Amd 01 - Specification 25 05 11.pdf

Powerhouse Elevator No. 2 Rehab - Big Bend Dam BB97

SECTION TABLE OF CONTENTS

DIVISION 25 - INTEGRATED AUTOMATION

Amendment ##001 SECTION 25 05 11.00 28

CYBERSECURITY FOR CIVIL WORKS OPERATIONAL TECHNOLOGY

PART 1 GENERAL

1.1 GENERAL INFORMATION

1.2 REFERENCES

1.3 SUBMITTALS

1.3.1 Encrypted Submittal Requirements

1.3.2 Submittals of Lists

1.4 DEFINITIONS

1.5 CONTRACTOR PERSONNEL

1.6 CONTRACTOR PORTABLE ELECTRONIC DEVICES (PED)

1.6.1 Prohibited Activities

1.7 CYBERSECURITY REQUIREMENTS

1.8 SECURE CONFIGURATIONS OF COMPUTER OPERATING SYSTEMS

1.8.1 Principle of Least Privilege

1.8.1.1 Service Level Accounts

1.8.1.2 Operator Level Accounts

1.8.1.3 Administration Level Accounts

1.8.2 Application Separation

1.9 BASIC INPUT/OUTPUT SYSTEM (BIOS)/ UNIFIED EXTENSIBLE FIRMWARE

INTERFACE (UEFI) PROTECTION

1.10 LOGGING AND AUDITING

1.11 COMMUNICATIONS

1.11.1 Secure Network Design Considerations

1.11.2 Safety Systems

1.11.3 Protective Systems

1.11.4 Meters

1.11.5 Switchyard Components

1.11.6 Critical Components/Subsystems

1.11.7 Field Bus Systems

1.11.8 Industrial Control System (ICS) Management Zone

1.11.9 Operating System (OS) Management Zone

1.11.10 Network Management Zone

1.11.11 External Demilitarized Zone(DMZ)Connetion Zone

1.11.12 Wireless

1.11.13 Intrusion Detection

1.12 CONTROL DEVICE CODE PROTECTION

1.13 LOCKING PROVISIONS

1.14 REMOTE ACCESS

PART 2 PRODUCTS

2.1 COMPLETE SOFTWARE LIST

2.1.1 Antivirus/Antimalware Software

2.2 COMPLETE HARDWARE LIST

2.3 PORTS, PROTOCOLS, AND SERVICES LIST (Encrypted)

2.4 SYSTEM NETWORK DOCUMENTATION

2.5 DEFAULT PASSWORDS

2.6 ACCOUNT MANAGEMENT

SECTION 25 05 11 Page 1

Am-0001

2.7 INITIAL BACKUPS

2.7.1 Backup Software

PART 3 EXECUTION

3.1 UNNECESSARY SOFTWARE AND SERVICES

3.2 SECURITY CONFIGURATION

3.3 FIELD QUALITY CONTROL

3.3.1 Training

3.3.2 Cybersecurity Field Verification

3.3.2.1 Cybersecurity Field Verification Request

3.3.2.2 Verification for Each System

-- End of Section Table of Contents --

SECTION 25 05 11 Page 2

Amendment ##001 SECTION 25 05 11.00 28

CYBERSECURITY FOR CIVIL WORKS OPERATIONAL TECHNOLOGY

PART 1 GENERAL

1.1 GENERAL INFORMATION

a. This section covers the cybersecurity requirements for Operational Technology (OT) in order to verify and deliver components to the Project in an Interim Secure State (ISS).

b. ISS is achieved when the cybersecurity risk for the OT is known and the system has been verified to be technically and physically secure to an acceptable risk tolerance during the installation phase.

c. The requirements of this SECTION apply to the following Specifications SECTIONS:

01 11 00 SUMMARY OF WORK

14 21 23 ELECTRIC TRACTION PASSENGER ELEVATORS

26 20 00 INTERIOR DISTRIBUTION SYSTEM

28 31 70 INTERIOR FIRE ALARM SYSTEM, ADDRESSABLE

Specification Section 01 11 00 will provide a description of the scope of work. Specification Sections, 14 21 23 and 26 20 00 provide requirements for related control systems being added to the facility as part of the scope of work. Specification Section 28 31 70 provides requirements for modifying the existing addressable fire alarm system, and, depending upon modifications may require cybersecurity hardening.

1.2 REFERENCES

The publications listed below form a part of this section to the extent referenced. The publications are referred to within the text by the basic designation only.

U.S. DEPARTMENT OF DEFENSE (DOD)

DOD Directive 8140.01 (2015) Cyberspace Workforce Management

DOD 8500.01 (2014) Cybersecurity

DOD 8510.01 (2014; Change 1-2016) Risk Management Framework (RMF) for DoD Information Technology (IT)

DOD 8570.01-M (2005; Change 4, 2015) Information Assurance Workforce Improvement Program

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST)

NIST FIPS 140-2 (2001) Security Requirements for Cryptographic Modules

SECTION 25 05 11 Page 3

NIST SP 800-37 (2018; Revision 2) Risk Management Framework for Information Systems and Organizations

U.S. ARMY (DA)

DA PAM 25-2-6 (2019)Cybersecurity Training and Certification Program

DA PAM 25-2-13 (2019)Army Identity, Credential, and Access Management and Public Key Infrastructure Implementing Instruction

1.3 SUBMITTALS

Government approval is required for submittals with a "G" designation;

