B3_W9126G19B0007_(Part_4_of_4).pdf

FY19 DLA Gener al Pur pose War ehouse RD19DLA

SECTI ON 25 05 11

CYBERSECURI TY FOR FACI LI TY- RELATED CONTROL SYSTEMS

PART 1 GENERAL

Many subpar t s i n t hi s Sect i on cont ai n t ext i n cur l y br aces ( " { " and " } " ) i ndi cat i ng whi ch cyber secur i t y cont r ol and cont r ol cor r el at i on i dent i f i er ( CCI ) t he r equi r ement s of t he subpar t r el at e t o. The t ext i nsi de t hese cur l y br aces i s f or Gover nment r ef er ence onl y, and enabl es coor di nat i on of t he r equi r ement s of t hi s Sect i on wi t h t he RMF pr ocess t hr oughout t he desi gn and const r uct i on pr ocess. Text i n cur l y br aces ar e not cont r act or requirements.

Thi s Sect i on r ef er s t o Secur i t y Requi r ement s Gui de ( SRGs) and Secur i t y Techni cal I mpl ement at i on Gui de ( STI Gs) . STI Gs and SRGs ar e ar e avai l abl e onl i ne at t he I nf or mat i on Assur ance Suppor t Envi r onment ( I ASE) websi t e at http://iase.disa.mil/stigs/Pages/index.aspx . Not al l cont r ol syst em component s have appl i cabl e STI Gs or SRGs.

1. 1 RELATED REQUI REMENTS

Al l Sect i ons cont ai ni ng f aci l i t y- r el at ed cont r ol syst ems or cont r ol syst em component s ar e r el at ed t o t he r equi r ement s of t hi s Sect i on. Revi ew al l speci f i cat i on sect i ons t o det er mi ne r el at ed r equi r ement s.

1. 2 REFERENCES

The publ i cat i ons l i s t ed bel ow f or m a par t of t hi s speci f i cat i on t o t he ext ent r ef er enced. The publ i cat i ons ar e r ef er r ed t o wi t hi n t he t ext by t he basi c desi gnat i on onl y.

I NSTI TUTE OF ELECTRI CAL AND ELECTRONI CS ENGI NEERS ( I EEE)

I EEE 802. 1x ( 2010) Local and Met r opol i t an Ar ea Net wor ks - Por t Based Net wor k Access Control

NATI ONAL I NSTI TUTE OF STANDARDS AND TECHNOLOGY ( NI ST)

NI ST FI PS 201- 2 ( 2013) Per sonal I dent i t y Ver i f i cat i on ( PI V) of Feder al Empl oyees and Cont r act or s

U. S. DEPARTMENT OF DEFENSE ( DOD)

DODI 8551. 01 ( 2014) Por t s, Pr ot ocol s, and Ser vi ces Management ( PPSM)

DTM 08- 060 ( 2008) Pol i cy on Use of Depar t ment of Def ense ( DoD) I nf or mat i on Syst ems - St andar d Consent Banner and User Agr eement

SECTI ON 25 05 11 Page 1

1. 3 DEFINITIONS

1. 3. 1 Computer

As used i n t hi s Sect i on, a comput er i s one of t he f ol l owi ng:

a. a devi ce r unni ng a non- embedded deskt op or ser ver ver si on of Mi cr osof t Windows

b. a devi ce r unni ng a non- embedded ver si on of MacOS

c. a devi ce r unni ng a non- embedded ver si on of Li nux

d. a devi ce r unni ng a ver si on or der i vat i ve of t he Andr oi d OS, wher e Andr oi d i s consi der ed separ at e f r om Li nux

e. a devi ce r unni ng a ver si on of Appl e i OS

1. 3. 2 Net wor k Connect ed

A component i s net wor k connect ed ( or " connect ed t o a net wor k" ) onl y when t he devi ce has a net wor k t r anscei ver whi ch i s di r ect l y connect ed t o t he net wor k and i mpl ement s t he net wor k pr ot ocol . A devi ce l acki ng a net wor k t r anscei ver ( and accompanyi ng pr ot ocol i mpl ement at i on) can never be consi der ed net wor k connect ed. Not e t hat a devi ce connect ed t o a non- I P net wor k i s st i l l consi der ed net wor k connect ed ( an I P connect i on or I P addr ess i s not r equi r ed f or a devi ce t o be net wor k connect ed) .

Any devi ce t hat suppor t s wi r el ess communi cat i on i s net wor k connect ed, r egar dl ess of whet her t he devi ce i s communi cat i ng usi ng wi r el ess.

1. 3. 3 User Account Suppor t Level s

The suppor t f or user account s i s cat egor i zed i n t hi s Sect i on as one of t hr ee l evel s:

1. 3. 3. 1 FULLY Suppor t ed

Devi ce suppor t s conf i gur abl e i ndi v i dual account s. Account s can be cr eat ed, del et ed, modi f i ed, et c. Pr i v i l eges can be assi gned t o account s.

1. 3. 3. 2 MI NI MALLY Suppor t ed

Devi ce suppor t s a smal l , f i xed number of account s ( per haps onl y one) .

Account s cannot be modi f i ed. A devi ce wi t h onl y a " User " and an " Admi ni st r at or " account woul d f i t t hi s cat egor y. Si mi l ar l y, a devi ce wi t h t wo PI Ns f or l ogon - one f or r est r i c t ed and one f or unr est r i c t ed r i ght s woul d f i t her e ( i n ot her wor ds, t he account s do not have t o be t he t r adi t i onal " user name and passwor d" st r uct ur e) .

1. 3. 3. 3 NOT Suppor t ed

Devi ce does not suppor t any Access Enf or cement t her ef or e t he whol e concept of " account " i s meani ngl ess.

1. 3. 4 User I nt er f ace

Gener al l y, a user i nt er f ace i s har dwar e on a devi ce al l owi ng user i nt er act i on wi t h t hat devi ce v i a i nput ( but t ons, swi t ches, s l i der s, SECTI ON 25 05 11 Page 2 keyboar d, t ouch scr een, et c. ) and a scr een. Ther e ar e t hr ee t ypes of user i nt er f aces def i ned i n t hi s Sect i on: Li mi t ed Local User I nt er f ace, Ful l Local User I nt er f ace and Remot e User I nt er f ace. I n t hi s Sect i on, when t he t er m " User I nt er f ace" i s used wi t hout speci f y i ng whi ch t ype, i t r ef er s onl y t o Ful l Local User I nt er f ace and Remot e User I nt er f ace ( NOT t o Li mi t ed Local User I nt er f ace) .

1. 3. 4. 1 Li mi t ed Local User I nt er f ace

A Li mi t ed Local User I nt er f ace i s a user i nt er f ace wher e t he i nt er act i on i s l i mi t ed, f i xed at t he f act or y, and cannot be modi f i ed i n t he f i el d. The user must be physi cal l y at t he devi ce t o i nt er act wi t h i t .

Exampl es of Li mi t ed Local User I nt er f ace i ncl ude t her most at s ( Space Sensor Modul es as def i ned i n Sect i on 23 09 13 I NSTRUMENTATI ON AND CONTROL DEVI CES

FOR HVAC) .

1. 3. 4. 2 Ful l Local User I nt er f ace

A Ful l Local User I nt er f ace i s a user i nt er f ace wher e t he i nt er act i on and di spl ays ar e f i el d- conf i gur abl e.

