17R11vol4.pdf

Seymour Johnson AFB, North Carolina

Solicitation Number

W912HN-17-R-0011

Replacement of Air Traffic Control Tower

*5 Volume 4 of 4: Specification Divisions 26 - 33 25 - 33

PN VKAG013004R5

AUGUST 2017

U.S. ARMY ENGINEER DISTRICT, SAVANNAH

CORPS OF ENGINEERS

100 WEST OGLETHORPE AVENUE

SAVANNAH, GEORGIA 31401-3640

US Army Corps of Engineers Savannah District

Cont r ol Tower 17R11 Seynour Johnson AFB, NC

PROJECT TABLE OF CONTENTS

DI VI SI ON 01 - GENERAL REQUI REMENTS

01 11 00 SUMMARY OF WORK

01 32 01. 00 10 PROJECT SCHEDULE

01 33 00 SUBMI TTAL PROCEDURES

01 33 29 SUSTAI NABI LI TY REPORTI NG

01 35 26 GOVERNMENTAL SAFETY REQUI REMENTS

01 42 00 SOURCES FOR REFERENCE PUBLI CATI ONS

01 45 00. 00 10 QUALI TY CONTROL

01 45 00. 15 10 RESI DENT MANAGEMENT SYSTEM CONTRACTOR MODE( RMS CM)

01 45 35 SPECI AL I NSPECTI ONS

01 50 00 TEMPORARY CONSTRUCTI ON FACI LI TI ES AND CONTROLS

01 57 19 TEMPORARY ENVI RONMENTAL CONTROLS

01 62 35 RECYCLED/ RECOVERED/ BI OBASED MATERI ALS

01 74 19 CONSTRUCTI ON AND DEMOLI TI ON WASTE MANAGEMENT

01 78 00 CLOSEOUT SUBMI TTALS

01 78 23 OPERATI ON AND MAI NTENANCE DATA

01 91 00. 00 37 COMMISSIONING

DI VI SI ON 02 - EXI STI NG CONDI TI ONS

02 41 00 DEMOLI TI ON AND DECONSTRUCTI ON

02 82 13. 00 10 ASBESTOS ABATEMENT

02 83 13. 00 20 LEAD I N CONSTRUCTI ON

DI VI SI ON 03 - CONCRETE

03 11 13. 00 10 STRUCTURAL CAST- I N- PLACE CONCRETE FORMI NG

03 15 00. 00 10 CONCRETE ACCESSORI ES

03 20 00. 00 10 CONCRETE REI NFORCI NG

03 30 00. 00 10 CAST- I N- PLACE CONCRETE

03 35 00. 00 10 CONCRETE FI NI SHI NG

03 39 00. 00 10 CONCRETE CURI NG

DI VI SI ON 04 - MASONRY

04 20 00 UNI T MASONRY

DI VI SI ON 05 - METALS

05 12 00 STRUCTURAL STEEL

05 21 00 STEEL JOI ST FRAMI NG

05 30 00 STEEL DECKS

05 40 00 COLD- FORMED METAL FRAMI NG

05 50 13 MI SCELLANEOUS METAL FABRI CATI ONS

05 51 00 METAL STAI RS

05 52 00 METAL RAI LI NGS

DI VI SI ON 06 - WOOD, PLASTI CS, AND COMPOSI TES

06 10 00 ROUGH CARPENTRY

06 20 00 FI NI SH CARPENTRY

06 41 16. 00 10 PLASTI C- LAMI NATE- CLAD ARCHI TECTURAL CABI NETS

06 61 16 SOLI D POLYMER ( SOLI D SURFACI NG) FABRI CATI ONS

DI VI SI ON 07 - THERMAL AND MOI STURE PROTECTI ON

PROJECT TABLE OF CONTENTS Page 1

07 05 23 PRESSURE TESTI NG AN AI R BARRI ER SYSTEM FOR AI R TI GHTNESS

07 11 13 BI TUMI NOUS DAMPPROOFI NG

07 17 00 BENTONI TE WATERPROOFI NG

07 21 13 BOARD AND BLOCK I NSULATI ON

07 21 16 MI NERAL FI BER BLANKET I NSULATI ON

07 22 00 ROOF AND DECK I NSULATI ON

07 27 10. 00 10 BUI LDI NG AI R BARRI ER SYSTEM

07 41 13 METAL ROOF PANELS

07 42 13 METAL WALL PANELS

07 42 63 FABRI CATED WALL PANEL ASSEMBLI ES

07 54 19 POLYVI NYL- CHLORI DE ROOFI NG

07 60 00 FLASHI NG AND SHEET METAL

07 81 00 SPRAY- APPLI ED FI REPROOFI NG

07 84 00 FIRESTOPPING

07 92 00 JOI NT SEALANTS

DI VI SI ON 08 - OPENI NGS

08 11 13 STEEL DOORS AND FRAMES

08 11 16 ALUMI NUM DOORS AND FRAMES

08 14 00 WOOD DOORS

08 33 13 COI LI NG COUNTER DOORS

08 41 13 ALUMI NUM- FRAMED ENTRANCES AND STOREFRONTS

08 51 13 ALUMI NUM WI NDOWS

08 71 00 DOOR HARDWARE

08 81 00 GLAZING

08 88 58 AI R TRAFFI C CONTROL TOWER CAB GLASS

08 91 00 METAL LOUVERS

DI VI SI ON 09 - FI NI SHES

09 22 00 SUPPORTS FOR PLASTER AND GYPSUM BOARD

09 29 00 GYPSUM BOARD

09 30 10 CEMENT TI LI NG, QUARRY TI LI NG, AND PAVER TI LI NG

09 51 00 ACOUSTI CAL CEI LI NGS

09 62 38 STATI C- CONTROL FLOORI NG

09 65 00 RESI LI ENT FLOORI NG

09 65 66 RESI LI ENT ATHLETI C FLOORI NG

09 68 00 CARPETING

09 69 13 RI GI D GRI D ACCESS FLOORI NG

09 72 00 WALLCOVERINGS

09 83 13 ACOUSTI CAL WALL COATI NG

09 90 00 PAI NTS AND COATI NGS

DI VI SI ON 10 - SPECI ALTI ES

10 14 00. 10 EXTERI OR SI GNAGE

10 14 00. 20 I NTERI OR SI GNAGE

10 21 13 TOI LET COMPARTMENTS

10 26 00 WALL AND DOOR PROTECTI ON

10 28 13 TOI LET ACCESSORI ES

10 44 43. 00 37 FI RE EXTI NGUI SHER ACEESSORI ES

10 51 13 METAL LOCKERS

DI VI SI ON 12 - FURNI SHI NGS

12 24 13 ROLLER WI NDOW SHADES

12 48 13 ENTRANCE FLOOR MATS AND FRAMES

PROJECT TABLE OF CONTENTS Page 2

DI VI SI ON 13 - SPECI AL CONSTRUCTI ON

13 13 10 AI R TRAFFI C CONTROL TOWER ( ATCT) CAB

13 48 00 SEI SMI C PROTECTI ON FOR MI SCELLANEOUS EQUI PMENT

13 48 00. 00 10 SEI SMI C PROTECTI ON FOR MECHANI CAL EQUI PMENT

DI VI SI ON 14 - CONVEYI NG EQUI PMENT

14 21 23 ELECTRI C TRACTI ON PASSENGER ELEVATORS

DI VI SI ON 21 - FI RE SUPPRESSI ON

21 12 00 STANDPI PE SYSTEMS

21 13 13. 00 10 WET PI PE SPRI NKLER SYSTEM, FI RE PROTECTI ON

21 30 00 FI RE PUMPS

DI VI SI ON 22 - PLUMBI NG

22 00 00 PLUMBI NG, GENERAL PURPOSE

DI VI SI ON 23 - HEATI NG, VENTI LATI NG, AND AI R CONDI TI ONI NG ( HVAC)

