Phase1_RTA_V2-C_Div_25-33 Appendices.pdf

Cyber Center of Excellence

Ready to Advertise Submittal

Vincent Hall Renovation Phase 1 Volume 2 Specifications - C - Divisions 25-33 & Appendices

Solicitation No.: W912HN21B3008

June 25, 2021 Fort Gordon, Georgia

THIS PAGE INTENTIONALLY LEFT BLANK

Vincent Hall Renovation Phase 1 | READY TO ADVERTISE Seals & Signatures

TREVOR WIMBERLY

Civil

GONZALO KOOSAU

Structural

NHU TRAN

Architecture

JEFF WURMLIGER

Mechanical

Vincent Hall Renovation Phase 1 | READY TO ADVERTISE Seals & Signatures

DAVID KURTEN

Plumbing

TOM CHAPMAN

Communications Distribution

TOM IRWIN

Fire Protection

LUEL BAYLON

Electrical

FY20 PN 92894 Vincent Hall Renovation Phase 1 Ft Gordon, GA W912HN21B3008 Ready to Advertise (RTA) – June 25, 2021

PROJECT TABLE OF CONTENTS

DI VI SI ON 00 - PROCUREMENT AND CONTRACTI NG REQUI REMENTS

00 01 15 02/11 LIST OF DRAWINGS

DI VI SI ON 01 - GENERAL REQUI REMENTS

01 03 00 12/18 OPTIONS

01 11 00 08/15 SUMMARY OF WORK

01 14 00 11/11 WORK RESTRICTIONS

01 20 00 11/20 PRICE AND PAYMENT PROCEDURES

01 30 00 11/20 ADMINISTRATIVE REQUIREMENTS

01 30 00.00 23 07/19 FORT GORDON, GA INSTALLATION SPECIFIC

REQUIREMENTS

01 32 01.00 10 02/15 PROJECT SCHEDULE

01 33 00 08/18 SUBMITTAL PROCEDURES

01 33 29 08/18 SUSTAINABILITY REPORTING

01 35 26 11/20 GOVERNMENTAL SAFETY REQUIREMENTS

01 42 00 02/19 SOURCES FOR REFERENCE PUBLICATIONS

01 42 10 06/20 ABBREVIATIONS - TERMINOLOGY

01 45 00.00 10 11/16 QUALITY CONTROL

01 45 00.15 10 11/16, CHG 2: 08/19 RESIDENT MANAGEMENT SYSTEM CONTRACTOR

MODE (RMS CM)

01 45 35 11/20 SPECIAL INSPECTIONS

01 50 00 11/20 TEMPORARY CONSTRUCTION FACILITIES AND

CONTROLS

01 57 19 11/15 TEMPORARY ENVIRONMENTAL CONTROLS

01 58 00 08/19 PROJECT IDENTIFICATION

01 73 29 08/18 CUTTING AND PATCHING

01 74 19 01/07 CONSTRUCTION AND DEMOLITION WASTE

MANAGEMENT

01 74 23 08/18 CLEANING

01 78 00 05/19 CLOSEOUT SUBMITTALS

01 78 23 08/15 OPERATION AND MAINTENANCE DATA

01 91 00.15 10 05/19 TOTAL BUILDING COMMISSIONING

DI VI SI ON 02 - EXI STI NG CONDI TI ONS

02 41 00 05/10 DEMOLITION AND DECONSTRUCTION

02 42 51 11/19 CARPET REMOVAL AND RECLAMATION

02 83 00 11/18 LEAD REMEDIATION

02 84 33 05/20 REMOVAL AND DISPOSAL OF

POLYCHLORINATED BIPHENYLS (PCBs)

DI VI SI ON 03 - CONCRETE

03 30 00 02/19 CAST-IN-PLACE CONCRETE

03 39 23.13 06/20 CHEMICAL COMPOUND MEMBRANE CONCRETE

CURING

DI VI SI ON 04 - MASONRY

04 20 00 11/15 UNIT MASONRY

DI VI SI ON 05 - METALS

05 05 23.16 08/18 STRUCTURAL WELDING

05 12 00 08/18 STRUCTURAL STEEL

PROJECT TABLE OF CONTENTS Page 1

05 30 00 05/15 STEEL DECKS

05 40 00 05/15 COLD-FORMED METAL FRAMING

05 50 13 05/17 MISCELLANEOUS METAL FABRICATIONS

05 51 00 02/17 METAL STAIRS

05 51 33 02/16 METAL LADDERS

05 52 00 02/18 METAL RAILINGS

DI VI SI ON 06 - WOOD, PLASTI CS, AND COMPOSI TES

06 10 00 08/16 ROUGH CARPENTRY

06 20 00 08/16 FINISH CARPENTRY

06 41 16.00 10 08/10 PLASTIC-LAMINATE-CLAD ARCHITECTURAL

CABINETS

DI VI SI ON 07 - THERMAL AND MOI STURE PROTECTI ON

07 14 00 02/12, CHG 2: 02/18 FLUID-APPLIED WATERPROOFING

07 16 00.01 05/13 VAPOR EMISSION CONTROL FOR CONCRETE

FLOORS WITH FINISH FLOORING

07 21 13 02/16, CHG 2: 08/20 BOARD AND BLOCK INSULATION

07 22 00 02/16 ROOF AND DECK INSULATION

07 27 26 05/17, CHG 2: 08/20 FLUID-APPLIED MEMBRANE AIR BARRIERS

07 42 13 05/11 METAL WALL PANELS (MPS-1)

