Specifications_Volume_3_-_IFC_Reception_Phase_I.PDF

Fort Jackson, South Carolina

Solicitation Number

W912HP-19-R-2000

Reception Complex Volume 3 of 5: Specification Divisions 25 - 33

PN 76149

June 2019

U.S. ARMY ENGINEER DISTRICT, SAVANNAH

CORPS OF ENGINEERS

100 WEST OGLETHORPE AVENUE

SAVANNAH, GEORGIA 31401-3640

US Army Corps of Engineers Charleston District

Recept i on Compl ex JA76149 Ft . Jackson, SC

PROJECT TABLE OF CONTENTS

DI VI SI ON 01 - GENERAL REQUI REMENTS

01 11 00 SUMMARY OF WORK

01 30 00 ADMI NI STRATI VE REQUI REMENTS

01 32 01 PROJECT SCHEDULE

01 33 00 SUBMI TTAL PROCEDURES

01 33 29 SUSTAI NABI LI TY REPORTI NG

01 35 26 GOVERNMENTAL SAFETY REQUI REMENTS

01 42 00 SOURCES FOR REFERENCE PUBLI CATI ONS

01 45 00 QUALI TY CONTROL

01 45 00. 15 RESI DENT MANAGEMENT SYSTEM CONTRACTOR MODE ( RMS CM)

01 45 35 SPECI AL I NSPECTI ONS

01 50 00 TEMPORARY CONSTRUCTI ON FACI LI TI ES AND CONTROLS

01 57 19 TEMPORARY ENVI RONMENTAL CONTROLS

01 57 19. 37 I NDOOR AI R QUALI TY ( I AQ) MANAGEMENT

01 74 19. 37 CONSTRUCTI ON AND DEMOLI TI ON WASTE MANAGEMENT

01 78 00 CLOSEOUT SUBMI TTALS

01 78 23 OPERATI ON AND MAI NTENANCE DATA

01 91 00 COMMISSIONING

DI VI SI ON 02 - EXI STI NG CONDI TI ONS

02 83 13 LEAD I N CONSTRUCTI ON

DI VI SI ON 03 - CONCRETE

03 11 13 STRUCTURAL CAST- I N- PLACE CONCRETE FORMI NG

03 15 00 CONCRETE ACCESSORI ES

03 20 00 CONCRETE REI NFORCI NG

03 30 00 CAST- I N- PLACE CONCRETE

03 35 00 CONCRETE FI NI SHI NG

03 39 00 CONCRETE CURI NG

DI VI SI ON 04 - MASONRY

04 20 00 MASONRY

DI VI SI ON 05 - METALS

05 12 00 STRUCTURAL STEEL

05 30 00 STEEL DECKS

05 40 00 COLD- FORMED METAL FRAMI NG

05 50 13 MI SCELLANEOUS METAL FABRI CATI ONS

05 51 33 METAL LADDERS

05 52 00 METAL RAI LI NGS

DI VI SI ON 06 - WOOD, PLASTI CS, AND COMPOSI TES

06 10 00 ROUGH CARPENTRY

06 20 00 FI NI SH CARPENTRY

06 41 16 LAMI NATE CLAD ARCHI TECTURAL CASEWORK

06 61 16 SOLI D POLYMER ( SOLI D SURFACI NG) FABRI CATI ONS

DI VI SI ON 07 - THERMAL AND MOI STURE PROTECTI ON

07 05 23 PRESSURE TESTI NG AN AI R BARRI ER SYSTEM FOR AI R TI GHTNESS

07 21 13 BOARD AND BLOCK I NSULATI ON

PROJECT TABLE OF CONTENTS Page 1

07 21 16 MI NERAL FI BER BLANKET I NSULATI ON

07 22 00 ROOF AND DECK I NSULATI ON

07 27 10 BUI LDI NG AI R BARRI ER SYSTEM

07 41 00 METAL SOFFI T PANELS

07 41 13 METAL ROOF PANELS

07 42 13 METAL WALL PANELS

07 60 00 FLASHI NG AND SHEET METAL

07 61 14 STEEL STANDI NG SEAM ROOFI NG

07 84 00 FIRESTOPPING

07 92 00 JOI NT SEALANTS

DI VI SI ON 08 - OPENI NGS

08 11 13 STEEL DOORS AND FRAMES

08 11 16 ALUMI NUM DOORS AND FRAMES

08 14 00 WOOD DOORS

08 34 73 SOUND CONTROL DOOR ASSEMBLI ES

08 51 13 ALUMI NUM WI NDOWS

08 71 00 DOOR HARDWARE

08 81 00 GLAZING

08 91 00 METAL WALL LOUVERS

DI VI SI ON 09 - FI NI SHES

09 06 00 SCHEDULES FOR FI NI SHES

09 22 00 SUPPORTS FOR PLASTER AND GYPSUM BOARD

09 29 00 GYPSUM BOARD

09 30 10 CERAMI C, QUARRY, AND GLASS TI LI NG

09 51 00 ACOUSTI CAL CEI LI NGS

09 65 00 RESI LI ENT FLOORI NG

09 68 00 CARPETING

09 90 00 PAI NTS AND COATI NGS

DI VI SI ON 10 - SPECI ALTI ES

10 10 00 VI SUAL COMMUNI CATI ONS SPECI ALTI ES

10 14 01 EXTERI OR SI GNAGE

10 14 02 I NTERI OR SI GNAGE

10 21 13 TOI LET COMPARTMENTS

10 26 00 WALL AND DOOR PROTECTI ON

10 28 13 TOI LET ACCESSORI ES

10 56 13 STEEL SHELVI NG

DI VI SI ON 11 - EQUI PMENT

11 13 19. 13 LOADI NG DOCK LEVELERS

11 21 73 VERTI CAL CAROUSELS

DI VI SI ON 12 - FURNI SHI NGS

12 24 13 ROLLER WI NDOW SHADES

12 48 13 ENTRANCE FLOOR MATS AND FRAMES

12 50 00 FURNI TURE AND FURNI TURE I NSTALLATI ON

DI VI SI ON 13 - SPECI AL CONSTRUCTI ON

13 34 19 METAL BUI LDI NG SYSTEMS

13 48 00 SEI SMI C BRACI NG FOR MI SCELLANEOUS EQUI PMENT

PROJECT TABLE OF CONTENTS Page 2

DI VI SI ON 21 - FI RE SUPPRESSI ON

21 13 13 WET PI PE SPRI NKLER SYSTEM, FI RE PROTECTI ON

21 30 00 FI RE PUMPS

DI VI SI ON 22 - PLUMBI NG

22 00 00 PLUMBI NG, GENERAL PURPOSE

DI VI SI ON 23 - HEATI NG, VENTI LATI NG, AND AI R CONDI TI ONI NG ( HVAC)

23 00 00 AI R SUPPLY, DI STRI BUTI ON, VENTI LATI ON, AND EXHAUST SYSTEMS

23 05 48. 19 SEI SMI C BRACI NG FOR HVAC

23 05 93 TESTI NG, ADJUSTI NG, AND BALANCI NG FOR HVAC

23 07 00 THERMAL I NSULATI ON FOR MECHANI CAL SYSTEMS

23 09 00 I NSTRUMENTATI ON AND CONTROL FOR HVAC

23 09 13 I NSTRUMENTATI ON AND CONTROL DEVI CES FOR HVAC

23 09 23. 01 LONWORKS DI RECT DI GI TAL CONTROL FOR HVAC AND OTHER

BUI LDI NG CONTROL SYSTEMS

23 11 25 FACI LI TY GAS PI PI NG

23 23 00 REFRI GERANT PI PI NG

23 25 00 CHEMI CAL TREATMENT OF WATER FOR MECHANI CAL SYSTEMS

23 52 00 HEATI NG BOI LERS

23 57 10 FORCED HOT WATER HEATI NG SYSTEMS USI NG WATER AND STEAM

HEAT EXCHANGERS

23 64 10 WATER CHI LLERS, VAPOR COMPRESSI ON TYPE

23 64 26 CHI LLED, CHI LLED- HOT, AND CONDENSER WATER PI PI NG SYSTEMS

23 81 00 DECENTRALI ZED UNI TARY HVAC EQUI PMENT

23 82 46 ELECTRI C UNI T HEATERS

DI VI SI ON 25 - I NTEGRATED AUTOMATI ON

25 05 11 CYBERSECURI TY FOR FACI LI TY- RELATED CONTROL SYSTEMS

25 05 12 CYBERSECURI TY FOR FACI LI TY- RELATED CONTROL SYSTEMS

( SPECI AL SYSTEMS)

