TECHSPECS_25RA0010_amd0003.pdf

Lower Granite Turbine Intake Gate Hydraulic System Upgrade W912EF25RA010 amd 0003

PROJECT TABLE OF CONTENTS

DIVISION 01 - GENERAL REQUIREMENTS

01 00 00.00 28 GENERAL REQUIREMENTS

01 11 00.00 28 SUMMARY OF WORK

01 11 01.00 28 SUPPLEMENTARY REQUIREMENTS

01 12 16.00 26 WORK SEQUENCE

01 14 00.10 28 PROJECT SITE RESTRICTIONS

01 14 00.90 28 INTEGRATING ANTITERRORISM (AT) AND OPERATIONS SECURITY

(OPSEC)

01 20 00.00 20 PRICE AND PAYMENT PROCEDURES

01 22 00.00 28 MEASUREMENT AND PAYMENT

01 32 01.00 28 PROJECT SCHEDULE

01 33 00 SUBMITTAL PROCEDURES

01 35 29.10 28 GOVERNMENTAL SAFETY REQUIREMENTS

01 42 00 SOURCES FOR REFERENCE PUBLICATIONS

01 45 01.00 28 RESIDENT MANAGEMENT SYSTEM CONTRACTOR MODE (RMS CM)

01 45 04.00 28 CONTRACTOR QUALITY CONTROL

01 51 00.00 28 TEMPORARY UTILITIES

01 55 10.00 28 CONTRACTOR WORK, ACCESS AND STORAGE AREAS

01 57 20.00 28 ENVIRONMENTAL PROTECTION

01 78 00.00 28 CLOSEOUT SUBMITTALS

01 78 23.00 28 OPERATION AND MAINTENANCE DATA

01 79 00.00 28 DEMONSTRATION AND TRAINING

01 91 00.00 26 SYSTEMS TESTING AND COMMISSIONING

DIVISION 02 - EXISTING CONDITIONS

02 82 13.01 28 CLASS II ASBESTOS ABATEMENT

02 83 33.14 28 REMOVAL/CONTROL AND DISPOSAL OF PAINT WITH LEAD - SHORT

VERSION

DIVISION 03 - CONCRETE

03 45 33.00 28 PRECAST STRUCTURAL CONCRETE

03 60 00.01 26 CONCRETE DEMOLITION, REPAIR OF CONCRETE SURFACES, AND

MINOR EQUIPMENT FOUNDATIONS

DIVISION 05 - METALS

05 05 23.17 26 WELDING (STEEL), FABRICATION, AND MACHINE WORK

05 50 04.00 26 METALS: MATERIALS, PRODUCTS, AND MISCELLANEOUS ITEMS

DIVISION 07 - THERMAL AND MOISTURE PROTECTION

07 84 00.00 28 FIRESTOPPING

07 92 00.00 28 JOINT SEALANTS

DIVISION 09 - FINISHES

09 97 02.13 26 PAINTING - STEEL STRUCTURES

DIVISION 13 - SPECIAL CONSTRUCTION

13 48 00.00 26 SEISMIC RESTRAINT FOR MECHANICAL AND ELECTRICAL EQUIPMENT

DIVISION 25 - INTEGRATED AUTOMATION

PROJECT TABLE OF CONTENTS Page 1

25 05 11.01 26 CYBERSECURITY FOR CONTROL SYSTEMS

DIVISION 26 - ELECTRICAL

26 05 00.00 26 BASIC ELECTRICAL MATERIALS AND METHODS

26 05 19.00 26 INSULATED WIRE AND CABLE

26 05 26.00 26 GROUNDING

26 05 36.00 26 CABLE TRAYS FOR ELECTRICAL SYSTEMS

26 42 14.01 26 CATHODIC PROTECTION BY SACRIFICIAL ANODES

DIVISION 27 - COMMUNICATIONS

27 21 10.00 26 FIBER OPTIC DATA TRANSMISSION SYSTEM

DIVISION 33 - UTILITIES

33 56 53.00 26 HYDRAULIC FLUID STORAGE TANK

DIVISION 35 - WATERWAY AND MARINE CONSTRUCTION

35 05 40.14 26 HYDRAULIC POWER SYSTEMS FOR CIVIL WORKS STRUCTURES

35 05 40.15 26 HYDRAULIC FLUID

DIVISION 40 - PROCESS INTERCONNECTIONS

40 05 13.96 26 WELDING: PIPING AND PRESSURIZED SYSTEMS

40 95 13.00 26 PROCESS CONTROL PANELS AND HARDWARE

40 95 23.00 26 PROGRAMMABLE LOGIC CONTROLLER HARDWARE

DIVISION 41 - MATERIAL PROCESSING AND HANDLING EQUIPMENT

41 22 13.75 26 NEW SUPPORT BEAMS AND LIFTING DEVICES

-- End of Project Table of Contents --

PROJECT TABLE OF CONTENTS Page 2

G4EDDMTJ

Line New SECTION

SECTION TABLE OF CONTENTS

DIVISION 25 - INTEGRATED AUTOMATION

SECTION 25 05 11.01 26

CYBERSECURITY FOR CONTROL SYSTEMS

PART 1 GENERAL

1.1 REFERENCES

1.2 DEFINITIONS

1.2.1 Computer

1.2.2 Controller

1.2.3 Network

1.2.4 Network Connected

1.2.5 Operational Technology (OT)

1.3 SUBMITTALS

1.4 ENCRYPTED SUBMITTAL REQUIREMENTS

1.5 CYBERSECURITY DOCUMENTATION

1.5.1 Control System Inventory Reports

1.6 CYBERSECURITY AFTER ACCEPTANCE

PART 2 PRODUCTS

2.1 DISA APPROVED PRODUCTS

PART 3 EXECUTION

3.1 NETWORK REQUIREMENTS

3.1.1 Wireless and Wired Broadcast Communication

3.2 KEYS

3.3 REQUIREMENTS FOR LEAST FUNCTIONALITY

