22r19-CDC AMR-Am-0003.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

1. CONTRACT ID CODE

J

PAGE OF PAGES

1 2

2. AMENDMENT/MODIFICATION NO.

Am-0003

3. EFFECTIVE DATE

27-Jul-2022

4. REQUISITION/PURCHASE REQ. NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY CODE W9128A 7. ADMINISTERED BY (If other than item 6) CODE

CONTRACTING DIVISION

BLDG 230 OTAKE ST.

FORT SHAFTER HI 96858

See Item 6

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X 9A. AMENDMENT OF SOLICITATION NO.

W9128A22R0019

X 9B. DATED (SEE ITEM 11)

22-Jun-2022

10A. MOD. OF CONTRACT/ORDER NO.

10B. DATED (SEE ITEM 13)

CODE FACILITY CODE

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

FY22 MCA PN 96540 Child Development Center, Aliamanu Military Reservation, Oahu, Hawaii

See Continuation Page.

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print) 16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

TEL: EMAIL:

15B. CONT RACT OR/OFFEROR

(Signature of person authorized to sign)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA

BY

(Signature of Contracting Officer)

16C. DATE SIGNED

EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

30-105-04 STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

W9128A22R0019 Am-0003

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

1. CHANGES TO SPECIFICATIONS. Attached hereto are revised pages/paragraphs to the specifications. The revision mark “(Am-0003)” is shown on each revised page.

a. REVISED SECTIONS. The following are revised pages to the solicitation. Changes are bold and/or strike-through.

Section 23 07 00, TABLES 1, and 2 Section 25 02 11, para 1.6, para 1.7.2, and para 3.11

b. NEW SECTIONS. The following are new pages to the solicitation.

Section 00 60 00, Appendix A – Requests for Information (#59 through 70)

c. REPLACED SECTION. The following section is replaced in its entirety:

Section 25 05 11.01, Cybersecurity and Facility-Related Control Systems

d. DELETED SECTION. The following sections are to be deleted in its entirety:

N/A

2. CHANGES TO DRAWINGS

a. REVISED DRAWINGS. The following revised drawings replace like-numbered drawings and are issued herewith:

Sheet ID Mark Revision Date

P-502 3 7/19/2022 P-504 3 7/19/2022 M-501 3 7/19/2022 M-502 3 7/19/2022 M-503 3 7/19/2022 M-504 3 7/19/2022 M-635 3 7/19/2022

ES501 3 7/19/2022

EP602 3 7/19/2022

3. The proposal due date and time remains unchanged.

FY22 PN 096540 Child Development Center, Aliamanu Military Reservation

W9128A22R0019

RFI # Question Response

Please confirm the BAS-DDC HVAC Control Systems can be provide by qualified Tridium Dealer and is not considered a sole source to Johnson Controls.

See Am-0003, Sheet M-653

Reference sheets ES501, EP601, EP602. Detail A7 on ES502 shows Duct type D1 coming from EHH #10 to the new 500 kVA XFMR. We believe this should be going to the 1000 kVA XFMR per the one line sheets EP601 & EP602. This means there will need to be a duct schedule added showing the (3) 5” conduits going from the MDP to the 500 kVA XFMR per EP602. Please advise.

See Am-0003, Sheet ES501

Reference sheets EP401, EP602. Panel DP208 is shown in Electrical Room 308 on drawing EP602. Panel DP208 is shown in Electrical Room 301 on drawing EP401. Please advise.

See Am-0003, Sheet EP602

Table 1 in section 23 07 00 lists cold domestic water piping as being insulated. Cold water comes out of the ground in the mid-70s and does not require insulation in Hawaii. The spec section also specifically mentions for fluids “up to” 60 degrees, which the cold water is significantly above. Please confirm insulation is not required on domestic cold water as it provides no benefit.

See Am-0003, section 23 07 00, Table 1

Mechanical drawings nor S104 indicate pad thicknesses. Please provide mechanical pad thicknesses.

See Am-0003, Sheets M-501, M-504, and P-502

Per 07 27 10.00.10 – 1.1. states to construct the air barrier system indicated. The air barrier must be contiguous and connected across all surfaces. In the contract drawings, there are no air barriers shown on the roof, walls and floor. Please provide air barrier details: 1. Floor, 2. Walls,

3. Roof, 4. Wall/Roof Transition, 5. Roof penetrations

See Sheet AJ701, Air Barrier Notes.

Per CS102, A504 does not provide details for the concrete SOG at the Mechanical Yard and the Trash enclosure. Please provide Mechanical Equipment Pads. a. Added concrete thickness at the equipment pad

See Am-0003, sheets M-501, M-504, P-502, P-504

Section 00 60 00, Appendix A, Requests for Information - 1 (Am-0003)

FY22 PN 096540 Child Development Center, Aliamanu Military Reservation

W9128A22R0019

RFI # Question Response

Per L-401, 402 and 403, shows concrete pavement and resilient surfacing at the playground and detail B8/L502 shows details for the play surface.

Please provide detail for Concrete pavement (and Concrete under resilient surfacing) and reinforcing

See Am-0002, revised sheets L-401, L-402, L-403, and L-502.

Per L-401, 402 and 403, shows concrete pavement and resilient surfacing at the playground and detail B8/L502 shows details for the play surface.

Please provide detail for Subbase under concrete

See Am-0002, revised sheets L-401, L-402, L-403, and L-502.

Reference Sheet AJ701. Drawings call for fully grouted CMU as the air barrier system for walls. Please confirm no other type of air barrier coating is required

Confirmed.

