19R3004vol4.PDF

Fort Gordon, Georgia

Solicitation Number

W912HN-19-R-3004

SCI Training, Research, and Network Center (MCA-1) Volume 4 of 5: Specification Divisions 25 - 31

PN 88724

May 2019

U.S. ARMY ENGINEER DISTRICT, SAVANNAH

CORPS OF ENGINEERS

100 WEST OGLETHORPE AVENUE

SAVANNAH, GEORGIA 31401-3640

US Army Corps of Engineers Savannah District

SCI Tr ai ni ng, Resear ch, and Net wor k Cent er ( MCA1) C19R3004 Ft . Gor don, GA

PROJECT TABLE OF CONTENTS

DI VI SI ON 01 - GENERAL REQUI REMENTS

01 03 00 * 3 OPTI ONS

01 11 00 SUMMARY OF WORK

01 14 00 WORK RESTRI CTI ONS

01 22 00. 00 10 PRI CE AND PAYMENT PROCEDURES

01 30 00 ADMI NI STRATI VE REQUI REMENTS

01 32 01. 00 10 PROJECT SCHEDULE

01 33 00 SUBMI TTAL PROCEDURES

01 33 29 SUSTAI NABI LI TY REPORTI NG

01 35 26 GOVERNMENTAL SAFETY REQUI REMENTS

01 42 00 SOURCES FOR REFERENCE PUBLI CATI ONS

01 43 39 MOCK-UPS

01 45 00. 00 10 QUALI TY CONTROL

01 45 00. 15 10 RESI DENT MANAGEMENT SYSTEM CONTRACTOR MODE ( RMS CM)

01 45 35 SPECI AL I NSPECTI ONS

01 50 00 TEMPORARY CONSTRUCTI ON FACI LI TI ES AND CONTROLS

01 57 19 TEMPORARY ENVI RONMENTAL CONTROLS

01 58 00 PROJECT I DENTI FI CATI ON

01 73 29 CUTTI NG AND PATCHI NG

01 74 19 CONSTRUCTI ON AND DEMOLI TI ON WASTE MANAGEMENT

01 74 23 CLEANING

01 78 00 CLOSEOUT SUBMI TTALS

01 78 23 OPERATI ON AND MAI NTENANCE DATA

01 91 00. 15 TOTAL BUI LDI NG COMMI SSI ONI NG

DI VI SI ON 02 - EXI STI NG CONDI TI ONS

02 41 00 DEMOLI TI ON AND DECONSTRUCTI ON

DI VI SI ON 03 - CONCRETE

03 11 13. 00 10 STRUCTURAL CAST- I N- PLACE CONCRETE FORMI NG

03 15 00. 00 10 CONCRETE ACCESSORI ES

03 20 00. 00 10 CONCRETE REI NFORCI NG

03 30 00. 00 10 CAST- I N- PLACE CONCRETE

03 35 00. 00 10 CONCRETE FI NI SHI NG

03 39 00. 00 10 CONCRETE CURI NG

DI VI SI ON 04 - MASONRY

04 20 00 UNI T MASONRY

DI VI SI ON 05 - METALS

05 05 23. 13 10 ULTRASONI C I NSPECTI ON OF WELDMENTS

05 05 23. 16 STRUCTURAL WELDI NG

05 12 00 STRUCTURAL STEEL

05 30 00 STEEL DECKS

05 40 00 COLD- FORMED METAL FRAMI NG

05 45 23 EQUI PMENT SUPPORT SYSTEM

05 50 13 MI SCELLANEOUS METAL FABRI CATI ONS

05 51 00 METAL STAI RS

05 51 33 METAL LADDERS

05 52 00 METAL RAI LI NGS

05 72 00 DECORATI VE METAL SPECI ALTI ES

05 73 13 GLASS SUPPORTED RAI LI NGS

PROJECT TABLE OF CONTENTS Page 1

DI VI SI ON 06 - WOOD, PLASTI CS, AND COMPOSI TES

06 10 00 ROUGH CARPENTRY

06 16 43 GYPSUM SHEATHI NG

06 20 00 FI NI SH CARPENTRY

06 41 16. 00 10 PLASTI C- LAMI NATE- CLAD ARCHI TECTURAL CABI NETS

06 61 16 SOLI D SURFACI NG FABRI CATI ONS

DI VI SI ON 07 - THERMAL AND MOI STURE PROTECTI ON

07 05 23 PRESSURE TESTI NG AND AI R BARRI ER SYSTEM FOR AI R TI GHTNESS

07 14 00 COLD FLUI D- APPLI ED WATERPROOFI NG

07 16 00. 01 VAPOR EMI SSI ON CONTROL FOR CONCRETE FLOORS WI TH FI NI SH

FLOORING

07 21 13 BOARD AND BLOCK I NSULATI ON

07 22 00 ROOF AND DECK I NSULATI ON

07 27 10. 00 10 BUI LDI NG AI R BARRI ER SYSTEM

07 27 26 FLUI D- APPLI ED MEMBRANE AI R BARRI ERS

07 42 13 * 5 METAL WALL PANELS ( MPS- 1/ MPS- A2/ MPS- 3)

07 42 16 ALUMI NUM COMPOSI TE MATERI AL ( ACM) SYSTEM ( ACM- 1)

07 42 29 TERRACOTTA RAI NSCREEN WALL PANELS ( TCRS- 1, TCS- 1)

07 53 23 ETHYLENE- PROPYLENE- DI ENE- MONOMER ROOFI NG ( EPDM)

07 60 00 FLASHI NG AND SHEET METAL

07 81 00 SPRAY- APPLI ED FI REPROOFI NG

07 84 00 FIRESTOPPING

07 92 00 JOI NT SEALANTS

DI VI SI ON 08 - OPENI NGS

08 11 13 STEEL DOORS AND FRAMES

08 11 16 ALUMI NUM DOOR FRAMES

08 31 00 ACCESS DOORS AND PANELS

08 33 23 OVERHEAD COI LI NG DOORS

08 34 73 SOUND CONTROL DOOR ASSEMBLI ES

08 41 13 ALUMI NUM- FRAMED ENTRANCES AND STOREFRONTS

08 44 00 CURTAI N WALL AND GLAZED ASSEMBLI ES

08 71 00 DOOR HARDWARE

08 81 00 GLAZING

08 87 33 DECORATI VE FI LM

08 91 00 METAL WALL LOUVERS

DI VI SI ON 09 - FI NI SHES

09 22 16 NON- STRUCTURAL METAL FRAMI NG

09 24 24 PORTLAND CEMENT STUCCO

09 29 00 GYPSUM BOARD

09 30 10 CERAMI C, QUARRY, AND GLASS TI LI NG

09 51 00 ACOUSTI CAL CEI LI NGS

09 54 43 STRETCHED- FABRI C CEI LI NG SYSTEMS

09 62 38 STATI C- CONTROL FLOORI NG

09 65 00 RESI LI ENT FLOORI NG

09 66 23 RESI NOUS MATRI X TERRAZZO FLOORI NG

09 68 00 CARPETING

09 69 13 RI GI D GRI D ACCESS FLOORI NG

09 72 00 WALLCOVERINGS

09 84 20 ACOUSTI CAL WALL PANELS

09 90 00 PAI NTS AND COATI NGS

PROJECT TABLE OF CONTENTS Page 2

DI VI SI ON 10 - SPECI ALTI ES

10 14 00. 10 EXTERI OR SI GNAGE

10 14 00. 20 I NTERI OR SI GNAGE

10 14 00. 20 01 I NTERI OR MESSAGE SCHEDULE

10 14 53 TRAFFI C SI GNAGE

10 21 13 TOI LET COMPARTMENTS

10 22 19 DEMOUNTABLE AND MOVABLE PARTI TI ONS

10 22 29 UPFOLDI NG PANEL PARTI TI ONS

10 26 00 WALL AND DOOR PROTECTI ON

10 28 13 TOI LET ACCESSORI ES

10 44 16 FI RE EXTI NGUI SHERS

10 51 13 METAL LOCKERS

10 71 13 EXTERI OR SUN CONTROL DEVI CES ( AS- 1)

