Requirement clauses
The wording, ready to paste
Every clause here comes from an architect who had to make the thing work. Each group states why the requirement exists and what happens when it is left out — and where our own catalogue does not meet a clause, it says so.
Requirement clauses
Before you paste: which of these are disqualifying?
- All of these are written as requirements. That is deliberate — an architect writing for a working installation states what has to be true. But a specification consisting only of mandatory requirements disqualifies every tenderer, including us.
- The split between a mandatory requirement and a scored one is yours, not ours. It depends on what the installation actually needs, and the same clause can be disqualifying in an embassy and merely desirable in a training room.
- A second distinction runs through the library: some clauses are requirements on the product, others are requirements on the tender — obligations to state, show or attach something. The second kind is what makes tenders comparable, and it is the kind most often left out.
- The legal frame here is Swedish public procurement (LOU and LUFS). The clauses translate cleanly to other regimes, but the framing around them does not — map them to your own.
Data diodes and one-way transfer
Unidirectionality as a physical property
Why, and what happens without it: Direction is the whole product. Without these clauses a tenderer can offer a firewall with a rule and call it a diode — and a rule can be changed by whoever reaches the device.
Unidirectionality shall be enforced in the hardware design. The tenderer shall describe how return traffic is physically excluded, and the description shall address the design rather than the configuration of the unit.
The unit shall have no configurable setting, software mode or maintenance function capable of permitting data flow in the opposite direction. The tenderer shall certify this in writing.
Unidirectionality shall be independent of the software of the unit and shall persist through power loss, start-up, firmware failure and every configuration state.
The unit shall realise unidirectionality through several separate barriers in series, so that the failure of a single component does not remove the property. The design shall be described in the tender.
Galvanic isolation
Why, and what happens without it: Without the requirement covering the whole signal path, screen, earth or auxiliary power becomes the conducting connection the rest of the design removed.
Transfer between the domains shall be optical, with no electrically conducting connection between the sending and the receiving side. The requirement covers the signal path in its entirety, including screen, earth and any auxiliary power.
Verifiability and approval
Why, and what happens without it: A datasheet is a claim. Without a requirement for independent testing and for the approval to cover the offered article, the purchaser buys a form of words rather than a property.
Unidirectionality shall be verified by an independent party. A test report or equivalent certificate shall be attached to the tender. A claim in a datasheet is not accepted as evidence.
Where the equipment is placed in an approved emission-secure environment, the data diode itself shall be approved to the level the environment requires, stated as TEMPEST Level A under SDIP-27, corresponding to RÖS U1 [alternatively Level B / RÖS U2]. The approval shall cover the offered article, not a product family.
The tenderer shall state the article number of the offered unit and, for delivery to the Swedish Armed Forces, the M-number the equipment carries. Where no M-number exists, the tenderer shall state whether and when one can be obtained.
Sealing and tamper evidence
Why, and what happens without it: Sealing does not protect, it detects. Without clauses on how it is made, how it is checked and that units are replaced rather than repaired, the seal is decoration.
The unit shall be delivered sealed, and the seal shall be made so that opening leaves visible and irreversible evidence.
The tenderer shall describe how the sealing is implemented and how the recipient verifies it on delivery and at periodic inspection.
The unit shall not require opening for normal operation, configuration or fault finding. Any action that requires a seal to be broken shall be stated in the tender.
On failure the unit shall be replaced with a new sealed unit. Repair that presupposes a broken seal is not accepted without renewed verification under the purchaser’s procedure.
Performance and sizing
Why, and what happens without it: A diode has no back-pressure. Traffic in excess is lost silently, and without figures for real throughput an undersized link is discovered at the first restore.
The tenderer shall state the throughput of the unit under continuous load, not only the nominal link speed of the interface, together with the behaviour of the unit when incoming data exceeds link capacity.
The tenderer shall state the delay introduced for the data flow in question.
Where middleware is required, the tenderer shall state which protocols and applications are supported, how the integrity of a transfer is verified on the receiving side, and what happens to an interrupted or incomplete transfer.
