VOL2.PDF

VOLUME 2 OF 2

THIS PROJECT IS ADVERTISED ON AN UNRESTRICTED BASIS

SOLICITATION NO: W9127821R0028

CADD NO: MBY20001

SPECIFICATIONS

FOR

7.5MW RICE GENERATOR AND MICRO GRID CONTROLS

ANNISTON ARMY DEPOT, ALABAMA

(CALHOUN COUNTY)

“GOOD ENGINEERING RESULTS IN A BETTER ENVIRONMENT”

U.S. ARMY ENGINEER DISTRICT, MOBILE

109 St. Joseph St

Mobile, Alabama 36602

This page was intentionally left blank for duplex printing.

7.5MW RICE GENERATOR AND MICRO GRID CONTROLS W9127821R0028

ANNISTON ARMY DEPOT, ALABAMA MBY20001

Table of Contents Page 1

TABLE OF CONTENTS

VOLUME 1 OF 2

CHECKLIST FOR PREPARATION OF OFFERS

BIDDING REQUIREMENTS

STANDARD FORM 1442 - SOLICITATION, OFFER, AND AWARD

BIDDING SCHEDULE

EXPLANATION OF BID ITEMS

STANDARD FORM 24 - BID BOND

STANDARD FORM 28 - AFFIDAVIT OF INDIVIDUAL SURETY

STANDARD FORM LLL - DISCLOSURE OF LOBBYING ACTIVITIES

00 11 00 PROPOSAL SUBMISSION REQUIREMENTS AND INSTRUCTIONS

00 12 00 EVALUATION CRITERIA AND BASIS OF AWARD

00 21 16 INSTRUCTIONS TO PROPOSERS

00 45 00 REPRESENTATIONS & CERTIFICATIONS

00 70 00 SPECIAL CONTRACT REQUIREMENTS

SPECIFICATIONS

DIVISION 01 - GENERAL REQUIREMENTS

01 00 00 ADDITIONAL SPECIAL CONTRACT REQUIREMENTS

PROJECT SIGNS

DD FORM 1354

DD FORM 1354 CHECKLIST

WAGE RATES

CESAM FORM 1151, PROMPT PAYMENT CERTIFICATION AND

SUPPORTING DATA FOR CONTRACTOR PROGRESS PAYMENT INVOICE

01 32 01.00 10 PROJECT SCHEDULE

01 33 00 SUBMITTAL PROCEDURES

SUBMITTAL REGISTER

FORM 4025

01 33 29 SUSTAINABILITY REPORTING

01 35 26 GOVERNMENTAL SAFETY REQUIREMENTS

01 42 00 SOURCES FOR REFERENCE PUBLICATIONS

01 45 00.00 10 QUALITY CONTROL

01 45 00.15 10 RESIDENT MANAGEMENT SYSTEM CONTRACTOR MODE (RMS CM)

SAM FORM 696

01 50 00 TEMPORARY CONSTRUCTION FACILITES AND CONTROLS

01 57 19 TEMPORARY ENVIRONMENTAL CONTROLS

01 74 19 CONSTRUCTION WASTE MANAGEMENT AND DISPOSAL

01 78 23 OPERATION AND MAINTENANCE DATA

01 91 00.15 10 TOTAL BUILDING AND MICROGRID COMMISSIONING

DIVISION 03 – CONCRETE

03 30 00 CAST-IN-PLACE CONCRETE

03 30 53 MISCELLANEOUS CAST-IN-PLACE CONCRETE

DIVISION 05 – METALS

05 50 13 MISCELLANEOUS METAL FABRICATIONS

Table of Contents Page 2

DIVISION 07 - THERMAL AND MOISTURE PROTECTION

07 41 63 FABRICATED ROOF PANEL ASSEMBLIES

07 42 63 FABRICATED WALL PANEL ASSEMBLIES

07 92 00 JOINT SEALANTS

DIVISION 08 – OPENINGS

08 11 13 STEEL DOORS AND FRAMES

08 33 23 OVERHEAD COILING DOORS

08 71 00 DOOR HARDWARE

08 81 00 GLAZING

DIVISION 09 – FINISHES

09 06 00 SCHEDULES FOR FINISHES

09 22 00 SUPPORTS FOR PLASTER AND GYPSUM BOARD

09 29 00 GYPSUM BOARD

09 65 00 RESILIENT FLOORING

09 90 00 PAINTS AND COATINGS

DIVISION 10 – SPECIALTIES

10 14 00.10 EXTERIOR SIGNAGE

10 44 16 FIRE EXTINGUISHERS

DIVISION 13 – SPECIAL CONSTRUCTION

13 34 19 METAL BUILDING SYSTEMS

DIVISION 22 – PLUMBING

22 00 00 PLUMBING, GENERAL PURPOSE

DIVISION 23 – HEATING, VENTILATING, AND AIR CONDITIONING (HVAC)

