W912QR23B0005_CUI_Specs-0005.pdf

CUI

ATTENTION

Use this space to indicate categories, limited dissemination controls, special instructions, points of contact, etc., if needed.

ATTENTION

All individuals handling this information are required to protect it from unauthorized disclosure.

Handling, storage, reproduction, and disposition of the attached document(s) must be in accordance with 32 CFR Part 2002 and applicable agency policy.

Access to and dissemination of Controlled Unclassified Information shall be allowed as necessary and permissible to any individual(s), organization(s), or grouping(s) of users, provided such access or dissemination is consistent with or in furtherance of a Lawful Government Purpose and in a manner consistent with applicable law, regulations, and Government-wide policies.

Standard Form 901 (11-18) Prescribed by GSA/ISOO | 32 CFR 2002

Certified Final

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

Solicitation W912QR23B0005 for construction of main gate at Youngstown Air Force Reserve Station, Ohio is hereby amended as follows:

See Continuation Page.

1. CONTRACT ID CODE PAGE OF PAGES

1 2

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street , County, State and Zip Code) X W912QR23B0005

X 9B. DATED (SEE ITEM 11)

14-Jul-2023

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

U0005

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3.EFFECTIVE

DATE

07-Sep-2023

CODE

U. S. ARMY ENGINEER DISTRICT, LOUISVILLE

600 DR. MARTIN LUTHER KING, JR. PLACE

ROOM 821

LOUISVILLE KY 40202-2239

W912QR 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

W912QR23B0005_CUI_Specs-0005

W912QR23B0005

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 30 - BLOCK 14 CONTINUATION PAGE (SF 30)

The following have been added by full text:

AMDT 0005 CONTINUATION PAGE

a. The following SPECIFICATION SECTION has been added.

25 05 11.02 CYBERSECURITY FOR FACILITY-RELATED CONTROL SYSTEMS – FIRE AND LIFE SAFETY

b. The Wage Decision OH20230001 has been revised (Dated 1 September 2023) and is hereby incorporated.

c. All other terms and conditions remain unchanged.

(End of Summary of Changes)

"General Decision Number: OH20230001 09/01/2023

Superseded General Decision Number: OH20220001

State: Ohio

Construction Types: Heavy and Highway

Counties: Ohio Statewide.

Heavy and Highway Construction Projects

Note: Contracts subject to the Davis-Bacon Act are generally required to pay at least the applicable minimum wage rate required under Executive Order 14026 or Executive Order 13658.

Please note that these Executive Orders apply to covered contracts entered into by the federal government that are subject to the Davis-Bacon Act itself, but do not apply to contracts subject only to the Davis-Bacon Related Acts, including those set forth at 29 CFR 5.l(a)(2)-(60).

If the contract is entered into on or after January 30, 2022, or the contract is renewed or extended (e.g., an option is exercised) on or after January 30, 2022:

If the contract was awarded on or between January 1, 2015 and January 29, 2022, and the contract is not renewed or extended on or after January 30, 2022:

Executive Order 14026 generally applies to the contract.

The contractor must pay all covered workers at least $16.20 per hour (or the applicable wage rate listed on this wage determination, if it is higher) for all hours spent performing on the contract in 2023.

Executive Order 13658 generally applies to the contract.

The contractor must pay all covered workers at least $12.15 per hour (or the applicable wage rate listed on this wage determination, if it is higher) for all hours spent performing on that contract in 2023.

The applicable Executive Order minimum wage rate will be adjusted annually. If this contract is covered by one of the Executive Orders and a classification considered necessary for performance of work on the contract does not appear on this wage determination, the contractor must still submit a conformance request.

Additional information on contractor requirements and worker protections under the Executive Orders is available at http://www.dol.gov/whd/govcontracts.

Modification Number

Publication Date 01/06/2023

02/03/2023

03/03/2023

SECTION 25 05 11.02

CYBERSECURITY FOR FACILITY-RELATED CONTROL SYSTEMS - FIRE AND LIFE SAFETY

05/21

PART 1 GENERAL

Many subparts in this Section contain text in curly braces ("{" and "}") indicating which cybersecurity control and control correlation identifier (CCI) the requirements of the subpart relate to. The text inside these curly braces is for Government reference only and enables coordination of the requirements of this Section with the RMF process throughout the design and construction process. Text in curly braces are not contractor requirements.

1.1 CONTROL SYSTEM APPLICABILITY

There may be multiple versions of this Section associated with this project.

Different versions have requirements applicable to different control systems. This specific Section applies only to the Fire Alarm/Mass Notification System.

Control System work is expected to be performed from Level 0 through 2 based on the control system diagram in section 2 of United Facility Criteria 4-010-06 Cybersecurity of Facility Related Control Systems. The integrator is responsible for securing the control system to the lowest practical point.

Securing includes disabling all unused ports, protocols and services all the way down to level 0 of the control system. If an exposed port or protocol cannot be disabled the integrator must employee a means to make the port or protocol inaccessbale without damaging the control system ie:

Locking Cover.

The control system as designed does not have traditional IT (computers, switches) as part of the design.