USACE Critical Infrastructure Cybersecurity Mandatory Center of Expertise(UCIC-MCX)review is required for submittals with a "CS" designation; submittals having an "I" designation are for information only. Designation following the "G", "CS", or "I" designation identifies the office that will review the submittal for the Government. Submit in accordance with SECTION 1-3-1 SUBMITTAL REQUIREMENTS:

SD-01 Preconstruction Submittals

Account Level Permissions List (Encrypted); G, CS Sensitive Data Protection Plan (Encrypted); G, CS Operational Technology / Control Systems Acceptable Use Policy; G, CS

SD-02 Shop Drawings

Network Diagram (Encrypted); G, CS System Data Flow Diagram (Encrypted); G, CS

SD-03 Product Data

Pre-Construction Software List (Encrypted); G, CS Pre-Construction Hardware List (Encrypted); G, CS Complete Software List (Encrypted); G, CS Complete Hardware List (Encrypted); G, CS Ports, Protocols, and Services List (Encrypted); G, CS Certificate Protection Status (Encrypted); G, CS Backup Software (Encrypted); I, CS

SD-05 Design Data

Network Configuration Files (Encrypted); G, CS Deviations List (Encrypted); G, CS

SD-06 Test Reports

SCAP Tool Scan (Encrypted); G, CS STIG Veiwer Checklists (Encrypted); G, CS Antivirus/Antimalware Scan (Encrypted); G, CS

SD-07 Certificates

SECTION 25 05 11 Page 4

Contractor Personnel Qualifications; G, CS

SD-11 Closeout Submittals

Vulnerability Resolution Report (Encrypted); G, CS Comprehensive Password/Passphrase List (Encrypted); G, CS Comprehensive Account List (Encrypted); G, CS Initial Backups (Encrypted); G, CS BIOS/UEFI Protection Password/Passphrase List (Encrypted); G, CS

1.3.1 Encrypted Submittal Requirements

a. The submission process and authorized recipients for submittals specified as "Encrypted" must be provided at the Pre-Work meeting.

b. Encrypted submittals must be sent via DoD SAFE https://safe.apps.mil/ If DoD SAFE is not available, Contractor must have a prior approval from the UCIC for using similar method of submittal.

c. Data for encrypted submittals is sensitive and must be protected by the Contractor. Contractor must only disclose sensitive information to those who need to know. Sensitive information must not be stored on shared storage systems. Spreadsheets must be password protected.

Submit a list of individuals authorized to access the sensitive information and a Sensitive Data Protection Plan (encrypted).

1.3.2 Submittals of Lists

Contractor must submit the following using a Government-provided template.

Templates will be provided to the Contractor upon request after Notice to Proceed.

a. Pre-Construction Software List.

b. Pre-Construction Hardware List.

c. Complete Software List.

d. Complete Hardware List.

e. Ports, Protocols, and Services List.

f. Comprehensive Password/Passphrase List.

g. Comprehensive Account List.

h. BIOS Protection Password/Passphrase List.

i. Certificate Protection Status List.

j. Deviation List.

k. Operational Technology / Control System Acceptable Use Policy

1.4 DEFINITIONS

1.4.1 Architecture Type: The level of interconnectivity of an Operational Technology (OT) is a foundational criterion used when

SECTION 25 05 11 Page 5 determining the priority of a system. The more connectivity capability, the higher the likelihood that the system can be compromised through a cyber-attack. There are three main types of interconnection: no interconnection (OT Product, OT Subsystem), closed restricted network connection (OT Closed Restricted System), and interconnected (OT Restricted Interconnected System and OT Connected System).

1.4.2 Boundary Defense: When Operational Technology (OT) information travels outside the physical boundary, the information flow must be protected against outside threats. Firewalls should be used to isolate networks and protect data flow by restricting unnecessary traffic, both inbound and outbound. Traffic flows should also be encrypted using a VPN. Intrusion Detection should be used to alert on malicious or unauthorized traffic. For Operational Technology (OT) that requires information flow between the control network to an external boundary, e.g. Hydrology Reports, the connection will be protected using a data diode or unidirectional gateway instead of a firewall for additional protection.

1.4.3 BIOS: Basic Input/Output System. Fundamental system firmware used to boot and initialize system.

1.4.4 CCI: Control Correlation Identifier. The Control Correlation Identifier (CCI) provides a standard identifier and description for each of the singular, actionable statements that comprise an IA control or IA best practice. CCI bridges the gap between high-level policy expressions and low-level technical implementations. CCI allows a security requirement that is expressed in a high-level policy framework to be decomposed and explicitly associated with the low-level security setting(s) that must be assessed to determine compliance with the objectives of that specific security control. This ability to trace security requirements from their origin (e.g., regulations, Information Assurance frameworks) to their low-level implementation allows organizations to readily demonstrate compliance to multiple Information Assurance compliance frameworks. CCI also provides a means to objectively rollup and compare related compliance assessment results across disparate technologies.

1.4.5 CI: Critical Infrastructure. CI is defined as, "Systems & assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters (Critical Infrastructures Protection Act of 2001)."

1.4.6 Cybersecurity Function: A cybersecurity function is further defined as a user that is authorized (and therefore, trusted) to perform security-relevant functions that ordinary users are not authorized to perform. Examples of these activites include, but not limited to, creating/modifying user accounts, configuring auditing levels, configuring functionality of a device that is restricted from general users, network architecture design, and applying secure configuration to an Operating System or device.

