W912QR22R0028_Specs_PH1_Vol4-0000.pdf

Controlled by: USACE-LRL-ED-MA CUI Category(ies):

LDC or Distribution Statement: N/A POC: Blake Gevedon Contracting Specialist william.b.gevedon@usace.army.mi 502.315.6791

Materials shall be submitted to potential offerors currently certified in the Joint Certification Program (JCP) only.

W912QR22R0028_Specs_PH1_Vol4-0000

Solicitation For Repair/Renovate AFMC Headquarters Building (B10262) Phase 1 -

P2: 475429

Design-Bid-Build

Specifications 90% Final Revised Specification Submittal Vol. 4 of 5

10 November 2022

W912QR22R0028

ARIMS: 200A

Disposition: Maintain for 15yrs after construction

US Army Corps of Engineers Louisville District

Volume 4 of 5

SPECIFICATIONS

Rev00 Repair/Renovate AFMC

Headquarters Building (B10262) Phase 1 -

90% Final Revised Specification Submittal Project Number: ZHTV160500-262

P2 # 475429 Fiscal Year 2023

Solicitation Number: W912QR22R0028

20 October 2022

CONTROLLED

UNCLASSIFIED

INFORMATION

Controlled by: USACE Controlled by: Louisville District CUI Category: CUI Basic Distribution/Dissemination Controls: Distribution B POC: Steve Skaggs, 502-315-6368

THIS PAGE INTENTIONALLY LEFT BLANK

P2#475429 Repair/Reno AFMC HQ 10262 CUI Wright-Patterson AFB –Phase 1

PROJECT TABLE OF CONTENTS Page 1 CUI 90% Final Revised

PROJECT TABLE OF CONTENTS

VOLUME 1

DIVISION 00 - PROCUREMENT AND CONTRACTING REQUIREMENTS

00 10 00 PRICE BREAKOUT SCHEDULE

00 80 00.00 06 SPECIAL PROVISIONS

DIVISION 01 - GENERAL REQUIREMENTS

01 11 00 08/15 SUMMARY OF WORK

01 32 01.00 06 07/18 PROJECT SCHEDULE

01 33 00 08/18, CHG 4: 02/21 SUBMITTAL PROCEDURES

01 33 29.00 06 11/17 SUSTAINABILITY REPORTING

01 35 26.00 06 GOVERNMENT SAFETY REQUIREMENTS

01 35 43 12/20 GENERAL ENVIRONMENTAL PROTECTION

REQUIREMENTS (WPAFB)

01 35 53 08/19 SPECIAL SECURITY PROCEDURES

01 42 00 02/19 SOURCES FOR REFERENCE

PUBLICATIONS

01 45 00.15 10 11/16 RESIDENT MANAGEMENT SYSTEM

CONTRACTOR MODE (RMS CM)

01 45 04.10 06 CONTRACTOR QUALITY CONTROL

01 45 35 11/20 SPECIAL INSPECTIONS

01 46 00.00 06 04/20 TOTAL BUILDING COMMISSIONING

01 50 00 11/20 TEMPORARY CONSTRUCTION

FACILITIES AND CONTROLS

01 74 19 02/19 CONSTRUCTION WASTE MANAGEMENT

AND DISPOSAL

01 78 23 08/15 OPERATION AND MAINTENANCE DATA

VOLUME 2

DIVISION 02 - EXISTING CONDITIONS

02 41 00 05/10 DEMOLITION AND DECONSTRUCTION

PROJECT TABLE OF CONTENTS Page 2 CUI 90% Final Revised

DIVISION 03 - CONCRETE

03 01 00 02/18 REHABILITATION OF CONCRETE

03 30 00 02/19 CAST-IN-PLACE CONCRETE

03 33 00 11/09 CAST-IN-PLACE ARCHITECTURAL

CONCRETE

03 35 43 12/21 POLISHED CONCRETE FINISHING

03 62 15.00 06 07/16 FLOWABLE FILL

DIVISION 04 - MASONRY

04 20 00 11/15 UNIT MASONRY

04 72 00 09/20 CAST STONE MASONRY

DIVISION 05 - METALS

05 05 20.00 27 02/21 POST-INSTALLED CONCRETE AND

MASONRY ANCHORS

05 05 23.16 08/18 STRUCTURAL WELDING

05 12 00 08/18 STRUCTURAL STEEL

05 30 00 05/15 STEEL DECKS

05 40 00 05/15 COLD-FORMED METAL FRAMING

05 50 13 05/17 MISCELLANEOUS METAL FABRICATIONS

05 50 14 08/18 STRUCTURAL METAL FABRICATIONS

05 51 00 02/17 METAL STAIRS

05 51 00.01 05/22 PREFABRICATED ALUMINUM STAIRS

05 51 33 02/16 METAL LADDERS

05 52 00 02/18 METAL RAILINGS

05 52 16 12/21 METAL EGRESS BARRIER GATES

05 75 00 05/21 DECORATIVE FORMED METAL

PROJECT TABLE OF CONTENTS Page 3 CUI 90% Final Revised

DIVISION 06 - WOOD, PLASTICS, AND COMPOSITES

06 10 00 08/16 ROUGH CARPENTRY

06 16 00 10/20 SHEATHING

06 20 00 08/16 FINISH CARPENTRY

06 41 16.00 10 08/10 PLASTIC-LAMINATE-CLAD

ARCHITECTURAL CABINETS

06 61 16 08/10 SOLID SURFACING FABRICATIONS

06 64 00 11/19 PLASTIC PANELING

DIVISION 07 - THERMAL AND MOISTURE PROTECTION

07 01 50.19 05/20 PREPARATION FOR REROOFING

07 13 53 02/16 ELASTOMERIC SHEET WATERPROOFING

07 17 00 08/22 BENTONITE WATERPROOFING

07 17 10 08/22 BENTONITE INJECTION

WATERPROOFING

07 21 13 02/16 BOARD INSULATION

07 21 16 11/11 MINERAL FIBER BLANKET INSULATION

07 22 00 02/16 ROOF AND DECK INSULATION

07 24 00 05/11 POLYMER-BASED EXTERIOR FINISH

SYSTEMS (EFS)

07 27 10.00 10 08/19 BUILDING AIR BARRIER SYSTEM

07 27 19.01 05/17 SELF-ADHERING AIR BARRIERS

07 27 26 05/17 FLUID-APPLIED MEMBRANE AIR

BARRIERS

07 27 36 05/17 SPRAY FOAM AIR BARRIERS

07 42 13 05/11 METAL WALL PANELS

07 42 17 06/20 INSULATED-CORE METAL WALL BACKUP

PANEL SYSTEM

07 42 93 05/22 SOFFIT PANELS

07 44 56 06/20 MINERAL-FIBER-REINFORCED

CEMENTITIOUS PANELS

PROJECT TABLE OF CONTENTS Page 4 CUI 90% Final Revised

07 52 00 05/12 MODIFIED BITUMINOUS MEMBRANE

ROOFING

07 54 23 02/13 THERMOPLASTIC POLYOLEFIN (TPO)

