W912QR24R0003_Specs_Vol3-0000.pdf

Solicitation For Collective Training Officers Quarters, Ft. McCoy, WI

P2: 501939 (West)/510301 (East)

Design-Bid-Build

Specifications - Vol. 3 of 3 (DIV 25 - 33) Certified Final Design

05 March 2024

W912QR24R0003

ARIMS: 200A Disposition: Maintain for 15yrs after construction.

W912QR24R0003_Specs_Vol3-0000

P2 501939 & P2 510301 COLLECTIVE TRAINING OFFICERS QUARTERS

Fort McCoy, WI

PROJECT TABLE OF CONTENTS

DIVISION 00 - PROCUREMENT AND CONTRACTING REQUIREMENTS

00 80 00.00 06 04/21 SPECIAL PROVISIONS

DIVISION 01 - GENERAL REQUIREMENTS

01 32 01.00 06 07/18 PROJECT SCHEDULE

01 33 00 08/18 SUBMITTAL PROCEDURES

01 33 29.00 06 11/17 SUSTAINABILITY REPORTING

01 35 26.00 06 GOVERNMENT SAFETY REQUIREMENTS

01 42 00 02/19 SOURCES FOR REFERENCE PUBLICATIONS

01 45 00.15 10 11/16, CHG 2: 08/19 RESIDENT MANAGEMENT SYSTEM CONTRACTOR

MODE (RMS CM)

01 45 04.10 06 CONTRACTOR QUALITY CONTROL

01 45 35 11/20 SPECIAL INSPECTIONS

01 46 00.00 06 04/20 TOTAL BUILDING COMMISSIONING

01 50 00 11/20 TEMPORARY CONSTRUCTION FACILITIES AND

CONTROLS

01 57 19.00 06 04/20 TEMPORARY ENVIRONMENTAL CONTROLS AND

PERMITS

01 74 19 02/19, CHG 1: 08/20 CONSTRUCTION WASTE MANAGEMENT AND

DISPOSAL

01 78 23 08/15, CHG 1: 11/20 OPERATION AND MAINTENANCE DATA

DIVISION 02 - EXISTING CONDITIONS

02 41 00 08/22 DEMOLITION

02 43 00 05/10, CHG 2: 02/19 STRUCTURES MOVING AND ASSOCIATED

DEMOLITION

DIVISION 03 - CONCRETE

03 30 00 02/19, CHG 3: 11/21 CAST-IN-PLACE CONCRETE

DIVISION 04 - MASONRY

04 20 00 11/15, CHG 2: 05/19 UNIT MASONRY

DIVISION 05 - METALS

05 05 23.16 08/18 STRUCTURAL WELDING

05 12 00 08/18, CHG 2: 05/21 STRUCTURAL STEEL

05 21 00 05/15, CHG 1: 08/18 STEEL JOIST FRAMING

05 30 00 05/15, CHG 2: 08/18 STEEL DECKS

05 40 00 05/15, CHG 1: 08/18 COLD-FORMED METAL FRAMING

05 50 13 05/17, CHG 1: 08/18 MISCELLANEOUS METAL FABRICATIONS

05 51 00 02/17 METAL STAIRS

05 51 33 02/16, CHG 2: 02/18 METAL LADDERS

05 52 00 02/18 METAL RAILINGS

DIVISION 06 - WOOD, PLASTICS, AND COMPOSITES

06 10 00 08/16, CHG 2: 11/18 ROUGH CARPENTRY

06 41 16.00 10 08/10, CHG 1: 11/18 PLASTIC-LAMINATE-CLAD ARCHITECTURAL

CABINETS

06 61 16 08/20 SOLID SURFACING FABRICATIONS

PROJECT TABLE OF CONTENTS Page 1

CERTIFIED FINAL

TABLE OF CONTENTS VOLUME 1 OF 3

TABLE OF CONTENTS VOLUME 2 OF 3

DIVISION 07 - THERMAL AND MOISTURE PROTECTION

07 05 23 08/19 PRESSURE TESTING AN AIR BARRIER SYSTEM

FOR AIR TIGHTNESS

07 13 53 02/16, CHG 1: 08/17 ELASTOMERIC SHEET WATERPROOFING

07 21 13 02/16, CHG 2: 08/20 BOARD AND BLOCK INSULATION

07 21 16 11/11 SOUND INSULATION

07 27 10.00 10 08/19, CHG 1: 02/20 BUILDING AIR BARRIER SYSTEM

07 27 19.01 05/17, CHG 2: 08/20 SELF-ADHERING AIR BARRIERS

07 27 26 05/17, CHG 2: 08/20 FLUID-APPLIED MEMBRANE AIR BARRIERS

07 27 36 05/17, CHG 2: 08/20 SPRAY FOAM INSULATION

07 60 00 05/17, CHG 2: 11/18 FLASHING AND SHEET METAL

07 61 14.00 20 08/16, CHG 1: 08/18 STEEL STANDING SEAM ROOFING

07 84 00 05/10, CHG 1: 08/13 FIRESTOPPING

07 92 00 08/16, CHG 3: 11/18 JOINT SEALANTS

DIVISION 08 - OPENINGS

08 11 13 08/20 STEEL DOORS AND FRAMES

08 11 16 05/17, CHG 2: 11/18 ALUMINUM DOORS AND FRAMES

08 31 00 05/17, CHG 1: 08/18 ACCESS DOORS AND PANELS

08 51 13 05/19 ALUMINUM WINDOWS

08 71 00 02/16, CHG 3: 08/20 DOOR HARDWARE

08 81 00 05/19 GLAZING

08 91 00 08/20 METAL WALL LOUVERS

DIVISION 09 - FINISHES

09 22 00 02/10, CHG 2: 08/18 SUPPORTS FOR PLASTER AND GYPSUM BOARD

09 29 00 08/16, CHG 4: 02/20 GYPSUM BOARD

09 30 10 08/20 CERAMIC, QUARRY, AND GLASS TILING

09 51 00 08/20 ACOUSTICAL CEILINGS

09 62 38 08/17, CHG 1: 08/18 STATIC-CONTROL FLOORING

09 65 00 08/10, CHG 3: 08/18 RESILIENT FLOORING

09 90 00 02/21 PAINTS AND COATINGS

DIVISION 10 - SPECIALTIES

10 11 00 08/20 VISUAL DISPLAY UNITS

10 14 00.20 08/20 INTERIOR SIGNAGE

10 26 00 08/20 WALL AND DOOR PROTECTION

10 28 00.00 48 04/06 TOILET AND BATH ACCESSORIES

DIVISION 12 - FURNISHINGS

12 21 00 08/17, CHG 2: 11/18 WINDOW BLINDS

DIVISION 14 - CONVEYING EQUIPMENT

14 24 23 05/16 HYDRAULIC PASSENGER ELEVATORS

DIVISION 21 - FIRE SUPPRESSION

21 12 00 05/11 STANDPIPE SYSTEMS

21 13 13 08/20 WET PIPE SPRINKLER SYSTEMS, FIRE

PROTECTION

DIVISION 22 - PLUMBING

PROJECT TABLE OF CONTENTS Page 2

CERTIFIED FINAL

22 00 00 11/15, CHG 4: 05/21 PLUMBING, GENERAL PURPOSE

DIVISION 23 - HEATING, VENTILATING, AND AIR CONDITIONING (HVAC)

