21R0018 - Amend-0002 Tech Specs.pdf

Lower Monumental DC System and LV Switchgear Upgrades W912EF21R0018

LMA455606DCLV

PROJECT TABLE OF CONTENTS

DIVISION 00 - PROCUREMENT AND CONTRACTING REQUIREMENTS

00 01 15.00 28 LIST OF DRAWINGS

DIVISION 01 - GENERAL REQUIREMENTS

01 00 00.00 28 GENERAL REQUIREMENTS

01 11 00.00 28 SUMMARY OF WORK

01 11 01.00 28 SUPPLEMENTARY REQUIREMENTS

01 12 16.00 28 WORK SEQUENCE

01 14 00.10 28 PROJECT SITE RESTRICTIONS

01 14 00.90 28 INTEGRATING ANTITERRORISM (AT) AND OPERATIONS SECURITY

(OPSEC)

01 22 00.00 28 MEASUREMENT AND PAYMENT

01 32 01.00 28 PROJECT SCHEDULE

01 33 00 SUBMITTAL PROCEDURES

01 35 29.10 28 GOVERNMENTAL SAFETY REQUIREMENTS

01 42 00 SOURCES FOR REFERENCE PUBLICATIONS

01 45 01.00 28 RESIDENT MANAGEMENT SYSTEM CONTRACTOR MODE (RMS CM)

01 45 04.00 28 CONTRACTOR QUALITY CONTROL

01 51 00.00 28 TEMPORARY UTILITIES

01 55 10.00 28 CONTRACTOR WORK, ACCESS AND STORAGE AREAS

01 57 20.00 28 ENVIRONMENTAL PROTECTION

01 78 00.00 28 CLOSEOUT SUBMITTALS

01 78 23.00 28 OPERATION AND MAINTENANCE DATA

DIVISION 02 - EXISTING CONDITIONS

02 41 00.00 28 DEMOLITION

DIVISION 03 - CONCRETE

03 60 00.01 28 CONCRETE CORE DRILLING

DIVISION 07 - THERMAL AND MOISTURE PROTECTION

07 84 00.00 28 FIRESTOPPING

07 92 00.00 28 JOINT SEALANTS

DIVISION 08 - OPENINGS

08 11 13.00 28 STEEL DOORS AND FRAMES

08 71 00.00 28 DOOR HARDWARE

DIVISION 09 - FINISHES

09 90 00.00 28 PAINTS AND COATINGS

DIVISION 13 - SPECIAL CONSTRUCTION

13 48 00.01 28 SEISMIC RESTRAINT FOR MECHANICAL AND ELECTRICAL EQUIPMENT

DIVISION 22 - PLUMBING

22 00 00.00 28 PLUMBING, GENERAL PURPOSE

22 05 30.11 28 METAL SUPPORTS FOR MECHANICAL SYSTEMS

Amendment-002 PROJECT TABLE OF CONTENTS Page 1 g4ecctgh Line Amendment-002 - Section 01 11 00.00 28 g4ecctgh Line Amendment-002 - Section 01 22 00.00 28

DIVISION 23 - HEATING, VENTILATING, AND AIR CONDITIONING (HVAC)

23 00 00.00 28 MECHANICAL GENERAL REQUIREMENTS

23 00 10.00 28 AIR SUPPLY, DISTRIBUTION, VENTILATION, AND EXHAUST SYSTEMS

23 05 93.00 28 TESTING, ADJUSTING, AND BALANCING FOR HVAC

23 34 00.00 28 HVAC FANS

DIVISION 25 - INTEGRATED AUTOMATION

25 05 11.00 28 CYBERSECURITY

DIVISION 26 - ELECTRICAL

26 05 00.00 28 BASIC ELECTRICAL MATERIALS AND METHODS

26 05 13.00 28 MEDIUM-VOLTAGE CABLE

26 05 19.00 28 INSULATED WIRE AND CABLE

26 05 26.00 28 GROUNDING

26 05 36.00 28 CABLE TRAYS FOR ELECTRICAL SYSTEMS

26 08 00.00 28 APPARATUS INSPECTION AND TESTING

26 08 01.00 28 SYSTEMS TESTING AND COMMISSIONING

26 23 10.10 28 480 VOLT SWITCHGEAR AND TRANSFORMERS

26 24 19.00 28 MOTOR CONTROL CENTERS

26 28 00.00 28 SWITCHBOARDS AND PANELBOARDS

26 32 36.00 28 BATTERY CHARGERS AND INVERTERS

DIVISION 27 - COMMUNICATIONS

27 21 10.00 28 FIBER OPTIC DATA TRANSMISSION SYSTEM

DIVISION 40 - PROCESS INTERCONNECTIONS

40 95 00.00 28 PROCESS CONTROL

-- End of Project Table of Contents --

Amendment-002 PROJECT TABLE OF CONTENTS Page 2 g4ecctgh Line Amendment-002 - Section 25 05 11.00 28 g4ecctgh Line Amendment-002 - Section 26 05 00.00 28 g4ecctgh Line Amendment-002 - Section 26 05 13.00 28 g4ecctgh Line Amendment-002 - Section 26 05 19.00 28 g4ecctgh Line Amendment-002 - Section 28 05 26.00 28 g4ecctgh Line Amendment-002 - Section 26 08 01.00 28 g4ecctgh Line Amendment-002 - Section 26 23 10.10 28 g4ecctgh Line Amendment-002 - Section 26 24 19.00 28 g4ecctgh Line Amendment-002 - Section 26 28 00.00 28 g4ecctgh Line Amendment-002 - Section 26 32 36.00 28 g4ecctgh

Amendment-002 - Section 40 95 00.00 28

SECTION TABLE OF CONTENTS

DIVISION 01 - GENERAL REQUIREMENTS

SECTION 01 11 00.00 28

SUMMARY OF WORK

PART 1 GENERAL

1.1 SUMMARY

1.2 WORK COVERED BY CONTRACT DOCUMENTS

1.2.1 Project Description

1.2.2 Location

1.3 CONTRACT DRAWINGS

1.4 OCCUPANCY OF PREMISES

1.5 EXISTING WORK

PART 2 PRODUCTS (NOT APPLICABLE)

PART 3 EXECUTION (NOT APPLICABLE)

-- End of Section Table of Contents --

SECTION 01 11 00.00 28 Page 1 Amendment-002 g4ecctgh

Amendment-002 - Paragraph 1.2.1(h)

THIS PAGE INTENTIONALLY LEFT BLANK

SECTION 01 11 00.00 28 Page 2 Amendment-002

SECTION 01 11 00.00 28

SUMMARY OF WORK

PART 1 GENERAL

1.1 SUMMARY

This Section provides a summary of the various Contract work elements and their relationship to each other. This summary describes work activities within interim construction completion dates. This Section does not provide the technical detail for particular work activities, but describes the work as a whole, providing overall perspective to the separate tasks and their interrelationships. Use this Section in conjunction with all the Specification Sections and the Drawings to establish the total work requirements.