ROOFING

07 60 00 05/17 FLASHING AND SHEET METAL

07 61 15.00 20 08/16 ALUMINUM STANDING SEAM ROOFING

07 71 00 05/20 ROOF SPECIALTIES

07 72 10 11/19 ROOFTOP FALL ARREST SYSTEM

07 72 30 ROOF ACCESSORIES

07 72 53 07/20 SNOW GUARDS

07 81 00 02/11 SPRAY-APPLIED FIREPROOFING

07 81 23 05/20 INTUMESCENT FIREPROOFING

07 84 00 05/10 FIRESTOPPING

07 92 00 08/16 JOINT SEALANTS

07 95 13.13 12/20 INTERIOR EXPANSION JOINT COVER

ASSEMBLIES

07 95 13.16 01/21 EXTERIOR EXPANSION JOINT COVER

ASSEMBLIES

DIVISION 08 - OPENINGS

08 08 13 07/20 FIRE-RESISTANT GLAZING

08 11 13 02/10 STEEL DOORS AND FRAMES

08 14 00 08/16 WOOD DOORS

08 31 00 05/17 ACCESS DOORS AND PANELS

08 33 13 05/09 COILING COUNTER DOORS

08 33 23 11/19 OVERHEAD COILING DOORS

08 33 26 01/21 OVERHEAD COILING GRILLES

08 34 60 05/22 HORIZONTAL SLIDING WINDOW

08 34 73 02/15 SOUND CONTROL DOOR ASSEMBLIES

08 41 13 08/18 ALUMINUM-FRAMED ENTRANCES AND

STOREFRONTS

PROJECT TABLE OF CONTENTS Page 5 CUI 90% Final Revised

08 44 00 05/19 CURTAIN WALL AND GLAZED

ASSEMBLIES

08 71 00 02/16 DOOR HARDWARE

08 81 00 05/19 GLAZING

08 85 10 08/09 DECORATIVE FILM FOR GLASS

08 88 13 FIRE-RESISTANT STOREFRONT

GLAZING

08 91 00 05/11 METAL WALL LOUVERS

VOLUME 3

DIVISION 09 - FINISHES

09 22 00 02/10 SUPPORTS FOR PLASTER AND GYPSUM

BOARD

09 22 16 01/21 EXTRUDED ALUMINUM PARTITION

CLOSURE

09 23 00 08/16 GYPSUM PLASTERING

09 24 23 08/17 CEMENT STUCCO

09 29 00 08/16 GYPSUM BOARD

09 30 10 08/17 CERAMIC, QUARRY, AND GLASS

TILING

09 51 00 08/17 ACOUSTICAL CEILINGS

09 54 70 05/21 METAL PANEL CEILING SYSTEM

09 62 38 08/17 STATIC-CONTROL FLOORING

09 65 00 08/10 RESILIENT FLOORING

09 66 13 08/16, CHG 2: 11/18 PRECAST TERRAZZO TREADS

09 66 16 08/16 TERRAZZO FLOOR TILE

09 67 23.13 11/19 STANDARD RESINOUS FLOORING

09 68 00 11/17 CARPETING

09 72 00 08/17 WALLCOVERINGS

09 84 20 08/16 ACOUSTICAL WALL PANELS

09 90 00 05/11 PAINTS AND COATINGS

PROJECT TABLE OF CONTENTS Page 6 CUI 90% Final Revised

09 96 00 11/14 HIGH-PERFORMANCE COATINGS

09 96 46 11/19 INTUMESCENT PAINTING

DIVISION 10 - SPECIALTIES

10 11 00 08/17 VISUAL DISPLAY UNITS

10 14 00.10 08/17 EXTERIOR SIGNAGE

10 14 00.20 08/20 INTERIOR SIGNAGE

10 21 13 08/17 TOILET COMPARTMENTS

10 26 00 08/17 WALL AND DOOR PROTECTION

10 28 13 08/17 TOILET ACCESSORIES

10 44 16 11/19 FIRE EXTINGUISHERS

10 45 13 10/20 DEFIBRILLATOR CABINETS AND

DEFIBRILLATORS

10 51 13.10 05/11 METAL LOCKERS - SPECIAL PURPOSE

10 99 00 11/19 MISCELLANEOUS ITEMS

DIVISION 11 - EQUIPMENT

11 10 10 09/20 MODULAR ACCESS RAMPS

11 13 13 04/20 LOADING DOCK BUMPER

11 13 19.13 08/09 LOADING DOCK LEVELERS

DIVISION 12 - FURNISHINGS

12 24 13 08/17 ROLLER WINDOW SHADES

12 36 00 08/18 COUNTERTOPS

DIVISION 13 - SPECIAL CONSTRUCTION

13 48 73 05/20 BRACING FOR EQUIPMENT

PROJECT TABLE OF CONTENTS Page 7 CUI 90% Final Revised

DIVISION 14 - CONVEYING EQUIPMENT

14 21 23 05/20 ELECTRIC TRACTION PASSENGER

ELEVATORS

14 42 50 05/20 VERTICAL WHEELCHAIR LIFTS

DIVISION 21 - FIRE SUPPRESSION

21 12 00 05/11 STANDPIPE SYSTEMS

21 13 13.00 10 05/09 WET PIPE SPRINKLER SYSTEM, FIRE

PROTECTION

21 13 19 08/20 DELUGE SPRINKLER SYSTEMS, FIRE

PROTECTION

21 30 00 04/08 FIRE PUMPS

DIVISION 22 - PLUMBING

22 00 00 11/15 PLUMBING, GENERAL PURPOSE

22 11 16.11 WATER SERVICE TAPS AND SERVICE

LINE INSTALLATION

22 11 16.13 CROSS CONNECTION CONTROL AND

BACKFLOW PREVENTION

22 13 19.23 GREASE TRAPS

22 31 00 02/09 WATER SOFTENERS, CATION-EXCHANGE

(SODIUM CYCLE)

DIVISION 23 - HEATING, VENTILATING, AND AIR CONDITIONING (HVAC)