25 05 13 CYBERSECURI TY FOR FACI LI TY- RELATED CONTROL SYSTEMS

(FA/MNS)

DI VI SI ON 26 - ELECTRI CAL

26 00 00 BASI C ELECTRI CAL MATERI ALS AND METHODS

26 05 48 SEI SMI C PROTECTI ON FOR ELECTRI CAL EQUI PMENT

26 08 00 APPARATUS I NSPECTI ON AND TESTI NG

26 20 00 I NTERI OR DI STRI BUTI ON SYSTEM

26 23 00 SWITCHBOARDS

26 28 01 COORDI NATED POWER SYSTEM PROTECTI ON

26 29 23 VARI ABLE FREQUENCY DRI VE SYSTEMS UNDER 600 VOLTS

26 41 00 LI GHTNI NG PROTECTI ON SYSTEM

26 42 14 CATHODI C PROTECTI ON SYSTEM ( SACRI FI CI AL ANODE)

26 51 00 I NTERI OR LI GHTI NG

DI VI SI ON 27 - COMMUNI CATI ONS

27 05 14 CABLE TELEVI SI ON PREMI SES DI STRI BUTI ON SYSTEM

27 10 00 BUI LDI NG TELECOMMUNI CATI ONS CABLI NG SYSTEM

27 51 16 SOUND REI NFORCEMENT SYSTEMS

DI VI SI ON 28 - ELECTRONI C SAFETY AND SECURI TY

PROJECT TABLE OF CONTENTS Page 3

28 31 76 I NTERI OR FI RE ALARM AND MASS NOTI FI CATI ON SYSTEMS

DI VI SI ON 31 - EARTHWORK

31 00 00 EARTHWORK

31 05 19 GEOTEXTILE

31 11 00 CLEARI NG AND GRUBBI NG

31 31 16. 13 CHEMI CAL TERMI TE CONTROL

31 32 11 SOI L SURFACE EROSI ON CONTROL

DI VI SI ON 32 - EXTERI OR I MPROVEMENTS

32 01 19 FI ELD MOLDED SEALANTS FOR SEALI NG JOI NTS I N RI GI D

PAVEMENTS

32 05 33 LANDSCAPE ESTABLI SHMENT

32 11 16 BASE COURSE FOR RI GI D PAVI NG

32 11 23 AGGREGATE AND/ OR GRADED- CRUSHED AGGREGATE BASE COURSE

32 12 13 BI TUMI NOUS TACK AND PRI ME COATS

32 12 16 HOT- MI X ASPHALT ( HMA) FOR ROADS

32 13 13. 06 PORTLAND CEMENT CONCRETE PAVEMENT FOR ROADS AND SI TE

FACILITIES

32 16 19 CONCRETE CURBS, GUTTERS AND SI DEWALKS

32 17 23 PAVEMENT MARKI NGS

32 32 23 SEGMENTAL CONCRETE BLOCK RETAI NI NG WALL

DI VI SI ON 33 - UTI LI TI ES

33 40 00 STORM DRAI NAGE UTI LI TI ES

33 46 16 SUBDRAI NAGE PI PI NG

33 51 15 NATURAL- GAS / LI QUI D PETROLEUM GAS DI STRI BUTI ON

33 61 13. 13 PREFABRI CATED UNDERGROUND HYDRONI C ENERGY DI STRI BUTI ON

33 61 13. 19 VALVES, PI PI NG, AND EQUI PMENT I N VALVE MANHOLES

33 63 13. 19 CONCRETE TRENCH HYDRONI C AND STEAM ENERGY DI STRI BUTI ON

33 71 02 UNDERGROUND ELECTRI CAL DI STRI BUTI ON

33 82 00 TELECOMMUNI CATI ONS OUTSI DE PLANT ( OSP)

APPENDICES

Appendi x A ACM AND HAZMAT REPORTS Appendi x B COMMI SSI ONI NG PLAN Appendi x C SPECI AL I NSPECTI ONS

- - End of Pr oj ect Tabl e of Cont ent s - -

PROJECT TABLE OF CONTENTS Page 4

SECTI ON TABLE OF CONTENTS

DI VI SI ON 25 - I NTEGRATED AUTOMATI ON

SECTI ON 25 05 11

CYBERSECURI TY FOR FACI LI TY- RELATED CONTROL SYSTEMS

11/17

PART 1 GENERAL

1. 1 CONTROL SYSTEM APPLI CABI LI TY

1. 2 RELATED REQUI REMENTS

1. 3 REFERENCES

1. 4 DEFI NI TI ONS

1. 4. 1 Comput er

1. 4. 2 Net wor k Connect ed

1. 4. 3 User Account Suppor t Level s

1. 4. 3. 1 FULLY Suppor t ed

1. 4. 3. 2 MI NI MALLY Suppor t ed

1. 4. 3. 3 NOT Suppor t ed

1. 4. 4 User I nt er f ace

1. 4. 4. 1 Li mi t ed Local User I nt er f ace

1. 4. 4. 2 Ful l Local User I nt er f ace

1. 4. 4. 3 Remot e User I nt er f ace

1. 5 ADMI NI STRATI VE REQUI REMENTS

1. 5. 1 Coor di nat i on

1. 6 SUBMI TTALS

1. 7 CYBERSECURI TY DOCUMENTATI ON

1. 7. 1 Net wor k Communi cat i on Repor t

1. 7. 2 Cont r ol Syst em I nvent or y Repor t

1. 7. 3 Sof t war e Recover y and Reconst i t ut i on I mages

1. 7. 4 Cyber secur i t y Ri ser Di agr am

1. 7. 5 Cont r ol Syst em Cyber secur i t y Document at i on

1. 7. 5. 1 Sof t war e Appl i cat i ons

1. 7. 5. 2 For HVAC Cont r ol Syst em Devi ces

1. 7. 5. 2. 1 HVAC Cont r ol Syst em Devi ces FULLY Suppor t i ng User

Accounts

1. 7. 5. 2. 2 Al l Ot her HVAC Cont r ol Syst em Devi ces

1. 7. 5. 3 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

1. 8 SOFTWARE UPDATE LI CENSI NG

1. 9 CYBERSECURI TY DURI NG CONSTRUCTI ON

1. 9. 1 Cont r act or Comput er Equi pment

1. 9. 1. 1 Oper at i ng Syst em

1. 9. 1. 2 Ant i - Mal war e Sof t war e

1. 9. 1. 3 Passwor ds and Passphr ases

1. 9. 1. 4 Cont r act or Comput er Cyber secur i t y Compl i ance St at ement s

1. 9. 2 Tempor ar y I P Net wor ks

1. 9. 2. 1 Net wor k Boundar i es and Connect i ons

1. 9. 3 Gover nment Access t o Net wor k

1. 9. 4 Tempor ar y Wi r el ess I P Net wor ks

1. 9. 5 Passwor ds and Passphr ases

1. 9. 6 Cont r act or Tempor ar y Net wor k Cyber secur i t y Compl i ance St at ement s

1. 10 CYBERSECURI TY DURI NG WARRANTY PERI OD

SECTI ON 25 05 11 Page 1

PART 2 PRODUCTS

PART 3 EXECUTI ON

3. 1 ACCESS CONTROL REQUI REMENTS

3. 1. 1 User Account s

3. 1. 1. 1 Comput er s

3. 1. 1. 2 For HVAC Cont r ol Syst em Devi ces

3. 1. 1. 3 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

3. 1. 2 Unsuccessf ul Logon At t empt s

3. 1. 2. 1 Devi ces MI NI MALLY Suppor t i ng Account s

3. 1. 2. 2 Devi ces FULLY Suppor t i ng Account s

3. 1. 2. 3 Hi gh Avai l abi l i t y I nt er f aces Exempt f r om Unsuccessf ul Logon