Section 09 30 10, paragraph 2.5.2 specifies aluminum tile trims “as indicated”. No aluminum tile trims were found in the drawings. Please confirm that no tile trims per paragraph 2.5.2 are required for this project.

Required, see Drawing C1/A-602

The current LEED scorecard shows 2 points for Energy and Atmosphere Credit: Green Power and Carbon Offsets. Please confirm who would be responsible for the cost associated with these points?

Government.

Section 00 60 00, Appendix A, Requests for Information - 2

3FY21 PN96540 CHILD DEVELOPMENT CENTER, AMR

SECTION TABLE OF CONTENTS

DIVISION 25 - INTEGRATED AUTOMATION

SECTION 25 05 11.01.01

CYBERSECURITY FOR FACILITY-RELATED CONTROL SYSTEMS

PART 1 GENERAL

1.1 CONTROL SYSTEM APPLICABILITY

1.2 RELATED REQUIREMENTS

1.3 REFERENCES

1.4 DEFINITIONS

1.4.1 Computer

1.4.2 Network Connected

1.4.3 User Account Support Levels

1.4.3.1 FULLY Supported

1.4.3.2 MINIMALLY Supported

1.4.3.3 NOT Supported

1.4.4 User Interface

1.4.4.1 Limited Local User Interface

1.4.4.2 Full Local User Interface

1.4.4.3 Remote User Interface

1.5 ADMINISTRATIVE REQUIREMENTS

1.5.1 Coordination

1.6 SUBMITTALS

1.7 QUALITY CONTROL

1.7.1 Qualifications

1.7.1.1 Cybersecurity Subject Matter Expert

1.7.2 Information Systems Security Manager (ISSM)

1.8 CYBERSECURITY DOCUMENTATION

1.8.1 Cybersecurity Interconnection Schedule

1.8.2 Network Communication Report

1.8.3 Control System Inventory Report

1.8.4 Software Recovery and Reconstitution Images

1.8.5 Cybersecurity Riser Diagram

1.8.6 Control System Cybersecurity Documentation

1.8.6.1 For HVAC Control System Devices

1.8.6.1.1 HVAC Control System Devices FULLY Supporting User

Accounts

1.8.6.1.2 All Other HVAC Control System Devices

1.8.6.2 Default Requirements for Control System Devices

1.9 SOFTWARE UPDATE LICENSING

1.10 CYBERSECURITY DURING CONSTRUCTION

1.10.1 Contractor Computer Equipment

1.10.1.1 Operating System

1.10.1.2 Anti-Malware Software

1.10.1.3 Passwords and Passphrases

1.10.1.4 Contractor Computer Cybersecurity Compliance Statements

1.10.2 Temporary IP Networks

1.10.2.1 Network Boundaries and Connections

1.10.3 Government Access to Network

1.10.4 Temporary Wireless IP Networks

SECTION 25 05 11.01 Page 1

FY21 PN96540 CHILD DEVELOPMENT CENTER, AMR

1.10.5 Passwords and Passphrases

1.10.6 Contractor Temporary Network Cybersecurity Compliance

Statements

1.11 CYBERSECURITY DURING WARRANTY PERIOD

PART 2 PRODUCTS

PART 3 EXECUTION

3.1 ACCESS CONTROL REQUIREMENTS

3.1.1 User Accounts

3.1.1.1 For HVAC Control System Devices

3.1.1.2 Default Requirements for Control System Devices

3.1.2 Unsuccessful Logon Attempts

3.1.2.1 Devices MINIMALLY Supporting Accounts

3.1.2.2 Devices FULLY Supporting Accounts

3.1.2.3 High Availability Interfaces Exempt from Unsuccessful

Logon Attempts Requirements

3.1.3 System Use Notification

3.1.3.1 User Interface Banner Schedule

3.1.4 Permitted Actions Without Identification or Authentication

3.1.5 Wireless Access

3.1.5.1 Non-IP Wireless Communication

3.2 CYBERSECURITY AUDITING

3.2.1 Audit Events, Content of Audit Records, and Audit Generation

3.2.1.1 For HVAC Control System Devices

3.2.1.1.1 HVAC Control System Devices FULLY Supporting User

Accounts

3.2.1.1.2 Other HVAC Control System Devices

3.2.1.2 Default Requirements for Control System Devices

3.2.1.2.1 Devices Which FULLY Support Accounts

3.2.1.2.1.1 Audited Events

3.2.1.2.1.2 Audit Event Information To Record

3.2.1.2.2 Devices Which Do Not FULLY Support Accounts

3.2.2 Audit Storage Capacity and Audit Upload

3.2.2.1 Device Audit Record Upload Software

3.2.3 Time Stamps

3.2.3.1 For HVAC Control System Devices

3.2.3.2 Default Requirements for Control System Devices

3.3 REQUIREMENTS FOR LEAST FUNCTIONALITY

3.3.1 Non-IP Control Networks

3.3.2 IP Control Networks

3.4 SAFE MODE AND FAIL SAFE OPERATION

3.5 IDENTIFICATION AND AUTHENTICATION

3.5.1 User Identification and Authentication

3.5.1.1 HVAC Control Systems Devices

3.5.1.2 Default Requirements for Control System Devices

3.5.2 Authenticator Management

3.5.2.1 Authentication Type

3.5.2.1.1 For HVAC Control System Devices

3.5.2.1.2 Default Requirements for Control System Devices

3.5.2.2 Password-Based Authentication Requirements

3.5.2.2.1 Passwords for Non-Computer Devices FULLY Supporting

Accounts

3.5.2.2.2 Passwords for Web Interfaces

3.5.2.2.3 Passwords for Devices Minimally Supporting Accounts

3.5.2.2.4 Password Configuration and Reporting

3.5.2.3 Hardware Token-Based Authentication Requirements

SECTION 25 05 11.01 Page 2

3.5.3 Authenticator Feedback

3.5.4 Device Identification and Authentication

3.5.4.1 For HVAC Control System Devices

3.5.4.2 Default Requirements for Control System Devices

3.5.5 Cryptographic Module Authentication

3.6 EMERGENCY POWER

3.7 DURABILITY TO VULNERABILITY SCANNING

3.7.1 HVAC Control System Devices Other Than Computers

3.7.2 Default Requirements for Control System Devices

3.8 FIPS 201-2 REQUIREMENT

3.9 DEVICES WITH CONNECTION TO MULTIPLE IP NETWORKS

3.10 SYSTEM AND COMMUNICATION PROTECTION

3.10.1 Denial of Service Protection, Process Isolation and Boundary

Protection

3.10.2 Cryptographic Protection

3.11 DDC System Integration

-- End of Section Table of Contents --

SECTION 25 05 11.01 Page 3