23 00 00 08/18 AIR SUPPLY, DISTRIBUTION,

VENTILATION, AND EXHAUST SYSTEMS

23 01 30.41 02/15 HVAC SYSTEM CLEANING

23 05 15 02/14 COMMON PIPING FOR HVAC

23 05 93.00 06 08/16 TESTING, ADJUSTING, AND

BALANCING (TAB) OF HVAC

23 07 00 02/13 THERMAL INSULATION FOR

MECHANICAL SYSTEMS

PROJECT TABLE OF CONTENTS Page 8 CUI 90% Final Revised

23 09 00 02/19 INSTRUMENTATION AND CONTROL FOR

HVAC

23 09 13 11/15 INSTRUMENTATION AND CONTROL

DEVICES FOR HVAC

23 09 23.02 02/19 BACNET DIRECT DIGITAL

CONTROL FOR HVAC AND OTHER

BUILDING CONTROL SYSTEMS

23 11 25 11/08 FACILITY GAS PIPING

23 21 23 08/17 HYDRONIC PUMPS

23 23 00 10/07 REFRIGERANT PIPING

23 25 00 11/08 CHEMICAL TREATMENT OF WATER FOR

MECHANICAL SYSTEMS

23 64 10 11/16 WATER CHILLERS, VAPOR

COMPRESSION TYPE

23 64 26 08/09 CHILLED, CHILLED-HOT, AND

CONDENSER WATER PIPING SYSTEMS

23 81 00 05/18 DECENTRALIZED UNITARY HVAC

EQUIPMENT

23 82 01.00 10 04/08 WARM AIR HEATING SYSTEMS

VOLUME 4

DIVISION 25 - INTEGRATED AUTOMATION

25 05 11.21 11/17 CYBERSECURITY FOR FACILITY

RELATED CONTROL SYSTEMS FIRE AND

LIFE SAFETY (FLS)

25 05 11.23 11/17 CYBERSECURITY FOR FACILITY-

RELATED CONTROL SYSTEMS ENERGY

MANAGEMENT CONTROL SYSTEM (EMCS)

25 05 11.26 11/17 CYBERSECURITY FOR FACILITY-

RELATED CONTROL SYSTEMS UTILITY

CONTROL SYSTEM (UCS)

25 05 11.26 02 11/17 CYBERSECURITY FOR FACILITY-

RELATED CONTROL SYSTEMS BUILDING

CONTROL SYSTEM (BCS)

25 05 11.28 11/17 CYBERSECURITY FOR FACILITY-

RELATED CONTROL SYSTEMS

ELECTRONIC SECURITY SYSTEM (ESS)

PROJECT TABLE OF CONTENTS Page 9 CUI 90% Final Revised

25 08 10 04/06 UTILITY MONITORING AND CONTROL

SYSTEM TESTING

25 10 10 02/19 UTILITY MONITORING AND CONTROL

SYSTEM (UMCS) FRONT END AND

INTEGRATION

DIVISION 26 - ELECTRICAL

26 08 00 08/08, CHG 1: 02/15 APPARATUS INSPECTION AND TESTING

26 20 00 08/19 INTERIOR DISTRIBUTION SYSTEM

26 23 00 05/15 LOW-VOLTAGE SWITCHGEAR

26 24 13 05/15 SWITCHBOARDS

26 28 01.00 10 10/07 COORDINATED POWER SYSTEM

PROTECTION

26 29 23 02/20 ADJUSTABLE SPEED DRIVE (ASD)

SYSTEMS UNDER 600 VOLTS

26 32 15.00 05/20 ENGINE-GENERATOR SET STATIONARY

15-2500 KW, WITH AUXILIARIES

26 36 23 05/20 AUTOMATIC TRANSFER SWITCHES AND

BY-PASS/ISOLATION SWITCH

26 41 00 11/13 LIGHTNING PROTECTION SYSTEM

26 42 14.00 10 08/09 CATHODIC PROTECTION SYSTEM

(SACRIFICIAL ANODE)

26 51 00 05/20 INTERIOR LIGHTING

26 56 00 05/20 EXTERIOR LIGHTING

DIVISION 27 - COMMUNICATIONS

27 05 14.00 10 04/06 CABLE TELEVISION PREMISES

DISTRIBUTION SYSTEM

27 10 00 08/11 BUILDING TELECOMMUNICATIONS

CABLING SYSTEM

27 41 00 10/20 AUDIOVISUAL SYSTEMS

27 51 19 01/22 SOUND MASKING SYSTEMS

PROJECT TABLE OF CONTENTS Page 10 CUI 90% Final Revised

VOLUME 5

DIVISION 28 - ELECTRONIC SAFETY AND SECURITY

28 08 10 05/16 ELECTRONIC SECURITY SYSTEM

ACCEPTANCE TESTING

28 10 05 05/16 ELECTRONIC SECURITY SYSTEMS

(ESS)

28 31 76 08/11 INTERIOR FIRE ALARM AND MASS

NOTIFICATION SYSTEM

DIVISION 31 - EARTHWORK

31 00 00.00 06 07/18 EARTHWORK

31 11 00 11/18 CLEARING AND GRUBBING

31 31 16.13 08/16 CHEMICAL TERMITE CONTROL

DIVISION 32 - EXTERIOR IMPROVEMENTS

32 01 16.71 02/17 COLD MILLING ASPHALT PAVING

32 05 33 08/17 LANDSCAPE ESTABLISHMENT

32 11 20 08/17 BASE COURSE FOR RIGID AND

SUBBASES FOR FLEXIBLE PAVING

32 12 13 05/17 BITUMINOUS TACK AND PRIME COATS

32 12 16 08/09 HOT-MIX ASPHALT (HMA) FOR ROADS

32 13 13.06 06 06/18 PORTLAND CEMENT CONCRETE

PAVEMENT FOR ROADS AND SITE

FACILITIES

32 15 00 05/17 AGGREGATE SURFACING

32 16 19 05/18 CONCRETE CURBS, GUTTERS AND

SIDEWALKS

32 17 23 08/16 PAVEMENT MARKINGS

32 17 26 01/21 TACTILE WARNING SURFACING

32 31 13 11/16 CHAIN LINK FENCES AND GATES

32 31 13.10 11/16 CHAIN LINK FENCES AND GATES (FOR

BUILDING INTERIORS)

PROJECT TABLE OF CONTENTS Page 11 CUI 90% Final Revised

32 31 13.53 02/20 HIGH-SECURITY FENCES (CHAIN LINK

AND ORNAMENTAL) AND GATES

32 92 19 08/17 SEEDING

32 92 23 04/06, CHG 1: 08/21 SODDING

32 93 00 08/17, CHG 1: 08/21 EXTERIOR PLANTS

DIVISION 33 - UTILITIES

33 01 10.13 PRESSURE AND LEAKAGE TESTS

33 01 30.13 ACCEPTANCE TESTING FOR SANITARY

SEWERS

33 11 00 PIPING AND ACCESSORIES – GENERAL

PROVISIONS

33 11 00.11 POLYVINYL CHLORIDE (PVC) PIPE

33 11 00.15 DUCTILE IRON PIPE AND FITTINGS

33 30 00 05/18 SANITARY SEWERAGE

33 40 00 02/10 STORM DRAINAGE UTILITIES

33 46 13 04/08 FOUNDATION DRAINAGE SYSTEM

33 46 16 05/18 SUBDRAINAGE PIPING

33 51 15 08/19 NATURAL-GAS / LIQUEFIED

PETROLEUM GAS DISTRIBUTION

PIPELINES

33 52 10 11/18 FUEL SYSTEMS PIPING

33 56 10 05/19 FACTORY-FABRICATED FUEL STORAGE

TANKS

33 61 13.13 02/16 PREFABRICATED UNDERGROUND

HYDRONIC ENERGY DISTRIBUTION

33 71 02 02/15 UNDERGROUND ELECTRICAL

DISTRIBUTION

33 82 00 04/06 TELECOMMUNICATIONS OUTSIDE PLANT

(OSP)