Exampl es of a Ful l Local User I nt er f ace i ncl ude l ocal appl i cat i ons on a computer and user i nt er f aces t o Var i abl e Speed Dr i ves.

1. 3. 4. 3 Remot e User I nt er f ace

A Remot e User I nt er f ace i s a user i nt er f ace on a Cl i ent devi ce al l owi ng user i nt er act i on wi t h a di f f er ent Ser ver devi ce. The user need not be physi cal l y at t he Ser ver devi ce t o i nt er act wi t h i t .

Exampl es of Remot e User I nt er f aces i ncl ude web br owser s and Local Di spl ay Panel s as def i ned i n Sect i on 23 09 00 I NSTRUMENTATI ON AND CONTROL FOR HVAC.

1. 4 ADMI NI STRATI VE REQUI REMENTS

1. 4. 1 Coordination

Coor di nat e t he execut i on of t hi s Sect i on wi t h t he execut i on of al l ot her Sect i ons r el at ed t o cont r ol syst ems as i ndi cat ed i n t he par agr aph RELATED REQUI REMENTS. I t ems t hat must be consi der ed when coor di nat i ng pr oj ect ef f or t s i ncl ude but ar e not l i mi t ed t o:

a. I f r equest i ng per mi ssi on f or wi r el ess communi cat i on, t he Wi r el ess Communi cat i on Request submi t t al must be appr oved pr i or t o cont r ol syst em devi ce sel ect i on and i nt egr at i on.

b. I f r equest i ng per mi ssi on f or al t er nat e account l ock per mi ssi ons, t he Devi ce Account Lock Except i on Request must be appr oved pr i or t o cont r ol syst em devi ce sel ect i on and i nt egr at i on.

c. I f r equest i ng per mi ssi on f or t he use of a devi ce wi t h mul t i pl e I P connect i ons, t he Mul t i pl e I P Connect i on Devi ce Request must be appr oved pr i or t o cont r ol syst em devi ce sel ect i on and i nt egr at i on.

d. Wi r el ess t est i ng may be r equi r ed as par t of t he cont r ol syst em t est i ng. See r equi r ement s f or t he Wi r el ess Communi cat i on Test Repor t submittal.

SECTI ON 25 05 11 Page 3

e. I f t he Devi ce Audi t Recor d Upl oad Sof t war e i s t o be i nst al l ed on a comput er not bei ng pr ovi ded as par t of t he cont r ol syst em, coor di nat i on i s r equi r ed t o i dent i f y t he comput er on whi ch t o i nst al l t he sof t war e.

f . Cyber secur i t y I nt er connect i on Schedul e must be coor di nat ed wi t h ot her wor k t hat wi l l be i nt er connect ed t o, and i nt er connect i ons must be appr oved by t he Gover nment bef or e r el y i ng on t hem f or syst em functionality.

g. Cyber secur i t y t est i ng suppor t must be coor di nat ed acr oss cont r ol syst ems and wi t h t he Gover nment cyber secur i t y t est i ng schedul e.

h. Passwor ds must be coor di nat ed wi t h t he i ndi cat ed cont act f or t he pr oj ect s i t e.

i . I f appl i cabl e, HTTP web ser ver cer t i f i cat es must be obt ai ned f r om t he i ndi cat ed cont act f or t he pr oj ect s i t e.

j . Cont r act or Comput er Cyber secur i t y Compl i ance St at ement s f or each cont r act or usi ng cont r act or owned comput er s.

1. 5 SUBMITTALS

Gover nment appr oval i s r equi r ed f or submi t t al s wi t h a " G" desi gnat i on;

submi t t al s not havi ng a " G" desi gnat i on ar e f or i nf or mat i on onl y. When used, a desi gnat i on f ol l owi ng t he " G" desi gnat i on i dent i f i es t he of f i ce t hat wi l l r evi ew t he submi t t al f or t he Gover nment . Submi t t al s wi t h an " S" ar e f or i ncl usi on i n t he Sust ai nabi l i t y eNot ebook, i n conf or mance wi t h Sect i on 01 33 29 SUSTAI NABI LI TY REPORTI NG. Submi t t he f ol l owi ng i n accor dance wi t h Sect i on 01 33 00 SUBMI TTAL PROCEDURES:

SD- 01 Pr econst r uct i on Submi t t al s

Wi r el ess Communi cat i on Request ;

Devi ce Account Lock Except i on Request ;

Mul t i pl e I P Connect i on Devi ce Request ;

Cont r act or Comput er Cyber secur i t y Compl i ance St at ement s;

Cont r act or Tempor ar y Net wor k Cyber secur i t y Compl i ance St at ement s;

SD- 02 Shop Dr awi ngs

User I nt er f ace Banner Schedul e;

Net wor k Communi cat i on Repor t ;

Cyber secur i t y Ri ser Di agr am;

Cont r ol Syst em I nvent or y Repor t ;

Cyber secur i t y I nt er connect i on Schedul e;

SD- 03 Pr oduct Dat a

Cont r ol Syst em Cyber secur i t y Document at i on;

SECTI ON 25 05 11 Page 4

SD- 06 Test Repor t s

Wi r el ess Communi cat i on Test Repor t ;

SD- 07 Cer t i f i cat es

Sof t war e Li censes;

SD- 11 Cl oseout Submi t t al s

Passwor d Summar y Repor t ;

Sof t war e Recover y And Reconst i t ut i on I mages;

Devi ce Audi t Recor d Upl oad Sof t war e;

1. 6 QUALI TY CONTROL

1. 7 CYBERSECURI TY DOCUMENTATI ON

1. 7. 1 Net wor k Communi cat i on Repor t

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o CA- 9;

CCI - 002102, CCI - 002103, CCI - 002104, CCI - 002105 and al so t he submi t t al r equi r ement s associ at ed wi t h CM- 6, CM- 7 and SC- 41}

Pr ovi de a net wor k communi cat i on r epor t . For each net wor ked cont r ol l er , document t he communi cat i on char act er i st i cs of t he cont r ol l er i ncl udi ng communi cat i on pr ot ocol s, ser vi ces used, and a gener al descr i pt i on of what i nf or mat i on i s communi cat ed over t he net wor k. For each cont r ol l er usi ng I P, document al l TCP and UDP por t s used. I f ot her cont r ol syst em Sect i ons used on t hi s pr oj ect i ncl ude submi t t al s document i ng t hi s i nf or mat i on, pr ovi de copi es of t hose submi t t al s t o meet t hi s r equi r ement .

I n addi t i on t o t he r equi r ement s of Sect i on 01 33 00 SUBMI TTAL PROCEDURES, pr ovi de t he Net wor k Communi cat i on Repor t as an edi t abl e Mi cr osof t Excel file.

1. 7. 2 Cont r ol Syst em I nvent or y Repor t

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o CM- 8( a) , CP- 12, SI - 17, I A- 3; CCI - 000389, CCI - 000392, CCI - 000398, CCI - 002855, CCI - 002856, CCI - 002857, CCI - 002773, CCI - 002774, CCI - 002775, CCI - 000777, CCI - 000778, CCI - 001958}

Pr ovi de a Cont r ol Syst em I nvent or y r epor t usi ng t he I nvent or y Spr eadsheet l i s t ed under t hi s Sect i on at ht t p: / / www. wbdg. or g/ FFC/ NAVGRAPH/ gr apht oc. pdf document i ng al l net wor ked devi ces, i ncl udi ng net wor k i nf r ast r uct ur e devi ces.

