Attachment_GSA_New_Project_Smart_Building_Design.docx

Smart Building Design Standards For All New GSA Construction, Renovation and Energy Savings Performance Projects Document Version Control

Background The GSA is looking to technology to run its facilities Smarter. This means transparent access to building system data, intelligent control sequences, procurement of open systems, as well as the elimination of duplicate components of building system infrastructure i.e. the I.T. backbone, which is common amongst today’s building systems.

In March of 2011, the Department of Facilities Management and Services Programs (FMSP), the Office of Design and Construction (ODC) and PBS CIO (new organization name: Public Buildings Information Technology Services)jointly sponsored a policy which would change the way in which GSA approaches building system technology. This policy, entitled, ‘Technology Policy for PBS-Owned Building Monitoring and Control Systems’ shall be applied to all new GSA Construction, Renovations and Energy Savings Performance projects where new building system technologies or major modifications to the existing systems are impacted by the scope of the project. Following the issuance of the policy, the Building Technologies Technical Reference Guide was released, was a comprehensive guidance that detailed PBS CIO and OCIO’s IT requirements for integrating building monitoring and controls systems onto the GSA network.

Requirements of a Smart Building Systems Design In accordance with GSA policy, all new GSA Construction, Renovation and Energy Savings Performance projects must design for and implement the following features, when project scope associated with building systems* are impacted**.

*Impacted – Building Systems which are undergoing a major renovation, upgrade, replacement or expansion that represent either a sizeable cost (greater than 25% of original installation cost) or sizable alteration to the existing system as determined by the project team.

**Building Systems – Building Systems include any control or monitoring system used to keep the building operational. This includes, but is not limited to: Building Automation, Lighting Control, Advanced Metering, Security, Physical Access Control, Vertical Transportation, Irrigation, Digital Signage, etc.

1. Open Systems

All systems used for building system control, monitoring and data collection shall leverage open protocols for complete device level interoperability. The ‘open’ aspects of the protocol shall exist at the device level and not at a head end computer, server or network controller functioning as a gateway. Additionally, the entire solution must be open. To meet the GSA’s definition of open, the system must:

a. Implement an industry standard open protocol on the device level.

b. Provide unrestricted software licenses, databases and administration access privileges.

c. Provide all software tools required for network management, device and controller configuration and programing, as well as all software tools required to update the user interface functionality. These tools can be embedded within the controllers or provided to be installed on a government furnished computer.

d. The procurement and distribution of ALL products and software required to support the system must be freely available on an open and competitive market from multiple sources.

e. Companies shall not restrict procurement, distribution, maintenance or support contracts in any fashion. The government shall be able to obtain sales, installation and service of these solutions from multiple sources at competitive pricing.

f. Open protocols should be implemented on the following minimum systems:

Wireless* oBIX

· oBIX

· *Wireless

· oBIX

· Modbus

· *Wireless

Digital / Analog Input

Major Equipment (Chillers, Generators, Switchgear, etc.)

Wireless*

*Wireless shall be EnOcean, Zigbee, or 802.11 and shall meet PBS-CIO requirements Wireless Ethernet devices are required to comply with the GSA CIO 2100.2A Wireless LAN security guide. OCIO scans for unauthorized wireless access points on a regular basis and takes appropriate action if such an access point is discovered.

** Other building systems can include, but are not limited to: fire detection, fire suppression, security, physical card access, irrigation, vertical transportation, chemical treatment, weather stations, digital signage, etc.

*** Refer to the ‘advanced metering requirements’ portion of this document for Advanced Metering Protocol Specifics.

++ Note to reader: Digital or Addressable Lighting Control is not necessarily the same as DALI (Digital Addressable Lighting Interface) lighting control and does not always represent an ‘open’ solution. ‘DALI’ utilizes an open protocol that allows for interoperability at the device level (ballast, sensor, switch, and controller). Many ‘digital’ or ‘addressable’ lighting control systems implement a proprietary protocol on the end device level. The project team should be aware that many of the major and in some cases the majority lighting control vendors in the industry today implement a proprietary protocol on the end device level. Lighting control options do exists in the market today that utilize the preferred ‘open’ protocols listed in the table above. In some cases the major lighting control vendors in the industry who offer a standard proprietary solution will at the customers option and mandated request ‘re-flash’ their control devices to be in compliant with open protocols listed above. The project team is always encouraged to have these discussions with their lighting control vendor to make the best decision for the project.

2. Converged Data Networks and Government Furnished Equipment

The PBS Building Technology Policy requires that any network used to support building systems be managed by GSA IT (OCIO) and consist of Government Furnished Equipment (GFE) network electronics. In addition, GSA requires this to be a single common network for all building systems rather than providing a redundant network infrastructure for each building system. The physical media required to support the building systems (copper or fiber) shall be installed by the project in the same manner as it would have been prior to the Technology Policy for PBS-Owned Building Monitoring and Control Systems. Under the Policy, the project contractors shall work with OCIO/PBS CIO to obtain the necessary network design and network electronics requirements to support the project. This includes IP addresses, network routing and switching equipment, servers, workstations, and peripheral equipment, all to be furnished by the GSA. Care should be taken to ensure that this equipment is not purchased by the contractors when the contracts are executed. The project contractors must work with PBS CIO to determine and approve the network layout, design, IP address assignment, etc.

