Attachment- 33 AE Physical Security Risk Mitigation Design Guidance.pdf

10901 Front Beach Road, Ste 1415, Panama City Beach, FL 32407 www.force-protect.com

MEMORANDUM FOR RECORD (MFR) 9 November 2022

TO: Design Team, Spur Design

SUBJECT: Physical Security Risk Mitigation Design Guidance for Project #549A4- 21-700 EHRM Infrastructure Upgrades, Sam Rayburn Memorial Veterans Center, Bonham, Texas.

EXECUTIVE SUMMARY

This project will upgrade the facility infrastructure to support the new Electronic Health Record Modernization (EHRM) system in accordance with VA OEHRM Site Infrastructure Requirements (provided by VHA). The project shall include, but is not limited to, upgrading facility fiber throughout the buildings to each IT closet, provide a redundant fiber run throughout the facility to each IT closet, provide redundant fiber mains to the demarcation room from the provider point, design a new Data Center on the 5th Floor of bldg. 1, design or remodel twenty one IT closets throughout the facility, at specified locations adhering to the EHRM guidelines outlined in attachments, upgrade facility HVAC and electrical distribution as required, physical security assessment and upgrades and hazardous material abatement.

A campus wide physical security risk assessment was conducted 8 November 2021 by Force Protect (Project #549-17-801). Per PSRDM 1.5.2 the measures called out in the 8 November 2021 risk assessment can be considered as justification for “project-specific requirements or the need for modifications to PSRDM baseline requirements”.

Therefore, physical security recommendations for the EHRM scope in this report are based upon the risk assessment and comparative requirements of the VA Physical Security and Resiliency Design Manual (PSRDM), July 2022 revision, as they apply to this EHRM Infrastructure Upgrades scope of work. Therefore, PSRDM section 2.4, Table 2-1, Items 10 and 21 also apply:

Item 10 - Renovation or addition to a building that adds or changes a functional area (Relocation of Computer Room and Fiber Optic Entrance Room, in this case), CONTROLLED UNCLASSIFIED INFORMATION (CUI)

Physical Security Risk Mitigation Measures – EHRM Infrastructure Bonham VA Medical Center http://www.force-protect.com/ including particularly additions or changes of high value/high risk - Submit a request per section 1.3 to identify requirements:

Interpretations or deviations from requirements for VHA facilities must be evaluated and adjudicated by the Healthcare Engineering Oversight Committee on Physical Security and Resiliency.

Item 21 - Replacement and alteration of buried utilities and buried equipment: For buried utilities and buried equipment, when the project scope does not include alteration of the ground/road surface or site condition, upgrading the surface or site condition to comply with the PSRDM is not required. When buried utilities/equipment are modified (e.g. rerouted, replaced) as part of the project scope, or where the ground/road surface adjacent to or above buried utilities is modified as part of the project scope, comply with the requirements of Section 7.2.5 only for the portion of the utility being modified or the portion below or adjacent to the work area.

AE RISK MITIGATION DESIGN GUIDANCE

VA Site Fiber Optic Distribution

Vulnerability – Per the 2021 Risk Assessment, several buildings throughout the campus are not served by redundant fiber optic feeds. At many locations throughout campus, the underground fiber optic conduit is not concrete encased, and most conduits are near max fill. There is only a single fiber optic service to the campus.

Mitigations – Completely replace the existing campus fiber optic distribution. Ensure new fiber is compliant with the following measures:

1) The Telecommunications Feeds entering the campus are to comply with measures of PSRDM 8.2.3 outlined below:

a. Two services from each telecommunications provider are required, preferably with delivery from different central offices or sites.

b. Telecommunications cable pathways must be underground, located away from other utility services, and located away from high-risk areas.

c. Where more than one service is obtained, services must be separated by a minimum distance of 66 feet (20 m).

d. Telecommunications cable pathways must be designed to provide redundant services to the Entrance Room from the street or property line where the interface with the service provider takes place. Redundant service paths must be separated by a minimum distance of 66 feet (20 m) where possible.

2) Establish redundant telecommunications cable pathway from Datacenter to each

Telecommunications Room in each building, utilizing a ring topology for distribution. Locate new telecommunications cable pathways no closer than 50 feet (15 m) to each other. Sizing of conduits must be based on a 40 percent fill, and there must be a minimum of two spare four-inch (100 mm) conduits between buildings. Conduits must be encased in concrete. Distance between manholes or handholes must not be greater than 400 feet (122 m).

Telecommunications Room Resiliency Requirements

1) Ensure all mission critical Telecom Rooms within scope are on generator-backed HVAC service.

2) All equipment in the telecommunications rooms must be powered from UPS equipment that will provide a minimum of 10 minutes of service at full rated output.

3) Secure each Telecommunications Room as detailed in the section “Telecommunications Room Security” further in this report.

Entrance Room (Demarc)

The existing Fiber Optic Entrance Room will be relocated to the 5th floor as part of this project, as prescribed in the 2021 campus-wide risk assessment and preferred by VA Staff.

Vulnerability – If the new fiber optic entrance room is not properly secured, the room will be left vulnerable to undetected trespass, potentially resulting in scrap larceny/sabotage of fiber optic equipment. The impact of loss of trespass within the fiber optic entrance room could include shutdown of the entire campus telecommunications system.

