AMD 0005 21R1321.pdf

1641226

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

N62742-21-R-1321, J-034 Bachelor Officer Quarters-B, US NAVSUPPACT MCB, GUAM

See Next Page

1. CONTRACT ID CODE PAGE OF PAGES

J 1 3

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 19-Jan-2022

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X N6274221R1321

X 9B. DATED (SEE ITEM 11)

08-Jun-2021

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer X is extended, is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

19-Jan-2022

CODE

NAVFAC PACIFIC

CONSTRUCTION CONTRACTS BR (CODE ACQ33)

258 MAKALAPA DR STE 100

PEARL HARBOR HI 96860-3134

N62742 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

N6274221R1321

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

This amendment is issued to revise the following:

1. Document 00100, Instructions to Proposers, Paragraph 1.1. Number of Copies/Time of Receipt is revised as follows:

a. Subparagraph a., delete 27 January 2022, 2:00 p.m. HST and replace it with 09 February 2022, 2:00 p.m.

HST.

b. Subparagraph b., delete 27 January 2022, 2:00 p.m. HST and replace it with 09 February 2022, 2:00 p.m.

HST.

c. Subparagraph c., delete 28 January 2022, 2:00 p.m. HST and replace it with 10 February 2022, 2:00 p.m.

HST.

2. Document 00800, Special Contract Requirements, paragraph 1.5 Notice Concerning labor Rates, first paragraph, is revised to read as follows:

The Construction Wage Requirements statute (formerly known as the Davis-Bacon Act) will apply. The attached Guam General Decision No. GU20210002, Publication Date 01/07/2022 will remain in effect for the duration of the project, unless updated via amendment.

3. Specifications, Table of Contents is revised as follows:

a. Delete 07 81 00 Spray Applied Fireproofing in its entirety.

b. Add 10 44 16 Fire Extinguishers after 10 28 13 Toilet Accessories

4. Section 01 33 00, Submittal Register is revised to add the attached page 32A.

5. Section 01 35 13.02 Industrial Control Systems Procurement is deleted in its entirety and replaced with the revised Section 01 35 13.02 Industrial Control Systems Procurement. Revisions are indicated in green font.

6. Section 10 44 16 Fire Extinguishers is added after 10 28 13 Toilet Accessories.

7. Section 22 00 00 Plumbing, General Purpose is deleted in its entirety and replaced with the attached Section 22 00 00 Plumbing, General Purpose. Revisions are bolded and underlined.

8. Revised Drawings: The following previously issued drawings are revised and reissued. These revised drawings supersede any previously issued drawings:

NO.

SHEET

NO.

NAVFAC

NO.

DESCRIPTION

1 GI103 17268284 WALL RATING REVISION

2 A-503 17268461 DETAIL EDIT

3 A-603 17268478 FIRE RATING EDIT

4 M-702 17268566 REVISED CHWS/R SIZES

5 M-706 17268570 REVISED OAU POINTS LIST

6 M-901 17268573 ADDED AIR RELIEF VALVES

7 P-001 17268574 REVISED PLUMBING LEGEND

8 P-602 17268600 REVISED PLUMBING SCHEDULE

9 P-727 17268614 REVISED SCHEMATIC

N6274221R1321

9. All other terms and conditions remain unchanged.

End of Amendment

SUBMITTAL FORM,Jan 96 PREVIOUS EDITION IS OBSOLETE

J-034 BACHELOR OFFICER QUARTERS-B

10 44 16 SD-02 Shop Drawings

2.1.1Fire Extinguishers

Part 2Accessories

2.2.1Wall Brackets

1.5Schedule

SD-03 Product Data

2.1.1Fire Extinguishers

Part 2Accessories

2.2.1Wall Brackets

3.2.1Replacement Parts List

SD-04 Samples

1.3.1Equipment Samples

SD-07 Certificates

2.1.1Fire Extinguishers Certifications

1.4Manufacturer's Warranty with

Inspection Tag

SUBMITTAL REGISTER

CONTRACT NO.

TITLE AND LOCATION CONTRACTOR

CONTRACTOR:

SCHEDULE DATES

CONTRACTOR

ACTION

APPROVING AUTHORITY

A C T I V I T Y

N O

T R A N S M I T T A L

N O

S P E C

S E C T

DESCRIPTION

ITEM SUBMITTED

P A R A G R A P H

C L A S S I F I C A T I O N

G O V T

O R

A E

R E V W

R SUBMIT

APPROVAL

NEEDED

BY

MATERIAL

NEEDED

BY

A C T I O N

C O D E

DATE

OF

ACTION

DATE FWD

TO APPR

AUTH/

DATE RCD

FROM

CONTR

DATE FWD

TO OTHER

REVIEWER

DATE RCD

FROM OTH

REVIEWER

A C T I O N

C O D E

DATE

OF

ACTION

MAILED

TO

CONTR/

DATE RCD

FRM APPR

AUTH REMARKS

(a) (b) (c) (d) (e) (f) (g) (h) (i) (j) (k) (l) (m) (n) (o) (p) (q) (r)

AMD-0005 January 12, 2022AMD-0005 January 12, 2022

AMD-0005

PAGE 32A OF 82 PAGES

J-034 BACHELOR OFFICER QUARTERS-B 1641226

US NAVSUPPACT MCB GUAM

SECTION 01 35 13.02

INDUSTRIAL CONTROL SYSTEMS PROCUREMENT

PART 1 GENERAL

1.1 RELATED SECTIONS

Sections 25 05 11 CYBERSECURITY FOR FACILITY-RELATED CONTROL SYSTEMS, Section 25 08 11.00 20 RISK MANAGEMENT FRAMEWORK FOR FACILITY-RELATED CONROL SYSTEMS, 27 10 00 BUILDING TELECOMMUNICATIONS CABLING SYSTEMS, and 33 82 00 TELECOMMUNICATIONS OUTSIDE PLANT apply to this section with additions and modifications specified herein.