1.4.7 IAVAs: Information Assurance Vulnerability Alerts. The

Department of Defense (DoD) information system vulnerabilities are alerted with messages called Information Assurance Vulnerability

SECTION 25 05 11 Page 6

Alerts (IAVA). Vulnerabilities are evaluated to see what impact (if any) the might have and sent out by to all branches and units within the organization.

1.4.8 Interconnection Capability: Architecture's Interconnection capability is determined via the communications that exist between Operational Technology line items, whether they share an information type or not. Interconnection capability also includes any type of connection between line items and an external network. Interconnection capability is considered a primary risk factor that affects all aspects of the cybersecurity program. Reviewing network device information from the inventory provides an understanding of the basic networking structure and communication capabilities between the various listed line items and builds a clearer picture of the scope of the potential system. The UCIC developed five OT architecture types based on regularly occurring interconnection capability: the OT product, OT subsystem, OT closed restricted system, OT restricted interconnected system, and OT connected system.

1.4.9 ISO: Information System Owner. Official responsible for the overall procurement, development, integration, modification, or operation and maintenance of an information system, such as the District Chief of Operations.

1.4.10 ISS: Interim Secure State. Interim Secure State is achieved when a USACE control system's risk is known and the system has been verified as being technically and physically secured to an acceptable risk tolerance, but it does not have all documentation and/or administrative requirements met for obtaining an Authority To Operate (ATO). ISS is used to verify that a new control system installation, or a system going through a major upgrade, is implementing critical security controls during the installation phase and meets a specific cybersecurity standard (defined in this document) prior to the government taking ownership. ISS is also used to verify that an existing control system is operating at an acceptable state of cybersecurity.

l.4.11 IT: Information Technology. Any equipment or interconnected system or subsystem of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the executive agency.

l.4.12 Network Segmentation: The control network must be segmented or segregated either by logical or physical methods. Examples of logical methods include firewall zones, VLANs, or VPNs. Physical separation is done by deploying additional hardware. Network segmentation is used for isolation of discrete functions or processes. Each network segment will have its own IP address space or subnet.

1.4.13 OT: Operational Technology. The hardware and software dedicated to detecting and/or causing changes in physical processes through direct monitoring and control of physical devices to accomplish a specific mission in real time.

1.4.14 OT Product: An OT Product (either individual or aggregate) is a PLC with a non-routable IP or serial connection to a touch panel with an embedded operating system, no connection to a computer or server, no communications using a routable protocol, and no connection to any

SECTION 25 05 11 Page 7 component outside the physical boundary of the project. This is the foundational building block for the more complex OT systems. It is important to note that the connection between the touch panel and the PLC must be a one-to-one physical connection. Any connection with routable communications will elevate the OT Product to an OT Subsystem.

There are circumstances, particularly in hydropower facilities, when there are multiple OT Products all accomplishing similar missions but are not interconnected in any way. The UCIC determines if aggregating those OT Products into one administrative grouping is beneficial for RMF reporting. If so, this becomes the OT Product aggregate. It is important to note that the aggregate does not indicate any type of routable communications being used, and therefore does not raise this to the “system” level; it is purely an administrative designation.

1.4.15 OT Subsystem: An OT Subsystem (either individual or aggregate) adds workstations or servers to the PLCs for operation from a control room utilizing a routable protocol (Ethernet). It is important to note that there is no connection to any component that resides outside the logical or physical boundary of the project. The UCIC, in coordination with the ISO, determines how far a project’s physical boundary extends for the OT to remain a subsystem. That distance may be different from project to project. It is possible to group multiple OT Subsystems together when they operate under a single ISO, have the same information type, and have similar system configurations. This is called an OT Subsystem aggregate.

1.4.16 OT Closed Restricted: An OT Closed Restricted System is a subsystem that is networked to another government-owned and government-operated subsystem for remote control or monitoring capabilities over encrypted communication channels. The communication over encrypted channels is controlled and maintained on both ends by the same ISO. This system is not connected to any external network, nor does it have an external network connection capability.

1.4.17 OT Restricted Interconnected System: An OT Restricted

Interconnected System is an OT subsystem or an OT system that has the capability to connect to an external system only through a single-directional push of data (e.g., alarms, trends, and alerts) via a data diode or equivalent technology.

1.4.18 OT Connected System: An OT Connected System is an OT Subsystem or OT System that has a bi-directional path between the OT and an external network.

1.4.19 RMF: Risk Management Framework. A structured approach used to oversee and manage risk for an enterprise. See DOD 8510.01 , and NIST SP 800-37 for information and requirements.

1.4.20 SHB: Secure Host Baseline, or Army Gold Master. An image for certain Windows-based operating systems is available from the Government, upon request.

1.4.21 STIGs: Security Technical Implementation Guides, as released by the Defense Information Security Agency (DISA). See https://public.cyber.mil/STIGS for information.

1.4.22 VLAN: Virtual LAN (Local Area Network). A subnetwork which can group together collections of devices on separate physical local area networks (LANs). A LAN is a group of computers and devices that share

SECTION 25 05 11 Page 8 a communications line or wireless link to a server within the same geographical area.

1.4.23 VM: Virtual Machine. A virtual machine is a computer file, typically called an image, that behaves like an actual computer. In other words, creating a computer within a computer. It runs in a window, much like any other program, giving the end user the same experience on a virtual machine as they would have on the host operating system itself.