SECTION 25 05 11.01.01

CYBERSECURITY FOR FACILITY-RELATED CONTROL SYSTEMS

PART 1 GENERAL

Many subparts in this Section contain text in curly braces ("{" and "}") indicating which cybersecurity control and control correlation identifier (CCI) the requirements of the subpart relate to. The text inside these curly braces is for Government reference only, and enables coordination of the requirements of this Section with the RMF process throughout the design and construction process. Text in curly braces are not contractor requirements.

This Section refers to Security Requirements Guide (SRGs) and Security Technical Implementation Guide (STIGs). STIGs and SRGs are are available online at the Information Assurance Support Environment (IASE) website at http://iase.disa.mil/stigs/Pages/index.aspx . Not all control system components have applicable STIGs or SRGs.

1.1 CONTROL SYSTEM APPLICABILITY

There are multiple versions of this Section associated with this project.

Different versions have requirements applicable to different control systems. This specific Section applies only to the following control systems: HVAC Control Systems.

1.2 RELATED REQUIREMENTS

All Sections containing facility-related control systems or control system components are related to the requirements of this Section. Review all specification sections to determine related requirements.

1.3 REFERENCES

The publications listed below form a part of this specification to the extent referenced. The publications are referred to within the text by the basic designation only.

INSTITUTE OF ELECTRICAL AND ELECTRONICS ENGINEERS (IEEE)

IEEE 802.1x (2010) Local and Metropolitan Area Networks - Port Based Network Access Control

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST)

NIST FIPS 201-2 (2013) Personal Identity Verification (PIV) of Federal Employees and Contractors

U.S. DEPARTMENT OF DEFENSE (DOD)

DODI 8551.01 (2014) Ports, Protocols, and Services Management (PPSM)

SECTION 25 05 11.01 Page 4

DTM 08-060 (2008) Policy on Use of Department of Defense (DoD) Information Systems - Standard Consent Banner and User Agreement

1.4 DEFINITIONS

1.4.1 Computer

As used in this Section, a computer is one of the following:

a. a device running a non-embedded desktop or server version of Microsoft Windows

b. a device running a non-embedded version of MacOS

c. a device running a non-embedded version of Linux

d. a device running a version or derivative of the Android OS, where Android is considered separate from Linux

e. a device running a version of Apple iOS

1.4.2 Network Connected

A component is network connected (or "connected to a network") only when the device has a network transceiver which is directly connected to the network and implements the network protocol. A device lacking a network transceiver (and accompanying protocol implementation) can never be considered network connected. Note that a device connected to a non-IP network is still considered network connected (an IP connection or IP address is not required for a device to be network connected).

Any device that supports wireless communication is network connected, regardless of whether the device is communicating using wireless .

1.4.3 User Account Support Levels

The support for user accounts is categorized in this Section as one of three levels:

1.4.3.1 FULLY Supported

Device supports configurable individual accounts. Accounts can be created, deleted, modified, etc. Privileges can be assigned to accounts.

1.4.3.2 MINIMALLY Supported

Device supports a small, fixed number of accounts (perhaps only one).

Accounts cannot be modified. A device with only a "User" and an "Administrator" account would fit this category. Similarly, a device with two PINs for logon - one for restricted and one for unrestricted rights would fit here (in other words, the accounts do not have to be the traditional "user name and password" structure).

1.4.3.3 NOT Supported

Device does not support any Access Enforcement therefore the whole concept of "account" is meaningless.

SECTION 25 05 11.01 Page 5

1.4.4 User Interface

Generally, a user interface is hardware on a device allowing user interaction with that device via input (buttons, switches, sliders, keyboard, touch screen, etc.) and a screen. There are three types of user interfaces defined in this Section: Limited Local User Interface, Full Local User Interface and Remote User Interface. In this Section, when the term "User Interface" is used without specifying which type, it refers only to Full Local User Interface and Remote User Interface (NOT to Limited Local User Interface).

1.4.4.1 Limited Local User Interface

A Limited Local User Interface is a user interface where the interaction is limited, fixed at the factory, and cannot be modified in the field.

The user must be physically at the device to interact with it.

Examples of Limited Local User Interface include thermostats (Space Sensor Modules as defined in Section 23 09 13 INSTRUMENTATION AND CONTROL DEVICES

FOR HVAC).

1.4.4.2 Full Local User Interface

A Full Local User Interface is a user interface where the interaction and displays are field-configurable.

Examples of a Full Local User Interface include local applications on a computer and user interfaces to Variable Speed Drives .