DI VI SI ON 11 - EQUI PMENT

11 13 19. 13 LOADI NG DOCK ACCESSORI ES

11 14 13 SECURI TY TURNSTI LES

11 24 23 WI NDOW WASHI NG SYSTEM

11 24 26 SAFETY TI E- BACKS

DI VI SI ON 12 - FURNI SHI NGS

12 24 13 ROLLER WI NDOW SHADES

12 36 00 COUNTERTOPS

12 61 13 UPHOLSTERED AUDI ENCE SEATI NG

12 93 00 SI TE FURNI SHI NGS

DI VI SI ON 13 - SPECI AL CONSTRUCTI ON

13 49 20. 00 10 RF SHI ELDI NG

DI VI SI ON 14 - CONVEYI NG EQUI PMENT

14 21 23 ELECTRI C TRACTI ON PASSENGER ELEVATORS

DI VI SI ON 21 - FI RE SUPPRESSI ON

21 13 13. 00 10 COMBI NED WET PI PE SPRI NKLER AND STANDPI PE SYSTEM, FI RE

PROTECTION

21 30 00 FI RE PUMPS

DI VI SI ON 22 - PLUMBI NG

22 00 00 PLUMBI NG, GENERAL PURPOSE

22 14 29. 00 40 SUMP PUMPS

DI VI SI ON 23 - HEATI NG, VENTI LATI NG, AND AI R CONDI TI ONI NG ( HVAC)

23 00 00 AI R SUPPLY, DI STRI BUTI ON, VENTI LATI ON, AND EXHAUST SYSTEMS

23 01 30. 41 HVAC SYSTEM CLEANI NG

23 05 48. 00 40 VI BRATI ON AND SEI SMI C CONTROLS FOR HVAC PI PI NG AND

EQUIPMENT

23 05 93 TESTI NG, ADJUSTI NG, AND BALANCI NG FOR HVAC

23 07 00 THERMAL I NSULATI ON FOR MECHANI CAL SYSTEMS

23 09 00 I NSTRUMENTATI ON AND CONTROL FOR HVAC

23 09 13 I NSTRUMENTATI ON AND CONTROL DEVI CES FOR HVAC

23 09 23. 13 20 BACNET DI RECT DI GI TAL CONTROL SYSTEMS FOR HVAC

PROJECT TABLE OF CONTENTS Page 3

23 09 93 SEQUENCES OF OPERATI ON FOR HVAC CONTROL

23 11 25 FACI LI TY GAS PI PI NG

23 21 23 HYDRONI C PUMPS

23 23 00 REFRI GERANT PI PI NG

23 25 00 CHEMI CAL TREATMENT OF WATER FOR MECHANI CAL SYSTEMS

23 52 00 HEATI NG BOI LERS

23 57 10. 00 10 FORCED HOT WATER HEATI NG SYSTEMS USI NG WATER AND STEAM

HEAT EXCHANGERS

23 64 26 CHI LLED, CHI LLED- HOT, AND CONDENSER WATER PI PI NG SYSTEMS

23 81 00 DECENTRALI ZED UNI TARY HVAC EQUI PMENT

23 81 23. 00 20 COMPUTER ROOM AI R CONDI TI ONI NG UNI TS

DI VI SI ON 25 - I NTEGRATED AUTOMATI ON

25 05 11. 00 UTI LI TY MONI TORI NG AND CONTROL SYSTEM ONLY

25 05 11. 01 CYBERSECURI TY FOR FI RE LI FE SAFETY ( FLS) CONTROL SYSTEMS

25 08 10 UTI LI TY MONI TORI NG AND CONTROL SYSTEM TESTI NG

25 10 10. 00 UTI LI TY MONI TORI NG AND CONTROL SYSTEM ( UMCS) FRONT END

AND I NTEGRATI ON

25 10 10. 01 FI RE LI FE SAFETY ( FLS) CONTROL SYSTEM FRONT END AND

INTEGRATION

25 50 00. 00 20 CYBERSECURI TY OF FACI LI TY- RELATED CONTROL SYSTEMS

DI VI SI ON 26 - ELECTRI CAL

26 00 00. 00 20 BASI C ELECTRI CAL MATERI ALS AND METHODS

26 08 00 APPARATUS I NSPECTI ON AND TESTI NG

26 09 23 LI GHTI NG CONTROL DEVI CES

26 20 00 I NTERI OR DI STRI BUTI ON SYSTEM

26 23 00 LOW- VOLTAGE SWI TCHGEAR

26 24 13 SWITCHBOARDS

26 28 01. 00 10 COORDI NATED POWER SYSTEM PROTECTI ON

26 29 23 VARI ABLE FREQUENCY DRI VE SYSTEMS UNDER 600 VOLTS

26 32 33. 00 10 UNI NTERRUPTI BLE POWER SUPPLY ( UPS) SYSTEM ABOVE 15 KVA

CAPACITY

26 41 00 LI GHTNI NG PROTECTI ON SYSTEM

26 51 00 I NTERI OR LI GHTI NG

26 56 00 EXTERI OR LI GHTI NG

DI VI SI ON 27 - COMMUNI CATI ONS

27 10 00 BUI LDI NG TELECOMMUNI CATI ONS CABLI NG SYSTEM

DI VI SI ON 28 - ELECTRONI C SAFETY AND SECURI TY

28 08 10 ELECTRONI C SECURI TY SYSTEM ACCEPTANCE TESTI NG

28 10 05 ELECTRONI C SECURI TY SYSTEMS ( ESS)

28 31 76 I NTERI OR FI RE ALARM AND MASS NOTI FI CATI ON SYSTEM

DI VI SI ON 31 - EARTHWORK

31 00 00 EARTHWORK

31 00 01 EARTHWORK - BUI LDI NG SUBGRADE

31 05 19 GEOTEXTILE

31 05 21 GEOGRI D SOI L REI NFORCEMENT

31 05 22 GEOTEXTI LES USED AS FI LTERS

31 10 00 CLEARI NG FOR CI VI L WORKS

31 11 00 CLEARI NG AND GRUBBI NG

31 31 16. 13 * 5 CHEMI CAL TERMI TE CONTROL

PROJECT TABLE OF CONTENTS Page 4

31 32 11 SOI L SURFACE EROSI ON CONTROL

31 60 00 FOUNDATI ON PREPARATI ON

DI VI SI ON 32 - EXTERI OR I MPROVEMENTS

32 05 33 LANDSCAPE ESTABLI SHMENT

32 11 23 AGGREGATE BASE COURSES

32 11 24 GRADED CRUSHED AGGREGATE BASE COURSE FOR FLEXI BLE PAVEMENT

32 12 13 BI TUMI NOUS TACK AND PRI ME COATS

32 12 17 HOT MI X BI TUMI NOUS PAVEMENT

32 13 13. 06 PORTLAND CEMENT CONCRETE PAVEMENT FOR ROADS AND SI TE

FACILITIES

32 16 13 CONCRETE SI DEWALKS AND CURBS AND GUTTERS

32 17 23 PAVEMENT MARKI NGS

32 31 13 * 5 EXTERI OR GATES

32 31 27 SECURI TY FENCE

32 84 23 UNDERGROUND SPRI NKLER SYSTEMS

32 92 23 SODDING

32 93 00 EXTERI OR PLANTS

32 94 50 STRUCTURAL SOI L CELLS

DI VI SI ON 33 - UTI LI TI ES

33 05 00. 01 COMMON WORK FOR UTI LI TY RELOCATI ON

33 40 00 STORM DRAI NAGE UTI LI TI ES

33 46 16 SUBDRAI NAGE PI PI NG

33 61 13. 13 PREFABRI CATED UNDERGROUND HYDRONI C ENERGY DI STRI BUTI ON

33 63 13. 19 CONCRETE TRENCH HYDRONI C AND STEAM ENERGY DI STRI BUTI ON

33 71 02. 01 UNDERGROUND ELECTRI CAL DI STRI BUTI ON FOR COMMUNI CATI ONS

33 82 00 TELECOMMUNI CATI ONS OUTSI DE PLANT ( OSP)