3. Normalized Data The GSA’s GSAlink program has been designed to remotely and continuously monitor building system data for faults and failures. Buildings that are installing new or impacting existing building systems shall follow GSA policy that prepares the building for future connection to the GSAlink platform. The GSA requirements for the installation or major modifications of Building Systems to require a data normalization process as described below:

a. Use of middleware or similar common building system software platform which has connectivity and visibility into all building systems and protocols onsite. This process unifies all building data sources into a single database. It also manipulates the data that it is being captured into similar time frames, with similar point naming conventions. The normalization process will cleanse the data to remove errant data. Lastly, the normalization process will packet all building data into common IT protocols such as oBIX, XML, web services, in order to transmit data via the web. While there are several software packages that accomplish similar results the GSA’s GSAlink project has standardized on the Tridium Niagara AX platform to accomplish this normalization process.

b. Data from all building systems residing on the common and converged data network shall be exposed for use by third-party systems.

c. GSA projects are encouraged to follow the industry guidance issued by the following open source industry consortium: http://project-haystack.org/

d. Building System data points shall follow a common and documented point naming or tagging schema. This convention is under continuous development and improvement, for the latest standard please contact Chip Pierpont (chip.pierpont@gsa.gov).

4. Remote Data Access / GSA Wide Area Network

All new GSA Construction, Renovation and Energy Savings Performance projects installing or impacting major building system shall migrate these building systems to the GSA Wide Area Network following OCIO requirements. Whenever possible, building systems should be accessible via a web browser with no client software required. Refer to the Building Technologies Implementation Guide published by PBS-CIO for all IT networking requirements such as firewalls, security, processes and procedures.

5. Advanced Metering

All new GSA Construction and Renovation projects which do not currently have advanced metering installed and integrated back to the GSA’s national ION EEM platform shall be required to do so as part of the current project. All ESPCs shall include an ECM which includes this scope and its economic impact to the project for project teams to discuss for potential inclusion into final project. Refer to the ‘advanced metering requirement’ portion of this document for added details.

Additional Attributes of an Smart Building Systems Design A Smart Building design can be defined in many different ways, based on the vast variety of existing technologies in a facility. Each building’s situation is unique in terms of its existing systems and new project scopes.

It should be noted that many attributes of a smart building are related to maximizing the use and potential of software and networks already planned for the project. Therefore, great value and energy savings can be achieved at no or minimal added cost to the project, if the design and construction processes are guided by a knowledgeable resource on these principles.

While the GSA policy and this document describe several requirements of a Smart Building design, there are numerous additional optional features which will contribute to the intelligence and energy efficiency of the facility operation. In addition to the design and implementation requirements described in this document, the following attributes should be considered as a starting point for all new GSA Construction, Renovation and Energy Savings Performance projects.

1. Unified User Interface

a. A common graphical user interface which can be used to monitor and control various building systems.

2. Advanced lighting control

a. Intelligent light fixtures and controls which can accomplish load reduction, load shedding, demand response, daylight harvesting and data collection.

3. Data Collection

a. The GSA’s GSAlink project has the purpose of continuously monitoring building system data for faults and failures. As a result, a new value is achieved from added monitoring and diagnostic points from a variety of building systems.

4. Advanced Sub Metering

a. Advanced communicating meters on electric, steam, water and gas meters are required to develop a baseline and data for analytics. The use of sub-meters, consumption data from equipment data interface cards (chillers, VFDs, etc.) and current transducers, used to monitor equipment status should be required, whenever feasible.

5. Integrated Systems Sequence of Operations

a. Advanced control sequences should be accomplished when data from one building system can be used to enhance the operations of an independent building system. This can be accomplished when various building systems are converged on to a common IT infrastructure.

6. Native Power and Power over Ethernet

a. When feasible, consider using Power over Ethernet when data and power are required at the edge device.

Network and IT Requirements *** For additional details and for the latest requirements, refer to the Building Technologies Implementation Guide published by PBS-CIO*** Network and Cabling All IT networks and cabling required to support building systems shall follow the requirements listed in the latest version of the Telecommunications Distribution Design Guide published by the Office of Chief Information Officer (OCIO).

Operator Workstations and Servers Any personal computers or server hardware shall not be included in the scope of the contract. All software to be provided by the contractor shall be installed on GSA furnished workstations/servers. For additional details and for the latest requirements, refer to the Building Technologies Implementation Guide published by PBS-CIO Server Virtualization It is the GSA’s desire that, when feasible and supported by the manufacturer, all server software be installed in a virtual environment. This virtual environment will be provided by the GSA; however, the vendor will be required for the installation and configuration of this software.

Hosted Solutions / Software as Service While many vendors provided externally hosted solutions and other 3rd party services, GSA prefers that all applications be hosted internally on GSA provided infrastructure. All data associated with PBS managed systems is GSA owned data, and may not be transmitted or communicated outside of GSA’s private network without the approval of the PBITS’ or GSA OCIO’s Authorizing Official.