23 00 00 AI R SUPPLY, DI STRI BUTI ON, VENTI LATI ON, AND EXHAUST SYSTEMS

23 03 00. 00 20 BASI C MECHANI CAL MATERI ALS AND METHODS

23 05 93 TESTI NG, ADJUSTI NG, AND BALANCI NG FOR HVAC

23 07 00 THERMAL I NSULATI ON FOR MECHANI CAL SYSTEMS

23 09 00 I NSTRUMENTATI ON AND CONTROL FOR HVAC

23 09 13 I NSTRUMENTATI ON AND CONTROL DEVI CES FOR HVAC

23 09 23. 01 LONWORKS DI RECT DI GI TAL CONTROL FOR HVAC AND OTHER

BUI LDI NG CONTROL SYSTEMS

23 11 25 FACI LI TY GAS PI PI NG

23 52 43. 00 20 LOW PRESSURE WATER HEATI NG BOI LERS ( UNDER 800, 000 BTU/ HR

OUTPUT)

23 64 10 WATER CHI LLERS, VAPOR COMPRESSI ON TYPE

23 64 26 CHI LLED, CHI LLED- HOT, AND CONDENSER WATER PI PI NG SYSTEMS

23 82 02. 00 10 UNI TARY HEATI NG AND COOLI NG EQUI PMENT

DI VI SI ON 25 - I NTEGRATED AUTOMATI ON

25 05 11 * 5 CYBERSECURI TY FOR FACI LI TY- RELATED CONTROL SYSTEMS

DI VI SI ON 26 - ELECTRI CAL

26 00 00. 00 20 BASI C ELECTRI CAL MATERI ALS AND METHODS

26 05 48. 00 10 SEI SMI C PROTECTI ON FOR ELECTRI CAL EQUI PMENT

26 08 00 APPARATUS I NSPECTI ON AND TESTI NG

26 12 19. 10 THREE- PHASE PAD- MOUNTED TRANSFORMERS

26 20 00 I NTERI OR DI STRI BUTI ON SYSTEM

26 28 01. 00 10 COORDI NATED POWER SYSTEM PROTECTI ON

26 29 23 VARI ABLE FREQUENCY DRI VE SYSTEMS UNDER 600 VOLTS

26 32 14. 00 10 * 2 DI ESEL- GENERATOR SET, STATI ONARY 15- 300 KW, STANDBY

APPLICATIONS

26 32 15. 00 10 DI ESEL- GENERATOR SET STATI ONARY 100- 2500 KW, WI TH

AUXILIARIES

26 36 00. 00 10 AUTOMATI C TRANSFER SWI TCH AND BY- PASS/ I SOLATI ON SWI TCH

26 41 00 LI GHTNI NG PROTECTI ON SYSTEM

26 51 00 I NTERI OR LI GHTI NG

26 56 00 EXTERI OR LI GHTI NG

PROJECT TABLE OF CONTENTS Page 3

DI VI SI ON 27 - COMMUNI CATI ONS

27 10 00 BUI LDI NG TELECOMMUNI CATI ONS CABLI NG SYSTEM

27 51 13. 00 10 * 2 TELEPHONE I NTERFACE PAGI NG SYSTEM

DI VI SI ON 28 - ELECTRONI C SAFETY AND SECURI TY

28 31 76 I NTERI OR FI RE ALARM AND MASS NOTI FI CATI ON SYSTEM

DI VI SI ON 31 - EARTHWORK

31 00 00 EARTHWORK

31 11 00 CLEARI NG AND GRUBBI NG

31 31 16. 13 CHEMI CAL TERMI TE CONTROL

31 32 11 SOI L SURFACE EROSI ON CONTROL

31 62 13. 13 CAST- I N- PLACE CONCRETE PI LES

31 63 16 AUGER CAST GROUT PI LES

DI VI SI ON 32 - EXTERI OR I MPROVEMENTS

32 01 19 FI ELD MOLDED SEALANTS FOR SEALI NG JOI NTS I N RI GI D

PAVEMENTS

32 05 33 LANDSCAPE ESTABLI SHMENT

32 11 23 AGGREGATE AND/ OR GRADED- CRUSHED AGGREGATE BASE COURSE

32 12 17 HOT MI X BI TUMI NOUS PAVEMENT

32 13 11 CONCRETE PAVEMENT FOR AI RFI ELDS AND OTHER HEAVY- DUTY

PAVEMENTS

32 16 13 CONCRETE SI DEWALKS AND CURBS AND GUTTERS

32 17 24. 00 10 PAVEMENT MARKI NGS

32 31 13 CHAI N LI NK FENCES AND GATES

32 92 19 SEEDING

32 92 23 SODDING

32 93 00 EXTERI OR PLANTS

DI VI SI ON 33 - UTI LI TI ES

33 11 00 WATER UTI LI TY DI STRI BUTI ON PI PI NG

33 30 00 SANI TARY SEWERS

33 40 00 STORM DRAI NAGE UTI LI TI ES

33 51 15 NATURAL- GAS / LI QUI D PETROLEUM GAS DI STRI BUTI ON

33 71 02 UNDERGROUND ELECTRI CAL DI STRI BUTI ON

- - End of Pr oj ect Tabl e of Cont ent s - -

PROJECT TABLE OF CONTENTS Page 4

SECTI ON TABLE OF CONTENTS

DI VI SI ON 25 - I NTEGRATED AUTOMATI ON

SECTI ON 25 05 11

* 5 CYBERSECURI TY FOR FACI LI TY- RELATED CONTROL SYSTEMS

11/17

PART 1 GENERAL

1. 1 CONTROL SYSTEM APPLI CABI LI TY

1. 2 REFERENCES

1. 3 DEFI NI TI ONS

1. 3. 1 Comput er

1. 3. 2 Ful l Local User I nt er f ace

1. 3. 3 Ful l y Suppor t ed

1. 3. 4 Li mi t ed Local User I nt er f ace

1. 3. 5 Mi ni mal l y Suppor t ed

1. 3. 6 Net wor k Connect ed

1. 3. 7 Not Suppor t ed

1. 3. 8 Remot e User I nt er f ace

1. 3. 9 User Account Suppor t Level s

1. 3. 10 User I nt er f ace

1. 4 COORDI NATI ON

1. 5 SUBMI TTALS

1. 6 CYBERSECURI TY DOCUMENTATI ON

1. 6. 1 Cyber secur i t y I nt er connect i on Schedul e

1. 6. 2 Net wor k Communi cat i on Repor t

1. 6. 3 Cont r ol Syst em I nvent or y Repor t

1. 6. 4 Sof t war e Recover y and Reconst i t ut i on I mages

1. 6. 5 Cyber secur i t y Ri ser Di agr am

1. 6. 6 Cont r ol Syst em Cyber secur i t y Document at i on

1. 6. 6. 1 Sof t war e Appl i cat i ons

1. 6. 6. 2 For Cont r ol Syst em Devi ces

1. 6. 6. 2. 1 Cont r ol Syst em Devi ces Ful l y Suppor t i ng User Account s

1. 6. 6. 2. 2 Ot her Cont r ol Syst em Devi ces

1. 6. 6. 3 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

1. 7 SOFTWARE UPDATE LI CENSI NG

1. 8 CYBERSECURI TY DURI NG CONSTRUCTI ON

1. 8. 1 Cont r act or Comput er Equi pment

1. 8. 1. 1 Oper at i ng Syst em

1. 8. 1. 2 Ant i - Mal war e Sof t war e

1. 8. 1. 3 Passwor ds and Passphr ases

1. 8. 1. 4 Cont r act or Comput er Cyber secur i t y Compl i ance St at ement s

1. 8. 2 Tempor ar y I P Net wor ks

1. 8. 2. 1 Net wor k Boundar i es and Connect i ons

1. 8. 3 Gover nment Access t o Net wor k

1. 8. 4 Tempor ar y Wi r el ess I P Net wor ks

1. 8. 5 Passwor ds and Passphr ases

1. 8. 6 Cont r act or Tempor ar y Net wor k Cyber secur i t y Compl i ance St at ement s

1. 9 CYBERSECURI TY DURI NG WARRANTY PERI OD

PART 2 PRODUCTS

SECTI ON 25 05 11 Page 1 ( Added by Amendment 0005)

PART 3 EXECUTI ON

3. 1 ACCESS CONTROL REQUI REMENTS

3. 1. 1 User Account s

3. 1. 1. 1 Comput er s

3. 1. 1. 2 For Cont r ol Syst em Devi ces

3. 1. 1. 3 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

3. 1. 2 Unsuccessf ul Logon At t empt s

3. 1. 2. 1 Devi ces Mi ni mal l y Suppor t i ng Account s

3. 1. 2. 2 Devi ces Ful l y Suppor t i ng Account s

3. 1. 2. 3 Hi gh Avai l abi l i t y I nt er f aces Exempt f r om Unsuccessf ul Logon