1.4.4.3 Remote User Interface

A Remote User Interface is a user interface on a Client device allowing user interaction with a different Server device. The user need not be physically at the Server device to interact with it.

Examples of Remote User Interfaces include web browsers and Local Display Panels as defined in Section 23 09 00 INSTRUMENTATION AND CONTROL FOR HVAC .

1.5 ADMINISTRATIVE REQUIREMENTS

1.5.1 Coordination

Coordinate the execution of this Section with the execution of all other Sections related to control systems as indicated in the paragraph RELATED REQUIREMENTS. Items that must be considered when coordinating project efforts include but are not limited to:

a. If requesting permission for wireless communication, the Wireless Communication Request submittal must be approved prior to control system device selection and integration.

b. If requesting permission for alternate account lock permissions, the Device Account Lock Exception Request must be approved prior to control system device selection and integration.

c. If requesting permission for the use of a device with multiple IP connections, the Multiple IP Connection Device Request must be approved prior to control system device selection and integration.

SECTION 25 05 11.01 Page 6

d. If the Device Audit Record Upload Software is to be installed on a computer not being provided as part of the control system, coordination is required to identify the computer on which to install the software.

e. Cybersecurity Interconnection Schedule must be coordinated with other work that will be interconnected to, and interconnections must be approved by the Government before relying on them for system functionality.

f. Cybersecurity testing support must be coordinated across control systems and with the Government cybersecurity testing schedule.

g. Passwords must be coordinated with the indicated contact for the project site.

h. If applicable, HTTP web server certificates must be obtained from the indicated contact for the project site.

i. Contractor Computer Cybersecurity Compliance Statements for each contractor using contractor owned computers.

j. All work within this specification must be coordinated with the designated System Cybersecurity Subject Matter Expert (SME), Computing Environment (System Administrator), and Networking Personnel, including but not limited to, Security Technical Implementation Guides (STIGs), Cybersecurity testing, Vulnerability Scanning, etc.

1.6 SUBMITTALS

Government approval is required for submittals with a "G" designation;

submittals not having a "G" designation are for information only. When used, a designation following the "G" designation identifies the office that will review the submittal for the Government. Submit the following in accordance with Section 01 33 00 SUBMITTAL PROCEDURES:

SD-01 Preconstruction Submittals

Multiple IP Connection Device Request; G

Contractor Computer Cybersecurity Compliance Statements; G

Contractor Temporary Network Cybersecurity Compliance Statements;G

Information Systems Security Manager; G

SD-02 Shop Drawings

User Interface Banner Schedule; G

Network Communication Report; G

Cybersecurity Riser Diagram; G

Control System Inventory Report; G

Cybersecurity Interconnection Schedule; G

SECTION 25 05 11.01 Page 7

SD-03 Product Data

Control System Cybersecurity Documentation; G

SD-07 Certificates

Software Licenses; G

SD-11 Closeout Submittals

Password Summary Report; G

Software Recovery And Reconstitution Images; G

Device Audit Record Upload Software; G

1.7 QUALITY CONTROL

1.7.1 Qualifications

For the positions listed below resumes should be submitted to the Government within 14 days after notice to proceed. All certifications must be in effect prior to being hired.

These positons may serve across the contract.

1.7.1.1 Cybersecurity Subject Matter Expert

The individual will oversee all work within this specification. This position requires that the individual currently meets Information Assurance Manager Level II Certification in accordance with DoDI 8570 Information Workforce Improvement Program.

Individuals for this position should have experience securing DoD Systems and with Risk Management Framework. Control System Experiece is highly desireable.

1.7.2 Information Systems Security Manager (ISSM)

The contractor is responsible of hiring an Information Systems Security Manager. The Information Systems Security Manager (ISSM) is responsible for hardening the new building DDC system. The ISSM must meet the criteria as defined by AMC and will be registered in eMASS.

1.8 CYBERSECURITY DOCUMENTATION

1.8.1 Cybersecurity Interconnection Schedule

{For Reference Only: This subpart (and its subparts) relates to CA-3(b), CCI-00258}

Provide a completed Cybersecurity Interconnection Schedule documenting connections between the installed system and other systems. Provide the following information for each device communicating between systems:

Device Identifier, Device Description, Transport layer Protocol, Network Address, Port (if applicable), MAC (Layer 2) address (if applicable), Media, Application Protocol, Service (if applicable), Descriptive Purpose of communication. For communication with other authorized systems also provide the Foreign Destination and POC for Destination. If other control

SECTION 25 05 11.01 Page 8 system Sections used on this project include submittals documenting this information, provide copies of those submittals to meet this requirement.

In addition to the requirements of Section 01 33 00 SUBMITTAL PROCEDURES, provide the Cybersecurity Interconnection Schedule as an editable Microsoft Excel file (a template Cybersecurity Interconnection Schedule in Excel format is available at http://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/ forms-graphics-tables .)

1.8.2 Network Communication Report

{For Reference Only: This subpart (and its subparts) relates to CA-9;

CCI-002102, CCI-002103, CCI-002104, CCI-002105 and also the submittal requirements associated with CM-6, CM-7 and SC-41 }

Provide a network communication report. For each networked controller, document the communication characteristics of the controller including communication protocols, services used, and a general description of what information is communicated over the network. For each controller using IP, document all TCP and UDP ports used. If other control system Sections used on this project include submittals documenting this information, provide copies of those submittals to meet this requirement.

In addition to the requirements of Section 01 33 00 SUBMITTAL PROCEDURES, provide the Network Communication Report as an editable Microsoft Excel file.

