Amendment 0004 TechSpecs.pdf

Lower Monumental Navigation Lock Power & Controls Upgrade W912EF-22-R-0002 Amend-0004

SECTION TABLE OF CONTENTS

DIVISION 25 - INTEGRATED AUTOMATION

SECTION 25 05 11.00 28

CYBERSECURITY

06/03/2020

PART 1 GENERAL

1.1 GENERAL INFORMATION

1.2 REFERENCES

1.3 SUBMITTALS

1.3.1 Encrypted Submittal Requirements

1.3.2 Submittals of Lists

1.4 DEFINITIONS

1.5 CONTRACTOR PERSONNEL

1.6 CONTRACTOR PORTABLE ELECTRONIC DEVICES (PED)

1.6.1 Prohibited Activities

1.7 CYBERSECURITY REQUIREMENTS

1.8 SECURE CONFIGURATIONS OF COMPUTER OPERATING SYSTEMS

1.8.1 Principle of Least Privilege

1.8.1.1 Service Level Accounts

1.8.1.2 Operator Level Accounts

1.8.1.3 Administration Level Accounts

1.8.2 Application Separation

1.9 BASIC INPUT/OUTPUT SYSTEM (BIOS)/ UNIFIED EXTENSIBLE FIRMWARE

INTERFACE (UEFI) PROTECTION

1.10 LOGGING AND AUDITING

1.11 COMMUNICATIONS

1.12 CONTROL DEVICE CODE PROTECTION

1.13 LOCKING PROVISIONS

1.14 REMOTE ACCESS

PART 2 PRODUCTS

2.1 COMPLETE SOFTWARE LIST

2.1.1 Antivirus/Antimalware Software

2.2 COMPLETE HARDWARE LIST

2.3 PORTS, PROTOCOLS, AND SERVICES LIST (Encrypted)

2.4 SYSTEM NETWORK DOCUMENTATION

2.5 DEFAULT PASSWORDS

2.6 ACCOUNT MANAGEMENT

2.7 INITIAL BACKUPS

2.7.1 Backup Software

PART 3 EXECUTION

3.1 UNNECESSARY SOFTWARE AND SERVICES

3.2 SECURITY CONFIGURATION AUTOMATION PROTOCOL (SCAP) TOOL

3.3 FIELD QUALITY CONTROL

3.3.1 Cybersecurity Field Verification

3.3.1.1 Cybersecurity Field Verification Request

3.3.1.2 Verification for Each System

3.4 TRAINING

SECTION 25 05 11.00 28

G4ODTLKC

Line

-- End of Section Table of Contents --

SECTION 25 05 11.00 28

SECTION 25 05 11.00 28

CYBERSECURITY

06/03/2020

PART 1 GENERAL

1.1 GENERAL INFORMATION

a. This section covers the cybersecurity requirements for Operational Technology in order to verify and deliver components to the Project in an Interim Secure State (ISS).

b. ISS is achieved when the cybersecurity risk for the Operational Technology is known and the system has been verified to be technically and physically secure to an acceptable risk tolerance during the installation phase.

c. The requirements of this SECTION apply to the following Specifications SECTIONS:

1.2 REFERENCES

The publications listed below form a part of this section to the extent referenced. The publications are referred to within the text by the basic designation only.

U.S. DEPARTMENT OF DEFENSE (DOD)

DOD Directive 8140.01 (2015) Cyberspace Workforce Management

DOD 8500.01 (2014; Change 1-2019) Cybersecurity

DOD 8510.01 (2014; Change 1-2016; Change 2-2017) Risk Management Framework (RMF) for DoD Information Technology (IT)

DOD 8570.01-M (2005; Change 4, 2015) Information Assurance Workforce Improvement Program

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST)

NIST FIPS 140-2 (2001) Security Requirements for Cryptographic Modules

NIST SP 800-37 (2018; Revision 2) Risk Management Framework for Information Systems and Organizations

U.S. ARMY (DA)

DA PAM 25-2-13 (2019)Army Identity, Credential, and Access Management and Public Key Infrastructure Implementing Instruction

SECTION 25 05 11.00 28

1.3 SUBMITTALS

Government approval is required for submittals with a "G" designation;

submittals having an "I" designation are for information only. A designation following the "G" or "I" designation identifies the office that will review the submittal for the Government. The following shall be submitted in accordance with SECTION 01 33 00 SUBMITTAL PROCEDURES:

Critical Infrastructure Cybersecurity Mandatory Center of Expertise (UCIC-MCX) review is required for submittals with a "CS" office code.

Submi t i n accor dance wi t h t he i nf or mat i on pr ovi ded bel ow i n par agr aph " Encr ypt ed Submi t t al Requi r ement s. " SECTION 01 33 00 SUBMITTAL PROCEDURES will not be followed for submittals for this specification unless noted.

SD-01 Preconstruction Submittals

Account Level Permissions List (Encrypted); G, CS

Sensitive Data Protection Plan (Encrypted); G, CS

SD-02 Shop Drawings

Network Diagram of Power Electronic Control System (Encrypted); G, CS

System Data Flow Diagram (Encrypted); G, CS

SD-03 Product Data

Pre-Construction Software List (Encrypted); G, CS

Pre-Construction Hardware List (Encrypted); G, CS

Complete Software List (Encrypted); G, CS

Complete Hardware List (Encrypted); G, CS

Ports, Protocols, and Services List (Encrypted); G, CS

Certificate Protection Status (Encrypted); G, CS

Backup Software (Encrypted); I, CS

SD-05 Design Data

Deviations List (Encrypted); G, CS

SD-06 Test Reports

SCAP Tool Scan (Encrypted); G, CS

Antivirus/Antimalware Scan (Encrypted); G, CS

SD-07 Certificates

Contractor Personnel Qualifications; G, CS Submit this submittal in accordance with the SECTION 01 33 00

SUBMITTAL PROCEDURES.