07 52 00 05/12 MODIFIED BITUMINOUS MEMBRANE ROOFING

07 60 00 08/08 FLASHING AND SHEET METAL

07 81 00 02/11 SPRAY-APPLIED FIREPROOFING

07 84 00 05/10 FIRESTOPPING

07 92 00 08/16 JOINT SEALANTS

07 95 00 06/19 EXPANSION JOINTS

DI VI SI ON 08 - OPENI NGS

08 11 13 08/20 STEEL DOORS AND FRAMES

08 31 00 05/17 ACCESS DOORS AND PANELS

08 33 23 08/20 OVERHEAD COILING DOORS

08 41 13 08/18 ALUMINUM-FRAMED ENTRANCES AND

STOREFRONTS

08 71 00 02/16 DOOR HARDWARE

08 81 00 08/11 GLAZING

08 87 33 01/18 DECORATIVE FILM

DI VI SI ON 09 - FI NI SHES

09 22 16 01/18 NON-STRUCTURAL METAL FRAMING

09 29 00 08/16 GYPSUM BOARD

09 30 10 08/20 CERAMIC, QUARRY, AND GLASS TILING

09 51 00 08/20 ACOUSTICAL CEILINGS

09 62 38 08/17 STATIC-CONTROL FLOORING

09 65 00 08/10 RESILIENT FLOORING

09 68 00 11/17 CARPETING

09 69 13 11/15 RIGID GRID ACCESS FLOORING

09 84 20 08/16 ACOUSTICAL WALL PANELS

09 90 00 02/21 PAINTS AND COATINGS

DI VI SI ON 10 - SPECI ALTI ES

10 14 00.20 08/20 INTERIOR SIGNAGE

10 21 13 08/20 TOILET COMPARTMENTS

10 22 19 08/17 DEMOUNTABLE AND MOVABLE PARTITIONS

PROJECT TABLE OF CONTENTS Page 2

10 22 29 03/18 UPFOLDING PANEL PARTITIONS (Bid Alternate #1)

10 26 00 08/20 WALL AND DOOR PROTECTION

10 28 13 08/20 TOILET ACCESSORIES

10 44 16 11/19 FIRE EXTINGUISHERS

DI VI SI ON 11 - EQUI PMENT

11 24 26 07/18 SAFETY TIE-BACKS

DI VI SI ON 14 - CONVEYI NG EQUI PMENT

14 21 23 05/16 ELECTRIC TRACTION PASSENGER ELEVATORS

DI VI SI ON 21 - FI RE SUPPRESSI ON

21 13 13 08/20 WET PIPE SPRINKLER SYSTEMS, FIRE

PROTECTION

21 13 16 08/20 DRY PIPE SPRINKLER SYSTEMS, FIRE

PROTECTION

DI VI SI ON 22 - PLUMBI NG

22 00 00 11/15 PLUMBING, GENERAL PURPOSE

22 05 48.00 20 04/06 MECHANICAL SOUND, VIBRATION, AND

SEISMIC CONTROL

22 07 19.00 40 08/16 PLUMBING PIPING INSULATION

22 14 29.00 40 05/17 SUMP PUMPS

DI VI SI ON 23 - HEATI NG, VENTI LATI NG, AND AI R CONDI TI ONI NG ( HVAC)

23 01 30.41 02/15 HVAC SYSTEM CLEANING

23 03 00.00 20 08/10 BASIC MECHANICAL MATERIALS AND METHODS

23 05 48.00 40 08/15 VIBRATION AND SEISMIC CONTROLS FOR

HVAC PIPING AND EQUIPMENT

23 05 93 11/15 TESTING, ADJUSTING, AND BALANCING FOR

HVAC

23 07 00 02/13 THERMAL INSULATION FOR MECHANICAL

SYSTEMS

23 09 00 02/19 INSTRUMENTATION AND CONTROL FOR HVAC

23 09 13 11/15 INSTRUMENTATION AND CONTROL DEVICES

FOR HVAC

23 09 23.02 02/19 BACNET DIRECT DIGITAL CONTROL FOR HVAC

AND OTHER BUILDING CONTROL SYSTEMS

23 09 93 11/15 SEQUENCES OF OPERATION FOR HVAC CONTROL

23 11 20 05/20 FACILITY GAS PIPING

23 21 23 08/17 HYDRONIC PUMPS

23 23 00 10/07 REFRIGERANT PIPING

23 25 00 11/08 CHEMICAL TREATMENT OF WATER FOR

MECHANICAL SYSTEMS

23 30 00 05/20 HVAC AIR DISTRIBUTION

23 64 10 11/16 WATER CHILLERS, VAPOR COMPRESSION TYPE

23 64 26 08/09 CHILLED, CHILLED-HOT, AND CONDENSER

WATER PIPING SYSTEMS

23 81 00 05/18 DECENTRALIZED UNITARY HVAC EQUIPMENT

23 83 00.00 20 04/06 ELECTRIC SPACE HEATING EQUIPMENT

DI VI SI ON 25 - I NTEGRATED AUTOMATI ON

PROJECT TABLE OF CONTENTS Page 3

25 05 11.00 11/17 CYBERSECURITY FOR FACILITY-RELATED

CONTROL SYSTEMS - UMCS

25 05 11.01 11/17 CYBERSECURITY FOR FACILITY-RELATED

CONTROL SYSTEMS - UCS

25 05 11.02 11/17 CYBERSECURITY FOR FACILITY-RELATED

CONTROL SYSTEMS - FLS

25 05 11.03 11/17 CYBERSECURITY FOR FACILITY-RELATED

CONTROL SYSTEMS - C/VTS AND ES

25 10 10 02/19 CYBERSECURITY FOR UTILITY MONITORING

AND CONTROL SYSTEM (UMCS) FRONT END

AND INTEGRATION

DI VI SI ON 26 - ELECTRI CAL

26 08 00 08/08 APPARATUS INSPECTION AND TESTING

26 09 43 03/20 PLUG-LOAD CONTROL SYSTEM

26 20 00 08/19 INTERIOR DISTRIBUTION SYSTEM

26 23 00 05/15 LOW-VOLTAGE SWITCHGEAR

26 24 16.00 40 08/19 PANELBOARDS

26 28 01.00 10 10/07 COORDINATED POWER SYSTEM PROTECTION

26 29 23 02/20 VARIABLE FREQUENCY DRIVE SYSTEMS UNDER

600 VOLTS

26 41 00 11/13 LIGHTNING PROTECTION SYSTEM

26 51 00 05/20 INTERIOR LIGHTING

DI VI SI ON 27 - COMMUNI CATI ONS

27 05 28.36 05/17 CABLE TRAYS FOR COMMUNICATIONS SYSTEMS

27 10 00 08/11 BUILDING TELECOMMUNICATIONS CABLING

SYSTEM

DI VI SI ON 28 - ELECTRONI C SAFETY AND SECURI TY

28 08 10 05/16 ELECTRONIC SECURITY SYSTEM ACCEPTANCE

TESTING

28 10 05 05/16 ELECTRONIC SECURITY SYSTEMS (ESS)