For each devi ce pr ovi de al l appl i cabl e i nf or mat i on f or whi ch t her e i s a f i el d on t he spr eadsheet i n accor dance wi t h t he i nst r uct i ons on t he spreadsheet.

I n addi t i on t o t he r equi r ement s of Sect i on 01 33 00 SUBMI TTAL PROCEDURES, pr ovi de t he Cont r ol Syst em I nvent or y Repor t as an edi t abl e Mi cr osof t Excel file.

SECTI ON 25 05 11 Page 5

1. 7. 3 Sof t war e Recover y and Reconst i t ut i on I mages

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o CP- 10;

CCI - 000550, CCI - 000551, CCI - 000552}

For each comput er on whi ch sof t war e i s i nst al l ed under t hi s pr oj ect , pr ovi de a r ecover y i mage of t he f i nal as- bui l t comput er . Thi s i mage must al l ow f or bar e- met al r est or e such t hat r est or at i on of t he i mage i s suf f i c i ent t o r est or e syst em oper at i on t o t he i maged st at e wi t hout t he need f or r e- i nst al l at i on of sof t war e.

1. 7. 4 Cyber secur i t y Ri ser Di agr am

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o PL- 2( a) ;

CCI - 003051, CCI - 003053}

Pr ovi de a cyber secur i t y r i ser di agr am of t he compl et e cont r ol syst em i ncl udi ng al l net wor k and cont r ol l er har dwar e. I f t he cont r ol syst em speci f i cat i ons r equi r e a r i ser di agr am submi t t al , pr ovi de a copy of t hat submi t t al as t he cyber secur i t y r i ser di agr am. Ot her wi se, pr ovi de a r i ser di agr am i n one- l i ne f or mat .

1. 7. 5 Cont r ol Syst em Cyber secur i t y Document at i on

Thi s subpar t ( and i t s subpar t s) r el at es t o SA- 5 ( a) , ( b) , ( c) ; CCI s:

CCI - 003124, CCI - 003125, CCI - 003126, CCI - 003127, CCI - 003128, CCI - 003129, CCI - 003130, CCI - 003131}

Pr ovi de a Cont r ol Syst em Cyber secur i t y Document at i on submi t t al cont ai ni ng t he i ndi cat ed i nf or mat i on f or each devi ce and sof t war e appl i cat i on.

1. 7. 5. 1 Sof t war e Appl i cat i ons

For al l sof t war e appl i cat i ons r unni ng on comput er s pr ovi de:

a. admi ni st r at or document at i on t hat descr i bes secur e conf i gur at i on of t he sof t war e { r el at es t o CCI - 003124}

b. admi ni st r at or document at i on t hat descr i bes secur e i nst al l at i on of t he sof t war e { r el at es t o CCI - 003125}

c. admi ni st r at or document at i on t hat descr i bes secur e oper at i on of t he sof t war e { r el at es t o CCI - 003124}

d. admi ni st r at or document at i on t hat descr i bes ef f ect i ve use and mai nt enance of secur i t y f unct i ons or mechani sms f or t he sof t war e { r el at es t o CCI - 003127}

e. admi ni st r at or document at i on t hat descr i bes known vul ner abi l i t i es r egar di ng conf i gur at i on and use of admi ni st r at i ve ( i . e. pr i v i l eged) f unct i ons f or t he sof t war e { r el at es t o CCI - 003128} f . user document at i on t hat descr i bes user - accessi bl e secur i t y f unct i ons or mechani sms i n t he sof t war e and how t o ef f ect i vel y use t hose secur i t y f unct i ons or mechani sms { r el at es t o CCI - 003129}

g. user document at i on t hat descr i bes met hods f or user i nt er act i on whi ch enabl es i ndi v i dual s t o use t he sof t war e i n a mor e secur e manner

SECTI ON 25 05 11 Page 6

{ r el at es t o CCI - 003130}

h. user document at i on t hat descr i bes user r esponsi bi l i t i es i n mai nt ai ni ng t he secur i t y of t he sof t war e { r el at es t o CCI - 003131}

1. 7. 5. 2 For HVAC Cont r ol Syst em Devi ces

1. 7. 5. 2. 1 HVAC Cont r ol Syst em Devi ces FULLY Suppor t i ng User Account s

For al l HVAC Cont r ol Syst em Devi ces whi ch FULLY suppor t user account s, provide:

a. Document at i on t hat descr i bes secur e conf i gur at i on of t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003124}

b. Document at i on t hat descr i bes secur e oper at i on of t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003124}

c. Document at i on t hat descr i bes ef f ect i ve use and mai nt enance of secur i t y f unct i ons or mechani sms f or t he devi ce { f or r ef er ence onl y: r el at es t o

CCI-003127}

d. Document at i on t hat descr i bes known vul ner abi l i t i es r egar di ng conf i gur at i on and use of admi ni st r at i ve ( i . e. pr i v i l eged) f unct i ons f or t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003128}

e. Document at i on t hat descr i bes user - accessi bl e secur i t y f unct i ons or mechani sms i n t he devi ce and how t o ef f ect i vel y use t hose secur i t y f unct i ons or mechani sms; or a speci f i c i ndi cat i on t hat t her e ar e no user - accessi bl e secur i t y f unct i ons or mechani sms i n t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003129} f . Document at i on t hat descr i bes met hods f or user i nt er act i on whi ch enabl es i ndi v i dual s t o use t he devi ce i n a mor e secur e manner { f or r ef er ence onl y: r el at es t o CCI - 003130}

1. 7. 5. 2. 2 Al l Ot her HVAC Cont r ol Syst em Devi ces

For al l HVAC Cont r ol Syst em Devi ces whi ch do not FULLY suppor t user account s, pr ovi de:

a. Document at i on t hat descr i bes secur e conf i gur at i on of t he devi ce; or a speci f i c i ndi cat i on t hat t her e ar e no secur e conf i gur at i on st eps t hat appl y { f or r ef er ence onl y: r el at es t o CCI - 003124}

b. Document at i on t hat descr i bes ef f ect i ve use and mai nt enance of secur i t y f unct i ons or mechani sms f or t he devi ce; or a speci f i c i ndi cat i on t hat t her e ar e no secur i t y f unct i ons or mechani sms i n t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003127}

c. For devi ces whi ch i ncl ude a user i nt er f ace, document at i on t hat descr i bes met hods f or user i nt er act i on whi ch enabl es i ndi v i dual s t o use t he devi ce i n a mor e secur e manner { f or r ef er ence onl y: r el at es t o

CCI-003130}

1. 7. 5. 3 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

For cont r ol syst em devi ces wher e Cont r ol Syst em Cyber secur i t y Document at i on r equi r ement s ar e not ot her wi se i ndi cat ed i n t hi s Sect i on, pr ovi de:

SECTI ON 25 05 11 Page 7

a. Document at i on t hat descr i bes secur e conf i gur at i on of t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003124}

b. Document at i on t hat descr i bes secur e i nst al l at i on of t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003125}

c. Document at i on t hat descr i bes secur e oper at i on of t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003124}

d. Document at i on t hat descr i bes ef f ect i ve use and mai nt enance of secur i t y f unct i ons or mechani sms f or t he devi ce { f or r ef er ence onl y: r el at es t o