At t empt s Requi r ement s

3. 1. 3 Syst em Use Not i f i cat i on

3. 1. 4 User I nt er f ace Banner Schedul e

3. 1. 5 Per mi t t ed Act i ons Wi t hout I dent i f i cat i on or Aut hent i cat i on

3. 1. 6 Wi r el ess Access

3. 1. 6. 1 Wi r el ess I P Communi cat i ons

3. 1. 6. 2 Non- I P Wi r el ess Communi cat i on

3. 1. 6. 3 Wi r el ess Communi cat i on Request

3. 1. 6. 4 Wi r el ess Communi cat i on Test i ng

3. 2 CYBERSECURI TY AUDI TI NG

3. 2. 1 Audi t Event s, Cont ent of Audi t Recor ds, and Audi t Gener at i on

3. 2. 1. 1 Comput er s

3. 2. 1. 1. 1 Audi t ed Event s

3. 2. 1. 1. 2 Audi t Event I nf or mat i on To Recor d

3. 2. 1. 2 For Cont r ol Syst em Devi ces

3. 2. 1. 2. 1 Cont r ol Syst em Devi ces Ful l y Suppor t i ng User Account s

3. 2. 1. 2. 2 Ot her Cont r ol Syst em Devi ces

3. 2. 1. 3 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

3. 2. 1. 3. 1 Devi ces Whi ch Ful l y Suppor t Account s

3. 2. 1. 3. 2 Devi ces Whi ch Do Not Ful l y Suppor t Account s

3. 2. 2 Audi t St or age Capaci t y and Audi t Upl oad

3. 2. 2. 1 Devi ce Audi t Recor d Upl oad Sof t war e

3. 2. 3 Response t o Audi t Pr ocessi ng Fai l ur es

3. 2. 4 Ti me St amps

3. 2. 4. 1 Comput er s

3. 2. 4. 2 For Cont r ol Syst em Devi ces

3. 2. 4. 3 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

3. 3 REQUI REMENTS FOR LEAST FUNCTI ONALI TY

3. 3. 1 Non- I P Cont r ol Net wor ks

3. 3. 2 I P Cont r ol Net wor ks

3. 4 SAFE MODE AND FAI L SAFE OPERATI ON

3. 5 I DENTI FI CATI ON AND AUTHENTI CATI ON

3. 5. 1 User I dent i f i cat i on and Aut hent i cat i on

3. 5. 1. 1 Cont r ol Syst ems Devi ces

3. 5. 1. 2 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

3. 5. 2 Aut hent i cat or Management

3. 5. 2. 1 Aut hent i cat i on Type

3. 5. 2. 1. 1 For Cont r ol Syst em Devi ces

3. 5. 2. 1. 2 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

3. 5. 2. 2 Passwor d- Based Aut hent i cat i on Requi r ement s

3. 5. 2. 2. 1 Passwor ds f or Comput er s

3. 5. 2. 2. 2 Passwor ds f or Non- Comput er Devi ces Ful l y Suppor t i ng

Accounts

3. 5. 2. 2. 3 Passwor ds f or Web I nt er f aces

3. 5. 2. 2. 4 Passwor ds f or Devi ces Mi ni mal l y Suppor t i ng Account s

3. 5. 2. 2. 5 Passwor d Conf i gur at i on and Repor t i ng

3. 5. 2. 3 Har dwar e Token- Based Aut hent i cat i on Requi r ement s

SECTI ON 25 05 11 Page 2 ( Added by Amendment 0005)

3. 5. 3 Aut hent i cat or Feedback

3. 5. 4 Devi ce I dent i f i cat i on and Aut hent i cat i on

3. 5. 4. 1 For Cont r ol Syst em Devi ces

3. 5. 4. 2 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

3. 5. 5 Cr ypt ogr aphi c Modul e Aut hent i cat i on

3. 6 EMERGENCY POWER

3. 7 DURABI LI TY TO VULNERABI LI TY SCANNI NG

3. 7. 1 Cont r ol Syst em Devi ces Ot her Than Comput er s

3. 7. 2 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

3. 8 FI PS 201- 2 REQUI REMENT

3. 9 DEVI CES WI TH CONNECTI ON TO MULTI PLE I P NETWORKS

3. 10 DENI AL OF SERVI CE PROTECTI ON, PROCESS I SOLATI ON AND BOUNDARY

PROTECTION

3. 11 MALI CI OUS CODE PROTECTI ON

3. 12 TESTS

- - End of Sect i on Tabl e of Cont ent s - -

SECTI ON 25 05 11 Page 3 ( Added by Amendment 0005)

SECTI ON 25 05 11

* 5 CYBERSECURI TY FOR FACI LI TY- RELATED CONTROL SYSTEMS

11/17

PART 1 GENERAL

Thi s Sect i on r ef er s t o Secur i t y Requi r ement s Gui de ( SRGs) and Secur i t y Techni cal I mpl ement at i on Gui de ( STI Gs) . STI Gs and SRGs ar e ar e avai l abl e onl i ne at t he I nf or mat i on Assur ance Suppor t Envi r onment ( I ASE) websi t e at http://iase.disa.mil/stigs/Pages/index.aspx . Not al l cont r ol syst em component s have appl i cabl e STI Gs or SRGs.

1. 1 CONTROL SYSTEM APPLI CABI LI TY

Thi s Sect i on appl i es t o HVAC and Fi r e Al ar m/ Mass Not i f i cat i on. Each r equi r ement i n t hi s Sect i on appl i es t o each cont r ol syst em, unl ess speci f i cal l y i ndi cat ed ot her wi se. ( For exampl e, t he i ndi cat ed submi t t al r equi r ement s shal l be submi t t ed f or each cont r ol syst em. ) .

1. 2 REFERENCES

The publ i cat i ons l i s t ed bel ow f or m a par t of t hi s speci f i cat i on t o t he ext ent r ef er enced. The publ i cat i ons ar e r ef er r ed t o wi t hi n t he t ext by t he basi c desi gnat i on onl y.

AMERI CAN SOCI ETY OF HEATI NG, REFRI GERATI NG AND AI R- CONDI TI ONI NG

ENGI NEERS ( ASHRAE)

ASHRAE 135 ( 2016; I NT 1 2016; ERTA 1 2016) BACnet —A Dat a Communi cat i on Pr ot ocol f or Bui l di ng Aut omat i on and Cont r ol Net wor ks

I NSTI TUTE OF ELECTRI CAL AND ELECTRONI CS ENGI NEERS ( I EEE)

I EEE 802. 1x ( 2010) Local and Met r opol i t an Ar ea Net wor ks - Por t Based Net wor k Access Control

NATI ONAL I NSTI TUTE OF STANDARDS AND TECHNOLOGY ( NI ST)

NI ST FI PS 201- 2 ( 2013) Per sonal I dent i t y Ver i f i cat i on ( PI V) of Feder al Empl oyees and Cont r act or s

U. S. DEPARTMENT OF DEFENSE ( DOD)

DODI 8551. 01 ( 2014) Por t s, Pr ot ocol s, and Ser vi ces Management ( PPSM)

DTM 08- 060 ( 2008) Pol i cy on Use of Depar t ment of Def ense ( DoD) I nf or mat i on Syst ems - St andar d Consent Banner and User Agr eement

1. 3 DEFINITIONS

1. 3. 1 Computer

As used i n t hi s Sect i on, a comput er i s one of t he f ol l owi ng:

SECTI ON 25 05 11 Page 4 ( Added by Amendment 0005)

a. a devi ce r unni ng a non- embedded deskt op or ser ver ver si on of Mi cr osof t Windows

b. a devi ce r unni ng a non- embedded ver si on of MacOS

c. a devi ce r unni ng a non- embedded ver si on of Li nux

d. a devi ce r unni ng a ver si on or der i vat i ve of t he Andr oi d OS, wher e Andr oi d i s consi der ed separ at e f r om Li nux

e. a devi ce r unni ng a ver si on of Appl e i OS

1. 3. 2 Ful l Local User I nt er f ace

A Ful l Local User I nt er f ace i s a user i nt er f ace wher e t he i nt er act i on and di spl ays ar e f i el d- conf i gur abl e.

