Card Reader Specification 281300.pdf

UPGRADE EMERGENCY POWER IN BUILDING 138

VAMC, MARION, IN PROJECT: 610-16-104

10-11

28 13 00 - 1

SECTION 28 13 00

PHYSICAL ACCESS CONTROL SYSTEM

PART 1 – GENERAL

1.1 DESCRIPTION

A. This section specifies the finishing, installation, connection, testing and certification of a card reader addition to a complete and fully operating Physical Access Control System, hereinafter referred to as the PACS.

B. The existing campus Physical Access Control System is a Lenel system.

Provide new Assa Abloy Model iCLASS FIPS 201 card reader that is compatible to the existing Lenel system.

C. Physical Access Control System (PACS) shall consist of:

1. Card readers

2. Door locks and sensors

3. Power supplies, D. All security relevant decisions shall be made on “secure side of the door”. Secure side processing shall include;

1. Challenge/response management,

2. PKI path discovery and validation,

3. Credential identifier processing,

4. Authorization decisions.

1.2 RELATED WORK

A. Section 01 00 00 - GENERAL REQUIREMENTS. For General Requirements.

B. Section 07 84 00 - FIRESTOPPING. Requirements for firestopping application and use.

C. Section 08 71 00 - DOOR HARDWARE. Requirements for door installation.

D. Section 26 05 11 - REQUIREMENTS FOR ELECTRICAL INSTALLATIONS.

Requirements for connection of high voltage.

E. Section 26 05 33 – RACEWAYS AND BOXES FOR ELECTRICAL SYSTEMS.

Requirements for infrastructure.

F. Section 26 05 41 - UNDERGROUND ELECTRICAL CONSTRUCTION. Requirements for underground installation of wiring.

1.3 QUALITY ASSURANCE

A. The Contractor shall be responsible for providing, installing, and the operation of the PACS as shown. The Contractor shall also provide certification as required.

B. The security system will be installed and tested to ensure all components are fully compatible as a system and can be integrated with

10-11

28 13 00 - 2 all associated security subsystems, whether the security system is stand-alone or a part of a complete Information Technology (IT) computer network.

C. Manufacturers Qualifications: The manufacturer shall regularly and presently produce, as one of the manufacturer's principal products, the equipment and material specified for this project, and shall have manufactured the item for at least three years.

D. Product Qualifications:

1. Manufacturer's product shall have been in satisfactory operation, on three installations of similar size and type as this project, for approximately three years.

2. The Government reserves the right to require the Contractor to submit a list of installations where the products have been in operation before approval.

E. Contractor Qualifications:

1. The Contractor or security sub-contractor shall be a licensed security Contractor with a minimum of five (5) years experience installing and servicing systems of similar scope and complexity.

The Contractor shall be an authorized regional representative of the

Security Management System’s (PACS) manufacturer. The Contractor shall provide four (4) current references from clients with systems of similar scope and complexity which became operational in the past three (3) years. At least three (3) of the references shall be utilizing the same system components, in a similar configuration as the proposed system. The references must include a current point of contact, company or agency name, address, telephone number, complete system description, date of completion, and approximate cost of the project. The owner reserves the option to visit the reference sites, with the site owner’s permission and representative, to verify the quality of installation and the references’ level of satisfaction with the system. The Contractor shall provide copies of system manufacturer certification for all technicians. The

Contractor shall only utilize factory-trained technicians to install, program, and service the PACS. The Contractor shall only utilize factory-trained technicians to install, terminate and service controller/field panels and reader modules. The technicians shall have a minimum of five (5) continuous years of technical experience in electronic security systems. The Contractor shall

10-11

28 13 00 - 3 have a local service facility. The facility shall be located within

60 miles of the project site. The local facility shall include sufficient spare parts inventory to support the service requirements associated with this contract. The facility shall also include appropriate diagnostic equipment to perform diagnostic procedures.

The Resident Engineer reserves the option of surveying the company’s facility to verify the service inventory and presence of a local service organization.

a. The Contractor shall provide proof project superintendent with

BICSI Certified Commercial Installer Level 1, Level 2, or

Technician to provide oversight of the project.

b. Cable installer must have on staff a Registered Communication

Distribution Designer (RCDD) certified by Building Industry

Consulting Service International. The staff member shall provide consistent oversight of the project cabling throughout design, layout, installation, termination and testing.

F. Service Qualifications: There shall be a permanent service organization maintained or trained by the manufacturer which will render satisfactory service to this installation within fourhours of receipt of notification that service is needed. Submit name and address of service organizations.

1.4 SUBMITTALS

A. Submit below items in conjunction with Master Specification Sections 01

33 23, SHOP DRAWINGS, PRODUCT DATA, AND SAMPLES, Section 02 41 00, DEMOLITION.

B. Provide certificates of compliance with Section 1.3, Quality Assurance.

C. Provide a complete and thorough pre-installation and as-built design package in both electronic format and on paper, minimum size 48 x 48 inches (1220 x 1220 millimeters); drawing submittals shall be per the established project schedule.

D. Shop drawing and as-built packages shall include, but not be limited to:

1. Index Sheet that shall:

a. Define each page of the design package to include facility name, building name, floor, and sheet number.

b. Provide a complete list of all security abbreviations and symbols.