The Confidentiality, Integrity and Availibiity rating used for the purposes of design is as follows: Confidentiality: Low, Integrity: Moderate, and Availibility: Moderate.

The control system will communicate with a base wide Fire Alarm Reporting System and Wide Area Mass Notification System using radio broadcast for transport and communication. Refer to the Engineering Drawings for additional detail.

Amendment 0005

P2 473738 - Relocate Main Gate Youngstown Air Reserve Station, Ohio

CUI

Certified Final - Amendment 0005

1.2 RELATED REQUIREMENTS

This section does not contain sufficient requirements to procure a control system and must be used in conjunction with other Sections which specify control systems. This Section adds cybersecurity requirements to the control systems specified in other Sections, and as these requirements are conditioned on the control system being provided, there may be requirements in this Section that will not apply to this project. All Sections containing facility-related control systems or control system components are related to the requirements of this Section. Review all specification sections to determine related requirements.

In cases where a requirement is specified in both this Section and in another Section, the more stringent requirement must be met. In cases where a requirement in this Section conflicts with the requirements of another Section such that both requirements cannot be met at the same time, request direction from the Contracting Officer Representative to determine which requirement applies to the project.

1.3 REFERENCES

The publications listed below form a part of this specification to the extent referenced. The publications are referred to within the text by the basic designation only.

AMERICAN SOCIETY OF HEATING, REFRIGERATING AND AIR-CONDITIONING

ENGINEERS (ASHRAE)

ASHRAE 135 (2020; Interpretation 1-8 2021; Errata 1-2 2021; Addenda CD 2021; Addenda BY-CE 2022;

Interpretation 9-10 2022) BACnet—A Data Communication Protocol for Building Automation and Control Networks

INSTITUTE OF ELECTRICAL AND ELECTRONICS ENGINEERS (IEEE)

IEEE 802.1x (2010) Local and Metropolitan Area Networks - Port Based Network Access Control

INTERNET ENGINEERING TASK FORCE (IETF)

IETF RFC 2819 (2000) Remote Network Monitoring (RMON) Management Information Base (MIB)

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST)

NIST FIPS 140-2 (2001) Security Requirements for Cryptographic Modules

NIST FIPS 201-2 (2013) Personal Identity Verification (PIV) of Federal Employees and Contractors

U.S. DEPARTMENT OF DEFENSE (DOD)

DODI 8551.01 (2014) Ports, Protocols, and Services Management (PPSM)

P2 473738 - Relocate Main Gate Youngstown Air Reserve Station, Ohio

CUI

Certified Final - Amendment 0005

DTM 08-060 (2008) Policy on Use of Department of Defense (DoD) Information Systems - Standard Consent Banner and User Agreement

1.4 DEFINITIONS

1.4.1 Administrator Account

An administrator account is an account with full permissions to a device, application, or operating system, including the ability to create and modify other user accounts.

Note that the operating system Administrator Account may be different than Administrator Accounts for applications hosted on that operating system.

Also, most controllers will not have any support for accounts and will therefore not have an 'Aministrator Account'.

1.4.2 Controller

A device other than a computer or Ethernet switch. For Fire Protection systems this includes fire alarm control panels, remote operating consoles, and remote annunciators.

1.4.3 Mission Space

A device or media is in mission space if physical access to the device or media is controlled by the organization served by the device. For example, a VAV box controller in a suspended ceiling is in mission space if the VAV box serves that room; an electrical switchgear in an electrical room or an AHU in a mechanical room or on a rooftop may still be considered to be in mission space if the organization (mission) served by that switchgear or AHU controls access to the electrical room, mechanical room or rooftop.

1.4.4 Network

A network is a group of two or more devices that can communicate using a network protocol. Network protocols must provide a method for addressing devices on the network; a communication method that does not provide an addressing scheme is not a networked form of communication. Devices that communicate using a method of communication that does not support device addressing are not using a network.

1.4.5 Network Connected

A component is network connected (or "connected to a network") only when the device has a network transceiver which is directly connected to the network and implements the network protocol. A device lacking a network transceiver (and accompanying protocol implementation) can never be considered network connected. Note that (unlike many IT definitions of "Network Connected") a device connected to a non-IP network is still considered network connected (an IP connection or IP address is not required for a device to be network connected).

1.4.5.1 Wireless Network Connected

P2 473738 - Relocate Main Gate Youngstown Air Reserve Station, Ohio

CUI

Certified Final - Amendment 0005

Any device that supports wireless network communication is network connected to a wireless network, regardless of whether the device is communicating using wireless. Unless physically disabled, devices with wireless transceivers support wireless, it is not sufficient to disable the wireless in software.

1.4.6 Network Media

The thing that provides the communication channel between the devices on a network. Typically wire, but might include wireless, fiber optic, or even power line (some network protocols allow sending network signals over power wiring).

1.4.7 User Account Support Levels

The support for user accounts is categorized in this Section as one of three levels:

1.4.7.1 FULLY Supported

Device supports configurable individual accounts. Accounts can be created, deleted, modified, etc. Privileges can be assigned to accounts. These devices support user-based (as opposed to role-based) authentication.