At t empt s Requi r ement s

3. 1. 3 Syst em Use Not i f i cat i on

3. 1. 3. 1 User I nt er f ace Banner Schedul e

3. 1. 4 Per mi t t ed Act i ons Wi t hout I dent i f i cat i on or Aut hent i cat i on

3. 1. 5 Wi r el ess Access

3. 1. 5. 1 Wi r el ess I P Communi cat i ons

3. 1. 5. 2 Non- I P Wi r el ess Communi cat i on

3. 1. 5. 3 Wi r el ess Communi cat i on Request

3. 1. 5. 4 Wi r el ess Communi cat i on Test i ng

3. 2 CYBERSECURI TY AUDI TI NG

3. 2. 1 Audi t Event s, Cont ent of Audi t Recor ds, and Audi t Gener at i on

3. 2. 1. 1 Comput er s

3. 2. 1. 1. 1 Audi t ed Event s

3. 2. 1. 1. 2 Audi t Event I nf or mat i on To Recor d

3. 2. 1. 2 For HVAC Cont r ol Syst em Devi ces

3. 2. 1. 2. 1 HVAC Cont r ol Syst em Devi ces FULLY Suppor t i ng User

Accounts

3. 2. 1. 2. 2 Ot her HVAC Cont r ol Syst em Devi ces

3. 2. 1. 3 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

3. 2. 1. 3. 1 Devi ces Whi ch FULLY Suppor t Account s

3. 2. 1. 3. 1. 1 Audi t ed Event s

3. 2. 1. 3. 1. 2 Audi t Event I nf or mat i on To Recor d

3. 2. 1. 3. 2 Devi ces Whi ch Do Not FULLY Suppor t Account s

3. 2. 2 Audi t St or age Capaci t y and Audi t Upl oad

3. 2. 3 Response t o Audi t Pr ocessi ng Fai l ur es

3. 2. 4 Ti me St amps

3. 2. 4. 1 Comput er s

3. 2. 4. 2 For HVAC Cont r ol Syst em Devi ces

3. 2. 4. 3 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

3. 3 REQUI REMENTS FOR LEAST FUNCTI ONALI TY

3. 3. 1 Non- I P Cont r ol Net wor ks

3. 3. 2 I P Cont r ol Net wor ks

3. 4 SAFE MODE AND FAI L SAFE OPERATI ON

3. 5 I DENTI FI CATI ON AND AUTHENTI CATI ON

3. 5. 1 User I dent i f i cat i on and Aut hent i cat i on

3. 5. 1. 1 HVAC Cont r ol Syst ems Devi ces

3. 5. 1. 2 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

3. 5. 2 Aut hent i cat or Management

3. 5. 2. 1 Aut hent i cat i on Type

3. 5. 2. 1. 1 For HVAC Cont r ol Syst em Devi ces

3. 5. 2. 1. 2 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

3. 5. 2. 2 Passwor d- Based Aut hent i cat i on Requi r ement s

3. 5. 2. 2. 1 Passwor ds f or Comput er s

3. 5. 2. 2. 2 Passwor ds f or Non- Comput er Devi ces FULLY Suppor t i ng

Accounts

SECTI ON 25 05 11 Page 2

3. 5. 2. 2. 3 Passwor ds f or Web I nt er f aces

3. 5. 2. 2. 4 Passwor ds f or Devi ces Mi ni mal l y Suppor t i ng Account s

3. 5. 2. 2. 5 Passwor d Conf i gur at i on and Repor t i ng

3. 5. 2. 3 Har dwar e Token- Based Aut hent i cat i on Requi r ement s

3. 5. 3 Aut hent i cat or Feedback

3. 5. 4 Devi ce I dent i f i cat i on and Aut hent i cat i on

3. 5. 4. 1 For HVAC Cont r ol Syst em Devi ces

3. 5. 4. 2 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

3. 6 FI PS 201- 2 REQUI REMENT

3. 7 DEVI CES WI TH CONNECTI ON TO MULTI PLE I P NETWORKS

3. 8 SYSTEM AND I NTEGRATI ON I NTEGRI TY

3. 8. 1 Mal i c i ous Code Pr ot ect i on

3. 9 FI ELD QUALI TY CONTROL

3. 9. 1 Test s

- - End of Sect i on Tabl e of Cont ent s - -

SECTI ON 25 05 11 Page 3

SECTI ON 25 05 11

CYBERSECURI TY FOR FACI LI TY- RELATED CONTROL SYSTEMS

11/17

PART 1 GENERAL

Many subpar t s i n t hi s Sect i on cont ai n t ext i n cur l y br aces ( " { " and " } " ) i ndi cat i ng whi ch cyber secur i t y cont r ol and cont r ol cor r el at i on i dent i f i er ( CCI ) t he r equi r ement s of t he subpar t r el at e t o. The t ext i nsi de t hese cur l y br aces i s f or Gover nment r ef er ence onl y, and enabl es coor di nat i on of t he r equi r ement s of t hi s Sect i on wi t h t he RMF pr ocess t hr oughout t he desi gn and const r uct i on pr ocess. Text i n cur l y br aces ar e not cont r act or requirements.

Thi s Sect i on r ef er s t o Secur i t y Requi r ement s Gui de ( SRGs) and Secur i t y Techni cal I mpl ement at i on Gui de ( STI Gs) . STI Gs and SRGs ar e ar e avai l abl e onl i ne at t he I nf or mat i on Assur ance Suppor t Envi r onment ( I ASE) websi t e at http://iase.disa.mil/stigs/Pages/index.aspx . Not al l cont r ol syst em component s have appl i cabl e STI Gs or SRGs.

1. 1 CONTROL SYSTEM APPLI CABI LI TY

Ther e ar e mul t i pl e ver si ons of t hi s Sect i on associ at ed wi t h t hi s pr oj ect .

Di f f er ent ver si ons have r equi r ement s appl i cabl e t o di f f er ent cont r ol syst ems. Thi s speci f i c Sect i on appl i es onl y t o t he f ol l owi ng cont r ol systems: HVAC Cont r ol s f or CI I P. .

1. 2 RELATED REQUI REMENTS

Al l Sect i ons cont ai ni ng f aci l i t y- r el at ed cont r ol syst ems or cont r ol syst em component s ar e r el at ed t o t he r equi r ement s of t hi s Sect i on. Revi ew al l speci f i cat i on sect i ons t o det er mi ne r el at ed r equi r ement s.

1. 3 REFERENCES

The publ i cat i ons l i s t ed bel ow f or m a par t of t hi s speci f i cat i on t o t he ext ent r ef er enced. The publ i cat i ons ar e r ef er r ed t o wi t hi n t he t ext by t he basi c desi gnat i on onl y.

I NSTI TUTE OF ELECTRI CAL AND ELECTRONI CS ENGI NEERS ( I EEE)

I EEE 802. 1x ( 2010) Local and Met r opol i t an Ar ea Net wor ks - Por t Based Net wor k Access Control

NATI ONAL I NSTI TUTE OF STANDARDS AND TECHNOLOGY ( NI ST)

NI ST FI PS 201- 2 ( 2013) Per sonal I dent i t y Ver i f i cat i on ( PI V) of Feder al Empl oyees and Cont r act or s

SECTI ON 25 05 11 Page 4

U. S. DEPARTMENT OF DEFENSE ( DOD)

DODI 8551. 01 ( 2014) Por t s, Pr ot ocol s, and Ser vi ces Management ( PPSM)

DTM 08- 060 ( 2008) Pol i cy on Use of Depar t ment of Def ense ( DoD) I nf or mat i on Syst ems - St andar d Consent Banner and User Agr eement

1. 4 DEFINITIONS

1. 4. 1 Computer

As used i n t hi s Sect i on, a comput er i s one of t he f ol l owi ng:

a. a devi ce r unni ng a non- embedded deskt op or ser ver ver si on of Mi cr osof t Windows

b. a devi ce r unni ng a non- embedded ver si on of MacOS

c. a devi ce r unni ng a non- embedded ver si on of Li nux

d. a devi ce r unni ng a ver si on or der i vat i ve of t he Andr oi d OS, wher e Andr oi d i s consi der ed separ at e f r om Li nux

e. a devi ce r unni ng a ver si on of Appl e i OS

1. 4. 2 Net wor k Connect ed

A component i s net wor k connect ed ( or " connect ed t o a net wor k" ) onl y when t he devi ce has a net wor k t r anscei ver whi ch i s di r ect l y connect ed t o t he net wor k and i mpl ement s t he net wor k pr ot ocol . A devi ce l acki ng a net wor k t r anscei ver ( and accompanyi ng pr ot ocol i mpl ement at i on) can never be consi der ed net wor k connect ed. Not e t hat a devi ce connect ed t o a non- I P net wor k i s st i l l consi der ed net wor k connect ed ( an I P connect i on or I P addr ess i s not r equi r ed f or a devi ce t o be net wor k connect ed) .