28 31 76 08/20 INTERIOR FIRE ALARM AND MASS

NOTIFICATION SYSTEM, ADDRESSABLE

DI VI SI ON 31 - EARTHWORK

31 00 00 08/08 EARTHWORK

31 05 19.13 02/21 GEOTEXTILES FOR EARTHWORK

31 48 00 03/21 UNDERPINNING

DI VI SI ON 32 - EXTERI OR I MPROVEMENTS

32 11 23 08/17 AGGREGATE BASE COURSES

32 12 13 05/17 BITUMINOUS TACK AND PRIME COATS

32 12 16.16 11/20 ROAD-MIX ASPHALT PAVING

32 13 13.06 05/20 PORTLAND CEMENT CONCRETE PAVEMENT FOR

ROADS AND SITE FACILITIES

32 16 19 05/18 CONCRETE CURBS, GUTTERS AND SIDEWALKS

32 92 19 08/17 SEEDING

32 92 23 04/06 SODDING

DI VI SI ON 33 - UTI LI TI ES

33 82 00 04/06 TELECOMMUNICATIONS OUTSIDE PLANT (OSP)

PROJECT TABLE OF CONTENTS Page 4

-- End of Project Table of Contents --

PROJECT TABLE OF CONTENTS Page 5

PROJECT TABLE OF CONTENTS (APPENDIX) Page 1

APPENDIX A

AUGUSTA UTILITIES DEPARTMENT (AUD) SPECIFICATIONS

14.2 WATER DISTRIBUTION SYSTEMS DESIGN & CONSTRUCTION

14.3 WASTEWATER COLLECTION SYSTEMS DESIGN & CONSTRUCTION

14.4 EXCAVATION AND BACKFILLING

-- End of Project Table of Contents (Appendix) --

SECTION 25 05 11.00

CYBERSECURITY FOR FACILITY-RELATED CONTROL SYSTEMS - UMCS

11/17

PART 1 GENERAL

This section includes requirements in support of the DOD Risk Management Framework (RMF) for implementing cybersecurity. Refer to UFC 4-010-06 , Cybersecurity for Facility-Related Control Systems, for requiremetns on incorporating into control cystem design and for general informaiton on the RMF process as it applies to control systems. Assistance for control system cybersecurity is available form the following Service organizations:

US Army Corp of Engineers: Cybersecurity POC

For the purposes of the section and for this project, UMCS is used interchangeably with Energy Management and Control System (EMCS).

Many subparts in this Section contain text in curly braces ("{" and "}") indicating which cybersecurity control and control correlation identifier (CCI) the requirements of the subpart relate to. The text inside these curly braces is for Government reference only, and enables coordination of the requirements of this Section with the RMF process throughout the design and construction process. Text in curly braces are not contractor requirements.

This Section refers to Security Requirements Guide (SRGs) and Security Technical Implementation Guide (STIGs). STIGs and SRGs are are available online at the Information Assurance Support Environment (IASE) website at http://iase.disa.mil/stigs/Pages/index.aspx . Not all control system components have applicable STIGs or SRGs.

1.1 CONTROL SYSTEM APPLICABILITY

There are multiple versions of this Section associated with this project.

Different versions have requirements applicable to different control systems. This specific Section applies only to the following control systems:

a. Heating, Ventilation, and Air Conditioning (HVAC)

b. Building Lighting System (BLS)

1.1.1 Control System Classification

The C-I-A impact levels for the control system have been determined to be

LOW-MODERATE-MODERATE (L-M-M).

1.1.2 Interconnection

The control system(s) addressed by this specification will be connected to the existing base-wide Utility Monitoring and Control System (UMCS). The integration into the existing UMCS will allow for remote monitoring and control of systems and sub-systems.

SECTION 25 05 11.00 Page 1

1.1.3 Implementation

The facility will be renovated in two phases. This will result in two systems performing similar functions in the same building, simultaneously. This separation will be maintained due to cybersecruity authorization requirements. Complete facility integration will not occur until Phase 2.

1.2 RELATED REQUIREMENTS

All Sections containing facility-related control systems or control system components are related to the requirements of this Section. Review all specification sections to determine related requirements.

Incorporate each of the requirements contained in this specification for system specified in the following sections:

a. Section 23 09 00 INSTRUMENTATION AND CONTROL FOR HVAC

b. Section 23 09 13 INSTRUMENTATION AND CONTROL DEVICES FOR HVAC

c. Section 23 09 23.02 BACNET DIRECT DIGITAL CONTROL FOR HVAC AND OTHER

BUILDING CONTROL SYSTEMS

d. Section 26 51 00 INTERIOR LIGHTING

1.3 REFERENCES

The publications listed below form a part of this specification to the extent referenced. The publications are referred to within the text by the basic designation only.

AMERICAN SOCIETY OF HEATING, REFRIGERATING AND AIR-CONDITIONING

ENGINEERS (ASHRAE)

ASHRAE 135 (2016) BACnet—A Data Communication Protocol for Building Automation and Control Networks

INSTITUTE OF ELECTRICAL AND ELECTRONICS ENGINEERS (IEEE)

IEEE 802.1x (2010) Local and Metropolitan Area Networks - Port Based Network Access Control

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST)

NIST FIPS 201-2 (2013) Personal Identity Verification (PIV) of Federal Employees and Contractors

U.S. DEPARTMENT OF DEFENSE (DOD)

DODI 8551.01 (2014) Ports, Protocols, and Services Management (PPSM)

DTM 08-060 (2008) Policy on Use of Department of Defense (DoD) Information Systems - Standard Consent Banner and User Agreement

SECTION 25 05 11.00 Page 2

UFC 4-010-06 (2016; with Change 1, 2017) Cybersecurity of Facility-Related Control Systems

1.4 DEFINITIONS

1.4.1 Computer

As used in this Section, a computer is one of the following:

a. a device running a non-embedded desktop or server version of Microsoft Windows

b. a device running a non-embedded version of MacOS

c. a device running a non-embedded version of Linux

d. a device running a version or derivative of the Android OS, where Android is considered separate from Linux

e. a device running a version of Apple iOS

1.4.2 Network Connected

A component is network connected (or "connected to a network") only when the device has a network transceiver which is directly connected to the network and implements the network protocol. A device lacking a network transceiver (and accompanying protocol implementation) can never be considered network connected. Note that a device connected to a non-IP network is still considered network connected (an IP connection or IP address is not required for a device to be network connected).