PROJECT TABLE OF CONTENTS Page 12 CUI 90% Final Revised

DIVISION 34 - TRANSPORTATION

34 71 13.19 02/20 CRASH RATED ACTIVE VEHICLE

BARRIERS AND CONTROLS

-- End of Project Table of Contents --

Wright-Patterson AFB – Phase 1

SECTION 25 05 11.21

CYBERSECURITY FOR FACILITY-RELATED CONTROL SYSTEMS

FIRE AND LIFE SAFETY (FLS)

11/17

PART 1 GENERAL

This Section refers to Security Requirements Guide (SRGs) and Security Technical Implementation Guide (STIGs). STIGs and SRGs are available online at the Information Assurance Support Environment (IASE) website at http://iase.disa.mil/stigs/Pages/index.aspx . Not all control system components have applicable STIGs or SRGs.

1.1 CONTROL SYSTEM APPLICABILITY

There are multiple versions of this Section associated with this project.

Different versions have requirements applicable to different control systems. This specific Section applies only to the following control systems: Fire and Life Safety to include Fire Suppression, Fire Pump, and Fire Alarm Reporting including Mass Notification Systems .

1.2 RELATED REQUIREMENTS

All Sections containing facility-related control systems or control system components are related to the requirements of this Section. Review all specification sections to determine related requirements.

1.3 REFERENCES

The publications listed below form a part of this specification to the extent referenced. The publications are referred to within the text by the basic designation only.

U.S. DEPARTMENT OF DEFENSE (DOD)

DODI 8551.01 (2014) Ports, Protocols, and Services Management (PPSM)

1.4 DEFINITIONS

1.4.1 Computer

As used in this Section, a computer is one of the following:

a. a device running a non-embedded desktop or server version of Microsoft Windows

b. a device running a non-embedded version of MacOS

c. a device running a non-embedded version of Linux

d. a device running a version or derivative of the Android OS, where Android is considered separate from Linux

e. a device running a version of Apple iOS

SECTION 25 05 11.21 Page 1 CUI 90% Final Revised

1.4.2 Network Connected

A component is network connected (or "connected to a network") only when the device has a network transceiver which is directly connected to the network and implements the network protocol. A device lacking a network transceiver (and accompanying protocol implementation) can never be considered network connected. Note that a device connected to a non-IP network is still considered network connected (an IP connection or IP address is not required for a device to be network connected).

Any device that supports wireless communication is network connected, regardless of whether the device is communicating using wireless .

1.4.3 User Account Support Levels

The support for user accounts is categorized in this Section as one of three levels:

1.4.3.1 FULLY Supported

Device supports configurable individual accounts. Accounts can be created, deleted, modified, etc. Privileges can be assigned to accounts.

1.4.3.2 MINIMALLY Supported

Device supports a small, fixed number of accounts (perhaps only one).

Accounts cannot be modified. A device with only a "User" and an "Administrator" account would fit this category. Similarly, a device with two PINs for logon - one for restricted and one for unrestricted rights would fit here (in other words, the accounts do not have to be the traditional "user name and password" structure).

1.4.3.3 NOT Supported

Device does not support any Access Enforcement therefore the whole concept of "account" is meaningless.

1.4.4 User Interface

Generally, a user interface is hardware on a device allowing user interaction with that device via input (buttons, switches, sliders, keyboard, touch screen, etc.) and a screen. There are three types of user interfaces defined in this Section: Limited Local User Interface, Full Local User Interface and Remote User Interface. In this Section, when the term "User Interface" is used without specifying which type, it refers only to Full Local User Interface and Remote User Interface (NOT to Limited Local User Interface).

1.4.4.1 Limited Local User Interface

A Limited Local User Interface is a user interface where the interaction is limited, fixed at the factory, and cannot be modified in the field.

The user must be physically at the device to interact with it.

Examples of Limited Local User Interface include thermostats (Space Sensor Modules as defined in Section 23 09 13 INSTRUMENTATION AND CONTROL DEVICES

FOR HVAC).

SECTION 25 05 11.21 Page 2

1.4.4.2 Full Local User Interface

A Full Local User Interface is a user interface where the interaction and displays are field-configurable.

Examples of a Full Local User Interface include local applications on a computer and user interfaces to Variable Speed Drives .

1.4.4.3 Remote User Interface

A Remote User Interface is a user interface on a Client device allowing user interaction with a different Server device. The user need not be physically at the Server device to interact with it.

Examples of Remote User Interfaces include web browsers and Local Display Panels as defined in Section 23 09 00 INSTRUMENTATION AND CONTROL FOR HVAC .

1.5 ADMINISTRATIVE REQUIREMENTS

1.5.1 Coordination

Coordinate the execution of this Section with the execution of all other Sections related to control systems as indicated in the paragraph RELATED REQUIREMENTS. Items that must be considered when coordinating project efforts include but are not limited to:

a. If requesting permission for wireless communication, the Wireless Communication Request submittal must be approved prior to control system device selection and integration.

b. If requesting permission for alternate account lock permissions, the Device Account Lock Exception Request must be approved prior to control system device selection and integration.

c. Wireless testing may be required as part of the control system testing. See requirements for the Wireless Communication Test Report submittal.

d. Cybersecurity testing support must be coordinated across control systems and with the Government cybersecurity testing schedule.

e. Passwords must be coordinated with the indicated contact for the project site.

f . Contractor Computer Cybersecurity Compliance Statements for each contractor using contractor owned computers.