SD-11 Closeout Submittals

Vulnerability Resolution Report (Encrypted); G, CS

Comprehensive Password/Passphrase List (Encrypted); G, CS

Comprehensive Account List (Encrypted); G, CS

Initial Backups (Encrypted); G, CS

BIOS/UEFI Protection Password/Passphrase List (Encrypted); G, CS

1.3.1 Encrypted Submittal Requirements

a. Submi t submi t t al s speci f i ed as " Encr ypt ed" usi ng onl y t he DoD SAFE websi t e ( ht t ps: / / saf e. apps. mi l / ) and not through RMS 3.0. The Contracting Officer will provide the POC and explain the submittal process after Notice to Proceed. Include the transmittal form (ENG Form 4025) with each submittal.

b. The Contractor shall also complete the ENG Form 4025 in RMS 3.0 Contractor Mode for each "Encrypted" submittal sent via the DoD SAFE website.

c. Dat a f or encr ypt ed submi t t al s i s sensi t i ve and must be pr ot ect ed by t he Cont r act or . Contractor must only disclose sensitive information to those who need to know. Sensitive information must not be stored on shared storage systems. Spreadsheets must be password protected.

Submit a list of individuals authorized to access the sensitive information and a Sensitive Data Protection Plan (encrypted).

1.3.2 Submittals of Lists

Contractor must submit the following using a Government-provided Excel spreadsheet. Spreadsheet will be provided to the Contractor upon request after Notice to Proceed.

a. Pre-Construction Software List.

b. Pre-Construction Hardware List.

c. Complete Software List.

d. Complete Hardware List.

e. Ports, Protocols, and Services List.

f. Comprehensive Password/Passphrase List.

g. Comprehensive Account List.

h. BIOS Protection Password/Passphrase List.

i. Certificate Protection Status List.

j. Deviation List.

1.4 DEFINITIONS

a. BIOS: Basic Input/Output System.

b. CCI: Control Correlation Identifier. See https://public.cyber.mil/STIGS/CCI/ for information.

c. CISA: Cybersecurity and Infrastructure Security Agency. See https://www.cisa.gov/ for information.

d. COR: Contracting Officer's Representative.

e. DA: Department of the Army

f. DA PAM: Department of the Army Pamphlet.

g. DISA: Defense Information Security Agency.

h. IAVAs: Information Assurance Vulnerability Alerts. See https://iavm.csd.disa.mil/ for additional information.

i. ISO: Information System Owner.

j. ISO-DR: Information System Owner's Delegated Representative.

Government Representative.

k. ISS: Interim Secure State.

l. IT: Information Technology.

m. KO: Contracting Officer.

n. NIST: National Institute of Standards and Technology

o. OT: Operational Technology.

p. RMF: Risk Management Framework. See DOD 8510.01 , and NIST SP 800-37 for information and requirements.

q. SCAP: Security Configuration Automation Protocol. See https://public.cyber.mil/STIGS/SCAP/ for information.

r. SHB: Secure Host Baseline, or Army Gold Master. An image for certain Windows-based operating systems is available from the Government, upon request.

s. STIGs: Security Technical Implementation Guides, as released by the Defense Information Security Agency (DISA). See https://public.cyber.mil/STIGS for information.

t. USACE: United States Army Corps of Engineers.

u. UCIC-MCX: USACE Critical Infrastructure Cybersecurity Mandatory Center of Expertise

v. VLAN: Virtual LAN (Local Area Network).

1.5 CONTRACTOR PERSONNEL

a. Contractors performing cybersecurity functions must obtain the appropriate DoD approved cybersecurity baseline certification prior to being engaged. The Contractor must ensure that personnel accessing information systems have the proper and current cybersecurity certification to perform cybersecurity functions:

1. DOD Directive 8140.01 , Cyberspace Workforce Management.

2. DOD 8570.01-M , Information Assurance Workforce Improvement Program, Information Assurance Technical (IAT). See https://public.cyber.mil/cwmp/dod-approved-8570-baseline-certifications/ for Approved Baseline IAT Certifications.

3. DA PAM 25-2-6, Cybersecurity Training and Certification Program

b. Submit Contractor personnel qualifications for acceptance a minimum of 30 days after notice to proceed.

c. All Contractors who will have access to make changes to the Operational Technology must sign the OT Acceptable Use Policy (AUP) prior to accessing the Operational Technology.

1.6 CONTRACTOR PORTABLE ELECTRONIC DEVICES (PED)

a. All Contractor personnel and equipment that will connect to USACE-owned systems are subject to the requirements of this SECTION.

This includes all Contractor equipment, including laptops and other portable devices, that will not be delivered to USACE as part of this contract.

b. All Contractor PEDs must be approved by the Contracting Officer (KO) or Contracting Officer's Representative (COR) for connection to USACE-owned systems prior to connection.

c. For compliance, security, and network maintenance purposes, authorized individuals within USACE may monitor equipment, systems, and network traffic at any time, per the existing acceptable use and audit policies. USACE reserves the right to audit networks and systems on a periodic basis to ensure compliance with Army policy.

Users connecting to USACE-owned equipment with approved PEDs consent to monitoring and inspection of their equipment.

d. PEDs approved for connection to USACE-owned systems equipment must meet the following requirements:

1. Be subject to scanning or checking by designated USACE personnel before being connected to any USACE-owned equipment.

This process will be repeated before connection each time the PED goes off-site (crosses the facility boundary).

2. Undergo regular maintenance ensuring the PED is patched and up to date and a current full antivirus scan has been completed within the previous 10 days.

3. Ensure the PED firewall is enabled and set to "Public".

4. Demonstrate that all required patching and software/firmware updates are applied, and compliance with any applicable STIGs (Security Technical Implementation Guides) version and release is achieved.

5. Employ data-at-rest encryption to protect information stored on the device. The types of information that must be protected include the following:

i. Site specific drawings.

ii. Configuration files.

iii. Project files.

iv. Vulnerability data.

v. Any specific information that could potentially lead to a compromise.

e. If limited connectivity to the Internet is required to update software patches and retrieve updated virus definitions, the following requirements must be met:

1. The host based firewall on the computer must be enabled and the network identifier for the Internet connection must be set to "Public".

2. After the software patches are applied and the virus definitions updated, the computer must be isolated from the Internet connection, and a full scan with the Antivirus Software completed, resulting with no detections, prior to connection to the USACE-owned equipment.

3. Prior to connecting to the equipment, network, or system, antivirus definition files must be verified to be less than seven days old and a full scan has been completed.

f. In the event that an authorized or approved non-USACE-owned PED is lost or stolen, user must immediately notify the Contracting Officer or Contracting Officer's Representative.