1.4.7.2 MINIMALLY Supported

Device supports a small, fixed number of accounts (perhaps only one).

Accounts cannot be modified. A device with only a "User" and an "Administrator" account would fit this category. Similarly, a device with two PINs for logon - one for restricted and one for unrestricted rights would fit here (in other words, the accounts do not have to be the traditional "username and password" structure). These devices typically only support role-based authentication.

Examples of devices which MINIMALLY support accounts are a) a variable frequency drive with a single account which requires a PIN for access to configuration; and b) a room lighting control touchpad interface that has a single account.

1.4.7.3 NOT Supported

Device does not support any Access Enforcement therefore the whole concept of "account" is meaningless.

1.4.8 Manual Local Input

Manual Local Inputs are system analog or binary inputs that are adjustable by a person but are, by intrinsic hardware design, very limited in potential capabilities. Manual Local Inputs do not have touch screens or full keyboards, but may have a few buttons or dials to allow input. Manual Local Inputs do not have full graphic screens or dot-matrix displays, but may have simple lights (LEDs) or 7-segment displays. Manual Local Inputs do not have any sort of menu structure, each button has a single well-defined function.

Examples of Manual Local Inputs are H-O-A switches, simple thermostats, and disconnect switches.

P2 473738 - Relocate Main Gate Youngstown Air Reserve Station, Ohio

Certified Final - Amendment 0005

1.4.9 User Interface

A User Interface (UI) is something other than a Manual Local Input or Card Reader that allows a person to interact with the system or device. Note that while a Card Reader is not by itself a User Interface, a User Interface may contain a Card Reader in order for it to authenticate its user. Within control systems, there are a wide range of User Interfaces.

Two important distinctions are 1) whether the user interface is Local or Remote, and 2) the effective capabilities of the User Interface to alter data, which is the "privilege" of the user interface (where effective privilege available to a specific user at a specific user interface is the combination of the greatest privilege offered by the user interface and the specific account the user is logged into).

1.4.9.1 Local User Interface

A Local User Interface is a user interface where the physical hardware the user interacts with (keyboard, buttons, display, etc.) is physically part of the device being affected. All of the relevant characteristics of the user interface are embodied within a single device.

Note that a Local UI may be able to access data in a different device, Local versus Remote in this context refers to the user interface itself;

the capability to access data in a different device is covered under "Full User Interface".

1.4.9.2 Remote User Interface

A Remote User Interface implements a Client/Server model where the physical hardware the user interacts with (Client) is physically distinct from the device being affected (Server). Most or all of the security and functionality characteristics of the user interface are defined by the Server, not the Client. The Client and Server communicate via a network connection. A common example of a remote user interface is a web-based interface where the browser (client) is generally on different hardware than the web server (server). A Remote UI remains a Remote UI even if the user happens to be at a Client on the same hardware as the Server. What is important is that a) the Client may be on different hardware than the Server and b) the majority of the security and functional characteristics of the interface are defined at the Server.

Note that this definition of "remote" is consistent with that generally used in the control industry but is not aligned with the NIST 800-53 definition of "Remote", which refers to "outside the system". The term "Remote" here better aligns with the NIST 800-53 definition of "Network" (remote from within the system) Access.

1.4.9.3 Types of User Interface (by capability)

User interfaces are also categorized by their capabilities as being Read Only, Limited, or Full.

1.4.9.3.1 Read-Only User Interface

A Read Only User Interface (also referred to as a View-Only User Interface) is a user interface that only allows for reading data, it does not allow (have the capability to) modify data. A Read Only User Interface may be either Local or Remote. A User Interface that is configured to be Read Only (by some other means than the interface itself, such as using configuration software on a laptop) is a Read-Only Interface. Note a Read Only User Interface may have buttons (or touch screen, etc.) allowing the user to navigate through the presentation of data.

Examples of a Read Only User Interfaces are a) a publicly viewable "energy dashboard" showing weather data and energy usage within a building and b) digital wayfinding signage.

1.4.9.3.2 Limited User Interface

A Limited User Interface is a user interface that - by design - can only alter information local to the user interface. Note that the determination of "alter" includes only direct interactions, it explicitly excludes interactions that might occur as secondary effects. For example, an interface changing the flow setpoint in a pump controller is a direct interaction, the subsequent change in flow (as well as any subsequent downstream changes in valve position) are not direct interactions.

Two examples of LIMITED UIs are: a) a variable speed drive has a Limited Local User Interface which allows the user to change properties within the drive, but does not allow affecting things outside the drive; and b) a typical home WiFi Router has a Limited Remote User Interface which allows configuration of the Router, but does not allow direct interaction with other devices.

1.4.9.3.3 Full User Interface

A Full User Interface can alter information in devices outside the device with the user interface. For example, a typical Local Display Panel is a Full Local User Interface while a browser-based front end is a Full Remote User Interface.

1.4.9.3.4 View-Only User Interface

See Read-Only User Interface

1.4.9.4 Other User Interface Terminology

In addition to defining whether a user interface is a Hardware Limited, Read-Only, Limited or Full, and whether it is Local or Remote, user interfaces are classified by whether they are writable or privileged.