1.6 SUBMITTALS

Government approval is required for submittals with a "G" designation;

submittals not having a "G" designation are for Contractor Quality Control approval. Submit the following in accordance with and Section 01 33 00

SUBMITTAL PROCEDURES:

SD-01 Preconstruction Submittals

Wireless Communication Request ; G

Device Account Lock Exception Request ; G

SECTION 25 05 11.21 Page 3

Contractor Computer Cybersecurity Compliance Statements ; G

Contractor Temporary Network Cybersecurity Compliance Statements ; G

SD-02 Shop Drawings

Network Communication Report ; G

Cybersecurity Riser Diagram ; G

Control System Inventory Report ; G

SD-03 Product Data

Control System Cybersecurity Documentation ; G

SD-06 Test Reports

Wireless Communication Test Report ; G

SD-07 Certificates

Software Licenses ; G

Cybersecurity Representative Certification or Qualifications; G

SD-11 Closeout Submittals

Password Summary Report ; G

Software Recovery And Reconstitution Images ; G

1.7 QUALITY CONTROL

1.7.1 Cybersecurity Representative

Provide a Cybersecurity Representative as the key person to implement and manage the cybersecurity related control systems of the project. This position requires that the individual currently meets Information Assurance Manager Level II Certification in accordance with DODI 8570 Information Workforce Improvement Program. Any certification must be in effect prior to being hired. Submit one hard copy and an electronic copy .

The Cybersecurity Representative must lead and oversee the cybersecurity control systems work specified herein and be the primary point of contact for the Government regarding the cybersecurity work.

1.8 CYBERSECURITY DOCUMENTATION

1.8.1 Network Communication Report

For Reference Only: This subpart (and its subparts) relates to CA-9;

CCI-002103, CCI-002194, CCI-002105 and also the submittal requirements associated with CM-6, CM-7 and SC-41).

Provide a network communication report. For each networked controller, document the communication characteristics of the controller including communication protocols, services used, and a general description of what information is communicated over the network. If other control system

SECTION 25 05 11.21 Page 4

Sections used on this project include submittals documenting this information, provide copies of those submittals to meet this requirement.

In addition to the requirements of Section 01 33 00 SUBMITTAL PROCEDURES, provide the Network Communication Report as an editable Microsoft Excel file.

1.8.2 Control System Inventory Report

For Reference Only: This subpart (and its subparts) relates to CM-8(a);

CP-12, SI-17, IA-3; CCI-000389, CCI-000392, CCI-000398, CCI-002855,

CCI-002856, CCI-002857, CCI-002773, CCI-002774, CCI-002775, CCI-000777,

CCI-000778 CCI-001958.

Provide a Control System Inventory report using the Inventory Spreadsheet listed under this Section at http://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/forms-graphics-tables documenting all devices, including network devices, network infrastructure devices, non-networked devices, input devices (e.g.

sensors) and output devices (e.g. actuators). For each device provide all applicable information for which there is a field on the spreadsheet in accordance with the instructions on the spreadsheet.

In addition to the requirements of Section 01 33 00 SUBMITTAL PROCEDURES, provide the Control System Inventory Report as an editable Microsoft Excel file.

1.8.3 Software Recovery and Reconstitution Images

For Reference Only: This subpart (and its subparts) related to CP-10;

CCI-000550, CCI-000551, CCI-000552)

For each device on which software is installed or modified under this project, provide a recovery image of the final as-built device . This image must allow for bare-metal restore such that restoration of the image is sufficient to restore system operation to the imaged state without the need for re-installation of software.

1.8.4 Cybersecurity Riser Diagram

For Reference Only: This subpart (and its subparts) related to PL-2(a);

CCI-003051, CCI-003052)

Provide a cybersecurity riser diagram of the complete control system including all network and controller hardware. If the control system specifications require a riser diagram submittal, provide a copy of that submittal as the cybersecurity riser diagram. Otherwise, provide a riser diagram in one-line format overlayed on a facility schematic.

1.8.5 Control System Cybersecurity Documentation

For Reference Only: This subpart (and its subparts) relates to SA-5 (a), (b), (c); CCIs: CCI-003124, CCI-003125, CCI-003126, CCI-003127, CCI-003128, CCI-003129, CCI-003130, CCI-003131)

Provide a Control System Cybersecurity Documentation submittal containing the indicated information for each device and software application.

SECTION 25 05 11.21 Page 5

1.8.5.1 Default Requirements for Control System Devices

For control system devices where Control System Cybersecurity Documentation requirements are not otherwise indicated in this Section, provide:

a. Documentation that describes secure configuration of the device . (for reference only: relates to CCI-003124).

b. Documentation that describes secure installation of the device . (for reference only: relates to CCI-003125).

c. Documentation that describes secure operation of the device . (for reference only: relates to CCI-003124).

d. Documentation that describes effective use and maintenance of security functions or mechanisms for the device . (for reference only: relates to CCI-003124)

e. Documentation that describes known vulnerabilities regarding configuration and use of administrative (i.e. privileged) functions for the device . (for reference only: relates to CCI-003128)

f. Documentation that describes user-accessible security functions or mechanisms in the device and how to effectively use those security functions or mechanisms . (for reference only: relates to CCI-003129)

g. Documentation that describes methods for user interaction which enables individuals to use the device in a more secure manner . (for reference only: relates to CCI-003130)

h. Documentation that describes user responsibilities in maintaining the security of the device . (for reference only: relates to CCI-003131)

1.9 SOFTWARE UPDATE LICENSING

For Reference Only: This subpart (and its subparts) related to SI-2(a), (c); CCI-001227, CCI-002605)

In addition to all other licensing requirements, all software licensing must include licensing of the following software updates for a period of no less than 5 years:

a. Security and bug-fix patches issued by the software manufacturer.

b. Security patches to address any vulnerability identified in the National Vulnerability Database at http://nvd.nist.gov with a Common Vulnerability Scoring System (CVSS) severity rating of MEDIUM or higher.

Provide a single Software Licenses submittal with documentation of the software licenses for all software provided .

1.10 CYBERSECURITY DURING CONSTRUCTION

For Reference Only: This subpart (and its subparts) related to AC-18, SA-3, CCI-00258)

In addition to the control system cybersecurity requirements indicated in

SECTION 25 05 11.21 Page 6 this section, meet following requirement throughout the construction process.

1.10.1 Contractor Computer Equipment

Contractor owned computers may be used for construction. When used, contractor computers must meet the following requirements:

1.10.1.1 Operating System

The operating system must be an operating system currently supported by the manufacturer of the operating system. The operating system must be current on security patches and operating system manufacturer required updates.

1.10.1.2 Passwords and Passphrases

The passwords and passphrases for all computers must be changed from their default values. Passwords must be a minimum of eight characters with a minimum of one uppercase letter, one lowercase letter, one number and one special character.

1.10.1.3 Contractor Computer Cybersecurity Compliance Statements

Provide a single submittal containing completed Contractor Computer Cybersecurity Compliance Statements for each company using contractor owned computers. Contractor Computer Cybersecurity Compliance Statements must use the template published at http://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/forms-graphics-tables Each Statement must be signed by a cybersecurity representative for the relevant company.