23 05 93.00 06 08/16 TESTING, ADJUSTING, AND BALANCING

(TAB) OF HVAC

23 07 00 02/13, CHG 7: 05/20 THERMAL INSULATION FOR MECHANICAL

SYSTEMS

23 09 00 02/19 INSTRUMENTATION AND CONTROL FOR HVAC

23 09 13 11/15 INSTRUMENTATION AND CONTROL DEVICES

FOR HVAC

23 09 23.02 02/19 BACNET DIRECT DIGITAL CONTROL FOR HVAC

AND OTHER BUILDING CONTROL SYSTEMS

23 11 25 11/08 FACILITY GAS PIPING

23 23 00 08/21 REFRIGERANT PIPING

23 30 00 05/20 HVAC AIR DISTRIBUTION

23 52 00 04/08, CHG 5: 11/19 HEATING BOILERS

23 64 10 11/16, CHG 2: 08/18 WATER CHILLERS, VAPOR COMPRESSION TYPE

23 64 26 08/09, CHG 5: 11/19 CHILLED, CHILLED-HOT, AND CONDENSER

WATER PIPING SYSTEMS

23 81 00 05/18, CHG 1: 02/21 DECENTRALIZED UNITARY HVAC EQUIPMENT

DIVISION 25 - INTEGRATED AUTOMATION

25 05 11.01 05/21 CYBERSECURITY FOR FACILITY-RELATED

CONTROL SYSTEMS - FIRE ALARM

25 05 11.02 05/21 CYBERSECURITY FOR FACILITY-RELATED

CONTROL SYSTEMS - HVAC

DIVISION 26 - ELECTRICAL

26 08 00 11/21 APPARATUS INSPECTION AND TESTING

26 20 00 08/19, CHG 3: 11/21 INTERIOR DISTRIBUTION SYSTEM

26 24 13 08/21 SWITCHBOARDS

26 28 01.00 10 08/21 COORDINATED POWER SYSTEM PROTECTION

26 29 23 02/20, CHG 1: 05/21 ADJUSTABLE SPEED DRIVE (ASD) SYSTEMS

UNDER 600 VOLTS

26 41 00 11/13 LIGHTNING PROTECTION SYSTEM

26 51 00 05/20, CHG 2: 11/21 INTERIOR LIGHTING

26 56 00 08/21 EXTERIOR LIGHTING

DIVISION 27 - COMMUNICATIONS

27 05 14.00 10 04/06 CABLE TELEVISION PREMISES DISTRIBUTION

SYSTEM

27 05 28.36 48 04/20 CABLE TRAYS FOR COMMUNICATIONS SYSTEMS

27 10 00.00 48 10/20 BUILDING TELECOMMUNICATIONS CABLING

SYSTEM

DIVISION 28 - ELECTRONIC SAFETY AND SECURITY

28 31 76 08/20 INTERIOR FIRE ALARM AND MASS

NOTIFICATION SYSTEM, ADDRESSABLE

DIVISION 31 - EARTHWORK

31 00 00.00 06 07/18 EARTHWORK

31 05 19.13 02/21 GEOTEXTILES FOR EARTHWORK

PROJECT TABLE OF CONTENTS Page 3

CERTIFIED FINAL

TABLE OF CONTENTS VOLUME 3 OF 3

DIVISION 32 - EXTERIOR IMPROVEMENTS

32 01 19.61 11/19 SEALING OF JOINTS IN RIGID PAVEMENT

32 11 23 05/22 AGGREGATE BASE COURSE

32 11 23.23 08/22 BASE COURSE DRAINAGE LAYERS

32 13 13.06 06 06/18 PORTLAND CEMENT CONCRETE PAVEMENT FOR

ROADS AND SITE FACILITIES

32 15 00 05/17 AGGREGATE SURFACING

32 16 19 05/18 CONCRETE CURBS, GUTTERS AND SIDEWALKS

32 17 23 08/16, CHG 5: 11/18 PAVEMENT MARKINGS

32 31 26 11/21 WIRE FENCES AND GATES

32 92 19 08/17, CHG 1: 08/21 SEEDING

DIVISION 33 - UTILITIES

33 05 23.13 11/19 UTILITY HORIZONTAL DIRECTIONAL DRILLING

33 11 00 02/18, CHG 1: 02/22 WATER UTILITY DISTRIBUTION PIPING

33 30 00 05/18 SANITARY SEWERAGE

33 40 00 11/21 STORMWATER UTILITIES

33 46 16 05/18 SUBDRAINAGE PIPING

33 71 02 02/15 UNDERGROUND ELECTRICAL DISTRIBUTION

33 82 00.00 48 04/20 TELECOMMUNICATIONS OUTSIDE PLANT (OSP)