Any device that supports wireless communication is network connected, regardless of whether the device is communicating using wireless .

1.4.3 User Account Support Levels

The support for user accounts is categorized in this Section as one of three levels:

1.4.3.1 FULLY Supported

Device supports configurable individual accounts. Accounts can be created, deleted, modified, etc. Privileges can be assigned to accounts.

1.4.3.2 MINIMALLY Supported

Device supports a small, fixed number of accounts (perhaps only one).

Accounts cannot be modified. A device with only a "User" and an "Administrator" account would fit this category. Similarly, a device with two PINs for logon - one for restricted and one for unrestricted rights would fit here (in other words, the accounts do not have to be the traditional "user name and password" structure).

1.4.3.3 NOT Supported

Device does not support any Access Enforcement therefore the whole concept of "account" is meaningless.

SECTION 25 05 11.00 Page 3

1.4.4 User Interface

Generally, a user interface is hardware on a device allowing user interaction with that device via input (buttons, switches, sliders, keyboard, touch screen, etc.) and a screen. There are three types of user interfaces defined in this Section: Limited Local User Interface, Full Local User Interface and Remote User Interface. In this Section, when the term "User Interface" is used without specifying which type, it refers only to Full Local User Interface and Remote User Interface (NOT to Limited Local User Interface).

1.4.4.1 Limited Local User Interface

A Limited Local User Interface is a user interface where the interaction is limited, fixed at the factory, and cannot be modified in the field.

The user must be physically at the device to interact with it.

Examples of Limited Local User Interface include thermostats (Space Sensor Modules as defined in Section 23 09 13 INSTRUMENTATION AND CONTROL DEVICES

FOR HVAC).

1.4.4.2 Full Local User Interface

A Full Local User Interface is a user interface where the interaction and displays are field-configurable.

Examples of a Full Local User Interface include local applications on a computer and user interfaces to Variable Speed Drives .

1.4.4.3 Remote User Interface

A Remote User Interface is a user interface on a Client device allowing user interaction with a different Server device. The user need not be physically at the Server device to interact with it.

Examples of Remote User Interfaces include web browsers and Local Display Panels as defined in Section 23 09 00 INSTRUMENTATION AND CONTROL FOR HVAC .

1.4.5 C-I-A Impact Level

A reference to the security objectives of Confidentiality (C), Integrity (I), and Availability (A) associated with a control system. These values are determined by the System Owner (SO) in conjunction with the Authorizing Official (AO). The potential impact levels for each security objective are LOW (L), MODERATE (M), and HIGH (H).

The determination of control system impact levels is a requirement of

UFC 4-010-06 .

1.5 ADMINISTRATIVE REQUIREMENTS

1.5.1 Coordination

Coordinate the execution of this Section with the execution of all other Sections related to control systems as indicated in the paragraph RELATED REQUIREMENTS. Items that must be considered when coordinating project efforts include but are not limited to:

SECTION 25 05 11.00 Page 4

a. If requesting permission for alternate account lock permissions, the Device Account Lock Exception Request must be approved prior to control system device selection and integration.

b. If the Device Audit Record Upload Software is to be installed on a computer not being provided as part of the control system, coordination is required to identify the computer on which to install the software.

c. Cybersecurity Interconnection Schedule must be coordinated with other work that will be interconnected to, and interconnections must be approved by the Government before relying on them for system functionality.

d. Cybersecurity testing support must be coordinated across control systems and with the Government cybersecurity testing schedule.

e. Passwords must be coordinated with the indicated contact for the project site.

f. If applicable, HTTP web server certificates must be obtained from the indicated contact for the project site.

g. Contractor Computer Cybersecurity Compliance Statements for each contractor using contractor owned computers.

1.6 SUBMITTALS

Government approval is required for submittals with a "G" or "S" classification. Submittals not having a "G" or "S" classification are for Contractor Quality Control approval. Architect/Engineer approval is required for submittals marked with an "AE" designation. Submit the following in accordance with Section 01 33 00 SUBMITTAL PROCEDURES:

SD-01 Preconstruction Submittals

Qualifications; G

Device Account Lock Exception Request; G

Contractor Computer Cybersecurity Compliance Statements; G

Contractor Temporary Network Cybersecurity Compliance Statements; G

SD-02 Shop Drawings

User Interface Banner Schedule; G

Network Communication Report; G

Cybersecurity Riser Diagram; G

Control System Inventory Report; G

Cybersecurity Interconnection Schedule; G

SD-03 Product Data

Control System Cybersecurity Documentation; G

SECTION 25 05 11.00 Page 5

SD-07 Certificates

Software Licenses; G

SD-11 Closeout Submittals

Password Summary Report; G

Software Recovery And Reconstitution Images; G

Device Audit Record Upload Software; G

1.7 QUALITY CONTROL

1.7.1 Qualifications

1.7.1.1 Control System Cybersecurity Subject Matter Expert

The individual will oversee all work within this specification. This position requires that the individual currently meets Information Assurance Manager Level II Certification in accordance with DoDI 8570 Information Workforce Improvement Program.

Individuals for this position should have experience securing DoD systems and with Risk Management Framework. Control System Experience is highly desirable.

Resumes should be submitted to the Government within 14 days after notice to proceed. All certifications to include computing environment must be in effect prior to beginning work.

1.7.1.2 Computing Environment (System Administrator) and Networking Personnel

The individual will complete all work at the computing level environment.

This position requires that the individual meets Information Assurance Technical Level II Certification in accordance with DoDI 8570 Information Workforce Improvement Program.

Individuals for this positions should have experience securing DoD systems, Security Information Technical Guides, associated tools and practices. Control System Experience is highly desirable.

Resumes should be submitted to the Government within 14 days after notice to proceed. All certifications to include computing environment must be in effect prior to beginning work.

Control System Cybersecurity Subject Matter Expert and Computing Environment and Network Personnel can serve across the contract.

