1CA2979 RLP ExhB3_CIS-SF ASR-03-Physical Security Construction Standards.pdf

USCIS Physical Security Construction Standard

Office of Security and Integrity

December 2019

Version 1.0

This Publication Supersedes all Non‐Procedural Countermeasures Outlined in the USCIS IHB 121‐01‐601, Facility Security Standards Dated June 2010

This Publication replaces the Facility Security Specific Requirements publication dated

November 2017

Record of Changes

Date Version Description Author

10/14/2019 1.0 Approved Draft of PSCS Document Laflamme, Barbieri, Underwood

11/18/2019 1.1 Added MegaCenter Section Under 3.2 Intrusion Detection Equipment

Laflamme

12/02/2019 1.2 IDS Panel Update Underwood

12/02/2019 1.3 OIT Comments Added to Annex C McCarthy

12/03/2019 1.4 Added 3.1 ACS Test Requirements Young

12/13/2019 1.5 Added Annex K: USCIS District and Field Office Special Requirements Document

Laflamme

1.0 Purpose

Table of Contents

2.0 Device Location Standardizations

2.1 Card Reader Location

2.2 Request to Exit (REX) Location

2.3 Push to Exit (PEX) Location

2.4 Door Closers

2.5 Door Sweeps

2.6 Door Contacts

2.7 Balanced Magnetic Switches (BMS)

2.8 Locksets – Mechanical, Electrical, Magnetic

2.9 Security Hinges

2.10 Camera Locations

2.11 Blue Strobe

2.12 Motion Sensors

2.13 Glass Break Sensors

2.14 Duress Buttons

2.15 Alarm Keypads

3.0 Security Systems Requirements

3.1 Access Control Systems (ACS)

3.2 Intrusion Detection Equipment (IDS)

3.2.1 Balanced Magnetic Switches

3.2.2 Motion Sensors

3.2.3 Glass Break Sensors

3.2.4 IDS Panels

3.2.5 Duress Buttons

3.2.6 Alarm Keypads

3.3 Cameras

3.3.1 PTZ

3.3.2 Fixed

3.3.3 Dome – 360°

3.3.4 Dome – 180°

3.3.5 Specialty – Thermal Imaging, Fisheye

3.4 Cabling Requirements

3.5 Security Rack and Components

3.5.1 Network Switches

3.5.2 Network Video Recorder (NVR) Specifications

3.5.3 Keyboard, Monitor, Mouse (KMM)

3.5.4 Access Control Server

3.5.5 Patch Panels

3.5.6 Uninterrupted Power Supply

3.6 Internet Protocol (IP) Addresses

4.0 Request For Lease Proposal Requirements (Public Facing)—FSL II & III

4.1 Site Security

4.1.1 Illumination of Entrances, Exits, Parking Lots and Garages

4.1.2 Visitor Access to Controlled Parking

4.1.3 Application of Barriers (e.g., Raised Curbs, Fencing, Bollards, Planters, etc.)

4.1.4 Authorized Parking

4.2 Structure Security

4.2.1 Blast Resistance Windows

4.2.2 Blast Resistance Façade/Structure/Progressive Collapse/Under

Building Parking

4.2.3 Burglary Resistance of Windows

4.2.4 Protection of Air Intakes

4.2.5 Security of Ventilation Equipment and Controls

4.2.6 Emergency Generators

4.3 Facility Entrance Security

4.3.1 Employee/Visitor Access Control

4.3.1.1 Occupant/Visitor Screening

4.3.2 Lobby Queuing

4.3.3 Perimeter Door and Door Locks

4.3.4 Control of Keys and Access Media

4.3.5 Emergency Exit Doors/Delayed Egress

4.3.6 Door Hardware Schedule

4.4 Interior Security

4.4.1 Blast Resistance Interior Spaces

4.4.2 Blast Resistance Mail Screening and Receiving Location

4.5 Electronic Security Systems (ESS)

4.5.1 Mailroom Security Considerations

Annex A: Acronyms and Definitions Annex F: Market Survey Template Annex B: Sample Key Plan Annex G: ESS Flow Chart Annex C: Access Control Annex H: LAP Flow Chart Annex D: Naming Conventions Annex I: Security Acceptance Checklist Annex E: Cable Labeling Conventions Annex J: Security Kickoff Handout Annex K: USCIS District and Field Office Special

Requirements Document

1.0 Purpose:

The purpose of this document is to provide procedural guidance for the Office of Security and Integrity Security Leads (SL), and the Regional Physical Security Specialists (RPSS), Facilities Project Managers (PMs) and General Services Administration (GSA) PMs with a tool to properly develop security measures when executing Lease Acquisition Projects/Major (LAP/Major), Minor Projects and Electronic Security System (ESS) Projects based on USCIS and Interagency Security Committee (ISC) requirements.

Included are general descriptions and specifications for USCIS security requirements. It is to be used in conjunction with the General Services Administration (GSA) Request for Lease Proposal (RLP), the District and Field Office Special Requirements document published by USCIS Facilities Management Division and the GSA Special Programs Division (SPD) USCIS Electronic Security Specifications guide when completing security projects for USCIS. NOTE: This document replaces the Facility Security Specific Requirements publication dated November 2017.

Combined with common sense, this document should be used to objectively design projects and assist the SL, RPSS and PMs in meeting the needs of USCIS by incorporating the theories of “rightsizing” and “customization” when developing individual Scopes of Work (SOW), all the while maintaining the spirt and intent of the Interagency Security Committee. (See Annex A for definitions of rightsizing and customization).