1.4.9.4.1 Writable User Interface

Any User Interface that is not Read-Only is Writable. (Limited User Interfaces and Full User Interfaces are both writable user interfaces (as they are capable of changing a value)).

1.4.9.4.2 Privileged User Interface

A Privileged UI is a UI that has sufficient capabilities or functionality that it requires specific cybersecurity measures to be put in place to limit its unauthorized use. Ultimately, whether a specific user interface is considered a Privileged User Interface must be determined by usage.

Unless otherwise specified, user interfaces can be determined to be privileged or not using the following:

a. Read-Only User Interfaces are not privileged user interfaces.

b. Full User interfaces for Fire Alarm Systems are privileged user interfaces as indicated and shown, or when another requirement of this Section establishes they are privileged. For all other systems, Full User Interfaces are privileged user interfaces.

c. User interfaces that allow for configuration of auditing or allows for modification or deletion of audit logs are privileged user interface.

d. User interfaces that allow for reprogramming a network connected device is a privileged user interface.

e. For Fire Protection Systems, User Interfaces that can inhibit or force the activation of a fire suppression system (e.g. such as for a pre-action or deluge system) are privileged user interfaces.

e. Except as specified above, a Limited User Interface must be determined to be privileged or not based on the specific capabilities and use case of the user interface. In general however, user interfaces that do not offer significant capabilities above and beyond those available at that location via other means (e.g. such as a disconnect switch, breaker, or hand-off-auto switch, or physical attack) are not privileged.

1.4.10 Wireless Network

Any network that communicates without using wires or fiber optics as the communication media. Wireless networks include: WiFi, Bluetooth, ZigBee, cellular, satellite, 900 MHz radio, 2.4 GHz, free space optical, point-to-point laser, and IR.

1.4.11 Wired Broadcast Network

Wired Broadcast Networks are any network, such as powerline carrier networks and modem (wired telephony), that use wire-based technologies where there is not a clearly defined boundary for signal propagation.

1.5 ADMINISTRATIVE REQUIREMENTS

1.5.1 Points of Contact

Coordinate with the following Points of Contact as indicated in this Section and as required. Not all projects will require coordination with all Points of Contact. When coordination is required and no Point of Contact is indicated, coordinate with the Contracting Office Representative (COR).

1.5.2 Coordination

Coordinate the execution of this Section with the execution of all other Sections related to control systems as indicated in the paragraph RELATED

REQUIREMENTS. Items that must be considered when coordinating project efforts include but are not limited to:

a. If requesting permission for alternate account lock permissions, the Device Account Lock Exception Request must be approved prior to control system device selection and installation.b. If requesting permission for the use of a device with multiple physical connections to IP networks, the Multiple IP Connection Device Request must be approved prior to control system device selection and installation.c. Wireless testing may be required as part of the control system testing. See requirements for the Wireless Communication Test Report submittal.

d. Cybersecurity testing support must be coordinated across control systems and with the Government cybersecurity testing schedule.

e. Passwords must be coordinated with the indicated contact for the project site.

f. Contractor Computer Cybersecurity Compliance Statements must be provided for each contractor using contractor owned computers.

1.6 SUBMITTALS

Government approval is required for submittals with a "G" or "S" classification. Submittals not having a "G" or "S" classification are for Contractor Quality Control approval. Submit the following in accordance with Section 01 33 00 SUBMITTAL PROCEDURES:

SD-01 Preconstruction Submittals

Device Account Lock Exception Request; G

Multiple Ethernet Connection Device Request; G[, [_____]] Contractor Computer Cybersecurity Compliance Statements; G

Contractor Temporary Network Cybersecurity Compliance Statements;G

Cybersecurity Subject Matter Expert Qualifications; G

SD-02 Shop Drawings

Network Communication Report; G

Cybersecurity Riser Diagram; G

SD-03 Product Data

Control System Cybersecurity Documentation; G

SD-06 Test Reports

Control System Cybersecurity Testing Procedures; G

Control System Cybersecurity Testing Report; G

SD-07 Certificates

Software Licenses; G

SD-11 Closeout Submittals

Password Change Summary Report; G

Enclosure Keys; G

Software and Configuration Backups; GSystem Maintenance Tool Software; G[, [_____]]

Control System Inventory Report; G

Integrity Verification Software; G

1.7 QUALITY CONTROL

1.7.1 Qualifications

For the positions listed below resumes should be submitted to the Government within 14 days after notice to proceed. All certifications must be in effect prior to being hired.

These positons may serve across the contract.

1.7.1.1 Cybersecurity Subject Matter Expert

The individual will be responsible for verifying all submittals of the integrator and overseeing any system cybersecurity hardening. This position requires that the individual currently meets Information Assurance Manager Level II Certification in accordance with DoDI 8570 Information Workforce Improvement Program and DoDI 8140 Cyberspace Workforce Improvement Program.

Individuals for this position should have experience securing DoD Systems and with Risk Management Framework. Control System Experiece is required.