1.8 CYBERSECURITY DOCUMENTATION

1.8.1 Cybersecurity Interconnection Schedule

{For Reference Only: This subpart (and its subparts) relates to CA-3(b), CCI-00258}

Provide a completed Cybersecurity Interconnection Schedule documenting connections between the installed system and other systems. Provide the

SECTION 25 05 11.00 Page 6 following information for each device communicating between systems:

Device Identifier, Device Description, Transport layer Protocol, Network Address, Port (if applicable), MAC (Layer 2) address (if applicable), Media, Application Protocol, Service (if applicable), Descriptive Purpose of communication. If other control system Sections used on this project include submittals documenting this information, provide copies of those submittals to meet this requirement.

In addition to the requirements of Section 01 33 00 SUBMITTAL PROCEDURES, provide the Cybersecurity Interconnection Schedule as an editable Microsoft Excel file (a template Cybersecurity Interconnection Schedule in Excel format is available at http://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/forms-graphics-tables

1.8.2 Network Communication Report

{For Reference Only: This subpart (and its subparts) relates to CA-9;

CCI-002102, CCI-002103, CCI-002104, CCI-002105 and also the submittal requirements associated with CM-6, CM-7 and SC-41 }

Provide a network communication report. For each networked controller, document the communication characteristics of the controller including communication protocols, services used, and a general description of what information is communicated over the network. For each controller using IP, document all TCP and UDP ports used. If other control system Sections used on this project include submittals documenting this information, provide copies of those submittals to meet this requirement.

In addition to the requirements of Section 01 33 00 SUBMITTAL PROCEDURES, provide the Network Communication Report as an editable Microsoft Excel file.

1.8.3 Control System Inventory Report

{For Reference Only: This subpart (and its subparts) relates to CM-8(a), CP-12, SI-17, IA-3; CCI-000389, CCI-000392, CCI-000398, CCI-002855, CCI-002856, CCI-002857, CCI-002773, CCI-002774, CCI-002775, CCI-000777, CCI-000778, CCI-001958}

Provide a Control System Inventory report using the Inventory Spreadsheet listed under this Section at http://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/forms-graphics-tables documenting all devices, including networked devices, network infrastructure devices, non-networked devices, input devices (e.g.

sensors) and output devices (e.g. actuators). For each device provide all applicable information for which there is a field on the spreadsheet in accordance with the instructions on the spreadsheet.

In addition to the requirements of Section 01 33 00 SUBMITTAL PROCEDURES, provide the Control System Inventory Report as an editable Microsoft Excel file.

1.8.4 Software Recovery and Reconstitution Images

{For Reference Only: This subpart (and its subparts) relates to CP-10;

CCI-000550, CCI-000551, CCI-000552}

For each computer on which software is installed under this project, provide a recovery image of the final as-built computer. This image must

SECTION 25 05 11.00 Page 7 allow for bare-metal restore such that restoration of the image is sufficient to restore system operation to the imaged state without the need for re-installation of software.

For each communications infrastructure device, e.g. switches, routers, and firewalls, provide a recovery image of the final as-built device. This image must allow for the firmware compatible restoration of the image sufficient to restore system operation to the imaged state.

For each programmable control system device, provide a recovery image or complete downloadable configuration of the final as-built device. This image must allow for the firmware compatible restoration of the image sufficient to restore system operation to the imaged state.

If additional user permissions are required to meet this requirement, coordinate the creation of the image with the Government.

1.8.5 Cybersecurity Riser Diagram

{For Reference Only: This subpart (and its subparts) relates to PL-2(a);

CCI-003051, CCI-003053}

Provide a network riser and connection diagram of the complete control system network including all cabling and patch panel details, network equipment, controller hardware, and connected devices. The diagram to illustrate all physical connections, logical connections, addressing and subnet details, and routing information. Detailed information regarding high-density devices and equipment may be represented in tabular format.

1.8.6 Control System Cybersecurity Documentation

This subpart (and its subparts) relates to SA-5 (a),(b),(c); CCIs:

CCI-003124, CCI-003125, CCI-003126, CCI-003127, CCI-003128, CCI-003129,

CCI-003130, CCI-003131}

Provide a Control System Cybersecurity Documentation submittal containing the indicated information for each device and software application.

1.8.6.1 For HVAC Control System Devices

1.8.6.1.1 HVAC Control System Devices FULLY Supporting User Accounts

For all HVAC Control System Devices which FULLY support user accounts, provide:

a. Documentation that describes secure configuration of the device {for reference only: relates to CCI-003124}

b. Documentation that describes secure operation of the device {for reference only: relates to CCI-003124}

c. Documentation that describes effective use and maintenance of security functions or mechanisms for the device {for reference only: relates to

CCI-003127}

d. Documentation that describes known vulnerabilities regarding configuration and use of administrative (i.e. privileged) functions for the device {for reference only: relates to CCI-003128}

SECTION 25 05 11.00 Page 8

e. Documentation that describes user-accessible security functions or mechanisms in the device and how to effectively use those security functions or mechanisms; or a specific indication that there are no user-accessible security functions or mechanisms in the device {for reference only: relates to CCI-003129}

f. Documentation that describes methods for user interaction which enables individuals to use the device in a more secure manner {for reference only: relates to CCI-003130}

1.8.6.1.2 All Other HVAC Control System Devices

For all HVAC Control System Devices which do not FULLY support user accounts, provide:

a. Documentation that describes secure configuration of the device; or a specific indication that there are no secure configuration steps that apply {for reference only: relates to CCI-003124}

b. Documentation that describes effective use and maintenance of security functions or mechanisms for the device; or a specific indication that there are no security functions or mechanisms in the device {for reference only: relates to CCI-003127}

c. For devices which include a user interface, documentation that describes methods for user interaction which enables individuals to use the device in a more secure manner {for reference only: relates to

CCI-003130}

1.8.6.2 BLS Control System Devices

1.8.6.2.1 BLS Control System Devices FULLY Supporting User Accounts

For all BLS Control System Devices which FULLY support user accounts, provide:

a. Documentation that describes secure configuration of the device {for reference only: relates to CCI-003124}

b. Documentation that describes secure operation of the device {for reference only: relates to CCI-003124}

c. Documentation that describes effective use and maintenance of security functions or mechanisms for the device {for reference only: relates to