23 00 00 AIR SUPPLY, DISTRIBUTION, VENTILATION, AND EXHAUST SYSTEMS

23 03 00.00 20 BASIC MECHANICAL MATERIALS AND METHODS

23 05 93 TESTING, ADJUSTING, AND BALANCING FOR HVAC

23 07 00 THERMAL INSULATION FOR MECHANICAL ROOMS

23 09 00 INSTRUMENTATION AND CONTROL FOR HVAC

23 09 23.02 BACNET DIRECT DIGITAL CONTROL FOR HVAC AND OTHER BUILDING

CONTROL SYSTEMS

23 11 25 FACILITY GAS PIPING

23 81 00 DECENTRALIZED UNITARY HVAC EQUIPMENT

VOLUME 2 OF 2

DIVISION 25 – INTEGRATED AUTOMATION

25 05 11.00 CYBERSECURITY FOR FACILITY-RELATED CONTROL SYSTEMS – IDS

25 05 11 CYBERSECURITY FOR FACILITY-RELATED CONTROL SYSTEMS – HVAC

25 08 10 UTILITY MONITORING AND CONTROL SYSTEM TESTING

25 10 10 UTILITY MONITORING AND CONTROL SYSTEM (UMCS) FRONT END AND

INTEGRATION

Table of Contents Page 3

DIVISION 26 – ELECTRICAL

26 00 00.00 20 BASIC ELECTRICAL MATERIALS AND METHODS

26 08 00 APPARATUS INSPECTION AND TESTING

26 11 14.00 10 MAIN ELECTRIC SUPPLY STATION AND SUBSTATION

26 12 19.10 THREE-PHASE, LIQUID-FILLED PAD-MOUNTED TRANSFORMERS

26 20 00 INTERIOR DISTRIBUTION SYSTEM

26 28 01.00 10 COORDINATED POWER SYSTEM PROTECTION AND MICROGRID

CONTROLLER

26 32 15.00 ENGINE-GENERATOR SET STATIONARY 15-2500 KW, WITH

AUXILIARIES

26 36 23.00 20 AUTOMATIC TRANSFER SWITCHES

26 41 00 LIGHTNING PROTECTION SYSTEM

26 51 00 INTERIOR LIGHTING

26 56 00 EXTERIOR LIGHTING

DIVISION 27 – COMMUNICATIONS

27 10 00 BUILDING TELECOMMUNICATIONS CABLING SYSTEM

27 21 10.00 40 FIBER OPTIC DATA TRANSMISSION SYSTEM

DIVISION 28 – ELECTRONIC SAFETY AND SECURITY

28 10 05 ELECTRONIC SECURITY SYSTEMS (ESS)

28 31 00.00 10 FIRE DETECTION AND ALARM SYSTEM, DIRECT CURRENT LOOP

DIVISION 31 – EARTHWORK

31 00 00 EARTHWORK

31 11 00 CLEARING AND GRUBBING

DIVISION 32 – EXTERIOR IMPROVEMENTS

32 01 19.61 SEALING OF JOINTS IN RIGID PAVEMENT

32 05 33 LANDSCAPE ESTABLISHMENT

32 11 23 GRADED – CRUSHED AGGREGATE BASE COURSES

32 12 16 HOT-MIX ASPHALT (HMA) FOR ROADS

32 13 13.06 PORTLAND CEMENT CONCRETE PAVEMENT FOR ROADS AND SITE

FACILITIES

32 15 00 AGGREGATE SURFACING

32 16 19 CONCRETE CURBS, GUTTERS AND SIDEWALKS

32 17 23 PAVEMENT MARKINGS

32 31 13.53 HIGH-SECURITY FENCES (CHAIN LINK) AND GATES

32 92 19 SEEDING

32 92 23 SODDING

DIVISION 33 – UTILITIES

33 11 00 WATER UTILITY DISTRIBUTION PIPING

33 40 00 STORM DRAINAGE UTILITIES

33 71 01 OVERHEAD TRANSMISSION AND DISTRIBUTION

33 71 02 UNDERGROUND ELECTRICAL DISTRIBUTION

33 82 00 TELECOMMUNICATIONS OUTSIDE PLANT (OSP)

Table of Contents Page 4

APPENDICES

APPENDIX A GEOTECHNICAL REPORT

APPENDIX B NICHOLS INDUSTRIAL AREA FIRE HYDRANT FLOW TEST

--End of Project Table of Contents--

SECTION 25 05 11.00

CYBERSECURITY FOR FACILITY-RELATED CONTROL SYSTEMS - IDS

11/17

PART 1 GENERAL

Many subparts in this Section contain text in curly braces ("{" and "}") indicating which cybersecurity control and control correlation identifier (CCI) the requirements of the subpart relate to. The text inside these curly braces is for Government reference only, and enables coordination of the requirements of this Section with the RMF process throughout the design and construction process. Text in curly braces are not contractor requirements.

This Section refers to Security Requirements Guide (SRGs) and Security Technical Implementation Guide (STIGs). STIGs and SRGs are are available online at the Information Assurance Support Environment (IASE) website at http://iase.disa.mil/stigs/Pages/index.aspx . Not all control system components have applicable STIGs or SRGs.

1.1 CONTROL SYSTEM APPLICABILITY

There are multiple versions of this Section associated with this project.

Different versions have requirements applicable to different control systems. This specific Section applies only to the following control systems: IDS.

1.2 RELATED REQUIREMENTS

All Sections containing facility-related control systems or control system components are related to the requirements of this Section. Review all specification sections to determine related requirements.

1.3 REFERENCES

The publications listed below form a part of this specification to the extent referenced. The publications are referred to within the text by the basic designation only.

U.S. DEPARTMENT OF DEFENSE (DOD)

DTM 08-060 (2008) Policy on Use of Department of Defense (DoD) Information Systems - Standard Consent Banner and User Agreement

1.4 DEFINITIONS

1.4.1 Computer

As used in this Section, a computer is one of the following:

a. a device running a non-embedded desktop or server version of Microsoft Windows

b. a device running a non-embedded version of MacOS

c. a device running a non-embedded version of Linux

SECTION 25 05 11.00 Page 1

d. a device running a version or derivative of the Android OS, where Android is considered separate from Linux

e. a device running a version of Apple iOS

1.4.2 Network Connected

A component is network connected (or "connected to a network") only when the device has a network transceiver which is directly connected to the network and implements the network protocol. A device lacking a network transceiver (and accompanying protocol implementation) can never be considered network connected. Note that a device connected to a non-IP network is still considered network connected (an IP connection or IP address is not required for a device to be network connected).

1.4.3 User Account Support Levels

The support for user accounts is categorized in this Section as one of three levels:

1.4.3.1 FULLY Supported

Device supports configurable individual accounts. Accounts can be created, deleted, modified, etc. Privileges can be assigned to accounts.

1.4.3.2 MINIMALLY Supported

Device supports a small, fixed number of accounts (perhaps only one).

Accounts cannot be modified. A device with only a "User" and an "Administrator" account would fit this category. Similarly, a device with two PINs for logon - one for restricted and one for unrestricted rights would fit here (in other words, the accounts do not have to be the traditional "user name and password" structure).

1.4.3.3 NOT Supported

Device does not support any Access Enforcement therefore the whole concept of "account" is meaningless.