2.0 Device Location and Standardizations:

Not all USCIS facilities require the same level of protection, nor do they have the same physical characteristics; consequently, there is no way to standardize Access Control Systems (ACS), Intrusion Detection Systems (IDS) or Internet Protocol Video Surveillance Systems (IPVSS). What can be standardized, however, is the physical location in which devices and hardware should be installed. The need to consider alternative installation locations may arise. The SL or RPSS should always consider the cause and effect of relocating a device before authorizing its relocation.

2.1 Card Reader Location

With very few exceptions, all USCIS card readers will be installed on the ingress side of the door. In limited circumstances where access control of both the ingress and egress sides of the door must be maintained, employing the use of a card reader on both sides may be considered. In these scenarios, the SL and RPSS will review the building path of egress, as determined by the Fire Marshal, to determine if delayed egress equipment should be installed.

Card readers will be surface mounted near the door (Interior/Exterior) and located in a position to meet federal, state, local and Americans with Disabilities Act (ADA) laws. NOTE: Card readers will be located adjacent to ADA devices.

In limited circumstances, card readers that are placed back‐to back on the ingress and egress side of a door are to have a Radio Frequency Identification (RFID) inhibitor plate installed to prevent cross frequency interference.

When installing card readers on the exterior of USCIS facilities, ensure that they are protected from all harsh elements and vandalism; e.g.

snow, rain, direct/prolonged sunlight and extreme wind. (This will include all card readers mounted to pedestals).

2.2 Request to Exit (REX) Location

REX sensors will be mounted above an ACS equipped door on the egress side, unless an electrified lockset is installed. The sensor will be angled to detect motion within five feet of the door. NOTE: REX devices will not release electric strikes. Electric door strikes will solely be controlled by the access control system relays when an authorized card read is granted.

2.3 Push to Exit (PEX) Location

PEX actuators will be surface mounted near the strike side of the door and located in a position to meet federal, state, local and ADA laws.

2.4 Pneumatic Door Closers

Generally installed at the top of the door by the side of the hinge.

All ACS equipped doors must have a hydraulic door closer installed to ensure door closes, and latches after use. NOTE: All fire rated doors must be equipped with a door closer or self‐closing hinges.

2.5 Door Sweeps

Install automatic door bottom and floor threshold devices on HSDN/Talon rooms.

2.6 Door Position Switches (DPS)

When feasible, DPS, also known as door contacts, will be securely mounted on the door head and the top rail of the door.

There may be instances when the door contact will need to be installed on the vertical doorjamb and the lock stile.

2.7 Balanced Magnetic Switches (BMS)

In USCIS single tenant facilities, all exterior perimeter doors and roof hatches will be equipped with a BMS.

In multitenant facilities, doors leading into USCIS space from common areas will be considered perimeter doors and will require

BMS.

GSA federally owned facilities that house multiple federal agencies in which USCIS is not the lead tenant agency, do not require BMS on the exterior perimeter doors if the following conditions exist:

Lead tenant agency at the facility has operational BMS in place.

Facility is manned by government contracted Protective

Service Officers (PSOs) on a 24/7 basis and USCIS is able to install door contact monitoring workstation.

2.8 Locksets—Mechanical, Electrical, Magnetic

Mechanical and electric locksets will be installed on the lock stile.

o Storeroom function locks and hardware are required for all doors receiving card readers. These locksets/hardware have a lever on both sides, but the outside is stationary and cannot be moved.

From the outside, the door latch is operated with a key. On the inside, simply engaging the lever will retract the latch. (For doors with panic hardware and/or magnetic locksets). In no circumstance will a classroom function lockset be used on a door with a card reader.

o Locksets will be high‐security, tamper‐resistant, commercial‐grade mortise locksets with storeroom function lock.

o Locksets will be on the master key system determined by USCIS.

o The Security Integrator will provide and install a wall‐mounted, organized, lockable key box to accommodate all required keys to

USCIS space. A minimum of two (2) keys that open the key box will be provided to USCIS.

o Locksets will be six‐pin cores.

o Locksets will have interchangeable cores, and the security integrator will provide a core removal key to USCIS.

o A key plan will be developed with coordination from USCIS displaying key cut codes, pin codes, key numbers, and their corresponding door access will be provided by the security integrator. (The number of keys required will be determined during the key plan development.)

NOTE: A KNOX‐BOX may be required by local code or by USCIS guidance to secure an access device (i.e., key or access card) to expedite Fire Department entry. If required, a tamper switch alarm will be installed.

o If electric strike opens from unsecure space, install strike latch guard.

Magnetic locksets will be installed on the top rail of the door.

o Only use magnetic locksets on double doors that are glass, with or without framing, and do not have astragal (center piece).

The use of electrified vertical rods is not acceptable.

o Locks will be mounted/installed in accordance with security industry standards as well as federal, state, local, fire and ADA laws.

o Locks will be powered with dedicated Direct Current (DC) power.

o A single motion PEX or touch‐sensitive panic bar with built‐in request to exit will be installed on the egress side to deactivate the magnetic field for exit. Request to Exit (REX) device will depend on the door type and location.

o Magnetic locking devices without built‐in Electronic Magnetic

Field (EMF) suppression and/or magnetic locking devices that draw large amounts of current (typically older models), shall be installed using external isolation relay(s). Doing this will protect

ACS components from potential transient EMF these magnetic locking devices can generate.

o Battery uninterruptible power supply (UPS) will be supplied and support a minimum of 4 hours.

o For main entrance visitor doors, a toggle switch accessible on interior above door will be provided to disable magnetic locks during business hours.

o Doors equipped with magnetic locksets will also have mechanical vertical locksets that can be actuated with panic hardware, locked in open position by locking down panic bar with hex key, and either secured or unlocked using a mechanical lockset and key from exterior. (See Mechanical Lock Specifications under Section 5.2)

2.9 Security Hinges

Secure perimeter doors with non‐removable hinges.