Network Equipment and Design All switches and routers will be provided by GSA OCIO. The contractor shall coordinate approval efforts with Public Buildings Information Technology Services on obtaining an approved network design.

Remote Network Access All vendors which require access to devices residing on the GSA network (servers, workstations, building control / monitoring devices, etc.) shall obtain government clearance in the form of HSPD-12 credentials with an ENT account for all staff expected to access these devices for installation or maintenance. Access to the GSA network will be via a secure Citrix connection and credentials provided by the GSA. The GSA team will provide temporary admin rights to servers and workstations by request when needed. No outside connections, in addition to the GSA Wide Area Network, will be permitted to GSA building systems.

Software All non-standard software installation requests must be reviewed and approved from both legal and technical perspectives. For additional details and for the latest requirements, refer to the Building Technologies Implementation Guide published by PBS-CIO Building Monitoring & Control Devices – Security Scanning & Remediation Requirements All IP addressed devices, appliances or servers that will communicate over the GSA network must be scanned in the PBS IT Security test lab by the GSA PBS CIO and/or GSA OCIO in order to assess vulnerabilities and acceptable configurations. A security assessment report will then be provided to the responsible contractor. Vulnerabilities must be mitigated within the appropriate timeframe, as described in the Security Assessment Report, or the responsible contractor may provide a mitigation plan along with milestones and timelines for remediation for consideration of GSA PBS, in order to connect to the building systems network.

The length of Scanning and Remediation review process is dependent on the support provided by the vendor and the hardware manufacturer. This process can take weeks or months, dependent on the support provided by the vendor and manufacturer to correct identified issues. Each vendor is required to submit their devices within 14 days of receiving notice to proceed and each vendor shall be responsible for aiding in the process to keep their project schedule obligations on track. For additional details and for the latest requirements, refer to the Building Technologies Implementation Guide published by PBS-CIO Advanced Metering Requirements All new GSA Construction, Renovation projects which do not currently have advanced metering installed and integrated back to the GSA’s national ION EEM platform shall be required to do so as part of the current project. All ESPCs shall include an ECM (energy conservation measure), which includes this scope and its economic impact to the project for project teams to discuss for potential inclusion into the final project.

Purpose GSA’s PBS Office of Chief Information Officer has issued the Advanced Metering System Implementation Guide that describes GSA’s IT policy. The policy mandates that all advanced metering be kept inside the firewall and is geared to stress the importance of GSA regional IT in all advanced metering projects. In order for the metered data at the regional level to be displayed and be able to utilize the functions available to the GSA National Office metering analysis system, ION EEM, the data must be brought into that system through an interconnection. The scope for interconnection will need to be contracted for directly with Schneider Electric.

General Advanced Metering Requirements

1. All work to connect and integrate the Metering System components installed by this project to the ION EEM national database shall be made by Schneider Electric: POC Don Brown (317-730-7947). Schneider Electric is the sole source provider of these services and administrator of the ION EEM system as awarded by the GSA Energy Program office Required Meter Locations

1. Advanced Meters are required to be installed at the following locations and must be integrated into the national ION EEM system:

a) Main Electric Utility Feed(s)

b) Main Gas Utility Feed(s)

c) Main Steam Utility Feed(s) Optional Meter Locations and Requirements

1. Advanced Meters installations are suggested, but are OPTIONAL at the following locations:

a) Main Water Utility Feed(s)

b) Submeter location including, but not limited to:

i. Tenant Circuits

ii. Data Center Utilities

iii. Major Utility consuming equipment such as:

· HVAC (Central Plant / Air Handling Unit)

· Lighting Circuits

· Receptacle Loads

· Irrigation Systems

· Cooling System Make Up Water

2. Integration of ‘Optional Meter’ data to the ION EEM is suggested, but is not required.

3. Integration of ‘Required Meters’ to a local display for local building system use is suggested, but is not required.

GSA Communication and Interconnection Requirements As all GSA sites install advanced metering at the building level, there will be three options for importing logged meter or device data into the ION EEM system in National Office for analysis and display on your regional Digital Dashboard. For options (1) and (3) below, ION EEM Enterprise (the real-time operational software application that imports all regionally collected meter data into ION EEM) will ‘poll’ the device(s) or database(s) for the data and bring it in, provided that the devices have this communication capability. As many advanced meters are IP addressable, the National Office System has the capability to poll these devices, on a fixed interval, request and import specific log registers from the device or a secured site associated with the device(s). For IT security reasons, data will be “pulled” from all devices (or secured sites and databases) and not “pushed” to them. To achieve interconnection, one of three options will be acceptable:

1. Device Polling Providing that the regional field devices meet the communications protocol requirements in this document, the National Office System can poll these devices using the data acquisition feature in its ION EEM Enterprise software. ION Enterprise will load all meter data into ION EEM for analysis and viewing on the Regional Digital Dashboard.