-- End of Project Table of Contents --

PROJECT TABLE OF CONTENTS Page 4

SECTION TABLE OF CONTENTS

DIVISION 25 - INTEGRATED AUTOMATION

SECTION 25 05 11.01

CYBERSECURITY FOR FACILITY-RELATED CONTROL SYSTEMS - FIRE ALARM

05/21

PART 1 GENERAL

1.1 CONTROL SYSTEM APPLICABILITY

1.2 RELATED REQUIREMENTS

1.3 REFERENCES

1.4 DEFINITIONS

1.4.1 Administrator Account

1.4.2 Computer

1.4.3 Controller

1.4.4 Mission Space

1.4.5 Network

1.4.6 Network Connected

1.4.7 Network Media

1.4.8 User Interface

1.4.8.1 Local User Interface

1.4.8.2 Remote User Interface

1.4.8.3 Types of User Interface (by capability)

1.4.8.4 Other User Interface Terminology

1.4.8.4.1 Full User Interface

1.4.8.4.2 Privileged User Interface

1.4.9 Wireless Network

1.5 ADMINISTRATIVE REQUIREMENTS

1.5.1 Points of Contact

1.5.2 Coordination

1.6 SUBMITTALS

1.7 QUALITY CONTROL

1.7.1 Control System Cybersecurity Subject Matter Expert

1.8 CYBERSECURITY DOCUMENTATION

1.8.1 Proposed STIG and SRG Applicability Report

1.8.2 Network Communication Report

1.8.3 Control System Inventory Report

1.8.4 Software and Configuration Backups

1.8.5 Cybersecurity Riser Diagram

1.8.6 STIG, SRG and Vendor Guide Compliance Result Report

1.8.7 Control System Cybersecurity Documentation

1.8.7.1 Default Requirements for Control System Devices

1.9 SOFTWARE LICENSING

1.10 CYBERSECURITY DURING CONSTRUCTION

1.10.1 Contractor Computer Equipment

1.10.1.1 Operating System

1.10.1.2 Anti-Malware Software

1.10.1.3 Passwords and Passphrases

1.10.1.4 User-Based Authentication

1.10.1.5 Demonstration of Compliance

1.10.1.6 Contractor Computer Cybersecurity Compliance Statements

1.10.2 Temporary IP Networks

SECTION 25 05 11.01 Page 1

1.10.2.1 Network Boundaries and Connections

1.10.3 Government Access to Network

1.10.4 Temporary Wireless IP Networks

1.10.5 Passwords and Passphrases

1.10.6 Contractor Temporary Network Cybersecurity Compliance

Statements

1.11 CYBERSECURITY DURING WARRANTY PERIOD

PART 2 PRODUCTS

PART 3 EXECUTION

3.1 CYBERSECURITY HARDENING AND CONFIGURATION GUIDES

3.2 NETWORK REQUIREMENTS

3.2.1 Information Flow Enforcement In MODERATE Impact Systems

3.2.2 Wireless and Wired Broadcast Communication for Fire Protection

Systems

3.2.3 Non-IP Control Networks

3.2.4 IP Control Networks

3.2.4.1 IP Network Routers

3.2.4.2 IP Devices With Multiple Ethernet Connection

3.2.5 Cryptographic Protection

3.2.6 Device Identification and Authentication

3.2.6.1 Default Requirements for Control System Devices

3.2.7 Cryptographic Module Authentication

3.3 ACCESS CONTROL REQUIREMENTS

3.3.1 User Accounts

3.3.1.1 Controllers

3.3.1.1.1 Fire Protection Systems

3.3.1.1.2 Default Requirements for Other Control Systems

3.3.1.2 Additional User Account Expiration Requirements In

MODERATE Impact Systems:

3.3.1.2.1 For Other Control System Devices FULLY Supporting

Accounts

3.3.2 Unsuccessful Logon Attempts

3.3.2.1 Devices MINIMALLY Supporting Accounts

3.3.2.2 Devices FULLY Supporting Accounts

3.3.2.3 High Availability Interfaces Exempt from Unsuccessful

Logon Attempts Requirements

3.3.3 System Use Notification

3.3.3.1 System Use Notification for Remote User Interfaces

3.3.3.2 System Use Notification for Local User Interfaces

3.3.4 Session Lock and Session Termination Requirements In MODERATE

Impact Systems:

3.3.4.1 Session Termination

3.3.4.2 Session Lock

3.3.4.3 Session Lock and Termination for Controllers

3.3.5 Permitted Actions Without Identification or Authentication

3.3.6 Pysical Security in MODERATE Impact Systems

3.3.6.1 Physical Security for Media

3.3.6.1.1 Physical Security for Media Inside Mission Space

3.3.6.1.2 Physical Security for Media Outside Mission Space

3.3.6.1.3 Physical Security for Non-Network Media in Fire

Protection Systems

3.3.6.2 Physical Security for Devices

3.3.6.2.1 Physical Security for Devices in Fire Protection

Systems

3.3.6.3 Physical Security for User Interfaces

SECTION 25 05 11.01 Page 2

3.3.7 Enclosures

3.4 USER IDENTIFICATION AND AUTHENTICATION

3.4.1 User Identification and Authentication for All System Types

3.4.2 User Identification and Authentication for Specific System

Types

3.4.3 Implementation of Identification and Authorization Requirements

3.4.4 Password-Based Authentication Requirements

3.4.4.1 Passwords for Controllers FULLY Supporting Accounts

3.4.4.2 Passwords for Remote Interfaces

3.4.4.3 Passwords for Devices Minimally Supporting Accounts

3.4.4.4 Password Configuration and Reporting

3.4.5 Authenticator Feedback

3.5 CYBERSECURITY AUDITING

3.5.1 Audit Events, Content of Audit Records, and Audit Generation

3.5.1.1 Default Requirements for Control System Controllers

3.5.1.1.1 Controllers Which FULLY Support Accounts

3.5.1.1.1.1 Audited Events

3.5.1.1.1.2 Audit Event Information To Record

3.5.1.1.2 Controllers Which Do Not FULLY Support Accounts

3.5.2 Audit Time Stamps

3.6 REQUIREMENTS FOR LEAST FUNCTIONALITY

3.6.1 Device Capabilities

3.6.2 Software

3.7 SYSTEM AND COMMUNICATION PROTECTION

3.7.1 Collaborative Computing

3.7.2 Denial of Service Protection and Application Partitioning In

MODERATE Impact Systems:

3.7.2.1 Default Requirements for MODERATE Impact Control Systems

3.7.3 Mobile Code In MODERATE Impact Systems:

3.7.4 Protection of Information at Rest In MODERATE Impact Systems:

3.7.5 Process Isolation and Boundary Protection in Moderate Impact

Fire Protection Systems

3.7.5.1 Radio Interfaces for Fire Protection Systems

3.7.5.2 Fire Supression System Network Isolation

3.8 SAFE MODE AND FAIL SAFE OPERATION

3.9 SYSTEM MAINTENANCE TOOL SOFTWARE

3.10 DEVICE POWER

3.10.1 Device Behavior on Loss of Power In MODERATE Impact Systems:

3.11 VULNERABILITY SCANNING

3.11.1 Controllers

3.12 FIPS 201-2 REQUIREMENT

3.13 SYSTEM AND INTEGRATION INTEGRITY

3.13.1 Malicious Code Protection

3.13.2 Software, Firmware, and Information Integrity In MODERATE

Impact Systems:

3.14 CONTROL SYSTEM CYBERSECURITY TESTING

3.14.1 Control System Cybersecurity Testing Procedures

3.14.2 Control System Cybersecurity Testing Execution

3.14.3 Control System Cybersecurity Testing Report

3.15 FIELD QUALITY CONTROL, CYBERSECURITY VALIDATION SUPPORT

3.16 CYBERSECURITY TRAINING

-- End of Section Table of Contents --

SECTION 25 05 11.01 Page 3

SECTION 25 05 11.01

CYBERSECURITY FOR FACILITY-RELATED CONTROL SYSTEMS - FIRE ALARM

05/21

PART 1 GENERAL

Many subparts in this Section contain text in curly braces ("{" and "}") indicating which cybersecurity control and control correlation identifier (CCI) the requirements of the subpart relate to. The text inside these curly braces is for Government reference only and enables coordination of the requirements of this Section with the RMF process throughout the design and construction process. Text in curly braces are not contractor requirements.

This Section refers to Security Requirements Guide (SRGs) and Security Technical Implementation Guide (STIGs). STIGs and SRGs are available online at the Information Assurance Support Environment (IASE) website at https://public.cyber.mil/stigs/downloads/ and an SRG/STIG Applicability Guide and Collection Tool is available at https://public.cyber.mil/stigs/SCAP/ . Not all control system components have applicable STIGs or SRGs. The "Control Systems SRG" does not apply to work performed under this Section; all requirements within this section to apply applicable SRGs DO NOT include the "Control Systems SRG".

1.1 CONTROL SYSTEM APPLICABILITY

There are multiple versions of this Section associated with this project.

Different versions have requirements applicable to different control systems. This specific Section applies only to the following control systems: Fire Reporting/Mass Notification (Building Level Controls Only).

The components involved are for the Fire Reporting System. The installer should apply cybersecurity to the lowest point practical on the control system. Primary work will be conducted at Control System Levels 0 thru 1.

1.2 RELATED REQUIREMENTS

This section does not contain sufficient requirements to procure a control system and must be used in conjunction with other Sections which specify control systems. This Section adds cybersecurity requirements to the control systems specified in other Sections, and as these requirements are conditioned on the control system being provided, there may be requirements in this Section that will not apply to this project. All Sections containing facility-related control systems or control system components are related to the requirements of this Section. Review all specification sections to determine related requirements.

In cases where a requirement is specified in both this Section and in another Section, the more stringent requirement must be met. In cases where a requirement in this Section conflicts with the requirements of another Section such that both requirements cannot be met at the same

SECTION 25 05 11.01 Page 4 time, request direction from the Contracting Officer Representative to determine which requirement applies to the project.

1.3 REFERENCES

The publications listed below form a part of this specification to the extent referenced. The publications are referred to within the text by the basic designation only.

INSTITUTE OF ELECTRICAL AND ELECTRONICS ENGINEERS (IEEE)

IEEE 802.1x (2010) Local and Metropolitan Area Networks - Port Based Network Access Control

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST)

NIST FIPS 140-2 (2001) Security Requirements for Cryptographic Modules

NIST FIPS 201-2 (2013) Personal Identity Verification (PIV) of Federal Employees and Contractors

U.S. DEPARTMENT OF DEFENSE (DOD)

DODI 8551.01 (2014) Ports, Protocols, and Services Management (PPSM)

DTM 08-060 (2008) Policy on Use of Department of Defense (DoD) Information Systems - Standard Consent Banner and User Agreement

1.4 DEFINITIONS

1.4.1 Administrator Account

An administrator account is an account with full permissions to a device, application, or operating system, including the ability to create and modify other user accounts.

Note that the operating system Administrator Account may be different than Administrator Accounts for applications hosted on that operating system.

Also, most controllers will not have any support for accounts and will therefore not have an 'Aministrator Account'.

1.4.2 Computer

A computer is one of the following:

a. a device running a non-embedded desktop or server version of Microsoft Windows

b. a device running a non-embedded version of MacOS

c. a device running a non-embedded version of Linux

d. a device running a version or derivative of the Android Operating System, where Android is considered separate from Linux

SECTION 25 05 11.01 Page 5

e. a device running a version of Apple iOS

Unless otherwise indicated or clear from context use of the word "device" in this Section includes computers.

1.4.3 Controller

A device other than a computer or Ethernet switch. For Fire Protection systems this includes fire alarm control panels, remote operating consoles, and remote annunciators.

1.4.4 Mission Space

A device or media is in mission space if physical access to the device or media is controlled by the organization served by the device. For example, a VAV box controller in a suspended ceiling is in mission space if the VAV box serves that room; an electrical switchgear in an electrical room or an AHU in a mechanical room or on a rooftop may still be considered to be in mission space if the organization (mission) served by that switchgear or AHU controls access to the electrical room, mechanical room or rooftop.

1.4.5 Network

A network is a group of two or more devices that can communicate using a network protocol. Network protocols must provide a method for addressing devices on the network; a communication method that does not provide an addressing scheme is not a networked form of communication. Devices that communicate using a method of communication that does not support device addressing are not using a network.

1.4.6 Network Connected

A component is network connected (or "connected to a network") only when the device has a network transceiver which is directly connected to the network and implements the network protocol. A device lacking a network transceiver (and accompanying protocol implementation) can never be considered network connected. Note that (unlike many IT definitions of "Network Connected") a device connected to a non-IP network is still considered network connected (an IP connection or IP address is not required for a device to be network connected).

1.4.7 Network Media

The thing that provides the communication channel between the devices on a network. Typically wire, but might include wireless, fiber optic, or even power line (some network protocols allow sending network signals over power wiring).

1.4.8 User Interface

A User Interface (UI) is something other than a Manual Local Input or Card Reader that allows a person to interact with the system or device. Note that while a Card Reader is not by itself a User Interface, a User Interface may contain a Card Reader in order for it to authenticate its user. Within control systems, there are a wide range of User Interfaces.

Two important distinctions are 1) whether the user interface is Local or Remote, and 2) the effective capabilities of the User Interface to alter

SECTION 25 05 11.01 Page 6 data, which is the "privilege" of the user interface (where effective privilege available to a specific user at a specific user interface is the combination of the greatest privilege offered by the user interface and the specific account the user is logged into).