1.2 WORK COVERED BY CONTRACT DOCUMENTS

1.2.1 Project Description

This section is a general summary of the required work and is not all-inclusive. The work described within these specifications includes, but is not necessarily limited to, the following:

a. Remove and Provide new double-ended 480 VAC Switchgear SQO including 4.16kV/480V Transformers.

b. Remove and Provide new double-ended 480 VAC Switchgear SQ1 including 4.16kV/480V Transformers.

c. Remove and Provide new 4.16kV/480V Transformers for 480 VAC Switchgear SQ2.

d. Provide new 4.16kV/480V Transformers for 480 VAC Switchgear SQ3.

e. Remove and Provide 6 Main Unit Auxiliary Boards; SU1 through SU6.

f. Remove and Provide Medium Voltage Feeder Cables to SQO, SQ1, and SQ2, Remove and Provide 480VAC and 125 VDC cables as indicated on the contract drawings.

g. Provide a local control panel for each 480VAC Switchgear lineup.

i. Provide the station service 125 VDC battery monitoring system, battery room modifications for ventilation, spill containment, and safety modifications.

j. Remove and Provide new DC Switchboards SB1, SB2, and SB3.

k. Remove and Provide new DC and Preferred AC Panel boards CE1-6, CE7, CE8, CH1A and CH1B, CA1,.

SECTION 01 11 00.00 28 Page 3 Amendment-002 h.. Remove and Provide new MCC /panelboards CQO1, CQO3, CQO4, CQO5, CQ1, SH, and CQO8.

g4ecctgh

Amendment-002 - Paragraph 1.2.1(h)

l. Remove and Provide new Battery Chargers BC1 and BC2 and two new Inverter Bypass switches.

m. Remove existing 4160 Governor oil pump motors and controllers.

Replace pump motors with 480VAC motors.

n. Remove existing custom brackets that support the 4160 governor pump motors on main units 1 - 3. Provide new brackets able to support the new 480VAC motors.

o. Remove water connections from the existing shower and eyewash station and provide new tepid water system and connect to the existing emergency shower and eyewash station.

p. Prepare and furnish as-built drawings and O&M Manuals for the completed installation.

q. Provide all necessary contractor commissioning activities and support Government Commissioning activities.

r. Remove existing battery room exhaust fan and provide new 1,000 cfm capacity battery room exhaust fan.

s. Remove the existing turning vanes and supply air outlets and provide new supply air outlets with larger inside radius duct bends and balancing dampers.

t. Remove existing door and door frame to battery room and provide new fire rated door and frame.

1.2.2 Location

The work shall be located at Lower Monumental Powerhouse.

1.3 CONTRACT DRAWINGS

a. The Drawings are accompanied with these Specifications.

b. One set of full size Contract drawings, maps, and Specifications will be furnished to the Contractor without charge per Section 00700 Contract Clause 252.236-7001, CONTRACT DRAWINGS AND SPECIFICATIONS.

Reference publications will not be furnished.

c. Contractor must immediately check furnished Drawings and notify the Government of any discrepancies.

1.4 OCCUPANCY OF PREMISES

a. Buildings will be occupied during performance of work under this Contract.

b. Before work is started, the Contractor must arrange with the Contracting Officer a sequence of procedure, means of access, space for storage of materials and equipment, and use of approaches, corridors, and stairways.

1.5 EXISTING WORK

In addition to Section 00700 Contract Clause 52.236-9, PROTECTION OF

SECTION 01 11 00.00 28 Page 4

EXISTING VEGETATION, STRUCTURES, EQUIPMENT, UTILITIES, AND IMPROVEMENTS:

a. Remove or alter existing work in such a manner as to prevent injury or damage to any portion of the existing work to remain.

b. Upon completion of the work, repair or replace portions of existing work, which have been damaged by Contractor's operations, to preconstruction conditions at the expense of the Contractor.

PART 2 PRODUCTS (NOT APPLICABLE)

PART 3 EXECUTION (NOT APPLICABLE)

-- End of Section --

SECTION 01 11 00.00 28 Page 5

THIS PAGE INTENTIONALLY LEFT BLANK

SECTION 01 11 00.00 28 Page 6

SECTION TABLE OF CONTENTS

DIVISION 01 - GENERAL REQUIREMENTS

SECTION 01 22 00.00 28

MEASUREMENT AND PAYMENT

PART 1 GENERAL

1.1 RETAINAGE OF PAYMENT

1.2 CLIN 0001 - MOBILIZATION AND DEMOBILIZATION

1.3 CLIN 0002 - REMOVE AND DISPOSE OF EXISTING TRANSFORMERS AND 480V

AC SWITCHGEAR SQO, SQ1, and SQ2.