Exampl es of a Ful l Local User I nt er f ace i ncl ude l ocal appl i cat i ons on a computer and user i nt er f aces t o Var i abl e Speed Dr i ves.

1. 3. 3 Ful l y Suppor t ed

Devi ce suppor t s conf i gur abl e i ndi v i dual account s. Account s can be cr eat ed, del et ed, modi f i ed, et c. Pr i v i l eges can be assi gned t o account s.

1. 3. 4 Li mi t ed Local User I nt er f ace

A Li mi t ed Local User I nt er f ace i s a user i nt er f ace wher e t he i nt er act i on i s l i mi t ed, f i xed at t he f act or y, and cannot be modi f i ed i n t he f i el d. The user must be physi cal l y at t he devi ce t o i nt er act wi t h i t .

Exampl es of Li mi t ed Local User I nt er f ace i ncl ude t her most at s ( Space Sensor Modul es as def i ned i n Sect i on 23 09 13 I NSTRUMENTATI ON AND CONTROL DEVI CES

FOR HVAC) .

1. 3. 5 Mi ni mal l y Suppor t ed

Devi ce suppor t s a smal l , f i xed number of account s ( per haps onl y one) .

Account s cannot be modi f i ed. A devi ce wi t h onl y a " User " and an " Admi ni st r at or " account woul d f i t t hi s cat egor y. Si mi l ar l y, a devi ce wi t h t wo PI Ns f or l ogon - one f or r est r i c t ed and one f or unr est r i c t ed r i ght s woul d f i t her e; t he account s do not have t o be t he t r adi t i onal " user name and passwor d" st r uct ur e.

1. 3. 6 Net wor k Connect ed

A component i s connect ed t o a net wor k onl y when t he devi ce has a net wor k t r anscei ver whi ch i s di r ect l y connect ed t o t he net wor k and i mpl ement s t he net wor k pr ot ocol . A devi ce l acki ng a net wor k t r anscei ver and accompanyi ng pr ot ocol i mpl ement at i on i s not consi der ed net wor k connect ed. Not e t hat a devi ce connect ed t o a non- I P net wor k i s st i l l consi der ed net wor k connect ed;

an I P connect i on or I P addr ess i s not r equi r ed f or a devi ce t o be net wor k connected.

Devi ces t hat suppor t wi r el ess communi cat i on ar e net wor k connect ed, r egar dl ess of whet her t he devi ce i s communi cat i ng usi ng wi r el ess.

SECTI ON 25 05 11 Page 5 ( Added by Amendment 0005)

1. 3. 7 Not Suppor t ed

Devi ce does not suppor t any Access Enf or cement , t her ef or e t he whol e concept of " account " i s meani ngl ess.

1. 3. 8 Remot e User I nt er f ace

A Remot e User I nt er f ace i s a user i nt er f ace on a Cl i ent devi ce al l owi ng user i nt er act i on wi t h a di f f er ent Ser ver devi ce. The user need not be physi cal l y at t he Ser ver devi ce t o i nt er act wi t h i t .

Exampl es of Remot e User I nt er f aces i ncl ude web br owser s and Local Di spl ay Panel s as def i ned i n Sect i on 23 09 00 I NSTRUMENTATI ON AND CONTROL FOR HVAC.

1. 3. 9 User Account Suppor t Level s

The suppor t f or user account s i s cat egor i zed i n t hi s Sect i on as one of t hr ee l evel s:

1. 3. 10 User I nt er f ace

Gener al l y, a user i nt er f ace i s har dwar e on a devi ce al l owi ng user i nt er act i on wi t h t hat devi ce v i a i nput ( but t ons, swi t ches, s l i der s, keyboar d, t ouch scr een, et c. ) and a scr een. Ther e ar e t hr ee t ypes of user i nt er f aces def i ned i n t hi s Sect i on: Li mi t ed Local User I nt er f ace, Ful l Local User I nt er f ace and Remot e User I nt er f ace. I n t hi s Sect i on, when t he t er m " User I nt er f ace" i s used wi t hout speci f y i ng whi ch t ype, i t r ef er s onl y t o Ful l Local User I nt er f ace and Remot e User I nt er f ace, not t o Li mi t ed Local User I nt er f ace.

1. 4 COORDINATION

Coor di nat e t he execut i on of t hi s Sect i on wi t h t he execut i on of ot her Sect i ons r el at ed t o cont r ol syst ems. I t ems t hat must be consi der ed when coor di nat i ng pr oj ect ef f or t s i ncl ude but ar e not l i mi t ed t o:

a. I f r equest i ng per mi ssi on f or wi r el ess communi cat i on, t he Wi r el ess Communi cat i on Request submi t t al must be appr oved pr i or t o cont r ol syst em devi ce sel ect i on and i nt egr at i on.

b. I f r equest i ng per mi ssi on f or al t er nat e account l ock per mi ssi ons, t he Devi ce Account Lock Except i on Request must be appr oved pr i or t o cont r ol syst em devi ce sel ect i on and i nt egr at i on.

c. I f r equest i ng per mi ssi on f or t he use of a devi ce wi t h mul t i pl e I P connect i ons, t he Mul t i pl e I P Connect i on Devi ce Request must be appr oved pr i or t o cont r ol syst em devi ce sel ect i on and i nt egr at i on.

d. Wi r el ess t est i ng may be r equi r ed as par t of t he cont r ol syst em t est i ng. See r equi r ement s f or t he Wi r el ess Communi cat i on Test Repor t submittal.

e. I f t he Devi ce Audi t Recor d Upl oad Sof t war e i s t o be i nst al l ed on a comput er not bei ng pr ovi ded as par t of t he cont r ol syst em, coor di nat i on i s r equi r ed t o i dent i f y t he comput er on whi ch t o i nst al l t he sof t war e.

f . Cyber secur i t y I nt er connect i on Schedul e must be coor di nat ed wi t h ot her wor k t hat wi l l be i nt er connect ed t o, and i nt er connect i ons must be appr oved by t he Gover nment bef or e r el y i ng on t hem f or syst em

SECTI ON 25 05 11 Page 6 ( Added by Amendment 0005) functionality.

g. Cyber secur i t y t est i ng suppor t must be coor di nat ed acr oss cont r ol syst ems and wi t h t he Gover nment cyber secur i t y t est i ng schedul e.

h. Passwor ds must be coor di nat ed wi t h t he i ndi cat ed cont act f or t he pr oj ect s i t e.

i . I f appl i cabl e, HTTP web ser ver cer t i f i cat es must be obt ai ned f r om t he i ndi cat ed cont act f or t he pr oj ect s i t e.

j . Cont r act or Comput er Cyber secur i t y Compl i ance St at ement s f or each cont r act or usi ng cont r act or owned comput er s.

1. 5 SUBMITTALS

Gover nment appr oval i s r equi r ed f or submi t t al s wi t h a " G" desi gnat i on;

submi t t al s not havi ng a " G" desi gnat i on ar e f or i nf or mat i on onl y. When used, a desi gnat i on f ol l owi ng t he " G" desi gnat i on i dent i f i es t he of f i ce t hat wi l l r evi ew t he submi t t al f or t he Gover nment . Submi t t he f ol l owi ng i n accor dance wi t h Sect i on 01 33 00 SUBMI TTAL PROCEDURES:

SD- 01 Pr econst r uct i on Submi t t al s

Wi r el ess Communi cat i on Request ; G, RO

Devi ce Account Lock Except i on Request ; G, RO

Mul t i pl e I P Connect i on Devi ce Request ; G, RO

Cont r act or Comput er Cyber secur i t y Compl i ance St at ement s; G, RO

Cont r act or Tempor ar y Net wor k Cyber secur i t y Compl i ance St at ement s;

G, RO

SD- 02 Shop Dr awi ngs

User I nt er f ace Banner Schedul e; G, RO

Net wor k Communi cat i on Repor t ; G, RO

Cyber secur i t y Ri ser Di agr am; G, RO

Cont r ol Syst em I nvent or y Repor t ; G, RO

Cyber secur i t y I nt er connect i on Schedul e; G, RO

SD- 03 Pr oduct Dat a

Cont r ol Syst em Cyber secur i t y Document at i on; G, RO

SD- 06 Test Repor t s

Wi r el ess Communi cat i on Test Repor t ; G, RO

SD- 07 Cer t i f i cat es

Sof t war e Li censes; G, RO

SECTI ON 25 05 11 Page 7 ( Added by Amendment 0005)