1.4.8.1 Local User Interface

A Local User Interface is a user interface where the physical hardware the user interacts with (keyboard, buttons, display, etc.) is physically part of the device being affected. All of the relevant characteristics of the user interface are embodied within a single device.

Note that a Local UI may be able to access data in a different device, Local versus Remote in this context refers to the user interface itself;

the capability to access data in a different device is covered under "Full User Interface".

1.4.8.2 Remote User Interface

A Remote User Interface implements a Client/Server model where the physical hardware the user interacts with (Client) is physically distinct from the device being affected (Server). Most or all of the security and functionality characteristics of the user interface are defined by the Server, not the Client. The Client and Server communicate via a network connection. A common example of a remote user interface is a web-based interface where the browser (client) is generally on different hardware than the web server (server). A Remote UI remains a Remote UI even if the user happens to be at a Client on the same hardware as the Server. What is important is that a) the Client may be on different hardware than the Server and b) the majority of the security and functional characteristics of the interface are defined at the Server.

Note that this definition of "remote" is consistent with that generally used in the control industry but is not aligned with the NIST 800-53 definition of "Remote", which refers to "outside the system". The term "Remote" here better aligns with the NIST 800-53 definition of "Network" (remote from within the system) Access.

1.4.8.3 Types of User Interface (by capability)

User interfaces are also categorized by their capabilities as being Read Only, Limited, or Full.

1.4.8.4 Other User Interface Terminology

In addition to defining whether a user interface is a Hardware Limited, Read-Only, Limited or Full, and whether it is Local or Remote, user interfaces are classified by whether they are writable or privileged.

1.4.8.4.1 Full User Interface

A Full User Interface can alter information in devices outside the device with the user interface. For example, a typical Local Display Panel is a Full Local User Interface while a browser-based front end is a Full Remote User Interface.

SECTION 25 05 11.01 Page 7

1.4.8.4.2 Privileged User Interface

A Privileged UI is a UI that has sufficient capabilities or functionality that it requires specific cybersecurity measures to be put in place to limit its unauthorized use. Ultimately, whether a specific user interface is considered a Privileged User Interface must be determined by usage.

Unless otherwise specified, user interfaces can be determined to be privileged or not using the following:

a. Read-Only User Interfaces are not privileged user interfaces.

b. Full User interfaces for Fire Alarm Systems are privileged user interfaces as indicated and shown, or when another requirement of this Section establishes they are privileged. For all other systems, Full User Interfaces are privileged user interfaces.

c. User interfaces that allow for configuration of auditing or allows for modification or deletion of audit logs are privileged user interface.

d. User interfaces that allow for reprogramming a network connected device is a privileged user interface.

e. For Fire Protection Systems, User Interfaces that can inhibit or force the activation of a fire suppression system (e.g. such as for a pre-action or deluge system) are privileged user interfaces.

f. Writeable User Interfaces in Electronic Security Systems (ESS) are privileged user interfaces.

e. Except as specified above, a Limited User Interface must be determined to be privileged or not based on the specific capabilities and use case of the user interface. In general however, user interfaces that do not offer significant capabilities above and beyond those available at that location via other means (e.g. such as a disconnect switch, breaker, or hand-off-auto switch, or physical attack) are not privileged.

1.4.9 Wireless Network

Any network that communicates without using wires or fiber optics as the communication media. Wireless networks include: WiFi, Bluetooth, ZigBee, cellular, satellite, 900 MHz radio, 2.4 GHz, free space optical, point-to-point laser, and IR.

1.5 ADMINISTRATIVE REQUIREMENTS

1.5.1 Points of Contact

Coordinate with the following Points of Contact as indicated in this Section and as required. Not all projects will require coordination with all Points of Contact. When coordination is required and no Point of Contact is indicated, coordinate with The Contracting Office Representative (COR).

a. Government Computer Access Point of Contact: The Contracting Office Representative (COR)

b. HTTPS Certificate Point of Contact: The Contracting Office Representative (COR)

SECTION 25 05 11.01 Page 8

c. Email Address Point of Contact: The Contracting Office Representative

(COR)

d. Password Point of Contact: The Contracting Office Representative (COR)

e. Mobile Code Point of Contact: The Contracting Office Representative

(COR)

1.5.2 Coordination

Coordinate the execution of this Section with the execution of all other Sections related to control systems as indicated in the paragraph RELATED REQUIREMENTS. Items that must be considered when coordinating project efforts include but are not limited to:

a. If requesting permission for wireless or wired broadcast communication, the Wireless and Wired Broadcast Communication Request submittal must be approved prior to control system device selection and installation.

b. If requesting permission for alternate account lock permissions, the Device Account Lock Exception Request must be approved prior to control system device selection and installation.

c. If requesting permission for the use of a device with multiple physical connections to IP networks, the Multiple IP Connection Device Request must be approved prior to control system device selection and installation.

d. Wireless testing may be required as part of the control system testing. See requirements for the Wireless Communication Test Report submittal.

e. Cybersecurity testing support must be coordinated across control systems and with the Government cybersecurity testing schedule.

f. Passwords must be coordinated with the indicated contact for the project site.

g. If applicable, HTTPS web server certificates must be obtained from the indicated HTTPS Certificate Point of Contact.

h. Contractor Computer Cybersecurity Compliance Statements must be provided for each contractor using contractor owned computers.

1.6 SUBMITTALS

Government approval is required for submittals with a "G" or "S" classification. Submittals not having a "G" or "S" classification are for information only. When used, a code following the "G" classification identifies the office that will review the submittal for the Government.

Submit the following in accordance with Section 01 33 00 SUBMITTAL

PROCEDURES:

SD-01 Preconstruction Submittals

Device Account Lock Exception Request; G

SECTION 25 05 11.01 Page 9

Multiple Ethernet Connection Device Request; G

Contractor Computer Cybersecurity Compliance Statements; G

Contractor Temporary Network Cybersecurity Compliance Statements; G

Protection of Information At Rest Proposal; G

Proposed STIG and SRG Applicability Report; G

SD-02 Shop Drawings

Network Communication Report; G

Cybersecurity Riser Diagram; G

SD-03 Product Data

Control System Cybersecurity Documentation; G

SD-06 Test Reports

Control System Cybersecurity Testing Procedures; G

Control System Cybersecurity Testing Report; G

SD-07 Certificates

Software Licenses; G

SD-11 Closeout Submittals

Confidential Password Report; G

Enclosure Keys; G

Software and Configuration Backups; G

System Maintenance Tool Software; G

Control System Scanning Tools; G

STIG, SRG and Vendor Guide Compliance Result Report; G

Control System Inventory Report; G

Integrity Verification Software; G

1.7 QUALITY CONTROL

1.7.1 Control System Cybersecurity Subject Matter Expert

The individual will oversee all work within this specification. This position requires that the individual currently meet Information Assurance Manager Level II Certification requirements in accordance with DoDI 8570 Information Workforce Improvement Program.