1.8 CYBERSECURITY DOCUMENTATION

{For Government Reference Only: This subpart (and its subparts) relates to

PL-7; CCI-003071}

1.8.1 Network Communication Report

{For Government Reference Only: This subpart (and its subparts) relates to

CA-9, PL-8; CCI-003075; CCI-002102, CCI-002103, CCI-002104, CCI-002105,

CCI-003072, CCI-003073, CCI-003075 and also the submittal requirements associated with CM-6, CM-7, SC-8 and SC-41 including CM-7(3), CCI-000388.}

Provide a network communication report. For each networked device, document the communication characteristics of the device including communication protocols, services used, encryption employed, and a general description of what information is communicated over the network. For each device using IP, document all TCP and UDP ports used. For non-IP communications, document communication protocol and media used. If other control system Sections used on this project include submittals documenting this information, provide copies of those submittals to meet this requirement.

In addition to the requirements of Section 01 33 00 SUBMITTAL PROCEDURES, provide the Network Communication Report as an editable Microsoft Excel file.

1.8.2 Control System Inventory Report

{For Government Reference Only: This subpart (and its subparts) relates to CM-8(a), SI-17, IA-3; CCI-000389, CCI-000392, CCI-000398, CCI-002773, CCI-002774, CCI-002775, CCI-000777, CCI-000778, CCI-001958}

Provide a Control System Inventory report using the Inventory Spreadsheet listed under this Section at https://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/ufgs-25-05-11 documenting all devices, including networked devices, network infrastructure devices, non-networked devices, input devices (e.g. sensors) and output devices (e.g. actuators). For each device provide all applicable information for which there is a field on the spreadsheet in accordance with the instructions on the spreadsheet.

In addition to the requirements of Section 01 33 00 SUBMITTAL PROCEDURES, provide the Control System Inventory Report as an editable Microsoft Excel file.

1.8.3 Software and Configuration Backups

{For Government Reference Only: This subpart (and its subparts) relates to

CP-10; CCI-000550, CCI-000551, CCI-000552}

For all controllers, provide a backup of the controller configuration and the source code for all loaded application programs (all software that is not common to every controller of the same manufacturer and model).

For each control device on which software is installed under this project and the device has the ability, rovide a recovery image of the final as-built.

If any or all of these are provided under another Section, provide documentation indicating this and referencing those submittals. The intent is to provide the ability to restore the devices back to their original as-built state.

1.8.4 Cybersecurity Riser Diagram

{For Government Reference Only: This subpart (and its subparts) relates to PL-2(a), PL-8; CCI-003051, CCI-003053, CCI-003072, CCI-003073, CCI-003075}

Provide a cybersecurity riser diagram of the complete control system including all network and device hardware. If the control system specifications require a riser diagram submittal, provide a copy of that submittal as the cybersecurity riser diagram. Otherwise, provide a riser diagram in one-line format.

1.8.5 Control System Cybersecurity Documentation

{For Government Reference Only: This subpart (and its subparts) relates to SA-5 (a),(b),(c); CCIs: CCI-003124, CCI-003125, CCI-003126, CCI-003127, CCI-003128, CCI-003129, CCI-003130, CCI-003131}

Provide a Control System Cybersecurity Documentation submittal containing the indicated information for each device and software application.

1.8.5.1 Default Requirements for Control System Devices

For control system devices where Control System Cybersecurity Documentation requirements are not otherwise indicated in this Section, provide:

a. Documentation that describes secure configuration of the device {For Government Reference Only: relates to CCI-003124}

b. Documentation that describes secure installation of the device {For Government Reference Only: relates to CCI-003125}

c. Documentation that describes secure operation of the device {For Government Reference Only: relates to CCI-003124}

d. Documentation that describes effective use and maintenance of security functions or mechanisms for the device {For Government Reference Only:

relates to CCI-003127}

e. Documentation that describes known vulnerabilities regarding configuration and use of administrative (i.e. privileged) functions for the device {For Government Reference Only: relates to CCI-003128}

f. Documentation that describes user-accessible security functions or mechanisms in the device and how to effectively use those security functions or mechanisms {For Government Reference Only: relates to

CCI-003129}

g. Documentation that describes methods for user interaction which enables individuals to use the device in a more secure manner {For Government Reference Only: relates to CCI-003130}

h. Documentation that describes user responsibilities in maintaining the security of the device {For Government Reference Only: relates to

CCI-003131}

1.9 SOFTWARE LICENSING

{For Government Reference Only: This subpart (and its subparts) relates to SI-2(a), SI-2(c), SI-7(14); CCI-001227, CCI-002605, CCI-002737}

For all software provided that has not already been licensed to the government or project site, provide a license to the project site for a period of no less than 5 years, and the license must also include the following software updates:

a. Security and bug-fix patches issued by the software manufacturer.

b. Security patches to address any vulnerability identified in the National Vulnerability Database at http://nvd.nist.gov with a Common Vulnerability Scoring System (CVSS) severity rating of MEDIUM or higher.