2. Device to Database Transfer from a SFTP Server inside GSA firewall The building level device(s) must send its data via SFTP to the ION EEM Enterprise server at National Office. In this specific configuration, the ION Enterprise system will use its data acquisition feature to collect the files from the SFTP server and import the files into ION EEM for analysis and display in the Digital Dashboard. This must only be done from inside the GSA firewall.

If device is not capable of SFTP, but has other “secure” communications options available, the approach must be cleared through GSA IT Security Team before proceeding. Contact national FMSP Energy Division Metering program leads and regional POCs for additional guidance.

3. Database to Database Transfer from 3rd Party Software For existing GSA regions (example: Region 7) who are already utilizing a regional operational software application (Tridium/Siemens, etc.) provided by a 3rd Party to collect regional meter data, the ION EEM Enterprise server at National Office will be configured (data acquisition) to poll the database associated with the software application, and load its metered data into ION Enterprise. ION EEM Enterprise will export all files into ION EEM for analysis and viewing in the regional Digital Dashboard.

Communication Requirements ION EEM operates on historic data only, as opposed to real-time data. Data is typically time stamped in 15-minute intervals. The “real-time” operational software that collects all regional meter data is provided by ION EEM Enterprise. This system allows the presentation of real-time and historic data. A software module loads data from the ION EEM Enterprise database into the ION EEM database for analysis and user display in ION EEM. In order to get data into the ION EEM Enterprise system, all regional meters will need to satisfy the following protocols:

Communications Protocol The following protocols are supported by ION EEM Enterprise Software.

a. Modbus RTU

b. Modbus TCP/IP Communications Media ION Enterprise supports the following communications media:

a. Serial RS485

b. Serial RS232

c. Ethernet (preferred)

d. Telephone dial-up modem (slow and often high maintenance) Historic Data for ION Meters ION meters feature on-board logging. This means that data is stored in a circular memory block in the meter. New data replaces the oldest data, so that one always has the most recent data stored on the meter e.g. the last 30 days. The effect of this is that any temporary loss of communications will not mean a loss of data in the ION Enterprise and ION EEM systems. As long as the communications downtime is not longer than the depth setting of the data recorder, data will not be lost.

Historic Data for 3rd Party Meters Although 3rd party meters might have similar on-board logging capability, ION Enterprise and ION EEM do not support the reading of these historic data logs. Data from 3rd Party meters must be logged using a software module of ION Enterprise, using a protocol other than ION protocol e.g. Modbus RTU. This means that in order to log data, continuous communications is required.

Historic Data from other sources Historic data can be loaded into the ION EEM database from e-mail, .xml and flat file formats. This means that historic data can also be sourced from 3rd party databases, SFTP sites etc. A software module receives and transfers the data and loads it into the ION EEM database.

Advanced Meter Performance Requirements All meters used for this project shall comply with the technical and communication requirements in this document as well as the following performance specifications:

Mechanical Meters with Pulse Outputs:

1. All mechanical meters using a pulse counter shall have the capability to measure and record usage at least every 15 minutes.

Electric Meters

1. Meter accuracy specifications shall comply with ANSI 12.20 Class 0.5 at 25°C.

2. Meter shall be UL certified.

3. Meter accuracy shall be + 0.5% for power measurements.

4. Capability to measure and record 15 minute interval data for kW, kWh and kVARh

5. Capable of bi-directional monitoring of: power consumption, phase voltages, phase currents, power factor, kVAR and waveform capture, (bi-directional may not be necessary in all projects if it is not anticipated to have on-site generation that will exceed the needs of the facility)

6. Electric Meter displays so voltages and current can be simultaneously read of all three phases of power.

Water Meters

1. Domestic water meters shall have a flow accuracy of ±.5% of reading and a turndown ratio of at least 50:1.

Natural Gas Meters

1. Natural gas meters shall have a flow accuracy of ±1% of reading and a turndown ratio of at least 100:1.

Steam Meters

1. Steam meters shall have a volumetric flow accuracy of ±2% of reading and a turndown ratio of at least 10:1.

District Chilled Water Meters

1. District chilled water meters shall have a flow accuracy of ±2% of reading and a turndown ratio of at least 50:1.

Oil Usage Meters

1. Fuel oil usage meters shall have a flow accuracy of ±1% of reading and a turndown ration of at least 10:1.

Smart Building Project Support The GSA has provided its project teams numerous support tools to assist with the successful implementation of the Smart Buildings program. These include:

1. Regional Smart Building Industry Experts: contact Chip Pierpont (chip.pierpont@gsa.gov).

2. PBS Building and Energy Team project site: https://sharepoint.pbs.gsa.gov/pbs/energyit/ESI/Wiki%20Pages/Home.aspx

3. PBS Building and Energy Support Team (PBS CIO): pbs.pbios@gsa.gov

4. Reference Documents as mentioned below Reference Documents For additional technical information on this subject matter please request the following documents (note some of the links are only available from inside of the GSA firewall, please always check with a GSA POC to ensure you have the latest version of these reference documents):