1.6.1 Prohibited Activities

a. Under no circumstances are users authorized to engage in any activity that is illegal under local, state, federal or international law while utilizing authorized or approved USACE-owned or non-USACE-owned resources related to work on this contract. The following activities are strictly prohibited with regards to connecting authorized or approved USACE-owned or non-USACE-owned PEDs to USACE-owned equipment, with no exceptions:

1. Using Operational Technology or other related monitoring and/or control systems for any personal use.

2. Connecting unauthorized or unapproved non-USACE PEDs to USACE equipment, systems, or networks.

3. Intentional introduction of malicious programs into the network or server (e.g., viruses, worms, Trojan horses, e-mail bombs, etc.).

4. Port scanning or security scanning without prior notification to the KO, in coordination with designated site OT personnel.

5. Executing any form of network monitoring which will intercept data not intended for the user's host, unless this activity is a part of the user's normal job/duty.

6. Hotspot-capable PEDs are not permitted to broadcast Wi-Fi signals as an access point (i.e. function as a router for a wireless network) within and/or around certain areas of the USACE facility premises (e.g., control room and computer server room, unit control equipment enclosures such as RTU cabinets, digital governor or exciter cabinets, etc.) and must not be connected to USACE equipment, systems, or networks.

7. PEDs must not be loaned or otherwise given to any person other than whom the device is assigned to.

8. Exporting software, technical information, encryption software or technology, which is in violation of international or regional export control laws. Notify the KO or COR of any material that is in question. Material in question shall only be exported with KO or COR approval.

b. Any use of email on Operational Technology and any related monitoring/control of USACE systems or networks is prohibited.

c. Any user found to have violated this policy may be subject to disciplinary action.

1.7 CYBERSECURITY REQUIREMENTS

a. All items and components provided by the Contactor must meet all Cybersecurity Requirements of this Specification, as well as DOD 8500.01 and DOD 8510.01 . Include all applicable current Cybersecurity regulations, policies, and processes from these documents.

b. Prior to Government acceptance of the system, the Contractor must adhere to all vendor-specific, CISA, and IAVA alert requirements for reporting, patching, and/or mitigating. Contractor must address all vulnerabilities for Contractor provided hardware and software within 30 days of the alert.

c. Notify the Contracting Officer or Contracting Officer's Representative within 48 hours of receipt of an alert and within 48 hours of resolution. Prior to anticipated Government acceptance, submit a Vulnerability Resolution Report (encrypted). The report must identify the vulnerability alert ID and the date of resolution for each component.

1.8 SECURE CONFIGURATIONS OF COMPUTER OPERATING SYSTEMS

a. Configure the Operating System and all Network accessible devices following the Principle of Least Privilege and Application Separation as described below.

b. Configure the following per the latest STIG (STIG in place at the time of Government acceptance).

1. All Operating Systems.

2. All Network accessible devices.

c. Install the most current versions of the following, unless otherwise specified or approved. All applicable updates to software or firmware must be applied to systems prior to delivery to the Government.

1. Operating Systems.

2. Software updates.

3. Firmware updates.

4. Security Patches .

5. Service Packs.

6. BIOS/UEFI.

1.8.1 Principle of Least Privilege

a. All Operating Systems and Network accessible devices must be configured using the Principle of Least Privilege. Principle of Least Privilege must be used for all of the following:

1. Operating System permissions.

2. File access.

3. User accounts.

4. Application-to-application communications.

b. Configure Operational Technology using a role-based access control scheme so that normal operations occur using an Operator level account, with minimum privileges required to operate the system. See paragraph "Operator Level Accounts", below, for additional information and requirements.

c. Unnecessary/unused accounts must be removed from the Operational Technology. Any "guest-level" accounts that are created on the system by default must be disabled.

d. Submit Account Level Permissions List (Encrypted) and allowable operations for the following account levels a minimum of 30 calendar days prior to anticipated beginning of account configurations:

1. Service Level Accounts.

2. Operator Level Accounts.

3. Administration Level Accounts.

1.8.1.1 Service Level Accounts

All required Service Level Accounts must be created as normal users with no administrative permissions. Removable media devices and USB ports (with the exception of keyboard and mouse) must be disabled.

1.8.1.2 Operator Level Accounts

Operator Level Accounts allow normal operation of the system, but do not allow for any configuration changes. Removable media devices and USB ports (with the exception of keyboard and mouse) must be disabled. The Contractor must document the minimum privileges required for the Operator level account in the Account Level Permissions submittal.

1.8.1.3 Administration Level Accounts

a. Administration-level (privileged access) accounts are required to perform any configuration changes on the system. Separate administration-level accounts must be created for each administrator on the system.

b. Removable media devices and USB ports will be available for Administration Level Accounts, only. The availability of the USB ports and removable media devices must be configurable using the accounts on the system.

1.8.2 Application Separation

a. Application Separation utilizes the operating system on the primary partition of the hard drive.

1. Application Databases. Application databases must be installed on a different partition than the Operating System (OS).

2. Web servers. Web servers must be installed on a different partition than the Operating System (OS).

3. Web servers and database servers must not be installed on the same computer.

b. For Virtual Machines, web servers and database servers must not be hosted on the same Virtual Machine.

1.9 BASIC INPUT/OUTPUT SYSTEM (BIOS)/ UNIFIED EXTENSIBLE FIRMWARE

INTERFACE (UEFI) PROTECTION

a. Provide a protection mechanism to prevent unwanted changes to the system BIOS/UEFI for all devices on the system, where technically feasible.

b. All BIOS/UEFI Protection Mechanisms must utilize passwords, and passphrases, that conform to DoD STIG requirements. BIOS/UEFI Protection passwords must be used to allow access by system engineering and administrative personnel after initial commissioning of the system.

c. Where technically feasible, all systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run UEFI mode, not Legacy BIOS mode.

d. Submit within 30 calendar days prior to anticipated Government acceptance of the system, all BIOS/UEFI Protection Password/Passphrase List (Encrypted) to the Contracting Officer.