Provide a single Software Licenses submittal with documentation of the software licenses for all software provided

1.10 CYBERSECURITY DURING CONSTRUCTION

{For Government Reference Only: This subpart (and its subparts) relates to

AC-18, SA-3; CCI-000258}

In addition to the control system cybersecurity requirements indicated in this section, meet following requirement throughout the construction process.

1.10.1 Contractor Computer Equipment

Contractor owned computers may be used for construction. Contractor computers connected to the control system, control system network, or a control system component at any point during construction must meet the following requirements:

1.10.1.1 Operating System

The operating system must be an operating system currently supported by the manufacturer of the operating system. The operating system must be current on security patches and operating system manufacturer required updates.

1.10.1.2 Anti-Malware Software

The computer must run anti-malware software from a reputable software manufacturer. Anti-malware software must be a version currently supported by the software manufacturer, must be current on all patches and updates, and must use the latest definitions file. Computers used on this project must be scanned using the installed software at least once per day.

1.10.1.3 Passwords and Passphrases

The passwords and passphrases for computers, applications, and web-based applications supporting passwords must be changed from their default values. Passwords must be a minimum of eight characters with a minimum of one uppercase letter, one lowercase letter, one number and one special character.

1.10.1.4 User-Based Authentication

Each user must have a unique account; sharing of a single account between multiple users is prohibited.

1.10.1.5 Demonstration of Compliance

The Government has the right to require demonstration of computer compliance with these requirements at any time during the project.

1.10.1.6 Contractor Computer Cybersecurity Compliance Statements

Provide a single submittal containing completed Contractor Computer Cybersecurity Compliance Statements for each company using contractor owned computers. Contractor Computer Cybersecurity Compliance Statements must use the template published at https://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/ufgs-25-05-11.

Each Statement must be signed by a cybersecurity representative for the relevant company.

1.10.2 Temporary IP Networks

Temporary contractor-installed IP networks may be used during construction.

When used, temporary contractor-installed IP networks connected to the control system, control system network, or a control system component at any point during construction must meet the following requirements:

1.10.2.1 Network Boundaries and Connections

The network must not extend outside the project site and must not connect to any IP network other than those specifically provided or furnished for this project. Any and all access to the network from outside the project site is prohibited.

1.10.3 Government Access to Network

Government personnel must be allowed to have complete and immediate access to the network at any time in order to verify compliance with this specification.

1.10.4 Temporary Wireless IP Networks

In addition to the other requirements on temporary IP networks, temporary wireless IP (WiFi) networks, when permitted, must not interfere with existing wireless networks, must use WPA2 security and must not broadcast the network name (SSID). Network names (SSID) for wireless networks must be changed from their default values.

1.10.5 Passwords and Passphrases

The passwords and passphrases for all network devices and network access must be changed from their default values. Passwords must be a minimum 8 characters with a minimum of one uppercase letter, one lowercase letter, one number and one special character.

1.10.6 Contractor Temporary Network Cybersecurity Compliance Statements

Provide a single submittal containing completed Contractor Temporary Network Cybersecurity Compliance Statements for each company implementing a temporary IP network. Contractor Temporary Network Cybersecurity Compliance Statements must use the template published at https://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/ufgs-25-05-11.

Each Statement must be signed by a cybersecurity representative for the relevant company. If no temporary IP networks will be used, provide a single copy of the Statement indicating this.

1.11 CYBERSECURITY DURING WARRANTY PERIOD

All work performed on the control system after acceptance must be performed using Government Furnished Equipment or equipment specifically and individually approved by the Government.

PART 2 PRODUCTS

All products used on this project must meet the indicated requirements, but not all products specified here will be required by every project.

2.1 DAISY CHAIN IP CONTROLLERS

Controllers used as Daisy Chain IP Controllers must be IP controllers with exactly two Ethernet network connections and basic built-in switch capabilities to allow implementation of an Ethernet network in a daisy chain architecture. Switches incorporated by Daisy Chain IP Controllers are not required to meet the requirements for Ethernet Switches as defined in this Section.

PART 3 EXECUTION

3.1 CYBERSECURITY HARDENING AND CONFIGURATION GUIDES

Install, configure, and harden all hardware and software furnished on this project in accordance with manufacturer provided documentation, procedures, or methods for secure configuration or installation. Do not implement specific hardening actions if that action would conflict with requireed functionality or another requirement of this Section.

3.2 NETWORK REQUIREMENTS

3.2.1 Wireless and Wired Broadcast Communication for Fire Protection Systems

The use of wireless and wired broadcast communication for fire protection systems within a facility is prohibited. Wireless communication may be used to provide communication from the fire protection system in a facility to the central monitoring station.

3.2.2 Non-IP Control Networks

When control system specifications require particular communication protocols, use only those communication protocols and only as specified.

Do not implement any other communication protocol.

When control system specifications do not indicate requirements for communication protocols, use only those protocols required for operation of the system as specified.

