENT PROVIDED SCOPE AND PRODUCT, INSTALLATION, AND MAINTENANCE The Lessor shall permit installation of a perimeter Intrusion Detection System (IDS) to be operated by the Government.

The Government shall provide and install an IDS on perimeter entry and exit doors, and operable ground-floor windows. Basic Security-in-Depth IDS— include: magnetic door switch(s), alarm system keypad, passive infrared sensor(s) (PIR), an alarm panel (to designated monitoring center) and appropriate communication method i.e. telephone and/or Internet connection, glass-break detector, magnetic window switches or shock sensors.

Basic Security-in-Depth IDS shall be connected and monitored at a central station. Emergency notification lists shall be coordinated with the monitoring station to include all applicable Government and Lessor points of contact. Monitoring shall be designed to facilitate a real-time detection of an incident, and to coordinate an active response to an incident.

The Lessor, at the notice to proceed stage of the procurement, shall advise the Government of the appropriate time to install the equipment during the construction of the Space and shall facilitate the installation, including access to electrical panels and other areas of the building, as necessary.

DURESS ALARM

LESSOR PROVIDED DESIGN, INSTALLATION, AND MAINTENANCE – LEVEL III

The Lessor shall design, install, and maintain a duress alarm system as describedTechnical review shall be coordinated with the Government security representative, at the direction of the Contracting Officer, prior to installation. System testing and acceptance shall be conducted by the Government prior to occupancy. This system shall comply with the Architectural Barriers Act, section F230.0.

The Lessor in consultation and coordination with the security provider and Government shall conduct security system performance testing annually. Testing must be based on established, consistent agency-specific protocols, documented and furnished to the Lease Contracting Officer. Components which fail or require maintenance or which fail during testing should be serviced in accordance with the Security System Maintenance Criteria listed below.

Security System Maintenance Criteria: The Lessor in consultation and coordination with a security provider, either internal or external, as determined by the Lease Contracting Officer, and the Government security representative shall implement a preventive maintenance program for all security systems they have installed. Any critical component that becomes inoperable must be replaced or repaired within 72 hours.

Critical components are those required to provide security (IDS, CCTV, access control, etc.) for a perimeter access point or critical area. "Replacement" may include implementing other temporary measures in instances where the replacement or repair is not achievable within the specified time frame (e.g. a temporary barrier to replace an inoperable pop-up vehicle barrier, etc.). Failure by the Lessor to provide sufficient replacement measures within the timeframe identified above may result in the Government’s providing guard service, the cost of which must be reimbursed by the Lessor.

GOVERNMENT PROVIDED SCOPE, PRODUCT, INSTALLATION, AND MAINTENANCE

The Lessor shall permit installation of a duress alarm system to be provided and operated by the Government. The Government, in coordination with a security provider, either internal or external, as determined by the Contracting Officer, shall document and implement duress procedures for emergency situations.

The Lessor, at the notice to proceed stage of the procurement, shall advise the Government of the appropriate time to install the equipment during the construction of the Space and shall facilitate the installation, including access to electrical panels and other areas of the building, as necessary.

STRUCTURE

WINDOWS

SHATTER-RESISTANT WINDOW PROTECTION

The Lessor shall provide and install, shatter-resistant material not less than 0.18 millimeters (7 mil) thick on all exterior windows in Government-occupied Space meeting the following properties - Film composite strength and elongation rate measured at a strain rate not exceeding 50% per minute shall not be less than the following:

- Yield Strength: 12,000 psi

- Elongation at yield: 3%

- Longitudinal Tensile strength: 22,000 psi

- Traverse Tensile strength: 25,000 psi

- Longitudinal Elongation at break: 90%

- Traverse Elongation at break: 75%

THE ALTERNATIVE METHOD is for the Lessor to provide a window system that conforms to a minimum glazing performance condition of “3b” for a high protection level and a low hazard level. Window systems shall be certified as prescribed by WINGARD PE 4.3 or later to GSA performance condition “3b” (in accordance with the GSA Standard Test Method for Glazing and Window Systems Subject to Dynamic Loadings or Very Low Hazard (in accordance with ASTM F 1642, Standard Test Method for Glazing or Glazing Systems Subject to Air Blast Loading) in response to air blast load of 4 psi/28 psi-msec.

If the Lessor chooses the Alternative Method, the Lessor shall provide a description of the shatter-resistant window system and provide certification from a licensed professional engineer that the proposed system meets the above standard. Prior to installation, this will be provided for evaluation by the Government, whose approval shall not be unreasonably withheld.