Environment and operation
Why, and what happens without it: Operating temperature and storage temperature are different figures. Without the clause, equipment arrives that survives the transport but not the technical space.
The equipment shall be specified for operation in the temperature range [X] to [Y] °C in the intended location. The tenderer shall state operating and storage temperature for the offered article.
For placement in vehicles, containers or unconditioned technical spaces, the equipment shall be tested to MIL-STD 810G and MIL-STD 461F. Tested methods and levels shall be stated.
Monitoring
Why, and what happens without it: An alarm that requires a path back into the protected domain undoes what the diode does. The clause exists so that monitoring does not become the channel the design removed.
The equipment shall be able to raise alarms on link failure, power loss and status change without this requiring a connection into the protected domain. Alarms shall be available as SNMP traps.
TEMPEST/RÖS and the secure workplace
Approval level
Why, and what happens without it: The level follows the environment, not the classification of the information, and the chain breaks at the weakest device. Without a clause covering every device, an approved workstation arrives with an unapproved mouse in it.
The equipment shall be approved to TEMPEST Level A under SDIP-27, corresponding to the Swedish RÖS U1.
The level requirement applies to **every** device placed inside the zone boundary, including displays, keyboards, mice, audio devices, cameras, telephones, printers, copiers, document cameras and presentation equipment. A tender containing a single device without approval at the stated level does not meet the requirement.
The tenderer shall present the level per article number in a consolidated list. Where a device in the offered solution has no approval of its own, this shall be stated explicitly together with the tenderer’s justification for why the device may nonetheless be placed inside the zone boundary.
Level requirement by zone: [zone A] shall meet TEMPEST Level A / RÖS U1, [zone B] shall meet TEMPEST Level B / RÖS U2. The choice of level rests on the purchaser’s documented assessment of the environment and is not negotiable down by reference to the classification of the information.
Evidence
Why, and what happens without it: An approval that does not cover the offered configuration is not an approval. Without the clause, the deviation is the supplier’s to assess after the fact.
Approval shall be issued by an accredited laboratory. The certificate shall be attached to the tender. A statement in a datasheet, brochure or on a website does not constitute evidence.
The certificate shall cover the offered configuration. Where the offered configuration deviates from the tested one, the deviation shall be presented and its effect on the approval stated.
The tenderer shall on request be able to present the test report behind the certificate within the scope of a security protection agreement. That the report is not published openly is accepted; that it does not exist is not.
Installation responsibility
Why, and what happens without it: Seven of twelve TEMPEST environments fail on the installation, not on the equipment. Without the clause, approved devices arrive in premises that cannot be approved.
The tender shall state the installation conditions required for the delivered equipment to reach the stated level in the purchaser’s premises, at minimum covering: filtering of the incoming mains supply, physical separation of red and black cabling, containment for fibre, and which conductors may and may not cross the zone boundary.
The tenderer shall state which of these conditions are included in the delivery and which are assumed to be provided by the purchaser. **Conditions that are neither included nor stated are treated as not met.**
The tenderer shall state design power draw and heat dissipation per device and for the installation as a whole, and state the narrowest operating temperature range among the offered devices.
Installation shall be carried out by personnel covered by a security protection agreement and security-vetted for the assignment.
The delivery shall be accepted only once installation approval is in place, not when the equipment has been delivered. The payment plan shall follow this.
Configuration control
Why, and what happens without it: An approval is not eroded by one decision but by ten individually reasonable component swaps. Without these clauses nobody notices when it happened.
Delivered equipment shall be sealed on delivery. Sealing levels, the extent of the sealing and which role may break which seal shall be stated in the delivery documentation.
The tenderer shall describe its process for configuration change, including how the effect on the approval is established and communicated to the purchaser **before** the change is made.
Replacement of a component, enclosure part, cabling, mains cable or accessory in the approved configuration shall not take place without the purchaser’s written approval. The tenderer shall state which components are replaceable without affecting the approval, and which are not.
The tenderer shall state the support period and spare parts availability for each offered product family, together with the notice period on product discontinuation and whether a last-time buy is offered.