3.3 ACCESS CONTROL REQUIREMENTS

3.3.1 User Accounts

{For Government Reference Only: This subpart (and its subparts) relate to AC-2(a), AC-3, AC-6(1), AC-6(10), AC-6(2), AC-6(9), CM-11(2), and IA-2;

CCI-002110, CCI-000213, CCI-002235, CCI-001558, CCI-002221, CCI-002222,

CCI-002223, CCI-002235, CCI-000039, CCI-001419, CCI-002234, CCI-001812, and CCI-000764. For MODERATE Impact systems, this subpart (and its subparts) also relate to AC-2 (2), AC-2(3), AC-2(4), AC-6(1), and CM-5(1);

CCI-001361, CCI-000017, CCI-000217, CCI-000018, CCI-001403, CCI-001404,

CCI-001405, CCI-002130, CCI-001683, CCI-001684, CCI-001685, CCI-001686,

CCI-002132, CCI-001558, CCI-002221, CCI-002222, CCI-002223, CCI-001813.}

Any user interface supporting user accounts (either FULLY or MINIMALLY) must limit access according to specified limitations for each account.

All user interfaces FULLY supporting accounts must implement user-based authentication where each account is uniquely assigned to a specific user.

User interfaces FULLY supporting accounts must implement at least three (3) levels of user account privilege including: 1) an account with read-only permissions 2) an account with full permissions including account creation and modification and 3) an account with greater permissions than read-only but without account creation and modification.

3.3.1.1 Controllers

For user interfaces provided by controllers, provide access control in accordance with the User Interface Requirements table for the applicable control system and user interface type.

a. For table entries of "NA": NA means Not Applicable, there are no interfaces in this category.

b. For table entries of "None Required": The user interface is not required to support user accounts.

c. For table entries of "MINIMALLY": The user interface must at least MINIMALLY support user accounts.

d. For table entries of "FULLY": The user interface must at FULLY support user accounts.

e. For table entries of "KEY": The user interface must have physical security in the form of either a key lock on the interface itself or be furnished inside a locked enclosure. Where this is required for a read only interface, this lock must prevent viewing of data on the interface; for other interfaces, this lock must prevent using the interface to alter data.

f. For table entries of "Physical Security": For Local FULL interfaces, the interface must be located inside mission space. For Local Limited (not FULL) interfaces, the user interface must either a) be located within mission space or b) be protected by physical security at least as good as the control devices (and equipment controlled by the control devices) affected by the interface. For purposes of this requirement, 'affected' includes controllers with data that can be directly altered by the interface, as well as mechanical and/or electrical equipment directly controlled by those controllers, but does not include other interactions.

g. Entries of the form "X and Y" must meet both the requirement indicated for X and the requirement indicated for Y. For example, an entry of "MINIMALLY and Physical Security" indicates the user interface must both MINIMALLY support accounts and have physical security.

h. Entries of the form "X or Y" must meet either the requirement indicated for X or the requirement indicated for Y.

3.3.1.1.1 Fire Protection Systems

User Interface Requirements for MODERATE Impact Fire Protection Systems

User Interface Type Access Control Requirement (See note 2)

Local Read Only None Required

Local Limited, Non-privileged None Required

Local Limited, Privileged KEY

Local Full KEY

Remote Read Only NA

Remote Limited, Non-Privileged NA

Remote Limited, Privileged

AND

Remote Full

NA

Notes:

1)Local Read Only User Interfaces are always Non-Privileged 2)Devices outside mission space require physical security protections as indicated (in "PHYSICAL SECURITY IN MODERATE IMPACT SYSTEMS")

3.3.2 System Use Notification

{For Government Reference Only: This subpart (and its subparts) relates to

AC-8; CCI-000048, CCI-002247, CCI-002243, CCI-002244, CCI-002245,

CCI-002246, CCI-000050, CCI-002248}

3.3.2.1 System Use Notification for Remote User Interfaces

Remote user interfaces must display a warning banner meeting the requirements of DTM 08-060 on screen.

3.3.2.2 System Use Notification for Local User Interfaces

Devices which are connected to a network and have a local user interface must display a warning banner meeting the requirements of DTM 08-060 on the user interface screen if capable of doing so and must have a permanently affixed label with an approved banner from DTM 08-060 if unable to display the warning banner on the screen. Where it is impractical (perhaps due to device size) to affix the label to the device, affix the label to the device enclosure.

Labels must be machine printed or engraved, plastic or metal, designed for permanent installation, must use a font no smaller than 14 point, and must provide a high contrast between font and background colors.

3.3.3 Session Lock and Session Termination Requirements In MODERATE Impact Systems:

{For Government Reference Only: This subpart (and its subparts) relates to AC-11(a), AC-11(b), AC-11(1), AC-12, SC-10; AC-10; CCI-000058, CCI-000059, CCI-000056, CCI-000057, CCI-000060, CCI-002360, CCI-002361, CCI-001133, CCI-001134, CCI-000054, CCI-000055, CCI-002252}

3.3.3.1 Session Termination

When session termination is required for a User Interface, the User Interface must implement session termination a) based on manual initiation, or b) based on lack of activity, or c) based on either manual initiation or lack of activity, as indicated.