LOCK GROUND FLOOR WINDOWS (SHELL)

The Lessor shall lock all ground floor windows with L-brackets using security screws, or equivalent measure, acceptable to the Government.

SECURE NON-WINDOW OPENINGS (SHELL)

The Lessor shall secure all non-window openings, such as, mechanical vents, utility entries, and exposed plenums to prevent unauthorized entry.

PREVENT VISUAL OBSERVATION INTO "SENSITIVE AREAS"

The Lessor shall provide blinds, curtains, or other window treatments in “Sensitive Areas” that can be employed to prevent visual observation of that area that is acceptable by the Government.

BUILDING SYSTEMS

EMERGENCY GENERATOR

The Lessor shall locate emergency generators, either pre-existing or installed as part of Tenant Improvements, in a secure area, protected from unauthorized access and vehicle ramming, if outdoors. The emergency generator and its fuel tank must be located at least 25 feet from loading docks, entrances, and parking areas. (If the 25 foot distance cannot be achieved, a combination of standoff, hardening, and venting methods must be implemented to protect utilities from vehicle borne improvised explosive devices of ____ pounds of TNT equivalency.)

SECURING ON-SITE PUBLICLY-ACCESSIBLE UTILITIES

The Lessor shall secure the water supply handles, control mechanisms, and service connections at on-site publicly-accessible locations with locks and anti-tamper devices acceptable to the Government.

SECURING AIR INTAKE GRILLES

The Lessor shall secure air intake grilles less than 30 feet above grade or otherwise accessible. Air intake grilles shall be secured with tamper switches connected to a central alarm monitoring station and monitored by CCTV or other security systems. As an alternative the air intake may be relocated to a position greater than 30 feet above grade.

HVAC SYSTEM FOR CHEMICAL, BIOLOGICAL AND RADIOLOGICAL (CBR) ATTACK-SUSCEPTIBLE

AREAS

The Lessor shall provide separate isolated HVAC systems in lobbies, loading docks, mail rooms and other locations as identified by a risk assessment as susceptible to CBR attack, to protect other building areas from possible contamination.

All exterior air handling units (AHUs), including the supply air for re-circulating AHUs, shall be equipped with Minimum Efficiency Reporting Value (MERV) 10 particulate filters. AHUs serving lobbies and mailroom, including the supply air stream for re-circulating AHUs, shall be equipped with Minimum Efficiency Reporting Value (MERV) 13 filters.

OPERATIONS AND ADMINISTRATION

LESSOR TO WORK WITH FACILITY SECURITY COMMITTEE (SHELL)

The Lessor shall cooperate and work with the buildings Facility Security Committee (FSC) throughout the term of the lease.

ACCESS TO BUILDING INFORMATIONI (SHELL)

Building Information—including mechanical, electrical, vertical transport, fire and life safety, security system plans and schematics, computer automation systems, and emergency operations procedures—shall be strictly controlled. Such information shall be released to authorized personnel only, approved by the Government, by the development of an access list and controlled copy numbering. The Lease Contracting Officer may direct that the names and locations of Government tenants not be disclosed in any publicly accessed document or record. If that is the case, the Government may request that such information not be posted in the building directory.

Lessor shall have emergency plans and associated documents readily available in the event of an emergency.

SECURITY PLANS AND LAYOUTS – LEVEL III

The Lessor shall treat and safekeep any plans and specifications related to security measures as For Official Use Only (FOUO).

SCREENING OF MAIL AND PACKAGES – LEVEL III

Lessor shall provide space suitable for the Government to inspect and screen all mail and packages using X-ray at a loading dock, if present. If there is no loading dock, Lessor shall provide space at an existing screening location or at an alternative location in the Building acceptable to the Government. The space shall be located on an exterior wall, 25 feet or less from an exterior door, with a stand-alone air handling system.

The screeners shall physically inspect items that cannot be passed through screening equipment before distribution to the Government agencies throughout the facility. This space shall be considered part of the lease common area and not ABOA square footage.

OCCUPANT EMERGENCY PLANS (SHELL)

The Lessor is required to cooperate, participate and comply with the development and implementation of the Government’s Occupant Emergency Plan (OEP) and if necessary, a supplemental Shelter-in Place (SIP) Plan. Periodically, the Government may request that the Lessor assist in reviewing and revising its OEP and SIP. The Plan, among other things, must include an annual emergency evacuation drill, emergency notification procedures of the Lessor’s building engineer or manager, building security, local emergency personnel, and Government agency personnel.

SECURITY GUARD POSTINGS

The Government may elect to post armed security guards at all screening checkpoints and at the entrances to Government-occupied Space.