CCI-003127}

d. Documentation that describes known vulnerabilities regarding configuration and use of administrative (i.e. privileged) functions for the device {for reference only: relates to CCI-003128}

e. Documentation that describes user-accessible security functions or mechanisms in the device and how to effectively use those security functions or mechanisms; or a specific indication that there are no user-accessible security functions or mechanisms in the device {for reference only: relates to CCI-003129}

f. Documentation that describes methods for user interaction which enables individuals to use the device in a more secure manner {for reference only: relates to CCI-003130}

SECTION 25 05 11.00 Page 9

1.8.6.2.2 All Other BLS Control System Devices

For all BLS Control System Devices which do not FULLY support user accounts, provide:

a. Documentation that describes secure configuration of the device; or a specific indication that there are no secure configuration steps that apply {for reference only: relates to CCI-003124}

b. Documentation that describes effective use and maintenance of security functions or mechanisms for the device; or a specific indication that there are no security functions or mechanisms in the device {for reference only: relates to CCI-003127}

c. For devices which include a user interface, documentation that describes methods for user interaction which enables individuals to use the device in a more secure manner {for reference only: relates to

CCI-003130}

1.8.6.3 Default Requirements for Control System Devices

For control system devices where Control System Cybersecurity Documentation requirements are not otherwise indicated in this Section, provide:

a. Documentation that describes secure configuration of the device {for reference only: relates to CCI-003124}

b. Documentation that describes secure installation of the device {for reference only: relates to CCI-003125}

c. Documentation that describes secure operation of the device {for reference only: relates to CCI-003124}

d. Documentation that describes effective use and maintenance of security functions or mechanisms for the device {for reference only: relates to

CCI-003127}

e. Documentation that describes known vulnerabilities regarding configuration and use of administrative (i.e. privileged) functions for the device {for reference only: relates to CCI-003128}

f. Documentation that describes user-accessible security functions or mechanisms in the device and how to effectively use those security functions or mechanisms {for reference only: relates to CCI-003129}

g. Documentation that describes methods for user interaction which enables individuals to use the device in a more secure manner {for reference only: relates to CCI-003130}

h. Documentation that describes user responsibilities in maintaining the security of the device {for reference only: relates to CCI-003131}

1.9 SOFTWARE UPDATE LICENSING

{For Reference Only: This subpart (and its subparts) relates to SI-2 (a),(c); CCI-001227, CCI-002605}

SECTION 25 05 11.00 Page 10

In addition to all other licensing requirements, all software licensing must include licensing of the following software updates for a period of no less than 5 years:

a. Security and bug-fix patches issued by the software manufacturer.

b. Security patches to address any vulnerability identified in the National Vulnerability Database at http://nvd.nist.gov with a Common Vulnerability Scoring System (CVSS) severity rating of MEDIUM or higher.

Provide a single Software Licenses submittal with documentation of the software licenses for all software provided

1.10 CYBERSECURITY DURING CONSTRUCTION

{For Reference Only: This subpart (and its subparts) relates to AC-18, SA-3, CCI-00258}

In addition to the control system cybersecurity requirements indicated in this section, meet following requirement throughout the construction process.

1.10.1 Contractor Computer Equipment

Contractor owned computers may be used for construction. When used, contractor computers must meet the following requirements:

1.10.1.1 Operating System

The operating system must be an operating system currently supported by the manufacturer of the operating system. The operating system must be current on security patches and operating system manufacturer required updates.

1.10.1.2 Anti-Malware Software

The computer must run anti-malware software from a reputable software manufacturer. Anti-malware software must be a version currently supported by the software manufacturer, must be current on all patches and updates, and must use the latest definitions file. All computers used on this project must be scanned using the installed software at least once per day.

1.10.1.3 Passwords and Passphrases

The passwords and passphrases for all computers must be changed from their default values. Passwords must be a minimum of eight characters with a minimum of one uppercase letter, one lowercase letter, one number and one special character.

1.10.1.4 Contractor Computer Cybersecurity Compliance Statements

Provide a single submittal containing completed Contractor Computer Cybersecurity Compliance Statements for each company using contractor owned computers. Contractor Computer Cybersecurity Compliance Statements must use the template published at http://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/forms-graphics-tables Each Statement must be signed by a cybersecurity representative for the relevant company.

SECTION 25 05 11.00 Page 11

1.10.2 Temporary IP Networks

Temporary contractor-installed IP networks may be used during construction. When used, temporary contractor-installed IP networks must meet the following requirements:

1.10.2.1 Network Boundaries and Connections

The network must not extend outside the project site and must not connect to any IP network other than IP networks provided under this project or Government furnished IP networks provided for this purpose. Any and all network access from outside the project site is prohibited. Unused network access ports are to be disabled via the management console or command line when not in use.

1.10.3 Government Access to Network

Government personnel must be allowed to have complete and immediate access to the network at any time in order to verify compliance with this specification

1.10.4 Temporary Wireless IP Networks

In addition to the other requirements on temporary IP networks, temporary wireless IP (WiFi) networks must not interfere with existing wireless network and must use WPA2 security. Network names (SSID) for wireless networks must be changed from their default values.

1.10.5 Passwords and Passphrases

The passwords and passphrases for all network devices and network access must be changed from their default values. Passwords must be a minimum 8 characters with a minimum of one uppercase letter, one lowercase letter, one number and one special character.

1.10.6 Contractor Temporary Network Cybersecurity Compliance Statements

Provide a single submittal containing completed Contractor Temporary Network Cybersecurity Compliance Statements for each company implementing a temporary IP network. Contractor Temporary Network Cybersecurity Compliance Statements must use the template published at http://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/forms-graphics-tables Each Statement must be signed by a cybersecurity representative for the relevant company. If no temporary IP networks will be used, provide a single copy of the Statement indicating this.

1.11 CYBERSECURITY DURING WARRANTY PERIOD

All work performed on the control system after acceptance must be performed using Government Furnished Equipment or equipment specifically and individually approved by the Government.

PART 2 PRODUCTS

(NOT USED)

SECTION 25 05 11.00 Page 12

PART 3 EXECUTION

3.1 ACCESS CONTROL REQUIREMENTS

3.1.1 User Accounts

{For Reference Only: This subpart (and its subparts) relate to AC-2(a)and

AC-3; CCI-002110, CCI-000213.}

Any device supporting user accounts (either FULLY or MINIMALLY) must limit access to the device according to specified limitations for each account.

Install and configure any device having a STIG or SRG in accordance with that STIG or SRG.