1. Technology Policy for PBS-Owned Buildings Monitoring & Control Systems – Dated 3/31/11

https://sharepoint.pbs.gsa.gov/pbs/energyit/ESI/Library%20of%20docs%20saved%20on%20this%20site/ImplementationGuide/Technology%20Policy%20for%20PBS-Owned%20Buildings%20Monitoring%20and%20Control%20Systems_4.5.11.pdf

2. Building Technologies Implementation Guide published by PBS-CIO

https://docs.google.com/a/gsa.gov/file/d/0BxQYPw9OoknPN2FkODZkZmEtNzAyMi00NjBjLWJkOTYtY2IzNDQwNDA2MTUx/edit?usp=sharing

3. Facilities Standards for the Public Building Services P-100 (current version)

4. Telecommunications Distribution Design Guide published by the Office of Chief Information Officer (OCIO)

Contact Brad Murray: brad.murray@gsa.gov

5. Advanced Metering System Implementation Guide issued by PBS-CIO

Contact Karen Curran: karen.curran@gsa.gov image1.emf

Technology Policy for PBS-Owned Buildings Monitoring & Control Systems.pdf image2.emf

Building Technologies Technical Reference Guide_FINAL_6.24.11.pdf

Building Technologies

Technical Reference Guide

6/24/2011

Version History / Change Record

Revision x –

Change

Number

Person

Posting

Change Reason for Change Page Number of

Approval

Office of Facilities Management and Services Programs

Signed: Date:

Office of Design and Construction

Office of the Public Buildings Service Chief Information Office

Introduction

The Building Technologies Technical Reference Guide was created in response to repeated requests for information and formalized guidance related to the technical integration of building monitoring and control systems (BMC) to the GSA network and within its GSA’s information technology (IT) environment. BMC systems include, but are not limited to building technologies such as advanced metering systems (AMS), building automation systems, lighting control systems, physical access control systems (PACS), renewable energy systems, and kiosks. These systems, while closely related to the scope of facilities management, are IT systems, and as such are subject to the same Federal and agency specific policies and security standards as any other

Federal IT system. It is the intent of this document to not only inform on those polices and standards, but to establish a consistent approach for how these technologies will be implemented and supported within GSA.

This guide was initiated and published by the PBS CIO in cooperation with GSA’s OCIO, and developed and reviewed with extensive participation with multiple offices of PBS including Facilities Management and Design and Construction, as well as with participants from the Regions. The organization and oversight for this guide was led by a Core Team of senior management from multiple divisions of PBS and included leadership from several GSA Regions. Each chapter of this guide covers a functional area, and the content for each was developed through working group meetings, which included the participation of stakeholders and subject matter experts from central office and the regions.

This Guide is consistent with exiting Federal and GSA specific IT policies and is partnered with the Building

Monitoring and Control System Technology Policy, which was issued jointly by PBS CIO, Facilities Management and Design & Construction divisions in April of 2011.

This guide is a “living document” and will be updated as necessary to accommodate improvements to processes, evolved best practices, and any new or updated policies or standards relevant to the implementation of building monitoring and control systems. Users of this guide are encouraged to provide feedback that will lead to improvement in future versions.