1.8.3 Control System Inventory Report

{For Reference Only: This subpart (and its subparts) relates to CM-8(a), CP-12, SI-17, IA-3; CCI-000389, CCI-000392, CCI-000398, CCI-002855, CCI-002856, CCI-002857, CCI-002773, CCI-002774, CCI-002775, CCI-000777, CCI-000778, CCI-001958}

Provide a Control System Inventory report using the Inventory Spreadsheet listed under this Section at http://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs /forms-graphics-tables documenting all networked devices, including network infrastructure devices. For each device provide all applicable information for which there is a field on the spreadsheet in accordance with the instructions on the spreadsheet.

In addition to the requirements of Section 01 33 00 SUBMITTAL PROCEDURES, provide the Control System Inventory Report as an editable Microsoft Excel file.

1.8.4 Software Recovery and Reconstitution Images

{For Reference Only: This subpart (and its subparts) relates to CP-10;

CCI-000550, CCI-000551, CCI-000552}

For control system devices installed under this project, provide a recovery image of the final as-built computer. This image must allow for bare-metal restore such that restoration of the image is sufficient to restore system operation to the imaged state without the need for re-installation of software.

If additional user permissions are required to meet this requirement, SECTION 25 05 11.01 Page 9 coordinate the creation of the image with the contracting officer.

1.8.5 Cybersecurity Riser Diagram

{For Reference Only: This subpart (and its subparts) relates to PL-2(a);

CCI-003051, CCI-003053}

Provide a cybersecurity riser diagram of the complete control system including all network and controller hardware. If the control system specifications require a riser diagram submittal, provide a copy of that submittal as the cybersecurity riser diagram. Otherwise, provide a riser diagram in one-line format overlayed on a facility schematic.

1.8.6 Control System Cybersecurity Documentation

This subpart (and its subparts) relates to SA-5 (a),(b),(c); CCIs:

CCI-003124, CCI-003125, CCI-003126, CCI-003127, CCI-003128, CCI-003129,

CCI-003130, CCI-003131}

Provide a Control System Cybersecurity Documentation submittal containing the indicated information for each device and software application.

1.8.6.1 For HVAC Control System Devices

1.8.6.1.1 HVAC Control System Devices FULLY Supporting User Accounts

For all HVAC Control System Devices which FULLY support user accounts, provide:

a. Documentation that describes secure configuration of the device {for reference only: relates to CCI-003124}

b. Documentation that describes secure operation of the device {for reference only: relates to CCI-003124}

c. Documentation that describes effective use and maintenance of security functions or mechanisms for the device {for reference only: relates to

CCI-003127}

d. Documentation that describes known vulnerabilities regarding configuration and use of administrative (i.e. privileged) functions for the device {for reference only: relates to CCI-003128}

e. Documentation that describes user-accessible security functions or mechanisms in the device and how to effectively use those security functions or mechanisms; or a specific indication that there are no user-accessible security functions or mechanisms in the device {for reference only: relates to CCI-003129}

f. Documentation that describes methods for user interaction which enables individuals to use the device in a more secure manner {for reference only: relates to CCI-003130}

1.8.6.1.2 All Other HVAC Control System Devices

For all HVAC Control System Devices which do not FULLY support user accounts, provide:

SECTION 25 05 11.01 Page 10

a. Documentation that describes secure configuration of the device; or a specific indication that there are no secure configuration steps that apply {for reference only: relates to CCI-003124}

b. Documentation that describes effective use and maintenance of security functions or mechanisms for the device; or a specific indication that there are no security functions or mechanisms in the device {for reference only: relates to CCI-003127}

c. For devices which include a user interface, documentation that describes methods for user interaction which enables individuals to use the device in a more secure manner {for reference only: relates to

CCI-003130}

1.8.6.2 Default Requirements for Control System Devices

For control system devices where Control System Cybersecurity Documentation requirements are not otherwise indicated in this Section, provide:

a. Documentation that describes secure configuration of the device {for reference only: relates to CCI-003124}

b. Documentation that describes secure installation of the device {for reference only: relates to CCI-003125}

c. Documentation that describes secure operation of the device {for reference only: relates to CCI-003124}

d. Documentation that describes effective use and maintenance of security functions or mechanisms for the device {for reference only: relates to

CCI-003127}

e. Documentation that describes known vulnerabilities regarding configuration and use of administrative (i.e. privileged) functions for the device {for reference only: relates to CCI-003128}

f. Documentation that describes user-accessible security functions or mechanisms in the device and how to effectively use those security functions or mechanisms {for reference only: relates to CCI-003129}

g. Documentation that describes methods for user interaction which enables individuals to use the device in a more secure manner {for reference only: relates to CCI-003130}

h. Documentation that describes user responsibilities in maintaining the security of the device {for reference only: relates to CCI-003131}

1.9 SOFTWARE UPDATE LICENSING

{For Reference Only: This subpart (and its subparts) relates to SI-2 (a),(c); CCI-001227, CCI-002605}

In addition to all other licensing requirements, all software licensing must include licensing of the following software updates for a period of no less than 5 years:

a. Security and bug-fix patches issued by the software manufacturer.

SECTION 25 05 11.01 Page 11

b. Security patches to address any vulnerability identified in the National Vulnerability Database at http://nvd.nist.gov with a Common Vulnerability Scoring System (CVSS) severity rating of MEDIUM or higher.

Provide a single Software Licenses submittal with documentation of the software licenses for all software provided

1.10 CYBERSECURITY DURING CONSTRUCTION

{For Reference Only: This subpart (and its subparts) relates to AC-18, SA-3, CCI-00258}

In addition to the control system cybersecurity requirements indicated in this section, meet following requirement throughout the construction process.