1.4 CLIN 0003 - REMOVE AND DISPOSE OF EXISTING MAIN UNIT AUXILIARY

BOARDS SU1 - SU6 AND CP1-6

1.5 CLIN 0004 - REMOVE AND DISPOSE OF EXISTING MOTOR CONTROL CENTERS

CQO1, CQO4, CQO5, SH AND THE SH TRANSFORMER

1.6 CLIN 0005 - REMOVE AND DISPOSE OF EXISTING PANELBOARDS CQO3, FCQ1,

and FCQ2

1.7 CLIN 0006AA - REMOVE AND DISPOSE OF EXISTING 4160 VOLT GOVERNOR

OIL PUMP MOTORS. UNITS 1 - 3

1.8 CLIN 0006AB - REMOVE AND DISPOSE OF EXISTING 4160 VOLT GOVERNOR

OIL PUMP MOTORS. UNITS 4 - 6

1.9 CLIN 0007 - REMOVE AND DISPOSE OF EXISTING BATTERY CHARGERS BC1,

BC2, AND BC3

1.10 CLIN 0008 - REMOVE AND DISPOSE OF EXISTING PREFFERED-AC INVERTERS

THEN FURNISH AND INSTALL NEW PREFERRED-AC INVERTERS

1.11 CLIN 0009 - REMOVE AND DISPOSE OF EXISTING DC SWITCHBOARDS,

PANELBOARDS AND PREFERRED AC PANELS

1.12 CLIN 0010 - REMOVE AND DISPOSE OF EXISTING CONDUCTORS, CONDUIT

RISERS, AND EXPOSED CONDUIT

1.13 CLIN 0011 - REMOVE AND DISPOSE OF EXISTING HEADCOVER, TURBINE

BEARING OIL PUMP STARTERS AND CONTROLS

1.14 CLIN 0012 - FURNISH AND INSTALL NEW 480V AC SWITCHGEAR AND

TRANSFORMER LINEUPS SQO, SQ1, SQ2 AND SQ3; INCLUDING NEW FEEDER

CABLES

1.15 CLIN 0013 - FURNISH AND INSTALL NEW UNIT MOTOR CONTROL CENTERS

SU1 - SU6, INCLUDING NEW FEEDER CABLES

1.16 CLIN 0014 - FURNISH AND INSTALL NEW STATION SERVICE MOTOR CONTROL

CENTERS CQO1, CQO4, CQO5 AND SH INCLUDING NEW FEEDER CABLES, AND

MODIFY DCQ2

1.17 CLIN 0015 - FURNISH AND INSTALL NEW PANELBOARDS CQO3, FCQ1, AND

FCQ2

1.18 CLIN 0016AA - FURNISH AND INSTALL NEW 480 VOLT GOVERNOR OIL PUMP

MOTORS IN UNITS 1 - 3

1.19 CLIN 0016AB - FURNISH AND INSTALL NEW 480 VOLT GOVERNOR OIL PUMP

MOTORS IN UNITS 4 - 6

1.20 CLIN 0017 - FURNISH AND INSTALL NEW 125V BATTERY CHARGERS BC1,

BC2 AND BC3

1.21 CLIN 0018 - FURNISH AND INSTALL NEW BATTERY, BATTERY MONITORING

COMPUTER, CART, DIAGNOSTIC EQUIPMENT, WIRING, BATTERY MONITORING

HARDWARE & SOFTWARE PACKAGE

1.22 CLIN 0019 - FURNISH AND INSTALL NEW BATTERY SWITCHBOARDS, DC

SECTION 01 22 00.00 28 Page 1 Amendment - 002

DISTRIBUTION PANELBOARDS, 120V AC DISTRIBUTION PANELBOARDS, AND

MANUAL BREAKER TRANSFER PANELS INCLUDING NEW FEEDER CABLES

1.23 CLIN 0020 - BATTERY ROOM MODIFICATIONS

1.24 CLIN 0021 - FURNISH AND INSTALL SQ REMOTE CONTROL PANELS

1.25 CLIN 0022 - FURNISH AND INSTALL SBC PANEL

1.26 CLIN 0023 - FURNISH SPARE PARTS AND ACCESSORIES

1.27 CLIN 0024 - CORE DRILLING AND CONCRETE WORK

1.28 CLIN 0025 - FURNISH O&M MANUALS

1.29 CLIN 0026 - FURNISH FINAL RECORD DRAWINGS

1.30 CLIN 0027 - FURNISH COMMISSIONING SERVICES AND TRAINING

1.31 CLIN 0028 - FIRESTOPPING

1.32 CLIN 0029 - FURNISH AND INSTALL NEW CABLE TRAYS.

PART 2 PRODUCTS (NOT APPLICABLE)

PART 3 EXECUTION (NOT APPLICABLE)

-- End of Section Table of Contents --

SECTION 01 22 00.00 28 Page 2 Amendment - 002 g4ecctgh

Amendment-002 - Paragraph 1.32

SECTION 01 22 00.00 28

MEASUREMENT AND PAYMENT

PART 1 GENERAL

In each instance, the contract price for an item shall constitute full compensation for furnishing all plant, labor, equipment, and materials, and for performing all operations required to complete the work included in the item as herein specified, or as otherwise approved.

1.1 RETAINAGE OF PAYMENT

Retainage in the amount of 10 percent of original contract award amount will be withheld until the final submittals listed below have been approved by the Government. The 10 percent final submittals retainage will be held until the Contractor has earned 90 percent of the original contract value. See SECTION 01 78 00.00 28 "CLOSEOUT SUBMITTALS" and SECTION 01 78 23.00 28 "OPERATION AND MAINTENANCE DATA" for additional information.

a. Final Shop Drawings.

b. Final As-built Drawings.

c. Final Record Drawings.

d. Return of Government Issued Items.

e. Final Operation and Maintenance Manuals and Parts Catalogs.

f. Final Spare Parts submission.

g. Complete all required training.

1.2 CLIN 0001 - MOBILIZATION AND DEMOBILIZATION

Measurement and payment for mobilization and demobilization will be in accordance with Contract CLAUSE: PAYMENT FOR MOBILIZATION AND DEMOBILIZATION. This item will be measured for payment as a complete pay item (JOB) under Item No. 0001, "Mobilization and Demobilization", which price and payment shall be full compensation for mobilizing and demobilizing all plant and equipment required for performance of the work, as specified and approved.

1.3 CLIN 0002 - REMOVE AND DISPOSE OF EXISTING TRANSFORMERS AND 480V AC

SWITCHGEAR SQO, SQ1, and SQ2.

Removal and disposal of existing transformers and 480V AC switchgear SQO, SQ1, and SQ2 will be measured for payment as a complete pay item (JOB).

Payment will be made at the lump sum price for CLIN No. 0002, "REMOVE AND DISPOSE OF EXISTING TRANSFORMERS AND 480V AC SWITCHGEAR SQO, SQ1, and SQ2", which price and payment shall be full compensation for all work required to remove and dispose of existing transformers and 480V AC switchgear SQO, SQ1, and SQ2, complete, as specified and approved.

1.4 CLIN 0003 - REMOVE AND DISPOSE OF EXISTING MAIN UNIT AUXILIARY BOARDS

SU1 - SU6 AND CP1-6

Remove and dispose of existing main unit auxiliary boards SU1 - SU6 and CP1-6 will be measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No. 0003, "REMOVE AND DISPOSE

SECTION 01 22 00.00 28 Page 3

OF EXISTING MAIN UNIT AUXILIARY BOARDS SU1 - SU6 AND CP1-6", which price and payment shall be full compensation for all work required to remove and dispose of existing main unit auxiliary boards SU1 - SU6 and CP1-6, complete, as specified and approved.

1.5 CLIN 0004 - REMOVE AND DISPOSE OF EXISTING MOTOR CONTROL CENTERS CQO1,

CQO4, CQO5, SH AND THE SH TRANSFORMER

Remove and dispose of existing motor control centers CQO1, CQO4, CQO5, SH and the SH transformer will be measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No. 0003, "REMOVE AND DISPOSE OF EXISTING MOTOR CONTROL CENTERS CQO1, CQO4, CQO5, SH

AND THE SH TRANSFORMER", which price and payment shall be full compensation for all work required to remove and dispose of existing motor control centers CQO1, CQO4, CQO5, SH and the SH transformer, complete, as specified and approved.

1.6 CLIN 0005 - REMOVE AND DISPOSE OF EXISTING PANELBOARDS CQO3, FCQ1, and

FCQ2

Remove and dispose of existing panelboards CQO3, FCQ1, and FCQ2 will be measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No. 0005, "REMOVE AND DISPOSE OF EXISTING PANELBOARDS CQO3, CQO8, FCQ1, and FCQ2", which price and payment shall be full compensation for all work required to remove and dispose of existing panelboards CQO3, FCQ1, and FCQ2 as specified and approved.