DI VI SI ON 34 - TRANSPORTATI ON

34 71 13. 19 ACTI VE VEHI CLE BARRI ERS

APPENDICES

Appendi x A AUD SPECI FI CATI ONS Appendi x B GEOTECHNI CAL REPORTS

- - End of Pr oj ect Tabl e of Cont ent s - -

PROJECT TABLE OF CONTENTS Page 5

SCI Tr ai ni ng, Resear ch, and Net wor k Cent er ( MCA1) 19R3004

SECTI ON TABLE OF CONTENTS

DI VI SI ON 25 - I NTEGRATED AUTOMATI ON

SECTI ON 25 05 11. 00

UTI LI TY MONI TORI NG AND CONTROL SYSTEM ONLY

11/17

PART 1 GENERAL

1. 1 CONTROL SYSTEM APPLI CABI LI TY

1. 2 RELATED REQUI REMENTS

1. 3 REFERENCES

1. 4 DEFI NI TI ONS

1. 4. 1 Comput er

1. 4. 2 Net wor k Connect ed

1. 4. 3 User Account Suppor t Level s

1. 4. 3. 1 FULLY Suppor t ed

1. 4. 3. 2 MI NI MALLY Suppor t ed

1. 4. 3. 3 NOT Suppor t ed

1. 4. 4 User I nt er f ace

1. 4. 4. 1 Li mi t ed Local User I nt er f ace

1. 4. 4. 2 Ful l Local User I nt er f ace

1. 4. 4. 3 Remot e User I nt er f ace

1. 5 ADMI NI STRATI VE REQUI REMENTS

1. 5. 1 Coor di nat i on

1. 6 SUBMI TTALS

1. 7 QUALI TY CONTROL

1. 8 DELI VERY, STORAGE, AND HANDLI NG

1. 9 CYBERSECURI TY DOCUMENTATI ON

1. 9. 1 Cyber secur i t y I nt er connect i on Schedul e

1. 9. 2 Net wor k Communi cat i on Repor t

1. 9. 3 Cont r ol Syst em I nvent or y Repor t

1. 9. 4 Sof t war e Recover y and Reconst i t ut i on I mages

1. 9. 5 Cyber secur i t y Ri ser Di agr am

1. 9. 6 Cont r ol Syst em Cyber secur i t y Document at i on

1. 9. 6. 1 Sof t war e Appl i cat i ons

1. 9. 6. 2 For HVAC Cont r ol Syst em Devi ces

1. 9. 6. 2. 1 HVAC Cont r ol Syst em Devi ces FULLY Suppor t i ng User

Accounts

1. 9. 6. 2. 2 Al l Ot her HVAC Cont r ol Syst em Devi ces

1. 9. 6. 3 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

1. 10 SOFTWARE UPDATE LI CENSI NG

1. 11 CYBERSECURI TY DURI NG CONSTRUCTI ON

1. 11. 1 Cont r act or Comput er Equi pment

1. 11. 1. 1 Oper at i ng Syst em

1. 11. 1. 2 Ant i - Mal war e Sof t war e

1. 11. 1. 3 Passwor ds and Passphr ases

1. 11. 1. 4 Cont r act or Comput er Cyber secur i t y Compl i ance St at ement s

1. 11. 2 Tempor ar y I P Net wor ks

1. 11. 2. 1 Net wor k Boundar i es and Connect i ons

1. 11. 3 Gover nment Access t o Net wor k

1. 11. 4 Tempor ar y Wi r el ess I P Net wor ks

1. 11. 5 Passwor ds and Passphr ases

SECTI ON 25 05 11. 00 Page 1

1. 11. 6 Cont r act or Tempor ar y Net wor k Cyber secur i t y Compl i ance Statements

1. 12 CYBERSECURI TY DURI NG WARRANTY PERI OD

PART 2 PRODUCTS

PART 3 EXECUTI ON

3. 1 ACCESS CONTROL REQUI REMENTS

3. 1. 1 User Account s

3. 1. 1. 1 Comput er s

3. 1. 1. 2 For HVAC Cont r ol Syst em Devi ces

3. 1. 1. 3 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

3. 1. 2 Unsuccessf ul Logon At t empt s

3. 1. 2. 1 Devi ces MI NI MALLY Suppor t i ng Account s

3. 1. 2. 2 Devi ces FULLY Suppor t i ng Account s

3. 1. 2. 3 Hi gh Avai l abi l i t y I nt er f aces Exempt f r om Unsuccessf ul Logon

At t empt s Requi r ement s

3. 1. 3 Syst em Use Not i f i cat i on

3. 1. 3. 1 User I nt er f ace Banner Schedul e

3. 1. 4 Per mi t t ed Act i ons Wi t hout I dent i f i cat i on or Aut hent i cat i on

3. 1. 5 Wi r el ess Access

3. 1. 5. 1 Wi r el ess I P Communi cat i ons

3. 1. 5. 2 Non- I P Wi r el ess Communi cat i on

3. 1. 5. 3 Wi r el ess Communi cat i on Request

3. 1. 5. 4 Wi r el ess Communi cat i on Test i ng

3. 2 CYBERSECURI TY AUDI TI NG

3. 2. 1 Audi t Event s, Cont ent of Audi t Recor ds, and Audi t Gener at i on

3. 2. 1. 1 Comput er s

3. 2. 1. 1. 1 Audi t ed Event s

3. 2. 1. 1. 2 Audi t Event I nf or mat i on To Recor d

3. 2. 1. 2 For HVAC Cont r ol Syst em Devi ces

3. 2. 1. 2. 1 HVAC Cont r ol Syst em Devi ces FULLY Suppor t i ng User

Accounts

3. 2. 1. 2. 2 Ot her HVAC Cont r ol Syst em Devi ces

3. 2. 1. 3 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

3. 2. 1. 3. 1 Devi ces Whi ch FULLY Suppor t Account s

3. 2. 1. 3. 1. 1 Audi t ed Event s

3. 2. 1. 3. 1. 2 Audi t Event I nf or mat i on To Recor d

3. 2. 1. 3. 2 Devi ces Whi ch Do Not FULLY Suppor t Account s

3. 2. 2 Audi t St or age Capaci t y and Audi t Upl oad

3. 2. 2. 1 Devi ce Audi t Recor d Upl oad Sof t war e

3. 2. 3 Response t o Audi t Pr ocessi ng Fai l ur es

3. 2. 4 Ti me St amps

3. 2. 4. 1 Comput er s

3. 2. 4. 2 For HVAC Cont r ol Syst em Devi ces

3. 2. 4. 3 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

3. 3 REQUI REMENTS FOR LEAST FUNCTI ONALI TY

3. 3. 1 Non- I P Cont r ol Net wor ks

3. 3. 2 I P Cont r ol Net wor ks

3. 4 SAFE MODE AND FAI L SAFE OPERATI ON

3. 5 I DENTI FI CATI ON AND AUTHENTI CATI ON

3. 5. 1 User I dent i f i cat i on and Aut hent i cat i on

3. 5. 1. 1 HVAC Cont r ol Syst ems Devi ces

3. 5. 1. 2 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

3. 5. 2 Aut hent i cat or Management

3. 5. 2. 1 Aut hent i cat i on Type

3. 5. 2. 1. 1 For HVAC Cont r ol Syst em Devi ces

SECTI ON 25 05 11. 00 Page 2

3. 5. 2. 1. 2 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

3. 5. 2. 2 Passwor d- Based Aut hent i cat i on Requi r ement s

3. 5. 2. 2. 1 Passwor ds f or Comput er s

3. 5. 2. 2. 2 Passwor ds f or Non- Comput er Devi ces FULLY Suppor t i ng

Accounts

3. 5. 2. 2. 3 Passwor ds f or Web I nt er f aces

3. 5. 2. 2. 4 Passwor ds f or Devi ces Mi ni mal l y Suppor t i ng Account s

3. 5. 2. 2. 5 Passwor d Conf i gur at i on and Repor t i ng

3. 5. 2. 3 Har dwar e Token- Based Aut hent i cat i on Requi r ement s

3. 5. 3 Aut hent i cat or Feedback

3. 5. 4 Devi ce I dent i f i cat i on and Aut hent i cat i on

3. 5. 4. 1 For HVAC Cont r ol Syst em Devi ces

3. 5. 4. 2 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

3. 5. 5 Cr ypt ogr aphi c Modul e Aut hent i cat i on

3. 6 EMERGENCY POWER

3. 7 DURABI LI TY TO VULNERABI LI TY SCANNI NG

3. 7. 1 HVAC Cont r ol Syst em Devi ces Ot her Than Comput er s

3. 7. 2 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

3. 8 FI PS 201- 2 REQUI REMENT

3. 9 DEVI CES WI TH CONNECTI ON TO MULTI PLE I P NETWORKS

3. 10 SYSTEM AND COMMUNI CATI ON PROTECTI ON

3. 10. 1 Deni al of Ser vi ce Pr ot ect i on, Pr ocess I sol at i on and Boundar y