2.10 Camera Locations

Install cameras where field of view (FOV) provides optimal forensic details.

o Internet Protocol Video Surveillance System (IPVSS) Field of View:

The Interagency Security Committee outlines the IPVSS field of view requirements. The design of the IPVSS will vary depending on the objective of the surveillance, environment, facility type, and end‐user requirements. Coordination between the on‐site security representative and the Security Integrator is essential to maximize the operational effectiveness of the IPVSS and integration with other physical security equipment. The IPVSS field of view will be based on primary objective/purpose of the IPVSS scene content.

o Recognition – Recognition is best described as a camera designed to observe and identify a person or object with enough detail for courtroom quality. This level is often utilized as facial recognition or license plate recognition. The minimum horizontal resolution should be 80 pixels per foot. Recognition view should be utilized for facility entrances and exits when possible.

o Forensic Review – Forensic Review is best described as being designed for use at a later time to identify objects of interest.

For example, type (make/model) of a car in a parking lot. The minimum horizontal resolution should be 40 pixels per foot.

o Observation – Observation is defined as a continuous overview of scene content captured. The camera purpose is best described as being capable of capturing an image that can be utilized to verify the general characteristics of the image. For example, the number of cars or people in a parking lot. The minimum horizontal resolution should be 20 pixels per foot.

Install interior cameras 8 to 10 feet from the ground when feasible.

Cameras will be positioned to view activities in the following areas:

loading docks, guard screening areas, lobbies, waiting room/information counters, entrance doors, ceremony rooms and Government Owned Vehicle (GOV) parking areas.

Cameras will provide complete 360° video coverage of all exterior perimeters controlled by USCIS; visitor and employee entrances into USCIS space.

Specialty cameras will be installed as prescribed by the SL and/or RPSS; to include a fisheye camera over X‐Ray screening areas.

2.11 Blue Strobe

Install a blue strobe light in a conspicuous location at the screening or guard workstation. Consider the most advantageous location to ensure visibility when an alarm or duress button is activated.

2.12 Motion Sensors

Locate motion sensors in close proximity to all skylights, guard screening areas and main hallways leading to exterior exits.

Glass perimeter doors in non‐federal facilities will be covered by motion sensors and BMS.

2.13 Glass Break Sensors

Mount glass break sensors in the ceiling, where feasible, to cover all glass that is less than or equal to 16ft above street level. In addition, all USCIS glass/windows that are accessible by permanently affixed ladder, roof, or skywalk will have glass break sensors.

2.14 Duress Buttons

Locate Duress buttons at each info counter window, guard work area and

Directors Office. Duress alarms will be desk mounted, recessed, and out of sight from the general public, visitors, and customers. The duress alarm will be positioned within arm’s reach of the user when seated at their respective desk/stations.

2.15 Alarm Keypads

Keypads will be mounted inside secured space near main entrances, employee entrances and guards desk. Keypads are to be located in a position to meet federal, state, local, and ADA laws.

2.16 Audio/visual intercom transmitters (AVT)

AVT will be located at mailrooms, select suite entrances and loading dock areas and capable of remote door release. Audio/visual receivers (AVR) will be located at guard station and/or the mission support area.

3.0 Security Systems Requirements:

The Security Integrator will furnish and install the following security system components, as defined by the SOW:

Access Control System (ACS) Intrusion Detection System (IDS) Internet Protocol Video Surveillance System (IPVSS)

Each system will be capable of initially operating on an integrated standalone platform which can provide USCIS with the ability to access, monitor, administer and control all three systems through a single client.

This section will detail the Security Integrator’s responsibility for providing a fully operational ACS, IDS, IPVSS and security rack configuration. USCIS security systems will have the below listed salient characteristics.

3.1 Access Control Systems (ACS)

See Annex C for specific system requirements for Gallagher, CCure and Lenel. Security Integrators may provide bids for ACS that have the same salient characteristics as those mentioned above; however, before any alternate ACS system will be considered, it will have to be certified in the USCIS Information Technology Lab before being allowed to operation on the USCIS Enterprise. It should be noted that this process is lengthy and will significantly impact the ESS upgrade timelines, potentially disqualifying a Security Integrator from placing a bid. The Security Integrator may be liable for partial or full compensation for costs incurred to USCIS when testing a proposed solution. Contribution amount will be defined by USCIS before procuring the equipment.

3.2 Intrusion Detection Equipment (IDS)

The Security Integrator shall completely install the security system. The liability of all installation and complete testing is the sole responsibility of the Contractor/Installer and includes the proper functioning of the zones into the MegaCenter. The FPS MegaCenter will provide minimal support for troubleshooting, but this does not reduce any of the Installer/Alarm Contractor responsibilities. The Installer should have working knowledge of the manufacturer’s system they are installing. The Technical Service Desk (TSD) will not walk the Installer though how to install the system. The Installer shall contact the MegaCenter Alarm Services Desk for programming standards.

Once installation is completed, notify the MegaCenter that the panel is ready to be programmed. Local keypad programming will be locked out and all future programming issues will be handled through the MegaCenter. If installation issues arise, the Installer/Alarm Contractor shall contact the equipment manufacturer’s technical support for the system they are installing.