1.7 CLIN 0006AA - REMOVE AND DISPOSE OF EXISTING 4160 VOLT GOVERNOR OIL

PUMP MOTORS. UNITS 1 - 3

Remove and dispose of existing 4160 volt governor oil pump motors for units 1 - 3 will be measured for payment as a complete pay item (JOB).

Payment will be made at the lump sum price for CLIN No. 0006AA, "REMOVE

AND DISPOSE OF EXISTING 4160 VOLT GOVERNOR OIL PUMP MOTORS. UNITS 1 - 3",

which price and payment shall be full compensation for all work required to remove and dispose of existing 4160 volt governor oil pump motors for units 1 - 3 complete, as specified and approved.

1.8 CLIN 0006AB - REMOVE AND DISPOSE OF EXISTING 4160 VOLT GOVERNOR OIL

PUMP MOTORS. UNITS 4 - 6

Remove and dispose of existing 4160 volt governor oil pump motors for units 4 - 6 will be measured for payment as a complete pay item (JOB).

Payment will be made at the lump sum price for CLIN No. 0006AB, "REMOVE

AND DISPOSE OF EXISTING 4160 VOLT GOVERNOR OIL PUMP MOTORS. UNITS 4 - 6",

which price and payment shall be full compensation for all work required to remove and dispose of existing 4160 volt governor oil pump motors for units 4 - 6 complete, as specified and approved.

1.9 CLIN 0007 - REMOVE AND DISPOSE OF EXISTING BATTERY CHARGERS BC1, BC2,

AND BC3

Remove and dispose of existing battery chargers BC1, BC2, AND BC3 will be measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No. 0007, "REMOVE AND DISPOSE OF EXISTING BATTERY CHARGERS BC1, BC2, AND BC3", which price and payment shall be full compensation for all work required to remove and dispose of existing battery chargers BC1, BC2, AND BC3, complete, as specified and approved.

SECTION 01 22 00.00 28 Page 4

1.10 CLIN 0008 - REMOVE AND DISPOSE OF EXISTING PREFFERED-AC INVERTERS

THEN FURNISH AND INSTALL NEW PREFERRED-AC INVERTERS

Removal and disposal of existing preffered-ac inverters then furnishing and installing new preferred-ac inverters will be measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No. 0008, "REMOVE AND DISPOSE OF EXISTING PREFFERED-AC INVERTERS THEN FURNISH AND INSTALL NEW PREFERRED-AC INVERTERS", which price and payment shall be full compensation for all work required to remove and dispose of existing preffered-ac inverters then furnish and install new preferred-ac inverters complete, as specified and approved.

1.11 CLIN 0009 - REMOVE AND DISPOSE OF EXISTING DC SWITCHBOARDS,

PANELBOARDS AND PREFERRED AC PANELS

Removal and disposal of existing DC switchboards, panelboards and preferred AC panels will be measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No. 0009, "REMOVE AND DISPOSE OF EXISTING DC SWITCHBOARDS, PANELBOARDS AND PREFERRED

AC PANELS", which price and payment shall be full compensation for all work required to remove and dispose of existing DC switchboards, panelboards and preferred AC panels complete, as specified and approved.

1.12 CLIN 0010 - REMOVE AND DISPOSE OF EXISTING CONDUCTORS, CONDUIT

RISERS, AND EXPOSED CONDUIT

Removal and disposal of existing conductors, conduit risers, and exposed conduit will be measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No. 0010, "REMOVE AND DISPOSE OF EXISTING CONDUCTORS, CONDUIT RISERS, AND EXPOSED CONDUIT", which price and payment shall be full compensation for all work required to remove and dispose of existing conductors, conduit risers, and exposed conduit complete, as specified and approved.

1.13 CLIN 0011 - REMOVE AND DISPOSE OF EXISTING HEADCOVER, TURBINE BEARING

OIL PUMP STARTERS AND CONTROLS

Removal and disposal of existing headcover, turbine bearing oil pump starters and controls will be measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No. 0011, "REMOVE AND DISPOSE OF EXISTING HEADCOVER, TURBINE BEARING OIL PUMP

STARTERS AND CONTROLS", which price and payment shall be full compensation for all work required to remove and dispose of existing headcover and turbine bearing oil pump starters and controls, complete, as specified and approved.

1.14 CLIN 0012 - FURNISH AND INSTALL NEW 480V AC SWITCHGEAR AND

TRANSFORMER LINEUPS SQO, SQ1, SQ2 AND SQ3; INCLUDING NEW FEEDER CABLES

Furnish and install new 480V AC switchgear lineups SQO, SQ1, SQ2 and SQ3;

including new feeder cables will be measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No. 0012, "FURNISH AND INSTALL NEW 480V AC SWITCHGEAR AND TRANSFORMER LINEUPS SQO, SQ1, SQ2 AND SQ3, INCLUDING NEW FEEDER CABLES", which price and payment shall be full compensation for all work required to furnish and install new 480V AC switchgear and transformer lineups SQO, SQ1, SQ2 AND SQ3;

including new feeder cables, complete, as specified and approved.

SECTION 01 22 00.00 28 Page 5

1.15 CLIN 0013 - FURNISH AND INSTALL NEW UNIT MOTOR CONTROL CENTERS SU1 -

SU6, INCLUDING NEW FEEDER CABLES

Furnish and install new unit motor control centers SU1 - SU6, including new feeder cables will be measured for payment as a complete pay item (JOB).

Payment will be made at the lump sum price for CLIN No. 0013, "FURNISH AND

INSTALL NEW UNIT MOTOR CONTROL CENTERS SU1 - SU6, INCLUDING NEW FEEDER

CABLES", which price and payment shall be full compensation for all work required to furnish and install new unit motor control centers SU1 - SU6, including new feeder cables complete, as specified and approved.

1.16 CLIN 0014 - FURNISH AND INSTALL NEW STATION SERVICE MOTOR CONTROL

CENTERS CQO1, CQO4, CQO5 AND SH INCLUDING NEW FEEDER CABLES, AND MODIFY DCQ2

Furnish and install new station service motor control centers CQO1, CQO4, CQO5 and SH including new feeder cables, and modify DCQ2 will be measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No. 0014, "FURNISH AND INSTALL NEW STATION SERVICE

MOTOR CONTROL CENTERS CQO1, CQO4, CQO5 AND SH INCLUDING NEW FEEDER CABLES,

AND MODIFY DCQ2", which price and payment shall be full compensation for all work required to furnish and install new station service motor control centers CQO1, CQO4, CQO5 and SH including new feeder cables, and modify DCQ2 complete, and as specified and approved.