Protection

3. 10. 2 Cr ypt ogr aphi c Pr ot ect i on

3. 11 SYSTEM AND I NTEGRATI ON I NTEGRI TY

3. 11. 1 Mal i c i ous Code Pr ot ect i on

3. 12 FI ELD QUALI TY CONTROL

3. 12. 1 Test s

- - End of Sect i on Tabl e of Cont ent s - -

SECTI ON 25 05 11. 00 Page 3

SECTI ON 25 05 11. 00

UTI LI TY MONI TORI NG AND CONTROL SYSTEM ONLY

11/17

PART 1 GENERAL

Many subpar t s i n t hi s Sect i on cont ai n t ext i n cur l y br aces ( " { " and " } " ) i ndi cat i ng whi ch cyber secur i t y cont r ol and cont r ol cor r el at i on i dent i f i er ( CCI ) t he r equi r ement s of t he subpar t r el at e t o. The t ext i nsi de t hese cur l y br aces i s f or Gover nment r ef er ence onl y, and enabl es coor di nat i on of t he r equi r ement s of t hi s Sect i on wi t h t he RMF pr ocess t hr oughout t he desi gn and const r uct i on pr ocess. Text i n cur l y br aces ar e not cont r act or requirements.

Thi s Sect i on r ef er s t o Secur i t y Requi r ement s Gui de ( SRGs) and Secur i t y Techni cal I mpl ement at i on Gui de ( STI Gs) . STI Gs and SRGs ar e ar e avai l abl e onl i ne at t he I nf or mat i on Assur ance Suppor t Envi r onment ( I ASE) websi t e at http://iase.disa.mil/stigs/Pages/index.aspx . Not al l cont r ol syst em component s have appl i cabl e STI Gs or SRGs.

1. 1 CONTROL SYSTEM APPLI CABI LI TY

Ther e ar e mul t i pl e ver si ons of t hi s Sect i on associ at ed wi t h t hi s pr oj ect .

Di f f er ent ver si ons have r equi r ement s appl i cabl e t o di f f er ent cont r ol syst ems. Thi s speci f i c Sect i on appl i es onl y t o t he f ol l owi ng cont r ol syst ems: UMCS i ncl udi ng: HVAC, BUI LDI NG LI GHTI NG.

1. 2 RELATED REQUI REMENTS

Al l Sect i ons cont ai ni ng f aci l i t y- r el at ed cont r ol syst ems or cont r ol syst em component s ar e r el at ed t o t he r equi r ement s of t hi s Sect i on. Revi ew al l speci f i cat i on sect i ons t o det er mi ne r el at ed r equi r ement s.

1. 3 REFERENCES

The publ i cat i ons l i s t ed bel ow f or m a par t of t hi s speci f i cat i on t o t he ext ent r ef er enced. The publ i cat i ons ar e r ef er r ed t o wi t hi n t he t ext by t he basi c desi gnat i on onl y.

AMERI CAN SOCI ETY OF HEATI NG, REFRI GERATI NG AND AI R- CONDI TI ONI NG

ENGI NEERS ( ASHRAE)

ASHRAE 135 ( 2016; I NT 1 2016; ERTA 1 2016) BACnet —A Dat a Communi cat i on Pr ot ocol f or Bui l di ng Aut omat i on and Cont r ol Net wor ks

I NSTI TUTE OF ELECTRI CAL AND ELECTRONI CS ENGI NEERS ( I EEE)

I EEE 802. 1x ( 2010) Local and Met r opol i t an Ar ea Net wor ks - Por t Based Net wor k Access Control

NATI ONAL I NSTI TUTE OF STANDARDS AND TECHNOLOGY ( NI ST)

NI ST FI PS 201- 2 ( 2013) Per sonal I dent i t y Ver i f i cat i on

SECTI ON 25 05 11. 00 Page 4

( PI V) of Feder al Empl oyees and Cont r act or s

U. S. DEPARTMENT OF DEFENSE ( DOD)

DODI 8551. 01 ( 2014) Por t s, Pr ot ocol s, and Ser vi ces Management ( PPSM)

DTM 08- 060 ( 2008) Pol i cy on Use of Depar t ment of Def ense ( DoD) I nf or mat i on Syst ems - St andar d Consent Banner and User Agr eement

1. 4 DEFINITIONS

1. 4. 1 Computer

As used i n t hi s Sect i on, a comput er i s one of t he f ol l owi ng:

a. a devi ce r unni ng a non- embedded deskt op or ser ver ver si on of Mi cr osof t Windows

b. a devi ce r unni ng a non- embedded ver si on of MacOS

c. a devi ce r unni ng a non- embedded ver si on of Li nux

d. a devi ce r unni ng a ver si on or der i vat i ve of t he Andr oi d OS, wher e Andr oi d i s consi der ed separ at e f r om Li nux

e. a devi ce r unni ng a ver si on of Appl e i OS

1. 4. 2 Net wor k Connect ed

A component i s net wor k connect ed ( or " connect ed t o a net wor k" ) onl y when t he devi ce has a net wor k t r anscei ver whi ch i s di r ect l y connect ed t o t he net wor k and i mpl ement s t he net wor k pr ot ocol . A devi ce l acki ng a net wor k t r anscei ver ( and accompanyi ng pr ot ocol i mpl ement at i on) can never be consi der ed net wor k connect ed. Not e t hat a devi ce connect ed t o a non- I P net wor k i s st i l l consi der ed net wor k connect ed ( an I P connect i on or I P addr ess i s not r equi r ed f or a devi ce t o be net wor k connect ed) .

Any devi ce t hat suppor t s wi r el ess communi cat i on i s net wor k connect ed, r egar dl ess of whet her t he devi ce i s communi cat i ng usi ng wi r el ess.

1. 4. 3 User Account Suppor t Level s

The suppor t f or user account s i s cat egor i zed i n t hi s Sect i on as one of t hr ee l evel s:

1. 4. 3. 1 FULLY Suppor t ed

Devi ce suppor t s conf i gur abl e i ndi v i dual account s. Account s can be cr eat ed, del et ed, modi f i ed, et c. Pr i v i l eges can be assi gned t o account s.

1. 4. 3. 2 MI NI MALLY Suppor t ed

Devi ce suppor t s a smal l , f i xed number of account s ( per haps onl y one) .

Account s cannot be modi f i ed. A devi ce wi t h onl y a " User " and an " Admi ni st r at or " account woul d f i t t hi s cat egor y. Si mi l ar l y, a devi ce wi t h t wo PI Ns f or l ogon - one f or r est r i c t ed and one f or unr est r i c t ed r i ght s woul d f i t her e ( i n ot her wor ds, t he account s do not have t o be t he

SECTI ON 25 05 11. 00 Page 5 t r adi t i onal " user name and passwor d" st r uct ur e) .

1. 4. 3. 3 NOT Suppor t ed

Devi ce does not suppor t any Access Enf or cement t her ef or e t he whol e concept of " account " i s meani ngl ess.

1. 4. 4 User I nt er f ace

Gener al l y, a user i nt er f ace i s har dwar e on a devi ce al l owi ng user i nt er act i on wi t h t hat devi ce v i a i nput ( but t ons, swi t ches, s l i der s, keyboar d, t ouch scr een, et c. ) and a scr een. Ther e ar e t hr ee t ypes of user i nt er f aces def i ned i n t hi s Sect i on: Li mi t ed Local User I nt er f ace, Ful l Local User I nt er f ace and Remot e User I nt er f ace. I n t hi s Sect i on, when t he t er m " User I nt er f ace" i s used wi t hout speci f y i ng whi ch t ype, i t r ef er s onl y t o Ful l Local User I nt er f ace and Remot e User I nt er f ace ( NOT t o Li mi t ed Local User I nt er f ace) .

1. 4. 4. 1 Li mi t ed Local User I nt er f ace

A Li mi t ed Local User I nt er f ace i s a user i nt er f ace wher e t he i nt er act i on i s l i mi t ed, f i xed at t he f act or y, and cannot be modi f i ed i n t he f i el d. The user must be physi cal l y at t he devi ce t o i nt er act wi t h i t .