1.10 LOGGING AND AUDITING

a. Design the Operational Technology to log critical events and operator actions related to the operation of the system. The critical events will be defined by the Government at the Pre-Work meeting.

b. The log of operator actions must only be accessible from an Administration Level account on the system. The operations log must include the following:

1. A time stamp.

2. The control action taken.

3. The account through which the action was initiated.

c. Configure Operating System logging per the STIG requirements without exception, including the specified minimum log sizes defined in the STIG.

1.11 COMMUNICATIONS

a. Protect the following communications using NIST FIPS 140-2 compliant encryption methods (see https://csrc.nist.gov/publications/detail/fips/140/2/final for additional information:

1. Public switched telephone network.

2. Leased lines.

3. Any wireless communication.

b. Establish Virtual Private Network IPSec tunnels between different facilities, including all wireless devices, using approved network devices. See https://aplits.disa.mil/processAPList.action for additional information.

c. Protected communications must use Digital Certificates, where possible. Self-signed certificates are acceptable. Document communications devices that cannot be Certificate protected. Submit Certificate Protection Status (Encrypted) for all communication devices prior to any Contractor equipment requiring certificates arriving at the Project site.

d. Firewalls must be utilized to control communications between tunnels. Firewalls must meet STIG requirements.

e. The proposed network and wireless devices must be selected from the DISA approved product list (APL). See https://aplits.disa.mil/processAPList .

1.12 CONTROL DEVICE CODE PROTECTION

a. The Contractor must configure and utilize the existing cybersecurity features, available on the devices that are to be added to the Operational Technology network.

b. All passwords set to protect code or configuration settings must be provided to the Government as defined in the ACCOUNT MANAGEMENT paragraph.

c. All programming/code developed under this contract must be accessible and changeable by the Government upon completion of work under this contract. Include any codes, hardware or software keys, license numbers, etc., required to enable the Government to access or change the programming on all devices supplied under this contract.

These must be provided to the Government at no additional cost.

1.13 LOCKING PROVISIONS

a. All cabinets and enclosures that contain Operational Technology components must have lockable handles, doors, or accessories allowing the cabinet to be secured using a padlock.

b. All such cabinets and enclosures must be secured using padlocks with a minimum of a 3/8-inch diameter hardened shackle and be stainless steel.

c. Padlocks must meet requirements in accordance with Federal Specification FF-P-2827 and the NFESC DoD Lock Program FED-STD-2827.

1.14 REMOTE ACCESS

a. All configurations for commissioning a new system or an upgrade to an existing system must be completed on site. Where technically feasible, commissioning will be completed using government-furnished equipment.

PART 2 PRODUCTS

2.1 COMPLETE SOFTWARE LIST

a. Provide comprehensive software list for all components of the Operational Technology. The list must include, at a minimum, the following:

1. Software Name.

2. Software Vendor.

3. Software Version Number (major version number only, for Pre-Design Software Listing).

4. Software Selection Purpose/Justification.

5. License Status and number identifier.

b. Submit a Pre-Construction Software List (Encrypted) a minimum of 30 calendar days prior to beginning of system construction. Submit a Complete Software List (Encrypted) a minimum of 60 calendar days prior to installed operation of the software.

c. Software with a currently supported STIG meets Government cybersecurity requirements. Software without a currently supported STIG is subject to Government review and approval. See https://public.cyber.mil/STIGS/ , for a listing of software with a currently supported STIG.

2.1.1 Antivirus/Antimalware Software

a. All computers must include the most up to date DoD approved antivirus software with up to date signatures. See https://www.niap-ccevs.org/Product/ for additional information.

b. Verify that the Antivirus/Antimalware software will not negatively affect the operation of the Operational Technology. Computers and servers being installed must be configured with up-to-date antivirus signatures, not older than 10 days, prior to deployment.

c. Submit Antivirus/Antimalware Scan (Encrypted) test results to show evidence of a clean scan, a minimum of 30 days prior to anticipated Government acceptance of the Operational Technology.

2.2 COMPLETE HARDWARE LIST

a. Provide comprehensive hardware list of all hardware devices to be utilized on the Operational Technology. The list must include the following:

1. All PLCs and Related OT Components.

2. Computers.

3. Network Accessible Devices.

4. Interface Converters.

5. Any Similar Devices.

b. Provide the following information, at a minimum:

1. Hostname/Component Name.

2. Manufacturer.

3. Model Number.

4. Firmware Version Number, where applicable (major version number only, for Pre-Design Hardware Listing).

5. Installation Location. Includes physical location, and functional location in the control system.

c. Submit a Pre-Construction Hardware List (Encrypted) a minimum of 30 calendar days prior to beginning of system construction. Submit a

Complete Hardware List (Encrypted) a minimum of 60 calendar days prior to installed operation of the hardware.

d. Hardware listed at the following DISA website meets Government cybersecurity requirements: https://aplits.disa.mil/processAPList .

Hardware not listed is subject to Government review and approval.

2.3 PORTS, PROTOCOLS, AND SERVICES LIST (Encrypted)

a. Provide a comprehensive list of the Ports, Protocols, and Services necessary for normal operations, emergency operations, and troubleshooting of the Operational Technology. At a minimum, the list must include the following:

1. Vendors.

2. Justifications.

3. Executables.

4. Ports.

5. Protocols.

6. Services.

b. Submit a Ports, Protocols, and Services List (Encrypted)a minimum of 30 calendar days prior to anticipated Government acceptance of the system.

2.4 SYSTEM NETWORK DOCUMENTATION

a. Provide a complete System Network Diagram of Power Electronic Control System (Encrypted) to include all network devices, operational technology, and maintenance components. Clearly show the topology and connection of all electronic devices of the Power Electronic Control System that include, but are not limit to, device location, tagging, manufacturer part/model, protocol, TCP/IP addresses, operating system, and firmware version. The diagram must include the following for each device:

1. Labels of device type (e.g., workstation, server, PLC, etc.).

2. Component Manufacturer/model.

3. Operating System.

4. Operating System Version Number.

5. Firmware manufacturer.

6. Firmware version number.

b. In addition, the Contractor must submit a complete System Data Flow Diagram that shows all of the devices on the Operational Technology that communicate via routable protocols. Submit a System Data Flow Diagram (Encrypted) that indicates the normal system communications among the devices on the network, including the ports and protocols utilized for communications. Clearly show direction of data flow and bandwidth between devices. Include the following in the System Data Flow Diagram:

1. Arrows to indicate direction of data flow between components.

Define the physical media and protocol for each link.