1.2 REFERENCES

The publications listed below form a part of this specification to the extent referenced. The publications are referred to within the text by the basic designation only.

APPLICABLE DOCUMENTS

SECNAV M-5510.30 DON Personnel Security Program Manual

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST)

NIST SP 800-37 The Risk Management Framework (RMF) for DoD Information Technology (IT)

NIST SP 800-82 Guide to Industrial Control Systems (ICS) Securitys

NIST SP 800-53 Security and Privacy Controls for Federal Information Systems and Organizations

U.S. DEPARTMENT OF DEFENSE (DOD)

DoDI 8500.01 Cybersecurity

DoDI 8510.01 DoD Risk Management Framework (RMKF) for DoD Information Technology (IT)

OTHER APPLICABLE DOCUMENTS

UFC 3-580-01 Telecommunications Interior Infrastructure Planning and Design

UFC 4-010-06 Cybersecurity of Facility-Related Control Systems

PWUC Public Works Utilities Criteria (PWUC) for Design & Construction: Electric, Sewer, & Water

NAVFAC FRCS NAVFAC FRCS Diagram Requirements Job Aid_MAY2019.pdf

1.3 DEFINITIONS

SECTION 01 35 13.02 Page 1 Amendment 0005

1.3.1 Industrial Control Systems (ICS)

Within NAVFAC, Industrial Control Systems (ICS), Facility-Related Control Systems (FRCS), and parts of those systems generally consist of Utility Control Systems (UCS) such as Advanced Metering Infrastructure (AMI) and Supervisory Control and Data Acquisition (SCADA) systems as well as Building Control Systems (BCS) such as the Direct Digital Control (DDC) systems used in elevators, smart-lighting, and Heating, Cooling, & Ventilation (HVAC).

1.4 SUBMITTALS

Government approval is required for submittals with a "G" designation;

submittals not having a "G" designation are for Contractor Quality Control approval. Submit the following in accordance with Section 01 33 00 SUBMITTAL PROCEDURES and paragraph "DOCUMENTATION" and its subparagraphs in this section:

SD-03 Product Data

Network Switches; G

Media Converters; G

Uninterruptible Power Supply (UPS); G

Remote Terminal Unit (RTU); G

Intermediary Network Devices; G

SD-10 Operation and Maintenance Data

Operator Manual; G

Sustainment Materials; G

Security Controls Documents; G

System Authorization Documents; G

Access Controls Summary; G

Auditing Controls Summary; G

Configuration Management Plan; G

Contingency Plan; G

Security Features Guide; G

Vulnerability Management Plan; G

Maintenance Plan; G

Documented Statements; G

Test Results; G

SECTION 01 35 13.02 Page 2

SD-11 Closeout Submittals; G

Technical Narrative; G

Completed Navfac Marianas Ics Checklist; G

1.5 WORK COVERED BY CONTRACT DOCUMENTS

This work includes providing for all ICS equipment, network architectures, programming/configuration, testing, commissioning, and documentation to be assessed and authorized under the Department of Navy Risk Management Framework (RMF) process per the most current versions of the standards and regulations referenced in paragraph "REFERENCES" in this section.

1.5.1 General Guidance

For all provided systems and parts of systems, the Government must be afforded the capability to seamlessly and efficiently understand, operate, test, maintain, secure from unauthorized access, diagnose and troubleshoot problems, and recover from run-time errors.

All provided equipment and software must be currently marketed products, not currently scheduled for end of life or obsolescence, to ensure system sustainability. Where older versions of software are provided due to incompatibility concerns between different versions, provide the Government with the means (licenses, install disks, and any other installation materials) to fully update the provided software to the latest marketed version. Hardware and software products for systems networking should have been evaluated and accredited at a licensed/approved evaluation facility and listed as being in conformance to the Common Criteria for IT Security Evaluation (ISO Standard 15408, visit https://www.niap-ccevs.org for more information); products shown to be in the evaluation process for this purpose are acceptable. If multiple versions of hardware exists, devices supporting encryption will be considered first; if additional licenses are required for encryption, those licenses will be obtained as well. Products that fall under the scope of the Unified Capabilities Requirements must be listed in the Department of Defense Information Network (DoDIN) Approved Products List (APL) (https://aplits.disa.mil/apl). Operating systems and malware/antivirus protection application(s) must also be approved for use by the Department of the Navy in the DoN Applications and Database Management System (https://www.dadms.navy.mil). All software licenses are required to be in the name of the Department of the Navy.

