36E77620R0010-003.pdf

Master Plan Annex VA Central California Health Care System (VACCHCS)

VISN 21 Physical Security Design Facility Survey (IDIQ Task Order #6 VA261-16-J-0762)

FOR OFFICIAL USE ONLY (FOUO)

Copyright © 2017 September 25, 2017 • Final Report (100% Submission)

This page intentionally left blank.

Final Report (100% Submission) Romanyk Consulting Corp. Copyright © 2017

2 I P a g e

ACKNOWLEDGEMENTS

1.0 – EXECUTIVE SUMMARY………………………………………….…………..07

2.0 – INTRODUCTION

OBJECTIVES

PROJECT APPROACH

TEAM COMPOSITION

SECURITY OF INFORMATION (CONSIDERATIONS)

PROGRESSIVE COLLAPSE (CONSIDERATIONS)

3.0 – EXISTING CONDITIONS……………………………….……………………..21

4.0 – GAP ANALYSIS…………….………………………………………….…………27

APPROACH

DEFICIENCY IDENTIFICATION

RISK ASSIGNMENT

RECOMMENDATIONS

BLAST RESISTANCE

5.0 – SELECTED CORRECTIVE STRATEGIES

SUMMARY

FACILTIY CONDITION ASSESSMENT (FCA) INTEGRATION

DETAILED CORRECTIVE STRATEGY INFORMATION

MASTER PLAN INTEGRATION AND ANNEX

APPENDIX

A – POINT OF CONTROL DEFINITIONS AND CROSS-REFERENCE WITH PSDM SECTIONS

B – RISK MATRIX

C – WAIVERS AND EQUIVALENCIES

D – FRESNO SEISMIC STATUS REPORT (COMPLETE)

E – FINAL DEFICIENCY REPORT

F – 45% SUBMITTAL MATERIALS

G – 65% SUBMITTAL MATERIALS

H – DEFICIENCY DETAIL SHEETS (ELECTRONIC APPENDIX)

I – FACILITY CONDITION ASSESSMENT (FCA) INTEGRATION

J – PHYSICAL SECURITY REFERENCES

TABLE OF CONTENTS

FOR OFFICIAL USE ONLY (FOUO)

Final Report (100% Submission)

3 I P a g e

Final Report (100% Submission)

4 I P a g e

By nature, a comprehensive Physical Security Design Facility Survey requires a proactive, dynamic team approach. Romanyk Consulting Corp. (RCC) acknowledges and greatly appreciates the collaborative and professional staff interactions with multiple levels within the Veterans Health Administration (VHA), including Headquarters, the VA Sierra Pacific Network (VISN 21), and the VA Central California Health Care System

(VACCHCS).

The following individuals have made significant and lasting contributions to the VACCHCS Physical Security Design Facility Survey, and RCC would like to acknowledge and thank them for their consistent, proactive, and professional teamwork!

The Romanyk team extends its thanks to VISN 21 for taking this proactive approach to their facilities’ security and for giving RCC the opportunity to assist in the endeavor. Both VISN and station representatives are encouraged to contact Jacob Mouro, RCC Senior Security Specialist, at (855) 424-3838 extension 320, to assist with any questions regarding the contents of this report.

Andrew N. Romanyk, President & CEO

VA Central California Health Care System Travis Horn, Chief, Engineering Service Sean Hinds, Facility Planner/Emergency Manager John Sulin, Admin. Officer, Engineering Service Theresa DiMaggio, Facility Planner Steve Bauman, Director, VACCHCS Although not listed individually by name, RCC greatly appreciates support from numerous VACCHCS staff representing Police, Emergency Management, Planning, Engineering Service, and Executive Leadership.