1.4.4 User Interface

Generally, a user interface is hardware on a device allowing user interaction with that device via input (buttons, switches, sliders, keyboard, touch screen, etc.) and a screen. There are three types of user interfaces defined in this Section: Limited Local User Interface, Full Local User Interface and Remote User Interface. In this Section, when the term "User Interface" is used without specifying which type, it refers only to Full Local User Interface and Remote User Interface (NOT to Limited Local User Interface).

1.4.4.1 Limited Local User Interface

A Limited Local User Interface is a user interface where the interaction is limited, fixed at the factory, and cannot be modified in the field.

The user must be physically at the device to interact with it.

SECTION 25 05 11.00 Page 2

1.4.4.2 Full Local User Interface

A Full Local User Interface is a user interface where the interaction and displays are field-configurable.

1.4.4.3 Remote User Interface

A Remote User Interface is a user interface on a Client device allowing user interaction with a different Server device. The user need not be physically at the Server device to interact with it.

1.5 ADMINISTRATIVE REQUIREMENTS

1.5.1 Coordination

Coordinate the execution of this Section with the execution of all other Sections related to control systems as indicated in the paragraph RELATED

REQUIREMENTS.

1.6 SUBMITTALS

Government approval is required for submittals with a "G" designation;

submittals not having a "G" designation are for information only. When used, a designation following the "G" designation identifies the office that will review the submittal for the Government. Submit the following in accordance with Section 01 33 00 SUBMITTAL PROCEDURES:

SD-01 Preconstruction Submittals

Contractor Computer Cybersecurity Compliance Statements; G , RO

SD-02 Shop Drawings

User Interface Banner Schedule; G , RO

Network Communication Report; G , RO

Cybersecurity Riser Diagram; G , RO

Control System Inventory Report; G , RO

SD-07 Certificates

Software Licenses; G , RO

1.7 CYBERSECURITY DOCUMENTATION

1.7.1 Network Communication Report

{For Reference Only: This subpart (and its subparts) relates to CA-9;

CCI-002102, CCI-002103, CCI-002104, CCI-002105 and also the submittal requirements associated with CM-6, CM-7 and SC-41 }

Provide a network communication report. For each networked controller, document the communication characteristics of the controller including communication protocols, services used, and a general description of what information is communicated over the network. For each controller using IP, document all TCP and UDP ports used. If other control system Sections used on this project include submittals documenting this information, SECTION 25 05 11.00 Page 3 provide copies of those submittals to meet this requirement.

In addition to the requirements of Section 01 33 00 SUBMITTAL PROCEDURES, provide the Network Communication Report as an editable Microsoft Excel file.

1.7.2 Control System Inventory Report

{For Reference Only: This subpart (and its subparts) relates to CM-8(a), CP-12, SI-17, IA-3; CCI-000389, CCI-000392, CCI-000398, CCI-002855, CCI-002856, CCI-002857, CCI-002773, CCI-002774, CCI-002775, CCI-000777, CCI-000778, CCI-001958}

Provide a Control System Inventory report using the Inventory Spreadsheet listed under this Section at http://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/forms-graphics-tables documenting all networked devices, including network infrastructure devicesdevices, including networked devices, network infrastructure devices, non-networked devices, input devices (e.g. sensors) and output devices (e.g. actuators). For each device provide all applicable information for which there is a field on the spreadsheet in accordance with the instructions on the spreadsheet.

In addition to the requirements of Section 01 33 00 SUBMITTAL PROCEDURES, provide the Control System Inventory Report as an editable Microsoft Excel file.

1.7.3 Cybersecurity Riser Diagram

{For Reference Only: This subpart (and its subparts) relates to PL-2(a);

CCI-003051, CCI-003053}

Provide a cybersecurity riser diagram of the complete control system including all network and controller hardware. If the control system specifications require a riser diagram submittal, provide a copy of that submittal as the cybersecurity riser diagram. Otherwise, provide a riser diagram in one-line format.

1.8 SOFTWARE UPDATE LICENSING

{For Reference Only: This subpart (and its subparts) relates to SI-2 (a),(c); CCI-001227, CCI-002605}

In addition to all other licensing requirements, all software licensing must include licensing of the following software updates for a period of no less than 5 years:

a. Security and bug-fix patches issued by the software manufacturer.

b. Security patches to address any vulnerability identified in the National Vulnerability Database at http://nvd.nist.gov with a Common Vulnerability Scoring System (CVSS) severity rating of MEDIUM or higher.

Provide a single Software Licenses submittal with documentation of the software licenses for all software provided

SECTION 25 05 11.00 Page 4

1.9 CYBERSECURITY DURING CONSTRUCTION

{For Reference Only: This subpart (and its subparts) relates to AC-18, SA-3, CCI-00258}

In addition to the control system cybersecurity requirements indicated in this section, meet following requirement throughout the construction process.

1.9.1 Contractor Computer Equipment

Contractor owned computers may be used for construction. When used, contractor computers must meet the following requirements:

1.9.1.1 Operating System

The operating system must be an operating system currently supported by the manufacturer of the operating system. The operating system must be current on security patches and operating system manufacturer required updates.

1.9.1.2 Anti-Malware Software

The computer must run anti-malware software from a reputable software manufacturer. Anti-malware software must be a version currently supported by the software manufacturer, must be current on all patches and updates, and must use the latest definitions file. All computers used on this project must be scanned using the installed software at least once per day.

1.9.1.3 Passwords and Passphrases

The passwords and passphrases for all computers must be changed from their default values. Passwords must be a minimum of eight characters with a minimum of one uppercase letter, one lowercase letter, one number and one special character.

1.9.1.4 Contractor Computer Cybersecurity Compliance Statements

Provide a single submittal containing completed Contractor Computer Cybersecurity Compliance Statements for each company using contractor owned computers. Contractor Computer Cybersecurity Compliance Statements must use the template published at http://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/forms-graphics-tables Each Statement must be signed by a cybersecurity representative for the relevant company.

1.10 CYBERSECURITY DURING WARRANTY PERIOD

All work performed on the control system after acceptance must be performed using Government Furnished Equipment or equipment specifically and individually approved by the Government.