Any devi ce t hat suppor t s wi r el ess communi cat i on i s net wor k connect ed, r egar dl ess of whet her t he devi ce i s communi cat i ng usi ng wi r el ess.

1. 4. 3 User Account Suppor t Level s

The suppor t f or user account s i s cat egor i zed i n t hi s Sect i on as one of t hr ee l evel s:

1. 4. 3. 1 FULLY Suppor t ed

Devi ce suppor t s conf i gur abl e i ndi v i dual account s. Account s can be cr eat ed, del et ed, modi f i ed, et c. Pr i v i l eges can be assi gned t o account s.

1. 4. 3. 2 MI NI MALLY Suppor t ed

Devi ce suppor t s a smal l , f i xed number of account s ( per haps onl y one) .

Account s cannot be modi f i ed. A devi ce wi t h onl y a " User " and an " Admi ni st r at or " account woul d f i t t hi s cat egor y. Si mi l ar l y, a devi ce wi t h t wo PI Ns f or l ogon - one f or r est r i c t ed and one f or unr est r i c t ed r i ght s woul d f i t her e ( i n ot her wor ds, t he account s do not have t o be t he t r adi t i onal " user name and passwor d" st r uct ur e) .

SECTI ON 25 05 11 Page 5

1. 4. 3. 3 NOT Suppor t ed

Devi ce does not suppor t any Access Enf or cement t her ef or e t he whol e concept of " account " i s meani ngl ess.

1. 4. 4 User I nt er f ace

Gener al l y, a user i nt er f ace i s har dwar e on a devi ce al l owi ng user i nt er act i on wi t h t hat devi ce v i a i nput ( but t ons, swi t ches, s l i der s, keyboar d, t ouch scr een, et c. ) and a scr een. Ther e ar e t hr ee t ypes of user i nt er f aces def i ned i n t hi s Sect i on: Li mi t ed Local User I nt er f ace, Ful l Local User I nt er f ace and Remot e User I nt er f ace. I n t hi s Sect i on, when t he t er m " User I nt er f ace" i s used wi t hout speci f y i ng whi ch t ype, i t r ef er s onl y t o Ful l Local User I nt er f ace and Remot e User I nt er f ace ( NOT t o Li mi t ed Local User I nt er f ace) .

1. 4. 4. 1 Li mi t ed Local User I nt er f ace

A Li mi t ed Local User I nt er f ace i s a user i nt er f ace wher e t he i nt er act i on i s l i mi t ed, f i xed at t he f act or y, and cannot be modi f i ed i n t he f i el d. The user must be physi cal l y at t he devi ce t o i nt er act wi t h i t .

Exampl es of Li mi t ed Local User I nt er f ace i ncl ude t her most at s ( Space Sensor Modul es as def i ned i n Sect i on 23 09 13 I NSTRUMENTATI ON AND CONTROL DEVI CES

FOR HVAC) .

1. 4. 4. 2 Ful l Local User I nt er f ace

A Ful l Local User I nt er f ace i s a user i nt er f ace wher e t he i nt er act i on and di spl ays ar e f i el d- conf i gur abl e.

Exampl es of a Ful l Local User I nt er f ace i ncl ude l ocal appl i cat i ons on a computer and user i nt er f aces t o Var i abl e Speed Dr i ves.

1. 4. 4. 3 Remot e User I nt er f ace

A Remot e User I nt er f ace i s a user i nt er f ace on a Cl i ent devi ce al l owi ng user i nt er act i on wi t h a di f f er ent Ser ver devi ce. The user need not be physi cal l y at t he Ser ver devi ce t o i nt er act wi t h i t .

Exampl es of Remot e User I nt er f aces i ncl ude web br owser s and Local Di spl ay Panel s as def i ned i n Sect i on 23 09 00 I NSTRUMENTATI ON AND CONTROL FOR HVAC.

1. 5 ADMI NI STRATI VE REQUI REMENTS

1. 5. 1 Coordination

Coor di nat e t he execut i on of t hi s Sect i on wi t h t he execut i on of al l ot her Sect i ons r el at ed t o cont r ol syst ems as i ndi cat ed i n t he par agr aph RELATED REQUI REMENTS. I t ems t hat must be consi der ed when coor di nat i ng pr oj ect ef f or t s i ncl ude but ar e not l i mi t ed t o:

a. I f r equest i ng per mi ssi on f or wi r el ess communi cat i on, t he Wi r el ess Communi cat i on Request submi t t al must be appr oved pr i or t o cont r ol syst em devi ce sel ect i on and i nt egr at i on.

b. I f r equest i ng per mi ssi on f or al t er nat e account l ock per mi ssi ons, t he Devi ce Account Lock Except i on Request must be appr oved pr i or t o cont r ol syst em devi ce sel ect i on and i nt egr at i on.

SECTI ON 25 05 11 Page 6

c. I f r equest i ng per mi ssi on f or t he use of a devi ce wi t h mul t i pl e I P connect i ons, t he Mul t i pl e I P Connect i on Devi ce Request must be appr oved pr i or t o cont r ol syst em devi ce sel ect i on and i nt egr at i on.

d. Wi r el ess t est i ng may be r equi r ed as par t of t he cont r ol syst em t est i ng. See r equi r ement s f or t he Wi r el ess Communi cat i on Test Repor t submittal.

e. I f t he Devi ce Audi t Recor d Upl oad Sof t war e i s t o be i nst al l ed on a comput er not bei ng pr ovi ded as par t of t he cont r ol syst em, coor di nat i on i s r equi r ed t o i dent i f y t he comput er on whi ch t o i nst al l t he sof t war e.

f . Cyber secur i t y I nt er connect i on Schedul e must be coor di nat ed wi t h ot her wor k t hat wi l l be i nt er connect ed t o, and i nt er connect i ons must be appr oved by t he Gover nment bef or e r el y i ng on t hem f or syst em functionality.

g. Cyber secur i t y t est i ng suppor t must be coor di nat ed acr oss cont r ol syst ems and wi t h t he Gover nment cyber secur i t y t est i ng schedul e.

h. Passwor ds must be coor di nat ed wi t h t he i ndi cat ed cont act f or t he pr oj ect s i t e.

i . I f appl i cabl e, HTTP web ser ver cer t i f i cat es must be obt ai ned f r om t he i ndi cat ed cont act f or t he pr oj ect s i t e.

j . Cont r act or Comput er Cyber secur i t y Compl i ance St at ement s f or each cont r act or usi ng cont r act or owned comput er s.