The tenderer shall state the country of design, development and manufacture per offered product, together with who has had physical access to the product in the supply chain.
M-number
Why, and what happens without it: An M-number and an emission approval are different things, and the number is assigned through a process the purchaser drives. Requiring it from a supplier without knowing that produces tenders that cannot be compared.
For delivery to the Swedish Armed Forces the equipment shall carry an M-number. The M-number shall be stated per article in the tender.
An M-number and a TEMPEST approval are two separate requirements and shall be presented separately. An M-number is not evidence of emission approval, and an emission approval does not confer an M-number.
Where an M-number has not yet been assigned, the tenderer shall state where in the process the case stands and the estimated date. The purchaser notes that M-numbers are assigned through a process driven by the contracting authority and cannot be produced by a supplier on request.
Security agreement (SUA) and export control
Why, and what happens without it: Export control and the security protection agreement decide whether the delivery is possible at all. The question belongs in the tender documents, not in a negotiation after award.
The assignment is covered by security-protected procurement with a security protection agreement (SUA). The tenderer shall state whether a security protection agreement exists with another authority and if so at what level.
The tenderer shall state whether the offered equipment is export controlled and which permits are required for delivery to the stated destination. The destination country is given in the tender documents and shall be answered explicitly.
Fiber communication, teleprotection and OT
Optical budget
Why, and what happens without it: A budget is in dB, range is in metres, and "typical distance" is neither. Without these clauses the link cannot be engineered, and the fault shows up as sporadic bit errors that look like equipment failure.
The tenderer shall state the optical system budget in dB per link, separately for every fibre type offered (9/125, 50/125, 62.5/125), together with the wavelength the budget applies to.
The tenderer shall state whether the quoted "typical distance" is calculated with or without system margin, and the size of that margin.
21-216 states 6 dB for 62.5/125 and 3 dB for 50/125.
The purchaser provides measured span attenuation for the actual link. The tenderer shall show that the offered equipment leaves at least 3 dB of remaining margin after deducting measured span attenuation, every connector pair in the link and a repair margin of 2 dB.
The tenderer shall state the minimum permitted received optical power (saturation limit) and whether an attenuation pad is required on link lengths below 100 m.
Documented for 21-215.
On handover, two-way attenuation measurement and an OTDR record shall be delivered for every fibre pair. Measurement in one direction only is not accepted.
Protocols and interfaces
Why, and what happens without it: Codirectional and contradirectional G.703 look identical in a tender and do not work together. Delay and clock source additionally decide whether the protection trips correctly.
The teleprotection interface shall follow IEEE C37.94 with a configurable number of 64 kbit/s channels (N). The number of channels shall be stated and shall be settable to the same value at both ends.
Where G.703 is offered it shall be stated whether the interface is codirectional (Codir) or contradirectional. The variants are not interchangeable.
The E1 interface shall be delivered as 120 Ω balanced on RJ48 *or* 75 Ω unbalanced on BNC. The requirement shall be stated per installation.
The tenderer shall state each conversion stage’s contribution to channel delay in microseconds, measured and not estimated.
No such figure is published for any product in the catalogue today.
Where the equipment takes part in a synchronous chain, the clock source shall be stated (network port or internal oscillator), and the behaviour on loss of the master described.
Where Synchronous Ethernet is offered, ITU-T G.8261, G.8262 and G.8264 shall be met, and the tenderer shall state explicitly that every network element in the synchronisation path has to support SyncE.
Fiber type and connectors
Why, and what happens without it: Coupling 62.5/125 into 50/125 costs about 4.7 dB in one direction and almost nothing in the other. The fault is one-directional and therefore hard to find.
The offered equipment shall be stated per fibre type: singlemode 9/125 µm, multimode 50/125 µm and multimode 62.5/125 µm. The budget shall be stated separately per type.
Connectors shall be stated per port (LC, SC, ST, MPO). Where the equipment carries a different connector from the existing installation, hybrid patch cords with the correct fibre type shall be included in the delivery.
The catalogue mixes ST, LC, SC and MPO between product families.