Legacy devices that are not required in the new system configuration must be disconnected, removed and turned over to the Government unless otherwise indicated.

PART 2 PRODUCTS

Not usedAll products used on this project must meet the indicated requirements, but not all products specified here will be required by every project.

2.1 GENERAL PRODUCT REQUIREMENTS

Materials and equipment must be standard products of a manufacturer regularly engaged in the manufacturing of these and similar products. The standard products must be Trade Agreement Act (TAA) compliant. Items of

SECTION 01 35 13.02 Page 3 the same type and purpose must be identical, including equipment, assemblies, parts and components.

2.2 SUPPLY CHAIN RISK MANAGEMENT (SCRM)

Receipt of gray market or counterfeit items poses a risk to the DoD systems and the accreditation of that system. Following SCRM practices during the procurement process reduces the risk associated with receipt of gray market or counterfeit equipment and components. Best practices of SCRM must be implemented when procuring Information Technology (IT) equipment and components, including all ICS/FRCS products required for every project. Equipment and components must be procured through authorized Original Equipment Manufacturer (OEM) channels or authorized U.S. distributors. Vendors must guarantee that OEM equipment does not contain third-party parts or components.

2.3 PRODUCT DATA

Submittals must include the following:

- Manufacturer's name

- Place of manufacture

- Product Type

- Catalog model or number

- Operating System (if applicable)

- Firmware Version (if applicable)

- Serial Number

- Warranty Information

- SCRM Information

Provide manufacturer's product data sheets documenting compliance with product specifications for each product provided under this Section.

Provide product data for all products in a single indexed compendium, organized by product type.

2.3.1 Network Switches

Network switches located in climate controlled environments must be compliant with product specifications under Section 25 05 11 and must have the following characteristics:

- Form Factor: Rack-mountable

- Power Supply: Two (Primary and Backup)

- Stackable: Yes

- Advanced Switching: Layer 3

- Manageable: Yes

- Listed on DoDIN APL: Yes

- Full compatibility with existing and future ICS/FRCS networks: Yes

- Minimum Required Protocol Support: CDP, EIGRP

- Software-Defined Access compatible

- Trade Agreement Act (TAA) compliant

2.3.2 Media Converters

SECTION 01 35 13.02 Page 4

Media converters located in climate controlled environments must have the following characteristics:

- Operating Environment: 0C to 50C

- Standards: IEEE 802.3

- 10/100/1000Base-T (RJ-45) 100m to 100/1000Base-X SFP Slot (empty)

- Full compatibility with existing and future ICS network(s)/switch(es):

Yes

- Trade Agreement Act (TAA) compliant

2.3.3 Uninterruptible Power Supply (UPS)

Standalone Uninterruptible Power Supplies (UPS) located in climate controlled environments must have the following characteristics:

- Network Management Support

- Voltage: 120V AC Input/Output

- Output Power Capacity: minimum 2.2kVA (1.8kWatts)

- Form Factor: Rack-mountable

- Surge Protection: minimum 340 Joules

- Input: NEMA 5-20P

- Output: (1) L5-20R, (6) NEMA 5-20R

- Compatible with ICS switch(es)

- Trade Agreement Act (TAA) Compliant

2.3.4 Remote Terminal Unit (RTU)

Remote Terminal Unit (RTU) or gateway devices required for IP network connection to the NAVFAC Marianas Advanced Metering Infrastructure (AMI) system must have the following characteristics:

- must be compatible with absolute encoder type water meters (per NAVFAC MAR PW, water meters are required to be equipped with absolute (digital) encoders)

- must have physical infrastructure (CAT6 or SM fiber) connection back to ICS cabinet, i.e. not wireless

- must connect using MODBUS/TCP

- maintain registers for cumulative water consumption (gallons)

- maintain registers for peak flow (gpm)

- must integrate into NAVFAC MAR AMI system

2.3.5 Intermediary Network Devices

Multimode small form-factor pluggable (SFP) transceiver modules (used with the media converters) and located in climate controlled environments must have the following characteristics:

- Operating Environment: 0C to 70C

- Standards: IEEE 802.3

- 1000Base-SX

- Port Type: 1300nm Ext. multimode (LC) 2km

- Full compatibility with existing and future ICS network(s)/switch(es): Yes

- Trade Agreement Act (TAA) compliant

SECTION 01 35 13.02 Page 5

Single mode small form-factor pluggable (SFP) transceiver modules (used with the media converters) and located in climate controlled environments must have the following characteristics:

- Operating Environment: 0C to 70C

- Standards: IEEE 802.3

- 1000Base-LX

- Port Type: 1310nm Ext. single mode (LC) 10km

- Full compatibility with existing and future ICS network(s)/switch(es):

Yes

- Trade Agreement Act (TAA) compliant

PART 3 EXECUTION

3.1 INDUSTRIAL CONTROL SYSTEMS REQUIREMENTS

3.1.1 Contractor Personnel Requirements

Personnel installing or interacting with new or existing systems hardware and software are required to be United States citizens. Personnel requesting access to existing Navy systems for the purpose of installing new software, programming/configuring software, or modifying code for existing software are required to have a favorable security background check in accordance with IT-II designation, per SECNAV M-5510.30.