2. Logical boundary of the system marked with a red line clearly defining components inside the boundary as well as components outside the boundary. Label any connections to external networks and indicate the boundary protection.

3. Indicate any VLAN segregation of the devices on the diagram.

c. Diagrams must be provided electronically formatted for 11" X 17" sheets. Develop diagrams using Microsoft Visio, Microstation, or other approved editable format. Submit copies of original electronic files as well as Portable Document Format (PDF) files.

d. Submit all diagrams a minimum of 30 calendar days after notice to proceed.

2.5 DEFAULT PASSWORDS

a. The Contractor must change any default passwords on the equipment provided under this contract, including any PLCs, HMI, and network devices. Submit 60 days prior to completion of work a Comprehensive Password/Passphrase List (Encrypted), of all passwords/passphrases that are required to properly operate, maintain, and troubleshoot the Operational Technology.

b. Where technically feasible, all Contractor generated passwords must meet requirements of applicable STIGs and DA PAM 25-2-13 .

c. Include, and clearly identify, any default passwords that cannot be changed on any configurable device provided under this contract.

2.6 ACCOUNT MANAGEMENT

a. Submit 60 days prior to completion of work a Comprehensive Account List (Encrypted) for each configurable device on the Operational Technology. This include the following :

1. All Application Accounts.

2. Operating System Accounts.

3. Network Accessible Device Accounts.

4. Emergency Accounts.

5. Service Accounts.

6. Communications Accounts.

b. The list must provide the unique username and password for each account on each device on the system.

2.7 INITIAL BACKUPS

The Contractor must provide complete Initial Backups (Encrypted) of each component 30 days prior to anticipated Government acceptance of the system. Backups must be sufficient to restore all components to their delivered state. The backups must be stored on an encrypted external hard drive to be provided to the Government. The backups must be tested and verified as functional for restoring the system prior to submittal.

Include verification of testing and functionality with submittal.

2.7.1 Backup Software

Backups of Windows-based components must be performed with Macrium Reflect as provided by Paramount Software or equal. An acceptable equivalent Windows-based backup software must meet the following salient characteristics.

a. Create full, incremental, and differential backup images of partitions, folders, and/or files.

b. Restore and clone backup images

c. Compressed backup images

d. Compatible with approved editions of Microsoft Windows

Submit Backup Software (encrypted).

PART 3 EXECUTION

3.1 UNNECESSARY SOFTWARE AND SERVICES

a. The Contractor must remove all unnecessary software (not required for the operation and maintenance of the Operational Technology) from all computers on the system. Contractor must not install unnecessary software or services on system computers, including, but not limited to, the following:

1. Games.

2. Entertainment.

3. Unnecessary Diagnostic Packages.

b. Remove or disable all services and ports on the supplied components which are not required for normal, emergency, or troubleshooting operations. Unnecessary services on the automation hardware to be provided, such as web servers, must be disabled in configuration when not required for normal or emergency operations or troubleshooting.

3.2 SECURITY CONFIGURATION AUTOMATION PROTOCOL (SCAP) TOOL

a. Utilize the Security Configuration Automation Protocol (SCAP) tool, similar scanning tool, or a manual check, to scan the computers using the latest STIG for the Operating System, third-party applications and programs, and network-accessible devices provided.

b. Using the DoD STIG Viewer, a checklist must be created using the

SCAP scan results or manual STIG review. The completed checklist, to include all manual checks, must be provided 60 days prior to anticipated Government acceptance.

c. Document any Deviations List (Encrypted) required for proper system operation. Include reasons why a STIG, patch, firmware update, or any other requirement cannot be met. Submit Deviations List a minimum of 60 days prior to anticipated date of deviation operation.

The Deviations List must include the following:

1. STIG/SRG/Patch/Firmware Update (what is being deviated).

2. Vulnerability Identification.

3. Rule Identification.

4. Control.

5. CCI.

6. Finding.

7. Deviation Justification.

8. Current Risk-Mitigation Actions.

d. Submit the SCAP Tool Scan (Encrypted) results to demonstrate the secure configuration of all devices provided. SCAP Tool Scan results must be submitted, and accepted by the Government prior to the equipment arriving at the Government facility. Equipment without an acceptable SCAP Tool Scan or manual STIG review must not connect to the control system.

3.3 FIELD QUALITY CONTROL

3.3.1 Cybersecurity Field Verification

a. Field verify cybersecurity compliance before the Operational Phase of commissioning.

b. Furnish the services of qualified cybersecurity personnel and all supplies and equipment necessary for verification. The Contracting Officer and cybersecurity specialist reserve the right to witness all system verifications for cybersecurity.

3.3.1.1 Cybersecurity Field Verification Request

Perform the cybersecurity field verification for applicable equipment and systems specified in the SECTIONS listed in paragraph GENERAL INFORMATION. Notify the Contracting Officer at least 15 calendar days in advance of each cybersecurity verification inspection.

3.3.1.2 Verification for Each System

a. Field verify cybersecurity compliance at the field testing of each system installation. During field verification, assist Government personnel with changing job-specific passwords to Government assigned and controlled passwords. Group field verification tasks to minimize the number of Contracting Officer trips to witness verification.

b. All field verification tests shall be completed during the Pre-Operational Phase of Commissioning.

3.4 TRAINING

See SECTION 01 11 01.00 28 SUPPLEMENTAL REQUIREMENTS, paragraph TRAINING.

In addition to the requirements in SECTION 01 11 01.00 28, the procedures for applying software and firmware updates shall be included.