1. 6 SUBMITTALS

Gover nment appr oval i s r equi r ed f or submi t t al s wi t h a " G" desi gnat i on;

submi t t al s not havi ng a " G" desi gnat i on ar e f or i nf or mat i on onl y. When used, a desi gnat i on f ol l owi ng t he " G" desi gnat i on i dent i f i es t he of f i ce t hat wi l l r evi ew t he submi t t al f or t he Gover nment . Submi t t al s wi t h an " S" ar e f or i ncl usi on i n t he Sust ai nabi l i t y eNot ebook, i n conf or mance wi t h Section 01 33 29 SUSTAI NABI LI TY REPORTI NG. Submi t t he f ol l owi ng i n accor dance wi t h Sect i on 01 33 00 SUBMI TTAL PROCEDURES:

SD- 01 Pr econst r uct i on Submi t t al s

Wi r el ess Communi cat i on Request ; G, RO

Devi ce Account Lock Except i on Request ; G, RO

Mul t i pl e I P Connect i on Devi ce Request ; G, RO

Cont r act or Comput er Cyber secur i t y Compl i ance St at ement s; G, RO

Cont r act or Tempor ar y Net wor k Cyber secur i t y Compl i ance St at ement s; G, RO

SD- 02 Shop Dr awi ngs

User I nt er f ace Banner Schedul e; G, RO

Net wor k Communi cat i on Repor t ; G, RO

SECTI ON 25 05 11 Page 7

Cyber secur i t y Ri ser Di agr am; G, RO

Cont r ol Syst em I nvent or y Repor t ; G, RO

SD- 03 Pr oduct Dat a

Cont r ol Syst em Cyber secur i t y Document at i on; G, RO

SD- 06 Test Repor t s

Wi r el ess Communi cat i on Test Repor t ; G, RO

SD- 07 Cer t i f i cat es

Sof t war e Li censes; G, RO

SD- 11 Cl oseout Submi t t al s

Passwor d Summar y Repor t ; G, RO

Sof t war e Recover y And Reconst i t ut i on I mages; G, RO

1. 7 CYBERSECURI TY DOCUMENTATI ON

1. 7. 1 Net wor k Communi cat i on Repor t

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o CA- 9;

CCI - 002102, CCI - 002103, CCI - 002104, CCI - 002105 and al so t he submi t t al r equi r ement s associ at ed wi t h CM- 6, CM- 7 and SC- 41}

Pr ovi de a net wor k communi cat i on r epor t . For each net wor ked cont r ol l er , document t he communi cat i on char act er i st i cs of t he cont r ol l er i ncl udi ng communi cat i on pr ot ocol s, ser vi ces used, and a gener al descr i pt i on of what i nf or mat i on i s communi cat ed over t he net wor k. For each cont r ol l er usi ng I P, document al l TCP and UDP por t s used. I f ot her cont r ol syst em Sect i ons used on t hi s pr oj ect i ncl ude submi t t al s document i ng t hi s i nf or mat i on, pr ovi de copi es of t hose submi t t al s t o meet t hi s r equi r ement .

I n addi t i on t o t he r equi r ement s of Sect i on 01 33 00 SUBMI TTAL PROCEDURES, pr ovi de t he Net wor k Communi cat i on Repor t as an edi t abl e Mi cr osof t Excel file.

1. 7. 2 Cont r ol Syst em I nvent or y Repor t

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o CM- 8( a) , CP- 12, SI - 17, I A- 3; CCI - 000389, CCI - 000392, CCI - 000398, CCI - 002855, CCI - 002856, CCI - 002857, CCI - 002773, CCI - 002774, CCI - 002775, CCI - 000777, CCI - 000778, CCI - 001958}

Pr ovi de a Cont r ol Syst em I nvent or y r epor t usi ng t he I nvent or y Spr eadsheet l i s t ed under t hi s Sect i on at ht t p: / / www. wbdg. or g/ FFC/ NAVGRAPH/ gr apht oc. pdf document i ng al l devi ces, i ncl udi ng net wor ked devi ces, net wor k i nf r ast r uct ur e devi ces, non- net wor ked devi ces, i nput devi ces ( e. g. sensor s) and out put devi ces ( e. g. act uat or s) . For each devi ce pr ovi de al l appl i cabl e i nf or mat i on f or whi ch t her e i s a f i el d on t he spr eadsheet i n accor dance wi t h t he i nst r uct i ons on t he spr eadsheet .

SECTI ON 25 05 11 Page 8

I n addi t i on t o t he r equi r ement s of Sect i on 01 33 00 SUBMI TTAL PROCEDURES, pr ovi de t he Cont r ol Syst em I nvent or y Repor t as an edi t abl e Mi cr osof t Excel file.

1. 7. 3 Sof t war e Recover y and Reconst i t ut i on I mages

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o CP- 10;

CCI - 000550, CCI - 000551, CCI - 000552}

For each comput er on whi ch sof t war e i s i nst al l ed under t hi s pr oj ect , pr ovi de a r ecover y i mage of t he f i nal as- bui l t comput er . Thi s i mage must al l ow f or bar e- met al r est or e such t hat r est or at i on of t he i mage i s suf f i c i ent t o r est or e syst em oper at i on t o t he i maged st at e wi t hout t he need f or r e- i nst al l at i on of sof t war e.

1. 7. 4 Cyber secur i t y Ri ser Di agr am

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o PL- 2( a) ;

CCI - 003051, CCI - 003053}

Pr ovi de a cyber secur i t y r i ser di agr am of t he compl et e cont r ol syst em i ncl udi ng al l net wor k and cont r ol l er har dwar e. I f t he cont r ol syst em speci f i cat i ons r equi r e a r i ser di agr am submi t t al , pr ovi de a copy of t hat submi t t al as t he cyber secur i t y r i ser di agr am. Ot her wi se, pr ovi de a r i ser di agr am i n one- l i ne f or mat over l ayed on a f aci l i t y schemat i c.

1. 7. 5 Cont r ol Syst em Cyber secur i t y Document at i on

Thi s subpar t ( and i t s subpar t s) r el at es t o SA- 5 ( a) , ( b) , ( c) ; CCI s:

CCI - 003124, CCI - 003125, CCI - 003126, CCI - 003127, CCI - 003128, CCI - 003129, CCI - 003130, CCI - 003131}

Pr ovi de a Cont r ol Syst em Cyber secur i t y Document at i on submi t t al cont ai ni ng t he i ndi cat ed i nf or mat i on f or each devi ce and sof t war e appl i cat i on.

1. 7. 5. 1 Sof t war e Appl i cat i ons

For al l sof t war e appl i cat i ons r unni ng on comput er s pr ovi de:

a. admi ni st r at or document at i on t hat descr i bes secur e conf i gur at i on of t he sof t war e { r el at es t o CCI - 003124}

b. admi ni st r at or document at i on t hat descr i bes secur e i nst al l at i on of t he sof t war e { r el at es t o CCI - 003125}

c. admi ni st r at or document at i on t hat descr i bes secur e oper at i on of t he sof t war e { r el at es t o CCI - 003124}

d. admi ni st r at or document at i on t hat descr i bes ef f ect i ve use and mai nt enance of secur i t y f unct i ons or mechani sms f or t he sof t war e { r el at es t o CCI - 003127}

e. admi ni st r at or document at i on t hat descr i bes known vul ner abi l i t i es r egar di ng conf i gur at i on and use of admi ni st r at i ve ( i . e. pr i v i l eged) f unct i ons f or t he sof t war e { r el at es t o CCI - 003128} f . user document at i on t hat descr i bes user - accessi bl e secur i t y f unct i ons or

SECTI ON 25 05 11 Page 9 mechani sms i n t he sof t war e and how t o ef f ect i vel y use t hose secur i t y f unct i ons or mechani sms { r el at es t o CCI - 003129}

g. user document at i on t hat descr i bes met hods f or user i nt er act i on whi ch enabl es i ndi v i dual s t o use t he sof t war e i n a mor e secur e manner { r el at es t o CCI - 003130}

h. user document at i on t hat descr i bes user r esponsi bi l i t i es i n mai nt ai ni ng t he secur i t y of t he sof t war e { r el at es t o CCI - 003131}

1. 7. 5. 2 For HVAC Cont r ol Syst em Devi ces

1. 7. 5. 2. 1 HVAC Cont r ol Syst em Devi ces FULLY Suppor t i ng User Account s

For al l HVAC Cont r ol Syst em Devi ces whi ch FULLY suppor t user account s, provide:

a. Document at i on t hat descr i bes secur e conf i gur at i on of t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003124}

b. Document at i on t hat descr i bes secur e oper at i on of t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003124}

c. Document at i on t hat descr i bes ef f ect i ve use and mai nt enance of secur i t y f unct i ons or mechani sms f or t he devi ce { f or r ef er ence onl y: r el at es t o