Mitigation - In addition to the requirements outlined by the AHJ (Healthcare Engineering Oversight Committee on Physical Security and Resiliency), design the Entrance Room in accordance with the requirements of PSRDM Chapter 9.4.1, and Appendices A and B outlined below, as justified by the 2021 risk assessment:

1) Arm the door to the Entrance Room per SDO 113 and Appendix B:

a. Dual-authentication (PIV and pin code) card reader

b. Closer

c. Continuous hinge

d. Flush bolts (if applicable)

e. Mortise lock

2) Install fixed, motion-activated camera inside each door to the Entrance Room, tied into Security Control Center (SCC), notifying them immediately when room is entered and recording to NVR when activated.

3) Install contact sensors on the operable portions (if any) of existing windows in new Computer Room space, tied to the SCC. Additionally, Install 3M S-140 forced-entry/blast-resistant film.

4) Extend all walls and partitions surrounding the Entrance Room from slab to slab.

5) The Entrance Room must be provided with generator-backed HVAC service.

6) All equipment in the Entrance Room must be powered from UPS equipment that will provide a minimum of 10 minutes of service at full rated output when only passive equipment is in the Entrance Room. When the Entrance Room contains active equipment, UPS equipment that will provide 10 minutes of service at full rated output is required. If no EES or standby power is to be provided to the Entrance Room, an assessment of the facility must be performed to determine the required UPS battery runtime. In cases where EES or standby power is not available, the UPS operating duration may be increased to 4 hours or more to meet mission needs.

7) Install Public Address/Mass Notification System within the Entrance Room.

Main Computer Room (Datacenter) Security

The existing Computer Room is below grade and will be relocated to the 5th floor as part of this project, as prescribed in the 2021 campus-wide risk assessment and preferred by VA Staff.

Vulnerability – If the new Main Computer Room is not properly secured, the room will be left vulnerable to undetected trespass, potentially resulting in scrap larceny / theft of PII / sabotage of fiber optic equipment. The impact of loss of trespass within the Main Computer Room could include shutdown of the entire campus telecommunications system.

In addition to the requirements outlined by the AHJ (Healthcare Engineering Oversight Committee on Physical Security and Resiliency), ensure the Computer Room is located and constructed in accordance with the requirements of PSRDM 5.4 outlined below, as justified by the 2021 risk assessment:

1) The Computer Room must not be located within 50’ of any main entrance, Loading Dock, personnel and package screening area, uncontrolled parking, and Mailroom, and in no case directly above or below such spaces. Ensure the 5th floor location is not within 50’ of these high-risk areas.

2) Extend all walls and partitions surrounding the Computer Room from slab to slab.

3) All vents, ducts, and similar openings greater than 96 square inches that enter or pass through the Computer Room to be protected with security bars/louvers.

4) Arm all doors to the Computer Room per SDO 217 and Appendix B. Tie all ESS to the Security Control Center (SCC):

a. Dual-authentication (PIV and pin code) card reader

b. Closer

c. Continuous hinge

d. Door contact

e. Electric strike

f. Flush bolts

g. Mortise lock

5) Install fixed, motion-activated camera inside each door to the Computer Room, tied into Security Control Center (SCC), notifying them immediately when room is entered and recording to NVR when activated.

6) Install panic/duress pushbuttons in opposite corners of the Computer Room, tied into Security Control Center (SCC).

7) Install contact sensors on the operable portions (if any) of existing windows in new Computer Room space, tied to the SCC. Additionally, Install 3M S-140 forced-entry/blast-resistant film.

8) Install Public Address/Mass Notification System within the Computer Room.

Telecommunications Room Security

Each Telecommunications Room throughout the VAMC is expected to be either relocated or expanded to meet EHRM requirements.

Vulnerability – Telecommunications Rooms are vulnerable to undetected trespass resulting in scrap larceny / theft of PII / interruption of hospital operations.

Mitigation - Design each Telecommunications Room per the requirements of PSRDM Appendices A & B, as well as the recommendations of the 2021 risk assessment.

1) Arm the doors to each Telecommunications Rooms per SDO 218 and Appendix B.

Tie all ESS to the Security Control Center (SCC):

a. Dual-authentication (PIV and pin code) Card Reader.

b. Mortise Lock

c. Contact Sensors (tied to PACS and SCC)

d. Continuous Hinge

e. Flush Bolts (if applicable)

2) Install fixed, motion-activated camera inside each new Telecommunications Room, tied into Security Control Center (SCC), notifying them immediately when room is entered and recording to NVR when activated.

3) Where Telecommunications Enclosures (TE’s) are used, ensure they are monitored with motion-activated cameras.

4) Install Public Address/Mass Notification System within each Telecommunications Room.

5) The 2021 risk assessment called for relocation of electronic security panels to dedicated Security Equipment Closets (separate from the TRs), each containing slab-to slab construction of walls, security hinges on doors, and access control. If this is not attainable due to square footage constraints, enclose all security equipment within TRs in a security cage, armed with dual-authentication (PIV and pin code) PACS and contact sensors. Ensure all wall-mounted electronic security panels are mounted to 0.75-inch (19mm) fire-rated plywood.

The mitigation measures in this report are submitted CONTROLLED UNCLASSIFIED INFORMATION (CUI) and should not be shared with anyone other than the VA Primary Staff, Spur’s assigned team and Force Protect Security Consultants.

FRANK A FINLEY, II, PSP

Physical Security Consultant frank@force-protect.com 502-836-4232 mailto:frank@force-protect.com