-- End of Section --

SECTION TABLE OF CONTENTS

DIVISION 26 - ELECTRICAL

SECTION 26 23 10.10 28

LOW VOLTAGE SWITCHGEAR AND SUBSTATION TRANSFORMERS

08/17

PART 1 GENERAL

1.1 SUMMARY

1.2 REFERENCES

1.3 SUBMITTALS

1.4 SWITCHGEAR DRAWINGS AND DATA

1.4.1 Assembly, Detail Drawings and Data

1.4.2 Outline Drawings

1.4.3 Schematic Diagrams, Connection Diagrams and One Line Diagrams

1.5 ARRANGEMENT AND ASSEMBLY

1.5.1 Equipment Arrangement and Coordination

1.5.2 Cable and Conduit Entrances

1.6 QUALIFICATIONS

1.7 DELIVERY, STORAGE, AND HANDLING

1.7.1 Notification of Shipment

1.7.2 General

1.8 QUALIFICATIONS OF FIELD ENGINEERING SERVICE PERSONNEL

1.9 MATERIALS AND EQUIPMENT

1.9.1 Standard Products

PART 2 PRODUCTS

2.1 GENERAL REQUIREMENTS

2.1.1 Corrosion Prevention

2.1.1.1 General

2.1.1.2 Fastenings and Fittings

2.1.1.3 Corrosion-Resisting Materials

2.1.1.4 Corrosion-Resisting Treatments

2.1.1.5 Finish

2.2 LOW VOLTAGE SWITCHGEAR

2.2.1 General Requirements

2.2.2 Switchgear Enclosure And Framework

2.2.2.1 General

2.2.2.2 Enclosures

2.2.2.3 Drawout Circuit Breakers

2.2.2.4 Ventilating Opening

2.2.2.5 Foundations

2.2.3 Device Arrangement

2.2.4 Buses And Connections

2.2.4.1 Ground Bus

2.2.5 Power Circuit Breakers

2.2.5.1 General

2.2.5.2 Main and Bus Tie Circuit Breakers

2.2.5.3 Feeder Air Circuit Breakers

2.2.5.4 Digital Trip Unit

2.2.5.5 Safety Shutters

SECTION 26 23 10.10 28

2.2.6 Automatic Bus Transfer

2.2.7 Protective Relays

2.2.8 Test Switches

2.2.9 Fiber Optic Arc Flash Sensors

2.2.10 Switchgear Wiring

2.2.11 Terminal Blocks

2.2.12 Panelboards

2.2.13 Molded-Case Circuit Breakers

2.2.13.1 Trip Units

2.2.13.2 120-Volt and 208-Volt AC Circuits

2.2.13.3 480-Volt AC Circuits

2.2.14 Remote Racking Device

2.2.15 Remote Control Device

2.3 CONTROL SWITCHES

2.3.1 General

2.3.2 Switch Features

2.4 ARC FLASH WARNING LABEL

2.5 SERVICE ENTRANCE AVAILABLE FAULT CURRENT LABEL

2.6 GROUND BALL STUDS

2.7 ARC FLASH PROTECTION

2.8 SUBSTATION TRANSFORMERS (4160/480)

2.8.1 Transformer Bus Connections

2.8.2 Type and Rating

2.8.2.1 Core and Coils

2.8.2.1.1 Enclosure

2.8.3 Incoming Sections

2.8.4 Outgoing Sections

2.8.5 Internal Enclosure Wiring

2.8.6 Control Cabinet

2.8.7 Surge Protection

2.8.8 Ground Bus

2.8.9 Temperature Relay

2.8.10 Foundation

2.9 INDICATING METERS

2.9.1 Ammeters

2.9.2 Voltmeters

2.10 INDICATING LAMP ASSEMBLIES

2.11 INSTRUMENT TRANSFORMERS

2.11.1 General

2.11.2 Voltage Transformers

2.11.3 Current Transformers

2.11.3.1 General

2.11.3.2 Window or Bushing Type Current Transformers

2.11.3.3 Rating

2.11.3.4 Burden Analysis

2.12 KEY INTERLOCKS

2.13 ANNUNCIATION EQUIPMENT

2.14 PAINTING

2.15 ACCESSORIES

2.16 SPARE PARTS

PART 3 EXECUTION

3.1 EQUIPMENT INSTALLATION

3.2 TEMPORARY POWER

3.3 480-VOLT SWITCHGEAR FACTORY INSPECTION AND TESTS

3.3.1 General

3.3.2 Breaker Assembly Tests

3.3.2.1 Assembled Equipment

SECTION 26 23 10.10 28

3.3.2.2 Wiring

3.3.2.3 Breaker Assembly

3.3.2.4 Circuit Breaker

3.3.2.5 Switchgear Assembly

3.4 INSTRUMENT TRANSFORMER TEST

3.5 SUBSTATION TRANSFORMERS (4160/480) TESTS

3.6 FIELD INSPECTION, TESTING AND COMMISSIONING

3.6.1 General

3.6.2 Low Voltage Breakers and Switchgear

3.6.3 Transformer (4160/480) Tests

3.6.4 Protective Relays

3.7 OPERATION AND MAINTENANCE MANUAL DATA

3.8 AS-BUILT DRAWINGS

3.9 TRAINING

3.10 NAMEPLATES

3.11 FINAL ACCEPTANCE

-- End of Section Table of Contents --

SECTION 26 23 10.10 28

LOW VOLTAGE SWITCHGEAR AND SUBSTATION TRANSFORMERS

08/17

PART 1 GENERAL

1.1 SUMMARY

These SPECIFICATIONS include the design, fabrication, assembly, wiring, testing, delivery, installation and testing of new LSQ1 and LSQ2 low voltage switchgear, substation transformers, appurtenances, and spare parts.

The equipment shall be designed to satisfy the requirements of these specifications and shall incorporate the requirements contained in each of the following sections:

13 48 00.00 28 SEISMIC RESTRAINT FOR MECHANICAL AND ELECTRICAL EQUIPMENT,

26 05 00.00 28 GENERAL ELECTRICAL WORK, 26 05 19.00 28 INSULATED WIRE AND

CABLE, and 26 08 00.00 28 APPARATUS INSPECTION AND TESTING.

1.2 REFERENCES

The publications listed below form a part of this specification to the extent referenced. The publications are referred to within the text by the basic designation only.