3.1.1.1 For HVAC Control System Devices

Devices with web interfaces must either FULLY support user accounts or have their web interface disabled. Field devices with full local user interfaces allowing modification of data must at least MINIMALLY support user accounts.

3.1.1.2 For BLS Control System Devices

Field devices with full local user interfaces allowing modification of data must at least MINIMALLY support user accounts.

3.1.1.3 Default Requirements for Control System Devices

For control system devices where User Account requirements are not otherwise indicated in this Section:

a. Devices with web interfaces must either FULLY support user accounts or have their web interface disabled.

b. Field devices with full local user interfaces allowing modification of data must at least MINIMALLY support user accounts.

c. Field devices with read-only full local user interfaces must at least MINIMALLY support user accounts.

3.1.2 Unsuccessful Logon Attempts

{For Reference Only: This subpart (and its subparts) relate AC-7 (a), AC-7 (b); CCI-000043, CCI-000044, CCI-001423, CCI-002236, CCI-002237, CCI-002238}

Except for high availability user interfaces indicated as exempt, devices must meet the indicated requirements for handling unsuccessful logon attempts.

3.1.2.1 Devices MINIMALLY Supporting Accounts

Devices which MINIMALLY support accounts are not required to lock based on unsuccessful logon attempts.

3.1.2.2 Devices FULLY Supporting Accounts

Devices which FULLY support accounts must meet the following requirements. If a device cannot meet these requirements, document device

SECTION 25 05 11.00 Page 13 capabilities to protect from subsequent unsuccessful logon attempts and propose alternate protections in a Device Account Lock Exception Request submittal. Do not implement alternate protection measures without explicit permission from the Government.

a. It must lock the user account when three unsuccessful logon attempts occur within a 15 minute interval.

b. Once an account is locked, the account must stay locked until unlocked by an administrator.

c. Once the indicated number of unsuccessful logon attempts occurs, delay further logon prompts by 5 seconds.

3.1.2.3 High Availability Interfaces Exempt from Unsuccessful Logon Attempts Requirements

There are no high availability interfaces which are exempt from unsuccessful logon attempts requirements.

3.1.3 System Use Notification

{For Reference Only: This subpart (and its subparts) relates to AC-8;

CCI-000048, CCI-002247, CCI-002243, CCI-002244, CCI-002245, CCI-002246,

CCI-000050, CCI-002248}

Web interfaces must display a warning banner meeting the requirements of

DTM 08-060 .

Devices which are connected to a network and have a user interface must display a warning banner meeting the requirements of DTM 08-060 if capable of doing so. Devices which are connected to a network and have a user interface but are not capable of displaying a banner must have a permanently affixed label displaying an approved banner from DTM 08-060 .Labels must be machine printed or engraved, plastic or metal, designed for permanent installation, must use a font no smaller than 14 point, and must provide a high contract between font and background colors.

3.1.3.1 User Interface Banner Schedule

Provide a User Interface Schedule using the format indicated showing each user interface provided and how the information banner requirement has been implemented for each user interface.

User I nt er f ace Schedul e For mat ( wi t h sampl e ent r i es)

User I nt er f ace Description

User I nt er f ace Location

Type of User Interface

Banner I mpl ement at i on

Sample 1 Room 1 Remote DTM 08-060 Banner "A" Displayed at Logon

Sample 2 Room 2 Limited Local DTM 08-060 Banner "B" on Affixed Label

SECTION 25 05 11.00 Page 14

User I nt er f ace Schedul e For mat ( wi t h sampl e ent r i es)

User I nt er f ace Description

User I nt er f ace Location

Type of User Interface

Banner I mpl ement at i on

Sample 3 Room 3 Full Local DTM 08-060 Banner "B" Displayed on Screen

3.1.4 Permitted Actions Without Identification or Authentication

{For Reference Only: This subpart (and its subparts) relates to AC-14;

CCI-000061, CCI-000232}

The control system must require identification and authentication before allowing any actions by a user acting from a user interface which MINIMALLY or FULLY supports accounts.

3.1.5 Wireless Access

{For Reference Only: This subpart (and its subparts) relates to AC-18;

CCI-001438, CCI-001439, CCI-002323, CCI-001441}

Wireless networking is not authorized for this project. Do not use any wireless communication. Any device with wireless communication capability is considered to be using wireless communication, regardless of whether or not the device is actively communicating wirelessly, except when wireless communication has been physically permanently disabled (such as through the removal of the wireless transceiver).

3.1.5.1 Wireless IP Communications

Do not install wireless IP networks, including: do not install a wireless access point; do not install or configure an ad-hoc wireless network; do not install or configure a WiFi Direct communication.

3.1.5.2 Non-IP Wireless Communication

Non-IP Wireless networking is not authorized for this project.

3.2 CYBERSECURITY AUDITING

3.2.1 Audit Events, Content of Audit Records, and Audit Generation

{For Reference Only: This subpart (and its subparts) relates to AU-2(a),(c),(d), AU-3, AU-12; CCI-000123, CCI-001571, CCI-000125, CCI-001485, CCI-000130, CCI-000131, CCI-000132, CCI-00133, CCI-000134, CCI-001487, CCI-000169, CCI-001459, CCI-000171, CCI-000172, CCI-001910}

For devices that have STIG/SRGs related to audit events, content of audit records or audit generation, comply with the requirements of those STIG/SRGs.

3.2.1.1 Computers

Computer systems are existing. Currently configured auditing will be maintained. No additional requirements.

SECTION 25 05 11.00 Page 15

3.2.1.2 For HVAC Control System Devices

3.2.1.2.1 HVAC Control System Devices FULLY Supporting User Accounts

For devices FULLY supporting accounts, provide the capability to select audited events, and the contents of audit logs. Configure devices to audit the following events:

a. Successful and unsuccessful logon attempts to the device

b. Starting and ending time for user access to the device

c. All account creations, modifications, disabling, and terminations

d. All device shutdown and startup

Configure the device to record for each event the following information (as applicable): the type of event, when the event occurred and the identity of any individuals or subjects associated with the event

3.2.1.2.2 Other HVAC Control System Devices

There are no requirements to perform auditing at HVAC field devices that do not FULLY support accounts.