1.5 CONTRACTOR PERSONNEL

a. The Contractor must ensure that personnel accessing Operational Technology (OT) systems have the proper and current cybersecurity certification to perform cybersecurity functions:

1. DOD Directive 8140.01 , Cyberspace Workforce Management.

2. DOD 8570.01-M , Information Assurance Workforce Improvement Program, Information Assurance Technical (IAT). See https://public.cyber.mil/cwmp/dod-approved-8570-baseline-certifications/ for Approved Baseline IAT Certifications.

3. DA PAM 25-2-6 , Cybersecurity Training and Certification Program

b. Submit Contractor personnel qualifications for acceptance a minimum of 30 days after notice to proceed.

c. All Contractors who will have access to make changes to the Operational Technology must sign the USACE OT/Control Systems Acceptable Use Policy (AUP), provided by the government prior to accessing the Operational Technology.

d. Contractor personnel must submit signed OT/Control Systems AUP to the government within 30 days of Notice to Proceed.

1.6 CONTRACTOR PORTABLE ELECTRONIC DEVICES (PED)

a. All Contractor personnel and equipment that will connect to USACE-owned systems are subject to the requirements of this SECTION.

This includes all Contractor equipment, including laptops and other portable devices, that will not be delivered to USACE as part of this contract.

b. All Contractor PEDs must be approved by the Contracting Officer (KO) or Contracting Officer's Representative (COR) for connection to USACE-owned systems prior to connection.

c. For compliance, security, and network maintenance purposes, authorized individuals within USACE may monitor equipment, systems, and network traffic at any time, per the existing acceptable use and audit policies. USACE reserves the right to audit networks and systems on a periodic basis to ensure compliance with Army policy.

Users connecting to USACE-owned equipment with approved PEDs consent to monitoring and inspection of their equipment.

d. PEDs approved for connection to USACE-owned systems equipment must meet the following requirements:

SECTION 25 05 11 Page 9

1. Be subject to scanning or checking by designated USACE personnel before being connected to any USACE-owned equipment.

This process will be repeated before connection each time the PED goes off-site (crosses the facility boundary).

2. Undergo regular maintenance ensuring the PED is patched and up to date and a current full antivirus scan has been completed within the previous 10 days.

3. Ensure the PED firewall is enabled and set to "Public".

4. Demonstrate that all required patching and software/firmware updates are applied, and compliance with any applicable STIGs (Security Technical Implementation Guides) version and release is achieved.

5. Employ data-at-rest encryption to protect information stored on the device. The types of information that must be protected include the following:

i. Site specific drawings.

ii. Configuration files.

iii. Project files.

iv. Vulnerability data.

v. Any specific information that could potentially lead to a compromise.

e. If limited connectivity to the Internet is required to update software patches and retrieve updated virus definitions, the following requirements must be met:

1. Computer will be disconnected from the Operational Technology (OT) completely before establishing a connection to the Internet.

2. The host-based firewall on the computer must be enabled and the network identifier for the Internet connection must be set to "Public".

3. After the software patches are applied and the virus definitions updated, the computer must be isolated from the Internet connection, and a full scan with the Antivirus Software completed, resulting with no detections, prior to connection to the USACE-owned equipment.

4. Prior to connecting to the equipment, network, or system, antivirus definition files must be verified to be less than seven days old and a full scan has been completed.

f. In the event that an authorized or approved non-USACE-owned PED is lost or stolen, the user must immediately notify the Contracting Officer or Contracting Officer's Representative.

1.6.1 Prohibited Activities

a. Under no circumstances are users authorized to engage in any

SECTION 25 05 11 Page 10 activity that is illegal under local, state, federal or international law while utilizing authorized or approved USACE-owned or non-USACE-owned resources related to work on this contract. The following activities are strictly prohibited with regards to connecting authorized or approved USACE-owned or non-USACE-owned PEDs to USACE-owned equipment, with no exceptions:

1. Using Operational Technology or other related monitoring and/or control systems for any personal use.

2. Connecting unauthorized or unapproved non-USACE PEDs to USACE equipment, systems, or networks.

3. Intentional introduction of malicious programs into the network or server (e.g., viruses, worms, Trojan horses, e-mail bombs, etc.).

4. Port scanning or security scanning without prior notification to the KO, in coordination with designated site OT personnel.

5. Executing any form of network monitoring which will intercept data not intended for the user's host, unless this activity is a part of the user's normal job/duty.

6. Hotspot-capable PEDs are not permitted to broadcast Wi-Fi signals as an access point (i.e. function as a router for a wireless network) within and/or around certain areas of the USACE facility premises (e.g., control room and computer server room, unit control equipment enclosures such as RTU cabinets, digital governor or exciter cabinets, etc.) and must not be connected to USACE equipment, systems, or networks.

7. PEDs must not be loaned or otherwise given to any person other than whom the device is assigned to.

8. Exporting software, technical information, encryption software or technology, which is in violation of international or regional export control laws. Notify the KO or COR of any material that is in question. Material in question shall only be exported with KO or COR approval.

b. Any use of email on Operational Technology and any related monitoring/control of USACE systems or networks is prohibited.

c. Any user found to have violated this policy may be subject to disciplinary action.