10-11

28 13 00 - 4

c. Reference all general notes that are utilized within the design package.

d. Specification and scope of work pages for all individual security systems that are applicable to the design package that will:

1) Outline all general and job specific work required within the design package.

2) Provide a detailed device identification table outlining device Identification (ID) and use for all security systems equipment utilized in the design package.

2. Drawing sheets that will be plotted on the individual floor plans or site plans shall:

a. Include a title block as defined above.

b. Clearly define the drawings scale in both standard and metric measurements.

c. Provide device identification and location.

d. Address all signal and power conduit runs and sizes that are associated with the design of the electronic security system and other security elements (e.g., barriers, etc.).

e. Identify all pull box and conduit locations, sizes, and fill capacities.

f. Address all general and drawing specific notes for a particular drawing sheet.

3. A detailed riser drawing for each applicable security subsystem shall:

a. Indicate the sequence of operation.

b. Relationship of integrated components on one diagram.

c. Include the number, size, identification, and maximum lengths of interconnecting wires.

d. Wire/cable types shall be defined by a wire and cable schedule.

The schedule shall utilize a lettering system that will correspond to the wire/cable it represents (example: A = 18 AWG/1

Pair Twisted, Unshielded). This schedule shall also provide the manufacturer’s name and part number for the wire/cable being installed.

4. A detailed system drawing for each applicable security system shall:

a. Clearly identify how all equipment within the system, from main panel to device, shall be laid out and connected.

10-11

28 13 00 - 5

b. Provide full detail of all system components wiring from point-to-point.

c. Identify wire types utilized for connection, interconnection with associate security subsystems.

d. Show device locations that correspond to the floor plans.

e. All general and drawing specific notes shall be included with the system drawings.

5. A detailed schedule for all of the applicable security subsystems shall be included. All schedules shall provide the following information:

a. Device ID.

b. Device Location (e.g. site, building, floor, room number, location, and description).

c. Mounting type (e.g. flush, wall, surface, etc.).

d. Power supply or circuit breaker and power panel number.

e. In addition, for the PACS, provide the door ID, door type (e.g.

wood or metal), locking mechanism (e.g. strike or electromagnetic lock) and control device (e.g. card reader or biometrics).

6. Detail and elevation drawings for all devices that define how they were installed and mounted.

E. Pre-installation design packages shall go through a full review process conducted by the Contractor along with a VA representative to ensure all work has been clearly defined and completed. All reviews shall be conducted in accordance with the project schedule. There shall be four

(4) stages to the review process:

1. 35 percent

2. 65 percent

3. 90 percent

4. 100 percent

F. Provide manufacturer security system product cut-sheets. Submit for approval at least 30 days prior to commencement of formal testing, a

Security System Operational Test Plan. Include procedures for operational testing of each component and security subsystem, to include performance of an integrated system test.

G. Submit manufacture’s certification of Underwriters Laboratories, Inc.

(UL) listing as specified. Provide all maintenance and operating manuals per Section 01 00 00, GENERAL REQUIREMENTS, and Section 28 05

00 COMMON WORK RESULTS FOR ELECTRONIC SAFETY AND SECURITY.

10-11

28 13 00 - 6

H. Completed System Readiness Checklists provided by the Commissioning

Agent and completed by the contractor, signed by a qualified technician and dated on the date of completion, in accordance with the requirements of Section 28 08 00 COMMISSIONING OF ELECTRONIC SAFETY AND

SECURITY SYSTEMS.

I. General: Submittals shall be in full compliance of the Contract

Documents. All submittals shall be provided in accordance with this section. Submittals lacking the breath or depth these requirements will be considered incomplete and rejected. Submissions are considered multidisciplinary and shall require coordination with applicable divisions to provide a complete and comprehensive submission package.

Additional general provisions are as follows:

1. The Contractor shall schedule submittals in order to maintain the project schedule. For coordination drawings refer to Specification

Section 01 33 10 - DESIGN SUBMITTAL PROCEDURES, which outline basic submittal requirements and coordination. Section 01 33 10 shall be used in conjunction with this section.

2. The Contractor shall identify variations from requirements of

Contract Documents and state product and system limitations, which may be detrimental to successful performance of the completed work or system.

3. Each package shall be submitted at one (1) time for each review and include components from applicable disciplines (e.g., electrical work, architectural finishes, door hardware, etc.) which are required to produce an accurate and detailed depiction of the project.

4. Manufacturer’s information used for submittal shall have pages with items for approval tagged, items on pages shall be identified, and capacities and performance parameters for review shall be clearly marked through use of an arrow or highlighting. Provide space for

Resident Engineer and Contractor review stamps.

5. Technical Data Drawings shall be in the latest version of AutoCAD®, drawn accurately, and in accordance with VA CAD Standards. FREEHAND

SKETCHES OR COPIED VERSIONS OF THE CONSTRUCTION DOCUMENTS WILL NOT

BE ACCEPTED. The Contractor shall not reproduce Contract Documents or copy standard information as the basis of the Technical Data

Drawings. If departures from the technical data drawings are subsequently deemed necessary by the Contractor, details of such

10-11

28 13 00 - 7 departures and the reasons thereof shall be submitted in writing to the Resident Engineer for approval before the initiation of work.

