Personnel who maintain Facility Related Control Systems (FRCS) of any type are required to implement cybersecurity to attain and maintain an Authority to Operate (ATO) on their respective systems. This document is a guide for installation personnel owning and operating control systems to assist in addressing the cybersecurity process for FRCS in the Army through the Risk Management Framework (RMF) approach, which encompasses six steps. This manual walks the reader through the administrative aspects of each step.

This work assessed the potential for development of a building automation system (BAS) specification (for heating, ventilating, and air conditioning systems, etc.) based on the BACnet ® communications protocol. Although BACnet is widely supported, no BAS specification exists that implements BACnet as an Open System. The BACnet protocol is detailed, includes comprehensive requirements, and also provides options in how individual vendors might choose to implement it. Such vendorspecific choices can effectively close the system to future open bid procurements, or result in incompatible systems. This work concluded that implementing BACnet in an Open manner will require extensively prescriptive requirements with a large amount of design and contract documentation. The resulting system may not integrate as tightly as desired and may therefore not be as user friendly to Army installation operations and maintenance (O&M) staff as other equivalent systems due mainly to the need for multiple configuration tools. This work recommends that development of BAS specifications based on BACnet continue and that a source selection process that pre-qualifies BACnet contractors be developed to help obtain open systems in accordance with those specifications. DISCLAIMER:The contents of this report are not to be used for advertising, publication, or promotional purposes. Citation of trade names does not constitute an official endorsement or approval of the use of such commercial products. All product names and trademarks cited are the property of their respective owners. The findings of this report are not to be construed as an official Department of the Army position unless so designated by other authorized documents.

Fort Leonard Wood, MO, has two separate Utility Monitoring and Control Systems (UMCSs) that remotely monitor and supervise hundreds of building control systems. The garrison is currently considering whether it would best to merge the two existing systems into a single, integrated UMCS. However, coordinating the operation of these separate systems is a significant issue that will affect the garrison's decision on how to move forward. This work reviewed and analyzed the installation's building automation technology, related industry standards, utility metering requirements, and market trends, and made specific recommendations to outline a path forward to configure a single installation-wide UMCS with a front-end that provides DPW access to perform supervisory monitoring and control functions including access to utility metering data. DISCLAIMER: The contents of this report are not to be used for advertising, publication, or promotional purposes. Citation of trade names does not constitute an official endorsement or approval of the use of such commercial products. All product names and trademarks cited are the property of their respective owners. The findings of this report are not to be construed as an official Department of the Army position unless so designated by other authorized documents. DESTROY THIS REPORT WHEN NO LONGER NEEDED. DO NOT RETURN IT TO THE ORIGINATOR. source" to Honeywell if the scope of the project is limited to integrating the systems. Where a project, such as Military Construction (MILCON), includes the integration of a BCS and UMCS, the BCS, UFGSs, and UMCS UFGS can be used together and bidders will need to engage with Honeywell to accomplish the integration portion of the project. A non-solesource path could be taken to continue to expand the Government UMCS, which has the disadvantages described in this report. 5. Consolidate utility metering under a single umbrella by making all future metering part of the selected/adopted UMCS. It is not recommended to use a separate UMCS dedicated solely to metering (i.e., do not use an Enterprise Energy Data Reporting Systems [EEDRS] server dedicated to metering). Huntsville should use the Honeywell UMCS to pass metering data to the Meter Data Management System (MDMS). 6. Specify and install all future metering using the requirements defined in UFGS 23 09 13, which were updated and tailored to Fort Leonard Wood as part of this project. 7. Continue to urge Honeywell and the Fort Leonard Wood Network Enterprise Center (NEC) to obtain full UMCS connectivity and to provide the Fort Leonard Wood DPW with a user interface (i.e., Enterprise Buildings Integrator (EBI)/Honeywell Energy Manager [HEM] as described herein). 8. Consider the garrison's ability and means to staff and support a UMCS, both over the near term, and also with the eventual government ownership of the Honeywell UMCS when the Energy Savings Performance Contract (ESPC) period expires in October 2025. 9. Address staffing shortages, in particular recently eliminated DPW UMCS Manager position, w...

Army policy calls for each installation to install a building automation system (aka utility monitoring and control system [UMCS]) to provide for centralized monitoring of buildings and utilities to reduce energy and water commodity and maintenance costs. Typically, the UMCS, including building control systems (BCS), is installed and expanded in piecemeal fashion resulting in intersystem incompatibilities. The integration of multivendor BCSs into a single basewide UMCS, and subsequent UMCS operation, can present technical and administrative challenges due to its complexity and cybersecurity requirements. Open Control Systems technology and open communications protocols, including BACnet, LonWorks, and Niagara Framework, help overcome technical incompatibilities. Additional practical considerations include funding, control systems commissioning, staffing, training, and the need for a commitment to proper operation, use, and sustainment of the UMCS. This document provides guidance to Army installations to help achieve a successful basewide UMCS through its full life cycle based on DoD criteria and technical requirements for Open Control Systems and cybersecurity. It includes institutional knowledge on technical solutions and business processes amassed from decades of collaboration with Army installations and learned from and with their staff. Detailed activities spanning both implementation and sustainment include planning, procurement, installation, integration, cybersecurity authorization, and ongoing management.

The contents of this report are not to be used for advertising, publication, or promotional purposes. Citation of trade names does not constitute an official endorsement or approval of the use of such commercial products. All product names and trademarks cited are the property of their respective owners. • The findings of this report are not to be construed as an official Department of the Army position unless so designated by other authorized documents.