When the alarm system is completely installed and programmed to the MegaCenter’s specifications, it must be fully tested with the MegaCenter Alarm Services Desk and the Installer/Alarm Contractor. If required by the installation contract, the Contractor must then schedule an acceptance inspection. Once this inspection is completed and the work determined satisfactory, (by someone other than the Installer, i.e. FPS, COTR, or client agency) the MegaCenter can issue a test report indicating all zones have been tested successfully to FPS, COTR, or client agency conducting the inspection as part of the package for final payment.

Once all the information is received, the MegaCenter will provide an account number for the project. The alarm will be disabled during testing and placed online when all of the required information and testing has been completed.

IDS will include Federal Protective Services (FPS) Mega‐Center approved alarm panels, passive infrared (PIR) dual technology sensors, balance magnetic switches, duress alarms, glass break sensors, dual technology motion detection sensors and tamper alarms. NOTE: Each sensor will have tamper indicating circuitry installed. Device tamper alarms will be annotated on the Mega‐Center Alarm Requirements (MAR) document.

IDS is required for all perimeter access, ground floor windows, and any other windows with direct access from adjacent rooftops, and roof hatches into USCIS space. IDS will include FPS Mega‐Center–approved alarm panels, PIR dual‐ technology sensors, BMS, duress alarms, glass break sensors, dual‐technology motion detection sensors and tamper alarms (panel and sensors). The IDS keypad(s) (arm/disarm control) must also be located near the employee entrance.

All sensors will be individually zoned such that the alarm location can be easily located through the use of simple zone maps by responding forces. For this reason, the daisy chaining of sensors, alarms, or zones is prohibited.

Zoning needs to allow individual areas to be disarmed for after‐hours use (i.e., the interior alarms could be disarmed for after‐hours use but the perimeter alarms would remain armed). Zoning requirements will be determined by FPS Mega‐Center.

Alarm messaging language will meet the FPS Mega‐Center Monitoring Station requirements.

The Security Integrator will provide enough battery backup power to support four (4) hours of continuous power to intrusion detection equipment in the event of power loss. Batteries will be machine labeled with the date of install.

3.2.1 Balanced Magnetic Switches

BMS will act as an alarm to the IDS when armed and provide door status notifications to ACS.

NOTE: Install double pole, double throw (DPDT) to provide door contact monitoring to the ACS when the BMS is not activated.

BMS will be housed in weatherproof enclosures when exposed to outside elements.

BMS will incorporate removal (pry) tamper circuit. Surface mounted switches may be used at the approval of SL and/or RPSS, but they must meet salient features stated above.

BMS will be Harco Magnasphere HSS L2 series or equivalent.

3.2.2 Motion Sensors

Dual technology consists of PIR and microwave detection technology integrated into a single enclosure.

Must have a 360° capability to provide effective coverage of area.

Motion sensors will be on different microwave frequencies when positioned in same area.

If installed in an IDF or MDF, the motion sensor will be set to microwave detection only.

Motion sensors will not be mounted on or near pipes, steel girders, or

HVAC systems as doing so may result in false alarms (ex. hanging microphones, fans, venetian blinds, open windows).

Optional: 360‐degree, ceiling‐mounted, dual‐technology motion sensors may be used for large areas or where the use of directional sensors is not feasible.

3.2.3 Glass Break Sensors

All sensors will be based on the flex‐guard technology. (Once the glass break detects both audio and impact signals, it will send an alarm virtually eliminating false alarms.)

Glass break sensors will be ceiling mounted devices, where feasible.

Contractor will provide a glass break testing device matching devices installed.

Glass break sensors will provide detection of plate, safety, laminated and tempered glass breakage.

Glass break sensors will be Honeywell SG16256T or equivalent.

3.2.4 IDS Panels

Each IDS Panel will be connected to the FPS Mega‐Center servicing the area for alarm monitoring via an individual analog “POTS” (Plain Old Telephone System) landline. The Lessor will be responsible for providing the analog telephone line (POTS) for the required communication to the Government’s alarm answering service. The Lessor will pay for and maintain this line for the term of the lease.

Connection to the Mega‐Center requires the use of panels from the following manufacturers: Bosch (Model: D9412G‐V4) or Digital.

Mega‐Center Alarm Requirements (MAR) Request Form is required to be completed and approved by FPS prior to connecting. Portions of the MAR are required to be completed by the Security Integrator and Field Security Manager

(FSM) and or/RPSS.

NOTE: Alarm systems will be configured for manual arming/disarming unless otherwise specified by USCIS.

The Security Integrator is responsible for pre‐testing and programming the IDS with the Mega‐Center (at a minimum) three (3) weeks prior to security acceptance. Pre‐testing will consist of actuating each individual zone then restoring the zone on the associated IDS keypad. The Mega‐ Center must confirm the restored zone verbally and in the alarm history report to pass a zone.

3.2.5 Duress Buttons

Field Office Director (FOD) and info‐counter duress alarms shall annunciate at the guards desk via audible and visual notification. The guard visitor screening station duress alarm will annunciate at the Mega‐ Center. If the facility does not have guard service, all duress alarms will annunciate at the Mega‐Center. All other offices have the ability to call the guard desk through 911 services and speed dial.

Duress alarm annunciations will be distinguishable from other alarm annunciations.

Duress alarms must have a method to prevent accidental annunciation.

Duress alarms will lock‐in alarm mode until manually reset by key or similar device. NOTE: Key or similar device will be kept with the PSO and FSM/LSO on site.