PART 2 PRODUCTS

(NOT USED)

SECTION 25 05 11.00 Page 5

PART 3 EXECUTION

3.1 ACCESS CONTROL REQUIREMENTS

3.1.1 User Accounts

3.1.1.1 Control System Devices

Devices with web interfaces must either FULLY support user accounts or have their web interface disabled. Field devices with full local user interfaces allowing modification of data must at least MINIMALLY support user accounts.

3.1.2 Unsuccessful Logon Attempts

3.1.2.1 High Availability Interfaces Exempt from Unsuccessful Logon Attempts Requirements

There are no high availability interfaces which are exempt from unsuccessful logon attempts requirements.

3.1.3 System Use Notification

{For Reference Only: This subpart (and its subparts) relates to AC-8;

CCI-000048, CCI-002247, CCI-002243, CCI-002244, CCI-002245, CCI-002246,

CCI-000050, CCI-002248}

Web interfaces must display a warning banner meeting the requirements of

DTM 08-060 .

Devices which are connected to a network and have a user interface must display a warning banner meeting the requirements of DTM 08-060 if capable of doing so. Devices which are connected to a network and have a user interface but are not capable of displaying a banner must have a permanently affixed label displaying an approved banner from DTM 08-060 .Labels must be machine printed or engraved, plastic or metal, designed for permanent installation, must use a font no smaller than 14 point, and must provide a high contract between font and background colors.

3.1.3.1 User Interface Banner Schedule

Provide a User Interface Schedule using the format indicated showing each user interface provided and how the information banner requirement has been implemented for each user interface.

User I nt er f ace Schedul e For mat ( wi t h sampl e ent r i es)

User I nt er f ace Description

User I nt er f ace Location

Type of User Interface

Banner I mpl ement at i on

Sample 1 Room 1 Remote DTM 08-060 Banner "A" Displayed at Logon

Sample 2 Room 2 Limited Local DTM 08-060 Banner "B" on Affixed Label

Sample 3 Room 3 Full Local DTM 08-060 Banner "B" Displayed on Screen

SECTION 25 05 11.00 Page 6

User I nt er f ace Schedul e For mat ( wi t h sampl e ent r i es)

User I nt er f ace Description

User I nt er f ace Location

Type of User Interface

Banner I mpl ement at i on

3.2 REQUIREMENTS FOR LEAST FUNCTIONALITY

{For Reference Only: This subpart (and its subparts), along with the network communication report submittal specified elsewhere in this section, relates to CM-6 (a), (c), CM-7, CM-7 (1)(b), SC-41; CCI-000363, CCI-000364, CCI-000365, CCI-001588, CCI-001755, CCI-000381, CCI-000380, CCI-00382, CCI-001761, CCI-001762, CCI-002544, CCI-002545, CCI-002546.}

For Other Control Systems: Do not provide devices with user interfaces where one was not required.

3.3 SYSTEM AND COMMUNICATION PROTECTION

3.3.1 Denial of Service Protection, Process Isolation and Boundary Protection

{For Reference Only: This subpart (and its subparts) relates to SC-5, SC-39, SC-7(a); CCI-001093, CCI-002385, CCI-002386, CCI-002430, CCI-001097}

To the greatest extent practical, implement control logic in non-computer hardware and without reliance on the network.

3.4 FIELD QUALITY CONTROL

3.4.1 Tests

In addition to testing and testing support required by other Sections, provide a minimum of 8 hours of technical support for cybersecurity testing of control systems.

-- End of Section --

SECTION 25 05 11.00 Page 7

This page was intentionally left blank for duplex printing.

SECTION 25 05 11

CYBERSECURITY FOR FACILITY-RELATED CONTROL SYSTEMS - HVAC

11/17

PART 1 GENERAL

Many subparts in this Section contain text in curly braces ("{" and "}") indicating which cybersecurity control and control correlation identifier (CCI) the requirements of the subpart relate to. The text inside these curly braces is for Government reference only, and enables coordination of the requirements of this Section with the RMF process throughout the design and construction process. Text in curly braces are not contractor requirements.

This Section refers to Security Requirements Guide (SRGs) and Security Technical Implementation Guide (STIGs). STIGs and SRGs are are available online at the Information Assurance Support Environment (IASE) website at http://iase.disa.mil/stigs/Pages/index.aspx . Not all control system components have applicable STIGs or SRGs.

1.1 CONTROL SYSTEM APPLICABILITY

There are multiple versions of this Section associated with this project.

Different versions have requirements applicable to different control systems. This specific Section applies only to the following control systems: Bacnet Direct Digital Control for HVAC.

1.2 RELATED REQUIREMENTS

All Sections containing facility-related control systems or control system components are related to the requirements of this Section. Review all specification sections to determine related requirements.

1.3 REFERENCES

The publications listed below form a part of this specification to the extent referenced. The publications are referred to within the text by the basic designation only.

AMERICAN SOCIETY OF HEATING, REFRIGERATING AND AIR-CONDITIONING

ENGINEERS (ASHRAE)

ASHRAE 135 (2016) BACnet—A Data Communication Protocol for Building Automation and Control Networks

INSTITUTE OF ELECTRICAL AND ELECTRONICS ENGINEERS (IEEE)

IEEE 802.1x (2010) Local and Metropolitan Area Networks - Port Based Network Access Control

U.S. DEPARTMENT OF DEFENSE (DOD)

DODI 8551.01 (2014) Ports, Protocols, and Services Management (PPSM)

SECTION 25 05 11 Page 1

DTM 08-060 (2008) Policy on Use of Department of Defense (DoD) Information Systems - Standard Consent Banner and User Agreement

1.4 DEFINITIONS

1.4.1 Network Connected

A component is network connected (or "connected to a network") only when the device has a network transceiver which is directly connected to the network and implements the network protocol. A device lacking a network transceiver (and accompanying protocol implementation) can never be considered network connected. Note that a device connected to a non-IP network is still considered network connected (an IP connection or IP address is not required for a device to be network connected).

1.4.2 User Account Support Levels

The support for user accounts is categorized in this Section as one of three levels:

1.4.2.1 FULLY Supported

Device supports configurable individual accounts. Accounts can be created, deleted, modified, etc. Privileges can be assigned to accounts.