Individuals for this position should have experience securing DoD systems

SECTION 25 05 11.01 Page 10 and with Risk Management Framework. Control System experience is highly desirable.

Resumes should be submitted to the Government within 14 days after notice to proceed. All certifications must be in effect prior to beginning work.

This position may serve across the contract for all control systems. There is no requirement to have one Cybersecurity SME per platform.

1.8 CYBERSECURITY DOCUMENTATION

{For Government Reference Only: This subpart (and its subparts) relates to PL-7; CCI-003071}

1.8.1 Proposed STIG and SRG Applicability Report

For each model of network connected or network infrastructure device, use the DISA SRG/STIG Applicability Guide and Collection Tool (available at https://public.cyber.mil/stigs/SCAP/ to identify applicable STIGs or SRGs and provide a report indicating applicable STIGs and SRGs for each model.

1.8.2 Network Communication Report

{For Government Reference Only: This subpart (and its subparts) relates to CA-9, PL-8; CCI-003075; CCI-002102, CCI-002103, CCI-002104, CCI-002105, CCI-003072, CCI-003073, CCI-003075 and also the submittal requirements associated with CM-6, CM-7, SC-8 and SC-41 including CM-7(3), CCI-000388. }

Provide a network communication report. For each networked device, document the communication characteristics of the device including communication protocols, services used, encryption employed, and a general description of what information is communicated over the network. For each device using IP, document all TCP and UDP ports used. For non-IP communications, document communication protocol and media used. If other control system Sections used on this project include submittals documenting this information, provide copies of those submittals to meet this requirement.

In addition to the requirements of Section 01 33 00 SUBMITTAL PROCEDURES, provide the Network Communication Report as an editable Microsoft Excel file.

1.8.3 Control System Inventory Report

{For Government Reference Only: This subpart (and its subparts) relates to CM-8(a), SI-17, IA-3; CCI-000389, CCI-000392, CCI-000398, CCI-002773, CCI-002774, CCI-002775, CCI-000777, CCI-000778, CCI-001958}

Provide a Control System Inventory report using the Inventory Spreadsheet listed under this Section at https://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/ufgs-25-05-11 documenting all networked devices, including network infrastructure devices. For each device provide all applicable information for which there is a field on the spreadsheet in accordance with the instructions on the spreadsheet.

In addition to the requirements of Section 01 33 00 SUBMITTAL PROCEDURES, provide the Control System Inventory Report as an editable Microsoft Excel file.

SECTION 25 05 11.01 Page 11

1.8.4 Software and Configuration Backups

{For Government Reference Only: This subpart (and its subparts) relates to CP-10; CCI-000550, CCI-000551, CCI-000552}

For all ethernet switches provide a backup of the switch configuration.

For all controllers, provide a backup of the controller configuration and the source code for all loaded application programs (all software that is not common to every controller of the same manufacturer and model).

If any or all of these are provided under another Section, provide documentation indicating this and referencing those submittals.

1.8.5 Cybersecurity Riser Diagram

{For Government Reference Only: This subpart (and its subparts) relates to PL-2(a), PL-8; CCI-003051, CCI-003053, CCI-003072, CCI-003073, CCI-003075}

Provide a cybersecurity riser diagram of the complete control system including all network and device hardware. If the control system specifications require a riser diagram submittal, provide a copy of that submittal as the cybersecurity riser diagram. Otherwise, provide a riser diagram in one-line format overlayed on a facility schematic.

1.8.6 STIG, SRG and Vendor Guide Compliance Result Report

For every component (device or software) with an applicable STIG or SRG in the Proposed STIG and SRG Applicability Report, provide a result report documenting compliance with the STIG or SRG requirements. For components which are scannable by the SCAP (security content automation protocol) tool (available online at https://public.cyber.mil/stigs/scap ), provide the SCAP report and raw scan results.

For every component (device or software) with manufacturer provided cybersecurity documentation, procedure, or method for secure configuration or installation, provide a report documenting how the component was configured and any deviation from the manufacturer instructions.

1.8.7 Control System Cybersecurity Documentation

{For Government Reference Only: This subpart (and its subparts) relates to SA-5 (a),(b),(c); CCIs: CCI-003124, CCI-003125, CCI-003126, CCI-003127, CCI-003128, CCI-003129, CCI-003130, CCI-003131}

Provide a Control System Cybersecurity Documentation submittal containing the indicated information for each device and software application.

1.8.7.1 Default Requirements for Control System Devices

For control system devices where Control System Cybersecurity Documentation requirements are not otherwise indicated in this Section, provide:

a. Documentation that describes secure configuration of the device {For Government Reference Only: relates to CCI-003124}

SECTION 25 05 11.01 Page 12

b. Documentation that describes secure installation of the device {For Government Reference Only: relates to CCI-003125}

c. Documentation that describes secure operation of the device {For Government Reference Only: relates to CCI-003124}

d. Documentation that describes effective use and maintenance of security functions or mechanisms for the device {For Government Reference Only:

relates to CCI-003127}

e. Documentation that describes known vulnerabilities regarding configuration and use of administrative (i.e. privileged) functions for the device {For Government Reference Only: relates to CCI-003128}

f. Documentation that describes user-accessible security functions or mechanisms in the device and how to effectively use those security functions or mechanisms {For Government Reference Only: relates to

CCI-003129}

g. Documentation that describes methods for user interaction which enables individuals to use the device in a more secure manner {For Government Reference Only: relates to CCI-003130}

h. Documentation that describes user responsibilities in maintaining the security of the device {For Government Reference Only: relates to

CCI-003131}

1.9 SOFTWARE LICENSING

{For Government Reference Only: This subpart (and its subparts) relates to SI-2(a), SI-2(c), SI-7(14); CCI-001227, CCI-002605, CCI-002737}

For all software provided that has not already been licensed to the government or project site, provide a license to the project site for a period of no less than 5 years, and the license must also include the following software updates:

a. Security and bug-fix patches issued by the software manufacturer.

b. Security patches to address any vulnerability identified in the National Vulnerability Database at http://nvd.nist.gov with a Common Vulnerability Scoring System (CVSS) severity rating of MEDIUM or higher.