1.7 CYBERSECURITY REQUIREMENTS

a. All items and components provided by the Contactor must meet all Cybersecurity Requirements of this Specification, as well as DOD 8500.01 and DOD 8510.01 . Include all applicable current Cybersecurity regulations, policies, and processes from these documents.

b. Prior to Government acceptance of the system, the Contractor must adhere to all vendor-specific, CISA, and IAVA alert requirements for reporting, patching, and/or mitigating. Contractor must address all vulnerabilities for Contractor provided hardware and software within

SECTION 25 05 11 Page 11

30 days of the alert.

c. Notify the Contracting Officer or Contracting Officer's Representative within 48 hours of receipt of an alert and within 48 hours of resolution. Prior to anticipated Government acceptance, submit a Vulnerability Resolution Report (encrypted). The report must identify the vulnerability alert ID and the date of resolution for each component.

1.8 SECURE CONFIGURATIONS OF COMPUTER OPERATING SYSTEMS

a. Configure the Operating System, Applications, and all Network accessible devices following the Principle of Least Privilege and Application Separation as described below.

b. Configure the following per the latest STIG (STIG in place at the time of Government acceptance).

1. All Operating Systems.

2. All Network accessible devices.

c. Install the most current versions of the following, unless otherwise specified or approved. All applicable updates to software or firmware must be applied to systems prior to delivery to the Government, unless proven to disrupt system functionality and approved by the Government..

1. Operating Systems.

2. Software/Applications.

3. Software updates.

4. Firmware updates.

5. Security Patches .

6. Service Packs.

7. BIOS/UEFI.

1.8.1 Principle of Least Privilege

a. All Operating Systems and Network accessible devices must be configured using the Principle of Least Privilege. Principle of Least Privilege must be used for all of the following:

1. Operating System permissions.

2. File access.

3. User accounts.

4. Application-to-application communications.

b. Configure Operational Technology using a role-based access control scheme so that normal operations occur using an Operator level account, with minimum privileges required to operate the system. See

SECTION 25 05 11 Page 12 paragraph "Operator Level Accounts", below, for additional information and requirements.

c. Unnecessary/unused accounts must be removed from the Operational Technology. Any "guest-level" accounts that are created on the system by default must be disabled.

d. Submit Account Level Permissions List (Encrypted) and allowable operations for the following account levels a minimum of 30 calendar days prior to anticipated beginning of account configurations:

1. Service Level Accounts.

2. Operator Level Accounts.

3. Administration Level Accounts.

1.8.1.1 Service Level Accounts

All required Service Level Accounts must be created as normal users with no administrative permissions. Removable media devices and USB ports (with the exception of keyboard and mouse) must be disabled.

1.8.1.2 Operator Level Accounts

Operator Level Accounts allow normal operation of the system, but do not allow for any configuration changes. Removable media devices and USB ports (with the exception of keyboard and mouse) must be disabled. The Contractor must document the minimum privileges required for the Operator level account in the Account Level Permissions submittal.

1.8.1.3 Administration Level Accounts

a. Administration-level (privileged access) accounts are required to perform any configuration changes on the system. Separate administration-level accounts must be created for each administrator on the system.

b. Removable media devices and USB ports will be available for Administration Level Accounts, only. The availability of the USB ports and removable media devices must be configurable using the accounts on the system.

1.8.2 Application Separation

a. Application Separation utilizes the operating system on the primary partition of the hard drive.

1. Application Databases. Application databases must be installed on a different partition than the Operating System (OS).

2. Web servers. Web servers must be installed on a different partition than the Operating System (OS).

3. Web servers and database servers must not be installed on the same computer.

b. For Virtual Machines, web servers and database servers must not be hosted on the same Virtual Machine.

SECTION 25 05 11 Page 13

1.9 BASIC INPUT/OUTPUT SYSTEM (BIOS)/ UNIFIED EXTENSIBLE FIRMWARE

INTERFACE (UEFI) PROTECTION

a. Provide a protection mechanism to prevent unwanted changes to the system BIOS/UEFI for all devices on the system, where technically feasible.

b. All BIOS/UEFI Protection Mechanisms must utilize passwords, and passphrases, that conform to DoD STIG requirements. BIOS/UEFI Protection passwords must be used to allow access by system engineering and administrative personnel after initial commissioning of the system.

c. Where technically feasible, all systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run UEFI mode, not Legacy BIOS mode.

d. Submit within 30 calendar days prior to anticipated Government acceptance of the system, all BIOS/UEFI Protection Passwords/Passphrases (Encrypted) to the KO or COR.

1.10 LOGGING AND AUDITING

a. Design the Operational Technology to log critical events and operator actions related to the operation of the system. The critical events will be defined by the Government at the Pre-Work meeting.

b. Configure Operating System logging per the STIG requirements without exception, including the specified minimum log sizes defined in the STIG.

1.11 COMMUNICATIONS

a. Protect the following communications using NIST FIPS 140-2 compliant encryption methods (see https://csrc.nist.gov/publications/detail/fips/140/2/final for additional information:

1. Public switched telephone network.

2. Leased lines.

3. Any wireless communication.

b. Establish Virtual Private Network IPSec tunnels between different facilities, including all wireless devices, using approved network devices. See https://aplits.disa.mil/processAPList.action for additional information.

c. Protected communications must use Digital Certificates, where possible. Document communications devices that cannot be Certificate protected. Submit Certificate Protection Status (Encrypted) for all communication devices prior to any Contractor equipment requiring certificates arriving at the Project site.

d. Firewalls must be utilized to control communications between tunnels. Firewalls must meet STIG requirements.

SECTION 25 05 11 Page 14

e. The proposed network and wireless devices must be selected from the DISA approved product list (APL). See https://aplits.disa.mil/processAPList .