CCI-003127}

e. Document at i on t hat descr i bes known vul ner abi l i t i es r egar di ng conf i gur at i on and use of admi ni st r at i ve ( i . e. pr i v i l eged) f unct i ons f or t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003128} f . Document at i on t hat descr i bes user - accessi bl e secur i t y f unct i ons or mechani sms i n t he devi ce and how t o ef f ect i vel y use t hose secur i t y f unct i ons or mechani sms { f or r ef er ence onl y: r el at es t o CCI - 003129}

g. Document at i on t hat descr i bes met hods f or user i nt er act i on whi ch enabl es i ndi v i dual s t o use t he devi ce i n a mor e secur e manner { f or r ef er ence onl y: r el at es t o CCI - 003130}

h. Document at i on t hat descr i bes user r esponsi bi l i t i es i n mai nt ai ni ng t he secur i t y of t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003131}

1. 8 SOFTWARE UPDATE LI CENSI NG

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o SI - 2 ( a) , ( c) ; CCI - 001227, CCI - 002605}

I n addi t i on t o al l ot her l i censi ng r equi r ement s, al l sof t war e l i censi ng must i ncl ude l i censi ng of t he f ol l owi ng sof t war e updat es f or a per i od of no l ess t han 5 year s:

a. Secur i t y and bug- f i x pat ches i ssued by t he sof t war e manuf act ur er .

b. Secur i t y pat ches t o addr ess any vul ner abi l i t y i dent i f i ed i n t he Nat i onal Vul ner abi l i t y Dat abase at http://nvd.nist.gov wi t h a Common Vul ner abi l i t y Scor i ng Syst em ( CVSS) sever i t y r at i ng of MEDI UM or hi gher .

Pr ovi de a s i ngl e Sof t war e Li censes submi t t al wi t h document at i on of t he sof t war e l i censes f or al l sof t war e pr ovi ded

1. 9 CYBERSECURI TY DURI NG CONSTRUCTI ON

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o AC- 18, SA- 3, CCI - 00258}

I n addi t i on t o t he cont r ol syst em cyber secur i t y r equi r ement s i ndi cat ed i n t hi s sect i on, meet f ol l owi ng r equi r ement t hr oughout t he const r uct i on process.

SECTI ON 25 05 11 Page 8

1. 9. 1 Cont r act or Comput er Equi pment

Cont r act or owned comput er s may be used f or const r uct i on. When used, cont r act or comput er s must meet t he f ol l owi ng r equi r ement s:

1. 9. 1. 1 Oper at i ng Syst em

The oper at i ng syst em must be an oper at i ng syst em cur r ent l y suppor t ed by t he manuf act ur er of t he oper at i ng syst em. The oper at i ng syst em must be cur r ent on secur i t y pat ches and oper at i ng syst em manuf act ur er r equi r ed updat es.

1. 9. 1. 2 Ant i - Mal war e Sof t war e

The comput er must r un ant i - mal war e sof t war e f r om a r eput abl e sof t war e manuf act ur er . Ant i - mal war e sof t war e must be a ver si on cur r ent l y suppor t ed by t he sof t war e manuf act ur er , must be cur r ent on al l pat ches and updat es, and must use t he l at est def i ni t i ons f i l e. Al l comput er s used on t hi s pr oj ect must be scanned usi ng t he i nst al l ed sof t war e at l east once per day.

1. 9. 1. 3 Passwor ds and Passphr ases

The passwor ds and passphr ases f or al l comput er s must be changed f r om t hei r def aul t val ues. Passwor ds must be a mi ni mum of ei ght char act er s wi t h a mi ni mum of one upper case l et t er , one l ower case l et t er , one number and one speci al char act er .

1. 9. 1. 4 Cont r act or Comput er Cyber secur i t y Compl i ance St at ement s

Pr ovi de a s i ngl e submi t t al cont ai ni ng compl et ed Cont r act or Comput er Cyber secur i t y Compl i ance St at ement s f or each company usi ng cont r act or owned comput er s. Cont r act or Comput er Cyber secur i t y Compl i ance St at ement s must use t he t empl at e publ i shed at http://www.wbdg.org/FFC/NAVGRAPH/graphtoc.pdf .

Each St at ement must be s i gned by a cyber secur i t y r epr esent at i ve f or t he r el evant company.

1. 9. 2 Tempor ar y I P Net wor ks

Tempor ar y cont r act or - i nst al l ed I P net wor ks may be used dur i ng const r uct i on.

When used, t empor ar y cont r act or - i nst al l ed I P net wor ks must meet t he f ol l owi ng r equi r ement s:

1. 9. 2. 1 Net wor k Boundar i es and Connect i ons

The net wor k must not ext end out s i de t he pr oj ect s i t e and must not connect t o any I P net wor k ot her t han I P net wor ks pr ovi ded under t hi s pr oj ect or Gover nment f ur ni shed I P net wor ks pr ovi ded f or t hi s pur pose. Any and al l net wor k access f r om out si de t he pr oj ect s i t e i s pr ohi bi t ed.

1. 9. 3 Gover nment Access t o Net wor k

Gover nment per sonnel must be al l owed t o have compl et e and i mmedi at e access t o t he net wor k at any t i me i n or der t o ver i f y compl i ance wi t h t hi s specification

1. 9. 4 Tempor ar y Wi r el ess I P Net wor ks

I n addi t i on t o t he ot her r equi r ement s on t empor ar y I P net wor ks, t empor ar y wi r el ess I P ( Wi Fi ) net wor ks must not i nt er f er e wi t h exi st i ng wi r el ess

SECTI ON 25 05 11 Page 9 net wor k and must use WPA2 secur i t y. Net wor k names ( SSI D) f or wi r el ess net wor ks must be changed f r om t hei r def aul t val ues.

1. 9. 5 Passwor ds and Passphr ases

The passwor ds and passphr ases f or al l net wor k devi ces and net wor k access must be changed f r om t hei r def aul t val ues. Passwor ds must be a mi ni mum 8 char act er s wi t h a mi ni mum of one upper case l et t er , one l ower case l et t er , one number and one speci al char act er .

1. 9. 6 Cont r act or Tempor ar y Net wor k Cyber secur i t y Compl i ance St at ement s

Pr ovi de a s i ngl e submi t t al cont ai ni ng compl et ed Cont r act or Tempor ar y Net wor k Cyber secur i t y Compl i ance St at ement s f or each company i mpl ement i ng a t empor ar y I P net wor k. Cont r act or Tempor ar y Net wor k Cyber secur i t y Compl i ance St at ement s must use t he t empl at e publ i shed at http://www.wbdg.org/FFC/NAVGRAPH/graphtoc.pdf . Each St at ement must be s i gned by a cyber secur i t y r epr esent at i ve f or t he r el evant company. I f no t empor ar y I P net wor ks wi l l be used, pr ovi de a s i ngl e copy of t he St at ement i ndi cat i ng t hi s.

1. 10 CYBERSECURI TY DURI NG WARRANTY PERI OD

Al l wor k per f or med on t he cont r ol syst em af t er accept ance must be per f or med usi ng Gover nment Fur ni shed Equi pment or equi pment speci f i cal l y and i ndi v i dual l y appr oved by t he Gover nment .