3.2.6 Alarm Keypads

A Bosch D1260B keypad or equivalent shall be used. Keypads will be mounted inside secured space near main entrances, employee entrances, and guards desk. Keypads are to be located in a position to meet federal, state, local, and ADA laws. The alarm delay will be set at minimum 30 seconds and maximum of 60 seconds. Keypad alarms locations will be clearly indicated on construction documents. Quantity of keypads will depend on number of partitions, floors, zones, etc.

Monitoring Products (DMP) XR550 Alarm Panel. NOTE: Before acquisition Security Integrator must verify models with the Mega‐Center due to constant changes in FPS requirements.

3.3 Cameras

USCIS employs Fixed, Pan/Tilt/Zoom (PTZ) and dome form factors. Cameras will be positioned to view activities at the loading dock, guard screening areas, lobbies, waiting room information counters, perimeter entrance doors, and the exterior of the building/parking areas. In some instances, cameras will be positioned to view the entry/egress of large file storage areas. All cameras will have the following general features:

A minimum Axis P‐Series or equivalent. The P‐Series is considered versatile and an advanced video product.

Will be ONVIF compliant.

Exposed camera wires will be covered by flex conduit or installed in a neck mount system to deter tampering.

Camera housings will have a vandal resistant rating unless otherwise directed by SL and/or RPSS.

Exterior camera housings must be weather resistant and capable of operating in extreme hot/cold environments as well as high and low humidity environments.

Optical lens will be determined by the scope of the project.

Cameras will be at minimum high definition at 1080P.

Cameras will be at minimum Microsoft Windows 10 Server compatible.

Cameras will be equipped with motion detection for motion detected recording unless directed otherwise by SL and/or RPSS.

Cameras will be equipped with Light Finder or Optimized Infrared

(IR) Illuminator technology to allow viewing out to the maximum optical zoom capability of the camera.

Cameras will support Axis Zipstream technology (or equivalent).

Cameras will have a Wide Dynamic Range (WDR) function.

3.3.1 PTZ

Cameras will be mounted on parapet style mounts with swing‐in arms for maintenance/repairs to camera from roof access. Parapet length determined by SL and/or RPSS as needed.

Cameras will hang out and above corner of facility to allow an unimpeded 360° view.

Cameras will be powered by dedicated AC/DC or Power Over Ethernet (PoE) with Injector.

Will be used in combination with joy stick.

SL and/or RPSS will determine programming.

3.3.2 Fixed

Will have corridor format as determined by the SL and/or RPSS.

Power‐Over‐Ethernet (PoE) for network connectivity and power with a single cable.

Cameras will be Indoor/Outdoor rated.

3.3.3 Dome—360°

8 MP, 360° multidirectional camera, one IP address 360° IR illumination and remote zoom and focus Axis Lightfinder and Forensic WDR or equal Flexible positioning of four varifocal camera heads Axis Zipstream for reduced bandwidth and storage needs or equal

3.3.4 Dome—180°

Seamlessly stitched images 180° horizontal and 90° vertical coverage

8.3 MP resolution at full frame rate

Axis Lightfinder and Forensic WDR or equal Axis Zipstream or equal for reduced bandwidth and storage needs 180° view capability with minimum 4320x1920 resolution

3.3.5 Specialty—Thermal Imaging, Fisheye

Fisheye will be defined in a project by the SL and/or RPSS to provide the camera image output characteristics of a convex non‐rectilinear appearance.

Thermal capable cameras will be defined by the SL and/or RPSS to produce images, or thermograms, as visual displays of the amount of infrared energy emitted, transmitted, and reflected by an object.

3.4 Cabling Requirements

All cabling will be plenum rated under National Fire Protection Association (NFPA) Standard 90A. No riser cabling will be used in any project. Wire will be sized according to the manufacturer's specification. Wire must be upsized after considering voltage drop and load calculations as specified in the technical portions of this specification.

o All cabling will be labeled and identified in accordance with Annex E. Label makers will be used to mark cabling. Permanent markers used to label cable is not acceptable.

Cat 6A shielded cable will not be accepted.

A Fluke Level 5 or higher cable tester must be used to certify the complete cable plant installation. Permanent Link Test required for Category 6A certification. Fluke Linkware format (.flw) is required for technical deliverables package.

The manufacturer of the conductivity/termination hardware is responsible for supporting the single‐source warranty of the complete cable plant installation. The selected cabling contractor is required to be a certified installer with trained technicians of the proposed manufacturer’s product. The proposed cable plant solution must meet the minimum 15‐year application assurance warranty to include product, cable, etc. and labor for the provided installation.

Terminate Category 6 horizontal cables on patch panels and modular outlets to meet manufacturer’s requirements. (Do NOT allow pairs to untwist, and outer jacket should only be a ½ inch from termination point). Route cables from both sides of equipment rack when terminating on patch panels with separation down center of rack, and use wire management, supporting bars, etc.

Cable labeling requirements:

o Naming conventions (See Annex D) shall be used throughout the system architecture, reflected on submittals and as‐built documentation, and when programming or configuring ACS database objects.

o Security Integrator is required to label each cable at the back of the patch panel and as close as possible to the terminating point in the controller. Labels will also be placed at each end of each device. Additionally, all controller Ethernet connections are required to be labeled at each end of the device location and at the front of patch cable.

3.5 Security Rack and Components

The rack will be provided by the Security Integrator according to the model number and build specifications contained in Annex C.

The security rack components will consist of the following: Network Switches, Network Video Recorder (NVR), Keyboard, Monitor, Mouse (KMM), ACS Server, Patch Panels, and UPS.