1.11.1 Secure Network Design Considerations

An OT Subsystem is the lowest level architecture that includes networking capabilities. Subsystems that interconnect into OT Closed Restricted, OT Restricted Interconnected, or OT Connected systems, require network segmentation to preserve the integrity of individual subsystems from possible interference or compromise from other subsystems. Most OT Subsystem networks have a flat architecture. A flat network architecture is a security risk. Network segmentation or network zones controlled and protected by a firewall or data-diode are part of a defense in depth security posture. While physical separation provides the strongest defense, logical separation should be a minimum segmentation between subsystems.

1.11.2 Safety Systems

A safety system protects health and life.A safety system must be physically isolated from the control system network. If a safety system is required to connect to a control system, a data-diode will be used to ensure the safety system cannot be compromised from the control system network.

1.11.3 Protective Systems

A protective system prevents damage to equipment.A protective system consists of critical relays or IEDs and must be physically isolated from the control system network . If a protective system is required to connect to a control system, a data-diode will be used to ensure the safety system cannot be compromised from the control system network.

1.11.4 Meters

Meters should be hardwired to a PLC as either a digital input or analog input. For a meter that is networked, the meter should be on its own network segment to ensure the meters cannot be compromised from the control system network.

1.11.5 Switchyard Components

Switchyard components consists of high voltage transformers, circuit breakers, powerline phase metering, and overload/short circuit relays.

The switchyard gear should be on its own network segment to ensure the switchyard gear cannot be compromised from the control system network.

1.11.6 Critical Components/Subsystems

An example of critical components or auxiliary subsystems would be sump pumps and oiler subsystems. These types of systems are usually physically isolated network segments. If these types of systems are required to connect to a control system, a separate firewall will be used to protect these systems to ensure they cannot be compromised from the control system network.

SECTION 25 05 11 Page 15

1.11.7 Field Bus Systems

An example of field bus systems for Hydropower would be the PLC for a Power Generation Unit, Penstock PLC, sequence of event recorded, PLC for cooling water flow meters, temp monitoring and flow monitoring. If these types of systems are required to connect to a control system, a separate firewall will be used to protect these systems to ensure they cannot be compromised from the control system network.

1.11.8 Industrial Control System (ICS) Management Zone

The components of an ICS management zone consist of the OT server, Human Machine Interface (HMI) client, historian, engineering workstation, and an event printer. These components should be on their own network segment to ensure they cannot be compromised from the control system network.

1.11.9 Operating System (OS) Management Zone

The components of an OS management zone consist of an Active Directory server (if required), Windows Centralized Log server, Windows Server Update Services server or patch server. These components should be on their own network segment to ensure they cannot be compromised from the control system network.

1.11.10 Network Management Zone

The components of a network management zone consist of a SYSLOG server, network manager, RADIUS server, and a network time protocol server. These components should be on their own network segment to ensure they cannot be compromised from the control system network.

1.11.11 External Demilitarized Zone(DMZ)Connetion Zone

The components of an External DMZ Connections zone consist of an external jump box computer, an event forwarder, any wireless controllers, or other devices that require communication outside of the control system. The External DMZ must be separated from the control network with a firewall.

The external connection to the outside must be protected with full boundary defense measures; i.e., router, firewall, VPN, and IDS.

1.11.12 Wireless

There are several different types of wireless communications used in control systems. Wireless communications are vulnerable to session high-jacking, man-in-the-middle attacks, and jamming. Some of the most common wireless communications technology are; Bluetooth (802.15.1), ZigBee (802.15.4), ZWave (802.15.4), WirelessHART (802.15.4), Wi-Fi (802.11), 900MHz ISM Radio (802.11ah), Microwave (FCC 47 C.F.R, Part 101), and LTE (802.16). All wireless communications require AES encryption when technically feasible. All wireless communication initiation/termination controllers or gateways must be in the External DMZ separated from the control system with a firewall.

1. Wireless bridges are used to connect two distant networks together. Wireless bridges can be Wi-Fi, Microwave, 900 MHz ISM Radio or LTE (If properly configured). Wireless bridges must be configured as point to point or point to multi-point connections.

2. Wireless access points should not be used in control systems.

SECTION 25 05 11 Page 16

Wireless access points are used to connect portable electronic devices to the network. Per DoD regulation 8100.02, all wireless access points require a Wireless Intrusion Detection System (WIDS) and 802.1x access control using a wireless access controller or RADIUS server.

3. Bluetooth or Bluetooth Personal Area Networks should not be used in control systems. Bluetooth is a wireless technology to connect peripherals to a device.

4. ZigBee is a wireless technology like Bluetooth that can be used for a low power wide area network (LPWAN). This technology is being used in wireless sensors, HVAC thermostats, and other control system components.

5. ZWave is like ZigBee, but at a lower frequency. It is used mostly in wireless Internet of Things (IoT) devices. The IoT devices are mostly designed for home use.

6. The wireless Highway Addressable Remote Transducer Protocol (HART) are used for a personal area network. This technology is being used in wireless sensors, HVAC thermostats, and other control system components.

1.11.13 Intrusion Detection

An Intrusion Detection Systems (IDS) solution consists of a network test access point (TAP) or serial TAP to capture the communications, a sensor to interface with the TAP, a server to manage multiple sensors, and a client or analyst workstation to review the alerts. IDS’s are anomaly or signature-based security devices that look for malicious or unauthorized communications. There are IDS’s for IP, serial, and wireless communications. The IDS solution will be a parallel network that taps into the control network but does not inject any packets into the control network. The placement of TAPs is critical when determining that there is a malicious actor in the network. TAPs should be placed at any ingress/egress point between the control network and any other network.