Provide a single Software Licenses submittal with documentation of the software licenses for all software provided

1.10 CYBERSECURITY DURING CONSTRUCTION

{For Government Reference Only: This subpart (and its subparts) relates to

AC-18, SA-3; CCI-000258}

In addition to the control system cybersecurity requirements indicated in this section, meet following requirement throughout the construction process.

1.10.1 Contractor Computer Equipment

Contractor owned computers may be used for construction. Contractor

SECTION 25 05 11.01 Page 13 computers connected to the control system, control system network, or a control system component at any point during construction must meet the following requirements:

1.10.1.1 Operating System

The operating system must be an operating system currently supported by the manufacturer of the operating system. The operating system must be current on security patches and operating system manufacturer required updates.

1.10.1.2 Anti-Malware Software

The computer must run anti-malware software from a reputable software manufacturer. Anti-malware software must be a version currently supported by the software manufacturer, must be current on all patches and updates, and must use the latest definitions file. Computers used on this project must be scanned using the installed software at least once per day.

1.10.1.3 Passwords and Passphrases

The passwords and passphrases for computers, applications, and web-based applications supporting passwords must be changed from their default values. Passwords must be a minimum of eight characters with a minimum of one uppercase letter, one lowercase letter, one number and one special character.

1.10.1.4 User-Based Authentication

Each user must have a unique account; sharing of a single account between multiple users is prohibited.

1.10.1.5 Demonstration of Compliance

The Government has the right to require demonstration of computer compliance with these requirements at any time during the project.

1.10.1.6 Contractor Computer Cybersecurity Compliance Statements

Provide a single submittal containing completed Contractor Computer Cybersecurity Compliance Statements for each company using contractor owned computers. Contractor Computer Cybersecurity Compliance Statements must use the template published at https://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/ufgs-25-05-11 Each Statement must be signed by a cybersecurity representative for the relevant company. 1.10.2 Temporary IP Networks

Temporary contractor-installed IP networks may be used during construction. When used, temporary contractor-installed IP networks connected to the control system, control system network, or a control system component at any point during construction must meet the following requirements:

1.10.2.1 Network Boundaries and Connections

The network must not extend outside the project site and must not connect to any IP network other than those specifically provided or furnished for this project. Any and all access to the network from outside the project site is prohibited.

SECTION 25 05 11.01 Page 14

1.10.3 Government Access to Network

Government personnel must be allowed to have complete and immediate access to the network at any time in order to verify compliance with this specification.

1.10.4 Temporary Wireless IP Networks

In addition to the other requirements on temporary IP networks, temporary wireless IP (WiFi) networks, when permitted, must not interfere with existing wireless networks, must use WPA2 security and must not broadcast the network name (SSID). Network names (SSID) for wireless networks must be changed from their default values.

1.10.5 Passwords and Passphrases

The passwords and passphrases for all network devices and network access must be changed from their default values. Passwords must be a minimum 8 characters with a minimum of one uppercase letter, one lowercase letter, one number and one special character.

1.10.6 Contractor Temporary Network Cybersecurity Compliance Statements

Provide a single submittal containing completed Contractor Temporary Network Cybersecurity Compliance Statements for each company implementing a temporary IP network. Contractor Temporary Network Cybersecurity Compliance Statements must use the template published at https://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/ufgs-25-05-11 Each Statement must be signed by a cybersecurity representative for the relevant company. If no temporary IP networks will be used, provide a single copy of the Statement indicating this.

1.11 CYBERSECURITY DURING WARRANTY PERIOD

All work performed on the control system after acceptance must be performed using Government Furnished Equipment or equipment specifically and individually approved by the Government.

PART 2 PRODUCTS

(NOT USED)

PART 3 EXECUTION

3.1 CYBERSECURITY HARDENING AND CONFIGURATION GUIDES

Install, configure, and harden all hardware and software furnished on this project in accordance with manufacturer provided documentation, procedures, or methods for secure configuration or installation. Do not implement specific hardening actions if that action would conflict with requireed functionality or another requirement of this Section.

3.2 NETWORK REQUIREMENTS

3.2.1 Information Flow Enforcement In MODERATE Impact Systems

{For Government Reference Only: This subpart (and its subparts) relate to

AC-4; CCI-001368, CCI-001414, CCI-001548, CCI-001549, CCI-001550,

SECTION 25 05 11.01 Page 15

CCI-001551}

Install and configure Ethernet switches to block all traffic on all ports not required by the control protocol.

3.2.2 Wireless and Wired Broadcast Communication for Fire Protection Systems

The use of wireless and wired broadcast communication for fire protection systems within a facility is prohibited. Wireless communication may be used to provide communication from the fire protection system in a facility to the central monitoring station.

3.2.3 Non-IP Control Networks

When control system specifications require particular communication protocols, use only those communication protocols and only as specified.

Do not implement any other communication protocol.

When control system specifications do not indicate requirements for communication protocols, use only those protocols required for operation of the system as specified.

3.2.4 IP Control Networks

{For Government Reference Only: This subpart relates to CM-6(a), CM-7(a), CM-7(b), CM-7(1)(b), SC-41; CCI-001588, CCI-000381, CCI-000380, CCI-000381, CCI-000382, CCI-001761, CCI-001762, CCI-002544, CCI-002545, CCI-002546. For Moderate Impact Systems, this subpart (and its subparts) also relates to SC-5(1), SC-5(2); CCI-001094 CCI-001095 }

IP Networks must be Ethernet networks and must use switches which are Ethernet Switches or Daisy Chain IP Controllers as defined in this Section. Do not use nonsecure functions, ports, protocols and services as defined in DODI 8551.01 unless those ports, protocols and services are specifically required by the control system specifications or otherwise specifically authorized by the Government. Do not use ports, protocols and services that are not specified in the control system specifications or required for operation of the control system.

For MODERATE Impact Systems, unless explicitly authorized, do not use IP networks if the same control functionality is available through the use of non-IP networks.

3.2.4.1 IP Network Routers

Do not install any device that performs IP routing.