PART 2 PRODUCTS

( NOT USED)

PART 3 EXECUTI ON

3. 1 ACCESS CONTROL REQUI REMENTS

3. 1. 1 User Account s

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at e t o AC- 2( a) and

AC- 3; CCI - 002110, CCI - 000213. }

Any devi ce suppor t i ng user account s ( ei t her FULLY or MI NI MALLY) must l i mi t access t o t he devi ce accor di ng t o speci f i ed l i mi t at i ons f or each account .

I nst al l and conf i gur e any devi ce havi ng a STI G or SRG i n accor dance wi t h t hat STI G or SRG.

3. 1. 1. 1 Computers

Al l comput er s must FULLY suppor t user account s.

3. 1. 1. 2 For HVAC Cont r ol Syst em Devi ces

Devi ces wi t h web i nt er f aces must ei t her FULLY suppor t user account s or have t hei r web i nt er f ace di sabl ed. Fi el d devi ces wi t h f ul l l ocal user i nt er f aces al l owi ng modi f i cat i on of dat a must at l east MI NI MALLY suppor t user account s.

3. 1. 1. 3 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

For cont r ol syst em devi ces wher e User Account r equi r ement s ar e not

SECTI ON 25 05 11 Page 10 ot her wi se i ndi cat ed i n t hi s Sect i on:

a. Devi ces wi t h web i nt er f aces must ei t her at l east MI NI MALLY suppor t user account s or have t hei r web i nt er f ace di sabl ed.

b. Fi el d devi ces wi t h f ul l l ocal user i nt er f aces al l owi ng modi f i cat i on of dat a must at l east MI NI MALLY suppor t user account s.

c. Fi el d devi ces wi t h r ead- onl y f ul l l ocal user i nt er f aces must at l east MI NI MALLY suppor t user account s.

d. Al l devi ces must at l east MI NI MALLY suppor t user account s.

3. 1. 2 Unsuccessf ul Logon At t empt s

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at e AC- 7 ( a) , AC- 7 ( b) ; CCI - 000043, CCI - 000044, CCI - 001423, CCI - 002236, CCI - 002237, CCI-002238}

Except f or hi gh avai l abi l i t y user i nt er f aces i ndi cat ed as exempt , devi ces must meet t he i ndi cat ed r equi r ement s f or handl i ng unsuccessf ul l ogon attempts.

3. 1. 2. 1 Devi ces MI NI MALLY Suppor t i ng Account s

Devi ces whi ch MI NI MALLY suppor t account s ar e not r equi r ed t o l ock based on unsuccessf ul l ogon at t empt s.

3. 1. 2. 2 Devi ces FULLY Suppor t i ng Account s

Devi ces whi ch FULLY suppor t account s must meet t he f ol l owi ng r equi r ement s.

I f a devi ce cannot meet t hese r equi r ement s, document devi ce capabi l i t i es t o pr ot ect f r om subsequent unsuccessf ul l ogon at t empt s and pr opose al t er nat e pr ot ect i ons i n a Devi ce Account Lock Except i on Request submi t t al . Do not i mpl ement al t er nat e pr ot ect i on measur es wi t hout expl i c i t per mi ssi on f r om t he Gover nment .

a. I t must l ock t he user account when t hr ee unsuccessf ul l ogon at t empt s occur wi t hi n a 15 mi nut e i nt er val .

b. Once an account i s l ocked, t he account must st ay l ocked unt i l unl ocked by an admi ni st r at or .

c. Once t he i ndi cat ed number of unsuccessf ul l ogon at t empt s occur s, del ay f ur t her l ogon pr ompt s by 5 seconds.

3. 1. 2. 3 Hi gh Avai l abi l i t y I nt er f aces Exempt f r om Unsuccessf ul Logon At t empt s Requi r ement s

Ther e ar e no hi gh avai l abi l i t y i nt er f aces whi ch ar e exempt f r om unsuccessf ul l ogon at t empt s r equi r ement s.

3. 1. 3 Syst em Use Not i f i cat i on

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o AC- 8;

CCI - 000048, CCI - 002247, CCI - 002243, CCI - 002244, CCI - 002245, CCI - 002246, CCI - 000050, CCI - 002248}

SECTI ON 25 05 11 Page 11

Web i nt er f aces must di spl ay a war ni ng banner meet i ng t he r equi r ement s of

DTM 08- 060.

Devi ces whi ch ar e connect ed t o a net wor k and have a user i nt er f ace must di spl ay a war ni ng banner meet i ng t he r equi r ement s of DTM 08- 060 i f capabl e of doi ng so. Devi ces whi ch ar e connect ed t o a net wor k and have a user i nt er f ace but ar e not capabl e of di spl ayi ng a banner must have a per manent l y af f i xed l abel di spl ayi ng an appr oved banner f r om DTM 08- 060.Labels must be machi ne pr i nt ed or engr aved, pl ast i c or met al , desi gned f or per manent i nst al l at i on, must use a f ont no smal l er t han 14 poi nt , and must pr ovi de a hi gh cont r act bet ween f ont and backgr ound col or s.

3. 1. 3. 1 User I nt er f ace Banner Schedul e

Pr ovi de a User I nt er f ace Schedul e usi ng t he f or mat i ndi cat ed showi ng each user i nt er f ace pr ovi ded and how t he i nf or mat i on banner r equi r ement has been i mpl ement ed f or each user i nt er f ace.

User I nt er f ace Schedul e For mat ( wi t h sampl e ent r i es)

User I nt er f ace Description

User I nt er f ace Location

Type of User Interface

Banner I mpl ement at i on

Sampl e 1 Room 1 Remote DTM 08- 060 Banner " A" Di spl ayed at Logon

Sampl e 2 Room 2 Li mi t ed Local DTM 08- 060 Banner " B" on Af f i xed Label

Sampl e 3 Room 3 Ful l Local DTM 08- 060 Banner " B" Di spl ayed on Screen

3. 1. 4 Per mi t t ed Act i ons Wi t hout I dent i f i cat i on or Aut hent i cat i on

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o AC- 14;

CCI - 000061, CCI - 000232}

The cont r ol syst em must r equi r e i dent i f i cat i on and aut hent i cat i on bef or e al l owi ng any act i ons by a user act i ng f r om a user i nt er f ace whi ch MI NI MALLY or FULLY suppor t s account s.

3. 1. 5 Wi r el ess Access

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o AC- 18;

CCI - 001438, CCI - 001439, CCI - 002323, CCI - 001441}

Unl ess expl i c i t l y aut hor i zed by t he Gover nment , do not use any wi r el ess communi cat i on. Any devi ce wi t h wi r el ess communi cat i on capabi l i t y i s consi der ed t o be usi ng wi r el ess communi cat i on, r egar dl ess of whet her or not t he devi ce i s act i vel y communi cat i ng wi r el essl y, except when wi r el ess communi cat i on has been physi cal l y per manent l y di sabl ed ( such as t hr ough t he r emoval of t he wi r el ess t r anscei ver ) .

SECTI ON 25 05 11 Page 12

3. 1. 5. 1 Non- I P Wi r el ess Communi cat i on

When non- I P wi r el ess communi cat i on i s expl i c i t l y aut hor i zed by t he Gover nment , use t he maxi mum l evel of encr ypt i on suppor t ed by t he speci f i c pr ot ocol empl oyed and sel ect s i gnal st r engt h and r adi at ed power t o t he mi ni mum necessar y f or r el i abl e communi cat i on.