Table of Contents

Version History / Change Record

Approval

Introduction

Chapter 1: Policy/Standards & IT Security

1. Overview

1.1 Roles and Responsibilities

1.2 Connecting to the GSA Network

1.2.1 Requirements for Network Connection

1.2.2 Certification and Accreditation (C&A) Policy

1.2.3 C&A Criteria

1.2.4 Scanning Devices Risk Assessments

1.2.5 Encryption

1.2.5.1 Wireless

1.2.5.2 SFTP (Secure File Transfer Protocol) Data Transmission

1.3 Scanned Device List

1.5 Continuous Monitoring and Controlling

1.6 User Access

1.6.2 HSPD-12 Credentialing

1.7 Building Systems Virtual Network

Appendix A: Contact Information

Appendix B: Listing of Reference Policies

Appendix C: Scanning Processes

Appendix D: Security for GSA Building Automation Systems

Appendix E: Top Ten Most Common Vulnerabilities in BMC Systems Scans

Chapter 2: Network Infrastructure

2. Overview

2.1 Roles and Responsibilities

2.2 Standards for Interoperability

2.3 Network Topology

2.4 Network Design Requirements: Submitting a Network Design Diagram to PBS CIO and

OCIO 27

2.5 Sample Network Design Diagrams

2.6 Hardware Standards & Policy

2.7 Requesting Switches and Routers

2.8 Configuration and Connection of the Switches and the Routers

2.9 Acceptance of Non-Standard Hardware

Appendix F

Chapter 3: Cabling, Data Circuit Installation and Upgrade

3 Overview

3.1 Applicable Standards for Cabling Infrastructure

3.2 Minimum Requirement for Ethernet Cabling

3.3 Attenuation Limit

3.4 How are OCIO’s Cabling Standards Enforced?

3.5 Cabling Installation Options

3.5.1 Cabling for New Infrastructure

3.5.2 Cabling Infrastructure for Existing or Migrating Systems

3.5.3 PBS CIO/ OCIO installation Options

3.5.3.1 Local Support

3.5.3.2 Network Services

3.5.3.3 Local Vendor

3.6 General Architecture

3.7 Cable Installation and Support

3.8 Cabling Roles and Responsibilities

3.9 Overview of Data Circulation

3.10 Process for Data Circulation Requests & Sites Visits

3.11 Important Considerations in the Circuit Installation Process

3.12 Circuit Installation Roles & Responsibilities

Appendix G: Contact Information

Appendix H: Listing of Reference Policies

Chapter 4: PBS Systems Support

4 Overview

4.1 Standard Configuration Specifications for Hardware

4.1.1 Physical Server

4.2 Connecting the Server to the GSA Network

4.3 Administrative Access to Servers

4.4 Upon Installation of Application

4.5 Virtual Server

4.6 High-level Process on Physical and Virtual Server Configuration

4.7 How Does the PBS Systems Support Team Monitors Systems?

4.8 Mandatory Server Support Guidelines

4.9 BAS Application Documentation Form: Why Is IT Important?

4.10 Planned Outages

4.11 Patches and updates

4.12 Roles and responsibilities

4.13 What is Virtualization?

Appendix I: Contact Information

Chapter 5: IT Requirements in Scopes of Work (SOWs) for Building Controls Procurements .. 51

5 Overview

5.1 Instructions for Use

5.2 Small Projects

5.3 New Construction(Design and Construction)

5.4 Scope of Work

Chapter 6: Technical Support for Building Monitoring and Control and Energy Management

Systems

6 Overview

6.1 Reporting Issues

6.2 Helpdesk hotline

6.3 Submitting an IT Ticket

6.4 Describing the BMC or EMS issues

6.5 Examples of BMC or EMS issues to include on the call or helpdesk ticket

6.6 Provide information about the site

6.7 System Support Process

6.7.1 Help Desk Ticket Initiation

6.7.2 Management and Troubleshooting Open Tickets

6.7.3 Resolving Open Tickets – Roles and Responsibilities

6.7.3.1 PBS Systems Support

6.7.3.2 OCIO – InterSec:

6.7.3.3 Local OCIO

6.7.3.4 Building Management

6.7.3.5 Controls Vendor

6.7.4 Closing Tickets

6.7.5 Process Flow

Glossary

Chapter 1 Policy/Standards & IT Security

1. Overview

This chapter will detail the General Services Administration (GSA) and Public Building Services’ (PBS) standards and Information Technology (IT) security policies with respect to the implementation of building monitoring and control BMC) systems It will document the comprehensive system requirements related to approved software, standard hardware, network connectivity, user access and security clearances Additionally, it will serve as an educational tool for those who are not familiar with PBS and GSA IT security standards and better prepare these implementations to meet the criteria of an eventual Certification and Accreditation (C&A) as required by the GSA/PBS Chief Information Officer (PBS CIO) for all GSA IT systems.

1.1 Roles and Responsibilities

The roles and responsibilities between GSA CIO (OCIO) and PBS CIO can be broken down as follow:

1.1.1 OCIO has responsibility for the entire IP transport layer to include all routing and switching equipment and access to IP connectivity. They have command responsibility for the GSA Local Area Network (LAN) and GSA Wide Area Network (WAN). OCIO is the sole provider for any and all IP addresses for devices associated with its network.

1.1.2 PBS CIO is responsible for all PBS servers on GSA WAN/LAN, including IT Systems in the Regional Offices, PBS Property Management Centers, regionally-based IT systems, and GSA buildings. This includes server hardware, UPS, Operating Systems, database, monitoring of the server/application services, backups and restores.

1.1.3 PBS IT Security team performs vulnerability assessment scans on building Monitoring and Control

Components to meet GSA, PBS, and FISMA flaw identification and continuous monitoring requirements. PBS IT Security performs scans as part of its Continuous Monitoring program to ensure alignment with GSA CIO-IT Security 08-39. They provide a security assessment on the security posture of each device connected to the GSA network using an IP address

1.1.4 Regional responsibility includes ensuring that any BAS IT system contracted, purchased, owned and operated in the Regions adhere to guidance as well as articulating any contractual agreement with the vendor who provides information technology products or services to PBS, including hardware, software and Service Level Agreements. Additionally, the Regions are responsible for contacting the PBS Building and Energy team early on in the implementation process (prior to contract award) for applicable contract and implementation requirements. They are responsible for the installation, configuration, and management of the application software. In addition, they are to complete the Application

Documentation form for the PSS (PBS Server Support) team in a timely manner in order to ensure monitoring and backup routines are established.

1.2 Connecting to the GSA Network

Federal IT regulations regarding Trusted Internet Connection (TIC) in conjunction with PBS and GSA CIO’s IT policies require all PBS IT systems needing network connectivity to reside on the GSA network.

1.2.1 Requirements for Network Connection

Government-furnished network equipment and computer hardware must be used in all cases for PBS IT systems

• Network equipment- includes any equipment that has IP routing and switching functionality.

• Computer hardware- includes, but is not limited to servers, PCs, laptops and their peripherals

(monitors, mice and keyboards).