SD- 11 Cl oseout Submi t t al s

Passwor d Summar y Repor t ; G, RO

Sof t war e Recover y And Reconst i t ut i on I mages; G, RO

Devi ce Audi t Recor d Upl oad Sof t war e; G, RO

1. 6 CYBERSECURI TY DOCUMENTATI ON

1. 6. 1 Cyber secur i t y I nt er connect i on Schedul e

Pr ovi de a compl et ed Cyber secur i t y I nt er connect i on Schedul e document i ng connect i ons bet ween t he i nst al l ed syst em and ot her syst ems. Pr ovi de t he f ol l owi ng i nf or mat i on f or each devi ce communi cat i ng bet ween syst ems: Devi ce I dent i f i er , Devi ce Descr i pt i on, Tr anspor t l ayer Pr ot ocol , Net wor k Addr ess, Por t ( i f appl i cabl e) , MAC ( Layer 2) addr ess ( i f appl i cabl e) , Medi a, Appl i cat i on Pr ot ocol , Ser vi ce ( i f appl i cabl e) , Descr i pt i ve Pur pose of communi cat i on. For communi cat i on wi t h ot her aut hor i zed syst ems al so pr ovi de t he For ei gn Dest i nat i on and POC f or Dest i nat i on. I f ot her cont r ol syst em Sect i ons used on t hi s pr oj ect i nc l ude submi t t al s document i ng t hi s i nf or mat i on, pr ovi de copi es of t hose submi t t al s t o meet t hi s r equi r ement .

I n addi t i on t o t he r equi r ement s of Sect i on 01 33 00 SUBMI TTAL PROCEDURES, pr ovi de t he Cyber secur i t y I nt er connect i on Schedul e as an edi t abl e Mi cr osof t Excel f i l e ( a t empl at e Cyber secur i t y I nt er connect i on Schedul e i n Excel f or mat i s avai l abl e at http://www.wbdg.org/FFC/NAVGRAPH/graphtoc.pdf .)

1. 6. 2 Net wor k Communi cat i on Repor t

Pr ovi de a net wor k communi cat i on r epor t . For each net wor ked cont r ol l er , document t he communi cat i on char act er i st i cs of t he cont r ol l er i ncl udi ng communi cat i on pr ot ocol s, ser vi ces used, and a gener al descr i pt i on of what i nf or mat i on i s communi cat ed over t he net wor k. For each cont r ol l er usi ng I P, document t he TCP and UDP por t s used. I f ot her cont r ol syst em Sect i ons used on t hi s pr oj ect i ncl ude submi t t al s document i ng t hi s i nf or mat i on, pr ovi de copi es of t hose submi t t al s t o meet t hi s r equi r ement .

I n addi t i on t o t he r equi r ement s of Sect i on 01 33 00 SUBMI TTAL PROCEDURES, pr ovi de t he Net wor k Communi cat i on Repor t as an edi t abl e Mi cr osof t Excel file.

1. 6. 3 Cont r ol Syst em I nvent or y Repor t

Pr ovi de a Cont r ol Syst em I nvent or y r epor t usi ng t he I nvent or y Spr eadsheet l i s t ed under t hi s Sect i on at ht t p: / / www. wbdg. or g/ FFC/ NAVGRAPH/ gr apht oc. pdf document i ng t he devi ces, i ncl udi ng net wor ked devi ces, net wor k i nf r ast r uct ur e devi ces, non- net wor ked devi ces, i nput devi ces ( e. g. sensor s) and out put devi ces ( e. g. act uat or s) . For each devi ce, pr ovi de t he appl i cabl e i nf or mat i on f or whi ch t her e i s a f i el d on t he spr eadsheet i n accor dance wi t h t he i nst r uct i ons on t he spr eadsheet .

I n addi t i on t o t he r equi r ement s of Sect i on 01 33 00 SUBMI TTAL PROCEDURES, pr ovi de t he Cont r ol Syst em I nvent or y Repor t as an edi t abl e Mi cr osof t Excel file.

1. 6. 4 Sof t war e Recover y and Reconst i t ut i on I mages

For each comput er on whi ch sof t war e i s i nst al l ed under t hi s pr oj ect , SECTI ON 25 05 11 Page 8 ( Added by Amendment 0005) pr ovi de a r ecover y i mage of t he f i nal as- bui l t comput er . Thi s i mage must al l ow f or bar e- met al r est or e such t hat r est or at i on of t he i mage i s suf f i c i ent t o r est or e syst em oper at i on t o t he i maged st at e wi t hout t he need f or r e- i nst al l at i on of sof t war e.

Sof t war e l i censes shal l gr ant t he Gover nment t he r i ght s i n t echni cal dat a t o oper at e and mai nt ai n t he syst ems and use t he sof t war e as r equi r ed.

1. 6. 5 Cyber secur i t y Ri ser Di agr am

Pr ovi de a cyber secur i t y r i ser di agr am of t he compl et e cont r ol syst em, i ncl udi ng t he net wor k and cont r ol l er har dwar e. I f t he cont r ol syst em speci f i cat i ons r equi r e a r i ser di agr am submi t t al , pr ovi de a copy of t hat submi t t al as t he cyber secur i t y r i ser di agr am. Ot her wi se, pr ovi de a r i ser di agr am i n one- l i ne f or mat and al so a oone- l i ne f or mat over l ayed on a f aci l i t y schemat i c.

1. 6. 6 Cont r ol Syst em Cyber secur i t y Document at i on

Pr ovi de a Cont r ol Syst em Cyber secur i t y Document at i on submi t t al cont ai ni ng t he i ndi cat ed i nf or mat i on f or each devi ce and sof t war e appl i cat i on.

1. 6. 6. 1 Sof t war e Appl i cat i ons

For t he sof t war e appl i cat i ons r unni ng on comput er s, pr ovi de:

a. admi ni st r at or document at i on t hat descr i bes secur e conf i gur at i on of t he software

b. admi ni st r at or document at i on t hat descr i bes secur e i nst al l at i on of t he software

c. admi ni st r at or document at i on t hat descr i bes secur e oper at i on of t he software

d. admi ni st r at or document at i on t hat descr i bes ef f ect i ve use and mai nt enance of secur i t y f unct i ons or mechani sms f or t he sof t war e

e. admi ni st r at or document at i on t hat descr i bes known vul ner abi l i t i es r egar di ng conf i gur at i on and use of admi ni st r at i ve ( i . e. pr i v i l eged) f unct i ons f or t he sof t war e f . user document at i on t hat descr i bes user - accessi bl e secur i t y f unct i ons or mechani sms i n t he sof t war e and how t o ef f ect i vel y use t hose secur i t y f unct i ons or mechani sms

g. user document at i on t hat descr i bes met hods f or user i nt er act i on whi ch enabl es i ndi v i dual s t o use t he sof t war e i n a mor e secur e manner

h. user document at i on t hat descr i bes user r esponsi bi l i t i es i n mai nt ai ni ng t he secur i t y of t he sof t war e

1. 6. 6. 2 For Cont r ol Syst em Devi ces

1. 6. 6. 2. 1 Cont r ol Syst em Devi ces Ful l y Suppor t i ng User Account s

For t he Cont r ol Syst em Devi ces whi ch f ul l y suppor t user account s, pr ovi de:

a. Document at i on t hat descr i bes secur e conf i gur at i on of t he devi ce

SECTI ON 25 05 11 Page 9 ( Added by Amendment 0005)

b. Document at i on t hat descr i bes secur e oper at i on of t he devi ce

c. Document at i on t hat descr i bes ef f ect i ve use and mai nt enance of secur i t y f unct i ons or mechani sms f or t he devi ce

d. Document at i on t hat descr i bes known vul ner abi l i t i es r egar di ng conf i gur at i on and use of admi ni st r at i ve ( i . e. pr i v i l eged) f unct i ons f or t he devi ce

e. Document at i on t hat descr i bes user - accessi bl e secur i t y f unct i ons or mechani sms i n t he devi ce and how t o ef f ect i vel y use t hose secur i t y f unct i ons or mechani sms; or a speci f i c i ndi cat i on t hat t her e ar e no user - accessi bl e secur i t y f unct i ons or mechani sms i n t he devi ce f . Document at i on t hat descr i bes met hods f or user i nt er act i on whi ch enabl es i ndi v i dual s t o use t he devi ce i n a mor e secur e manner