3. 1. 5. 2 Wi r el ess Communi cat i on Request

Pr ovi de a r epor t document i ng t he pr oposed use of wi r el ess communi cat i on pr i or t o begi nni ng const r uct i on usi ng t he Wi r el ess Communi cat i on Request Schedul e at http://www.wbdg.org/FFC/NAVGRAPH/graphtoc.pdf .

For each devi ce pr oposed t o use wi r el ess communi cat i on show: t he devi ce i dent i f i er , a descr i pt i on of t he devi ce, t he l ocat i on of t he devi ce, t he devi ce i dent i f i er s of ot her devi ces communi cat i ng wi t h t he devi ce, t he pr ot ocol used f or communi cat i on, encr ypt i on t ype and st r engt h, RF Fr equency, Radi at ed Power i n dBm ( deci bel wi t h a mi l l i wat t r ef er ence) , f r ee- space r ange, and t he expect ed as- i nst al l ed r ange.

3. 1. 5. 3 Wi r el ess Communi cat i on Test i ng

As par t of Per f or mance Ver i f i cat i on Test i ng ( PVT) , conduct t est i ng of wi r el ess communi cat i on f or al l devi ces i ndi cat ed on t he appr oved Wi r el ess Communi cat i on Request as r equi r i ng t est i ng.

To t est wi r el ess communi cat i on, t est f or wi r el ess net wor k r ecept i on at mul t i pl e poi nt s al ong t he wi r el ess t est boundar y i n t he v i c i ni t y of t he wi r el ess devi ce, and r ecor d whet her a net wor k connect i on can be est abl i shed at each poi nt . The wi r el ess t est boundar y i s t he bui l di ng ext er i or wal l s.

I f wi r el ess t est i ng i s r equi r ed, pr ovi de a Wi r el ess Communi cat i on Test Repor t document i ng t he t est i ng poi nt s and r esul t s at each poi nt f or each wi r el ess devi ce.

3. 2 REQUI REMENTS FOR LEAST FUNCTI ONALI TY

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) , al ong wi t h t he net wor k communi cat i on r epor t submi t t al speci f i ed el sewher e i n t hi s sect i on, r el at es t o CM- 6 ( a) , ( c) , CM- 7, CM- 7 ( 1) ( b) , SC- 41; CCI - 000363, CCI - 000364, CCI - 000365, CCI - 001588, CCI - 001755, CCI - 000381, CCI - 000380, CCI - 00382, CCI - 001761, CCI - 001762, CCI - 002544, CCI - 002545, CCI - 002546. }

For devi ces t hat have a STI G or SRG r el at ed t o Requi r ement s f or Least Funct i onal i t y ( such as conf i gur at i on set t i ngs and por t and devi ce I / O access f or l east f unct i onal i t y) , i nst al l and conf i gur e t he devi ce i n accor dance wi t h t hat STI G or SRGs.

For HVAC Cont r ol Syst ems: Do not pr ovi de devi ces wi t h user i nt er f aces wher e one was not r equi r ed. Do not use a net wor ked sensor or act uat or wher e a non- net wor ked sensor or act uat or woul d suf f i ce.

For Ot her Cont r ol Syst ems: Do not pr ovi de devi ces wi t h user i nt er f aces wher e one was not r equi r ed.

3. 2. 1 Non- I P Cont r ol Net wor ks

When cont r ol syst em speci f i cat i ons r equi r e par t i cul ar communi cat i on pr ot ocol s, use onl y t hose communi cat i on pr ot ocol s and onl y as speci f i ed.

SECTI ON 25 05 11 Page 13

Do not i mpl ement any ot her communi cat i on pr ot ocol , or use any pr ot ocol on por t s ot her t han t hose speci f i ed.

When cont r ol syst em speci f i cat i ons do not i ndi cat e r equi r ement s f or communi cat i on pr ot ocol s, use onl y t hose pr ot ocol s r equi r ed f or oper at i on of t he syst em as speci f i ed.

3. 2. 2 I P Cont r ol Net wor ks

Do not use nonsecur e f unct i ons, por t s, pr ot ocol s and ser vi ces as def i ned i n DODI 8551. 01 unl ess t hose por t s, pr ot ocol s and ser vi ces ar e speci f i cal l y r equi r ed by t he cont r ol syst em speci f i cat i ons or ot her wi se speci f i cal l y aut hor i zed by t he Gover nment . Do not use por t s, pr ot ocol s and ser v i ces t hat ar e not speci f i ed i n t he cont r ol syst em speci f i cat i ons or r equi r ed f or oper at i on of t he cont r ol syst em.

3. 3 SAFE MODE AND FAI L SAFE OPERATI ON

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o CP- 12, SI - 17; CCI - 002855, CCI - 002856, CCI - 002857, CCI - 002773, CCI - 002774, CCI-002775}

For al l cont r ol syst em component s wi t h an appl i cabl e STI G or SRG, conf i gur e t he component i n accor dance wi t h al l appl i cabl e STI Gs and SRGs.

3. 4 I DENTI FI CATI ON AND AUTHENTI CATI ON

3. 4. 1 User I dent i f i cat i on and Aut hent i cat i on

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o

I A- 2, ( 1) , ( 12) ; CCI - 000764, CCI - 000765, CCI - 001953, CCI - 001954}

a. Devi ces t hat FULLY suppor t account s must uni quel y i dent i f y and aut hent i cat e or gani zat i onal user s.

b. Devi ces whi ch al l ow net wor k access t o pr i v i l eged account s must i mpl ement mul t i f act or aut hent i cat i on f or net wor k access t o pr i v i l eged accounts.

3. 4. 1. 1 HVAC Cont r ol Syst ems Devi ces

I dent i f i cat i on and Aut hent i cat i on f or net wor k access t o pr i v i l eged account s must be i mpl ement ed by ei t her accept i ng and el ect r oni cal l y ver i f y Per sonal I dent i t y Ver i f i cat i on ( PI V) cr edent i al s or i nher i t i ng i dent i f i cat i on and aut hent i cat i on f r om t he oper at i ng syst em.

3. 4. 1. 2 El ect r oni c Secur i t y Syst em Devi ces

I dent i f i cat i on and Aut hent i cat i on f or net wor k access t o pr i v i l eged account s must be i mpl ement ed by accept i ng and el ect r oni cal l y ver i f y i ng Per sonal I dent i t y Ver i f i cat i on ( PI V) cr edent i al s.

3. 4. 1. 3 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

For cont r ol syst em devi ces wher e User I dent i f i cat i on and Aut hent i cat i on r equi r ement s ar e not ot her wi se i ndi cat ed i n t hi s Sect i on, User I dent i f i cat i on and Aut hent i cat i on f or net wor k access t o pr i v i l eged account s must be i mpl ement ed by accept i ng and el ect r oni cal l y ver i f y Per sonal I dent i t y Ver i f i cat i on ( PI V) cr edent i al s.