3.2.4.2 IP Devices With Multiple Ethernet Connection

Except for Ethernet Switches and Daisy Chain IP Controllers, devices must not have more than one Ethernet connection to IP networks unless doing so is required by the project specifications and the specific application is approved. If a device with Multiple Ethernet Connections to IP networks is required, provide a Multiple Ethernet Connection Device Request using the Multiple Ethernet Connection Device Request Template at https://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/ufgs-25-05-11 to request approval for each device. If a device with Multiple Ethernet Connections to IP networks is not required, instead provide a document

SECTION 25 05 11.01 Page 16 stating that no approval is being requested.

3.2.5 Cryptographic Protection

{For Government Reference Only: This subpart relates to IA-2(9), IA-3(1), SC-8, SC-13, SC-23(1), SC-23(3); CCI-001942, CCI-001959, CCI-001967, CCI-002418, CCI-002449, CCI-002450, CCI-001185, CCI-001188, CCI-001664.}

All remote user interfaces must use HTTPS for all traffic between the user interface client and user interface server.

For devices that have STIG/SRGs related to cryptographic protection (CCI-002450), comply with the requirements of those STIG/SRGs. Ensure that IP network traffic is encrypted using NSA-approved cryptography;

provision of digital signatures and hashing, and FIPS-validated cryptography.

3.2.6 Device Identification and Authentication

{For Government Reference Only: This subpart (and its subparts) relates to IA-3; CCI-000777, CCI-000778, CCI-001958. For MODERATE Impact systems, this subpart (and its subparts) also relates to SC-23, SC-23(5);

CCI-001184, CCI-002470. }

All computers must support IEEE 802.1x for device authentication to the network.

3.2.6.1 Default Requirements for Control System Devices

For control system devices where Device Identification and Authentication requirements are not otherwise indicated in this Section: Devices using Ethernet must support IEEE 802.1x . Devices using HTTP as a control protocol must use HTTPS instead.

3.2.7 Cryptographic Module Authentication

{For Government Reference Only: This subpart (and its subparts) relates to IA-7; CCI-000803}

For devices (including but not limited to NIST FIPS 140-2 compliant radios) that have STIG/SRGs related to cryptographic module authentication (CCI-000803), comply with the requirements of those STIG/SRGs.

3.3 ACCESS CONTROL REQUIREMENTS

3.3.1 User Accounts

{For Government Reference Only: This subpart (and its subparts) relate to AC-2(a), AC-3, AC-6(1), AC-6(10), AC-6(2), AC-6(9), CM-11(2), and IA-2;

CCI-002110, CCI-000213, CCI-002235, CCI-001558, CCI-002221, CCI-002222,

CCI-002223, CCI-002235, CCI-000039, CCI-001419, CCI-002234, CCI-001812,

and CCI-000764. For MODERATE Impact systems, this subpart (and its subparts) also relate to AC-2 (2), AC-2(3), AC-2(4), AC-6(1), and CM-5(1);

CCI-001361, CCI-000017, CCI-000217, CCI-000018, CCI-001403, CCI-001404,

CCI-001405, CCI-002130, CCI-001683, CCI-001684, CCI-001685, CCI-001686,

CCI-002132, CCI-001558, CCI-002221, CCI-002222, CCI-002223, CCI-001813. }

Any user interface supporting user accounts (either FULLY or MINIMALLY) must limit access according to specified limitations for each account.

SECTION 25 05 11.01 Page 17

Install and configure any device having a STIG or SRG in accordance with that STIG or SRG.

All user interfaces FULLY supporting accounts must implement user-based authentication where each account is uniquely assigned to a specific user. User interfaces FULLY supporting accounts must implement at least three (3) levels of user account privilege including: 1) an account with read-only permissions 2) an account with full permissions including account creation and modification and 3) an account with greater permissions than read-only but without account creation and modification.

3.3.1.1 Controllers

For user interfaces provided by controllers, provide access control in accordance with the User Interface Requirements table for the applicable control system and user interface type.

a. For table entries of "NA": NA means Not Applicable, there are no interfaces in this category.

b. For table entries of "None Required": The user interface is not required to support user accounts.

c. For table entries of "MINIMALLY": The user interface must at least MINIMALLY support user accounts.

d. For table entries of "FULLY": The user interface must at FULLY support user accounts.

e. For table entries of "KEY": The user interface must have physical security in the form of either a key lock on the interface itself or be furnished inside a locked enclosure. Where this is required for a read only interface, this lock must prevent viewing of data on the interface; for other interfaces, this lock must prevent using the interface to alter data.

f. For table entries of "Physical Security": For Local FULL interfaces, the interface must be located inside mission space. For Local Limited (not FULL) interfaces, the user interface must either a) be located within mission space or b) be protected by physical security at least as good as the control devices (and equipment controlled by the control devices) affected by the interface. For purposes of this requirement, 'affected' includes controllers with data that can be directly altered by the interface, as well as mechanical and/or electrical equipment directly controlled by those controllers, but does not include other interactions.

g. Entries of the form "X and Y" must meet both the requirement indicated for X and the requirement indicated for Y. For example, an entry of "MINIMALLY and Physical Security" indicates the user interface must both MINIMALLY support accounts and have physical security.

h. Entries of the form "X or Y" must meet either the requirement indicated for X or the requirement indicated for Y.

SECTION 25 05 11.01 Page 18

3.3.1.1.1 Fire Protection Systems

User Interface Requirements for MODERATE Impact Fire Protection Systems

User Interface Type Access Control Requirement (See note 2)

Local Read Only None Required

Local Limited, Non-privileged None Required

Local Limited, Privileged KEY and Physical Security

Local Full KEY

Remote Read Only None Required

Remote Limited, Non-Privileged None Required

Remote Limited, Privileged

AND

Remote Full

None Required

Notes:

1)Local Read Only User Interfaces are always Non-Privileged 2)Devices outside mission space require physical security protections as indicated (in "PHYSICAL SECURITY IN MODERATE IMPACT SYSTEMS")

3.3.1.1.2 Default Requirements for Other Control Systems

For control system devices where User Interface Requirements are not otherwise indicated in this Section, use the Default User Interface Requirements tables.

Default User Interface Requirements for LOW Impact Control Systems

User Interface Type Access Control Requirement

Local Read Only (see note 1) None Required

Local Limited, Non-privileged None Required

Local Limited, Privileged MINIMALLY

Local Full MINIMALLY

Re…