3.5.1 Network Switches

Network switches will integrate all components of the ACS and IPVSS.

All network switches will have Power Over Ethernet (PoE) capability and must be approved by USCIS Office of Information Technology (OIT).

Switches will be securely mounted and provided proper ventilation.

The default configuration is half PoE On/Off commiserate with the number of ports available on the switch.

Network switches will not be configured with port security.

All network switches will be configured to full duplex.

Network switches will be procured and provided by OSI Field Security

Division (FSD), Operations Branch, Physical Security Section for ESS Modernization Projects unless stated otherwise; however, for LAP projects network switches and switch peripherals (ex. fiber jumpers, SFP, etc.) will be procured by the Security Integrator.

All network switches are accountable property and will be placed into USCIS Sunflower Asset Management System (SAMS) by a USCIS Property Custodian.

3.5.2 NVR Specifications

Video system shall be based on Milestone Video System with Axis cameras or equivalent. Security integrator will verify that all video components are compatible with the current or awarded ACS and will provide all necessary integration licenses to provide full interoperability between the ACS and IPVSS.

The NVR will be mounted in the security rack within the Local Area Network (LAN) room. The Security Integrator is responsible for assessing pre‐existing racks that may be used as part of the project, as determined in the bid‐walk.

The NVR will record at a minimum of 15 frames per second for 30 days for all cameras, as defined by the National Archives and Records Administration (NARA) GRS 21, Items 11 and 18.

The NVR will have a minimum of 10 Terabytes of storage capacity for recording all cameras. USCIS’ standard for recording is motion activation to reduce storage capacity while still meeting the 30 day requirement.

Exceptions may be made for 24 hour recording as determined by the SL and/or the RPSS. Note: NVR will overwrite video stored by oldest date automatically once it has reached capacity.

NVR will allow playback by choosing date and time and must auto adjust for daylight savings time changes.

NVR will support the amount of cameras on the system using IP based Ethernet (RJ45) connections.

NVR will have Microsoft Windows 10 server compatibility or better.

NVR will be capable of recording up to 2 MP resolution at 15 frames per second.

NVR video compression will be H.264 or MPEG‐4.

NVR will be capable of alarm triggered camera action.

NVR will allow export to secure digital device (i.e., encrypted thumb drive).

NVR will support remote management and configuration.

NVR will support activity log.

Functions will include alarm outputs, time/date stamps, motion detection, and management software, manage color/black and white cameras, and allow operation in duplex mode.

NVR will produce footage copies with watermarks or security stamps to prevent tampering and/or manipulation. A sample of the watermark or stamp must be provided to the SL and/or RPSS prior to the close of the project for approval.

When it is determined that cameras will record on motion, Security Integrators will create a rule in the Milestone NVR to record five seconds before motion is detected and stop recording three seconds after motion ends to ensure full motion incident is recorded, within the determined motion detection overlay.

3.5.3 Keyboard, Monitor, Mouse (KMM)

The Security Integrator will supply a KMM. See Annex C for specifications.

3.5.4 Access Control Server

The Security Integrator will supply a server according to the model number and build specifications found in Annex C.

The servers will come preconfigured with the defined ACS operating and management software.

3.5.5 Patch Panels

Will be provided by Security Integrator to streamline the cabling infrastructure within the rack. Patch cables will be consistent with OIT cabling standards. E.G.: The Security Integrator will not install CAT5 patch cables when CAT6A is utilized elsewhere.

3.5.6 Uninterrupted Power Supply

The Security Integrator will supply a UPS capable of providing:

o 90 minutes of power backup for the ACS.

o 90 minutes of power backup for IPVSS.

Prior to site acceptance the Security Integrator is responsible for testing the UPS for each system at rest to ensure runtime requirements are satisfied.

UPS must have a self‐test function. The Security Integrator will provide end user training for self‐testing.

3.6 Internet Protocol (IP) Addresses

The project manager will inquire/request IP Addresses from OSI FSD POC via the SL. For each project category (LAP, ESS, Minor) that is adding electronic security components, IP addresses will be needed. The following is a list of components that may require IP addresses:

o Card Readers o Door Controllers o Security Server o Enrollment Workstations o Guard Stations o Security Cameras o Network Video Recorder (NVR) o Video Encoders/Splitters connected to Large Security Monitors

(i.e. Smartwall) o Network Switches connected to Security System

NOTE: OSI FSD POC will request additional IP addresses congruent with potential expansion of the security system (USCIS Standard is 10%).

4.0 Request for Lease Proposal Requirements (Public Facing)—FSL II & III

This section will discuss Request for Lease Proposal (RLP) requirements for Facility Security Level II and III public facing facilities. A risk assessment may determine the need for further or enhanced countermeasures to be included as part of the lease. All level II measures in the GSA Public Buildings Service (PBS) desk guide apply, plus the additional USCIS measures below:

4.1 Site Security

4.1.1 Illumination of Entrances, Exits, Parking Lots and Garages

Facility entrances, exits, parking lots and garages will be illuminated to a minimum of five (5) lumens, at all times.

4.1.2 Visitor Access to Controlled Parking

Designate employee and visitor parking areas. Use signs designating visitor and/or employee parking areas.

Designate Government‐Owned Vehicle (GOV) parking areas. GOV parking should be parking areas closest to facility.

4.1.3 Application of Barriers (e.g., Raised Curbs, Fencing Bollards, Planters, etc.)

Will be determined during Preliminary Facility Security Level (FSL) Assessment.

In new construction, Crime Prevention through Environmental Design (CPTED) methods will be utilized to control flow of persons and vehicles. The use of natural barriers will be utilized when available.