1.4.2.2 MINIMALLY Supported

Device supports a small, fixed number of accounts (perhaps only one).

Accounts cannot be modified. A device with only a "User" and an "Administrator" account would fit this category. Similarly, a device with two PINs for logon - one for restricted and one for unrestricted rights would fit here (in other words, the accounts do not have to be the traditional "user name and password" structure).

1.4.2.3 NOT Supported

Device does not support any Access Enforcement therefore the whole concept of "account" is meaningless.

1.4.3 User Interface

Generally, a user interface is hardware on a device allowing user interaction with that device via input (buttons, switches, sliders, keyboard, touch screen, etc.) and a screen. There are three types of user interfaces defined in this Section: Limited Local User Interface, Full Local User Interface and Remote User Interface. In this Section, when the term "User Interface" is used without specifying which type, it refers only to Full Local User Interface and Remote User Interface (NOT to Limited Local User Interface).

1.4.3.1 Limited Local User Interface

A Limited Local User Interface is a user interface where the interaction is limited, fixed at the factory, and cannot be modified in the field.

The user must be physically at the device to interact with it.

Examples of Limited Local User Interface include thermostats (Space Sensor Modules as defined in Section 23 09 00 INSTRUMENTATION AND CONTROL FOR

SECTION 25 05 11 Page 2

HVAC).

1.4.3.2 Full Local User Interface

A Full Local User Interface is a user interface where the interaction and displays are field-configurable.

Examples of a Full Local User Interface include local applications on a computer and user interfaces to Variable Speed Drives .

1.4.3.3 Remote User Interface

A Remote User Interface is a user interface on a Client device allowing user interaction with a different Server device. The user need not be physically at the Server device to interact with it.

Examples of Remote User Interfaces include web browsers and Local Display Panels as defined in Section 23 09 00 INSTRUMENTATION AND CONTROL FOR HVAC .

1.5 SUBMITTALS

Government approval is required for submittals with a "G" designation;

submittals not having a "G" designation are for information only. When used, a designation following the "G" designation identifies the office that will review the submittal for the Government.Submittals with an "S" are for inclusion in the Sustainability eNotebook, in conformance with Section 01 33 29 SUSTAINABILITY REPORTING. Submit the following in accordance with Section 01 33 00 SUBMITTAL PROCEDURES:

SD-01 Preconstruction Submittals

Multiple IP Connection Device Request; G, RO

Contractor Computer Cybersecurity Compliance Statements; G, RO

SD-02 Shop Drawings

User Interface Banner Schedule; G, RO

Network Communication Report; G, RO

Cybersecurity Riser Diagram; G, RO

Control System Inventory Report; G, RO

SD-03 Product Data

Control System Cybersecurity Documentation

Password Summary Report; G, RO

Software Recovery And Reconstitution Images; G, RO

1.6 CYBERSECURITY DOCUMENTATION

1.6.1 Network Communication Report

{For Reference Only: This subpart (and its subparts) relates to CA-9;

CCI-002102, CCI-002103, CCI-002104, CCI-002105 and also the submittal

SECTION 25 05 11 Page 3 requirements associated with CM-6, CM-7 and SC-41)

Provide a network communication report. For each networked controller, document the communication characteristics of the controller including communication protocols, services used, and a general description of what information is communicated over the network. For each controller using IP, document all TCP and UDP ports used. If other control system Sections used on this project include submittals documenting this information, provide copies of those submittals to meet this requirement.

In addition to the requirements of Section 01 33 00 SUBMITTAL PROCEDURES, provide the Network Communication Report as an editable Microsoft Excel file.

1.6.2 Control System Inventory Report

{For Reference Only: This subpart (and its subparts) relates to CM-8(a), CP-12, SI-17, IA-3; CCI-000389, CCI-000392, CCI-000398, CCI-002855, CCI-002856, CCI-002857, CCI-002773, CCI-002774, CCI-002775, CCI-000777, CCI-000778, CCI-001958}

Provide a Control System Inventory report using the Inventory Spreadsheet listed under this Section at http://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/forms-graphics-tables documenting all devices, including networked devices, network infrastructure devices, non-networked devices, input devices (e.g.

sensors) and output devices (e.g. actuators). For each device provide all applicable information for which there is a field on the spreadsheet in accordance with the instructions on the spreadsheet.

In addition to the requirements of Section 01 33 00 SUBMITTAL PROCEDURES, provide the Control System Inventory Report as an editable Microsoft Excel file.

1.6.3 Software Recovery and Reconstitution Images

{For Reference Only: This subpart (and its subparts) relates to CP-10;

CCI-000550, CCI-000551, CCI-000552}

For each control device on which software is installed under this project, provide a recovery image of the final as-built control device. This image must allow for bare-metal restore such that restoration of the image is sufficient to restore system operation to the imaged state without the need for re-installation of software.

1.6.4 Cybersecurity Riser Diagram

{For Reference Only: This subpart (and its subparts) relates to PL-2(a);

CCI-003051, CCI-003053}

Provide a cybersecurity riser diagram of the complete control system including all network and controller hardware. If the control system specifications require a riser diagram submittal, provide a copy of that submittal as the cybersecurity riser diagram. Otherwise, provide a riser diagram in one-line format.

1.6.5 Control System Cybersecurity Documentation

This subpart (and its subparts) relates to SA-5 (a),(b),(c); CCIs:

SECTION 25 05 11 Page 4

CCI-003124, CCI-003125, CCI-003126, CCI-003127, CCI-003128, CCI-003129,

CCI-003130, CCI-003131}

Provide a Control System Cybersecurity Documentation submittal containing the indicated information for each device and software application.