• Proprietary system hardware/software can be vendor provided, but is subject to network and system testing, review and approval for connection to GSA’s network and acceptance of the PBS

CIO.

1.2.1.1 Government Furnished Equipment

PBS CIO will make every effort to provide one desktop and/or one laptop to newly integrated (to the

GSA network) sites for the purposes of giving new GSA users access to the building monitoring and control systems. Please note: availability of hardware is depending on the availably of budgeted funds dedicated for this purpose, which may or may not be renewed on an annual basis. Existing GSA workstation refreshes will still be coordinated through regional local OCIO’s office. No hardware

(workstations, servers, switches) will be provided unless an approved network diagram is submitted.

Please see chapter 2 details about network diagram requirements and submittal.

1.2.2 Certification and Accreditation (C&A) Policy

The GSA requires that before any hardware, software or new IT system is connected to its network, a formal approval process known as Certification and Accreditation (C&A) is performed and an Authority to Operate

(ATO) acquired. Certification is a comprehensive assessment of the management, operational, and technical security controls in an information system, made in support of security accreditation, to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system. Accreditation is the official management decision given by a senior agency official to authorize operation of an information system for a period of three years or less and to explicitly accept the risk to agency operations (including mission, functions, image, or reputation), agency assets, or individuals, based on the implementation of an agreed-upon set of security controls. The failure to obtain and maintain a valid certification and accreditation will be grounds for termination of the Government’s Authorization to operate the building Monitoring and

Control System. The Contractor must therefore be held is responsible for mitigating all security risks found during C&A process. All high-risk vulnerabilities must be mitigated within 30 days and all moderate risk vulnerabilities must be mitigated within 90 days from the date vulnerabilities are formally identified. The

Government will determine the risk rating of vulnerabilities.

1.2.3 C&A Criteria

The GSA PBS IT Security team performs C&As with a systematic, repeatable approach, which is utilized to uniformly evaluate any application or general support system. The first step is to request basic documentation, perform vulnerability scans, evaluate items received, and provide feedback to the PBS

Requesting Official throughout the process. The security team then is able to determine the extent to which the security controls in the application (information system) are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system. This also addresses specific actions taken or planned to correct deficiencies in the security controls and to reduce or eliminate known vulnerabilities in the information system. Upon successful completion of the C&A, the AO will have the information needed from the security certification to determine the risk to agency operations, agency assets, or individuals—and thus, will be able to render an appropriate security accreditation decision for the information system.

1.2.4 Scanning Devices Risk Assessments

IT Security assesses the risk this family of devices poses to PBS networks. Through vulnerability scanning and reviewing available documentation, we provide a security assessment for the PBS CIO describing the security posture of such devices. At the discretion of the PBS CIO’s office, Device scanning will be performed either in Central Office or on-site via GSA Site Remote Scanning..

The Security team will perform a scan and provide a Security Assessment Report to the appropriate

Point of Contact. Contact the PBS IT Security Team PBS.IT.Security@gsa.gov to request the Scanning

Request Form and other information you may need. (Please see Appendix C for PBS CIO Scanning

Process)

1.2.5 Encryption

The Federal Information Processing Standard (FIPS) 140-2 is the standard for any IP enabled device connecting to the GSA network (see Appendix B). This is a certificate that specifies the exact module name, hardware, software, firmware, and/or applet version numbers. Encryption is an important tool used to meet security control requirements. When used to protect sensitive information Federal systems must use encryption that meets FIPS 140-2 requirements. Once a system has been designed and deployed using FIPS compliant technologies it must be operated following documented procedures to ensure keys are created, stored, retired, revoked and otherwise managed in a consistent and secure manner. Wireless and SFTP (Secure File Transfer Protocol) Data Transmissions also need to meet FIPS

140-2 protocol. (Please see Appendix B for more information on GSA encryption policies.)

1.2.5.1 Wireless

Wireless Ethernet devices are required to meet FIPS 140-2 encryption model in order to meet the

GSA encryption and security protocol. They must comply with the GSA CIO 2100.2A Wireless LAN security guide. The OCIO scans for unauthorized wireless access points on a regular basis and takes appropriate action if such an access point is discovered. Additionally, OCIO Information system Security

Manager (ISSM) coordinates wireless scanning of Regional locations outside of the Washington Metro area with respective IT Managers and local government personnel responsible for network security.

Wireless Ethernet devices are required to meet FIPS 140-2 encryption model in order to meet the

GSA encryption and security protocol. They must comply with the GSA CIO 2100.2A Wireless LAN security guide. OCIO scans for unauthorized wireless access points quarterly and takes appropriate action if such an access point is discovered. The OCIO Information System Security Manager (ISSM) coordinates wireless scanning of Regional locations outside of the Washington D.C. Metro area with respective IT Managers and local government personnel responsible for network security. Please see

Appendix B “GSA Order CIO 2100.2A- GSA Wireless Local Area Network (LAN) Security” document for more information.

1.2.5.2 SFTP (Secure File Transfer Protocol) Data Transmission

SFTP data transmissions need to meet FIPS 140-2 protocol and adhere to proper authentication.