1.10.2 Temporary IP Networks

Temporary contractor-installed IP networks may be used during construction. When used, temporary contractor-installed IP networks must meet the following requirements:

1.10.2.1 Network Boundaries and Connections

The network must not extend outside the project site and must not connect to any IP network other than IP networks provided under this project or Government furnished IP networks provided for this purpose. Any and all network access from outside the project site is prohibited.

1.10.3 Government Access to Network

Government personnel must be allowed to have complete and immediate access to the network at any time in order to verify compliance with this specification

1.10.4 Passwords and Passphrases

The passwords and passphrases for all network devices and network access must be changed from their default values. Passwords must be a minimum 8 characters with a minimum of one uppercase letter, one lowercase letter, one number and one special character.

SECTION 25 05 11.21 Page 7

1.10.5 Contractor Temporary Network Cybersecurity Compliance Statements

Provide a single submittal containing completed Contractor Temporary Network Cybersecurity Compliance Statements for each company implementing a temporary IP network. Contractor Temporary Network Cybersecurity Compliance Statements must use the template published at http://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/forms-graphics-tables Each Statement must be signed by a cybersecurity representative for the relevant company. If no temporary IP networks will be used, provide a single copy of the Statement indicating this.

1.11 CYBERSECURITY DURING WARRANTY PERIOD

All work performed on the control system after acceptance must be performed using Government Furnished Equipment or equipment specifically and individually approved by the Government.

PART 2 PRODUCTS

Not Used.

PART 3 EXECUTION

3.1 ACCESS CONTROL REQUIREMENTS

3.1.1 User Accounts

For Reference Only: This subpart (and its subparts) related to AC-2(a) and AC-3; CCI-0002110, CCI-000213.1)

Any device supporting user accounts (either FULLY or MINIMALLY) must limit access to the device according to specified limitations for each account.

3.1.1.1 Default Requirements for Control System Devices

For control system devices where User Account requirements are not otherwise indicated in this Section:

a. Field devices with full local user interfaces allowing modification of data must at least MINIMALLY SUPPORT user accounts.

b. Field devices with read-only full local user interfaces must at least MINIMALLY support user accounts.

3.1.2 Unsuccessful Logon Attempts

For Reference Only: This subpart (and its subparts) related to AC-7(a), AC-7(b); CCI-000043, CCI-00004, CCI-001423, CCI-002236, cci-002237)

Except for high availability user interfaces indicated as exempt, devices must meet the indicated requirements for handling unsuccessful logon attempts.

3.1.2.1 Devices FULLY Supporting Accounts

Devices which FULLY support accounts must meet the following requirements. If a device cannot meet these requirements, document device capabilities to protect from subsequent unsuccessful logon attempts and propose alternate protections in a Device Account Lock Exception Request

SECTION 25 05 11.21 Page 8 submittal. Do not implement alternate protection measures without explicit permission from the Government.

a. Once an account is locked, the account must stay locked until unlocked by an administrator.

b. Once the indicated number of unsuccessful logon attempts occurs, delay further logon prompts by 5 seconds.

3.1.3 Permitted Actions Without Identification or Authentication

For Reference Only: This subpart (and its subparts) related to AC-14;

CCI-000061, CCI-000232)

The control system must require identification and authentication before allowing any actions by a user acting from a user interface which MINIMALLY or FULLY supports accounts.

3.1.4 Wireless Access

For Reference Only: This subpart (and its subparts) related to AC-18;

CCI-001438, CCI-002323, CCI-001441)

Unless explicitly authorized by the Government, do not use any wireless communication. Any device with wireless communication capability is considered to be using wireless communication, regardless of whether or not the device is actively communicating wirelessly, except when wireless communication has been physically permanently disabled (such as through the removal of the wireless transceiver).

3.1.4.1 Wireless IP Communications

Do not install wireless IP networks, including: do not install a wireless access point; do not install or configure an ad-hoc wireless network; do not install or configure a WIFI Direct communication.

When explicitly authorized by the Government, wireless IP communication may be used to communicate with an existing wireless network.

3.1.4.2 Non-IP Wireless Communication

When non-IP wireless communication is explicitly authorized by the Government, use the maximum level of encryption supported by the specific protocol employed and select signal strength and radiated power to the minimum necessary for reliable communication.

3.1.4.3 Wireless Communication Request

Provide a report documenting the proposed use of wireless communication prior to beginning construction using the Wireless Communication Request Schedule at http://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/forms-graphics-tables

For each device proposed to use wireless communication show: the device identifier, a description of the device, the location of the device, the device identifiers of other devices communicating with the device, the protocol used for communication, encryption type and strength, RF Frequency, Radiated Power in dBm (decibel with a milliwatt reference), free-space range, and the expected as-installed range.

SECTION 25 05 11.21 Page 9

3.1.4.4 Wireless Communication Testing

As part of Performance Verification Testing (PVT), conduct testing of wireless communication for all devices indicated on the approved Wireless Communication Request as requiring testing.

To test wireless communication, test for wireless network reception at multiple points along the wireless test boundary in the vicinity of the wireless device, and record whether a network connection can be established at each point. The wireless test boundary is the building exterior walls. If wireless testing is required, provide a Wireless Communication Test Report documenting the testing points and results at each point for each wireless device.

3.2 CYBERSECURITY AUDITING

3.2.1 Audit Events, Content of Audit Records, and Audit Generation

{For Reference Only: This subpart (and its subparts) relates to AU-2(a),(c),(d), AU-3, AU-12; CCI-000123, CCI-001571, CCI-000125, CCI-001485, CCI-000130, CCI-000131, CCI-000132, CCI-00133, CCI-000134, CCI-001487, CCI-000169, CCI-001459, CCI-000171, CCI-000172, CCI-001910}

3.2.1.1 Default Requirements for Control System Devices

For control system devices where Audit Events, Content of Audit Records, and Audit Generation are not otherwise indicated in this Section:

3.2.1.1.1 Devices Which FULLY Support Accounts

3.2.1.1.1.1 Audited Events

Configure each device to audit the following events:

a. Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g. classification levels)

b. Successful and unsuccessful logon attempts

c. Privileged activities or other system level access

d. Starting and ending time for user access to the system

e. Concurrent logons from different workstations f . All account creations, modifications, disabling, and terminations

3.2.1.1.2 Devices Which Do Not FULLY Support Accounts

For each Device which does not FULLY support accounts configure the device to audit all device shutdown and startup events and to record for each event the type of event and when the event occurred.

3.2.2 Audit Storage Capacity and Audit Upload

{For Reference Only: This subpart (and its subparts) relates to AU-4;

CCI-001848, CCI-001849}

SECTION 25 05 11.21 Page 10

a. For non-computer control system devices capable of generating audit records, provide 60 days worth of secure local storage, assuming 10 auditable events per day.