Security Background checks must be initiated by the Contractor immediately after award to ensure that background checks are completed and confirmed with NAVFAC Marianas CIO prior to scheduled installation. The Contractor's Facility Security Officer (FSO) is responsibility to initiate and process the security background checks.

Individuals developing or using Security Controls documentation, or other documents that are designated "Controlled Unclassified Information" (CUI), will be required to complete and submit a signed Non-Disclosure and Data Handling Agreement for CUI information. Individuals installing or interacting with new or existing systems equipment will be required to submit documentation showing compliance with the following additional requirements:

a. Fill out and sign/submit the NAVFAC Marianas SCADA Change Request Form (as needed)

b. Fill out and sign/submit the ICS SAAR-N Systems Access Authorization Request Forms

c. Fill out and sign/submit the ICS IA Addendum

d. Complete DoD CYBER AWARENESS CHALLENGE training at https://public.cyber.mil/training/

e. Fill out and sign/submit the NAVFAC Marianas ICS Privileged Access Form (for elevated privileges, such as for administrator or programmer tasks)

Individuals engaged in systems design, programming, and configuration activities, must possess at least five years of documented experience in implementing similar systems, specific project experience that is relevant to the type of work being done on the system, and manufacturer training in

SECTION 01 35 13.02 Page 6 the use and programming of any controls devices being installed.

3.1.2 Installations Requirements

Existing systems must remain operable and services must not be interrupted during the construction process to the greatest extent possible unless otherwise indicated. Coordinate construction phasing in the project schedule/connection or tie-in plan and safety plan with the Government and the system operator for approval prior to start of construction.

Systems may be located within controlled access areas. Access request procedures and requirements for access must be followed for these locations. Escorts may be necessary in many if not all circumstances. The Contractor will be responsible for coordinating access and escorts with the Government.

The Government must be afforded the ability to monitor and witness all installation, testing, and on-site configuration/programming work.

Due to rigorous network security requirements, access to existing systems is not permitted without the individual's consent to a systems use agreement. In general, no applications may be installed on Government systems without explicit request and Government approval. Government systems and systems provided to the Government must not be outfitted with hardware or software "back doors" to permit remote access. Use of flash memory devices (including USB "thumb" drives) on Government equipment is also prohibited. Information used in the course of systems implementation must be designated "Controlled Unclassified Information" (CUI) and must not be disseminated without written authorization from the Contracting Officer.

3.2 PROGRAMMING AND CONFIGURATION REQUIREMENTS

a. For installations that do not intend to integrate new ICS with any existing ICS with an Authorization to Operate (ATO), or where new ICS needs to be programmed prior to integration, contractor laptops may be used but must be validated, scanned for vulnerabilities, and approved by NAVFAC Marianas CIO prior to usage.

b. For any new ICS that need to be configured while already integrated to an existing ICS with an ATO, a Government laptop belonging to the accreditation boundary of that existing ICS must be utilized for programming and configuration. Coordinate with NAVFAC Marianas CIO to check-out appropriate laptop.

c. For programmable or configurable interfaces, coordinate requirements with the system operator and submit draft interface diagrams (and mimic diagrams as applicable) and descriptions for Government approval to ensure compliance with system operator requirements.

d. Configure all provided systems and parts of systems as needed to comply with the NAVFAC Marianas ICS Checklist.

e. All programmed code and scripts developed under this project must be documented and contain annotations within the code structure in accordance with industry best practices, for ease of understanding in troubleshooting or adapting. All compilers used to develop code must be indicated within documentation. Code must be organized into logical sections, clearly defined, with comments indicating the function of each section, including any expected inputs, outputs, and calling

SECTION 01 35 13.02 Page 7 functions. Modifications to existing code must be properly annotated, including date of change, reason for change, any changes to be expected for inputs or outputs. All code should be provided in compiled and uncompiled formats along with custom application programming interfaces (API) or packages used. All scripts and source code must be delivered to the Government in readable format as part of close-out submittals, unless this requirement is waived by NAVFAC Marianas CIO. Conduct code reviews at regular intervals to ensure quality and reduce the likelihood of errors and security vulnerabilities. Document the results of this process and provide for Government review upon request.

f. Systems with programmable interfaces must be configured with adequate interfaces and mimic diagrams (as applicable) for operators to easily view and understand all available data and system conditions. Mimic diagrams must bear resemblance to actual equipment and process layouts to the satisfaction of the Government and the system operators. Where possible, a graphical network analysis/status interface must be provided to allow for troubleshooting and verification of network conditions. Interfaces must not display false information, and should accurately convey fault conditions such as when network connectivity for particular devices has been lost. Programmable interfaces should also be configured and secured in accordance with the Application Security Development Security Technical Implementation Guide.

g. All code programming and script development under this project must be conducted in a secure environment that meets the Department of Defense requirements set forth in the Standards and Regulations referenced for cybersecurity in this document.

h. Copies of code modified or produced under this contract must only be retained while under a sustainment or support contract with the Government, and must only be used for the purposes described within the bounds of the agreement unless expressly authorized in writing by NAVFAC Marianas CIO. Code modified or generated under this contract must be disposed of as described in the Non-disclosure and Data Handling agreement.