1.17 CLIN 0015 - FURNISH AND INSTALL NEW PANELBOARDS CQO3, FCQ1, AND FCQ2

Furnish and install new panelboards CQO3, FCQ1, and FCQ2 will be measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No. 0015, "FURNISH AND INSTALL NEW PANELBOARDS CQO3, CQO8, FCQ1, and FCQ2", which price and payment shall be full compensation for all work required to furnish and install new panelboards CQO3, FCQ1, and FCQ2 complete, as specified and approved.

1.18 CLIN 0016AA - FURNISH AND INSTALL NEW 480 VOLT GOVERNOR OIL PUMP

MOTORS IN UNITS 1 - 3

Furnish and install new 480 volt governor oil pump motors in units 1 - 3 will be measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No. 0016AA, "FURNISH AND INSTALL NEW 480 VOLT GOVERNOR OIL PUMP MOTORS IN UNITS 1 - 3", which price and payment shall be full compensation for all work required to furnish and install new 480 volt governor oil pump motors in units 1 - 3 complete, as specified and approved.

1.19 CLIN 0016AB - FURNISH AND INSTALL NEW 480 VOLT GOVERNOR OIL PUMP

MOTORS IN UNITS 4 - 6

Furnish and install new 480 volt governor oil pump motors for units 4 - 6 will be measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No. 0016AB, "FURNISH AND INSTALL NEW 480 VOLT GOVERNOR OIL PUMP MOTORS IN UNITS 4 - 6", which price and payment shall be full compensation for all work required to furnish and install new 480 volt governor oil pump motors for units 4 - 6 complete, as specified and approved.

1.20 CLIN 0017 - FURNISH AND INSTALL NEW 125V BATTERY CHARGERS BC1, BC2

AND BC3

Furnish and install new 125V battery chargers BC1, BC2 AND BC3 will be

SECTION 01 22 00.00 28 Page 6 measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No. 0017, "FURNISH AND INSTALL NEW 125V BATTERY CHARGERS BC1, BC2 AND BC3", which price and payment shall be full compensation for all work required to furnish and install new 125V battery chargers BC1, BC2 AND BC3, complete, as specified and approved.

1.21 CLIN 0018 - FURNISH AND INSTALL NEW BATTERY, BATTERY MONITORING

COMPUTER, CART, DIAGNOSTIC EQUIPMENT, WIRING, BATTERY MONITORING HARDWARE &

SOFTWARE PACKAGE

Furnish and install new battery, battery monitoring computer, cart, diagnostic equipment, wiring, battery monitoring hardware & software package will be measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No. 0018, "FURNISH AND INSTALL

NEW BATTERY, BATTERY MONITORING COMPUTER, CART, DIAGNOSTIC EQUIPMENT,

WIRING, BATTERY MONITORING HARDWARE & SOFTWARE PACKAGE", which price and payment shall be full compensation for all work required to furnish and install new battery, battery monitoring computer, cart, diagnostic equipment, wiring, battery monitoring hardware & software package as specified, and approved.

1.22 CLIN 0019 - FURNISH AND INSTALL NEW BATTERY SWITCHBOARDS, DC

DISTRIBUTION PANELBOARDS, 120V AC DISTRIBUTION PANELBOARDS, AND MANUAL

BREAKER TRANSFER PANELS INCLUDING NEW FEEDER CABLES

Furnish and install new battery switchboards, DC distribution panelboards, 120V AC distribution panelboards, and manual breaker transfer panels including new feeder cables will be measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No. 0019, "FURNISH AND INSTALL NEW BATTERY SWITCHBOARDS, DC DISTRIBUTION

PANELBOARDS, 120V AC DISTRIBUTION PANELBOARDS, AND MANUAL BREAKER TRANSFER

PANELS INCLUDING NEW FEEDER CABLES", which price and payment shall be full compensation for all work required to furnish and install new battery switchboards, DC distribution panelboards, 120V AC distribution panelboards, and manual breaker transfer panels including new feeder cables complete, as specified and approved.

1.23 CLIN 0020 - BATTERY ROOM MODIFICATIONS

Battery room modifications will be measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No. 0020, "BATTERY ROOM MODIFICATIONS", which price and payment shall be full compensation for all upgrades made to the battery room according to contract plans and specifications, as specified and approved.

Battery Room Upgrades consist of the following work items:

a. Remove existing belt driven exhaust fan EF-6 and provide direct drive exhaust fan (retain mark EF-6) and associated fire damper and duct work items.

b. Piping serving existing emergency shower and eyewash station.

c. Hydrogen Detector, Smoke Detector, Room Differential Pressure Switch, and Emergency Shower and Eyewash Station Water flow detector; with the output from each of these devices annunciated in the Control Room.

d. Combination Fire smoke damper in the supply air duct serving the battery room with power to the damper and activation annunciated in the Control Room.

e. Fire damper at the exhaust air opening in the Battery Room.

f. Battery Monitoring System

g. Fire rated battery room door and fire barrier signs

SECTION 01 22 00.00 28 Page 7

1.24 CLIN 0021 - FURNISH AND INSTALL SQ REMOTE CONTROL PANELS

Furnishing and installing SQ remote control panels will be measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No. 0021, "FURNISH AND INSTALL SQ REMOTE CONTROL PANELS", which price and payment shall be full compensation for all work required to furnish and install SQ remote control panels complete, as specified and approved.

1.25 CLIN 0022 - FURNISH AND INSTALL SBC PANEL

Furnishing and installing SBC panel will be measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No. 0022, "FURNISH AND INSTALL SBC PANEL", which price and payment shall be full compensation for all work required to furnish and install SBC panel complete, as specified and approved.

1.26 CLIN 0023 - FURNISH SPARE PARTS AND ACCESSORIES

Furnishing spare parts and accessories will be measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No. 0023, "FURNISH SPARE PARTS AND ACCESSORIES", which price and payment shall be full compensation for all work required to furnish spare parts and accessories complete, as specified and approved.

1.27 CLIN 0024 - CORE DRILLING AND CONCRETE WORK

Core drilling and concrete work will be measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No.

0024, "CORE DRILLING AND CONCRETE WORK", which price and payment shall be full compensation for all work required for core drilling and concrete work complete, as specified and approved.

1.28 CLIN 0025 - FURNISH O&M MANUALS

Furnishing O&M manuals will be measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No. 0025, "FURNISH O&M MANUALS", which price and payment shall be full compensation for all work required to furnish O&M manuals complete, as specified and approved.

1.29 CLIN 0026 - FURNISH FINAL RECORD DRAWINGS

Furnishing final record drawings will be measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No. 0026, "FURNISH FINAL RECORD DRAWINGS", which price and payment shall be full compensation for all work required to furnish final record drawings complete, as specified and approved.

1.30 CLIN 0027 - FURNISH COMMISSIONING SERVICES AND TRAINING

Furnishing commissioning services and training will be measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No. 0027, "FURNISH COMMISSIONING SERVICES AND TRAINING", which price and payment shall be full compensation for all work required to furnish commissioning services complete, as specified and approved.

