S02 - Attachment 25 Physical Security Systems Technical Specifications 01-24-2023.pdf

Orlando VA Health Care System

Electronic Security System, Locks and Keys Specifications Contact VA Police for the most current specifications, this is a living document that will frequently change. All proposed security systems shall be presented to the Physical Security Specialist or Police Service delegated person for approval, and a list of proposed components shall be provided. VA Police

Physical Security may be contacted at vhaorlpolicephyssecurity@va.gov.

Surveillance Camera Systems:

1) Lake Nona: Pelco VideoXpert Enterprise

2) Other than Lake Nona:

a. Locations that are not expected to go over 100 cameras: VideoXpert Pro and all required components and licenses to allow integration into the Lake Nona Enterprise system.

b. Locations with over 90 cameras (within 10% of the 100 camera recommendation) shall use a VideoXpert Enterprise setup all required components and licenses to allow integration into the Lake Nona Enterprise system.

i. New locations shall support a minimum 10% growth.

ii. Existing locations that reach 90 cameras shall be evaluated by Physical Security to determine if migration to an Enterprise system is needed.

3) We are currently running VideoXpert 3.16 (Enterprise and Pro)

a. We are planning on upgrading to 3.19 (Enterprise and Pro)

4) Adding cameras:

a. Must include additional storage for all new cameras.

i. Storage capacity must allow for a minimum of 30 days 24/7 recording

ii. Storage shall be based on the camera’s maximum resolution settings

iii. Storage shall be based on recording at 30 fps

iv. Storage shall have an additional 10% buffer to the above.

b. Cameras shall be powered via PoE unless approved by the COR.

i. Media converters may be used when distances are greater than the distances certified for cabling.

ii. Media converters shall have Uninterruptable Power Supplies (UPS) at the camera end to ensure operation until generator power is established during outages.

c. Cat 6a or better cabling shall be used

d. Cameras shall be the better of Pelco professional or enterprise-grade cameras and be submitted for approval to Physical Security.

e. Must be capable of H.264 recording, H.265 preferred

f. 1080p (1920X1080) or better

g. Must include all required licensing for a minimum of 3 years.

mailto:vhaorlpolicephyssecurity@va.gov

h. Due to the large amount of managed cameras, cameras shall be Pelco cameras unless approved by VA Police Physical Security and the VA Locksmith. This allows for centralized management and administration including firmware updates in a single interface.

5) Cameras shall be configured to:

a. 16:9 or better if capable

b. Pan Tilt Zoom (PTZ) cameras shall have their “startup point” defined and set to a

“useful” location. See item 11.

c. PTZ cameras should be paired with “Multiview” cameras for full coverage

6) Must provide the greater of 1-year parts and labor warranty or manufactures warranty with labor costs included for all systems to be maintained by the OVAHCS

7) Must be installed and supported by a Pelco VideoXpert Enterprise Certified installer

8) A workstation or shared display shall be provided for local camera viewing at all facilities.

9) All computers including shared displays should have “turn on after power loss” enabled in BIOS and configured for remote desktop connections.

10) Must include all required licensing to allow integration into the ePACS system.

11) Contact Physical Security for clarification.

Electronic Physical Access Control System (ePACS):

1) Contact VA Police Physical Security to confirm the ePACS system to be installed

2) The Orlando VA Health Care System is transitioning all sites to Lenel OnGuard Enterprise, current approved version is 8.0, we will transition to 8.1 once GSA and VA approved:

a. System will use GSA IDManagement.gov APL 10126. See FIPS 201 Approved Products

List - Physical Access Control System Components (idmanagement.gov) for details.

b. Power Supplies and Enclosures will be Life Safety Power

c. System Controllers: Lenel – LNL-X4420. (This is the only allowable controller for readers for a FICAM-compliant OnGuard system).

d. Interface boards Lenel- LNL-1300-S3, LNL-1320-S3, and the LNL-1100-S3, LNL-1200-S3.

e. Validation system software, components, and licenses (All purchased through Lenel)

i. TI EntryPoint EP—EWS base License

ii. TI EntryPoint EP-PNL-RDR Panel/Server License, per controller, 2 readers

iii. TI EntryPoint EP-ADD-RDR-2 Additional 2-reader license

iv. TI EntryPoint EP-ADD-BWS Additional Enrollment Station

v. Lenel SWG-AUTH-002 – OnGuard High Assurance reader, bundle of 2.

vi. PIV Readers licenses (All purchased through Lenel) Lenel Veridt 900W2036- QXYON Stealth Dual (Part number not yet verified for appropriate firmware version. Alternate part number may be required.)

f. Card Reader: Veridt 900W2036. Must be compatible with PIV 5.5, 7, 8.1 and 8.2 cards.

https://www.idmanagement.gov/approved-products-list-pacs-products/ https://www.idmanagement.gov/approved-products-list-pacs-products/

3) Orlando VA HCS Legacy ePACS systems:

a. AMAG/Symmetry 8.0.2 Homeland Security Edition (Lake Nona)

i. Javelin S8 series card reader with PIV 5.5, 7, 8.1 and 8.2 compatible firmware.

ii. Contact VA Police Physical Security for panel information.

b. Identiv Hirsch hardware. (all other locations)

i. Currently running Velocity 3.8.3

ii. Mx series control panel’s.

iii. Must use SNIB 3’s for FIPS compliance.

iv. Must include components for FICAM HSPD-12 compliance.

v. Must use PIV Class card plus Pin pad reader that can read PIV 5.5, 7, 8.1 and 8.2 cards.