3.2.3 Time Stamps

{For Reference Only: This subpart (and its subparts) relates to AU-8;

CCI-000159, CCI-001889, CCI-0018901}

3.2.3.1 Control System Devices

Time stamp requirements for Control Systems are as indicated in the Control System specifications. Devices generating audit records must have internal clocks capable of providing time with a resolution of 1 second.

Clocks cannot drift more than 10 seconds per day. Configure the system so that each device generating audit records maintains accurate time to within 1 second.

3.2.3.2 Default Requirements for Control System Devices

For control system devices where Time Stamps requirements are not otherwise indicated in this Section: Devices generating audit records must have internal clocks capable of providing time with a resolution of 1 second. Clocks must not drift more than 10 seconds per day. Configure the system so that each device generating audit records maintains accurate time to within 1 second.

3.3 REQUIREMENTS FOR LEAST FUNCTIONALITY

{For Reference Only: This subpart (and its subparts), along with the network communication report submittal specified elsewhere in this section, relates to CM-6 (a), (c), CM-7, CM-7 (1)(b), SC-41; CCI-000363, CCI-000364, CCI-000365, CCI-001588, CCI-001755, CCI-000381, CCI-000380, CCI-00382, CCI-001761, CCI-001762, CCI-002544, CCI-002545, CCI-002546.}

Do not provide devices with user interfaces where one was not required.

Do not use a networked sensor or actuator where a non-networked sensor or actuator would suffice.

3.3.1 Non-IP Control Networks

When control system specifications require particular communication protocols, use only those communication protocols and only as specified.

Do not implement any other communication protocol, or use any protocol on ports other than those specified.

When control system specifications do not indicate requirements for communication protocols, use only those protocols required for operation of the system as specified.

3.3.2 IP Control Networks

Do not use nonsecure functions, ports, protocols and services as defined in DODI 8551.01 unless those ports, protocols and services are specifically required by the control system specifications or otherwise specifically authorized by the Government. Do not use ports, protocols and services that are not specified in the control system specifications or required for operation of the control system.

SECTION 25 05 11.21 Page 11

3.4 SAFE MODE AND FAIL SAFE OPERATION

{For Reference Only: This subpart (and its subparts) relates to CP-12, SI-17; CCI-002855, CCI-002856, CCI-002857, CCI-002773, CCI-002774, CCI-002775}

For all control system components, configure the component to implement fail-safe procedures to include standard control system design of sequences and alarm requirements.

3.5 IDENTIFICATION AND AUTHENTICATION

3.5.1 Authenticator Management

{For Reference Only: This subpart (and its subparts) relates to IA-5 (b),(c),(e),(g),(1),(11); CCI-000176, CCI-001544, CCI-001989, CCI-000182, CCI-001610, CCI-000192, CCI-000193, CCI-000194, CCI-000205, CCI-001619, CCI-001611, CCI-001612, CCI-001613, CCI-001614, CCI-000195, CCI-001615, CCI-000196, CCI-000197, CCI-000199, CCI-000198, CCI-001616, CCI-001617, CCI-000200, CCI-001618, CCI-002041, CCI-002002, CCI-002003}

3.5.1.1 Authentication Type

3.5.1.1.1 Default Requirements for Control System Devices

For control system devices where Authentication Type requirements are not otherwise indicated in this Section:

a. Devices MINIMALLY supporting accounts must use either password-based authentication or hardware token-based authentication.

3.5.1.2 Password-Based Authentication Requirements

3.5.1.2.1 Passwords for Devices Minimally Supporting Accounts

Devices minimally supporting accounts must support passwords with a minimum length of four characters.

3.5.1.2.2 Password Configuration and Reporting

For all devices with a password, change the password from the default password. Do not use the same password for more than one device unless specifically instructed to do so. Provide a Password Summary Report documenting the password for each device and describing the procedure to change the password for each device.

Do not provide the Password Summary Report in electronic format. Provide two hard copies of the Password Summary Report, each copy in its own sealed envelope.

3.5.2 Authenticator Feedback

(For Reference Only: This subpart relates to IA-6; CCI-000206)

Devices must never show authentication information, including passwords, on a display. Devices that momentarily display a character as it is entered, and then obscure the character, are acceptable.

SECTION 25 05 11.21 Page 12

3.6 EMERGENCY POWER

{For Reference Only: This subpart (and its subparts) relates to

PE-11,(1); CCI-02955, CCI-000961}

Emergency power is specified in the control system and equipment specifications.

3.7 DURABILITY TO VULNERABILITY SCANNING

{For Reference Only: This subpart (and its subparts) relates to RA-5 (a),(b),(c),(d); CCI-001054, CCI-001055, CCI-0010156, CCI-001641, CCI-001643, CCI-001057, CCI-001058, CCI-001059}

3.7.1 Default Requirements for Control System Devices

Non-computer control system devices where Durability to Vulnerability Scanning requirements are not otherwise indicated in this Section are not required to respond to scans.

3.8 SYSTEM AND COMMUNICATION PROTECTION

3.8.1 Denial of Service Protection, Process Isolation and Boundary Protection

{For Reference Only: This subpart (and its subparts) relates to SC-5, SC-39, SC-7(a); CCI-001093, CCI-002385, CCI-002386, CCI-002430, CCI-001097}

To the greatest extent practical, implement control logic in non-computer hardware and without reliance on the network.

3.9 FIELD QUALITY CONTROL

3.9.1 Tests

In addition to testing and testing support required by other Sections, provide a minimum of 16 hours of technical support for cybersecurity testing of control systems.

-- End of Section --

SECTION 25 05 11.21 Page 13

THIS PAGE INTENTIONALLY LEFT BLANK

SECTION 25 05 11.21 Page 14

SECTION 25 05 11.23

CYBERSECURITY FOR FACILITY-RELATED CONTROL SYSTEMS

ENERGY MANAGEMENT CONTROL SYSTEM (EMCS)

11/17

PART 1 GENERAL

Many subparts in this Section contain text in curly braces ("{" and "}") indicating which cybersecurity control and control correlation identifier (CCI) the requirements of the subpart relate to. The text inside these curly braces is for Government reference only, and enables coordination of the requirements of this Section with the RMF process throughout the design and construction process. Text in curly braces are not contractor requirements.

This Section refers to Security Requirements Guide (SRGs) and Security Technical Implementation Guide (STIGs). STIGs and SRGs are available online at the Information Assurance Support Environment (IASE) website at http://iase.disa.mil/stigs/Pages/index.aspx. Not all control system components have applicable STIGs or SRGs.

This Section refers to Security Requirements Guide (SRGs) and Security Technical Implementation Guide (STIGs). STIGs and SRGs are available online at the Information Assurance Support Environment (IASE) website at http://iase.disa.mil/stigs/Pages/index.aspx . Not all control system components have applicable STIGs or SRGs.

1.1 CONTROL SYSTEM APPLICABILITY

There are multiple versions of this Section associated with this project.