3.3.1 Device Capabilities

3.3.2 Software

3.4 VULNERABILITY ALERTS

-- End of Section Table of Contents --

SECTION 25 05 11.01 26 Page 1

G4EDDMTJ

New SECTION

THIS PAGE INTENTIONALLY LEFT BLANK

SECTION 25 05 11.01 26 Page 2

SECTION 25 05 11.01 26

CYBERSECURITY FOR CONTROL SYSTEMS

PART 1 GENERAL

1.1 REFERENCES

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST)

NIST FIPS 140-2 (2001) Security Requirements for Cryptographic Modules

1.2 DEFINITIONS

1.2.1 Computer

A computer is one of the following:

a. a device running a non-embedded desktop or server version of Microsoft Windows

b. a device running a non-embedded version of MacOS

c. a device running a non-embedded version of Linux

d. a device running a version or derivative of the Android Operating System, where Android is considered separate from Linux

e. a device running a version of Apple iOS

Unless otherwise indicated or clear from context use of the word "device" in this Section includes computers.

1.2.2 Controller

A device other than a computer or Ethernet switch.

1.2.3 Network

A network is a group of two or more devices that can communicate using a network protocol. Network protocols must provide a method for addressing devices on the network; a communication method that does not provide an addressing scheme is not a networked form of communication. Devices that communicate using a method of communication that does not support device addressing are not using a network. Addresses may be other than IP addresses, and addressing may be at either Open Systems Interconnection (OSI) layer 2 or layer 3.

1.2.4 Network Connected

A component is network connected (or "connected to a network") only when the device has a network transceiver which is directly connected to the network and implements the network protocol. A device lacking a network transceiver (and accompanying protocol implementation) can never be considered network connected. Note that (unlike many IT definitions of

SECTION 25 05 11.01 26 Page 3

"Network Connected") a device connected to a non-IP network is still considered network connected (an IP connection or IP address is not required for a device to be network connected).

1.2.5 Operational Technology (OT)

The hardware and software dedicated to detecting and/or causing changes in physical processes through direct monitoring and control of physical devices to accomplish a specific mission in real time.

1.3 SUBMITTALS

Government approval is required for submittals with a "G" or "S" classification. When used, a code following the "G" classification identifies the office that will review the submittal for the Government.

Submit the following in accordance with Section 01 33 00 SUBMITTAL

PROCEDURES:

SD-01 Preconstruction Submittals

Pre-Construction Control System Inventory Report (Encrypted); G, HDC

SD-11 Closeout Submittals

Final Control System Inventory Report (Encrypted); G, HDC

1.4 ENCRYPTED SUBMITTAL REQUIREMENTS

Submittals with sensitive data are marked with "(encrypted)" and must be encrypted with NIST FIPS 140-2 compliant encryption methods with a password with a minimum of: eight characters, one uppercase letter, one lowercase letter, one number, and one special character. Encrypted submittals must be sent via DoD SAFE (https://safe.apps.mil/) and only sent to those who need to know. If DoD SAFE is not available, the government will provide an alternative secure file transfer that must be used. Do not store encrypted submittals on shared storage systems. Store and send encrypted information separately than the password.