6. Packaging: The Contractor shall organize the submissions according to the following packaging requirements.

a. Binders: For each manual, provide heavy duty, commercial quality, durable three (3) ring vinyl covered loose leaf binders, sized to receive 8.5 x 11 in paper, and appropriate capacity to accommodate the contents. Provide a clear plastic sleeve on the spine to hold labels describing the contents. Provide pockets in the covers to receive folded sheets.

1) Where two (2) or more binders are necessary to accommodate data, correlate data in each binder into related groupings according to the Project Manual table of contents. Cross-referencing other binders where necessary to provide essential information for communication of proper operation and or maintenance of the component or system.

2) Identify each binder on the front and spine with printed binder title, Project title or name, and subject matter covered. Indicate the volume number if applicable.

b. Dividers: Provide heavy paper dividers with celluloid tabs for each Section. Mark each tab to indicate contents.

c. Protective Plastic Jackets: Provide protective transparent plastic jackets designed to enclose diagnostic software for computerized electronic equipment.

d. Text Material: Where written material is required as part of the manual use the manufacturer's standard printed material, or if not available, specially prepared data, neatly typewritten on 8.5 inches by 11 inches 20 pound white bond paper.

e. Drawings: Where drawings and/or diagrams are required as part of the manual, provide reinforced punched binder tabs on the drawings and bind them with the text.

1) Where oversized drawings are necessary, fold the drawings to the same size as the text pages and use as a foldout.

2) If drawings are too large to be used practically as a foldout, place the drawing, neatly folded, in the front or rear pocket of the binder. Insert a type written page indicating the drawing title, description of contents and drawing location at the appropriate location of the manual.

10-11

28 13 00 - 8

3) Drawings shall be sized to ensure details and text is of legible size. Text shall be no less than 1/16” tall.

f. Manual Content: In each manual include information specified in the individual Specification section, and the following information for each major component of building equipment and controls:

1) General system or equipment description.

2) Design factors and assumptions.

3) Copies of applicable Shop Drawings and Product Data.

4) System or equipment identification including: manufacturer, model and serial numbers of each component, operating instructions, emergency instructions, wiring diagrams, inspection and test procedures, maintenance procedures and schedules, precautions against improper use and maintenance, repair instructions, sources of required maintenance materials and related services, and a manual index.

g. Binder Organization: Organize each manual into separate sections for each piece of related equipment. At a minimum, each manual shall contain a title page, table of contents, copies of Product

Data supplemented by drawings and written text, and copies of each warranty, bond, certifications, and service Contract issued.

Refer to Group I through V Technical Data Package Submittal requirements for required section content.

h. Title Page: Provide a title page as the first sheet of each manual to include the following information; project name and address, subject matter covered by the manual, name and address of the Project, date of the submittal, name, address, and telephone number of the Contractor, and cross references to related systems in other operating and/or maintenance manuals.

i. Table of Contents: After the title page, include a type written table of contents for each volume, arranged systematically according to the Project Manual format. Provide a list of each product included, identified by product name or other appropriate identifying symbols and indexed to the content of the volume.

Where more than one (1) volume is required to hold data for a particular system, provide a comprehensive table of contents for all volumes in each volume of the set.

10-11

28 13 00 - 9

j. General Information Section: Provide a general information section immediately following the table of contents, listing each product included in the manual, identified by product name.

Under each product, list the name, address, and telephone number of the installer and maintenance Contractor. In addition, list a local source for replacement parts and equipment.

k. Drawings: Provide specially prepared drawings where necessary to supplement the manufacturers printed data to illustrate the relationship between components of equipment or systems, or provide control or flow diagrams. Coordinate these drawings with information contained in Project Record Drawings to assure correct illustration of the completed installation.

l. Manufacturer’s Data: Where manufacturer's standard printed data is included in the manuals, include only those sheets that are pertinent to the part or product installed. Mark each sheet to identify each part or product included in the installation.

Where more than one (1) item in tabular format is included, identify each item, using appropriate references from the

Contract Documents. Identify data that is applicable to the installation and delete references to information which is not applicable.

m. Where manufacturer's standard printed data is not available and the information is necessary for proper operation and maintenance of equipment or systems, or it is necessary to provide additional information to supplement the data included in the manual, prepare written text to provide the necessary information.

Organize the text in a consistent format under a separate heading for different procedures. Where necessary, provide a logical sequence of instruction for each operating or maintenance procedure. Where similar or more than one product is listed on the submittal the Contractor shall differentiate by highlighting the specific product to be utilized.

n. Calculations: Provide a section for circuit and panel calculations.

o. Loading Sheets: Provide a section for DGP Loading Sheets.

p. Certifications: Provide section for Contractor’s manufacturer certifications.

10-11

28 13 00 - 10

7. Contractor Review: Review submittals prior to transmittal.

Determine and verify field measurements and field construction criteria. Verify manufacturer’s catalog numbers and conformance of submittal with requirements of contract documents. Return non-conforming or incomplete submittals with requirements of the work and contract documents. Apply Contractor’s stamp with signature certifying the review and verification of products occurred, and the field dimensions, adjacent construction, and coordination of information is in accordance with the requirements of the contract documents.

8. Resubmission: Revise and resubmit submittals as required within 15 calendar days of return of submittal. Make resubmissions under procedures specified for initial submittals. Identify all changes made since previous submittal.