SECTI ON 25 05 11 Page 14

3. 4. 2 Aut hent i cat or Management

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o I A- 5 ( b) , ( c) , ( e) , ( g) , ( 1) , ( 11) ; CCI - 000176, CCI - 001544, CCI - 001989, CCI - 000182, CCI - 001610, CCI - 000192, CCI - 000193, CCI - 000194, CCI - 000205, CCI - 001619, CCI - 001611, CCI - 001612, CCI - 001613, CCI - 001614, CCI - 000195, CCI - 001615, CCI - 000196, CCI - 000197, CCI - 000199, CCI - 000198, CCI - 001616, CCI - 001617, CCI - 000200, CCI - 001618, CCI - 002041, CCI - 002002, CCI - 002003}

3. 4. 2. 1 Aut hent i cat i on Type

3. 4. 2. 1. 1 For HVAC Cont r ol Syst em Devi ces

Unl ess ot her wi se i ndi cat ed:

a. Sof t war e whi ch FULLY suppor t s account s and whi ch r uns on a comput er must use passwor d- based aut hent i cat i on or har dwar e t oken- based aut hent i cat i on.

b. Ot her devi ces whi ch FULLY suppor t account s must use passwor d- based authentication.

c. Devi ces MI NI MALLY suppor t i ng account s must use passwor d- based authentication.

3. 4. 2. 1. 2 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

For cont r ol syst em devi ces wher e Aut hent i cat i on Type r equi r ement s ar e not ot her wi se i ndi cat ed i n t hi s Sect i on:

a. Sof t war e whi ch FULLY suppor t s account s and whi ch r uns on a comput er must use passwor d- based aut hent i cat i on or har dwar e t oken- based aut hent i cat i on.

b. Ot her devi ces whi ch FULLY suppor t account s must use ei t her passwor d- based aut hent i cat i on or har dwar e t oken- based aut hent i cat i on.

c. Devi ces MI NI MALLY suppor t i ng account s must use ei t her passwor d- based aut hent i cat i on or har dwar e t oken- based aut hent i cat i on.

3. 4. 2. 2 Passwor d- Based Aut hent i cat i on Requi r ement s

3. 4. 2. 2. 1 Passwor ds f or Non- Comput er Devi ces FULLY Suppor t i ng Account s

Al l non- comput er devi ces FULLY suppor t i ng account s and suppor t i ng passwor d- based aut hent i cat i on must enf or ce t he f ol l owi ng r equi r ement s:

a. Mi ni mum passwor d l engt h of t wel ve ( 12) char act er s

b. Passwor d must cont ai n at l east one upper case char act er .

c. Passwor d must cont ai n at l east one l ower case char act er .

d. Passwor d must cont ai n at l east one numer i c char act er .

e. Passwor d must cont ai n at l east one speci al char act er .

f . Passwor d must have a maxi mum l i f et i me of s i xt y ( 60) days. When passwor ds expi r e, pr ompt user s t o change passwor ds. Do no l ock account s due t o expi r ed passwor ds.

SECTI ON 25 05 11 Page 15

g. Passwor d must di f f er f r om pr evi ous f i ve ( 5) passwor ds, wher e di f f er i s def i ned as changi ng at l east f i f t y per cent of t he char act er s.

h. Passwor ds must be cr ypt ogr aphi cal l y pr ot ect ed dur i ng st or age and transmission.

3. 4. 2. 2. 2 Passwor ds f or Web I nt er f aces Passwor ds f or connect i ng t o a web i nt er f ace suppor t i ng passwor d- based aut hent i cat i on must enf or ce t he f ol l owi ng r equi r ement s:

a. Mi ni mum passwor d l engt h of 12 char act er s

b. Passwor d must cont ai n at l east one upper case char act er .

c. Passwor d must cont ai n at l east one l ower case char act er .

d. Passwor d must cont ai n at l east one numer i c char act er .

e. Passwor d must cont ai n at l east one speci al char act er .

f . Passwor d must have a maxi mum l i f et i me of 60 days. When passwor ds expi r e, pr ompt user s t o change passwor ds. Do no l ock account s due t o expi r ed passwords.

g. Passwor d must di f f er f r om pr evi ous f i ve passwor ds, wher e di f f er i s def i ned as changi ng at l east 50 per cent of t he char act er s.

h. Passwor ds must be cr ypt ogr aphi cal l y pr ot ect ed dur i ng st or age and transmission.

3. 4. 2. 2. 3 Passwor ds f or Devi ces Mi ni mal l y Suppor t i ng Account s

Devi ces mi ni mal l y suppor t i ng account s must suppor t passwor ds wi t h a mi ni mum l engt h of f our char act er s.

3. 4. 2. 2. 4 Passwor d Conf i gur at i on and Repor t i ng

For al l devi ces wi t h a passwor d, change t he passwor d f r om t he def aul t passwor d. Coor di nat e sel ect i on of passwor ds wi t h COR. Do not use t he same passwor d f or mor e t han one devi ce unl ess speci f i cal l y i nst r uct ed t o do so.

Pr ovi de a Passwor d Summar y Repor t document i ng t he passwor d f or each devi ce and descr i bi ng t he pr ocedur e t o change t he passwor d f or each devi ce.

Do not pr ovi de t he Passwor d Summar y Repor t i n el ect r oni c f or mat . Pr ovi de t wo har dcopi es of t he Passwor d Summar y Repor t , each copy i n i t s own seal ed envelope.

3. 4. 2. 3 Har dwar e Token- Based Aut hent i cat i on Requi r ement s

Devi ces suppor t i ng har dwar e t oken- based aut hent i cat i on must use Per sonal I dent i t y Ver i f i cat i on ( PI V) cr edent i al s f or t he har dwar e t oken.

3. 4. 3 Aut hent i cat or Feedback

{ For Ref er ence Onl y: Thi s subpar t r el at es t o I A- 6; CCI - 000206}

Devi ces must never show aut hent i cat i on i nf or mat i on, i ncl udi ng passwor ds, on a di spl ay. Devi ces t hat moment ar i l y di spl ay a char act er as i t i s ent er ed, SECTI ON 25 05 11 Page 16 and t hen obscur e t he char act er , ar e accept abl e. For devi ces t hat have STI Gs or SRGs r el at ed t o obscur i ng of aut hent i cat or f eedback ( CCI - 000206) , compl y wi t h t he r equi r ement s of t hose STI GS/ SRGs.

3. 4. 4 Devi ce I dent i f i cat i on and Aut hent i cat i on

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o I A- 3;

CCI - 000777, CCI - 000778, CCI - 001958}

Al l comput er s must use I EEE 802. 1x f or aut hent i cat i on t o t he net wor k. Al l web ser ver s r unni ng on comput er s must use HTTPS.

3. 4. 4. 1 For HVAC Cont r ol Syst em Devi ces

Devi ces usi ng Fox Pr ot ocol must use HTTPS. Devi ces usi ng Fox Pr ot ocol must suppor t I EEE 802. 1x.

3. 4. 4. 2 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

For cont r ol syst em devi ces wher e Devi ce I dent i f i cat i on and Aut hent i cat i on r equi r ement s ar e not ot her wi se i ndi cat ed i n t hi s Sect i on: Devi ces usi ng Et her net must suppor t I EEE 802. 1x. Devi ces usi ng HTTP as a cont r ol pr ot ocol must use HTTPS i nst ead.

3. 4. 5 Cr ypt ogr aphi c Modul e Aut hent i cat i on

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o I A- 7;

CCI-000803}

For devi ces t hat have STI G/ SRGs r el at ed t o cr ypt ogr aphi c modul e aut hent i cat i on ( CCI - 000803) , compl y wi t h t he r equi r ement s of t hose STIG/SRGs.