Exampl es of Li mi t ed Local User I nt er f ace i ncl ude t her most at s ( Space Sensor Modul es as def i ned i n Sect i on 23 09 13 I NSTRUMENTATI ON AND CONTROL DEVI CES

FOR HVAC) .

1. 4. 4. 2 Ful l Local User I nt er f ace

A Ful l Local User I nt er f ace i s a user i nt er f ace wher e t he i nt er act i on and di spl ays ar e f i el d- conf i gur abl e.

Exampl es of a Ful l Local User I nt er f ace i ncl ude l ocal appl i cat i ons on a computer and user i nt er f aces t o Var i abl e Speed Dr i ves.

1. 4. 4. 3 Remot e User I nt er f ace

A Remot e User I nt er f ace i s a user i nt er f ace on a Cl i ent devi ce al l owi ng user i nt er act i on wi t h a di f f er ent Ser ver devi ce. The user need not be physi cal l y at t he Ser ver devi ce t o i nt er act wi t h i t .

Exampl es of Remot e User I nt er f aces i ncl ude web br owser s and Local Di spl ay Panel s as def i ned i n Sect i on 23 09 00 I NSTRUMENTATI ON AND CONTROL FOR HVAC.

1. 5 ADMI NI STRATI VE REQUI REMENTS

1. 5. 1 Coordination

Coor di nat e t he execut i on of t hi s Sect i on wi t h t he execut i on of al l ot her Sect i ons r el at ed t o cont r ol syst ems as i ndi cat ed i n t he par agr aph RELATED REQUI REMENTS. I t ems t hat must be consi der ed when coor di nat i ng pr oj ect ef f or t s i ncl ude but ar e not l i mi t ed t o:

a. I f r equest i ng per mi ssi on f or wi r el ess communi cat i on, t he Wi r el ess Communi cat i on Request submi t t al must be appr oved pr i or t o cont r ol syst em devi ce sel ect i on and i nt egr at i on.

b. I f r equest i ng per mi ssi on f or al t er nat e account l ock per mi ssi ons, t he

SECTI ON 25 05 11. 00 Page 6

Devi ce Account Lock Except i on Request must be appr oved pr i or t o cont r ol syst em devi ce sel ect i on and i nt egr at i on.

c. I f r equest i ng per mi ssi on f or t he use of a devi ce wi t h mul t i pl e I P connect i ons, t he Mul t i pl e I P Connect i on Devi ce Request must be appr oved pr i or t o cont r ol syst em devi ce sel ect i on and i nt egr at i on.

d. Wi r el ess t est i ng may be r equi r ed as par t of t he cont r ol syst em t est i ng. See r equi r ement s f or t he Wi r el ess Communi cat i on Test Repor t submittal.

e. I f t he Devi ce Audi t Recor d Upl oad Sof t war e i s t o be i nst al l ed on a comput er not bei ng pr ovi ded as par t of t he cont r ol syst em, coor di nat i on i s r equi r ed t o i dent i f y t he comput er on whi ch t o i nst al l t he sof t war e.

f . Cyber secur i t y I nt er connect i on Schedul e must be coor di nat ed wi t h ot her wor k t hat wi l l be i nt er connect ed t o, and i nt er connect i ons must be appr oved by t he Gover nment bef or e r el y i ng on t hem f or syst em functionality.

g. Cyber secur i t y t est i ng suppor t must be coor di nat ed acr oss cont r ol syst ems and wi t h t he Gover nment cyber secur i t y t est i ng schedul e.

h. Passwor ds must be coor di nat ed wi t h t he i ndi cat ed cont act f or t he pr oj ect s i t e.

i . I f appl i cabl e, HTTP web ser ver cer t i f i cat es must be obt ai ned f r om t he i ndi cat ed cont act f or t he pr oj ect s i t e.

j . Cont r act or Comput er Cyber secur i t y Compl i ance St at ement s f or each cont r act or usi ng cont r act or owned comput er s.

1. 6 SUBMITTALS

Gover nment appr oval i s r equi r ed f or submi t t al s wi t h a " G" desi gnat i on;

submi t t al s not havi ng a " G" desi gnat i on ar e f or Cont r act or Qual i t y Cont r ol appr oval . Ar chi t ect / Engi neer appr oval i s r equi r ed f or submi t t al s mar ked wi t h an " AE" desi gnat i on. Submi t t al s wi t h an " S" ar e f or i ncl usi on i n t he Sust ai nabi l i t y eNot ebook, i n conf or mance t o Sect i on 01 33 29 SUSTAI NABI LI TY REPORTI NG. Submi t t he f ol l owi ng i n accor dance wi t h Sect i on 01 33 00

SUBMI TTAL PROCEDURES:

SD- 01 Pr econst r uct i on Submi t t al s

Wi r el ess Communi cat i on Request ; G

Devi ce Account Lock Except i on Request ; G

Mul t i pl e I P Connect i on Devi ce Request ; G

Cont r act or Comput er Cyber secur i t y Compl i ance St at ement s; G

Cont r act or Tempor ar y Net wor k Cyber secur i t y Compl i ance St at ement s; G

SD- 02 Shop Dr awi ngs

User I nt er f ace Banner Schedul e; G

Net wor k Communi cat i on Repor t ; G

SECTI ON 25 05 11. 00 Page 7

Cyber secur i t y Ri ser Di agr am; G

Cont r ol Syst em I nvent or y Repor t ; G

Cyber secur i t y I nt er connect i on Schedul e; G

SD- 03 Pr oduct Dat a

Cont r ol Syst em Cyber secur i t y Document at i on; G

SD- 06 Test Repor t s

Wi r el ess Communi cat i on Test Repor t ; G

SD- 07 Cer t i f i cat es

Sof t war e Li censes; G

SD- 11 Cl oseout Submi t t al s

Passwor d Summar y Repor t ; G

Sof t war e Recover y And Reconst i t ut i on I mages; G

Devi ce Audi t Recor d Upl oad Sof t war e; G

1. 7 QUALI TY CONTROL

1. 8 DELI VERY, STORAGE, AND HANDLI NG

1. 9 CYBERSECURI TY DOCUMENTATI ON

1. 9. 1 Cyber secur i t y I nt er connect i on Schedul e

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o CA- 3( b) , CCI-00258}

Pr ovi de a compl et ed Cyber secur i t y I nt er connect i on Schedul e document i ng connect i ons bet ween t he i nst al l ed syst em and ot her syst ems. Pr ovi de t he f ol l owi ng i nf or mat i on f or each devi ce communi cat i ng bet ween syst ems: Devi ce I dent i f i er , Devi ce Descr i pt i on, Tr anspor t l ayer Pr ot ocol , Net wor k Addr ess, Por t ( i f appl i cabl e) , MAC ( Layer 2) addr ess ( i f appl i cabl e) , Medi a, Appl i cat i on Pr ot ocol , Ser vi ce ( i f appl i cabl e) , Descr i pt i ve Pur pose of communi cat i on. For communi cat i on wi t h ot her aut hor i zed syst ems al so pr ovi de t he For ei gn Dest i nat i on and POC f or Dest i nat i on. I f ot her cont r ol syst em Sect i ons used on t hi s pr oj ect i nc l ude submi t t al s document i ng t hi s i nf or mat i on, pr ovi de copi es of t hose submi t t al s t o meet t hi s r equi r ement .

I n addi t i on t o t he r equi r ement s of Sect i on 01 33 00 SUBMI TTAL PROCEDURES, pr ovi de t he Cyber secur i t y I nt er connect i on Schedul e as an edi t abl e Mi cr osof t Excel f i l e ( a t empl at e Cyber secur i t y I nt er connect i on Schedul e i n Excel f or mat i s avai l abl e at http://www.wbdg.org/FFC/NAVGRAPH/graphtoc.pdf .)