AMERICAN NATIONAL STANDARDS INSTITUTE (ANSI)

ANSI C12.1 ((2014; Errata 2016) Electric Meters - Code for Electricity Metering

ANSI C39.1 (1981; R 1992) Requirements for Electrical Analog Indicating Instruments

AMERICAN SOCIETY OF MECHANICAL ENGINEERS (ASME)

ASME B1.1 (2003; R 2018) Unified Inch Screw Threads (UN and UNR Thread Form)

ASME B1.20.1 (2013; R 2018) Pipe Threads, General Purpose (Inch)

ASTM INTERNATIONAL (ASTM)

ASTM A123/A123M (2017) Standard Specification for Zinc (Hot-Dip Galvanized) Coatings on Iron and Steel Products

ASTM A153/A153M (2016a) Standard Specification for Zinc Coating (Hot-Dip) on Iron and Steel Hardware

ASTM B187/B187M (2020) Standard Specification for Copper, Bus Bar, Rod and Shapes and General Purpose Rod, Bar and Shapes

INSTITUTE OF ELECTRICAL AND ELECTRONICS ENGINEERS (IEEE)

IEEE 1248 (1998; R 2007) Guide for the Commissioning of Electrical Systems in Hydroelectric Power Plants

IEEE C2 (2017; Errata 1-2 2017; INT 1 2017) National Electrical Safety Code

IEEE C37.09 (2018; Errata 2019) Standard Test Procedure for AC High-Voltage Circuit Breakers Rated on a Symmetrical Current Basis

IEEE C37.13 (2015) Standard for Low-Voltage AC Power Circuit Breakers Used in Enclosures

IEEE C37.16 (2009) Standard for Preferred Ratings, Related Requirements, and Application Recommendations for Low-Voltage AC (635 V and below) and DC 3200 V and below) Power Circuit Breakers

IEEE C37.17 (2012) Standard for Trip Devices for AC and General-Purpose DC Low-Voltage Power Circuit Breakers

IEEE C37.20.1 (2015) Standard for Metal-Enclosed Low-Voltage Power Circuit-Breaker Switchgear

IEEE C37.20.3 (2013) Standard for Metal-Enclosed Interrupter Switchgear

IEEE C37.90.1 (2013) Standard for Surge Withstand Capability (SWC) Tests for Relays and Relay Systems Associated with Electric Power Apparatus

IEEE C57.12.01 (2020) General Requirements for Dry-Type Distribution and Power Transformers Including Those with Solid-Cast and/or Resin-Encapsulated Windings

IEEE C57.12.91 (2011) Standard Test Code for Dry-Type Distribution and Power Transformers

IEEE C57.13 (2016) Requirements for Instrument Transformers

IEEE C57.13.3 (2014) Guide for Grounding of Instrument Transformer Secondary Circuits and Cases

IEEE C62.11 (2020) Standard for Metal-Oxide Surge Arresters for Alternating Current Power Circuits (>1kV)

INTERNATIONAL ELECTRICAL TESTING ASSOCIATION (NETA)

NETA ATS (2017; Errata 2017) Standard for Acceptance Testing Specifications for Electrical Power Equipment and Systems

NATIONAL ELECTRICAL MANUFACTURERS ASSOCIATION (NEMA)

NEMA C37.50 (2018) Switchgear--Low-Voltage AC Power Circuit Breakers Used in Enclosures - Test Procedures

NEMA PB 2 (2011) Deadfront Distribution Switchboards

NEMA SG 4 (2009; R 2013) AC High-Voltage Circuit Breakers

NATIONAL FIRE PROTECTION ASSOCIATION (NFPA)

NFPA 70 (2020; ERTA 20-1 2020; ERTA 20-2 2020; TIA

20-1; TIA 20-2; TIA 20-3; TIA 20-4)

National Electrical Code

UNDERWRITERS LABORATORIES (UL)

UL 44 (2018) UL Standard for Safety Thermoset-Insulated Wires and Cables

UL 489 (2016) UL Standard for Safety Molded-Case Circuit Breakers, Molded-Case Switches and Circuit-Breaker Enclosures

UL 1581 (2001; Reprint May 2020) UL Standard for Safety Reference Standard for Electrical Wires, Cables, and Flexible Cords

U.S. ARMY CORPS OF ENGINEERS (USACE)

EM 385-1-1 (2014) Safety and Health Requirements Manual

1.3 SUBMITTALS

Government approval is required for submittals with a "G" designation;

submittals having an "I" designation are for information only. When used, a designation following the "G" or "I" designation identifies the office that will review the submittal for the Government. The following shall be submitted in accordance with Section 01 33 00 SUBMITTAL PROCEDURES:

SD-01 Preconstruction Submittals Submit within 90 days after receipt of Notice to Proceed:

Work Plan; G EL

Qualifications of Field Engineering Service Personnel; G EL

SD-02 Shop Drawings Submit within 90 days after receipt of Notice to Proceed:

Assembly, Detail Drawings and Data; G EL

Outline Drawings; G EL

Foundation Detail Drawings; G EL

Submit within 90 days after receipt of Notice to Proceed:

Schematic Diagrams, Connection Diagrams and One Line Diagrams; G EL

SD-03 Product Data Submit within 45 days after receipt of Notice To Proceed:

Protective Relays; G EL

Data consisting of manufacturer's Relay Descriptive Literature and Instruction Manuals and include IEEE Device Number Protection Functions available in the relays provided, testing procedures and instructions pertaining to the frequency of calibration, inspection, adjustment, and cleaning.

Submit within 90 days after receipt of Notice to Proceed:

Power Circuit Breakers; G EL

Test Switches; G EL

Fiber Optic Arc Flash Sensors; G EL

Switchgear Wiring; G EL

Terminal Blocks; G EL

Panelboards; G EL

Molded-Case Circuit Breakers; G EL

Remote Racking Device; G EL

Remote Control Device; G EL

Control Switches; G EL

Substation Transformers (4160/480); G EL

Surge Protection; G EL

Temperature Relay; G EL

Indicating Meters; G EL

Indicating Lamp Assemblies; G EL

Instrument Transformers; G EL

Painting; G EL

Key Interlocks; G EL

Annunciation Equipment; G EL

Submit within 90 days after receipt of Notice to Proceed:

Time Current Curves; G EL

Relay Curves for Instrument Transformers; G EL

Accessories and Spare Parts List; G EL

SD-05 Design Data Submit within 90 days after receipt of Notice to Proceed.