3. 5 DURABI LI TY TO VULNERABI LI TY SCANNI NG

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o RA- 5 ( a) , ( b) , ( c) , ( d) ; CCI - 001054, CCI - 001055, CCI - 0010156, CCI - 001641, CCI - 001643, CCI - 001057, CCI - 001058, CCI - 001059}

Al l I P devi ces must be scannabl e, such t hat t he devi ce can be scanned by i ndust r y st andar d I P net wor k scanni ng ut i l i t i es wi t hout har m t o t he devi ce, appl i cat i on, or f unct i onal i t y .

For cont r ol syst em devi ces ot her t han comput er s:

3. 5. 1 HVAC Cont r ol Syst em Devi ces Ot her Than Comput er s

HVAC cont r ol syst em devi ces ot her t han comput er s ar e not r equi r ed t o r espond t o scans.

3. 5. 2 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

Non- comput er cont r ol syst em devi ces wher e Dur abi l i t y t o Vul ner abi l i t y Scanni ng r equi r ement s ar e not ot her wi se i ndi cat ed i n t hi s Sect i on .

3. 6 FI PS 201- 2 REQUI REMENT

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o SA- 4 ( 10) ;

CCI-003116}

SECTI ON 25 05 11 Page 17

Devi ces i n t he f ol l owi ng syst ems whi ch i mpl ement PI V must be on t he NI ST FI PS 201- 2 appr oved pr oduct l i s t : NONE.

3. 7 DEVI CES WI TH CONNECTI ON TO MULTI PLE I P NETWORKS

Except f or Et her net swi t ches, do not use mor e t han one physi cal connect i on t o I P net wor ks on t he same devi ce unl ess doi ng so i s bot h r equi r ed by t he pr oj ect speci f i cat i ons and t he speci f i c appl i cat i on i s appr oved. I f a devi ce wi t h mul t i pl e I P connect i ons i s r equi r ed, pr ovi de a Mul t i pl e I P Connect i on Devi ce Request usi ng t he Mul t i pl e I P Connect i on Devi ce Request Schedul e at http://www.wbdg.org/FFC/NAVGRAPH/graphtoc.pdf t o r equest appr oval f or each devi ce.

3. 8 SYSTEM AND COMMUNI CATI ON PROTECTI ON

3. 8. 1 Deni al of Ser vi ce Pr ot ect i on, Pr ocess I sol at i on and Boundar y Protection

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o SC- 5, SC- 39, SC- 7( a) ; CCI - 001093, CCI - 002385, CCI - 002386, CCI - 002430, CCI - 001097}

To t he gr eat est ext ent pr act i cal , i mpl ement cont r ol l ogi c i n non- comput er har dwar e and wi t hout r el i ance on t he net wor k.

3. 9 SYSTEM AND I NTEGRATI ON I NTEGRI TY

3. 9. 1 Mal i c i ous Code Pr ot ect i on

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o SI - 3( c) ;

CCI - 001241, CCI - 002623}

For al l comput er s i nst al l ed under t hi s pr oj ect , i nst al l and conf i gur e mal war e pr ot ect i on sof t war e i n accor dance wi t h t he r el evant STI Gs.

3. 10 FI ELD QUALI TY CONTROL

3. 10. 1 Tests

I n addi t i on t o t est i ng and t est i ng suppor t r equi r ed by ot her Sect i ons, pr ovi de a mi ni mum of 4 hour s of t echni cal suppor t f or cyber secur i t y t est i ng of cont r ol syst ems.

- - End of Sect i on - -

SECTI ON 25 05 11 Page 18

SECTI ON 26 00 00. 00 20

BASI C ELECTRI CAL MATERI ALS AND METHODS

PART 1 GENERAL

1. 1 REFERENCES

The publ i cat i ons l i s t ed bel ow f or m a par t of t hi s speci f i cat i on t o t he ext ent r ef er enced. The publ i cat i ons ar e r ef er r ed t o i n t he t ext by t he basi c desi gnat i on onl y.

ASTM I NTERNATI ONAL ( ASTM)

ASTM D709 ( 2016) St andar d Speci f i cat i on f or Lami nat ed Ther moset t i ng Mat er i al s

I NSTI TUTE OF ELECTRI CAL AND ELECTRONI CS ENGI NEERS ( I EEE)

I EEE 100 ( 2000; Ar chi ved) The Aut hor i t at i ve Di ct i onar y of I EEE St andar ds Ter ms

I EEE C2 ( 2017) Nat i onal El ect r i cal Saf et y Code

I EEE C57. 12. 28 ( 2014) St andar d f or Pad- Mount ed Equi pment

- Encl osur e I nt egr i t y

I EEE C57. 12. 29 ( 2014) St andar d f or Pad- Mount ed Equi pment

- Encl osur e I nt egr i t y f or Coast al Environments

NATI ONAL ELECTRI CAL MANUFACTURERS ASSOCI ATI ON ( NEMA)

NEMA 250 ( 2014) Encl osur es f or El ect r i cal Equi pment ( 1000 Vol t s Maxi mum)

NATI ONAL FI RE PROTECTI ON ASSOCI ATI ON ( NFPA)

NFPA 70 ( 2017) Nat i onal El ect r i cal Code

1. 2 RELATED REQUI REMENTS

Thi s sect i on appl i es t o cer t ai n sect i ons of Di v i s i ons 22 and 23, PLUMBI NG and HEATI NG VENTI LATI NG AND AI R CONDI TI ONI NG. Thi s sect i on appl i es t o al l sect i ons of Di v i s i on 26 and 33, ELECTRI CAL and UTI LI TI ES, of t hi s pr oj ect speci f i cat i on unl ess speci f i ed ot her wi se i n t he i ndi v i dual sect i ons. Thi s sect i on has been i ncor por at ed i nt o, and t hus, does not appl y t o, and i s not r ef er enced i n t he f ol l owi ng sect i ons.

Sect i on 26 20 00 I NTERI OR DI STRI BUTI ON SYSTEM Sect i on 26 24 13 SWI TCHBOARDS Sect i on 26 56 00 EXTERI OR LI GHTI NG Sect i on 27 10 00 BUI LDI NG TELECOMMUNI CATI ONS CABLI NG SYSTEM Sect i on 33 71 02 UNDERGROUND ELECTRI CAL DI STRI BUTI ON

SECTI ON 26 00 00. 00 20 Page 1

1. 3 DEFINITIONS

a. Unl ess ot her wi se speci f i ed or i ndi cat ed, el ect r i cal and el ect r oni cs t er ms used i n t hese speci f i cat i ons, and on t he dr awi ngs, shal l be as def i ned i n I EEE 100.

b. The t echni cal sect i ons r ef er r ed t o her ei n ar e t hose speci f i cat i on sect i ons t hat descr i be pr oduct s, i nst al l at i on pr ocedur es, and equi pment oper at i ons and t hat r ef er t o t hi s sect i on f or det ai l ed descr i pt i on of submi t t al t ypes.

c. The t echni cal par agr aphs r ef er r ed t o her ei n ar e t hose par agr aphs i n PART 2 - PRODUCTS and PART 3 - EXECUTI ON of t he t echni cal sect i ons t hat descr i be pr oduct s, syst ems, i nst al l at i on pr ocedur es, equi pment , and t est met hods.

1. 4 ELECTRI CAL CHARACTERI STI CS

El ect r i cal char act er i st i cs f or t hi s pr oj ect shal l be MV pr i mar y, t hr ee phase, t hr ee wi r e, 60 Hz, and 480 vol t s secondar y, t hr ee phase, f our wi r e.