3.3 TESTING AND COMMISSIONING REQUIREMENTS

a. Provide NAVFAC Marianas CIO with System Authorization Documents within sixty calendar days of award to receive approval of suggested hardware and software prior to procurement. Upon approval of hardware and software, coordinate with NAVFAC Marianas CIO to create a draft System Assessment Plan (SAP) in which applicable testing methods will be determined prior to installation.

b. Request an editable version of the NAVFAC Marianas ICS Checklist from the Government, and annotate with information required by the checklist, as well as the date and name of the Government representative who witnessed validation of each item. Facilitate Government testing of the system via network scans, Security Template Implementation Guide (STIG) testing, Cyber Hygiene Checklists, and provide support for interpreting scan and STIG test results as needed.

Demonstrate to the satisfaction of the Government that all provided system components are in compliance with the NAVFAC Marianas ICS Checklist, SAP, and Security Controls documentation prior to commissioning.

c. Conduct systems testing and verification, witnessed by the Government

SECTION 01 35 13.02 Page 8 and its system operator as each system component is brought online and commissioned. Systems testing and verification must show via operator interface(s) that system statuses and measurements are reported accurately, controls are fully operable, and programming/configuration conforms to statement of work and operator requirements. Notify the contracting officer forthwith of any equipment or system malfunctions encountered before or during testing that are outside the scope of work. Detailed test procedures, results, date/time, witnessing personnel, and other conditions as applicable must be documented for submission as part of close-out submittals.

3.4 TRAINING REQUIREMENTS

a. Provide on-site training for length of time and personnel as indicated to show how to operate, maintain, troubleshoot, repair, and reconfigure/reprogram the systems. Training requirement must include opportunity for hands-on experience.

Develop and provide an operator manual with step-by-step instructions (w/screenshots) showing how to perform key operational & maintenance/troubleshooting tasks.

Develop and provide a systems administration manual for IT components with step-by-step instructions (w/screenshots) showing how to perform key operational & maintenance/troubleshooting tasks such as user account maintenance, controlled startup/shutdown procedures, backup/restore procedures, software license maintenance, and database maintenance tasks.

Modify the operator and systems administration manuals based on feedback received as a result of the training session.

3.5 DOCUMENTATION

Provide five sets of CD-ROM containing native (editable) file formats. All software licenses are required to be in the name of the Department of the Navy.

3.5.1 Operator Manual

Provide bound hard copies as indicated for training purposes. Provide final Operator Manuals (including modifications based upon feedback) in conjunction with OMSI submittals for all installed equipment in accordance with specification 01 78 24.00 20 FACILITY ELECTRONIC OPERATION AND MAINTENANCE SUPPORT INFORMATION (eOMSI). All documents must be submitted in native (editable) and PDF formats on CD-R or DVD-R in the quantities indicated.

3.5.2 Sustainment Materials

Provide the following for every PLC, RTU, Supervisory Controller, or other network-capable (whether networked or not upon delivery) control device, organized by device and delivered on CD-R or DVD-R in conjunction with OMSI submittals:

a. Original firmware

b. Original firmware hash

SECTION 01 35 13.02 Page 9

c. SOP for application of firmware updates/patches

d. POC or website for firmware updates/patches

e. Count of interfaces and types

f. Protocols in use, per interface (specify upstream and downstream devices)

g. Configuration file

h. SOPs for each device configuration

i. SOPs for standard systems maintenance tasks

- User account maintenance

- Software license maintenance

- System Backup/restoral

- Controlled start-up and shutdown of the system

- Database maintenance

3.5.3 Security Controls Documents

Edit existing documentation where applicable; otherwise provide new documentation as described. Provide draft Systems Authorization documents, Access Controls Summary, Auditing Controls Summary, Configuration Management Plan, Contingency Plan, Security Features Guide, Vulnerability Management Plan, and Maintenance Plan documents, as well as Documented Statements along with all formal design submittals, complete with all information available at the time of the submittal. Provide a document changelog and outline or mark sections of documents that have been changed from originals and from each previous submittal. Provide final Security Controls documents in conjunction with As-Builts submittals, and additionally include the completed NAVFAC Marianas ICS Checklist. Request editable templates for hardware and software lists from the Government, as well as an example network diagram for use as guidance. Hardware and software lists must be in formats editable via Microsoft Excel 2010.

Network diagrams for the purpose of RMF submittals must be in formats editable via Microsoft Visio 2010. All documents must be submitted in native (editable) and PDF formats on CD-R or DVD-R in the quantities indicated.

3.5.3.1 System Authorization Documents (within 60 calendar days of award)

a. Draft hardware list (include the following for each device):

- Manufacturer

- Product line

- Model (and specific variant if applicable)

- Product type

- Location (installation/special area/building/floor/room)

SECTION 01 35 13.02 Page 10

- Key technical ratings (e.g. memory)

- Serial munber

- MAC addresses

- IP addresses

- Unique Navy identifier or barcode (if assigned)

- Operating system software (cross reference with software list)

- Application software (cross reference with software list)

- Network connections and types (cross reference with network diagram)

- Warranty information

b. Software List (include the following for all software):

- Manufacturer

- Version/subversion

- Location/device

- Used network ports/protocols/services

- Warranty information

Both hardware and software lists should also include Common Criteria EAL status, DADMS entry number, and OS/IOS/Firmware version(s) as applicable.

c. Network diagram

- Network diagram must show equipment locations, name/hostname, models, OS/IOS/Firmwaare version, VLAN (if used), and IP addresses on network communications schematic.