1. 6. 6. 2. 2 Ot her Cont r ol Syst em Devi ces

For t he Cont r ol Syst em Devi ces whi ch do not f ul l y suppor t user account s, provide:

a. Document at i on t hat descr i bes secur e conf i gur at i on of t he devi ce; or a speci f i c i ndi cat i on t hat t her e ar e no secur e conf i gur at i on st eps t hat apply

b. Document at i on t hat descr i bes ef f ect i ve use and mai nt enance of secur i t y f unct i ons or mechani sms f or t he devi ce; or a speci f i c i ndi cat i on t hat t her e ar e no secur i t y f unct i ons or mechani sms i n t he devi ce

c. For devi ces whi ch i ncl ude a user i nt er f ace, document at i on t hat descr i bes met hods f or user i nt er act i on whi ch enabl es i ndi v i dual s t o use t he devi ce i n a mor e secur e manner

1. 6. 6. 3 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

For cont r ol syst em devi ces wher e Cont r ol Syst em Cyber secur i t y Document at i on r equi r ement s ar e not ot her wi se i ndi cat ed i n t hi s Sect i on, pr ovi de:

a. Document at i on t hat descr i bes secur e conf i gur at i on of t he devi ce

b. Document at i on t hat descr i bes secur e i nst al l at i on of t he devi ce

c. Document at i on t hat descr i bes secur e oper at i on of t he devi ce

d. Document at i on t hat descr i bes ef f ect i ve use and mai nt enance of secur i t y f unct i ons or mechani sms f or t he devi ce

e. Document at i on t hat descr i bes known vul ner abi l i t i es r egar di ng conf i gur at i on and use of admi ni st r at i ve ( i . e. pr i v i l eged) f unct i ons f or t he devi ce f . Document at i on t hat descr i bes user - accessi bl e secur i t y f unct i ons or mechani sms i n t he devi ce and how t o ef f ect i vel y use t hose secur i t y f unct i ons or mechani sms

g. Document at i on t hat descr i bes met hods f or user i nt er act i on whi ch enabl es i ndi v i dual s t o use t he devi ce i n a mor e secur e manner

SECTI ON 25 05 11 Page 10 ( Added by Amendment 0005)

h. Document at i on t hat descr i bes user r esponsi bi l i t i es i n mai nt ai ni ng t he secur i t y of t he devi ce

1. 7 SOFTWARE UPDATE LI CENSI NG

I n addi t i on t o ot her l i censi ng r equi r ement s, t he sof t war e l i censi ng must i ncl ude l i censi ng of t he f ol l owi ng sof t war e updat es f or a per i od of no l ess t han 5 year s:

a. Secur i t y and bug- f i x pat ches i ssued by t he sof t war e manuf act ur er .

b. Secur i t y pat ches t o addr ess vul ner abi l i t i es i dent i f i ed i n t he Nat i onal Vul ner abi l i t y Dat abase at http://nvd.nist.gov wi t h a Common Vul ner abi l i t y Scor i ng Syst em ( CVSS) sever i t y r at i ng of " Medi um" or higher.

Pr ovi de a s i ngl e Sof t war e Li censes submi t t al wi t h document at i on of t he sof t war e l i censes f or t he sof t war e pr ovi ded.

1. 8 CYBERSECURI TY DURI NG CONSTRUCTI ON

I n addi t i on t o t he cont r ol syst em cyber secur i t y r equi r ement s i ndi cat ed i n t hi s sect i on, meet f ol l owi ng r equi r ement t hr oughout t he const r uct i on process.

1. 8. 1 Cont r act or Comput er Equi pment

Cont r act or owned comput er s may be used f or const r uct i on. When used, cont r act or comput er s must meet t he f ol l owi ng r equi r ement s:

1. 8. 1. 1 Oper at i ng Syst em

The oper at i ng syst em must be an oper at i ng syst em cur r ent l y suppor t ed by t he manuf act ur er of t he oper at i ng syst em. The oper at i ng syst em must be cur r ent on secur i t y pat ches and oper at i ng syst em manuf act ur er r equi r ed updat es.

1. 8. 1. 2 Ant i - Mal war e Sof t war e

The comput er must r un ant i - mal war e sof t war e f r om a r eput abl e sof t war e manuf act ur er . Ant i - mal war e sof t war e must be a ver si on cur r ent l y suppor t ed by t he sof t war e manuf act ur er , must be cur r ent on t he pat ches and updat es, and must use t he l at est def i ni t i ons f i l e. The comput er s used on t hi s pr oj ect must be scanned usi ng t he i nst al l ed sof t war e at l east once per day.

1. 8. 1. 3 Passwor ds and Passphr ases

The passwor ds and passphr ases f or t he comput er s must be changed f r om t hei r def aul t val ues. Passwor ds must be a mi ni mum of ei ght char act er s wi t h a mi ni mum of one upper case l et t er , one l ower case l et t er , one number , and one speci al char act er .

1. 8. 1. 4 Cont r act or Comput er Cyber secur i t y Compl i ance St at ement s

Pr ovi de a s i ngl e submi t t al cont ai ni ng compl et ed Cont r act or Comput er Cyber secur i t y Compl i ance St at ement s f or each company usi ng cont r act or owned comput er s. Cont r act or Comput er Cyber secur i t y Compl i ance St at ement s must use t he t empl at e publ i shed at http://www.wbdg.org/FFC/NAVGRAPH/graphtoc.pdf .

Each St at ement must be s i gned by a cyber secur i t y r epr esent at i ve f or t he

SECTI ON 25 05 11 Page 11 ( Added by Amendment 0005) r el evant company.

1. 8. 2 Tempor ar y I P Net wor ks

Tempor ar y cont r act or - i nst al l ed I P net wor ks may be used dur i ng const r uct i on.

When used, t empor ar y cont r act or - i nst al l ed I P net wor ks must meet t he f ol l owi ng r equi r ement s:

1. 8. 2. 1 Net wor k Boundar i es and Connect i ons

The net wor k must not ext end out s i de t he pr oj ect s i t e and must not connect t o I P net wor ks ot her t han I P net wor ks under t hi s Cont r act or Gover nment - f ur ni shed I P net wor ks pr ovi ded f or t hi s pur pose. Net wor k access f r om out si de t he pr oj ect s i t e i s pr ohi bi t ed.

1. 8. 3 Gover nment Access t o Net wor k

Gover nment per sonnel must be al l owed compl et e and i mmedi at e access t o t he net wor k t o ver i f y compl i ance wi t h t hi s Speci f i cat i on

1. 8. 4 Tempor ar y Wi r el ess I P Net wor ks

I n addi t i on t o t he ot her r equi r ement s on t empor ar y I P net wor ks, t empor ar y wi r el ess I P ( Wi Fi ) net wor ks must not i nt er f er e wi t h exi st i ng wi r el ess net wor k and must use WPA2 secur i t y. Net wor k names ( SSI D) f or wi r el ess net wor ks must be changed f r om t hei r def aul t val ues.

1. 8. 5 Passwor ds and Passphr ases

The passwor ds and passphr ases f or t he net wor k devi ces and net wor k access must be changed f r om t hei r def aul t val ues. Passwor ds must be a mi ni mum 8 char act er s wi t h a mi ni mum of one upper case l et t er , one l ower case l et t er , one number , and one speci al char act er .

1. 8. 6 Cont r act or Tempor ar y Net wor k Cyber secur i t y Compl i ance St at ement s

Pr ovi de a s i ngl e submi t t al cont ai ni ng compl et ed Cont r act or Tempor ar y Net wor k Cyber secur i t y Compl i ance St at ement s f or each company i mpl ement i ng a t empor ar y I P net wor k. Cont r act or Tempor ar y Net wor k Cyber secur i t y Compl i ance St at ement s must use t he t empl at e publ i shed at http://www.wbdg.org/FFC/NAVGRAPH/graphtoc.pdf . Each St at ement must be s i gned by a cyber secur i t y r epr esent at i ve f or t he r el evant company. I f no t empor ar y I P net wor ks wi l l be used, pr ovi de a s i ngl e copy of t he St at ement i ndi cat i ng t hi s.