3.2.1.3 BLS Control System Devices

3.2.1.3.1 BLS Control System Devices FULLY Supporting Accounts

For devices FULLY supporting accounts, provide the capability to select audited events, and the contents of audit logs. Configure devices to audit the following events:

a. Successful and unsuccessful logon attempts to the device

b. Starting and ending time for user access to the device

c. All account creations, modifications, disabling, and terminations

d. All device shutdown and startup

Configure the device to record for each event the following information (as applicable): the type of event, when the event occurred and the identity of any individuals or subjects associated with the event

3.2.1.3.1.1 Other BLS Control System Devices

There are no requirements to perform auditing at BLS field devices that do not FULLY support accounts.

3.2.1.4 Default Requirements for Control System Devices

For control system devices where Audit Events, Content of Audit Records, and Audit Generation are not otherwise indicated in this Section:

3.2.1.4.1 Devices Which FULLY Support Accounts

For each device which FULLY supports accounts, provide the capability to select audited events and the content of audit logs. Configure devices to

SECTION 25 05 11.00 Page 16 audit the indicated events, and to record the indicated information for each auditable event

3.2.1.4.1.1 Audited Events

Configure each device to audit the following events:

a. Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g. classification levels)

b. Successful and unsuccessful logon attempts

c. Privileged activities or other system level access

d. Starting and ending time for user access to the system

e. Concurrent logons from different workstations

f. All account creations, modifications, disabling, and terminations

g. All kernel module load, unload, and restart

3.2.1.4.1.2 Audit Event Information To Record

Configure each device to record, for each auditable event, the following information (where applicable to the event):

a. what type of event occurred

b. when the event occurred

c. where the event occurred

d. the source of the event

e. the outcome of the event

f. the identity of any individuals or subjects associated with the event

3.2.1.4.2 Devices Which Do Not FULLY Support Accounts

For each Device which does not FULLY support accounts configure the device to audit all device shutdown and startup events and to record for each event the type of event and when the event occurred.

3.2.2 Audit Storage Capacity and Audit Upload

{For Reference Only: This subpart (and its subparts) relates to AU-4;

CCI-001848, CCI-001849}

a. For devices that have STIG/SRGs related to audit storage capacity (CCI-001848 or CCI-001849) comply with the requirements of those STIG/SRGs.

b. For non-computer control system devices capable of generating audit records, provide 60 days worth of secure local storage, assuming 10 auditable events per day.

SECTION 25 05 11.00 Page 17

3.2.2.1 Device Audit Record Upload Software

For each non-computer device required to audit events, provide, and license to the Government, software implementing a secure mechanism of uploading audit records from the device to a computer and of exporting the uploaded audit records as a Microsoft Excel file or comma separated value text file. Where different devices use different software, provide software of each type required to upload audit logs from all devices.

Submit copies of device audit record upload software. If there are no non-computer devices requiring auditing, provide a document stating this in lieu of this submittal.

3.2.3 Response to Audit Processing Failures

{For Reference Only: This subpart (and its subparts) relates to AU-5;

CCI-000139, CCI-000140, CCI-001490}.

Front end computers associated with auditing must, in the case of a failure in the auditing system, continue to notify per the existing strategy.

3.2.4 Time Stamps

{For Reference Only: This subpart (and its subparts) relates to AU-8;

CCI-000159, CCI-001889, CCI-001890}

3.2.4.1 For HVAC Control System Devices

Time stamp requirements for HVAC Control Systems are as indicated in the HVAC Control System specifications.

3.2.4.2 BLS Control System Devices

Time stamp requirements for BLS Control Systems are as indicated in the Lighting Control System specifications.

3.2.4.3 Default Requirements for Control System Devices

For control system devices where Time Stamps requirements are not otherwise indicated in this Section: Devices generating audit records must have internal clocks capable of providing time with a resolution of 1 second. Clocks must not drift more than 10 seconds per day. Configure the system so that each device generating audit records maintains accurate time to within 1 second.

3.3 REQUIREMENTS FOR LEAST FUNCTIONALITY

{For Reference Only: This subpart (and its subparts), along with the network communication report submittal specified elsewhere in this section, relates to CM-6 (a), (c), CM-7, CM-7 (1)(b), SC-41; CCI-000363, CCI-000364, CCI-000365, CCI-001588, CCI-001755, CCI-000381, CCI-000380, CCI-00382, CCI-001761, CCI-001762, CCI-002544, CCI-002545, CCI-002546.}

For devices that have a STIG or SRG related to Requirements for Least Functionality (such as configuration settings and port and device I/O access for least functionality), install and configure the device in accordance with that STIG or SRGs.

SECTION 25 05 11.00 Page 18

For HVAC Control Systems: Do not provide devices with user interfaces where one was not required. Do not use a networked sensor or actuator where a non-networked sensor or actuator would suffice.

For BLS Control Systems: Do not provide devices with user interfaces where one was not required. Do not use a networked sensor or actuator where a non-networked sensor or actuator would suffice.

For Other Control Systems: Do not provide devices with user interfaces where one was not required. Do not use a networked sensor or actuator where a non-networked sensor or actuator would suffice.

3.3.1 Non-IP Control Networks

When control system specifications require particular communication protocols, use only those communication protocols and only as specified.

Do not implement any other communication protocol, or use any protocol on ports other than those specified.

When control system specifications do not indicate requirements for communication protocols, use only those protocols required for operation of the system as specified.

3.3.1.1 Allowable Non-IP Control Protocols

3.3.1.1.1 BACnet MS/TP

For device communications in a serial multi-drop configuration. Refer to section 23 09 23.02 BACNET Direct DIGITAL CONTROL FOR HVAC AND OTHER

BUILDING CONTROL SYSTEMS.

3.3.1.1.2 Modbus RTU

For device communications in a serial multi-drop configuration.

3.3.1.1.3 Serial RS-232 and USB

For device configuration and troubleshooting only. That are allowable in a point-to-point configuration only.

3.3.1.1.4 Quantum QS Link

For building lighting device communications in a serial multi-drop configuration.

3.3.1.1.5 DALI (IEC 62386)

For building lighting device communications in a serial multi-drop configuration.

3.3.2 IP Control Networks

Do not use nonsecure functions, ports, protocols and services as defined in DODI 8551.01 unless those ports, protocols and services are specifically required by the control system specifications or otherwise…