Every patch panel port shall be labelled with the fibre type, not only with a cable designation.
Temperature and environment
Why, and what happens without it: A relay cabinet is not an office. Without a clause on **operating** temperature rather than storage temperature, equipment arrives that works until the first winter.
Equipment in relay cabinets and unheated spaces shall have a documented **operating temperature** of at least −25 °C to +55 °C. Storage temperature alone is not accepted as compliance.
21-216-familjen och trip-länkarna uppfyller; 21-219v2 klarar −25…+70 °C; **fiberswitcharna gör det inte**.
Equipment in outdoor cabinets and vehicles shall have a documented operating temperature of at least −40 °C to +70 °C.
Only 21-215 meets this in the fibre category.
The equipment shall be mechanically qualified to IEC 60255-21-1 (vibration), -21-2 (shock) and -21-3 (seismic), class 2 as a minimum.
Mounting depth in a 19-inch rack shall not exceed 200 mm.
Supply shall be accepted from station auxiliary power within the range 48–250 VDC and 110–230 VAC in the same unit, without reconfiguration.
EMC and isolation
Why, and what happens without it: Switchgear is the electrically dirtiest environment the equipment meets. Without a stated framework a tenderer can pick the mildest one and still answer yes.
Equipment in switchgear shall meet IEC 60255-22-3 / IEEE C37.90.2 radiated immunity at 35 V/m as a minimum.
The equipment shall meet IEC 60255-22-4 class IV on the supply connection and class II as a minimum on the communications connection.
Dielectric testing to IEC 60255-5 at 2.0 kV for 1 minute, impulse testing to IEC 60255 / EN 50178 at 5 kV / 6 kV, and insulation resistance above 100 MΩ at 500 VDC shall be documented.
*Alternative framework:* immunity to IEC 61000-4-2/-3/-4/-5/-6/-8/-11/-17/-18/-29. The tenderer shall state which of the two frameworks the product is tested against — not both, where only one applies.
Railway installation: EMC to EN 50121-4 shall be documented.
Hazardous area: ATEX/IECEx approval shall be documented.
Service life, redundancy and maintenance
Why, and what happens without it: Grid owners procure against a 20–40 year installation life. Without a figure for the spare parts commitment, "long life cycle product" is a word — and two fibres in one cable are not redundancy.
The tenderer shall state the planned life cycle of the product and the commitment on spare parts supply, in years from the date of delivery.
The catalogue says "long life cycle product" without a figure.
The chassis shall permit replacement of the power supply and of a card module during operation.
A redundant power supply shall be fittable.
The equipment shall have a galvanically isolated alarm output as a normally open or normally closed contact, for connection to the alarm system of the installation.
An optical switch shall retain the selected channel on loss of supply voltage (latching function).
An optical switch with a web interface shall be connected to a separate management network and shall not be reachable from the network it switches.
Redundant links shall be routed in separate containment with separate building entries. Two fibres in the same cable are not accepted as redundancy.
KVM, HDBaseT and secure video conferencing
Domain separation
Why, and what happens without it: Shared peripherals are the channel between the domains. Without clauses on physical action, unambiguous indication and cleared memories, the separation is a setting.
The solution shall allow an operator to work against at least *[N]* mutually independent domains from one workstation, with no data path between the domains through the equipment at that workstation.
Selection of the active domain shall be by a physical action. The active domain shall not be changeable from any of the connected domains, nor through a network connection, a remote control protocol or a control system.
The active domain shall be indicated continuously and unambiguously at the workstation. The indication shall be driven by the actual state of the equipment and not by a control system’s understanding of that state.
No component in the solution may retain data, configuration or state originating in one domain after switching to another. The supplier shall present which memories exist in the signal path and how they are cleared.
The tenderer shall attach a block diagram showing where the domain boundary runs physically, together with a list of every signal that crosses the boundary and its direction.
KVM properties
Why, and what happens without it: The HDMI cable is not one-way: DDC, CEC, ARC and HEC run the other way. Without these clauses the presentation surface is a shared, writable node between every connected domain.