TAPs should be place inline with critical servers and PLCs. The use of TAPs is the preferred method for capturing traffic. An alternative to a TAP is using a mirror port on a managed switch or router. Extreme care must be used when using mirror ports. The control network traffic is the most critical and the use of a mirror port can starve the switch or router resources and interfere with the control network traffic.

1.12 CONTROL DEVICE CODE PROTECTION

a. The Contractor must configure and utilize the existing cybersecurity features, available on the devices that are to be added to the Operational Technology network.

b. All passwords set to protect code or configuration settings must be provided to the Government as defined in the ACCOUNT MANAGEMENT paragraph.

c. All programming/code developed under this contract must be accessible and changeable by the Government upon completion of work under this contract. Include any codes, hardware or software keys, license numbers, etc., required to enable the Government to access or change the programming on all devices supplied under this contract.

These must be provided to the Government at no additional cost.

SECTION 25 05 11 Page 17

1.13 LOCKING PROVISIONS

a. All cabinets and enclosures that contain Operational Technology components must have lockable handles, doors, or accessories allowing the cabinet to be secured using a padlock.

b. All such cabinets and enclosures must be secured using padlocks with a minimum of a 3/8-inch diameter hardened shackle and be stainless steel.

c. Padlocks must meet requirements in accordance with Federal Specification FF-P-2827 and the NFESC DoD Lock Program FED-STD-2827.

1.14 REMOTE ACCESS

a. All configurations for commissioning a new system or an upgrade to an existing system must be completed on site. Where technically feasible, commissioning will be completed using government-furnished equipment.

PART 2 PRODUCTS

2.1 COMPLETE SOFTWARE LIST

a. Provide comprehensive software list for all components of the Operational Technology. The list must include, at a minimum, the following:

1. Software Name.

2. Software Vendor.

3. Software Version Number (major version number only, for Pre-Design Software Listing).

4. Software Selection Purpose/Justification.

5. License Status and number identifier.

b. Submit a Pre-Construction Software List (Encrypted) a minimum of 30 calendar days prior to beginning of system construction. Submit a Complete Software List (Encrypted) a minimum of 60 calendar days prior to installed operation of the software.

c. Software with a currently supported STIG meets Government cybersecurity requirements. Software without a currently supported STIG is subject to Government review and approval. See https://public.cyber.mil/STIGS/ , for a listing of software with a currently supported STIG.

2.1.1 Antivirus/Antimalware Software

a. All computers must include the most up to date DoD approved antivirus software with up to date signatures.

b. Verify that the Antivirus/Antimalware software will not negatively affect the operation of the Operational Technology. Computers and servers being installed must be configured with up-to-date antivirus

SECTION 25 05 11 Page 18 signatures, not older than 10 days, prior to deployment.

c. Submit Antivirus/Antimalware Scan (Encrypted) test results to show evidence of a clean scan, a minimum of 30 days prior to anticipated Government acceptance of the Operational Technology.

2.2 COMPLETE HARDWARE LIST

a. Provide comprehensive hardware list of all hardware devices to be utilized on the Operational Technology. The list must include the following:

1. All PLCs and Related OT Components.

2. Computers.

3. Network Accessible Devices.

4. Interface Converters.

5. Any Similar Devices.

b. Provide the following information, at a minimum:

1. Hostname/Component Name.

2. Manufacturer.

3. Model Number.

4. Firmware Version Number, where applicable (major version number only, for Pre-Design Hardware Listing).

5. Installation Location. Includes physical location, and functional location in the control system.

c. Submit a Pre-Construction Hardware List (Encrypted) a minimum of 30 calendar days prior to beginning of system construction. Submit a Complete Hardware List (Encrypted) a minimum of 60 calendar days prior to installed operation of the hardware.

d. Hardware listed at the following DISA website meets Government cybersecurity requirements: https://aplits.disa.mil/processAPList .

Hardware not listed is subject to Government review and approval.

2.3 PORTS, PROTOCOLS, AND SERVICES LIST (Encrypted)

a. Provide a comprehensive list of the Ports, Protocols, and Services necessary for normal operations, emergency operations, and troubleshooting of the Operational Technology. At a minimum, the list must include the following:

1. Vendors.

2. Justifications.

3. Executables.

4. Ports.

SECTION 25 05 11 Page 19

5. Protocols.

6. Services.

b. Submit a Ports, Protocols, and Services List (Encrypted)a minimum of 30 calendar days prior to anticipated Government acceptance of the system.

2.4 SYSTEM NETWORK DOCUMENTATION

a. Provide a complete System Network Diagram (Encrypted) to include all network devices, operational technology, and maintenance components. The diagram must include the following for each device:

1. Labels of device type (e.g., workstation, server, PLC, etc.).

2. Component Manufacturer/model.

3. Operating System.

4. Operating System Version Number.

5. Firmware manufacturer.

6. Firmware version number.

b. In addition, the Contractor must submit a complete System Data Flow Diagram that shows all of the devices on the Operational Technology that communicate via routable protocols. Submit a System Data Flow Diagram (Encrypted) that indicates the normal system communications among the devices on the network, including the ports and protocols utilized for communications. Include the following in the System Data Flow Diagram:

1. Arrows to indicate direction of data flow between components.

Define the physical media and protocol for each link.