1.6.5.1 For HVAC Control System Devices

1.6.5.1.1 HVAC Control System Devices FULLY Supporting User Accounts

For all HVAC Control System Devices which FULLY support user accounts, provide:

a. Documentation that describes secure configuration of the device {for reference only: relates to CCI-003124}

b. Documentation that describes secure operation of the device {for reference only: relates to CCI-003124}

c. Documentation that describes effective use and maintenance of security functions or mechanisms for the device {for reference only: relates to

CCI-003127}

d. Documentation that describes known vulnerabilities regarding configuration and use of administrative (i.e. privileged) functions for the device {for reference only: relates to CCI-003128}

e. Documentation that describes user-accessible security functions or mechanisms in the device and how to effectively use those security functions or mechanisms; or a specific indication that there are no user-accessible security functions or mechanisms in the device {for reference only: relates to CCI-003129}

f. Documentation that describes methods for user interaction which enables individuals to use the device in a more secure manner {for reference only: relates to CCI-003130}

1.6.5.1.2 All Other HVAC Control System Devices

For all HVAC Control System Devices which do not FULLY support user accounts, provide:

a. Documentation that describes secure configuration of the device; or a specific indication that there are no secure configuration steps that apply {for reference only: relates to CCI-003124}

b. Documentation that describes effective use and maintenance of security functions or mechanisms for the device; or a specific indication that there are no security functions or mechanisms in the device {for reference only: relates to CCI-003127}

c. For devices which include a user interface, documentation that describes methods for user interaction which enables individuals to use the device in a more secure manner {for reference only: relates to

CCI-003130}

1.7 CYBERSECURITY DURING CONSTRUCTION

{For Reference Only: This subpart (and its subparts) relates to AC-18, SECTION 25 05 11 Page 5

SA-3, CCI-00258}

In addition to the control system cybersecurity requirements indicated in this section, meet following requirement throughout the construction process.

1.7.1 Contractor Computer Equipment

Contractor owned computers may be used for construction. When used, contractor computers must meet the following requirements:

1.7.1.1 Operating System

The operating system must be an operating system currently supported by the manufacturer of the operating system. The operating system must be current on security patches and operating system manufacturer required updates.

1.7.1.2 Anti-Malware Software

The computer must run anti-malware software from a reputable software manufacturer. Anti-malware software must be a version currently supported by the software manufacturer, must be current on all patches and updates, and must use the latest definitions file. All computers used on this project must be scanned using the installed software at least once per day.

1.7.1.3 Passwords and Passphrases

The passwords and passphrases for all computers must be changed from their default values. Passwords must be a minimum of eight characters with a minimum of one uppercase letter, one lowercase letter, one number and one special character.

1.7.1.4 Contractor Computer Cybersecurity Compliance Statements

Provide a single submittal containing completed Contractor Computer Cybersecurity Compliance Statements for each company using contractor owned computers. Contractor Computer Cybersecurity Compliance Statements must use the template published at http://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/forms-graphics-tables Each Statement must be signed by a cybersecurity representative for the relevant company.

1.8 CYBERSECURITY DURING WARRANTY PERIOD

All work performed on the control system after acceptance must be performed using Government Furnished Equipment or equipment specifically and individually approved by the Government.

PART 2 PRODUCTS

(NOT USED)

SECTION 25 05 11 Page 6

PART 3 EXECUTION

3.1 ACCESS CONTROL REQUIREMENTS

3.1.1 User Accounts

3.1.1.1 Control System Devices

Devices with web interfaces must either FULLY support user accounts or have their web interface disabled. Field devices with full local user interfaces allowing modification of data must at least MINIMALLY support user accounts.

3.1.2 Unsuccessful Logon Attempts

3.1.2.1 High Availability Interfaces Exempt from Unsuccessful Logon Attempts Requirements

There are no high availability interfaces which are exempt from unsuccessful logon attempts requirements.

3.1.3 System Use Notification

{For Reference Only: This subpart (and its subparts) relates to AC-8;

CCI-000048, CCI-002247, CCI-002243, CCI-002244, CCI-002245, CCI-002246,

CCI-000050, CCI-002248}

Web interfaces must display a warning banner meeting the requirements of

DTM 08-060 .

Devices which are connected to a network and have a user interface must display a warning banner meeting the requirements of DTM 08-060 if capable of doing so. Devices which are connected to a network and have a user interface but are not capable of displaying a banner must have a permanently affixed label displaying an approved banner from DTM 08-060 .

Labels must be machine printed or engraved, plastic or metal, designed for permanent installation, must use a font no smaller than 14 point, and must provide a high contract between font and background colors.

3.1.3.1 User Interface Banner Schedule

Provide a User Interface Schedule using the format indicated showing each user interface provided and how the information banner requirement has been implemented for each user interface.

User I nt er f ace Schedul e For mat ( wi t h sampl e ent r i es)

User I nt er f ace Description

User I nt er f ace Location

Type of User Interface

Banner I mpl ement at i on

Sample 1 Room 1 Remote DTM 08-060 Banner "A" Displayed at Logon

Sample 2 Room 2 Limited Local DTM 08-060 Banner "B" on Affixed Label

Sample 3 Room 3 Full Local DTM 08-060 Banner "B" Displayed on Screen

SECTION 25 05 11 Page 7

User I nt er f ace Schedul e For mat ( wi t h sampl e ent r i es)

User I nt er f ace Description

User I nt er f ace Location

Type of User Interface

Banner I mpl ement at i on

3.2 REQUIREMENTS FOR LEAST FUNCTIONALITY

{For Reference Only: This subpart (and its subparts), along with the network communication report submittal specified elsewhere in this section, relates to CM-6 (a), (c), CM-7, CM-7 (1)(b), SC-41; CCI-000363, CCI-000364, CCI-000365, CCI-001588, CCI-001755, CCI-000381, CCI-000380, CCI-00382, CCI-001761, CCI-001762, CCI-002544, CCI-002545, CCI-002546.}

For HVAC Control Systems: Do not provide devices with user interfaces where one was not required. Do not use a networked sensor or actuator where a non-networked sensor or actuator would suffice.

3.2.1 Non-IP Control Networks

When control system specifications require particular communication protocols, use only those communication protocols and only as specified.

Do not implement any other communication protocol, or use any protocol on ports other than those specified.

When control system specifications do not indicate requirements for communication protocols, use only those protocols required for operation of the system as specified.