CYBERSECURITY (SHELL)

A. Lessors are prohibited from connecting any portion of their building and access control systems (BACS) to any federally-owned or operated IT network. BACS include systems providing fire and life safety control, physical access control, building power and energy control, electronic surveillance, and automated HVAC, elevator, or building monitoring and control services (including IP addressable devices, application servers, or network switches).

B. In the event of a cybersecurity incident related to BACS, the Lessor shall initially assess the cyber incident, identify the impacts and risks to the Building and its occupants, and follow their organization’s cyber and IT procedures and protocols related to containing and handling a cybersecurity incident. In addition, the Lessor shall immediately inform the Lease Contracting Officer’s (LCO’s) designated representative, i.e., the Lease Administration Manager (LAM), about cybersecurity incidents that impact a federal tenant’s safety, security, or proper functioning.

C. Lessors are encouraged to put into place the following cyber protection measures in order to safeguard facilities and occupants:

1. Engineer and install BACS to comply with the Department of Homeland Security Industrial Control Systems Computer Emergency Response Team (DHS ICS-CERT) cyber security guidance and recommendations (https://ics-cert.us-cert.gov/Recommended-Practices).

2. Refer to the National Institute of Standards and Technology Cyber Security Framework (NIST- CSF) (https://www.nist.gov/cyberframework) and cybersecurity guidance in the DHS Commercial Facilities Sector-Specific Plan (https://www.dhs.gov/publication/nipp-ssp-commercial-facilities-2015) for best practices to manage cyber risks.

3. Encourage vendors of BACS to secure these devices and software through the following:

a. Develop and Institute a proper Configuration Management Plan for the BACS devices and applications, so that the system can be supported.

b. Safeguard sensitive data and/or login credentials through the use of strong encryption on devices and applications. This means using NIST- approved encryption algorithms, secure protocols (i.e., Transport Layer Security (TLS) 1.1, TLS 1.2, TLS 1.3) and Federal Information Processing Standard (FIPS) 140-2 validated modules.

c. Disable unnecessary services in order to protect the system from unnecessary access and a potential exposure point by a malicious attacker. Examples include File Transfer Protocol-FTP (a protocol used for transferring files to a remote location) and Telnet (allowing a user to issue commands remotely). Additionally, use of protocols that transmit data in the clear (such as default ZigBee) should be avoided, in favor of protocols that are encrypted.

d. Close unnecessary open ports to secure against unprivileged access.

e. Monitor and free web applications and supporting servers of common vulnerabilities in web applications, such as those identified by the (Open Web Application Security Project (OWASP) Top 10 Project (https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project).

f. Enforce Least Privilege, where proper permissions are enforced on a device or application so that a malicious attacker cannot gain access to all data. Enforcing Least Privilege will only allow users to access data they are allowed to see. Additional information can be found at https://www.beyondtrust.com/blog/what-is-least-privilege/

g. Protect against Insufficient User Access Auditing, where device or application does not have a mechanism to log/track activity by user. Enforce changing of factory default Username and Password to prevent unauthorized entry into the BACS system.

https://ics-cert.us-cert.gov/Recommended-Practices https://www.nist.gov/cyberframework https://www.dhs.gov/publication/nipp-ssp-commercial-facilities-2015 https://www.dhs.gov/publication/nipp-ssp-commercial-facilities-2015 https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project https://www.beyondtrust.com/blog/what-is-least-privilege/

h. Use updated antivirus software subscription at all times. Kaspersky-branded products or services, prohibited from use by the Federal Government, are not to be utilized.

i. Conduct antivirus and spyware scans on a regular basis. Patching for workstations and server Operating System (OS), as well as vulnerability patching should follow standard industry best practices for software development life cycle (SDLC).

j. Discontinue the use of end of life (EOL) systems and use only applications/systems that are supported by the manufacturer.

k. Operating Systems must be supported by the vendor for security updates (e.g., do not use Windows Server 2003).

l. Proposed standard installation, operation, maintenance, updates, and/or patching of software shall not alter the configuration settings from the approved United States Government Configuration Baseline (USGCB) or tenant agency guidance (if applicable).

m. Disallow the use of commercially-provided circuits to manage building systems and install building systems on a protected network, safeguarded by the enterprise firewalls in place.

Workstations or servers running building monitor and control systems are not connected and visible on the public internet.

n. Systems should have proper system configuration hardening and align with Center for Internet Security (CIS) benchmarks or other industry recognized benchmarks. Additional information can be found at https://www.cisecurity.org/cis-benchmarks/.

https://www.cisecurity.org/cis-benchmarks/