CCI-003127}

d. Document at i on t hat descr i bes known vul ner abi l i t i es r egar di ng conf i gur at i on and use of admi ni st r at i ve ( i . e. pr i v i l eged) f unct i ons f or t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003128}

e. Document at i on t hat descr i bes user - accessi bl e secur i t y f unct i ons or mechani sms i n t he devi ce and how t o ef f ect i vel y use t hose secur i t y f unct i ons or mechani sms; or a speci f i c i ndi cat i on t hat t her e ar e no user - accessi bl e secur i t y f unct i ons or mechani sms i n t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003129} f . Document at i on t hat descr i bes met hods f or user i nt er act i on whi ch enabl es i ndi v i dual s t o use t he devi ce i n a mor e secur e manner { f or r ef er ence onl y: r el at es t o CCI - 003130}

1. 7. 5. 2. 2 Al l Ot her HVAC Cont r ol Syst em Devi ces

For al l HVAC Cont r ol Syst em Devi ces whi ch do not FULLY suppor t user account s, pr ovi de:

a. Document at i on t hat descr i bes secur e conf i gur at i on of t he devi ce; or a speci f i c i ndi cat i on t hat t her e ar e no secur e conf i gur at i on st eps t hat appl y { f or r ef er ence onl y: r el at es t o CCI - 003124}

b. Document at i on t hat descr i bes ef f ect i ve use and mai nt enance of secur i t y f unct i ons or mechani sms f or t he devi ce; or a speci f i c i ndi cat i on t hat t her e ar e no secur i t y f unct i ons or mechani sms i n t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003127}

c. For devi ces whi ch i ncl ude a user i nt er f ace, document at i on t hat descr i bes met hods f or user i nt er act i on whi ch enabl es i ndi v i dual s t o use t he devi ce i n a mor e secur e manner { f or r ef er ence onl y: r el at es t o

CCI-003130}

SECTI ON 25 05 11 Page 10

1. 7. 5. 3 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

For cont r ol syst em devi ces wher e Cont r ol Syst em Cyber secur i t y Document at i on r equi r ement s ar e not ot her wi se i ndi cat ed i n t hi s Sect i on, pr ovi de:

a. Document at i on t hat descr i bes secur e conf i gur at i on of t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003124}

b. Document at i on t hat descr i bes secur e i nst al l at i on of t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003125}

c. Document at i on t hat descr i bes secur e oper at i on of t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003124}

d. Document at i on t hat descr i bes ef f ect i ve use and mai nt enance of secur i t y f unct i ons or mechani sms f or t he devi ce { f or r ef er ence onl y: r el at es t o

CCI-003127}

e. Document at i on t hat descr i bes known vul ner abi l i t i es r egar di ng conf i gur at i on and use of admi ni st r at i ve ( i . e. pr i v i l eged) f unct i ons f or t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003128} f . Document at i on t hat descr i bes user - accessi bl e secur i t y f unct i ons or mechani sms i n t he devi ce and how t o ef f ect i vel y use t hose secur i t y f unct i ons or mechani sms { f or r ef er ence onl y: r el at es t o CCI - 003129}

g. Document at i on t hat descr i bes met hods f or user i nt er act i on whi ch enabl es i ndi v i dual s t o use t he devi ce i n a mor e secur e manner { f or r ef er ence onl y: r el at es t o CCI - 003130}

h. Document at i on t hat descr i bes user r esponsi bi l i t i es i n mai nt ai ni ng t he secur i t y of t he devi ce { f or r ef er ence onl y: r el at es t o CCI - 003131}

1. 8 SOFTWARE UPDATE LI CENSI NG

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o SI - 2 ( a) , ( c) ; CCI - 001227, CCI - 002605}

I n addi t i on t o al l ot her l i censi ng r equi r ement s, al l sof t war e l i censi ng must i ncl ude l i censi ng of t he f ol l owi ng sof t war e updat es f or a per i od of no l ess t han 5 year s:

a. Secur i t y and bug- f i x pat ches i ssued by t he sof t war e manuf act ur er .

b. Secur i t y pat ches t o addr ess any vul ner abi l i t y i dent i f i ed i n t he Nat i onal Vul ner abi l i t y Dat abase at http://nvd.nist.gov wi t h a Common Vul ner abi l i t y Scor i ng Syst em ( CVSS) sever i t y r at i ng of MEDI UM or hi gher .

Pr ovi de a s i ngl e Sof t war e Li censes submi t t al wi t h document at i on of t he sof t war e l i censes f or al l sof t war e pr ovi ded

1. 9 CYBERSECURI TY DURI NG CONSTRUCTI ON

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o AC- 18, SA- 3, CCI - 00258}

SECTI ON 25 05 11 Page 11

I n addi t i on t o t he cont r ol syst em cyber secur i t y r equi r ement s i ndi cat ed i n t hi s sect i on, meet f ol l owi ng r equi r ement t hr oughout t he const r uct i on process.

1. 9. 1 Cont r act or Comput er Equi pment

Cont r act or owned comput er s may be used f or const r uct i on. When used, cont r act or comput er s must meet t he f ol l owi ng r equi r ement s:

1. 9. 1. 1 Oper at i ng Syst em

The oper at i ng syst em must be an oper at i ng syst em cur r ent l y suppor t ed by t he manuf act ur er of t he oper at i ng syst em. The oper at i ng syst em must be cur r ent on secur i t y pat ches and oper at i ng syst em manuf act ur er r equi r ed updat es.

1. 9. 1. 2 Ant i - Mal war e Sof t war e

The comput er must r un ant i - mal war e sof t war e f r om a r eput abl e sof t war e manuf act ur er . Ant i - mal war e sof t war e must be a ver si on cur r ent l y suppor t ed by t he sof t war e manuf act ur er , must be cur r ent on al l pat ches and updat es, and must use t he l at est def i ni t i ons f i l e. Al l comput er s used on t hi s pr oj ect must be scanned usi ng t he i nst al l ed sof t war e at l east once per day.

1. 9. 1. 3 Passwor ds and Passphr ases

The passwor ds and passphr ases f or al l comput er s must be changed f r om t hei r def aul t val ues. Passwor ds must be a mi ni mum of ei ght char act er s wi t h a mi ni mum of one upper case l et t er , one l ower case l et t er , one number and one speci al char act er .

1. 9. 1. 4 Cont r act or Comput er Cyber secur i t y Compl i ance St at ement s

Pr ovi de a s i ngl e submi t t al cont ai ni ng compl et ed Cont r act or Comput er Cyber secur i t y Compl i ance St at ement s f or each company usi ng cont r act or owned comput er s. Cont r act or Comput er Cyber secur i t y Compl i ance St at ement s must use t he t empl at e publ i shed at http://www.wbdg.org/FFC/NAVGRAPH/graphtoc.pdf .

Each St at ement must be s i gned by a cyber secur i t y r epr esent at i ve f or t he r el evant company.

1. 9. 2 Tempor ar y I P Net wor ks

Tempor ar y cont r act or - i nst al l ed I P net wor ks may be used dur i ng const r uct i on.

When used, t empor ar y cont r act or - i nst al l ed I P net wor ks must meet t he f ol l owi ng r equi r ement s:

1. 9. 2. 1 Net wor k Boundar i es and Connect i ons

The net wor k must not ext end out s i de t he pr oj ect s i t e and must not connect t o any I P net wor k ot her t han I P net wor ks pr ovi ded under t hi s pr oj ect or Gover nment f ur ni shed I P net wor ks pr ovi ded f or t hi s pur pose. Any and al l net wor k access f r om out si de t he pr oj ect s i t e i s pr ohi bi t ed.

1. 9. 3 Gover nment Access t o Net wor k

Gover nment per sonnel must be al l owed t o have compl et e and i mmedi at e access t o t he net wor k at any t i me i n or der t o ver i f y compl i ance wi t h t hi s specification

SECTI ON 25 05 11 Page 12

1. 9. 4 Tempor ar y Wi r el ess I P Net wor ks

I n addi t i on t o t he ot her r equi r ement s on t empor ar y I P net wor ks, t empor ar y wi r el ess I P ( Wi Fi ) net wor ks must not i nt er f er e wi t h exi st i ng wi r el ess net wor k and must use WPA2 secur i t y. Net wor k names ( SSI D) f or wi r el ess net wor ks must be changed f r om t hei r def aul t val ues.