9. Product Data: Within 15 calendar days after execution of the contract, the Contractor shall submit for approval a complete list of all of major products proposed for use. The data shall include name of manufacturer, trade name, model number, the associated contract document section number, paragraph number, and the referenced standards for each listed product.

J. Group 1 Technical Data Package: Group I Technical Data Package shall be one submittal consisting of the following content and organization.

Refer to VA Special Conditions Document for drawing format and content requirements. The data package shall include the following:

1. Section I - Drawings:

a. General – Drawings shall conform to VA Special Conditions and CAD

Standards Documents. All text associated with security details shall be 1/8” tall and meet VA text standard for AutoCAD™ drawings.

b. Cover Sheet – Cover sheet shall consist of Project Title and

Address, Project Number, Area and Vicinity Maps.

c. General Information Sheets – General Information Sheets shall consist of General Notes, Abbreviations, Symbols, Wire and Cable

Schedule, Project Phasing, and Sheet Index.

d. Floor Plans – Floor plans shall be produced from the

Architectural backgrounds issued in the Construction Documents.

The contractor shall receive floor plans from the prime A/E to develop these drawing sets. Security devices shall be placed on

10-11

28 13 00 - 11 drawings in scale. All text associated with security details shall be 1/8” tall and meet VA text standard for AutoCAD™ drawings. Floor plans shall identify the following:

1) security devices by symbol,

2) the associated device point number (derived from the loading sheets),

3) wire & cable types and counts

4) conduit sizing and routing

5) conduit riser systems

6) device and area detail call outs

e. Architectural details – Architectural details shall be produced for each device mounting type (door details for doors with physical access control, reader pedestals and mounts, security panel and power supply details).

f. Riser Diagrams – Contractor shall provide a riser diagram indicating riser architecture and distribution of the physical access control system throughout the facility (or area in scope).

g. Block Diagrams – Contractor shall provide a block diagram for the entire system architecture and interconnections with SMS subsystems. Block diagram shall identify SMS subsystem (e.g., physical access control, intrusion detection, closed circuit television, intercom, and other associated subsystems) integration; and data transmission and media conversion methodologies.

h. Interconnection Diagrams – Contractor shall provide interconnection diagram for each sensor, and device component.

Interconnection diagram shall identify termination locations, standard wire detail to include termination schedule. Diagram shall also identify interfaces to other systems such as elevator control, fire alarm systems, and security management systems.

i. Security Details:

1) Panel Assembly Detail – For each panel assembly, a panel assembly details shall be provided identifying individual panel component size and content.

2) Panel Details – Provide security panel details identify general arrangement of the security system components, backboard size, wire through size and location, and power circuit requirements.

10-11

28 13 00 - 12

3) Device Mounting Details – Provide mounting detailed drawing for each security device (physical access control system, intrusion detection, video surveillance and assessment, and intercom systems) for each type of wall and ceiling configuration in project. Device details shall include device, mounting detail, wiring and conduit routing.

4) Details of connections to power supplies and grounding

5) Details of surge protection device installation

6) Sensor detection patterns – Each system sensor shall have associated detection patterns.

7) Equipment Rack Detail – For each equipment rack, provide a scaled detail of the equipment rack location and rack space utilization. Use of BISCI wire management standards shall be employed to identify wire management methodology. Transitions between equipment racks shall be shown to include use vertical and horizontal latter rack system.

8) Security Control Room – The contractor shall provide a layout plan for the Security Control Room. The layout plan shall identify all equipment and details associated with the installation.

9) Operator Console – The contractor shall provide a layout plan for the Operator Console. The layout plan shall identify all equipment and details associated with the installation.

Equipment room - the contractor shall provide a layout plan for the equipment room. The layout plan shall identify all equipment and details associated with the installation.

10) Equipment Room – Equipment room details shall provide architectural, electrical, mechanical, plumbing, IT/Data and associated equipment and device placements both vertical and horizontally.

j. Electrical Panel Schedule – Electrical Panel Details shall be provided for all SMS systems electrical power circuits. Panel details shall be provided identifying panel type (Standard, Emergency Power, Emergency/Uninterrupted Power Source, and

Uninterrupted Power Source Only), panel location, circuit number, and circuit amperage rating.

k. Door Schedule – A door schedule shall be developed for each door equipped with electronic security components. At a minimum, the

10-11

28 13 00 - 13 door schedule shall be coordinated with Division 08 work and include the following information:

1) Item Number

2) Door Number (Derived from A/E Drawings)

3) Floor Plan Sheet Number

4) Standard Detail Number

5) Door Description (Derived from Loading Sheets)

6) Data Gathering Panel Input Number

7) Door Position or Monitoring Device Type & Model Number

8) Lock Type, Model Number & Power Input/Draw (standby/active)

9) Card Reader Type & Model Number

10) Shunting Device Type & Model Number

11) Sounder Type & Model Number

12) Manufacturer

13) Misc. devices as required

a) Delayed Egress Type & Model Number

b) Intercom

c) Camera

d) Electric Transfer Hinge

e) Electric Pass-through device

14) Remarks column indicating special notes or door configurations

4. Section III - Construction Mock-up: In areas with exposed

EMT/Conduit Raceways, contractor shall conceal raceway as much as practical and unobtrusively. In addition, historic significance must be considered to determine installation means and methods for approval by the owner.