- Network diagram must be layered to remove sensitive information such as IP addresses, VLAN, Port Protocols Service (PPS), Building number in support of sanitization when sharing.

- Network diagram must include a Dataflow Table mapped to a directional dataflow label between each component to clearly identify all Port protocols services (PPS) used.

- NAVFAC FRCS Diagram Requirements Job Aid May 2019 may be a source for reference.

3.5.3.2 Access Controls Summary

a. Information on software access controls, port control, and protection.

b. System user roles implemented by application and access privileges assigned by default to each role. If privileges can be added to, or removed from, a role, so specify.

SECTION 01 35 13.02 Page 11

c. Details on system logon, including denial after three invalid attempts, how to delay subsequent logons.

d. Details on privileged accounts - who should have them and when are they used.

e. Details on kinds of accounts, their associated privileges, which roles should have access, and so on - servers, wireless, equipment, meters.

f. User ID/password requirements or PKI requirements including details on shadowing, enforcement of password strength, encryption of passwords.

g. Details of system library structure and what roles should be allowed what access privileges to library components.

h. Details on remote (wireless) access by laptops or servers to meter and radio data.

3.5.3.3 Auditing Controls Summary

a. Details on auditing controls and auditing (creation of system audit trail for user accountability).

3.5.3.4 Configuration Management Plan

a. Vendor configuration management plan.

b. Information required to verify and test all patches and upgrades prior to deployment, including resources, capabilities, and coordination as required with any test procedures run at vendor labs.

3.5.3.5 Contingency Plan

a. Restoration Procedures - Guidance on restoring vendor software & hardware including guidance to help determine priority for restoration.

b. Startup & Shutdown Procedures - Details of system initialization, shutdown/aborts designed to ensure secure system state.

3.5.3.6 Security Features Guide

a. List and discussion of all security features of Vendor hardware and software.

b. Document use of mobile code (e.g. scripts, such as Java) and protections in place to prevent malicious content from using associated runtime systems.

c. Documented FIPS 140-2 validated cryptography (or equivalent) compliance.

3.5.3.7 Vulnerability Management Plan

a. Information required to verify and test all patches and upgrades prior to deployment, including resources, capabilities, and coordination as required with any test procedures run at vendor labs.

b. Security issues associated with implementation and maintenance of the application.

SECTION 01 35 13.02 Page 12

c. Cybersecurity POC for resolution of Cybersecurity issues post accreditation.

3.5.3.8 Maintenance Plan

a. Names and other required information of personnel who will be authorized to perform maintenance in accordance with maintenance agreement.

3.5.3.9 Documented Statements

a. Declaration that public domain software (e.g., freeware, shareware) is not used in the system.

b. Information on Common Criteria or National Information Assurance Partnership (NIAP) or Federal Information Processing Standards (FIPS) evaluation status of hardware and software.

3.5.3.10 Test Results

a. All applicable Security Technical Implementation Guide (STIG) checklist (.ckl) files as identified in the SAP, complete and filled out to acceptable standards.

b. All applicable Cyber Hygiene Checklist files as identified in the SAP, complete and filled out to acceptable standards.

c. All raw scan results (e.g. SCAP, Nessus)

3.6 NAVFAC Marianas ICS Checklist

Submit a completed NAVFAC Marianas ICS Checklist. The checklist is for system installers to review and coordinate with CIO2/4 support during installation and testing. The specified format for the NAVFAC Marianas ICS Checklist is included at the end of this section. The Government will provide an editable version of the NAVFAC Marianas ICS Checklist upon request.

3.7 TECHNICAL NARRATIVE

Provide a technical narrative to include detailed programmer certification and training requirements, and a plan describing how code reviews will be conducted and documented for Government review in a way that is verifiable. Automated code review tools with summary report printouts are recommended. Describe software development practices and standards applied to control system software and firmware that is written by the offeror or any planned subcontractors. Provide detailed information about quality assurance programs that are in place for the provided control system software and firmware, as well as quality control testing methods and results, also including unresolved vulnerabilities and recommended mitigation measures. Quality control testing should include fuzz testing, static testing, dynamic testing, and penetration testing, as well as use of positive and appropriate negative tests to verify that the procured product operates in accordance with requirements and without extra functionality, as well as monitoring for unexpected or undesirable behavior during these tests. Indicate approach and capability to remediate newly reported zero-day vulnerabilities.

-- End of Section --

SECTION 01 35 13.02 Page 13

NOTES/COMMENTS Operating System

Application Network Devices

CTR

Init's

GOV

Witness

DESCRIPTION

Remove all Software and Services not required for operation and/or maintenance of the product:

If removal is not technically feasible, then disable software not required for the operation and/or maintenance of the product. This removal shall not impede the primary function of the product.