1. HID pivCLASS RPK40

2. HID pivCLASS RKCL40

3. HID pivCLASS Biometric Reader

4. HID Signo 20K PIV

5. HID Signo 40K PIV

6. All others must be approved

4) Must include all required additional licensing where applicable.

5) All systems must be installed by installers certified by the appropriate manufacture.

6) Cable: ANSI: 4461030-500 1 4 Elem Comp Cable CMP Ylw Jacket along with any additional cabling needed for FICAM compliance to include meeting manufacturers’ recommendations for cabling or similar cabling meeting the manufacturers requirements. We have been advised the requirements for cable are:

a. 1-18awg 2 twisted shielded pairs (TSP) for reader,

b. 1-22awg 4 conductor for rex,

c. 1-22awg 2 conductor for contact,

d. 1-18awg 2 conductor for electric locking hardware

7) Greater of 1-year parts and labor warranty or manufacturer warranty with labor shall be included for systems to be maintained by the OVAHCS.

8) Contact Physical Security for location requirements.

9) Systems shall be managed by the VA.

10) Access control systems will be changing prior to FY 24, contact Physical Security for the most recent information.

Intrusion Detection Systems (IDS):

1) All VA managed IDS not integrated with the access control systems will be monitored by the Department of Homeland Security, Federal Protective Services, Megacenter. All equipment must be compatible with their monitoring. https://www.dhs.gov/megacenters Battle Creek MegaCenter: 269-565-9616. They may be contacted for current standards.

https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.dhs.gov%2Fmegacenters&data=04%7C01%7C%7C62dfb04f5b4242926f7c08d925c34059%7Ce95f1b23abaf45ee821db7ab251ab3bf%7C0%7C0%7C637582342789598756%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=1eVVfUfRDb0OSkVRcIxXECdqxzZqNQPfoHcMsDFwoBY%3D&reserved=0

2) Some sites IDS may be integrated into the access control system. Contact the physical security group to determine which solution is appropriate.

3) Greater of 1-year parts and labor warranty or manufactures warranty with labor shall be included for systems managed by the OVAHCS.

4) If lessor owned/managed IDS shall be installed and monitored by UL certified entities and must comply with all Federal, VA, State and local regulations and requirements.

Duress:

1) VA Police staffed locations

a. Lynx computer-based panic system shall be used in areas with VA computers.

b. Physical Lynx panic buttons may be used if the area has no VA computers.

2) Non VA Police staffed locations

a. Lynx computer-based panic system is preferred. Notification of duress can be set so that all employee’s receive notification

b. Please contact VA Police Physical Security for Lynx capabilities to determine if another solution is needed

3) Physical Security shall be contacted to determine if Lynx licenses need to be purchased.

Key Management:

1) Traka Touch Electronic Key Cabinets

2) Managed via Traka Web v03.14.0001 (may be upgrading to a newer version)

Network and networked devices:

The electronic security systems shall be on an isolated network. The VA Locksmith will provide specifications. All cabling shall Cat 6a or better and be in conduit. UPS’s shall be supplied if switches are needed.

1) Switches

a. Shall be Cisco 9300 or 9300L series with either Network Advantage or Essentials (either is acceptable) with a base 1100W AC power supply. Contact the VA Locksmith for the appropriate switch model. All other switches must be approved by the VA Locksmith.

b. Switches shall have modular or fixed uplinks.

c. Switches shall have redundant 1100W AC or better power supplies.

2) Switches and other networked devices shall only be installed once the room is turned over to the VA and secured. Peripheral devices without on-bord storage such as card readers and cameras may be installed in their final locations.

Door Locking Hardware:

1) The VA Locksmith shall be consulted on all proposed door locking hardware to ensure it conforms with requirements and can be serviced by the Locksmith.

a. Door lock Core shall be a 6 or 7 pin Small Format Interchangeable Core (contact the VA Locksmith for that facility’s lock pin count).

b. Door lock Brand and model shall be approved by the VA Locksmith.

2) Electric Mortise locks shall be the preferred type of electronic lock. Approval is needed for all others.

3) Electronic Panic hardware may be used when appropriate and approved.

4) Magnetic locks

a. Shall have a mechanical backup.

b. Shall have key override switches installed on the non secure side.

c. Shall not be used for exterior doors.

d. Should only be used for opposing doors.

5) Wireless automatic door opener buttons may not be used on the secure side of doorways accessed from non secure areas.

6) Copies of keys.

a. Master keys shall be provided to minimize the number of keys held by VA police.

b. VA Police shall have a copy of all Special Key Different (SKD) keys that are not on the master key system.

c. VA Locksmith shall be given all required information to make duplicate keys.

VA shall retain ownership of all components with onboard storage/memory even when installed by a lessor.

Reference: https://www.cfm.va.gov/til/dManual.asp#PSR Physical Security and Resiliency section

1) Camera/ePACS locations: https://www.cfm.va.gov/til/PhysicalSecurity/dmPhySecAppxB.xlsx

2) Door type location guide: https://www.cfm.va.gov/til/PhysicalSecurity/dmPhySecAppxA3.xlsx

3) Door type requirements: PSRDM - Appendix A2 Security Door Opening Schedule (va.gov)

4) Security door types: PSRDM Appendix A1-Security Door Types (va.gov) https://www.cfm.va.gov/til/dManual.asp#PSR https://www.cfm.va.gov/til/PhysicalSecurity/dmPhySecAppxB.xlsx https://www.cfm.va.gov/til/PhysicalSecurity/dmPhySecAppxA3.xlsx https://www.cfm.va.gov/til/PhysicalSecurity/dmPhySecAppxA2.pdf https://www.cfm.va.gov/til/PhysicalSecurity/dmPhySecAppxA1.pdf