4.1.4 Authorized Parking

Access to Government‐Owned Vehicles (GOV) must be covered by video surveillance.

4.2 Structure Security

4.2.1 Blast Resistance Windows

Film will be applied to all external windows.

The Lessor shall provide and install shatter‐resistant material.

Security window film, in the context of mitigating hazards from blast, is 7‐mil (7/1000 in.) thick or thicker on all exterior glass windows and doors in Government‐occupied space, meeting the following properties ‐ Film composite strength and elongation rate measured at a strain rate not exceeding 50% per minute shall not be less than the following:

o Yield Strength: 12,000 psi o Elongation at yield: 3% o Longitudinal Tensile strength: 22,000 psi o Traverse Tensile strength: 25,000 psi o Longitudinal Elongation at break: 90% o Traverse Elongation at break: 75%

New glazing systems will be designed with a minimum ½‐inch bite.

4.2.2 Blast Resistance Façade/Structure/Progressive Collapse/Under Building Parking

Use of construction materials which have inherent ductility and which are better able to respond to load reversals (e.g. cast in place reinforced concrete column construction).

4.2.3 Burglary Resistance of Windows

Windows in FSL II facilities that are on the ground floor will be lockable and monitored by IDS if they can be opened.

Windows in FSL III facilities shall be non‐operable and will be monitored by IDS.

4.2.4 Protection of Air Intakes

Lessor will provide emergency shutoff equipment for HVAC systems, and will secure accessible air intake grilles from tampering and removal.

4.2.5 Security of Ventilation Equipment and Controls

Protect the systems controls from unauthorized access.

4.2.6 Emergency Generators

If provided, the Lessor will locate emergency generators, either pre‐existing or installed as part of tenant improvements, in a secure area, protected from unauthorized access and vehicle ramming, if outdoors.

The emergency generator, and its fuel tank, must be located at least 25 feet from loading docks, entrances, and parking areas. (If the 25 foot distance cannot be achieved, a combination of standoff, hardening, and venting methods must be implemented to protect utilities from vehicle borne improvised explosive devices.

4.3 Facility Entrance Security

4.3.1 Employee/Visitor Access Control

4.3.1.1 Occupant/Visitor Screening

Magnetometers and X‐rays at public entrances. Magnetometers and X‐ray machines will be installed by the Government at the public entrance.

Armed security guards, provided by the Government, will direct the occupants and visitors through the screening equipment.

Appropriate lobby and entrance/exit space will be made available for this purpose. This space will be considered part of the lease common area and not ABOA (Usable) square footage.

NOTE: OSI will conduct a security assessment for non‐public facing FSL II facilities to determine guard requirements.

4.3.2 Lobby Queuing

Lobby should be designed to accommodate guard station, Magnetometer and X‐Ray machine.

The Architecture and Engineering (A&E) firm will work with

USCIS project manager to determine throughput and pedestrian traffic flow to minimize queuing.

Consider power supply locations and limit exposed wires to prevent tripping hazards.

4.3.3 Perimeter Door and Door Locks:

Secure perimeter doors with non‐removable hinges and electronic security system devices.

Doors will have mechanical locksets for manual key override.

4.3.4 Control of Keys and Access Media

Lessor will provide a key plan and provide high security locksets with interchangeable removable cores with core change key.

Lessor will also provide construction cores to be exchanged with permanent cores at acceptance.

4.3.5 Emergency Exit Doors/Delayed Egress

All doors designated “emergency exit only” will be equipped with automatic door closer and delayed egress panic hardware with a local audible alarm with key reset.

The delay time will meet local fire code requirements.

4.3.6 Door Hardware Schedule

See USCIS District and Field Office Special Requirements Document published by Facilities Management Division Field Space Management Branch.

4.4 Interior Security

4.4.1 Blast Resistance Interior Spaces

4.4.2 Blast Resistance Mail Screening and Receiving Location

4.5 Electronic Security Systems (ESS)

The Lessor will be responsible to provide and install all electronic security systems. The Lessor will maintain these systems and all associated security equipment for 364 days which will commence on the official date of GSA facility acceptance. The lessor is responsible for transferring all security warranty information and software licenses to USCIS at the end of the lessor’s maintenance responsibility; at which time the government will take complete ownership and maintenance responsibility through the remaining term of the lease. The complete requirements for the electronic security systems are provided in the attached annexes. All security equipment will become the property of the government at the end of the 364 day period and at its sole option, the Government may abandon property in the space following the expiration of the Lease or retain the right to remove the equipment. The Lessor will be relieved of any liability in connection therewith after the initial 364 days post GSA facility acceptance.

All installed systems, components and devices will comply with all referenced codes, standards and/or government requirements. It will be the Lessor’s responsibility to ensure that the proper coordination between all trade divisions be accomplished so that the ESS system is complete.

The Lessor’s designer and installing Security Integrator will be certified and/or licensed by the manufacturer of the systems, equipment and components that they are installing.

The Lessor will provide adequate training to USCIS personnel on the operation of all installed electronic security systems and equipment. A minimum of eight hours of training will be included.

The Lessor will provide to GSA/USCIS shop drawings, product data, material list and/or cut sheets on all devices, systems and/or components which are to be provided under the scope of work.

USCIS will review and provide comments on the provided information.

All ESS wiring will follow the USCIS cable plant standards.

4.5.1 Mailroom Security Considerations

Lessor will provide space suitable for the Government to inspect and screen all mail and packages using X‐ray in the mailroom.