1. 9. 5 Passwor ds and Passphr ases

The passwor ds and passphr ases f or al l net wor k devi ces and net wor k access must be changed f r om t hei r def aul t val ues. Passwor ds must be a mi ni mum 8 char act er s wi t h a mi ni mum of one upper case l et t er , one l ower case l et t er , one number and one speci al char act er .

1. 9. 6 Cont r act or Tempor ar y Net wor k Cyber secur i t y Compl i ance St at ement s

Pr ovi de a s i ngl e submi t t al cont ai ni ng compl et ed Cont r act or Tempor ar y Net wor k Cyber secur i t y Compl i ance St at ement s f or each company i mpl ement i ng a t empor ar y I P net wor k. Cont r act or Tempor ar y Net wor k Cyber secur i t y Compl i ance St at ement s must use t he t empl at e publ i shed at http://www.wbdg.org/FFC/NAVGRAPH/graphtoc.pdf . Each St at ement must be s i gned by a cyber secur i t y r epr esent at i ve f or t he r el evant company. I f no t empor ar y I P net wor ks wi l l be used, pr ovi de a s i ngl e copy of t he St at ement i ndi cat i ng t hi s.

1. 10 CYBERSECURI TY DURI NG WARRANTY PERI OD

Al l wor k per f or med on t he cont r ol syst em af t er accept ance must be per f or med usi ng Gover nment Fur ni shed Equi pment or equi pment speci f i cal l y and i ndi v i dual l y appr oved by t he Gover nment .

PART 2 PRODUCTS

( NOT USED)

PART 3 EXECUTI ON

3. 1 ACCESS CONTROL REQUI REMENTS

3. 1. 1 User Account s

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at e t o AC- 2( a) and

AC- 3; CCI - 002110, CCI - 000213. }

Any devi ce suppor t i ng user account s ( ei t her FULLY or MI NI MALLY) must l i mi t access t o t he devi ce accor di ng t o speci f i ed l i mi t at i ons f or each account .

I nst al l and conf i gur e any devi ce havi ng a STI G or SRG i n accor dance wi t h t hat STI G or SRG.

3. 1. 1. 1 Computers

Al l comput er s must FULLY suppor t user account s.

3. 1. 1. 2 For HVAC Cont r ol Syst em Devi ces

Devi ces wi t h web i nt er f aces must ei t her FULLY suppor t user account s or have t hei r web i nt er f ace di sabl ed. Fi el d devi ces wi t h f ul l l ocal user i nt er f aces al l owi ng modi f i cat i on of dat a must at l east MI NI MALLY suppor t user account s.

SECTI ON 25 05 11 Page 13

3. 1. 1. 3 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

For cont r ol syst em devi ces wher e User Account r equi r ement s ar e not ot her wi se i ndi cat ed i n t hi s Sect i on:

a. Devi ces wi t h web i nt er f aces must ei t her at l east MI NI MALLY suppor t user account s or have t hei r web i nt er f ace di sabl ed.

b. Fi el d devi ces wi t h f ul l l ocal user i nt er f aces al l owi ng modi f i cat i on of dat a must at l east MI NI MALLY suppor t user account s.

3. 1. 2 Unsuccessf ul Logon At t empt s

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at e AC- 7 ( a) , AC- 7 ( b) ; CCI - 000043, CCI - 000044, CCI - 001423, CCI - 002236, CCI - 002237, CCI-002238}

Except f or hi gh avai l abi l i t y user i nt er f aces i ndi cat ed as exempt , devi ces must meet t he i ndi cat ed r equi r ement s f or handl i ng unsuccessf ul l ogon attempts.

3. 1. 2. 1 Devi ces MI NI MALLY Suppor t i ng Account s

Devi ces whi ch MI NI MALLY suppor t account s ar e not r equi r ed t o l ock based on unsuccessf ul l ogon at t empt s.

3. 1. 2. 2 Devi ces FULLY Suppor t i ng Account s

Devi ces whi ch FULLY suppor t account s must meet t he f ol l owi ng r equi r ement s.

I f a devi ce cannot meet t hese r equi r ement s, document devi ce capabi l i t i es t o pr ot ect f r om subsequent unsuccessf ul l ogon at t empt s and pr opose al t er nat e pr ot ect i ons i n a Devi ce Account Lock Except i on Request submi t t al . Do not i mpl ement al t er nat e pr ot ect i on measur es wi t hout expl i c i t per mi ssi on f r om t he Gover nment .

a. I t must l ock t he user account when t hr ee unsuccessf ul l ogon at t empt s occur wi t hi n a 15 mi nut e i nt er val .

b. Once an account i s l ocked, t he account must st ay l ocked unt i l unl ocked by an admi ni st r at or .

c. Once t he i ndi cat ed number of unsuccessf ul l ogon at t empt s occur s, del ay f ur t her l ogon pr ompt s by 5 seconds.

3. 1. 2. 3 Hi gh Avai l abi l i t y I nt er f aces Exempt f r om Unsuccessf ul Logon At t empt s Requi r ement s

Ther e ar e no hi gh avai l abi l i t y i nt er f aces whi ch ar e exempt f r om unsuccessf ul l ogon at t empt s r equi r ement s.

3. 1. 3 Syst em Use Not i f i cat i on

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o AC- 8;

CCI - 000048, CCI - 002247, CCI - 002243, CCI - 002244, CCI - 002245, CCI - 002246, CCI - 000050, CCI - 002248}

Web i nt er f aces must di spl ay a war ni ng banner meet i ng t he r equi r ement s of

SECTI ON 25 05 11 Page 14

DTM 08- 060.

Devi ces whi ch ar e connect ed t o a net wor k and have a user i nt er f ace must di spl ay a war ni ng banner meet i ng t he r equi r ement s of DTM 08- 060 i f capabl e of doi ng so. Devi ces whi ch ar e connect ed t o a net wor k and have a user i nt er f ace but ar e not capabl e of di spl ayi ng a banner must have a per manent l y af f i xed l abel di spl ayi ng an appr oved banner f r om DTM 08- 060.Labels must be machi ne pr i nt ed or engr aved, pl ast i c or met al , desi gned f or per manent i nst al l at i on, must use a f ont no smal l er t han 14 poi nt , and must pr ovi de a hi gh cont r act bet ween f ont and backgr ound col or s.

3. 1. 3. 1 User I nt er f ace Banner Schedul e

Pr ovi de a User I nt er f ace Schedul e usi ng t he f or mat i ndi cat ed showi ng each user i nt er f ace pr ovi ded and how t he i nf or mat i on banner r equi r ement has been i mpl ement ed f or each user i nt er f ace.

User I nt er f ace Schedul e For mat ( wi t h sampl e ent r i es)

User I nt er f ace Description

User I nt er f ace Location

Type of User Interface

Banner I mpl ement at i on

Sampl e 1 Room 1 Remote DTM 08- 060 Banner " A" Di spl ayed at Logon

Sampl e 2 Room 2 Li mi t ed Local DTM 08- 060 Banner " B" on Af f i xed Label

Sampl e 3 Room 3 Ful l Local DTM 08- 060 Banner " B" Di spl ayed on Screen

3. 1. 4 Per mi t t ed Act i ons Wi t hout I dent i f i cat i on or Aut hent i cat i on

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o AC- 14;

CCI - 000061, CCI - 000232}

The cont r ol syst em must r equi r e i dent i f i cat i on and aut hent i cat i on bef or e al l owi ng any act i ons by a user act i ng f r om a user i nt er f ace whi ch MI NI MALLY or FULLY suppor t s account s.