Session Termination must result in logging out the user. A logged out User Interface may only perform actions as indicated in the "Permitted Actions Without Identification or Authentication" subpart of this Section or display a publicly viewable image or blank screen. User Interfaces must remain logged out (session terminated) until a user enters correct authentication information, which must initiate a new session.

3.3.4 Permitted Actions Without Identification or Authentication

{For Government Reference Only: This subpart (and its subparts) relates to

AC-14; CCI-000061, CCI-000232}

The control system must require identification and authentication before allowing any actions by a user acting from a user interface which MINIMALLY or FULLY supports accounts.

3.3.5 Pysical Security in MODERATE Impact Systems

{For Government Reference Only: This subpart relates to PE-3(1), PE-4, PE-5, SC-7(a), SC-7(c), SC-8, SC-8(1); CCI-000928, CCI-002926, CCI-000936, CCI-002930, CCI-002931, CCI-000937, CCI-001097, CCI-001109, CCI-002418, CCI-002419, CCI-002421.}

3.3.5.1 Physical Security for Media

3.3.5.1.1 Physical Security for Media Inside Mission Space

Install all non-IP network media located inside of the mission space in conduit. Install all IP network media located inside of the mission space in intermediate metallic conduit.

3.3.5.1.2 Physical Security for Media Outside Mission Space

Install all network media (both IP and non-IP) located outside of the mission space in rigid metallic conduit.

3.3.5.1.3 Physical Security for Non-Network Media in Fire Protection Systems

For Fire Supression Systems which can be be inhibited or forced to activate by manipulation of non-network wiring, install all non-network media outside of mission space, including analog and binary instrumentation wiring and power wiring, in rigid metallic conduit.

3.3.5.2 Physical Security for Devices

Install all devices (computers and controllers) which are located outside of mission space in lockable enclosures. (Recall that per definition of mission space, a room controlled by the mission is mission space regardless of whether it is contiguous with other mission space.)

Install all controllers connected to an IP network in lockable enclosures (both inside and outside of mission space).

3.3.5.2.1 Physical Security for Devices in Fire Protection Systems

For Fire Supression systems with a release panel, install all components of the supression system either inside mission space, or within locked enclosures. Components of these systems include: release panel, any relay or interface panels, analog and binary inputs or outputs, control valves, manual valves.

3.3.5.3 Physical Security for User Interfaces

Physical security requirements for User Interfaces are specified in the preceeding paragraphs of this Section.

3.3.6 Enclosures

Prior to final acceptance of the sytsem, lock all lockable enclosures.

Submit an Enclosure Keys submittal with all copies of keys for all enclosures and a key inventory list documenting all keys. Label each key with the matching enclosure identifier.

3.4 USER IDENTIFICATION AND AUTHENTICATION

{For Government Reference Only: This subpart (and its subparts) relates to IA-2, IA-2(1),IA-2(12), IA-5 IA-5(b), IA-5(c), IA-5(e), IA-5(g), IA-5(1), IA-5(11); CCI-000764, CCI-000765, CCI-001953, CCI-001954, CCI-001544, CCI-001989, CCI-000182, CCI-001610, CCI-000192, CCI-000193, CCI-000194, CCI-000205, CCI-001619, CCI-001611, CCI-001612, CCI-001613, CCI-001614, CCI-000195, CCI-001615, CCI-000196, CCI-000197, CCI-000199, CCI-000198, CCI-001616, CCI-001617, CCI-000200, CCI-001618, CCI-002041, CCI-002002, CCI-002003. For MODERATE Impact systems, this subpart also relates to AC-6

(1), AC-6(10), AC-6(2), AC-6(9)IA-2(4), IA-5(13); CCI-001558, CCI-002221,

CCI-002222, CCI-002223, CCI-002235, CCI-000039, CCI-001419, CCI-002234,

CCI-000768, CCI-002007.}

3.4.1 User Identification and Authentication for All System Types

Unless otherwise indicated, all user interfaces supporting accounts (either FULLY or MINIMALLY) must implement Identification and Authorization via passwords.

3.4.2 User Identification and Authentication for Specific System Types

System specific requirements are in addition to and supersede those indicated for all system types. When no additional requirements are indicated for a specific system type the requirements for all systems still apply to that system type.

3.4.3 User Identification and Authentication for Specific Devices

There are no additional device specific user interface requirements.

3.4.4 Implementation of Identification and Authorization Requirements

Identification and Authorization must be met by : Direct implementation in the user interface.

3.4.5 Password-Based Authentication Requirements

3.4.5.1 Passwords for Controllers FULLY Supporting Accounts

All controllers FULLY supporting accounts and supporting password-based authentication must enforce the following requirements:

a. Minimum password length of twelve (12) characters

b. Password must contain at least one uppercase character.

c. Password must contain at least one lowercase character.

d. Password must contain at least one numeric character.

e. Password must contain at least one special character. The list of supported special characters must include at least 4 separate characters.

f. Password must have a maximum lifetime of sixty (60) days. When passwords expire, prompt users to change passwords. Do not lock accounts due to expired passwords.

g. Password must differ from previous five (5) passwords, where differ is defined as changing at…