1.10.1 Contractor Computer Equipment

Contractor owned computers may be used for construction. When used, contractor computers must meet the following requirements:

1.10.1.1 Operating System

The operating system must be an operating system currently supported by the manufacturer of the operating system. The operating system must be current on security patches and operating system manufacturer required updates.

1.10.1.2 Anti-Malware Software

The computer must run anti-malware software from a reputable software manufacturer. Anti-malware software must be a version currently supported by the software manufacturer, must be current on all patches and updates, and must use the latest definitions file. All computers used on this project must be scanned using the installed software at least once per day.

1.10.1.3 Passwords and Passphrases

The passwords and passphrases for all computers must be changed from their default values. Passwords must be a minimum of eight characters with a minimum of one uppercase letter, one lowercase letter, one number and one special character.

1.10.1.4 Contractor Computer Cybersecurity Compliance Statements

Provide a single submittal containing completed Contractor Computer Cybersecurity Compliance Statements for each company using contractor owned computers. Contractor Computer Cybersecurity Compliance Statements must use the template published at http://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/ forms-graphics-tables . Each Statement must be signed by a cybersecurity representative for the relevant company.

1.10.2 Temporary IP Networks

Temporary contractor-installed IP networks may be used during construction. When used, temporary contractor-installed IP networks must meet the following requirements:

SECTION 25 05 11.01 Page 12

1.10.2.1 Network Boundaries and Connections

The network must not extend outside the project site and must not connect to any IP network other than IP networks provided under this project or Government furnished IP networks provided for this purpose. Any and all network access from outside the project site is prohibited.

1.10.3 Government Access to Network

Government personnel must be allowed to have complete and immediate access to the network at any time in order to verify compliance with this specification

1.10.4 Temporary Wireless IP Networks

In addition to the other requirements on temporary IP networks, temporary wireless IP (WiFi) networks must not interfere with existing wireless network and must use WPA2 security. Network names (SSID) for wireless networks must be changed from their default values.

1.10.5 Passwords and Passphrases

The passwords and passphrases for all network devices and network access must be changed from their default values. Passwords must be a minimum 8 characters with a minimum of one uppercase letter, one lowercase letter, one number and one special character.

1.10.6 Contractor Temporary Network Cybersecurity Compliance Statements

Provide a single submittal containing completed Contractor Temporary Network Cybersecurity Compliance Statements for each company implementing a temporary IP network. Contractor Temporary Network Cybersecurity Compliance Statements must use the template published at http://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/ forms-graphics-tables . Each Statement must be signed by a cybersecurity representative for the relevant company. If no temporary IP networks will be used, provide a single copy of the Statement indicating this.

1.11 CYBERSECURITY DURING WARRANTY PERIOD

All work performed on the control system after acceptance must be performed using Government Furnished Equipment or equipment specifically and individually approved by the Government.

PART 2 PRODUCTS

(NOT USED)

PART 3 EXECUTION

3.1 ACCESS CONTROL REQUIREMENTS

3.1.1 User Accounts

{For Reference Only: This subpart (and its subparts) relate to AC-2(a)and

AC-3; CCI-002110, CCI-000213.}

Any device supporting user accounts (either FULLY or MINIMALLY) must limit

SECTION 25 05 11.01 Page 13 access to the device according to specified limitations for each account.

Install and configure any device having a STIG or SRG in accordance with that STIG or SRG.

3.1.1.1 For HVAC Control System Devices

Devices with web interfaces must either FULLY support user accounts or have their web interface disabled. Field devices with full local user interfaces allowing modification of data must at least MINIMALLY support user accounts.

3.1.1.2 Default Requirements for Control System Devices

For control system devices where User Account requirements are not otherwise indicated in this Section:

a. Devices with web interfaces must either FULLY support user accounts or have their web interface disabled.

b. Field devices with full local user interfaces allowing modification of data must at least MINIMALLY support user accounts.

c. Field devices with read-only full local user interfaces must at least MINIMALLY support user accounts.

3.1.2 Unsuccessful Logon Attempts

{For Reference Only: This subpart (and its subparts) relate AC-7 (a), AC-7 (b); CCI-000043, CCI-000044, CCI-001423, CCI-002236, CCI-002237, CCI-002238}

Except for high availability user interfaces indicated as exempt, devices must meet the indicated requirements for handling unsuccessful logon attempts.

3.1.2.1 Devices MINIMALLY Supporting Accounts

Devices which MINIMALLY support accounts are not required to lock based on unsuccessful logon attempts.

3.1.2.2 Devices FULLY Supporting Accounts

Devices which FULLY support accounts must meet the following requirements. Do not implement alternate protection measures without explicit permission from the Government.

a. It must lock the user account when three unsuccessful logon attempts occur within a 15 minute interval.

b. Once an account is locked, the account must stay locked until unlocked by an administrator.

c. Once the indicated number of unsuccessful logon attempts occurs, delay further logon prompts by 5 seconds.

3.1.2.3 High Availability Interfaces Exempt from Unsuccessful Logon Attempts Requirements

There are no high availability interfaces which are exempt from

SECTION 25 05 11.01 Page 14 unsuccessful logon attempts requirements.

3.1.3 System Use Notification

{For Reference Only: This subpart (and its subparts) relates to AC-8;

CCI-000048, CCI-002247, CCI-002243, CCI-002244, CCI-002245, CCI-002246,

CCI-000050, CCI-002248}

Web interfaces must display a warning banner meeting the requirements of

DTM 08-060 .