If software that is not required cannot be removed or disabled, document a specific explanation and provide risk mitigating recommendations and/or specific technical justification. Provide documentation on what is removed and/or disabled. The software/service to be removed and/or disabled shall include, but not be limited to:

• Games

• Device drivers for product components not procured/delivered

• Messaging services (e.g., email, instant messenger, peer-to-peer file sharing)

• Source code

• Software compilers in user workstations and servers

• Software compilers for programming languages that are not used in the energy delivery system

• Unused networking and communications protocols

• Unused administrative utilities, diagnostics, network management, and system management functions

• Backups of files, databases, and programs used only during system development

• All unused data and configuration files Provide documentation of software/firmware that supports the product, including scripts and/or macros, run time configuration files and interpreters, databases and tables, and all other included software (identifying versions, revisions, and/or patch levels, as delivered). The listing shall include all ports and authorized services required for normal operation, emergency operation, or troubleshooting.

Remove and/or disable, through software, physical disconnection, or engineered barriers, all services and/or ports in the procured product not required for normal operation, emergency operations, or troubleshooting. This shall include communication ports and physical input/output ports (e.g., USB docking ports, CD/DVD drives, video ports, and serial ports). Provide documentation of disabled ports, connectors, and interfaces.

Configure the product to allow the ability to re-enable ports and/or services if they are disabled by software.

Disclose the existence of all known methods for bypassing computer authentication in the product, often referred to as backdoors, and provide written documentation that all such backdoors created have been permanently deleted from the system.

Provide summary documentation of the procured product’s security features and security-focused instructions on product maintenance, support, and reconfiguration of default settings.

Access Control Implement a warning banner on terminal interfaces that conforms to DoD warning banner guidelines Configure each component of the product to operate using the principle of least privilege. This includes operating system permissions, file access, user accounts, application-to-application communications, and energy delivery system services.

Provide user accounts with configurable access and permissions associated with one or more organizationally defined user role(s), where roles are used.

Provide a system administration mechanism for changing user(s’) role (e.g., group) associations.

Configure the product such that when a session or interprocess communication is initiated from a less privileged application, access shall be limited and enforced at the more critical side.

Provide a method for protecting against unauthorized privilege escalation.

Document options for defining access and security permissions, user accounts, and applications with associated roles. Configure these options, as specified.

Prevent unauthorized changes to the Basic Input/Output System (BIOS) and other firmware and document if not feasible, provide mitigation recommendations.

Verify and provide documentation for the procured product, attesting that unauthorized logging devices are not installed (e.g., key loggers, cameras, and microphones).

Account Management Document all accounts (including, but not limited to, generic and/or default) that need to be active for proper operation of the product.

Change default account settings to specific settings (e.g., length, complexity, history, and configurations) provided by government rep. Changed account information will not be published. All new account information will be provided by a protected mechanism.

Remove or disable any accounts that are not needed for normal or maintenance operations of the energy delivery system.

Accounts for emergency operations shall be placed in a highly secure configuration and documentation on their configuration.

Session Management Configure system to disallow multiple concurrent logins using the same authentication credentials, allow applications to retain login information between sessions, provide any auto-fill functionality during login, or allow anonymous logins.

Implement account-based and group-based configurable session-based logout and timeout settings (e.g., alarms and human-machine interfaces).

Authentication/Password Policy and Management Document the levels, methods, and capabilities for authentication and authorization. Deliver a product that adheres to standard authentication protocols.

Implement a configurable account password management system that allows for, but is not limited to, the following:

• Changes to passwords (including default passwords)

• Selection of password length

• Frequency of change

• Setting of required password complexity

• Number of login attempts prior to lockout

• Inactive session logout

• Screen lock by application

• Comparison to a library of forbidden strings

• Derivative use of the user name

• Denial of repeated or recycled use of the same password Ensure/verify that passwords are not stored within or around the system in clear text, and not hardcoded into software or scripts.

Implement a centralized and local account management interface.

NAVFAC MARIANAS ICS CHECKLIST v3.0 FOR [SYSTEM NAME]

CUI - DO NOT DISTRIBUTE Appendix C2

Implement a secure method of authentication (e.g., strong two-factor authentication) to allow for single sign-on authentication to a suite of applications.

Ensure/verify the protection of key files and access control lists used by the authentication system from non-administrative user read, write, and delete access. The authentication system must resolve each individual user’s credentials, roles, and authorizations to each application.

Provide documentation on configuring a single-sign-on system, as well as documentation showing equivalent results in running validation tests against the direct login and the single sign-on.

Logging and Auditing Implement logging capabilities or the ability to support the existing logging system. Logging capabilities shall be configurable by the government and support the governments security auditing requirements. As specified by the government, the procured product shall cover the following events, at a minimum (as appropriate to their function):

• Information requests and server responses

• Successful and unsuccessful authentication and access attempts

• Account changes

• Privileged use

• Application start-up and shutdown

• Application failures

• Major application configuration changes Implement standard time synchronization in the procured product (e.g., Global Positioning System [GPS], Network Time Protocol [NTP], and IEEE 1508-2008). If not providing standard time synchronization and is providing an alternate authoritative time source, the procured product shall be configured to synchronize to that authoritative time source.

Ensure/verify that time stamp audit trails and log files are automatically generated, as specified by the Acquirer.

Provide a list of all log management capabilities that the product is capable of generating and the format of those logs. This list shall identify which of those logs are enabled by default.