1. 9. 2 Net wor k Communi cat i on Repor t

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o CA- 9;

CCI - 002102, CCI - 002103, CCI - 002104, CCI - 002105 and al so t he submi t t al r equi r ement s associ at ed wi t h CM- 6, CM- 7 and SC- 41}

SECTI ON 25 05 11. 00 Page 8

Pr ovi de a net wor k communi cat i on r epor t . For each net wor ked cont r ol l er , document t he communi cat i on char act er i st i cs of t he cont r ol l er i ncl udi ng communi cat i on pr ot ocol s, ser vi ces used, and a gener al descr i pt i on of what i nf or mat i on i s communi cat ed over t he net wor k. For each cont r ol l er usi ng I P, document al l TCP and UDP por t s used. I f ot her cont r ol syst em Sect i ons used on t hi s pr oj ect i ncl ude submi t t al s document i ng t hi s i nf or mat i on, pr ovi de copi es of t hose submi t t al s t o meet t hi s r equi r ement .

I n addi t i on t o t he r equi r ement s of Sect i on 01 33 00 SUBMI TTAL PROCEDURES, pr ovi de t he Net wor k Communi cat i on Repor t as an edi t abl e Mi cr osof t Excel file.

1. 9. 3 Cont r ol Syst em I nvent or y Repor t

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o CM- 8( a) , CP- 12, SI - 17, I A- 3; CCI - 000389, CCI - 000392, CCI - 000398, CCI - 002855, CCI - 002856, CCI - 002857, CCI - 002773, CCI - 002774, CCI - 002775, CCI - 000777, CCI - 000778, CCI - 001958}

Pr ovi de a Cont r ol Syst em I nvent or y r epor t usi ng t he I nvent or y Spr eadsheet l i s t ed under t hi s Sect i on at ht t p: / / www. wbdg. or g/ FFC/ NAVGRAPH/ gr apht oc. pdf document i ng al l devi ces, i ncl udi ng net wor ked devi ces, net wor k i nf r ast r uct ur e devi ces, non- net wor ked devi ces, i nput devi ces ( e. g. sensor s) and out put devi ces ( e. g. act uat or s) . For each devi ce pr ovi de al l appl i cabl e i nf or mat i on f or whi ch t her e i s a f i el d on t he spr eadsheet i n accor dance wi t h t he i nst r uct i ons on t he spr eadsheet .

I n addi t i on t o t he r equi r ement s of Sect i on 01 33 00 SUBMI TTAL PROCEDURES, pr ovi de t he Cont r ol Syst em I nvent or y Repor t as an edi t abl e Mi cr osof t Excel file.

1. 9. 4 Sof t war e Recover y and Reconst i t ut i on I mages

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o CP- 10;

CCI - 000550, CCI - 000551, CCI - 000552}

For each comput er on whi ch sof t war e i s i nst al l ed under t hi s pr oj ect , pr ovi de a r ecover y i mage of t he f i nal as- bui l t comput er . Thi s i mage must al l ow f or bar e- met al r est or e such t hat r est or at i on of t he i mage i s suf f i c i ent t o r est or e syst em oper at i on t o t he i maged st at e wi t hout t he need f or r e- i nst al l at i on of sof t war e.

I f addi t i onal user per mi ssi ons ar e r equi r ed t o meet t hi s r equi r ement , coor di nat e t he cr eat i on of t he i mage wi t h t he Gover nment .

1. 9. 5 Cyber secur i t y Ri ser Di agr am

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o PL- 2( a) ;

CCI - 003051, CCI - 003053}

Pr ovi de a cyber secur i t y r i ser di agr am of t he compl et e cont r ol syst em i ncl udi ng al l net wor k and cont r ol l er har dwar e. I f t he cont r ol syst em speci f i cat i ons r equi r e a r i ser di agr am submi t t al , pr ovi de a copy of t hat submi t t al as t he cyber secur i t y r i ser di agr am. Ot her wi se, pr ovi de a r i ser di agr am i n one- l i ne f or mat over l ayed on a f aci l i t y schemat i c.

SECTI ON 25 05 11. 00 Page 9

1. 9. 6 Cont r ol Syst em Cyber secur i t y Document at i on

Thi s subpar t ( and i t s subpar t s) r el at es t o SA- 5 ( a) , ( b) , ( c) ; CCI s:

CCI - 003124, CCI - 003125, CCI - 003126, CCI - 003127, CCI - 003128, CCI - 003129, CCI - 003130, CCI - 003131}

Pr ovi de a Cont r ol Syst em Cyber secur i t y Document at i on submi t t al cont ai ni ng t he i ndi cat ed i nf or mat i on f or each devi ce and sof t war e appl i cat i on.

1. 9. 6. 1 Sof t war e Appl i cat i ons

For al l sof t war e appl i cat i ons r unni ng on comput er s pr ovi de:

a. admi ni st r at or document at i on t hat descr i bes secur e conf i gur at i on of t he sof t war e { r el at es t o CCI - 003124}

b. admi ni st r at or document at i on t hat descr i bes secur e i nst al l at i on of t he sof t war e { r el at es t o CCI - 003125}

c. admi ni st r at or document at i on t hat descr i bes secur e oper at i on of t he sof t war e { r el at es t o CCI - 003124}

d. admi ni st r at or document at i on t hat descr i bes ef f ect i ve use and mai nt enance of secur i t y f unct i ons or mechani sms f or t he sof t war e { r el at es t o CCI - 003127}

e. admi ni st r at or document at i on t hat descr i bes known vul ner abi l i t i es r egar di ng conf i gur at i on and use of admi ni st r at i ve ( i . e. pr i v i l eged) f unct i ons f or t he sof t war e { r el at es t o CCI - 003128} f . user document at i on t hat descr i bes user - accessi bl e secur i t y f unct i ons or mechani sms i n t he sof t war e and how t o ef f ect i vel y use t hose secur i t y f unct i ons or mechani sms { r el at es t o CCI - 003129}

g. user document at i on t hat descr i bes met hods f or user i nt er act i on whi ch enabl es i ndi v i dual s t o use t he sof t war e i n a mor e secur e manner { r el at es t o CCI - 003130}

h. user document at i on t hat descr i bes user r esponsi bi l i t i es i n mai nt ai ni ng t he secur i t y of t he sof t war e { r el at es t o CCI - 003131}

1. 9. 6. 2 For HVAC Cont r ol Syst em Devi ces

1. 9. 6. 2. 1 HVAC Cont r ol Syst em Devi ces FULLY Suppor t i ng User Account s

For al l HVAC Cont r ol Syst em Devi ces whi ch FULLY suppor t user account s, provide:

a. Document at i on t hat descr i bes secur e conf i gur at i on of t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003124}

b. Document at i on t hat descr i bes secur e oper at i on of t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003124}

c. Document at i on t hat descr i bes ef f ect i ve use and mai nt enance of secur i t y f unct i ons or mechani sms f or t he devi ce { f or r ef er ence onl y: r el at es t o

CCI-003127}

d. Document at i on t hat descr i bes known vul ner abi l i t i es r egar di ng

SECTI ON 25 05 11. 00 Page 10 conf i gur at i on and use of admi ni st r at i ve ( i . e. pr i v i l eged) f unct i ons f or t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003128}

e. Document at i on t hat descr i bes user - accessi bl e secur i t y f unct i ons or mechani sms i n t he devi ce and how t o ef f ect i vel y use t hose secur i t y f unct i ons or mechani sms; or a speci f i c i ndi cat i on t hat t her e ar e no user - accessi bl e secur i t y f unct i ons or mechani sms i n t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003129} f . Document at i on t hat descr i bes met hods f or user i nt er act i on whi ch enabl es i ndi v i dual s t o use t he devi ce i n a mor e secur e manner { f or r ef er ence onl y: r el at es t o CCI - 003130}

1. 9. 6. 2. 2 Al l Ot her HVAC Cont r ol Syst em Devi ces

For al l HVAC Cont r ol Syst em Devi ces whi ch do not FULLY suppor t user account s, pr ovi de:

a. Document at i on t hat descr i bes secur e conf i gur at i on of t he devi ce; or a speci f i c i ndi cat i on t hat t her e ar e no secur e conf i gur at i on st eps t hat appl y { f or r ef er ence onl y: r el at es t o CCI - 003124}

b. Document at i on t hat descr i bes ef f ect i ve use and mai nt enance of secur i t y f unct i ons or mechani sms f or t he devi ce; or a speci f i c i ndi cat i on t hat t her e ar e no secur i t y f unct i ons or mechani sms i n t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003127}

c. For devi ces whi ch i ncl ude a user i nt er f ace, document at i on t hat descr i bes met hods f or user i nt er act i on whi ch enabl es i ndi v i dual s t o use t he devi ce i n a mor e secur e manner { f or r ef er ence onl y: r el at es t o