Devices which are connected to a network and have a user interface must display a warning banner meeting the requirements of DTM 08-060 if capable of doing so. Devices which are connected to a network and have a user interface but are not capable of displaying a banner must have a permanently affixed label displaying an approved banner from DTM 08-060 .Labels must be machine printed or engraved, plastic or metal, designed for permanent installation, must use a font no smaller than 14 point, and must provide a high contract between font and background colors.

3.1.3.1 User Interface Banner Schedule

Provide a User Interface Schedule using the format indicated showing each user interface provided and how the information banner requirement has been implemented for each user interface.

User I nt er f ace Schedul e For mat ( wi t h sampl e ent r i es)

User I nt er f ace Description

User I nt er f ace Location

Type of User Interface

Banner I mpl ement at i on

Sample 1 Room 1 Remote DTM 08-060 Banner "A" Displayed at Logon

Sample 2 Room 2 Limited Local DTM 08-060 Banner "B" on Affixed Label

Sample 3 Room 3 Full Local DTM 08-060 Banner "B" Displayed on Screen

3.1.4 Permitted Actions Without Identification or Authentication

{For Reference Only: This subpart (and its subparts) relates to AC-14;

CCI-000061, CCI-000232}

The control system must require identification and authentication before allowing any actions by a user acting from a user interface which MINIMALLY or FULLY supports accounts.

3.1.5 Wireless Access

{For Reference Only: This subpart (and its subparts) relates to AC-18;

CCI-001438, CCI-001439, CCI-002323, CCI-001441}

Unless explicitly authorized by the Government, do not use any wireless

SECTION 25 05 11.01 Page 15 communication. Any device with wireless communication capability is considered to be using wireless communication, regardless of whether or not the device is actively communicating wirelessly, except when wireless communication has been physically permanently disabled (such as through the removal of the wireless transceiver).

3.1.5.1 Non-IP Wireless Communication

When non-IP wireless communication is explicitly authorized by the Government, use the maximum level of encryption supported by the specific protocol employed and select signal strength and radiated power to the minimum necessary for reliable communication.

3.2 CYBERSECURITY AUDITING

3.2.1 Audit Events, Content of Audit Records, and Audit Generation

{For Reference Only: This subpart (and its subparts) relates to AU-2(a),(c),(d), AU-3, AU-12; CCI-000123, CCI-001571, CCI-000125, CCI-001485, CCI-000130, CCI-000131, CCI-000132, CCI-00133, CCI-000134, CCI-001487, CCI-000169, CCI-001459, CCI-000171, CCI-000172, CCI-001910}

For devices that have STIG/SRGs related to audit events, content of audit records or audit generation, comply with the requirements of those STIG/SRGs.

3.2.1.1 For HVAC Control System Devices

3.2.1.1.1 HVAC Control System Devices FULLY Supporting User Accounts

For devices FULLY supporting accounts, provide the capability to select audited events, and the contents of audit logs. Configure devices to audit the following events:

a. Successful and unsuccessful logon attempts to the device

b. Starting and ending time for user access to the device

c. All account creations, modifications, disabling, and terminations

d. All device shutdown and startup

Configure the device to record for each event the following information (as applicable): the type of event, when the event occurred and the identity of any individuals or subjects associated with the event

3.2.1.1.2 Other HVAC Control System Devices

There are no requirements to perform auditing at HVAC field devices that do not FULLY support accounts.

3.2.1.2 Default Requirements for Control System Devices

For control system devices where Audit Events, Content of Audit Records, and Audit Generation are not otherwise indicated in this Section:

3.2.1.2.1 Devices Which FULLY Support Accounts

For each device which FULLY supports accounts, provide the capability to

SECTION 25 05 11.01 Page 16 select audited events and the content of audit logs. Configure devices to audit the indicated events, and to record the indicated information for each auditable event

3.2.1.2.1.1 Audited Events

Configure each device to audit the following events:

a. Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g. classification levels)

a. Successful and unsuccessful logon attempts

b. Privileged activities or other system level access

c. Starting and ending time for user access to the system

d. Concurrent logons from different workstations

e. All account creations, modifications, disabling, and terminations

f. All kernel module load, unload, and restart

3.2.1.2.1.2 Audit Event Information To Record

3.2.1.2.2 Devices Which Do Not FULLY Support Accounts

For each Device which does not FULLY support accounts configure the device to audit all device shutdown and startup events and to record for each event the type of event and when the event occurred.

3.2.2 Audit Storage Capacity and Audit Upload

{For Reference Only: This subpart (and its subparts) relates to AU-4;

CCI-001848, CCI-001849}

a. For devices that have STIG/SRGs related to audit storage capacity (CCI-001848 or CCI-001849) comply with the requirements of those STIG/SRGs.

b. For non-computer control system devices capable of generating audit records, provide 60 days worth of secure local storage, assuming 10 auditable events per day.

3.2.2.1 Device Audit Record Upload Software

For each non-computer device required to audit events, provide, and license to the Government, software implementing a secure mechanism of uploading audit records from the device to a computer and of exporting the uploaded audit records as a Microsoft Excel file or comma separated value text file. Where different devices use different software, provide software of each type required to upload audit logs from all devices.

Submit copies of device audit record upload software. If there are no non-computer devices requiring auditing, provide a document stating this in lieu of this submittal.

SECTION 25 05 11.01 Page 17

3.2.3 Time Stamps

{For Reference Only: This subpart (and its subparts) relates to AU-8;

CCI-000159, CCI-001889, CCI-001890}

3.2.3.1 For HVAC Control System Devices

Time stamp requirements for HVAC Control Systems are as indicated in the HVAC Control System specifications.