3.2.2 IP Control Networks

Do not use nonsecure functions, ports, protocols and services as defined in DODI 8551.01 unless those ports, protocols and services are specifically required by the control system specifications or otherwise specifically authorized by the Government. Do not use ports, protocols and services that are not specified in the control system specifications or required for operation of the control system.

3.3 IDENTIFICATION AND AUTHENTICATION

3.3.1 User Identification and Authentication

{For Reference Only: This subpart (and its subparts) relates to

IA-2,(1),(12); CCI-000764, CCI-000765, CCI-001953, CCI-001954}

a. Devices that FULLY support accounts must uniquely identify and authenticate organizational users.

b. Devices which allow network access to privileged accounts must implement multifactor authentication for network access to privileged accounts.

3.3.1.1 HVAC Control Systems Devices

Identification and Authentication for network access to privileged accounts must be implemented by either accepting and electronically verify

SECTION 25 05 11 Page 8

Personal Identity Verification (PIV) credentials or inheriting identification and authentication from the operating system.

3.3.2 Authenticator Management

3.3.2.1 Authentication Type

3.3.2.1.1 For HVAC Control System Devices

Unless otherwise indicated:

a. Software which FULLY supports accounts and which runs on a computer must use password-based authentication or hardware token-based authentication.

b. Other devices which FULLY support accounts must use password-based authentication.

c. Devices MINIMALLY supporting accounts must use password-based authentication.

3.3.2.2 Password-Based Authentication Requirements

3.3.2.2.1 Password Configuration and Reporting

For all devices with a password, change the password from the default password. Coordinate selection of passwords with Contracting Officer's Representative. Do not use the same password for more than one device unless specifically instructed to do so. Provide a Password Summary Report documenting the password for each device and describing the procedure to change the password for each device.

Do not provide the Password Summary Report in electronic format. Provide two hardcopies of the Password Summary Report, each copy in its own sealed envelope.

3.3.3 Authenticator Feedback

{For Reference Only: This subpart relates to IA-6; CCI-000206}

Devices must never show authentication information, including passwords, on a display. Devices that momentarily display a character as it is entered, and then obscure the character, are acceptable. For devices that have STIGs or SRGs related to obscuring of authenticator feedback (CCI-000206), comply with the requirements of those STIGS/SRGs.

3.3.4 Device Identification and Authentication

{For Reference Only: This subpart (and its subparts) relates to IA-3;

CCI-000777, CCI-000778, CCI-001958}

All computers must use IEEE 802.1x for authentication to the network. All web servers running on computers must use HTTPS and must implement HTTPS using web server certificates obtained from The Army.

3.3.4.1 For HVAC Control System Devices

Devices using Fox Protocol must use HTTPS using a web server certificate obtained from USACE. Devices using BACnet must support Network Security

SECTION 25 05 11 Page 9 as specified in Clause 24 of ASHRAE 135.

3.4 DURABILITY TO VULNERABILITY SCANNING

{For Reference Only: This subpart (and its subparts) relates to RA-5 (a),(b),(c),(d); CCI-001054, CCI-001055, CCI-0010156, CCI-001641, CCI-001643, CCI-001057, CCI-001058, CCI-001059}

All IP devices must be scannable, such that the device can be scanned by industry standard IP network scanning utilities without harm to the device, application, or functionality.

For control system devices other than computers:

3.4.1 HVAC Control System Devices Other Than Computers

HVAC control system devices other than computers are not required to respond to scans.

3.5 DEVICES WITH CONNECTION TO MULTIPLE IP NETWORKS

Except for Ethernet switches, do not use more than one physical connection to IP networks on the same device unless doing so is both required by the project specifications and the specific application is approved. If a device with multiple IP connections is required, provide a Multiple IP Connection Device Request using the Multiple IP Connection Device Request Schedule at http://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/forms-graphics-tables to request approval for each device.

3.6 SYSTEM AND COMMUNICATION PROTECTION

3.6.1 Denial of Service Protection, Process Isolation and Boundary Protection

{For Reference Only: This subpart (and its subparts) relates to SC-5, SC-39, SC-7(a); CCI-001093, CCI-002385, CCI-002386, CCI-002430, CCI-001097}

To the greatest extent practical, implement control logic in non-computer hardware and without reliance on the network.

3.7 FIELD QUALITY CONTROL

3.7.1 Tests

In addition to testing and testing support required by other Sections, provide a minimum of 8 hours of technical support for cybersecurity testing of control systems.

-- End of Section --

SECTION 25 05 11 Page 10

SECTION 25 08 10

UTILITY MONITORING AND CONTROL SYSTEM TESTING

04/06

PART 1 GENERAL

1.1 REFERENCES

The publications listed below form a part of this specification to the extent referenced. The publications are referred to within the text by the basic designation only.

CONSUMER TECHNOLOGY ASSOCIATION (CTA)

CTA CTA-709.1-D (2014) Control Network Protocol Specification

CTA CTA-709.3 (1999; R 2015) Free-Topology Twisted-Pair Channel Specification

CTA CTA-852-C (2014) Tunneling Device Area Network Protocols Over Internet Protocol Channels

1.2 DEFINITIONS

1.2.1 Algorithm

A set of well-defined rules or procedures for solving a problem or providing an output from a specific set of inputs.

1.2.2 Analog

A continuously varying signal value (temperature current, velocity, etc.).

1.2.3 Analog to Digital (A/D) Converter

An A/D converter is a circuit or device whose input is information in analog form and whose output is the same information in digital form.

1.2.4 CTA CTA-709.1-D

"Control Network Protocol Specification", Standard communication protocol for networked control systems that provides peer-to-peer communications.

1.2.5 Application Specific Controller

A device that is furnished with a pre-established built in application that is configurable but not re-programmable.

1.2.6 Architecture

Architecture is the general organization and structure of hardware and software.

SECTION 25 08 10 Page 1

1.2.7 Binary

A two-state system where an "ON" condition is represented by a high signal level and an "OFF" condition is represented by a low signal level.

1.2.8 Building Point of Connection (BPOC)

The point of connection between the UMCS network backbone and the building network backbone. The hardware at this location, which performs/provides the connection is referred to as the BPOC Hardware.