SECTION 01 22 00.00 28 Page 8

1.31 CLIN 0028 - FIRESTOPPING

Firestopping will be measured for payment as a complete pay item (JOB).

Payment will be made at the lump sum price for CLIN No. 0028, "FIRESTOPPING", which price and payment shall be full compensation for all work required for firestopping, complete, as specified and approved.

1.32 CLIN 0029 - FURNISH AND INSTALL NEW CABLE TRAYS

Furnishing and installing new cable trays will be measured for payment as a complete pay item (JOB). Payment will be made at the lump sum price for CLIN No. 0029, "FURNISH AND INSTALL NEW CABLE TRAYS ", which price and payment shall be full compensation for all work required for furnishing and installing new cable trays, complete, as specified and approved.

PART 2 PRODUCTS (NOT APPLICABLE)

PART 3 EXECUTION (NOT APPLICABLE)

-- End of Section --

SECTION 01 22 00.00 28 Page 9 Amendment-002 g4ecctgh

Amendment-002 - Paragraph 1.32

THIS PAGE INTENTIONALLY LEFT BLANK

SECTION 01 22 00.00 28 Page 10

SECTION TABLE OF CONTENTS

DIVISION 25 - INTEGRATED AUTOMATION

SECTION 25 05 11.00 28

CYBERSECURITY

PART 1 GENERAL

1.1 GENERAL INFORMATION

1.2 REFERENCES

1.3 SUBMITTALS

1.3.1 Encrypted Submittal Requirements

1.3.2 Submittals of Lists

1.4 DEFINITIONS

1.5 CONTRACTOR PERSONNEL QUALIFICATIONS

1.6 CONTRACTOR PORTABLE ELECTRONIC DEVICES (PED)

1.6.1 Prohibited Activities

1.7 CYBERSECURITY REQUIREMENTS

1.8 SECURE CONFIGURATIONS OF COMPUTER OPERATING SYSTEMS

1.8.1 Principle of Least Privilege

1.8.1.1 Service Level Accounts

1.8.1.2 Operator Level Accounts

1.8.1.3 Administration Level Accounts

1.8.2 Application Separation

1.9 BASIC INPUT/OUTPUT SYSTEM (BIOS)/ UNIFIED EXTENSIBLE FIRMWARE

INTERFACE (UEFI) PROTECTION

1.10 LOGGING AND AUDITING

1.11 COMMUNICATIONS

1.12 CONTROL DEVICE CODE PROTECTION

1.13 LOCKING PROVISIONS

1.14 REMOTE ACCESS

PART 2 PRODUCTS

2.1 COMPLETE SOFTWARE LIST

2.1.1 Antivirus/Antimalware Software

2.2 COMPLETE HARDWARE LIST

2.3 PORTS, PROTOCOLS, AND SERVICES LIST (Encrypted)

2.4 SYSTEM NETWORK DOCUMENTATION

2.5 DEFAULT PASSWORDS

2.6 ACCOUNT MANAGEMENT

2.7 INITIAL BACKUPS

2.7.1 BACKUP SOFTWARE (Encrypted)

2.8 MANAGED NETWORK SWITCHES

PART 3 EXECUTION

3.1 UNNECESSARY SOFTWARE AND SERVICES

3.2 SECURITY CONFIGURATION AUTOMATION PROTOCOL (SCAP) TOOL

3.3 FIELD QUALITY CONTROL

3.3.1 Training

3.3.2 Cybersecurity Field Verification

SECTION 25 05 11.00 28 Page 1 Amendment-002 g4ecctgh

Amendment-002 - Paragraph 1.1(c)(1)

3.3.2.1 Cybersecurity Field Verification Request

3.3.2.2 Verification for Each System

-- End of Section Table of Contents --

SECTION 25 05 11.00 28 Page 2

SECTION 25 05 11.00 28

CYBERSECURITY

PART 1 GENERAL

1.1 GENERAL INFORMATION

a. This section covers Department of Defense (DoD) Risk Management Framework (RMF) cybersecurity requirements for USACE Operational Technology. These requirements must be met in order to verify and deliver components to the government in an Interim Secure State (ISS).

b. ISS is achieved when the cybersecurity risks for the Operational Technology are known, documented and the system has been verified to be technically and physically secure to an acceptable risk tolerance during the installation phase.

c. The requirements of this SECTION apply to the following Specifications SECTIONS:

1. Section 40 95 00.00 26, SCADA PROGRAMMABLE LOGIC CONTROLLERS

40 95 00.00 28 PROCESS CONTROL

1.2 REFERENCES

The publications listed below form a part of this section to the extent referenced. The publications are referred to within the text by the basic designation only.

U.S. DEPARTMENT OF DEFENSE (DOD)

DOD Directive 8140.01 (2015) Cyberspace Workforce Management

DOD 8500.01 (2014) Cybersecurity

DOD 8510.01 (2014; Change 1-2016) Risk Management Framework (RMF) for DoD Information Technology (IT)

DOD 8570.01-M (2005; Change 4, 2015) Information Assurance Workforce Improvement Program

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST)

NIST FIPS 140-2 (2001) Security Requirements for Cryptographic Modules

NIST SP 800-37 (2018; Revision 2) Risk Management Framework for Information Systems and Organizations

U.S. ARMY (DA)

DA PAM 25-2-6 (2019)Cybersecurity Training and

SECTION 25 05 11.00 28 Page 3 Amendment-002 g4ecctgh

Amendment-002 - Paragraph 1.1(c)(1)

Certification Program

DA PAM 25-2-13 (2019)Army Identity, Credential, and Access Management and Public Key Infrastructure Implementing Instruction

FEDERAL SPECIFICATIONS

FF-P-2827A Padlock, Key Operated, General Field Service

1.3 SUBMITTALS

Government approval is required for submittals with a "G" designation;

USACE Critical Infrastructure Cybersecurity Mandatory Center of Expertise(UCIC-MCX)review is required for submittals with a "CS" designation; submittals having an "I" designation are for information only. Designation following the "G", "CS", or "I" designation identifies the office that will review the submittal for the Government. Submit in accordance with SECTION 01 33 00 SUBMITTAL PROCEDURES:

SD-01 Preconstruction Submittals

Submit within 30 days after Notice to Proceed:

Account Level Permissions List (Encrypted); G, CS, EL Sensitive Data Protection Plan (Encrypted); G, CS, EL

SD-02 Shop Drawings

Submit within 60 days after Notice to Proceed:

Network Diagram (Encrypted); G, CS, EL System Data Flow Diagram (Encrypted); G, CS, EL

SD-03 Product Data

Submit within 30 days after Notice to Proceed:

Pre-Construction Software List (Encrypted); G, CS, EL Pre-Construction Hardware List (Encrypted); G, CS, EL

Submit within 60 days prior to Site Acceptance Testing:

Complete Software List (Encrypted); G, CS, EL Complete Hardware List (Encrypted); G, CS, EL Ports, Protocols, and Services List (Encrypted); G, CS, EL Certificate Protection Status (Encrypted); G, CS, EL Backup Software (Encrypted); I, CS, EL

SD-05 Design Data

Submit within 60 days after Notice to Proceed:

Network Configuration Files (Encrypted); G, CS, EL

Submit within 60 days prior to anticipated date of deviation operation:

SECTION 25 05 11.00 28 Page 4

Deviations List (Encrypted); G, CS, EL

SD-06 Test Reports

Submit no later than 30 days after completion of scans:

SCAP Tool Scan (Encrypted); G, CS, EL Antivirus/Antimalware Scan (Encrypted); G, CS, EL

SD-07 Certificates

Submit within 30 days after Notice to Proceed:

Contractor Personnel Qualifications; G, CS, EL

SD-11 Closeout Submittals

Submit 60 days or more before completion of work:

Vulnerability Resolution Report (Encrypted); G, CS, EL Comprehensive Password/Passphrase List (Encrypted); G, CS, EL Comprehensive Account List (Encrypted); G, CS, EL Initial Backups (Encrypted); G, CS, EL BIOS/UEFI Protection Password/Passphrase List (Encrypted); G, CS, EL

1.3.1 Encrypted Submittal Requirements

a. The submission process and authorized recipients for submittals specified as "Encrypted" must be provided at the Pre-Work meeting.

b. Encrypted submittals must be sent via DoD SAFE https://safe.apps.mil/

c. Data for encrypted submittals is sensitive and must be protected by the Contractor. Contractor must only disclose sensitive information to those who need to know. Sensitive information must not be stored on shared storage systems. Spreadsheets must be password protected.

Submit a Sensitive Data Protection Plan (encrypted) which includes a list of individuals authorized to access the sensitive information, and descriptions of how sensitive data will be protected while in use, at rest, in transit, and also during disposal (deletion of sensitive data after contract completion).

1.3.2 Submittals of Lists

Contractor must submit the following using Government-provided Excel spreadsheets that have been pre-formatted with appropriate row/column headers. Spreadsheets may be provided as attachments to the contract and/or during the Pre-Work Meeting. Alternatively, spreadsheets will be provided to the Contractor upon request after Notice to Proceed.

a. Pre-Construction Software List.

b. Pre-Construction Hardware List.

c. Complete Software List.

d. Complete Hardware List.

SECTION 25 05 11.00 28 Page 5

e. Ports, Protocols, and Services List.

f. Comprehensive Password/Passphrase List.

g. Comprehensive Account List.

h. BIOS Protection Password/Passphrase List.

i. Certificate Protection Status List.

j. Deviation List.

1.4 DEFINITIONS

a. BIOS: Basic Input/Output System.

b. CCI: Control Correlation Identifier. See https://public.cyber.mil/STIGS/CCI/for information.

c. CISA: Cybersecurity and Infrastructure Security Agency. See https://www.cisa.gov/ for information.

d. COR: Contracting Officer's Representative.

e. DA: Department of the Army

f. DA PAM: Department of the Army Pamphlet.

g. DISA: Defense Information Security Agency.

h. IAVAs: Information Assurance Vulnerability Alerts. See https://iavm.csd.disa.mil/ for additional information.

i. ISO: Information System Owner.

j. ISO-DR: Information System Owner's Delegated Representative.

Government Representative.

k. ISS: Interim Secure State.

l. IT: Information Technology.

m. KO: Contracting Officer.

n. NIST: National Institute of Standards and Technology

o. OT: Operational Technology.

p. RMF: Risk Management Framework. See DOD 8510.01, and NIST SP 800-37 for information and requirements.

q. SCAP: Security Configuration Automation Protocol. See https://public.cyber.mil/STIGS/SCAP/for information.

r. SHB: Secure Host Baseline, or Army Gold Master. An image for certain Windows-based operating systems is available from the Government, upon request.

SECTION 25 05 11.00 28 Page 6

s. STIGs: Security Technical Implementation Guides, as released by the Defense Information Security Agency (DISA). See https://public.cyber.mil/STIGS for information.

t. USACE: United States Army Corps of Engineers.

u. UCIC-MCX: USACE Critical Infrastructure Cybersecurity Mandatory Center of Expertise

v. VLAN: Virtual LAN (Local Area Network).

1.5 CONTRACTOR PERSONNEL QUALIFICATIONS

a. Contractors performing cybersecurity functions must obtain the appropriate DoD approved cybersecurity baseline certification prior to being engaged. The Contractor must ensure that personnel accessing information systems have the proper and current cybersecurity certification to perform cybersecurity functions:

1. DOD Directive 8140.01, Cyberspace Workforce Management.

2. DOD 8570.01-M, Information Assurance Workforce Improvement Program, Information Assurance Technical (IAT). See https://public.cyber.mil/cwmp/dod-approved-8570-baseline-certifications/ for Approved Baseline IAT Certifications.

3. DA PAM 25-2-6, Cybersecurity Training and Certification Program

b. All Contractors who will have access to make changes to the Operational Technology must sign the OT Acceptable Use Policy (AUP) prior to accessing the Operational Technology.

1.6 CONTRACTOR PORTABLE ELECTRONIC DEVICES (PED)

a. All Contractor personnel and equipment that will connect to USACE-owned systems are subject to the requirements of this SECTION.

This includes all Contractor equipment, including laptops and other portable devices, that will not be delivered to USACE as part of this contract.

b. All Contractor PEDs must be approved by the Contracting Officer (KO), Contracting Officer's Representative (COR), or designated USACE site personnel prior to connection to USACE-owned systems.

c. For compliance, security, and network maintenance purposes, authorized individuals within USACE may monitor equipment, systems, and network traffic at any time, per the existing acceptable use and audit policies. USACE reserves the right to audit networks and systems on a periodic basis to ensure compliance with Army policy.

Users connecting to USACE-owned equipment with approved PEDs consent to monitoring and inspection of their equipment.

d. PEDs approved for connection to USACE-owned systems equipment must meet the following requirements:

1. Be subject to scanning or checking by designated USACE personnel before connecting to any USACE-owned equipment. This process will be repeated before connection each time the PED goes off-site (crosses the facility boundary).

SECTION 25 05 11.00 28 Page 7

2. Undergo regular maintenance to ensure the PED is patched and up-to-date, and a current full antivirus scan has been completed within the previous 10 days.

3. Ensure the PED firewall is enabled and set to "Public".

4. Demonstrate that all required patching and software/firmware updates have been applied, and compliance with any applicable STIG (Security Technical Implementation Guides) version and release is achieved.