5. Section IV - Manufacturers’ Data: The data package shall include manufacturers’ data for all materials and equipment, including sensors, local processors and console equipment provided under this specification.

6. Section V - System Description and Analysis: The data package shall include system descriptions, analysis, and calculations used in sizing equipment required by these specifications. Descriptions and calculations shall show how the equipment will operate as a system to meet the performance requirements of this specification. The data package shall include the following:

7. Section VI – Certifications & References: All specified manufacturer’s certifications shall be included with the data

10-11

28 13 00 - 14 package. Contractor shall provide Project references as outlined in

Paragraph 1.4 “Quality Assurance”.

M. Group IV Technical Data Package

1. Performance Verification Test

a. Based on the successful completion of the pre-delivery test, the

Contractor shall finalize the test procedures and report forms for the performance verification test (PVT) and the endurance test. The PVT shall follow the format, layout and content of the pre-delivery test. The Contractor shall deliver the PVT and endurance test procedures to the Resident Engineer for approval.

The Contractor may schedule the PVT after receiving written approval of the test procedures. The Contractor shall deliver the final PVT and endurance test reports within 14 calendar days from completion of the tests. Refer to Part 3 of this section for System Testing and Acceptance requirements.

2. Training Documentation

O. FIPS 201 Compliance Certificates

1. Provide Certificates for all device types utilizing credential verification. Provide certificates for:

a. Card Readers

P. Approvals will be based on complete submission of manuals together with shop drawings.

Q. Completed System Readiness Checklists provided by the Commissioning

Agent and completed by the contractor, signed by a qualified technician and dated on the date of completion, in accordance with the requirements of Section 28 08 00 COMMISSIONING OF ELECTRONIC SAFETY AND

SECURITY SYSTEMS.

1.5 APPLICABLE PUBLICATIONS

A. The publications listed below (including amendments, addenda, revisions, supplement, and errata) form a part of this specification to the extent referenced. The publications are referenced in the text by the basic designation only.

B. American National Standards Institute (ANSI)/ Security Industry

Association (SIA):

AC-03...................Access Control: Access Control Guideline Dye

Sublimation Printing Practices for PVC Access

Control Cards

10-11

28 13 00 - 15

TVAC-01.................CCTV to Access Control Standard - Message Set for System Integration

C. American National Standards Institute (ANSI)/ International Code

Council (ICC):

A117.1..................Standard on Accessible and Usable Buildings and

Facilities

D. Department of Justice American Disability Act (ADA)

28 CFR Part 36..........ADA Standards for Accessible Design 2010

E. Department of Veterans Affairs (VA):

PACS-R: Physical Access Control System (PACS) Requirements

VA Handbook 0730 Security and Law Enforcement

F. Government Accountability Office (GAO):

GAO-03-8-02 Security Responsibilities for Federally Owned and Leased

Facilities

G. National Electrical Contractors Association

303-2005................Installing Closed Circuit Television (CCTV)

Systems

H. National Electrical Manufactures Association (NEMA):

250-08..................Enclosures for Electrical Equipment (1000 Volts

Maximum)

I. National Fire Protection Association (NFPA):

70-11................... National Electrical Code

J. Underwriters Laboratories, Inc. (UL):

294-99..................The Standard of Safety for Access Control

System Units

305-08..................Standard for Panic Hardware

639-97..................Standard for Intrusion-Detection Units

752-05..................Standard for Bullet-Resisting Equipment

827-08..................Central Station Alarm Services

1076-95.................Standards for Proprietary Burglar Alarm Units and Systems

1981-03.................Central Station Automation System

2058-05.................High Security Electronic Locks

K. Homeland Security Presidential Directive (HSPD):

HSPD-12.................Policy for a Common Identification Standard for

Federal Employees and Contractors

L. Federal Communications Commission (FCC):

(47 CFR 15) Part 15 Limitations on the Use of Wireless Equipment/Systems

10-11

28 13 00 - 16

M. Federal Information Processing Standards (FIPS):

FIPS-201-1..............Personal Identity Verification (PIV) of Federal

Employees and Contractors

N. National Institute of Standards and Technology (NIST):

IR 6887 V2.1............Government Smart Card Interoperability

Specification (GSC-IS)

Special Pub 800-63......Electronic Authentication Guideline

Special Pub 800-96......PIV Card Reader Interoperability Guidelines

Special Pub 800-73-3....Interfaces for Personal Identity Verification

(4 Parts)

........................Pt. 1- End Point PIV Card Application

Namespace, Data Model & Representation

........................Pt. 2- PIV Card Application Card Command

Interface

........................Pt. 3- PIV Client Application Programming

Interface

........................Pt. 4- The PIV Transitional Interfaces & Data

Model Specification

Special Pub 800-76-1....Biometric Data Specification for Personal

Identity Verification

Special Pub 800-78-2....Cryptographic Algorithms and Key Sizes for

Personal Identity Verification

Special Pub 800-79-1....Guidelines for the Accreditation of Personal

Identity Verification Card Issuers

Special Pub 800-85B-1...DRAFTPIV Data Model Test Guidelines

Special Pub 800-85A-2...PIV Card Application and Middleware Interface

Test Guidelines (SP 800-73-3 compliance)