1.2.9 Control Wiring

This includes conduit, wire, and wiring devices to install complete HVAC control systems, including motor control circuits, interlocks, sensors, PE and EP switches, and like devices. This also includes all wiring from node to node, and nodes to all sensors and points defined in the I/O summary shown on drawings or specified herein, and required to execute the sequence of operation. Does not include line voltage power wiring.

1.2.10 Demand

The maximum rate of use of electrical energy averaged over a specific interval of time, usually expressed in kW.

1.2.11 Diagnostic Program

Machine-executable instructions used to detect and isolate system and component malfunctions.

1.2.12 Distributed Control

A system whereby all control processing is decentralized and independent of a central computer. In regards to a LonWorks based system, it also means where the control logic for a single piece of building level control resides in more than one controller (node).

1.2.13 Graphical User Interface (GUI)

Human-machine interfacing allows the operator to manage, command, monitor, and program the system.

1.2.14 Integration

Establishing communication between two or more systems to create a single system.

1.2.15 Interoperable

Two devices are interoperable if installed into the same system and they communicate with each other without the use of another device (such as a gateway).

1.2.16 Network

A system of distributed control units that are linked together on a communication bus. A network allows sharing of point information between all control units. Additionally, a network provides central monitoring and control of the entire system from any distributed control unit

SECTION 25 08 10 Page 2 location.

1.2.17 Network Configuration Tool

Software used to create and modify the control network database and configure controllers.

1.2.18 Node ID

A unique 48-bit node identification (ID) tag given to each node by Echelon Corporation.

1.2.19 Node

An intelligent LONWORKS(r) device with a node ID and communicates via CTA CTA-709.1-D and is connected to an CTA CTA-709.1-D network.

1.2.20 Operating System (OS)

Software which controls the execution of computer programs and which provides scheduling, debugging, input/output controls, accounting, compilation, storage assignment, data management, and related services.

1.2.21 Operator Workstation (OWS)

The OWS consists of a high-level processing desktop or laptop computer that provides a graphic user interface to network.

1.2.22 Peripheral

Input/Output (I/O) equipment used to communicate to and from the computer and make hard copies of system outputs and magnetic files.

1.2.23 Router

A device which routes messages destined for a node on another segment subnet or domain of the control network. The device controls message traffic based on node address and priority. Routers may also serve as communication links between powerline, twisted pair, fiber, coax, and RF media.

1.2.24 Standard Network Variable Type (SNVT)

A network variable of a standard format type used to define data information transmitted and receive by the individual nodes.

1.2.25 UMCS Network Media

Transmission equipment including cables and interface modules (excluding MODEMs) permitting transmission of digital information.

1.2.26 XIF

"External Interface File" contains the contents of the manufacturer's product documentation.

1.2.27 Gateway

A device that translates from one protocol to another. Gateways are also

SECTION 25 08 10 Page 3 called Communications Bridges or Protocol Translators.

1.3 SYSTEM DESCRIPTION

a. The purpose of this Specification is to define generic Factory, Performance Verification, and Endurance Test procedures for Utility Monitoring and Control Systems (UMCS) and building level DDC. These tests are to be used to assure that the physical and performance requirements of UMCS and building level DDC are tested, and that the test results are adequately documented. The Government will base certain contractual decisions on the results of these tests.

b. This document covers the factory, performance verification, and endurance test procedures for the Utility Monitoring and Control System (UMCS) and Direct Digital Control for HVAC. It has been written for a host based system where the LONWORKS(r) LNS database resides on the main computer (server) and communicates over the Ethernet (TCP/IP) connection to the field level controller nodes. The system shall be comprised of the server hardware and software, IP network hardware and software, and building point of connection (BPOC) hardware and software.

c. The contractor who provided building level DDC under Section 23 09 00 INSTRUMENTATION AND CONTROL FOR HVAC is responsible for testing the building level DDC. All control testing and controller tuning required under Section 23 09 00 shall be completed and approved before performing Performance Verification and Endurance Tests under this section.

d. The following UFGS: Section 25 10 10 UTILITY MONITORING AND CONTROL SYSTEM (UMCS) FRONT END AND INTEGRATION and Section 23 09 00 INSTRUMENTATION AND CONTROL FOR HVAC shall be part of the contract documents.

1.3.1 Factory Test

Conduct a factory test at a company site. Perform some of the basic functions of the UMCS and building level DDC, to assure that the performance requirements of the specifications are met.

1.3.2 Performance Verification and Endurance Test

a. Shall be conducted on hardware and software installed at the jobsite to assure that the physical and performance requirements of specifications are met. Tests on network media shall include all contractor furnished media and shall include at least one type of each device installed.

b. Shall be conducted under normal mode operation, unless otherwise indicated in the initial conditions description for each test. System normal mode describes a condition in which the system is performing its assigned tasks in accordance with the contract requirements.

c. Shall utilize the operator workstation (OWS) to issue commands or verify status data.

1.3.3 Test Equipment and Setup

All test equipment calibrations shall be traceable to NIST. The accuracy

SECTION 25 08 10 Page 4 of the test equipment and overall test method shall be at least twice the maximum accuracy required for the test. For example, if a temperature sensor has an accuracy of +1 degree F over the executed range, the test instrument used shall have an accuracy of at least +0.5 degree F or better. Provide all test equipment unless otherwise noted in the contract documents.

1.4 SUBMITTALS

Government approval is required for submittals with a "G" designation;

submittals not having a "G" designation are for information only. When used, a designation following the "G" designation identifies the office that will review the submittal for the Government.Submittals with an "S" are for inclusion in the Sustainability eNotebook, in conformance to Section 01 33 29 SUSTAINABILITY REPORTING. Submit the following in accordance with Section 01 33 00 SUBMITTAL PROCEDURES:

SD-01 Preconstruction Submittals

Factory Test; G, RO

SD-06 Test Reports

UMCS and Building Level DDC Testing Sequence

Performance Verification Test; G, RO

Endurance Testing

PART 2 PRODUCTS

Not Used

PART 3 EXECUTION

3.1 UMCS AND BUILDING LEVEL DDC TESTING SEQUENCE

Perform…