Communication Restrictions Document all remote access entry pathways and ensure that they can be enabled or disabled by the Acquirer as needed.

Ensure/verify that a method is provided for managing the network components of the procured product and changing configurations, including hardware and software configurations (e.g., addressing schemes).

Verify and document how the network configuration management interface is secured.

Malware Detection and Protection Implement the capability to automatically scan any removable media that is introduced to the product being acquired.

Implement both of the following:

• Provide a host-based malware detection capability. Quarantine (instead of automatically deleting) suspected infected files. Provide an updating scheme for malware signatures. Test and confirm compatibility of malware detection application patches and upgrades.

• Provide an application whitelisting solution that is tested, validated, and documented that shall only permit approved applications to run.

Validate that cybersecurity services running on the procured product (e.g., virus checking and malware detection) do not conflict with other such services running on the procured product.

Reliability and Adherence to Standards Verify that the addition of security features does not adversely affect connectivity, latency, bandwidth, response time, and throughput specified.

Physical Access System Components Provide lockable or locking enclosures or rooms for energy delivery systems and system components (e.g., servers, clients, and networking hardware) and for the systems used to manage and control physical access (e.g., servers, lock controllers, and alarm control panels).

Provide a method for tamper detection on lockable or locking enclosures. If a physical security and monitoring system is used, tamper detection shall be compatible.

Change locks, locking codes, keycards, and any other keyed entrances or provide the tools and instructions for making these changes.

Verify that physical security features do not hamper energy delivery system operations.

Reprogram codes (e.g., remove default codes) on provided locks and locking devices so that the codes/passwords are unique and do not repeat codes used in the past. Convey all codes/passwords to the government at system operational turnover.

General Wireless Technology Provisions Document specific protocols and other detailed information required for wireless devices to communicate with the control network, including other wireless equipment that can communicate with the supplied devices.

Document use, capabilities, and limits for the wireless devices.

Document the power and frequency requirements of the wireless devices (e.g., microwave devices meet the frequency requirements of Generic Requirements [GR]-63 Network Equipment Building System [NEBS] and GR-1089).

Document the range of the wireless devices and verify that the range of communications is minimized to both meet the needs of the proposed deployment and reduce the possibility of signal interception from outside the designated security perimeter.

Document that the wireless technology and associated devices comply with standard operational and security requirements specified in applicable wireless standard(s) or specification(s) (e.g., applicable IEEE standards, such as 802.11).

Document the configuration control options that enable varying of the security level of the devices.

Recommend alarm settings in accordance with the needs of the system, and implement in accordance with government direction.

Patch Management and Updates Verify and document that all products (including third-party hardware, software, firmware, and services) have appropriate updates and patches installed.

SIGNATURE DATE

I, [name of contractor QC Manager], attest that all of the items on this checklist have been verified and witnessed, and that comprehensive information for each item has been provided as applicable

CUI - DO NOT DISTRIBUTE Appendix C2

SECTION 10 44 16

FIRE EXTINGUISHERS

11/19

PART 1 GENERAL

1.1 REFERENCES

The publications listed below form a part of this specification to the extent referenced. The publications are referred to within the text by the basic designation only.

NATIONAL FIRE PROTECTION ASSOCIATION (NFPA)

NFPA 1 (2021) Fire Code

NFPA 10 (2018; ERTA 1-2 2018) Standard for Portable Fire Extinguishers

NFPA 101 (2021) Life Safety Code

U.S. NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

29 CFR 1910.157 (2003) Portable Fire Extinguishers

UNDERWRITERS LABORATORIES (UL)

UL 299 (2012) Dry Chemical Fire Extinguishers

1.2 SUBMITTALS

Government approval is required for submittals with a "G" or "S" classification. Submittals not having a "G" or "S" classification are for Contractor Quality Control approval. Submit the following in accordance with Section 01 33 00 SUBMITTAL PROCEDURES:

SD-02 Shop Drawings

Fire Extinguishers

Accessories

Wall Brackets

Schedule

SD-03 Product Data

Fire Extinguishers

Accessories

Wall Brackets

Replacement Parts List

SD-04 Samples

SECTION 10 44 16 Page 1

Equipment Samples

SD-07 Certificates

Fire Extinguishers Certifications

Manufacturer's Warranty with Inspection Tag

1.3 DELIVERY, STORAGE, AND HANDLING

Protect materials from weather, soil, and damage during delivery, storage, and construction.

Deliver materials in their original packages, containers, or bundles bearing the brand name and the name and type of the material.

1.3.1 Samples

Provide the following equipment samples: One of each type of fire extinguisher being installed; one full-sized sample of each type of cabinet being installed; three samples of wall brackets and accessories of each type being used.

Use approved samples for installation, with proper identification and storage.

1.4 WARRANTY

Guarantee that Fire Extinguishers are free of defects in materials, fabrication, finish, and installation and that they will remain so for a period of not less than 6 years after completion.

Submit the manufacturer's warranty with inspection tag.

1.5 PROJECT SCHEDULE

For fire extinguishers. Coordinate final fire extinguisher schedule with fire protection cabinet schedule to ensure proper fit and function. Use same designations indicated on Drawings.

PART 2 PRODUCTS