Special Pub 800-96......PIV Card Reader Interoperability Guidelines

Special Pub 800-37......Guide for Applying the Risk Management

Framework to Federal Information Systems

Special Pub 800-96......PIV Card Reader Interoperability Guidelines

Special Pub 800-96......PIV Card Reader Interoperability Guidelines

Special Pub 800-104A....Scheme for PIV Visual Card Topography

Special Pub 800-116.....Recommendation for the Use of PIV Credentials in Physical Access Control Systems (PACS)

O. Institute of Electrical and Electronics Engineers (IEEE):

C62.41..................IEEE Recommended Practice on Surge Voltages in

Low-Voltage AC Power Circuits

10-11

28 13 00 - 17

P. International Organization for Standardization (ISO):

7810....................Identification cards – Physical characteristics

7811....................Physical Characteristics for Magnetic Stripe

Cards

7816-1..................Identification cards - Integrated circuit(s) cards with contacts - Part 1: Physical characteristics

7816-2..................Identification cards - Integrated circuit cards

- Part 2: Cards with contacts -Dimensions and location of the contacts

7816-3..................Identification cards - Integrated circuit cards

- Part 3: Cards with contacts - Electrical interface and transmission protocols

7816-4..................Identification cards - Integrated circuit cards

- Part 11: Personal verification through biometric methods

7816-10.................Identification cards - Integrated circuit cards

- Part 4: Organization, security and commands for interchange

14443...................Identification cards - Contactless integrated circuit cards; Contactless Proximity Cards

Operating at 13.56 MHz in up to 5 inches distance

15693...................Identification cards -- Contactless integrated circuit cards - Vicinity cards; Contactless

Vicinity Cards Operating at 13.56 MHz in up to

50 inches distance

19794...................Information technology - Biometric data interchange formats

Q. Uniform Federal Accessibility Standards (UFAS) 1984

R. ADA Standards for Accessible Design 2010

S. Section 508 of the Rehabilitation Act of 1973

1.6 DEFINITIONS

A. ABA Track: Magnetic stripe that is encoded on track 2, at 75-bpi density in binary-coded decimal format; for example, 5-bit, 16-character set.

B. Access Control List: A list of (identifier, permissions) pairs associated with a resource or an asset. As an expression of security

10-11

28 13 00 - 18 policy, a person may perform an operation on a resource or asset if and only if the person’s identifier is present in the access control list

(explicitly or implicitly), and the permissions in the (identifier, permissions) pair include the permission to perform the requested operation.

C. Access Control: A function or a system that restricts access to authorized persons only.

D. API Application Programming Interface

E. Assurance Level (or E-Authentication Assurance Level): A measure of trust or confidence in an authentication mechanism defined in OMB

Memorandum M-04-04 and NIST Special Publication (SP) 800-63, in terms of four levels: [M-04-04]

1. Level 1: LITTLE OR NO confidence

2. Level 2: SOME confidence

3. Level 3: HIGH confidence

4. Level 4: VERY HIGH confidence

F. Authentication: A process that establishes the origin of information, or determines an entity’s identity. In this publication, authentication often means the performance of a PIV authentication mechanism.

G. Authenticator: A memory, possession, or quality of a person that can serve as proof of identity, when presented to a verifier of the appropriate kind. For example, passwords, cryptographic keys, and fingerprints are authenticators.

H. Authorization: A process that associates permission to access a resource or asset with a person and the person’s identifier(s).

I. BIO or BIO-A: A FIPS 201 authentication mechanism that is implemented by using a Fingerprint data object sent from the PIV Card to the PACS.

Note that the short-hand “BIO (-A)” is used throughout the document to represent both BIO and BIO-A authentication mechanisms.

J. Biometric: An authenticator produced from measurable qualities of a living person.

K. CAC EP – CAC End Point with end point PIV applet

L. CAC NG – CAC Next Generation with transitional PIV applet

M. Card Authentication Key (CAK): A PIV authentication mechanism (or the

PIV Card key of the same name) that is implemented by an asymmetric or symmetric key challenge/response protocol. The CAK is an optional mechanism defined in NIST SP 800-73. [SP800-73] NIST strongly recommends that every PIV Card contain an asymmetric CAK and

10-11

28 13 00 - 19 corresponding certificate, and that agencies use the asymmetric CAK protocol, rather than a symmetric CAK protocol, whenever the CAK authentication mechanism is used with PACS.

N. CCTV: Closed-circuit television.

O. Central Station: A PC with software designated as the main controlling

PC of the PACS. Where this term is presented with initial capital letters, this definition applies.

P. Controller: An intelligent peripheral control unit that uses a computer for controlling its operation. Where this term is presented with an initial capital letter, this definition applies.

Q. CPU: Central processing unit.

R. Credential: Data assigned to an entity and used to identify that entity.

S. File Server: A PC in a network that stores the programs and data files shared by users.

T. FIPS Federal Information Processing Standards

U. FRAC – First Responder Authentication Credential

V. HSPD Homeland Security Presidential Directive

W. I/O: Input/Output.

X. Identifier: A credential card, keypad personal identification number or code, biometric characteristic, or other unique identification entered as data into the entry-control database for the purpose of identifying an individual. Where this term is presented with an initial capital letter, this definition applies.