CCI-003130}

1. 9. 6. 3 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

For cont r ol syst em devi ces wher e Cont r ol Syst em Cyber secur i t y Document at i on r equi r ement s ar e not ot her wi se i ndi cat ed i n t hi s Sect i on, pr ovi de:

a. Document at i on t hat descr i bes secur e conf i gur at i on of t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003124}

b. Document at i on t hat descr i bes secur e i nst al l at i on of t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003125}

c. Document at i on t hat descr i bes secur e oper at i on of t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003124}

d. Document at i on t hat descr i bes ef f ect i ve use and mai nt enance of secur i t y f unct i ons or mechani sms f or t he devi ce { f or r ef er ence onl y: r el at es t o

CCI-003127}

e. Document at i on t hat descr i bes known vul ner abi l i t i es r egar di ng conf i gur at i on and use of admi ni st r at i ve ( i . e. pr i v i l eged) f unct i ons f or t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003128} f . Document at i on t hat descr i bes user - accessi bl e secur i t y f unct i ons or mechani sms i n t he devi ce and how t o ef f ect i vel y use t hose secur i t y f unct i ons or mechani sms { f or r ef er ence onl y: r el at es t o CCI - 003129}

g. Document at i on t hat descr i bes met hods f or user i nt er act i on whi ch enabl es

SECTI ON 25 05 11. 00 Page 11 i ndi v i dual s t o use t he devi ce i n a mor e secur e manner { f or r ef er ence onl y: r el at es t o CCI - 003130}

h. Document at i on t hat descr i bes user r esponsi bi l i t i es i n mai nt ai ni ng t he secur i t y of t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003131}

1. 10 SOFTWARE UPDATE LI CENSI NG

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o SI - 2 ( a) , ( c) ; CCI - 001227, CCI - 002605}

I n addi t i on t o al l ot her l i censi ng r equi r ement s, al l sof t war e l i censi ng must i ncl ude l i censi ng of t he f ol l owi ng sof t war e updat es f or a per i od of no l ess t han 5 year s:

a. Secur i t y and bug- f i x pat ches i ssued by t he sof t war e manuf act ur er .

b. Secur i t y pat ches t o addr ess any vul ner abi l i t y i dent i f i ed i n t he Nat i onal Vul ner abi l i t y Dat abase at http://nvd.nist.gov wi t h a Common Vul ner abi l i t y Scor i ng Syst em ( CVSS) sever i t y r at i ng of MEDI UM or hi gher .

Pr ovi de a s i ngl e Sof t war e Li censes submi t t al wi t h document at i on of t he sof t war e l i censes f or al l sof t war e pr ovi ded

1. 11 CYBERSECURI TY DURI NG CONSTRUCTI ON

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o AC- 18, SA- 3, CCI - 00258}

I n addi t i on t o t he cont r ol syst em cyber secur i t y r equi r ement s i ndi cat ed i n t hi s sect i on, meet f ol l owi ng r equi r ement t hr oughout t he const r uct i on process.

1. 11. 1 Cont r act or Comput er Equi pment

Cont r act or owned comput er s may be used f or const r uct i on. When used, cont r act or comput er s must meet t he f ol l owi ng r equi r ement s:

1. 11. 1. 1 Oper at i ng Syst em

The oper at i ng syst em must be an oper at i ng syst em cur r ent l y suppor t ed by t he manuf act ur er of t he oper at i ng syst em. The oper at i ng syst em must be cur r ent on secur i t y pat ches and oper at i ng syst em manuf act ur er r equi r ed updat es.

1. 11. 1. 2 Ant i - Mal war e Sof t war e

The comput er must r un ant i - mal war e sof t war e f r om a r eput abl e sof t war e manuf act ur er . Ant i - mal war e sof t war e must be a ver si on cur r ent l y suppor t ed by t he sof t war e manuf act ur er , must be cur r ent on al l pat ches and updat es, and must use t he l at est def i ni t i ons f i l e. Al l comput er s used on t hi s pr oj ect must be scanned usi ng t he i nst al l ed sof t war e at l east once per day.

1. 11. 1. 3 Passwor ds and Passphr ases

The passwor ds and passphr ases f or al l comput er s must be changed f r om t hei r def aul t val ues. Passwor ds must be a mi ni mum of ei ght char act er s wi t h a mi ni mum of one upper case l et t er , one l ower case l et t er , one number and one speci al char act er .

SECTI ON 25 05 11. 00 Page 12

1. 11. 1. 4 Cont r act or Comput er Cyber secur i t y Compl i ance St at ement s

Pr ovi de a s i ngl e submi t t al cont ai ni ng compl et ed Cont r act or Comput er Cyber secur i t y Compl i ance St at ement s f or each company usi ng cont r act or owned comput er s. Cont r act or Comput er Cyber secur i t y Compl i ance St at ement s must use t he t empl at e publ i shed at http://www.wbdg.org/FFC/NAVGRAPH/graphtoc.pdf .

Each St at ement must be s i gned by a cyber secur i t y r epr esent at i ve f or t he r el evant company.

1. 11. 2 Tempor ar y I P Net wor ks

Tempor ar y cont r act or - i nst al l ed I P net wor ks may be used dur i ng const r uct i on.

When used, t empor ar y cont r act or - i nst al l ed I P net wor ks must meet t he f ol l owi ng r equi r ement s:

1. 11. 2. 1 Net wor k Boundar i es and Connect i ons

The net wor k must not ext end out s i de t he pr oj ect s i t e and must not connect t o any I P net wor k ot her t han I P net wor ks pr ovi ded under t hi s pr oj ect or Gover nment f ur ni shed I P net wor ks pr ovi ded f or t hi s pur pose. Any and al l net wor k access f r om out si de t he pr oj ect s i t e i s pr ohi bi t ed.

1. 11. 3 Gover nment Access t o Net wor k

Gover nment per sonnel must be al l owed t o have compl et e and i mmedi at e access t o t he net wor k at any t i me i n or der t o ver i f y compl i ance wi t h t hi s specification

1. 11. 4 Tempor ar y Wi r el ess I P Net wor ks

I n addi t i on t o t he ot her r equi r ement s on t empor ar y I P net wor ks, t empor ar y wi r el ess I P ( Wi Fi ) net wor ks must not i nt er f er e wi t h exi st i ng wi r el ess net wor k and must use WPA2 secur i t y. Net wor k names ( SSI D) f or wi r el ess net wor ks must be changed f r om t hei r def aul t val ues.

1. 11. 5 Passwor ds and Passphr ases

The passwor ds and passphr ases f or al l net wor k devi ces and net wor k access must be changed f r om t hei r def aul t val ues. Passwor ds must be a mi ni mum 8 char act er s wi t h a mi ni mum of one upper case l et t er , one l ower case l et t er , one number and one speci al char act er .

1. 11. 6 Cont r act or Tempor ar y Net wor k Cyber secur i t y Compl i ance St at ement s

Pr ovi de a s i ngl e submi t t al cont ai ni ng compl et ed Cont r act or Tempor ar y Net wor k Cyber secur i t y Compl i ance St at ement s f or each company i mpl ement i ng a t empor ar y I P net wor k. Cont r act or Tempor ar y Net wor k Cyber secur i t y Compl i ance St at ement s must use t he t empl at e publ i shed at http://www.wbdg.org/FFC/NAVGRAPH/graphtoc.pdf . Each St at ement must be s i gned by a cyber secur i t y r epr esent at i ve f or t he r el evant company. I f no t empor ar y I P net wor ks wi l l be used, pr ovi de a s i ngl e copy of t he St at ement i ndi cat i ng t hi s.

1. 12 CYBERSECURI TY DURI NG WARRANTY PERI OD

Al l wor k per f or med on t he cont r ol syst em af t er accept ance must be per f or med usi ng Gover nment Fur ni shed Equi pment or equi pment speci f i cal l y and i ndi v i dual l y appr oved by t he Gover nment .

SECTI ON 25 05 11. 00 Page 13

PART 2 PRODUCTS

Not Used.