Different versions have requirements applicable to different control systems. This specific Section applies only to the following control systems: Energy Management Control System to include HVAC and Building Lighting Control System .

1.2 RELATED REQUIREMENTS

All Sections containing facility-related control systems or control system components are related to the requirements of this Section. Review all specification sections to determine related requirements.

1.3 REFERENCES

The publications listed below form a part of this specification to the extent referenced. The publications are referred to within the text by the basic designation only.

AMERICAN SOCIETY OF HEATING, REFRIGERATING AND AIR-CONDITIONING

ENGINEERS (ASHRAE)

ASHRAE 135 (2016) BACnet—A Data Communication Protocol for Building Automation and Control Networks

U.S. DEPARTMENT OF DEFENSE (DOD)

DODI 8551.01 (2014) Ports, Protocols, and Services

SECTION 25 05 11.23 Page 1

Management (PPSM)

DTM 08-060 (2008) Policy on Use of Department of Defense (DoD) Information Systems - Standard Consent Banner and User Agreement

1.4 DEFINITIONS

1.4.1 Computer

As used in this Section, a computer is one of the following:

a. a device running a non-embedded desktop or server version of Microsoft Windows

b. a device running a non-embedded version of MacOS

c. a device running a non-embedded version of Linux

d. a device running a version or derivative of the Android OS, where Android is considered separate from Linux

e. a device running a version of Apple iOS

1.4.2 Network Connected

A component is network connected (or "connected to a network") only when the device has a network transceiver which is directly connected to the network and implements the network protocol. A device lacking a network transceiver (and accompanying protocol implementation) can never be considered network connected. Note that a device connected to a non-IP network is still considered network connected (an IP connection or IP address is not required for a device to be network connected).

Any device that supports wireless communication is network connected, regardless of whether the device is communicating using wireless .

1.4.3 User Account Support Levels

The support for user accounts is categorized in this Section as one of three levels:

1.4.3.1 FULLY Supported

Device supports configurable individual accounts. Accounts can be created, deleted, modified, etc. Privileges can be assigned to accounts.

1.4.3.2 MINIMALLY Supported

Device supports a small, fixed number of accounts (perhaps only one).

Accounts cannot be modified. A device with only a "User" and an "Administrator" account would fit this category. Similarly, a device with two PINs for logon - one for restricted and one for unrestricted rights would fit here (in other words, the accounts do not have to be the traditional "user name and password" structure).

1.4.3.3 NOT Supported

Device does not support any Access Enforcement therefore the whole concept

SECTION 25 05 11.23 Page 2 of "account" is meaningless.

1.4.4 User Interface

Generally, a user interface is hardware on a device allowing user interaction with that device via input (buttons, switches, sliders, keyboard, touch screen, etc.) and a screen. There are three types of user interfaces defined in this Section: Limited Local User Interface, Full Local User Interface and Remote User Interface. In this Section, when the term "User Interface" is used without specifying which type, it refers only to Full Local User Interface and Remote User Interface (NOT to Limited Local User Interface).

1.4.4.1 Limited Local User Interface

A Limited Local User Interface is a user interface where the interaction is limited, fixed at the factory, and cannot be modified in the field.

The user must be physically at the device to interact with it.

Examples of Limited Local User Interface include thermostats (Space Sensor Modules as defined in Section 23 09 13 INSTRUMENTATION AND CONTROL DEVICES

FOR HVAC).

1.4.4.2 Full Local User Interface

A Full Local User Interface is a user interface where the interaction and displays are field-configurable.

Examples of a Full Local User Interface include local applications on a computer and user interfaces to Variable Speed Drives .

1.4.4.3 Remote User Interface

A Remote User Interface is a user interface on a Client device allowing user interaction with a different Server device. The user need not be physically at the Server device to interact with it.

Examples of Remote User Interfaces include web browsers and Local Display Panels as defined in Section 23 09 00 INSTRUMENTATION AND CONTROL FOR HVAC .

1.5 ADMINISTRATIVE REQUIREMENTS

1.5.1 Coordination

Coordinate the execution of this Section with the execution of all other Sections related to control systems as indicated in the paragraph RELATED REQUIREMENTS. Items that must be considered when coordinating project efforts include but are not limited to:

a. If requesting permission for alternate account lock permissions, the Device Account Lock Exception Request must be approved prior to control system device selection and integration.

b. If requesting permission for the use of a device with multiple IP connections, the Multiple IP Connection Device Request must be approved prior to control system device selection and integration.

c. If the Device Audit Record Upload Software is to be installed on a computer not being provided as part of the control system, SECTION 25 05 11.23 Page 3 coordination is required to identify the computer on which to install the software.

d. Cybersecurity Interconnection Schedule must be coordinated with other work that will be interconnected to, and interconnections must be approved by the Government before relying on them for system functionality.

e. Cybersecurity testing support must be coordinated across control systems and with the Government cybersecurity testing schedule.

f . Passwords must be coordinated with the indicated contact for the project site.

g. If applicable, HTTP web server certificates must be obtained from the indicated contact for the project site.

h. Contractor Computer Cybersecurity Compliance Statements for each contractor using contractor owned computers.

1.6 SUBMITTALS

Government approval is required for submittals with a "G" designation;

submittals not having a "G" designation are for Contractor Quality Control approval. When used, a designation following the "G" designation identifies the office that will review the submittal for the Government .

Submit the following in accordance with Section 01 33 00 SUBMITTAL

PROCEDURES:

SD-01 Preconstruction Submittals

Device Account Lock Exception Request ; G

Multiple IP Connection Device Request ; G

Contractor Computer Cybersecurity Compliance Statements ; G

Contractor Temporary Network Cybersecurity Compliance Statements ; G

SD-02 Shop Drawings

User Interface Banner Schedule ; G

Network Communication Report ; G

Cybersecurity Riser Diagram ; G

Control System Inventory Report ; G

Cybersecurity Interconnection Schedule ; G

SD-03 Product Data

Control System Cybersecurity Documentation ; G

SD-07 Certificates

Cybersecurity Representative Certification of Qualifications; G

SECTION 25 05 11.23 Page 4

Software Licenses ; G

SD-11 Closeout Submittals

Password Summary Report ; G

Software Recovery And Reconstitution Images ; G

1.7 QUALITY CONTROL

1.7.1 Cybersecurity Representative

Provide a Cybersecurity Representative as the key person to implement and manage the cybersecurity related control systems of the project. Submit the Cybersecurity Representative's Certification of Qualifications in accordance with requirements in DoDD 8570/DoDD 8140 no later than 30 calendar days after Notice to Proceed. Submit one hard copy and an electronic copy.

The Cybersecurity Representative can serve across the entire contract for all Cybersecurity requirements and can be hired by the Prime Contractor.