The KVM function shall present an emulated EDID to every connected source. DDC transactions from the source shall not be forwarded to the presentation device.
CEC, ARC/eARC and HEC shall be physically disconnected in both directions between source and presentation device.
The data path for keyboard and mouse shall be unidirectional from peripheral to active host, realised in hardware. Emulation in software is not accepted as compliance.
Only keyboards and pointing devices of HID class shall be accepted on the peripheral connections. Storage class devices, composite devices and devices that change class after enumeration shall be rejected.
The presentation device shall have no operating system and no local storage for user data.
Belagt uppfyllt av KVM-bildskärm 24" 60-00-8677 och 32" 60-00-7401.
Switching delay on domain change shall be at most *[X]* seconds, measured from the action to a usable image. The tenderer shall present the measured value.
USB handling
Why, and what happens without it: Disabled in software is still connected. Without clauses on positive disconnect, visible indication and HID restriction, the USB socket becomes the path the rest of the design closed.
USB connections at the workstation shall be disconnected by default and require an active physical action to connect ("positive disconnect").
Belagt uppfyllt av Secure USB Disconnect 60-00-0234 respektive 60-00-0235.
Connected status shall be indicated optically at the connection point, with separate indications for connected and disconnected.
The USB connection shall revert to the disconnected default state after at most *[T]* minutes without requiring a user action. *[T]* shall be set by the purchaser from the length of the working shift.
Storage devices over USB shall not be connectable through peripherals shared between domains.
Where the solution includes a touch screen, the touch data path shall be presented separately from the image path, and shall be either permanently assigned to one domain or connected through disconnectable USB as above.
Approval level
Why, and what happens without it: A chain where one device is *designed for* a level but not approved to it is not approved. The clause exists so the difference appears in the tender and is not discovered at inspection.
The equipment shall be approved to TEMPEST Level *[A/B]* under SDIP-27, corresponding to RÖS *[U1/U2]*. The approval shall be issued by an accredited laboratory and the certificate attached to the tender.
Every device in the signal path within the protected space shall meet the stated level. The tenderer shall list each device with its article number and the level it is approved to. Devices *designed for* a level but not approved to it shall be presented separately.
Equipment whose approval presupposes a particular configuration shall be delivered in that configuration. The tenderer shall state which interventions void the approval.
Where an M-number exists it shall be stated. The absence of an M-number shall be presented explicitly and not omitted.
Physical design and sealing
Why, and what happens without it: Sealing without a register proves nothing. These clauses tie the physical implementation to the routine that makes it meaningful.
Devices constituting a domain boundary shall be delivered sealed. The sealing shall be tamper-evident and shall cover every control that affects the security function of the device, including any EDID capture function.
The tenderer shall state which maintenance actions require a seal to be broken, and shall supply the procedure and the materials for resealing.
Storage media shall be accessible only behind a lockable hatch with a padlock of class 2 as a minimum, with optical and audible indication when the hatch is opened.
Belagt uppfyllt av Towerklient 60-00-7883.
Chassis opening shall be detected by a physical switch whose state can be read in the firmware of the system.
Installation responsibility
Why, and what happens without it: A room used at two levels is changed over physically, not in a control system. Without a commissioning record and a checklist, nobody knows what was actually disconnected.
Installation is part of the protection. The tenderer is responsible for the delivered equipment being installed so that the stated approval level is reached in the actual installation, including separation of red and black cabling, filtering of the mains supply and treatment of penetrations.
The tenderer shall supply an installation drawing showing cable routes, zoning and penetrations, together with a list of every fibre and cable that crosses a zone or domain boundary, with its function and direction stated.
On handover a commissioning record shall be drawn up documenting, for each device: serial number, approval level, seal identity, and — for devices with EDID capture — which presentation device the EDID was captured from and on what date.
The tenderer shall state the time a documented level changeover of the room takes, and shall supply the checklist to be used for that changeover.
Avser lokaler som ska användas på mer än en nivå — se mönster E.
Next step
Writing a specification now?
If a clause you need is not here, or you want a second reading of one you have drafted, ask. We would rather answer before the tender is published than after.