3. 1. 5 Wi r el ess Access

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o AC- 18;

CCI - 001438, CCI - 001439, CCI - 002323, CCI - 001441}

Unl ess expl i c i t l y aut hor i zed by t he Gover nment , do not use any wi r el ess communi cat i on. Any devi ce wi t h wi r el ess communi cat i on capabi l i t y i s consi der ed t o be usi ng wi r el ess communi cat i on, r egar dl ess of whet her or not t he devi ce i s act i vel y communi cat i ng wi r el essl y, except when wi r el ess communi cat i on has been physi cal l y per manent l y di sabl ed ( such as t hr ough t he r emoval of t he wi r el ess t r anscei ver ) .

SECTI ON 25 05 11 Page 15

3. 1. 5. 1 Wi r el ess I P Communi cat i ons

Do not i nst al l wi r el ess I P net wor ks, i ncl udi ng: do not i nst al l a wi r el ess access poi nt ; do not i nst al l or conf i gur e an ad- hoc wi r el ess net wor k; do not i nst al l or conf i gur e a Wi Fi Di r ect communi cat i on.

When expl i c i t l y aut hor i zed by t he Gover nment , wi r el ess I P communi cat i on may be used t o communi cat e wi t h an exi st i ng wi r el ess net wor k.

3. 1. 5. 2 Non- I P Wi r el ess Communi cat i on

When non- I P wi r el ess communi cat i on i s expl i c i t l y aut hor i zed by t he Gover nment , use t he maxi mum l evel of encr ypt i on suppor t ed by t he speci f i c pr ot ocol empl oyed and sel ect s i gnal st r engt h and r adi at ed power t o t he mi ni mum necessar y f or r el i abl e communi cat i on.

3. 1. 5. 3 Wi r el ess Communi cat i on Request

Pr ovi de a r epor t document i ng t he pr oposed use of wi r el ess communi cat i on pr i or t o begi nni ng const r uct i on usi ng t he Wi r el ess Communi cat i on Request Schedul e at http://www.wbdg.org/FFC/NAVGRAPH/graphtoc.pdf .

For each devi ce pr oposed t o use wi r el ess communi cat i on show: t he devi ce i dent i f i er , a descr i pt i on of t he devi ce, t he l ocat i on of t he devi ce, t he devi ce i dent i f i er s of ot her devi ces communi cat i ng wi t h t he devi ce, t he pr ot ocol used f or communi cat i on, encr ypt i on t ype and st r engt h, RF Fr equency, Radi at ed Power i n dBm ( deci bel wi t h a mi l l i wat t r ef er ence) , f r ee- space r ange, and t he expect ed as- i nst al l ed r ange.

3. 1. 5. 4 Wi r el ess Communi cat i on Test i ng

As par t of Per f or mance Ver i f i cat i on Test i ng ( PVT) , conduct t est i ng of wi r el ess communi cat i on f or al l devi ces i ndi cat ed on t he appr oved Wi r el ess Communi cat i on Request as r equi r i ng t est i ng.

To t est wi r el ess communi cat i on, t est f or wi r el ess net wor k r ecept i on at mul t i pl e poi nt s al ong t he wi r el ess t est boundar y i n t he v i c i ni t y of t he wi r el ess devi ce, and r ecor d whet her a net wor k connect i on can be est abl i shed at each poi nt . The wi r el ess t est boundar y i s t he bui l di ng ext er i or wal l s.

I f wi r el ess t est i ng i s r equi r ed, pr ovi de a Wi r el ess Communi cat i on Test Report document i ng t he t est i ng poi nt s and r esul t s at each poi nt f or each wi r el ess devi ce.

3. 2 CYBERSECURI TY AUDI TI NG

3. 2. 1 Audi t Event s, Cont ent of Audi t Recor ds, and Audi t Gener at i on

{ For Ref er ence Onl y: Thi s subpar t ( and i t s subpar t s) r el at es t o AU- 2( a) , ( c) , ( d) , AU- 3, AU- 12; CCI - 000123, CCI - 001571, CCI - 000125, CCI - 001485, CCI - 000130, CCI - 000131, CCI - 000132, CCI - 00133, CCI - 000134, CCI - 001487, CCI - 000169, CCI - 001459, CCI - 000171, CCI - 000172, CCI - 001910}

For devi ces t hat have STI G/ SRGs r el at ed t o audi t event s, cont ent of audi t r ecor ds or audi t gener at i on, compl y wi t h t he r equi r ement s of t hose STIG/SRGs.

SECTI ON 25 05 11 Page 16

3. 2. 1. 1 Computers

For each comput er , pr ovi de t he capabi l i t y t o sel ect audi t ed event s and t he cont ent of audi t l ogs. Conf i gur e comput er s t o audi t t he i ndi cat ed event s, and t o r ecor d t he i ndi cat ed i nf or mat i on f or each audi t abl e event

3. 2. 1. 1. 1 Audi t ed Event s

Conf i gur e each comput er t o audi t t he f ol l owi ng event s:

a. Successf ul and unsuccessf ul at t empt s t o access, modi f y, or del et e pr i v i l eges, secur i t y obj ect s, secur i t y l evel s, or cat egor i es of i nf or mat i on ( e. g. c l assi f i cat i on l evel s)

a. Successf ul and unsuccessf ul l ogon at t empt s

b. Pr i v i l eged act i v i t i es or ot her syst em l evel access

c. St ar t i ng and endi ng t i me f or user access t o t he syst em

d. Concur r ent l ogons f r om di f f er ent wor kst at i ons

e. Successf ul and unsuccessf ul accesses t o obj ect s f . Al l pr ogr am i ni t i at i ons

g. Al l di r ect access t o t he i nf or mat i on syst em

h. Al l account cr eat i ons, modi f i cat i ons, di sabl i ng, and t er mi nat i ons i . Al l ker nel modul e l oad, unl oad, and r est ar t

3. 2. 1. 1. 2 Audi t Event I nf or mat i on To Recor d

Conf i gur e each comput er t o r ecor d, f or each audi t abl e event , t he f ol l owi ng i nf or mat i on ( wher e appl i cabl e t o t he event ) :

a. What t ype of event occur r ed

b. When t he event occur r ed

c. Wher e t he event occur r ed

d. The sour ce of t he event

e. The out come of t he event f . The i dent i t y of any i ndi v i dual s or subj ect s associ at ed wi t h t he event

3. 2. 1. 2 For HVAC Cont r ol Syst em Devi ces

3. 2. 1. 2. 1 HVAC Cont r ol Syst em Devi ces FULLY Suppor t i ng User Account s

For devi ces FULLY suppor t i ng account s, pr ovi de t he capabi l i t y t o sel ect audi t ed event s, and t he cont ent s of audi t l ogs. Conf i gur e devi ces t o audi t t he f ol l owi ng event s:

a. Successf ul and unsuccessf ul l ogon at t empt s t o t he devi ce

SECTI ON 25 05 11 Page 17

b. St ar t i ng and endi ng t i me f or user access t o t he devi ce

c. Al l account cr eat i ons, modi f i cat i ons, di sabl i ng, and t er mi nat i ons

d. Al l devi ce shut down and st ar t up

Conf i gur e t he devi ce t o r ecor d f or each event t he f ol l owi ng i nf or mat i on ( as appl i cabl e) : t he t ype of event , when t he event occur r ed and t he i dent i t y of any i ndi v i dual s or subj ect s associ at ed wi t h t he event

3. 2. 1. 2. 2 Ot her HVAC Cont r ol Syst em Devi ces

Ther e ar e no r equi r ement s t o per f or m audi t i ng at HVAC f i el d devi ces t hat do not FULLY suppor t account s.

3. 2. 1. 3 Def aul t Requi r ement s f or Cont r ol Syst em Devi ces

For cont r ol syst em devi ces wher e Audi t Event s, Cont ent of Audi t Recor ds, and Audi t Gener at i on ar e not ot her wi se i ndi cat ed i n t hi s Sect i on:

3. 2. 1. 3. 1 Devi ces Whi ch FULLY Suppor t Account s

For each devi ce whi ch FULLY suppor t s account s, pr ovi de t he capabi l i t y t o sel ect audi t ed event s and t he cont ent of audi t l ogs. Conf i gur e devi ces t o audi t t he i ndi cat ed event s, and t o r ecor d t he i ndi cat ed i nf or mat i on f or each audi t abl e event

3. 2. 1. 3. 1. 1 Audi t ed Event…