3.2.3.2 Default Requirements for Control System Devices

For control system devices where Time Stamps requirements are not otherwise indicated in this Section: Devices generating audit records must have internal clocks capable of providing time with a resolution of 1 second. Clocks must not drift more than 10 seconds per day. Configure the system so that each device generating audit records maintains accurate time to within 1 second.

3.3 REQUIREMENTS FOR LEAST FUNCTIONALITY

{For Reference Only: This subpart (and its subparts), along with the network communication report submittal specified elsewhere in this section, relates to CM-6 (a), (c), CM-7, CM-7 (1)(b), SC-41; CCI-000363, CCI-000364, CCI-000365, CCI-001588, CCI-001755, CCI-000381, CCI-000380, CCI-00382, CCI-001761, CCI-001762, CCI-002544, CCI-002545, CCI-002546.}

For devices that have a STIG or SRG related to Requirements for Least Functionality (such as configuration settings and port and device I/O access for least functionality), install and configure the device in accordance with that STIG or SRGs.

For HVAC Control Systems: Do not provide devices with user interfaces where one was not required. Do not use a networked sensor or actuator where a non-networked sensor or actuator would suffice.

For Other Control Systems: Do not provide devices with user interfaces where one was not required. Do not use a networked sensor or actuator where a non-networked sensor or actuator would suffice.

3.3.1 Non-IP Control Networks

When control system specifications require particular communication protocols, use only those communication protocols and only as specified.

Do not implement any other communication protocol, or use any protocol on ports other than those specified.

When control system specifications do not indicate requirements for communication protocols, use only those protocols required for operation of the system as specified.

3.3.2 IP Control Networks

Do not use nonsecure functions, ports, protocols and services as defined in DODI 8551.01 unless those ports, protocols and services are specifically required by the control system specifications or otherwise specifically authorized by the Government. Do not use ports, protocols and services that are not specified in the control system specifications or required for operation of the control system.

SECTION 25 05 11.01 Page 18

3.4 SAFE MODE AND FAIL SAFE OPERATION

{For Reference Only: This subpart (and its subparts) relates to CP-12, SI-17; CCI-002855, CCI-002856, CCI-002857, CCI-002773, CCI-002774, CCI-002775}

For all control system components with an applicable STIG or SRG, configure the component in accordance with all applicable STIGs and SRGs.

3.5 IDENTIFICATION AND AUTHENTICATION

3.5.1 User Identification and Authentication

{For Reference Only: This subpart (and its subparts) relates to

IA-2,(1),(12); CCI-000764, CCI-000765, CCI-001953, CCI-001954}

a. Devices that FULLY support accounts must uniquely identify and authenticate organizational users.

b. Devices which allow network access to privileged accounts must implement multifactor authentication for network access to privileged accounts.

3.5.1.1 HVAC Control Systems Devices

Identification and Authentication for network access to privileged accounts must be implemented by either accepting and electronically verify Personal Identity Verification (PIV) credentials or inheriting identification and authentication from the operating system.

3.5.1.2 Default Requirements for Control System Devices

For control system devices where User Identification and Authentication requirements are not otherwise indicated in this Section, User Identification and Authentication for network access to privileged accounts must be implemented by accepting and electronically verify Personal Identity Verification (PIV) credentials.

3.5.2 Authenticator Management

{For Reference Only: This subpart (and its subparts) relates to IA-5 (b),(c),(e),(g),(1),(11); CCI-000176, CCI-001544, CCI-001989, CCI-000182, CCI-001610, CCI-000192, CCI-000193, CCI-000194, CCI-000205, CCI-001619, CCI-001611, CCI-001612, CCI-001613, CCI-001614, CCI-000195, CCI-001615, CCI-000196, CCI-000197, CCI-000199, CCI-000198, CCI-001616, CCI-001617, CCI-000200, CCI-001618, CCI-002041, CCI-002002, CCI-002003}

3.5.2.1 Authentication Type

3.5.2.1.1 For HVAC Control System Devices

Unless otherwise indicated:

a. Other devices which FULLY support accounts must use password-based authentication.

b. Devices MINIMALLY supporting accounts must use password-based authentication.

SECTION 25 05 11.01 Page 19

3.5.2.1.2 Default Requirements for Control System Devices

For control system devices where Authentication Type requirements are not otherwise indicated in this Section:

a. Other devices which FULLY support accounts must use either password-based authentication or hardware token-based authentication.

b. Devices MINIMALLY supporting accounts must use either password-based authentication or hardware token-based authentication.

3.5.2.2 Password-Based Authentication Requirements

3.5.2.2.1 Passwords for Non-Computer Devices FULLY Supporting Accounts

All non-computer devices FULLY supporting accounts and supporting password-based authentication must enforce the following requirements:

a. Minimum password length of twelve (12) characters

b. Password must contain at least one uppercase character.

c. Password must contain at least one lowercase character.

d. Password must contain at least one numeric character.

e. Password must contain at least one special character.

f. Password must have a maximum lifetime of sixty (60) days. When passwords expire, prompt users to change passwords. Do no lock accounts due to expired passwords.

g. Password must differ from previous five (5) passwords, where differ is defined as changing at least fifty percent of the characters.

h. Passwords must be cryptographically protected during storage and transmission.

3.5.2.2.2 Passwords for Web Interfaces

Passwords for connecting to a web interface supporting password-based authentication must enforce the following requirements:

a. Minimum password length of 12 characters

b. Password must contain at least one uppercase…