1.5 CYBERSECURITY DOCUMENTATION

1.5.1 Control System Inventory Reports

Provide a Pre-Construction Control System Inventory Report (Encrypted) report and a Final Control System Inventory Report (Encrypted), using the Inventory Spreadsheet listed under this Section at https://www.wbdg.org/ffc/dod/unified-facilities-guide -specifications-ufgs/ufgs-25-05-11 . In the Control System Inventory Reports, document all networked devices, including network infrastructure devices, and all software. For each device provide all applicable information for which there is a field on the spreadsheet in accordance with the instructions on the spreadsheet. In addition to the requirements of Section 01 33 00 SUBMITTAL PROCEDURES, provide the Control System Inventory Reports as editable Microsoft Excel files.

1.6 CYBERSECURITY AFTER ACCEPTANCE

All work performed on the control system after acceptance must be

SECTION 25 05 11.01 26 Page 4 performed using Government Furnished Equipment or equipment specifically and individually approved by the Government.

PART 2 PRODUCTS

2.1 DISA APPROVED PRODUCTS

Network switches, Routers, and Firewalls must be on the DISA approved product list (APL). See https://aplits.disa.mil/processAPList .

PART 3 EXECUTION

3.1 NETWORK REQUIREMENTS

3.1.1 Wireless and Wired Broadcast Communication

Do not use any wireless or wired broadcast communication. Do not install wireless or wired broadcast IP networks, including: do not install a wireless access point; do not install or configure an ad-hoc wireless network; do not install or configure a WiFi Direct communication. Do not install any device that performs IP routing.

3.2 KEYS

Prior to final acceptance of the system, lock all lockable enclosures.

Provide copies of keys for all enclosures and a key inventory list documenting all keys. Label each key with the matching enclosure identifier.

3.3 REQUIREMENTS FOR LEAST FUNCTIONALITY

3.3.1 Device Capabilities

Do not provide devices with remote user interfaces or with full user interfaces where one was not required. Do not use a networked sensor or actuator where a non-networked sensor or actuator would suffice.

3.3.2 Software

Do not install software that is not specifically required to meet a contract requirement. Remove any previously installed that is not specifically required to meet a contract requirement. Do not implement functionality within software that is not specifically required to meet contract requirements.

3.4 VULNERABILITY ALERTS

Prior to installation, adhere to all vendor-specific and CISA Information Assurance Vulnerability Alert (IAVA, see https://www.cisa.gov/uscert/ncas/alerts ) requirements for reporting, patching, and/or mitigating. For alerts which occur after installation but before government acceptance, resolve the vulnerabilities within 30 days of the alert.

-- End of Section --

SECTION 25 05 11.01 26 Page 5

THIS PAGE INTENTIONALLY LEFT BLANK

SECTION 25 05 11.01 26 Page 6

SUBMITTAL FORM,Jan 96 PREVIOUS EDITION IS OBSOLETE PAGE 1 OF 1 PAGES

W912EF25RA010

Lower Granite Turbine Intake Gate Hydraulic System Upgrade

25 05 11.01 26 SD-01 Preconstruction Submittals

1.5.1 G HDCPre-Construction Control System

Inventory Report (Encrypted)

SD-11 Closeout Submittals

1.5.1 G HDCFinal Control System Inventory

Report (Encrypted)

SUBMITTAL REGISTER

CONTRACT NO.

TITLE AND LOCATION CONTRACTOR

CONTRACTOR:

SCHEDULE DATES

CONTRACTOR

ACTION

APPROVING AUTHORITY

A C T I V I T Y

N O

T R A N S M I T T A L

N O

S P E C

S E C T

DESCRIPTION

ITEM SUBMITTED

P A R A G R A P H

C L A S S I F I C A T I O N

G O V T

O R

A E

R E V W

R SUBMIT

APPROVAL

NEEDED

BY

MATERIAL

NEEDED

BY

A C T I O N

C O D E

DATE

OF

ACTION

DATE FWD

TO APPR

AUTH/

DATE RCD

FROM

CONTR

DATE FWD

TO OTHER

REVIEWER

DATE RCD

FROM OTH

REVIEWER

A C T I O N

C O D E

DATE

OF

ACTION

MAILED

TO

CONTR/

DATE RCD

FRM APPR

AUTH REMARKS

(a) (b) (c) (d) (e) (f) (g) (h) (i) (j) (k) (l) (m) (n) (o) (p) (q) (r)

G4EDDMTJ

1.6 CYBERSECURITY AFTER ACCEPTANCE

3.4 VULNERABILITY ALERTS