Facility Related Control Systems and Energy Cybersecurity

Cybersecurity for Buildings and Facilities

Peregrine Subject Matter Experts (SMEs) have been conducting vulnerability assessments (VA) on federal buildings focused on control systems for the Department of Defense (DoD) on six contracts. Historically, electrical, HVAC and water systems were not connected to the internet and did not have to abide by cybersecurity regulations. Often termed Industrial Control Systems (ICS) or Operational Technology (OT), these devices were focused more on availability. Our SMEs regularly perform cybersecurity compliance assessments for both IT and OT systems. In the area of assessing ICS, Peregrine has extensive experience with cybersecurity for Facility Related Control Systems (FRCS) and has conducted numerous assessments focused on ICS, supporting facilities that have been designated as Defense Critical Infrastructure (DCI).

RMF for the Internet of Things (IoT)

From a DoD cybersecurity expertise perspective, over the last 14 years, Peregrine SMEs have supported Department of Defense Instruction (DoDI) 8500.01 and DoDI 8510.01, plus military service-specific guidance and requirements for performing RMF Assess Only or RMF Authorization To Operate (ATO). Peregrine provides expert hands-on cybersecurity support to ensure systems are securely configured in accordance with applicable DISA STIGS and SCAP checklists; UFGS 25 05 11, DoD policies and security controls; and undergo special assessment of their functional and security related capabilities and deficiencies. Our SMEs have also conducted contracts where we have (1) identified gaps between current federal/DoD standards for cybersecurity of OTs and cyber industry best practices, including ISA/IEC Standard 62443, the latest version of NIST 800-82, MOSAICS framework, Zero Trust principles and other industry frameworks and best practices; and (2) offered recommendations based on industry best practices and proposed new government standards to enhance cyber protections and resilience in a cyber contested environment.

Design for Cybersecurity via UFC and UFGS Requirements

Peregrine ensures organizations understand and meet the cybersecurity documentation required to comply with Unified Facilities Criteria (UFC) 04-010-06, Cybersecurity of Facility Related Control Systems and Unified Facilities Guide Specifications (UFGS) 25 05 11, Cybersecurity of Facility Related Control Systems. This is especially important for projects at the different program stages including Design (35%), Pre-Final (90%) and Final Design (100%), and specifically focusing on networks that include FRCS, ICS and commercial IoT products using the subset of 110 RMF security controls. Peregrine SMEs update the official DoD website that posts the latest data on cyber design requirements. Finally, we are experts on cyber commissioning and ensuring compliance with federal regulations.

Cybersecurity for UESC and ESPC

We provide assessment support for Utility Energy Savings Contracts (UESC) and Energy Savings Performance Contracts (ESPC) reviews. Energy Resilience cybersecurity support is provided to evaluate vulnerabilities. UESC/ESPC must include a cybersecurity plan for energy conservation measures and energy resilience projects that include the installation/modification of OT, which encompasses Platform Information Technology (PIT), Control Systems (CS), or FRCS.

Energy Cybersecurity

As experts in analyzing energy from a security and cyber aspect, Peregrine conducts Energy Security studies, identifying threats and vulnerabilities to the power supply, then proposes risk mitigation strategies, tying operational energy risks to mission impacts in order to help inform and prioritize mission resilience and renewable energy measures. Through this work, we have investigated and written cyber energy security requirements for the DoD, DPA, and EPS.

Metering

Peregrine won competitive contracts recently with both the U.S. Army and U.S. Coast Guard to upgrade their energy management systems to include meters at bases/sites around the world. Our staff routinely conducts site surveys; inspects local data collectors, metering and wireless connection devices; installs new or replaces electric, gas, and water meters and reconnects them; corrects any deficiencies to ensure all equipment is reporting properly; and documents all equipment installation according to the requirements which may include photos, as-built forms and/or floorplans. Our team also performs extensive site condition/engineering surveys of the existing site conditions and a full analysis of all relevant systems to validate the quantities of system equipment, verify existing site conditions, and develop design basis.

Trust Peregrine to cybersecure your building systems—and your mission.