1. 9 CYBERSECURI TY DURI NG WARRANTY PERI OD

Wor k per f or med on t he cont r ol syst em af t er accept ance must be per f or med usi ng Gover nment Fur ni shed Equi pment or equi pment speci f i cal l y and i ndi v i dual l y appr oved by t he Gover nment .

PART 2 PRODUCTS

Not used.

SECTI ON 25 05 11 Page 12 ( Added by Amendment 0005)

PART 3 EXECUTI ON

3. 1 ACCESS CONTROL REQUI REMENTS

3. 1. 1 User Account s

Devi ces suppor t i ng user account s ( ei t her f ul l y or mi ni mal l y) must l i mi t access t o t he devi ce accor di ng t o speci f i ed l i mi t at i ons f or each account .

I nst al l and conf i gur e devi ces havi ng a STI G or SRG i n accor dance wi t h t hat STI G or SRG.

3. 1. 1. 1 Computers

The comput er s must f ul l y suppor t user account s.

3. 1. 1. 2 For Cont r ol Syst em Devi ces

Devi ces wi t h web i nt er f aces must ei t her f ul l y suppor t user account s or have t hei r web i nt er f ace di sabl ed. Fi el d devi ces wi t h f ul l l ocal user i nt er f aces al l owi ng modi f i cat i on of dat a must at l east mi ni mal l y suppor t user account s.

3. 1. 1. 3 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

For cont r ol syst em devi ces wher e User Account r equi r ement s ar e not ot her wi se i ndi cat ed i n t hi s Sect i on:

a. Devi ces wi t h web i nt er f aces must ei t her at l east mi ni mal l y suppor t user account s or have t hei r web i nt er f ace di sabl ed.

b. Fi el d devi ces wi t h f ul l l ocal user i nt er f aces al l owi ng modi f i cat i on of dat a must at l east mi ni mal l y suppor t user account s.

c. Fi el d devi ces wi t h r ead- onl y f ul l l ocal user i nt er f aces must at l east mi ni mal l y suppor t user account s.

3. 1. 2 Unsuccessf ul Logon At t empt s

Except f or hi gh avai l abi l i t y user i nt er f aces i ndi cat ed as exempt , devi ces must meet t he i ndi cat ed r equi r ement s f or handl i ng unsuccessf ul l ogon attempts.

3. 1. 2. 1 Devi ces Mi ni mal l y Suppor t i ng Account s

Devi ces whi ch mi ni mal l y suppor t account s ar e not r equi r ed t o l ock based on unsuccessf ul l ogon at t empt s.

3. 1. 2. 2 Devi ces Ful l y Suppor t i ng Account s

Devi ces whi ch f ul l y suppor t account s must meet t he f ol l owi ng r equi r ement s.

I f a devi ce cannot meet t hese r equi r ement s, document devi ce capabi l i t i es t o pr ot ect f r om subsequent unsuccessf ul l ogon at t empt s and pr opose al t er nat e pr ot ect i ons i n a Devi ce Account Lock Except i on Request submi t t al . Do not i mpl ement al t er nat e pr ot ect i on measur es wi t hout expl i c i t per mi ssi on f r om t he Gover nment .

a. I t must l ock t he user account when t hr ee unsuccessf ul l ogon at t empt s occur wi t hi n a 15 mi nut e i nt er val .

SECTI ON 25 05 11 Page 13 ( Added by Amendment 0005)

b. Once an account i s l ocked, t he account must st ay l ocked unt i l unl ocked by an admi ni st r at or .

c. Once t he i ndi cat ed number of unsuccessf ul l ogon at t empt s occur s, del ay f ur t her l ogon pr ompt s by 5 seconds.

3. 1. 2. 3 Hi gh Avai l abi l i t y I nt er f aces Exempt f r om Unsuccessf ul Logon At t empt s Requi r ement s

Ther e ar e no hi gh avai l abi l i t y i nt er f aces whi ch ar e exempt f r om unsuccessf ul l ogon at t empt s r equi r ement s.

3. 1. 3 Syst em Use Not i f i cat i on

Web i nt er f aces must di spl ay a war ni ng banner meet i ng t he r equi r ement s of

DTM 08- 060.

Devi ces whi ch ar e connect ed t o a net wor k and have a user i nt er f ace must di spl ay a war ni ng banner meet i ng t he r equi r ement s of DTM 08- 060 i f capabl e of doi ng so. Devi ces whi ch ar e connect ed t o a net wor k and have a user i nt er f ace but ar e not capabl e of di spl ayi ng a banner must have a per manent l y af f i xed l abel di spl ayi ng an appr oved banner f r om DTM 08- 060.Labels must be machi ne pr i nt ed or engr aved, pl ast i c or met al , desi gned f or per manent i nst al l at i on, must use a f ont no smal l er t han 14 poi nt , and must pr ovi de a hi gh cont r act bet ween f ont and backgr ound col or s.

3. 1. 4 User I nt er f ace Banner Schedul e

Pr ovi de a User I nt er f ace Schedul e usi ng t he f or mat i ndi cat ed showi ng each user i nt er f ace pr ovi ded and how t he i nf or mat i on banner r equi r ement has been i mpl ement ed f or each user i nt er f ace.

User I nt er f ace Schedul e For mat ( wi t h sampl e ent r i es)

User I nt er f ace Description

User I nt er f ace Location

Type of User Interface

Banner I mpl ement at i on

Sampl e 1 Room 1 Remote DTM 08- 060 Banner " A" Di spl ayed at Logon

Sampl e 2 Room 2 Li mi t ed Local DTM 08- 060 Banner " B" on Af f i xed Label

Sampl e 3 Room 3 Ful l Local DTM 08- 060 Banner " B" Di spl ayed on Scr een

3. 1. 5 Per mi t t ed Act i ons Wi t hout I dent i f i cat i on or Aut hent i cat i on

The cont r ol syst em must r equi r e i dent i f i cat i on and aut hent i cat i on bef or e al l owi ng a user t o act f r om a user i nt er f ace whi ch mi ni mal l y or f ul l y suppor t s account s.

3. 1. 6 Wi r el ess Access

Unl ess expl i c i t l y aut hor i zed by t he Gover nment , do not use wi r el ess communi cat i ons. Remove t he wi r el ess t r anscei ver f r om devi ces wi t h wi r el ess communi cat i on capabi l i t y .

SECTI ON 25 05 11 Page 14 ( Added by Amendment 0005)

3. 1. 6. 1 Wi r el ess I P Communi cat i ons

Do not i nst al l wi r el ess I P net wor ks, i ncl udi ng wi r el ess access poi nt s; do not i nst al l or conf i gur e an ad- hoc wi r el ess net wor k; do not i nst al l or conf i gur e a Wi Fi Di r ect communi cat i on.

When expl i c i t l y aut hor i zed by t he Gover nment , wi r el ess I P communi cat i on may be used t o communi cat e wi t h an exi st i ng wi r el ess net wor k.

3. 1. 6. 2 Non- I P Wi r el ess Communi cat i on

When non- I P wi r el ess communi cat i on i s expl i c i t l y aut hor i zed by t he Gover nment , use t he maxi mum l evel of encr ypt i on suppor t ed by t he speci f i c pr ot ocol empl oyed and sel ect s i gnal st r engt h and r adi at ed power t o t he mi ni mum necessar y f or r el i abl e communi cat i on.

3. 1. 6. 3 Wi r el ess Communi cat i on Request

Pr ovi de a r epor t document i ng t he pr oposed use of wi r el ess communi cat i on pr i or t o begi nni ng const r uct i on usi ng t he Wi r el ess Communi cat i on Request Schedul e at http://www.wbdg.org/FFC/NAVGRAPH/graphtoc.pdf .