Y. IEC International Electrotechnical Commission

Z. ISO International Organization for Standardization

AA. KB Kilobyte

BB. kbit/s Kilobits / second

CC. LAN: Local area network.

DD. LED: Light-emitting diode.

EE. Legacy CAC – Contact only Common Access Card with v1 and v2 applets

FF. Location: A Location on the network having a PC-to-Controller communications link, with additional Controllers at the Location connected to the PC-to-Controller link with RS-485 communications loop.

Where this term is presented with an initial capital letter, this definition applies.

GG. NIST: National Institute of Standards and Technology

HH. PACS: Physical Access Control System

10-11

28 13 00 - 20

II. PC/SC: Personal Computer / Smart Card

JJ. PC: Personal computer. This acronym applies to the Central Station, workstations, and file servers.

KK. PCI Bus: Peripheral component interconnect; a peripheral bus providing a high-speed data path between the CPU and peripheral devices (such as monitor, disk drive, or network).

LL. PDF: (Portable Document Format.) The file format used by the Acrobat document exchange system software from Adobe.

MM. PIV: Personal Identification Verification

NN. PIV-I – PIV Interoperable credential

OO. PPS: Protocol and Parameters Selection

PP. RF: Radio frequency.

QQ. ROM: Read-only memory. ROM data are maintained through losses of power.

RR. RS-232: An TIA/EIA standard for asynchronous serial data communications between terminal devices. This standard defines a 25-pin connector and certain signal characteristics for interfacing computer equipment.

SS. RS-485: An TIA/EIA standard for multipoint communications.

TT. TCP/IP: Transport control protocol/Internet protocol incorporated into

Microsoft Windows.

UU. TPDU: Transport Protocol Data Unit

VV. TWIC – Transportation Worker Identification Credential

WW. UPS: Uninterruptible power supply.

XX. Vcc: Voltage at the Common Collector

YY. WAN: Wide area network.

ZZ. WAV: The digital audio format used in Microsoft Windows.

AAA. Wiegand: Patented magnetic principle that uses specially treated wires embedded in the credential card.

BBB. Windows: Operating system by Microsoft Corporation.

CCC. Workstation: A PC with software that is configured for specific limited security system functions.

1.7 COORDINATION

A. Coordinate arrangement, mounting, and support of electronic safety and security equipment:

1. To allow maximum possible headroom unless specific mounting heights that reduce headroom are indicated.

10-11

28 13 00 - 21

2. To provide for ease of disconnecting the equipment with minimum interference to other installations.

3. To allow right of way for piping and conduit installed at required slope.

4. So connecting raceways, cables, wireways, cable trays, and busways will be clear of obstructions and of the working and access space of other equipment.

B. Coordinate installation of required supporting devices and set sleeves in cast-in-place concrete, masonry walls, and other structural components as they are constructed.

C. Coordinate location of access panels and doors for electronic safety and security items that are behind finished surfaces or otherwise concealed.

1.8 MAINTENANCE & SERVICE

A. System Modifications

1. The Contractor shall make any recommendations for system modification in writing to the COR. No system modifications, including operating parameters and control settings, shall be made without prior written approval from the COR. Any modifications made to the system shall be incorporated into the operation and maintenance manuals and other documentation affected.

B. Software

1. The Contractor shall provide all software updates when approved by the Owner from the manufacturer during the installation and 12-month warranty period and verify operation of the system. These updates shall be accomplished in a timely manner, fully coordinated with the system operators, and incorporated into the operations and maintenance manuals and software documentation. There shall be at least one (1) scheduled update near the end of the first year’s warranty period, at which time the Contractor shall install and validate the latest released version of the Manufacturer’s software.

All software changes shall be recorded in a log maintained in the unit control room. An electronic copy of the software update shall be maintained within the log. At a minimum, the contractor shall provide a description of the modification, when the modification occurred, and name and contact information of the individual performing the modification. The log shall be maintained in a white

3 ring binder and the cover marked “SOFTWARE CHANGE LOG”.

10-11

28 13 00 - 22

1.9 PERFORMANCE REQUIREMENTS

A. PACS shall provide support for multiple authentication modes and bidirectional communication with the reader. PACS shall provide implementation capability for enterprise security policy and incident response.

B. All processing of authentication information must occur on the “safe side” of a door

C. PACS shall provide Credential Validation and Path Validation per NIST

800-116.

D. Field equipment shall include Controllers, sensors, and controls.

Controllers shall serve as an interface between the Central Station and sensors and controls. Data exchange between the Central Station and the Controllers shall include down-line transmission of commands, software, and databases to Controllers. The up-line data exchange from the Controller to the Central Station shall include status data such as intrusion alarms, status reports, and entry-control records.

Controllers are classified as alarm-annunciation or entry-control type.

E. System Response to Alarms: Field device network shall provide a system end-to-end response time of [1] second(s) or less for every device connected to the system. Alarms shall be annunciated at the Central

Station within 1 second of the alarm occurring at a Controller or device controlled by a local Controller, and within 100 ms if the alarm occurs at the Central Station. Alarm and status changes shall be displayed within 100 ms after receipt of data by the Central Station.