5. Employ data-at-rest encryption to protect information stored on the device. The types of information that must be protected include the following:

i. Site specific drawings.

ii. Configuration files.

iii. Project files.

iv. Vulnerability data.

v. Any specific information that could potentially lead to a compromise.

e. If limited connectivity to the Internet is required to update software patches and retrieve updated virus definitions, the following requirements must be met:

1. The host based firewall on the computer must be enabled and the network identifier for the Internet connection must be set to "Public".

2. After the software patches are applied and the virus definitions updated, the computer must be isolated from the Internet connection, and a full scan with the Antivirus Software completed, resulting with no detections, prior to connection to the USACE-owned equipment.

3. Prior to connecting to the equipment, network, or system, antivirus definition files must be verified to be less than seven days old and a full scan has been completed.

f. In the event that an authorized or approved non-USACE-owned PED is lost or stolen, user must immediately notify the Contracting Officer or Contracting Officer's Representative.

1.6.1 Prohibited Activities

a. Under no circumstances are users authorized to engage in any activity that is illegal under local, state, federal or international law while utilizing authorized or approved USACE-owned or non-USACE-owned resources related to work on this contract. The following activities are strictly prohibited with regards to connecting authorized or approved USACE-owned or non-USACE-owned PEDs to USACE-owned equipment, with no exceptions:

SECTION 25 05 11.00 28 Page 8

1. Using Operational Technology or other related monitoring and/or control systems for any personal use.

2. Connecting unauthorized or unapproved non-USACE PEDs to USACE equipment, systems, or networks.

3. Intentional introduction of malicious programs into the network or server (e.g., viruses, worms, Trojan horses, e-mail bombs, etc.).

4. Port scanning or security scanning without prior notification to the KO, in coordination with designated site OT personnel.

5. Executing any form of network monitoring which will intercept data not intended for the user's host, unless this activity is a part of the user's normal job/duty.

6. Hotspot-capable PEDs are not permitted to broadcast Wi-Fi signals as an access point (i.e. function as a router for a wireless network) within and/or around certain areas of the USACE facility premises (e.g., control room and computer server room, unit control equipment enclosures such as RTU cabinets, digital governor or exciter cabinets, etc.) and must not be connected to USACE equipment, systems, or networks.

7. PEDs must not be loaned or otherwise given to any person other than whom the device is assigned to.

8. Exporting software, technical information, encryption software or technology, which is in violation of international or regional export control laws. Notify the KO or COR of any material that is in question. Material in question shall only be exported with KO or COR approval.

b. Any use of email on Operational Technology and any related monitoring/control of USACE systems or networks is prohibited.

c. Any user found to have violated this policy may be subject to disciplinary action.

1.7 CYBERSECURITY REQUIREMENTS

a. All items and components provided by the Contactor must meet all Cybersecurity Requirements of this Specification, as well as DOD 8500.01and DOD 8510.01. Include all applicable current Cybersecurity regulations, policies, and processes from these documents.

b. Prior to Government acceptance of the system, the Contractor must adhere to all vendor-specific, CISA, and IAVA alert requirements for reporting, patching, and/or mitigating. Contractor must address all vulnerabilities for Contractor provided hardware and software within 30 days of the alert.

c. Notify the Contracting Officer or Contracting Officer's Representative within 48 hours of receipt of an alert and within 48 hours of resolution. Prior to anticipated Government acceptance, submit a Vulnerability Resolution Report (encrypted). The report must identify the vulnerability alert ID and the date of resolution for

SECTION 25 05 11.00 28 Page 9 each component.

1.8 SECURE CONFIGURATIONS OF COMPUTER OPERATING SYSTEMS

a. Configure the Operating System and all Network accessible devices following the Principle of Least Privilege and Application Separation as described below.

b. Configure the following per the latest STIG (STIG in place at the time of Government acceptance). Assume STIGs requirements will be similar to those in place at time of contract Award.

1. All Operating Systems. Use the USACE-provided Army Gold Master image for Windows-based operating systems in the control systems.

2. All Network accessible devices.

c. Install the most current versions of the following, unless otherwise specified or approved. All applicable updates to software or firmware must be applied to systems prior to delivery to the Government.

1. Operating Systems.

2. Software updates.

3. Firmware updates.

4. Security Patches.

5. Service Packs.

6. BIOS/UEFI.

1.8.1 Principle of Least Privilege

a. All Operating Systems and Network accessible devices must be configured using the Principle of Least Privilege. Principle of Least Privilege must be used for all of the following:

1. Operating System permissions.

2. File access.

3. User accounts.

4. Application-to-application communications.

b. Configure Operational Technology using a role-based access control scheme so that normal operations occur using an Operator level account, with minimum privileges required to operate the system. See paragraph "Operator Level Accounts", below, for additional information and requirements.

c. Unnecessary/unused accounts must be removed from the Operational Technology. Any "guest-level" accounts that are created on the system by default must be disabled.

SECTION 25 05 11.00 28 Page 10

d. Submit Account Level Permissions List (Encrypted) and allowable operations for the following account levels:

1. Service Level Accounts.

2. Operator Level Accounts.

3. Administration Level Accounts.

1.8.1.1 Service Level Accounts

All required Service Level Accounts must be created as normal users with no administrative permissions. Removable media devices and USB ports (with the exception of keyboard and mouse) must be disabled.

1.8.1.2 Operator Level Accounts

Operator Level Accounts allow normal operation of the system, but do not allow for any configuration changes. Removable media devices and USB ports (with the exception of keyboard and mouse) must be disabled. The Contractor must document the minimum privileges required for the Operator level account in the Account Level Permissions submittal.

1.8.1.3 Administration Level Accounts

a. Administration-level (privileged access) accounts are required to perform any configuration changes on the system. Separate administration-level accounts must be created for each administrator on the system.

b. Removable media devices and USB ports will be available for Administration Level Accounts, only. The availability of the USB ports and removable media devices must be configurable using the accounts on the system.

1.8.2 Application Separation

a. Application Separation utilizes the operating system on the primary partition of the hard drive.

1. Application Databases. Application databases must be installed on a different partition than the Operating System (OS).

2. Web servers. Web servers must be installed on a different partition than the Operating System (OS).

3. Web servers and database servers must not be installed on the same computer.

b. For Virtual Machines, web servers and database servers must not be hosted on the same Virtual Machine.

1.9 BASIC INPUT/OUTPUT SYSTEM (BIOS)/ UNIFIED EXTENSIBLE FIRMWARE

INTERFACE (UEFI) PROTECTION

a. Provide a protection mechanism to prevent unwanted changes to the system BIOS/UEFI for all devices on the system, where technically feasible.

SECTION 25 05 11.00 28 Page 11

b. All BIOS/UEFI Protection Mechanisms must utilize passwords, and passphrases, that conform to DoD STIG requirements. BIOS/UEFI Protection passwords must be used to allow access by system engineering and administrative personnel after initial commissioning of the system.

c. Where technically feasible, all systems must have Unified Extensible Firmware Interface (UEFI)…