For each devi ce pr oposed t o use wi r el ess communi cat i on show: t he devi ce i dent i f i er , a descr i pt i on of t he devi ce, t he l ocat i on of t he devi ce, t he devi ce i dent i f i er s of ot her devi ces communi cat i ng wi t h t he devi ce, t he pr ot ocol used f or communi cat i on, encr ypt i on t ype and st r engt h, RF Fr equency, Radi at ed Power i n dBm ( deci bel wi t h a mi l l i wat t r ef er ence) , f r ee- space r ange, and t he expect ed as- i nst al l ed r ange.

3. 1. 6. 4 Wi r el ess Communi cat i on Test i ng

As par t of Funct i onal Per f or mance Test i ng ( FPT) , conduct t est i ng of wi r el ess communi cat i on f or t he devi ces i ndi cat ed on t he appr oved Wi r el ess Communi cat i on Request as r equi r i ng t est i ng.

To t est wi r el ess communi cat i on, t est f or wi r el ess net wor k r ecept i on at mul t i pl e poi nt s al ong t he wi r el ess t est boundar y i n t he v i c i ni t y of t he wi r el ess devi ce, and r ecor d whet her a net wor k connect i on can be est abl i shed at each poi nt . The wi r el ess t est boundar y i s t he bui l di ng ext er i or wal l s.

I f wi r el ess t est i ng i s r equi r ed, pr ovi de a Wi r el ess Communi cat i on Test Report document i ng t he t est i ng poi nt s and r esul t s at each poi nt f or each wi r el ess devi ce.

3. 2 CYBERSECURI TY AUDI TI NG

3. 2. 1 Audi t Event s, Cont ent of Audi t Recor ds, and Audi t Gener at i on

For devi ces t hat have STI G/ SRGs r el at ed t o audi t event s, cont ent of audi t r ecor ds or audi t gener at i on, compl y wi t h t he r equi r ement s of t hose STIG/SRGs.

3. 2. 1. 1 Computers

For each comput er , pr ovi de t he capabi l i t y t o sel ect audi t ed event s and t he cont ent of audi t l ogs. Conf i gur e comput er s t o audi t t he i ndi cat ed event s, and t o r ecor d t he i ndi cat ed i nf or mat i on f or each audi t abl e event

SECTI ON 25 05 11 Page 15 ( Added by Amendment 0005)

3. 2. 1. 1. 1 Audi t ed Event s

Conf i gur e each comput er t o audi t t he f ol l owi ng event s:

a. Successf ul and unsuccessf ul at t empt s t o access, modi f y, or del et e pr i v i l eges, secur i t y obj ect s, secur i t y l evel s, or cat egor i es of i nf or mat i on ( e. g. c l assi f i cat i on l evel s)

a. Successf ul and unsuccessf ul l ogon at t empt s

b. Pr i v i l eged act i v i t i es or ot her syst em l evel access

c. St ar t i ng and endi ng t i me f or user access t o t he syst em

d. Concur r ent l ogons f r om di f f er ent wor kst at i ons

e. Successf ul and unsuccessf ul accesses t o obj ect s f . Pr ogr am i ni t i at i ons

g. Di r ect access t o t he i nf or mat i on syst em

h. Account cr eat i ons, modi f i cat i ons, di sabl i ng, and t er mi nat i ons i . Ker nel modul e l oad, unl oad, and r est ar t

3. 2. 1. 1. 2 Audi t Event I nf or mat i on To Recor d

Conf i gur e each comput er t o r ecor d, f or each audi t abl e event , t he f ol l owi ng i nf or mat i on ( wher e appl i cabl e t o t he event ) :

a. What t ype of event occur r ed

b. When t he event occur r ed

c. Wher e t he event occur r ed

d. The sour ce of t he event

e. The out come of t he event f . The i dent i t y of i ndi v i dual s and subj ect s associ at ed wi t h t he event

3. 2. 1. 2 For Cont r ol Syst em Devi ces

3. 2. 1. 2. 1 Cont r ol Syst em Devi ces Ful l y Suppor t i ng User Account s

For devi ces f ul l y suppor t i ng account s, pr ovi de t he capabi l i t y t o sel ect audi t ed event s, and t he cont ent s of audi t l ogs. Conf i gur e devi ces t o audi t t he f ol l owi ng event s:

a. Successf ul and unsuccessf ul l ogon at t empt s t o t he devi ce

b. St ar t i ng and endi ng t i me f or user access t o t he devi ce

c. Account cr eat i ons, modi f i cat i ons, di sabl i ng, and t er mi nat i ons

d. Devi ce shut down and st ar t up

SECTI ON 25 05 11 Page 16 ( Added by Amendment 0005)

Conf i gur e t he devi ce t o r ecor d f or each event t he f ol l owi ng i nf or mat i on ( as appl i cabl e) : t he t ype of event , when t he event occur r ed, and t he i dent i t i es of i ndi v i dual s and subj ect s associ at ed wi t h t he event

3. 2. 1. 2. 2 Ot her Cont r ol Syst em Devi ces

Ther e ar e no r equi r ement s t o per f or m audi t i ng at f i el d devi ces t hat do not f ul l y suppor t account s.

3. 2. 1. 3 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

For cont r ol syst em devi ces wher e Audi t Event s, Cont ent of Audi t Recor ds, and Audi t Gener at i on ar e not ot her wi se i ndi cat ed i n t hi s Sect i on:

3. 2. 1. 3. 1 Devi ces Whi ch Ful l y Suppor t Account s

For each devi ce whi ch f ul l y suppor t s account s, pr ovi de t he capabi l i t y t o sel ect audi t ed event s and t he cont ent of audi t l ogs. Conf i gur e devi ces t o audi t t he i ndi cat ed event s, and t o r ecor d t he i ndi cat ed i nf or mat i on f or each audi t abl e event

a. Conf i gur e each devi ce t o audi t t he f ol l owi ng event s:

( 1) Successf ul and unsuccessf ul at t empt s t o access, modi f y, or del et e pr i v i l eges, secur i t y obj ect s, secur i t y l evel s, or cat egor i es of i nf or mat i on ( e. g. c l assi f i cat i on l evel s)

( 2) Successf ul and unsuccessf ul l ogon at t empt s

( 3) Pr i v i l eged act i v i t i es or ot her syst em l evel access

( 4) St ar t i ng and endi ng t i me f or user access t o t he syst em

( 5) Concur r ent l ogons f r om di f f er ent wor kst at i ons

( 6) Account cr eat i ons, modi f i cat i ons, di sabl i ng, and t er mi nat i ons

( 7) Ker nel modul e l oad, unl oad, and r est ar t

b. Conf i gur e each comput er t o r ecor d, f or each audi t abl e event , t he f ol l owi ng i nf or mat i on ( wher e appl i cabl e t o t he event ) :

( 1) what t ype of event occur r ed

( 2) when t he event occur r ed

( 3) wher e t he event occur r ed

( 4) t he sour ce of t he event

( 5) t he out come of t he event

( 6) t he i dent i t i es of i ndi v i dual s and subj ect s associ at ed wi t h t he event

3. 2. 1. 3. 2 Devi ces Whi ch Do Not Ful l y Suppor t Account s

For each Devi ce whi ch does not f ul l y suppor t account s, conf i gur e t he devi ce t o audi t t he devi ce shut down and st ar t up event s and t o r ecor d f or each event t he t ype of event and when t he event occur r ed.

SECTI ON 25 05 11 Page 17 ( Added by Amendment 0005)

3. 2. 2 Audi t St or age Capaci t y and Audi t Upl oad

a. For devi ces t hat have STI G/ SRGs r el at ed t o audi t st or age capaci t y ( CCI - 001848 or CCI - 001849) compl y wi t h t he r equi r ement s of t hose STI G/ SRGs.

b. For non- comput er cont r ol syst em devi ces capabl e of gener at i ng audi t r ecor ds, pr ovi de 60 days wor t h of secur e l ocal st or age, assumi ng 10 audi t abl e event s per day.

3. 2. 2. 1 Devi ce Audi t Recor d Upl oad Sof t war e

For each non- comput er devi ce r equi r ed t o audi t event s, pr ovi de, and l i cense t o t he Gover nment , sof t war e i mpl ement i ng a secur e mechani sm of upl oadi ng audi t r ecor ds f r om t he devi ce t o a comput er and of expor t i ng t he upl oaded audi t r ecor ds as a Mi cr osof t Excel f i l e or comma separ at ed val ue t ext f i l e.