Temporary Power Plan; G EL

SD-06 Test Reports Submit within 90 days after receipt of Notice to Proceed:

Design Test Reports; G EL

Submit no less than 30 days prior to tests:

Factory Test Procedure; G EL

Field Test Procedure; G EL

Submit no later than 30 days after completion of tests:

Factory Inspection and Test Reports; G EL

Submit no later than 10 days after completion of tests:

Field Test Reports; I EL

Transformer (4160/480) Tests; G EL

Switchgear Factory Inspections And Tests; G EL

Substation Transformers (4160/480) Tests; G EL

480-Volt Switchgear Factory Inspection And Tests; G EL

SD-07 Certificates Submit no later than 7 days after shipment of protective relays:

Manufacturer's Test Reports; G EL

Submit no later than 14 days prior to delivery of equipment:

Notification of Shipment; G EL

Notification of Testing; G EL

Submit within 90 days after receipt of Notice to Proceed:

Certifications of Seismic Requirements; G EL

Certifications of Switchgear and Breakers Design Tests; G EL

SD-10 Operation and Maintenance Data

Operation and Maintenance Manual Data; G EL

SD-11 Closeout Submittals

Submit within 90 days after completion of work:

As-Built Drawings; G EL

a. Circuit Breaker Manufacturer's Installation Drawings and Details.

b. Circuit Breaker Controls and Schematic Diagrams.

Service Entrance Available Fault Current Label; G EL

1.4 SWITCHGEAR DRAWINGS AND DATA

1.4.1 Assembly, Detail Drawings and Data

Prepare and submit assembly, detail drawings and data to demonstrate that all parts of the equipment will conform to the requirements and intent of these SPECIFICATIONS. The drawings and data shall include sectional views of switchgear units and bus, description of removable elements, all relays and other devices, equipment lists, high resistance ground equipment and nameplate schedules. Drawings shall show coordination with other connected equipment including the transformer and metal enclosed bus indicating full electrical details of the connection.

1.4.2 Outline Drawings

Prepare and submit outline drawings for coordination of equipment and physical locations. Drawings shall include the overall dimensions and weights of the equipment; the size and location of conduit and cable entrances; details of provisions for bolting equipment to the floor, walls, and ceilings; the equipment crate sizes and proposed routing to the installation sites.

1.4.3 Schematic Diagrams, Connection Diagrams and One Line Diagrams

Schematic Diagrams, Connection Diagrams and One Line Diagrams shall be submitted indicating the switchgear assembly, complete assembly full line connection diagram, and control logic to demonstrate that the equipment will satisfy the requirements and intent of these SPECIFICATIONS. All controls and external connections indicated by the Contract drawings shall be accounted for. Point-to-point connection wireless wiring diagrams shall show all terminal blocks and connections as seen by the observer.

Provide a space at least three (3) inches below and adjacent to the terminal blocks in which external circuits, conduits or connections may be shown. The wiring diagrams shall be made as seen by an observer of the actual wiring, and shall show all the wiring and devices in the cubicle/sections. Solely using ladder logic or control diagrams to indicate wiring connections is not acceptable. The drawings shall clearly indicate where space exists for the mounting of future devices.

1.5 ARRANGEMENT AND ASSEMBLY

1.5.1 Equipment Arrangement and Coordination

The location and general arrangement of the low-voltage metal-enclosed switchgear assembly and substation transformers (4160/480) is shown on the drawings. Modifications of the equipment arrangement or the equipment device requirements shown shall be subject to approval. The medium and low voltage switchgear and transformers shall be designed as a system and adequate coordination between equipment shall be performed to ensure equipment enclosures line up to each other to the extent practical to make a clean and smooth appearance. The location of the bus shall be coordinated between the equipment to ensure it lines up at each equipment transition. Where equipment has different dimensions, adequate covers shall be incorporated into the design to fully cover openings and to match equipment outlines. The low voltage switchgear assembly shall be completely assembled, wired and tested at the factory. Transformers may be tested separately, but any controls between the switchgear and transformer should be simulated during testing. After complete assembly, the switchgear group shall be disassembled into sections, for convenience of handling, shipment, and installation.

1.5.2 Cable and Conduit Entrances

Power cables in conduit and cable tray shall enter the new switchgear from the top as shown on the Contract drawings. The preferred arrangement and layout of the switchgear is indicated on the drawings and shall be aligned such that existing embedded conduits will enter the appropriate vertical sections of the switchgear. Bottoms shall be open to the maximum extent practicable to allow for variations in cable entry from existing embedded conduits.

1.6 QUALIFICATIONS

The manufacturer of the equipment shall have a minimum of five (5) years continuous experience in the design, production and testing of equipment of the same type and rating.

1.7 DELIVERY, STORAGE, AND HANDLING

1.7.1 Notification of Shipment

Provide written notification to the Contracting Officer 14 calendar days prior to shipment of equipment.

1.7.2 General

Deliver products in the original unopened packages or containers clearly showing name of the manufacturer and the brand name undamaged, complete with installation instructions. Upon delivery, the products shall be thoroughly inspected for damage. Replace damaged or defective products.

Store products off the ground and protect from the weather, humidity, and temperature variations, dirt and dust, and other contaminants, within the storage condition limits published by the equipment manufacturer. Method of on-site storage and storage containers will be subject to approval by the Contracting Officer.

Electrical equipment shall be kept dry and free from precipitation and condensation before, during and after installation. All electrical equipment shall be stored in completely enclosed containers and in a humidity-controlled environment.

The products shall be shipped as completely assembled and wired as feasible so as to require a minimum of installation work. Each shipping section shall be properly matchmarked to facilitate reassembly, and shall be provided with removable lifting channels or eye bolts to facilitate lifting and handling. Any mounted devices such as relays and indicating instruments which cannot withstand the hazards of shipment shall be removed, properly marked with panel number to allow ready reinstallation, and carefully packed and shipped separately.

1.8 QUALIFICATIONS OF FIELD ENGINEERING SERVICE PERSONNEL

The Contractor shall provide qualified field engineering service personnel who are fluent in the English language to supervise, test, and install the new equipment specified in this SECTION. The personnel shall have a minimum of five (5) years experience in the installation and testing of new equipment made by the manufacturer used and shall be onsite during equipment installation and testing. The qualifications for the field service engineer(s) shall be submitted for approval and shall demonstrate compliance with the above requirements.