Mailrooms will be located on exterior walls with direct adjacency to bulk storage rooms. (See USCIS District and Field Office Special Requirements Document published by Facilities Management Division Field Space Management Branch).

If there is no mailroom or mailroom is located above ground level, Lessor will provide space at an existing screening location or at an alternative location in the building acceptable to the Government.

The space will be located on an exterior wall, 25 feet or less from an exterior door, with a stand‐alone air handling system.

The screeners will physically inspect items that cannot be passed through screening equipment before distribution to the Government agencies throughout the facility.

This space will be considered part of the lease common area and not ABOA square footage. All mail and packages not examined at a Consolidated Remote Delivery Site (CRDS) will be subject to X‐ ray screening and/or visual inspection.

This document is the final version of the USCIS Physical Security Construction Standard.

The information contained herein is subject to change. The document will be reviewed annually for consistency and applicability.

Alan G. Young Chief, Physical Security Section, OSI, FSD.

ANNEX A: Acronyms and Definitions

ACS Access Control Systems

ADA Americans with Disabilities Act

BMS Balanced Magnetic Switches

CPTED Crime Prevention through Environmental Design

CRDS Consolidated Remote Delivery Site

DMP Digital Monitoring Products

DPDT Double pole, double throw

DPS Door position switches

EPACS Enterprise Physical Access Control System

ESS Electronic Security System

FOD Field Office Director

FOV Field of view

FPS Federal Protective Services

FSL Facility Security Level

FSM Field Security Manager

FSOB Field Security Operation’s Branch

GOV Government Owned Vehicle

GSA General Services Administration

HSDN Homeland Security Data Network

IDS Intrusion Detection Systems

IPVSS Internet Protocol Video Surveillance Systems

LAN Local Area Network

LAP Lease Acquisition Projects

LSO Local Security Officers

MAR Mega‐Center Alarm Requirements

NARA National Archives and Records Administration

NVR Network Video Recorder

OIT USCIS Office of Information Technology

OSI Office Of Security and Integrity

PACS Physical Access System

PEX Push to Exit

PIR Passive Infrared

PoE Power‐Over‐Ethernet

POTS Plain Old Telephone System

PSOs Protective Service Officers

PTZ Pan/Tilt/Zoom

REX Request to Exit

RFID Radio Frequency Identification

RLP Request for Lease Proposal

RPSS Regional Physical Security Specialist

SAMS Sunflower Asset Management System

SL Security Lead

SOW Scopes of Work

USCIS United States Citizenship and Immigration Service

WDR Wide Dynamic Range

Definitions:

Rightsizing ‐ in this context means to provide a security system that is neither too big nor too small to meet the specific needs of the facility and USCIS mission.

The following is an example of the “rightsizing” approach:

If facility “X” is a multi‐tenant facility in which the GSA provides the perimeter cameras and Balanced Magnetic Switches (BMS) on the exterior of the facility, it would not be necessary; and, more importantly, cost conscious to place cameras and BMS next to GSA devices just because it is common practice for USCIS facilities. As an alternative, the SL or RPSS should work with the Field Security Manager (FSM) and/or Local Security Officers

(LSO) to ensure an agreement between GSA and USCIS exists in the event USCIS needs to review alarm reports or video footage from the GSA devices.

Customization ‐ in this context means the action of making or changing the USCIS specified security requirements to meet a location’s valid needs, as determined by the SL.

The following is an example of the “customization” approach:

Customization can take place, for example, when an FSM and/or Field Office Director

(FOD) request a card reader on a conference room door because of past instances of damage and misuse. Although not an USCIS requirement, the SL or RPSS can customize the security scope of work to add an additional card reader because a valid need has been identified. Customization should not be used solely for convenience sake.

ONVIF‐ ONVIF is a global and open industry forum with the goal of facilitating the development and use of a global open standard for the interface of physical IP‐based security products. ONVIF creates a standard for how IP products within video surveillance and other physical security areas can communicate with each other.

AXIS Zipstream®‐‐Axis Zipstream technology preserves all the important forensic detail you need, while lowering bandwidth and storage requirements by an average of 50% or more.

Unlike most compression technology, Zipstream doesn’t just limit bitrate. Instead, three kinds of intelligent algorithms ensure that relevant forensic information is identified, recorded and sent in full resolution and at full frame rate.

ANNEX B: Sample Key Plan

Key Plan Instruction

ANNEX C: Access Control

ACS Specifications—Gallagher Only

The following specifications provide functional, technical, and operational requirements for the USCIS Command Center PIV Physical Access Control (PACS). PACS will be referred to as ACS for the remainder of this document.

1. The ACS system will be Gallagher PIV ACS or equivalent. The system will have GSA E‐ PACS certification using 13.01 topology.

a. T21 PIV Reader MultiTech(APL Listing 10100) or equivalent.

i. Meets NIST SP 800‐116 specification for dual factor authentication for access

ii. Supports PIV, PIV‐I, FRAC, CIV, TWIC and CAC cards

iii. Keypad

iv. Fully configurable mimic panel reflecting the status of up to 8 inputs or outputs

v. Software upgrades performed through command center, no need to flash individual reader.

2. The security integrator must be certified by the manufacturer for the security system and will provide the certification to USCIS. GSA will ensure that the Security integrator selected is an HSPD‐12 certified provider.

3. Standardized naming conventions: security integrator shall follow all government provided naming conventions and standardized nomenclature when performing system configuration and database programming. Naming conventions will be provided to security integrator by the Government prior to security integrator commencing these activities. (See Annex D)

4. Database and event storage capacities may vary based upon the system configuration.