All graphics shall be displayed, including graphics-generated map displays, on the console monitor within 5 seconds of alarm receipt at the security console.[ This response time shall be maintained during system heavy load.]

F. False Alarm Reduction: The design of Central Station and Controllers shall contain features to reduce false alarms. Equipment and software shall comply with SIA CP-01.

G. Error Detection: A cyclic code error detection method shall be used between Controllers and the Central Station, which shall detect single-and double-bit errors, burst errors of eight bits or less, and at least

99 percent of all other multibit and burst error conditions.

Interactive or product error detection codes alone will not be acceptable. A message shall be in error if one bit is received incorrectly. System shall retransmit messages with detected errors. A

10-11

28 13 00 - 23 two-digit decimal number shall be operator assignable to each communication link representing the number of retransmission attempts.

When the number of consecutive retransmission attempts equals the assigned quantity, the Central Station shall print a communication failure alarm message. System shall monitor the frequency of data transmission failure for display and logging.

H. Data Line Supervision: System shall initiate an alarm in response to opening, closing, shorting, or grounding of data transmission lines.

I. Door Hardware Interface: Coordinate with Division 08 Sections that specify door hardware required to be monitored or controlled by the

PACS. The Controllers in this Section shall have electrical characteristics that match the signal and power requirements of door hardware. Integrate door hardware specified in Division 08 Sections to function with the controls and PC-based software and hardware in this

Section.

J. References to industry and trade association standards and codes are minimum installation requirement standards.

K. Drawings and other specification sections shall govern in those instances where requirements are greater than those specified in the above standards.

1.10 EQUIPMENT AND MATERIALS

A. Materials and equipment furnished shall be of current production by manufacturers regularly engaged in the manufacture of such items, for which replacement parts shall be available.

B. When more than one unit of the same class of equipment is required, such units shall be the product of a single manufacturer.

C. Equipment Assemblies and Components:

1. Components of an assembled unit need not be products of the same manufacturer.

2. Manufacturers of equipment assemblies, which include components made by others, shall assume complete responsibility for the final assembled unit.

3. Components shall be compatible with each other and with the total assembly for the intended service.

4. Constituent parts which are similar shall be the product of a single manufacturer.

D. Factory wiring shall be identified on the equipment being furnished and on all wiring diagrams.

10-11

28 13 00 - 24

E. When Factory Testing Is Specified:

1. The Government shall have the option of witnessing factory tests.

The contractor shall notify the VA through the Resident Engineer a minimum of 15 working days prior to the manufacturers making the factory tests.

2. Four copies of certified test reports containing all test data shall be furnished to the Resident Engineer prior to final inspection and not more than 90 days after completion of the tests.

3. When equipment fails to meet factory test and re-inspection is required, the contractor shall be liable for all additional expenses, including expenses of the Government.

1.11 WARRANTY OF CONSTRUCTION.

A. Warrant PACS work subject to the Article “Warranty of Construction” of

FAR clause 52.246-21.

B. Demonstration and training shall be performed prior to system acceptance.

PART 2 – PRODUCTS

2.1 GENERAL

A. All equipment and materials for the system will be compatible to ensure correct operation as outlined in FIPS 201, March 2006 and HSPD-12.

D. A PACS shall be comprised of, but not limited to, the following components:

1. Card Readers

2. System Sensors and Related Equipment

3. Door and Gate Hardware interface

4. Cables

2.2 CARD READERS

A. Power: Card reader shall be powered from its associated Controller, including its standby power source.

B. Response Time: Card reader shall respond to passage requests by generating a signal that is sent to the Controller. Response time shall be [800] ms or less, from the time the card reader finishes reading the credential card until a response signal is generated.

C. Enclosure: Suitable for surface, semiflush, or pedestal mounting.

Mounting types shall additionally be suitable for installation in the following locations:

10-11

28 13 00 - 25

1. Outdoors, with built-in heaters or other cold-weather equipment to extend the operating temperature range as needed for operation at the site.

D. Display: LED or other type of visual indicator display shall provide visual[ and audible] status indications and user prompts. Indicate power on/off, whether user passage requests have been accepted or rejected, and whether the door is locked or unlocked.

E. Shall be utilized for controlling the locking hardware on a door and allows for reporting back to the main control panel with the time/date the door was accessed, the name of the person accessing the point of entry, and its location.

F. Will be fully programmable and addressable, locally and remotely, and hardwired to the system.

G. Shall be individually home run to the main panel.

H. Shall be installed in a manner that they comply with:

1. The Uniform Federal Accessibility Standards (UFAS)

2. The Americans with Disabilities Act (ADA)

3. The ADA Standards for Accessible Design

I. Shall be housed in an aluminum bezel with a wide lead-in for easy card entry.

J. Shall contain read head electronics, and a sender to encode digital door control signals.

K. LED’s shall be utilized to indicate card reader status and access status.

L. Shall be able to support a user defined downloadable off-line mode of operation (e.g. locked, unlocked), which will go in effect during loss of communication with the main control panel.

M. Shall provide audible feedback to indicate access granted/denied decisions. Upon a card swipe, two audible tones or beeps shall indicate access granted and three tones or beeps shall indicate access denied.

All keypad buttons shall provide tactile audible feedback.

N. Shall have a minimum of two programmable inputs and two programmable outputs.

O. All card readers that…