PART 3 EXECUTI ON

3. 1 ACCESS CONTROL REQUI REMENTS

3. 1. 1 User Account s

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at e t o AC- 2( a) and

AC- 3; CCI - 002110, CCI - 000213. }

Any devi ce suppor t i ng user account s ( ei t her FULLY or MI NI MALLY) must l i mi t access t o t he devi ce accor di ng t o speci f i ed l i mi t at i ons f or each account .

I nst al l and conf i gur e any devi ce havi ng a STI G or SRG i n accor dance wi t h t hat STI G or SRG.

3. 1. 1. 1 Computers

Al l comput er s must FULLY suppor t user account s.

3. 1. 1. 2 For HVAC Cont r ol Syst em Devi ces

Devi ces wi t h web i nt er f aces must ei t her FULLY suppor t user account s or have t hei r web i nt er f ace di sabl ed. Fi el d devi ces wi t h f ul l l ocal user i nt er f aces al l owi ng modi f i cat i on of dat a must at l east MI NI MALLY suppor t user account s.

3. 1. 1. 3 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

For cont r ol syst em devi ces wher e User Account r equi r ement s ar e not ot her wi se i ndi cat ed i n t hi s Sect i on:

a. Devi ces wi t h web i nt er f aces must FULLY suppor t user account s or have t hei r web i nt er f ace di sabl ed.

b. Fi el d devi ces wi t h f ul l l ocal user i nt er f aces al l owi ng modi f i cat i on of dat a must at l east MI NI MALLY suppor t user account s.

c. Fi el d devi ces wi t h r ead- onl y f ul l l ocal user i nt er f aces must at l east MI NI MALLY suppor t user account s.

d. Al l devi ces must at l east MI NI MALLY suppor t user account s.

3. 1. 2 Unsuccessf ul Logon At t empt s

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at e AC- 7 ( a) , AC- 7 ( b) ; CCI - 000043, CCI - 000044, CCI - 001423, CCI - 002236, CCI - 002237, CCI-002238}

Except f or hi gh avai l abi l i t y user i nt er f aces i ndi cat ed as exempt , devi ces must meet t he i ndi cat ed r equi r ement s f or handl i ng unsuccessf ul l ogon attempts.

3. 1. 2. 1 Devi ces MI NI MALLY Suppor t i ng Account s

Devi ces whi ch MI NI MALLY suppor t account s ar e r equi r ed t o l ock when t hr ee unsuccessf ul l ogi n at t empt s occur wi t hi n 15 mi nut e i nt er val unl ess a l i f e

SECTI ON 25 05 11. 00 Page 14 saf et y i ssue wi t l l occur .

3. 1. 2. 2 Devi ces FULLY Suppor t i ng Account s

Devi ces whi ch FULLY suppor t account s must meet t he f ol l owi ng r equi r ement s.

I f a devi ce cannot meet t hese r equi r ement s, document devi ce capabi l i t i es t o pr ot ect f r om subsequent unsuccessf ul l ogon at t empt s and pr opose al t er nat e pr ot ect i ons i n a Devi ce Account Lock Except i on Request submi t t al . Do not i mpl ement al t er nat e pr ot ect i on measur es wi t hout expl i c i t per mi ssi on f r om t he Gover nment .

a. I t must l ock t he user account when t hr ee unsuccessf ul l ogon at t empt s occur wi t hi n a 15 mi nut e i nt er val unl ess a l i f e saf et y i ssue wi l l occur .

b. Once an account i s l ocked, t he account must st ay l ocked unt i l unl ocked by an admi ni st r at or .

c. Once t he i ndi cat ed number of unsuccessf ul l ogon at t empt s occur s, del ay f ur t her l ogon pr ompt s by 5 seconds.

3. 1. 2. 3 Hi gh Avai l abi l i t y I nt er f aces Exempt f r om Unsuccessf ul Logon At t empt s Requi r ement s

Ther e ar e no hi gh avai l abi l i t y i nt er f aces whi ch ar e exempt f r om unsuccessf ul l ogon at t empt s r equi r ement s.

3. 1. 3 Syst em Use Not i f i cat i on

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o AC- 8;

CCI - 000048, CCI - 002247, CCI - 002243, CCI - 002244, CCI - 002245, CCI - 002246, CCI - 000050, CCI - 002248}

Web i nt er f aces must di spl ay a war ni ng banner meet i ng t he r equi r ement s of

DTM 08- 060.

Devi ces whi ch ar e connect ed t o a net wor k and have a user i nt er f ace must di spl ay a war ni ng banner meet i ng t he r equi r ement s of DTM 08- 060 i f capabl e of doi ng so. Devi ces whi ch ar e connect ed t o a net wor k and have a user i nt er f ace but ar e not capabl e of di spl ayi ng a banner must have a per manent l y af f i xed l abel di spl ayi ng an appr oved banner f r om DTM 08- 060.Labels must be machi ne pr i nt ed or engr aved, pl ast i c or met al , desi gned f or per manent i nst al l at i on, must use a f ont no smal l er t han 14 poi nt , and must pr ovi de a hi gh cont r act bet ween f ont and backgr ound col or s.

3. 1. 3. 1 User I nt er f ace Banner Schedul e

Pr ovi de a User I nt er f ace Schedul e usi ng t he f or mat i ndi cat ed showi ng each user i nt er f ace pr ovi ded and how t he i nf or mat i on banner r equi r ement has been i mpl ement ed f or each user i nt er f ace.

User I nt er f ace Schedul e For mat ( wi t h sampl e ent r i es)

User I nt er f ace Description

User I nt er f ace Location

Type of User Interface

Banner I mpl ement at i on

Sampl e 1 Room 1 Remote DTM 08- 060 Banner " A" Di spl ayed at Logon

SECTI ON 25 05 11. 00 Page 15

User I nt er f ace Schedul e For mat ( wi t h sampl e ent r i es)

User I nt er f ace Description

User I nt er f ace Location

Type of User Interface

Banner I mpl ement at i on

Sampl e 2 Room 2 Li mi t ed Local DTM 08- 060 Banner " B" on Af f i xed Label

Sampl e 3 Room 3 Ful l Local DTM 08- 060 Banner " B" Di spl ayed on Screen

3. 1. 4 Per mi t t ed Act i ons Wi t hout I dent i f i cat i on or Aut hent i cat i on

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o AC- 14;

CCI - 000061, CCI - 000232}

The cont r ol syst em must r equi r e i dent i f i cat i on and aut hent i cat i on bef or e al l owi ng any act i ons by a user act i ng f r om a user i nt er f ace whi ch MI NI MALLY or FULLY suppor t s account s.

3. 1. 5 Wi r el ess Access

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o AC- 18;

CCI - 001438, CCI - 001439, CCI - 002323, CCI - 001441}

Unl ess expl i c i t l y aut hor i zed by t he Gover nment , do not use any wi r el ess communi cat i on. Any devi ce wi t h wi r el ess communi cat i on capabi l i t y i s consi der ed t o be usi ng wi r el ess communi cat i on, r egar dl ess of whet her or not t he devi ce i s act i vel y communi cat i ng wi r el essl y, except when wi r el ess communi cat i on has been physi cal l y per manent l y di sabl ed ( such as t hr ough t he r emoval of t he wi r el ess t r anscei ver ) .

3. 1. 5. 1 Wi r el ess I P Communi cat i ons

Do not i nst al l wi r el ess I P net wor ks, i ncl udi ng: do not i nst al l a wi r el ess access poi nt ; do not i nst al l or conf i gur e an ad- hoc wi r el ess net wor k; do not i nst al l or conf i gur e a Wi Fi Di r ect communi cat i on.

When expl i c i t l y aut hor i zed by t he Gover nment , wi r el ess I P communi cat i on may be used t o communi cat e wi t h an exi st i ng wi r el ess net wor k.

3. 1. 5. 2 Non- I P Wi r el ess Communi cat i on

When non- I P wi r el ess communi cat i on i s expl i c i t l y aut hor i zed by t he Gover nment , use t he maxi mum l evel of encr ypt i on suppor t ed by t he speci f i c pr ot ocol empl oyed and sel ect s i gnal st r engt h and r adi at ed power t o t he mi ni mum necessar y f or r el i abl e communi cat i on.

3. 1. 5. 3 Wi r el ess Communi cat i on Request

Pr ovi de a r epor t document i ng t he pr oposed use of wi r el ess communi cat i on pr i or t o begi nni ng const r uct i on usi ng t he Wi r el ess Communi cat i on Request Schedul…