1.3 Scanned Device List

All vendor furnished hardware and software must be approved by the appropriate GSA PBS Authorizing

Official (AO). As items get evaluated by the PBS IT Security team and receive favorable concurrence by the

GSA CIO, they will be added to the Scanned Device List. PBS associates can find the current scanned list at the link above; The list is not to be used either for inclusion or exclusion of listed components and is only provided as a guide to devices that have completed favorable assessments.

All IP addressed devices, appliances or servers that will communicate over the GSA network must be scanned by PBS CIO and/or OCIO, in order to assess vulnerabilities and acceptable configurations. A security assessment report will be then provided to the responsible PBS Associate. Vulnerabilities must be mitigated within the appropriate timeframe as described in the Security Assessment Report or the responsible PBS associate may provide a mitigation plan along with milestones and timelines for remediation for consideration of the PBS CIO in order to connect to the GSA network. (Please see Appendix D for “Top Ten

Most Common Vulnerabilities in BMC Systems Scans)

1.4 Client Software (Non-Standard Software)

The GSA CIO and the Service level CIOs have agreed that all non-standard software installation requests must be reviewed and approved from both legal and technical perspectives. Definition: Non-standard software is anything not on the approved software list. This process involves evaluation, acceptance of the terms of service by Office of General Counsel (OGC) and the testing and the imaging of the software itself by PBS CIO, in coordination with local OCIO.

1.4.1 Non-standard software on GSA workstations

The following steps need to be followed in order to complete the addition of the client software to the

GSA workstations:

1.4.1.1 The End-User License Agreement (EULA) needs to be made available to PBS CIO before contract is signed for evaluation and acceptance.

1.4.1.2 A soft copy of the embedded EULA needs to be emailed to the OGC (see Appendix A)

1.4.1.3 The OGC reviews terms of service and determines whether or not any of the terms need to be modified or eliminated before the government can agree. Items like indemnification clauses or agreements to pay attorney fees, in disputes are common in EULA’s but are not acceptable to the Government.

Please note: The location of the vendor’s headquarters can affect the approval process. The origin of the software becomes an issue when the price exceeds $194k (the threshold for Trade Agreements Act) or the software originates in Cuba, Iran, Sudan or North Korea.

1.4.1.4 Testing the software

1.4.1.4.1 The software must adhere to Federal Desktop Core Configuration (FDCC) standards (see Appendix B) and be able to be run as a normal user (i.e. does not need local admin rights to run).

1.4.1.4.2 PBS CIO, in coordination with local OCIO, will test the client software to ensure it integrates properly with the standard GSA image. This is done by testing the workstation before and after the software is installed on the workstation. The testing can be done from remote, providing the IP is for the workstation is made available. Please coordinate the testing with the PBS Application Support Team pbsapps.support@gsa.gov

1.4.1.4.3 If the OCIO requires changes to the software for compliance or compatibility reasons, changes will have to be made prior to acceptance.

1.4.1.4 The length of this review process is dependent on the changes required in the EULA.

1.4.2 Non-standard software on GSA servers

1.4.2.1 The EULA approval process is also applicable to non-standard software that will be installed on GSA servers, however since servers are deployed, managed and supported by PBS CIO, compatibility of the software with the servers will be determined by PBS CIO.

1.5 Continuous Monitoring and Controlling

Federal Information technology systems are required to be maintained in a secure fashion for as long as the system is in operation. Continuous Monitoring is the OMB approved process for verification of required security assurances, and to ensure new risks are routinely evaluated against the systems operating posture.

The Desktop Standards Workgroup (DSWG) is working on streamlining the approval process with non-standard software. Updates will be forth coming in FY 2011.

Systems unable to compensate to new issues discovered by the continuous monitoring process risk suspension of their Authorization to Operate in the Federal Government. Please note: The PBS CIO highly recommends that contracts for products and services should include warranties and support, therefore vendor would be responsible for any maintenance and support of their devices and language to this effect should be included in the contract. (Please see Appendix C for the PBS CIO’s Scanning Process.)

1.6 User Access

This section demonstrates how any GSA employee, contract staff or vendor/personnel can obtain access to

GSA IT systems, which includes all hardware, system software, data and network access. Each of these requirements needs to be met in order for access to be granted.

1.6.1 HSPD-12 Credentialing

On August of 2004, President George W. Bush signed the Homeland Security Presidential Directive-12

(HSPD-12) which is a mandated a Policy a for a Common Identification Standard for Federal Employees and

Contractors. HSPD-12 requires all federal Executive Agencies and departments to conduct personnel investigations, adjudicate results, and issue a Personal Identity Verification (PIV) or Access Card to all federal employees and contractors or personnel who require routine or regularly scheduled access to federally controlled facilities and information technology (IT) systems. ENT domain credential and VPN access require HSPD-12 clearance.

The mandatory minimum security clearance level for access to any GSA IT system is the preliminary adjudication of the National Agency Check with Written Inquires (NACI); however, the actual final clearance level needed is dependent on the security level of the data or systems being…