2. Logical boundary of the system marked with a red line clearly defining components inside the boundary as well as components outside the boundary. Label any connections to external networks and indicate the boundary protection.

3. Indicate any VLAN segmentation of the devices on the diagram.

c. Diagrams must be provided electronically formatted for 11" X 17" sheets. Develop diagrams using Microsoft Visio, Microstation, or other approved editable format. Submit copies of original electronic files as well as Portable Document Format (PDF) files.

d. Submit all diagrams a minimum of 30 calendar days after notice to proceed.

2.5 DEFAULT PASSWORDS

a. The Contractor must change any default passwords on the equipment provided under this contract, including any PLCs, HMI, and network devices. Submit 60 days prior to completion of work a Comprehensive Password/Passphrase List (Encrypted), of all passwords/passphrases

SECTION 25 05 11 Page 20 that are required to properly operate, maintain, and troubleshoot the Operational Technology.

b. Where technically feasible, all Contractor generated passwords must meet requirements of applicable STIGs and DA PAM 25-2-13 .

c. Include, and clearly identify, any default passwords that cannot be changed on any configurable device provided under this contract.

2.6 ACCOUNT MANAGEMENT

a. Submit 60 days prior to completion of work a Comprehensive Account List (Encrypted) for each configurable device on the Operational Technology. This include the following :

1. All Application Accounts.

2. Operating System Accounts.

3. Network Accessible Device Accounts.

4. Emergency Accounts.

5. Service Accounts.

6. Communications Accounts.

b. The list must provide the unique username and password for each account on each device on the system.

2.7 INITIAL BACKUPS

The Contractor must provide complete Initial Backups (Encrypted) of each component 30 days prior to anticipated Government acceptance of the system. Backups must be sufficient to restore all components to their delivered state. The backups must be stored on an encrypted external hard drive to be provided to the Government. The backups must be tested and verified as functional for restoring the system prior to submittal.

Include verification of testing and functionality with submittal.

2.7.1 Backup Software

Backups of Windows-based components must be performed with Macrium Reflect as provided by Paramount Software or equal. An acceptable equivalent Windows-based backup software must meet the following salient characteristics.

a. Create full, incremental, and differential backup images of partitions, folders, and/or files.

b. Restore and clone backup images

c. Compressed backup images

d. Compatible with approved editions of Microsoft Windows

Submit Backup Software (encrypted).

SECTION 25 05 11 Page 21

PART 3 EXECUTION

3.1 UNNECESSARY SOFTWARE AND SERVICES

a. The Contractor must remove all unnecessary software (not required for the operation and maintenance of the Operational Technology) from all computers on the system. Contractor must not install unnecessary software or services on system computers, including, but not limited to, the following:

1. Games.

2. Entertainment.

3. Unnecessary Diagnostic Packages.

b. Remove or disable all services and ports on the supplied components which are not required for normal, emergency, or troubleshooting operations. Unnecessary services on the automation hardware to be provided, such as web servers, must be disabled in configuration when not required for normal or emergency operations or troubleshooting.

3.2 SECURITY CONFIGURATION

a. Utilize the Security Configuration Automation Protocol (SCAP) tool, similar scanning tool, or a manual check, to scan the computers using the latest STIG for the Operating System, third-party applications and programs, and network-accessible devices provided.

b. Using the DoD STIG Viewer, a checklist must be created using the SCAP scan results or manual STIG review. The completed checklist, to include all manual checks, must be provided 60 days prior to anticipated Government acceptance.

c. Document any Deviations List (Encrypted) required for proper system operation. Include reasons why a STIG, patch, firmware update, or any other requirement cannot be met. Submit Deviations List a minimum of 60 days prior to anticipated date of deviation operation.

The Deviations List must include the following:

1. STIG/SRG/Patch/Firmware Update (what is being deviated).

2. Vulnerability Identification.

3. Rule Identification.

4. Control.

5. CCI.

6. Finding.

7. Deviation Justification.

8. Current Risk-Mitigation Actions.

d. Submit the SCAP Tool Scan (Encrypted) results to demonstrate the secure configuration of all devices provided. SCAP Tool Scan results

SECTION 25 05 11 Page 22 must be submitted, and accepted by the Government prior to the equipment arriving at the Government facility. Equipment without an acceptable SCAP Tool Scan or manual STIG review must not connect to the control system.

3.3 FIELD QUALITY CONTROL

3.3.1 Training

Provide 8 hours of classroom and hands-on training for 6 (six) Government personnel. The Government will provide for the training location.

Training must cover, at a minimum, the procedures for applying software and firmware updates for the devices supplied, information on normal adjustments, and any essential maintenance activities.

3.3.2 Cybersecurity Field Verification

a. Field verify cybersecurity compliance before the Pre- Operational Phase of commissioning.

b. Furnish the services of qualified cybersecurity personnel and all supplies and equipment necessary for verification. The Contracting Officer and cybersecurity specialist reserve the right to witness all system verifications for cybersecurity.

3.3.2.1 Cybersecurity Field Verification Request

Perform the cybersecurity field verification for applicable equipment and systems specified in the SECTIONS listed in paragraph GENERAL INFORMATION. Notify the Contracting Officer at least 15 calendar days in advance of each cybersecurity verification inspection.

3.3.2.2 Verification for Each System

a. Field verify cybersecurity compliance at the field testing of each system installation. During field verification, assist Government personnel with changing job-specific passwords to Government assigned and controlled passwords.