VA Sierra Pacific Network (VISN 21) Larry Janes, Capital Asset Manager (CAM) Richard Crowe, Deputy CAM/Acquisitions Manager (Project COR) Tim Bertucco, Assistant Capital Asset Manager Allan Federman, Energy Manager John (J.P.) Wallis, Presidential Management Fellow Randi Cappelletti, Presidential Management Fellow

Veterans Health Administration (VHA) Gary Krupa, Senior Electrical Engineer, VHA/OCAMES

ACKNOWLEDGEMENTS

FOR OFFICIAL USE ONLY (FOUO)

Final Report (100% Submission)

5 I P a g e

Final Report (100% Submission)

6 I P a g e

1.0 EXECUTIVE SUMMARY

Final Report (100% Submission)

7 I P a g e

Final Report (100% Submission)

8 I P a g e

Background In accordance with the Department of Veterans Affairs (VA) memorandum dated July 28, 2015, all

Veterans Integrated Service Network (VISN) Directors were charged to “ensure full implementation of the provisions and requirements stipulated within the Physical Security Design Manuals (PSDM) or obtain equivalencies/deviation approvals.” In response to this directive, the VA Sierra Pacific Network (VISN 21) contracted Romanyk Consulting Corp. (RCC) to conduct a third-party, comprehensive physical security assessment of all Network owned and leased facilities. Through a collaborative team approach involving VACCHCS facility subject matter experts, VISN representatives, and the RCC physical security team, 25 VACCHCS buildings were assessed under this survey (10 mission critical/15 life-safety protected). The original building list attachment showed a total of 26 buildings, however the Lot C Trailer was demolished prior to the beginning of this project. A total of 187 physical security compliance deficiencies (vulnerabilities) were identified for VACCHCS, 145 at the Fresno VAMC and 42 for all off-site locations.

Findings Noted deficiencies were assessed using a risk matrix of the likelihood of an occurrence in relation to the severity of an incident, with risk levels assigned on a scale of “very low” to “very high”1. At the Fresno VAMC campus, 48 deficiencies (33%) were rated as very high-risk and 82 deficiencies (57%) were evaluated as high-risk. Very high-risk deficiencies at Fresno VAMC medical center related to standoff (parking and roadway) and vehicle screening; most of the high-risk deficiencies related to one of the following three issues:

1. Video Assessment and Surveillance System (VASS) and Security Subsystem Integration

2. Security Control Center (SCC)

3. Lighting

There were no deficiencies considered very high-risk at VACCHCS off-site locations. Twenty deficiencies (48%) were rated as high-risk. The high-risk deficiencies were all related to vehicle access and parking within the standoff distance.

1 Refer to Appendix B for full definitions of the risk matrix utilized in this project and each risk level.

Risk Level Number of Deficiencies % of Total

VERY HIGH 48 33%

HIGH 82 57%

MEDIUM 13 9%

LOW 2 1%

VERY LOW 0 0%

Total 145 100%

Risk Level Number of Deficiencies % of Total

VERY HIGH 0 0%

HIGH 20 48%

MEDIUM 16 38%

LOW 6 14%

VERY LOW 0 0%

Total 42 100%

Table 1: Fresno VAMC Deficiencies by Risk Level

Table 2: VACCHCS Off-Site Location Deficiencies by Risk Level

Final Report (100% Submission)

9 I P a g e

Corrective Strategies Corrective action recommendations were provided by RCC and were jointly reviewed by station, VISN, and RCC representatives to formulate an overall plan to ensure PSDM compliance. Where possible, the priority was to align physical security corrective strategies with current cycle (FY 2019) VA Strategic Capital Investment Plan (SCIP) projects to “enhance” them for more immediate resolution of deficiencies, as well as to better position the project to garner physical security/safety points when evaluated for funding.

When incorporation of corrections into current cycle SCIP projects were not feasible, other corrective strategies were identified (including new physical security projects, station-level actions, waivers/equivalencies, and other miscellaneous strategies). Regardless of the approach chosen, the corrective strategies identified provide a comprehensive and proactive approach to alleviating physical security deficiencies. Table 3 shows a high-level summary of the impact of the final corrective strategies selected for the health care system by VACCHCS and VISN 21 representatives, in addition to the Rough Order of Magnitude (ROM) estimate for the “enhancements” to identified SCIP 2019 Projects, as well as ROM estimates for the new projects; the ROM estimates also account for costs related to temporary moves and other associated costs to complete the project, a predesign allowance, inflation to midpoint of construction, and market & acquisition costs. The total ROM estimate for VACCHCS projects is $73,438,000.

The following is a summary of all new projects and enhanced SCIP projects that will address physical security deficiencies for VACCHCS.

2 Rough order of magnitude (ROM) cost estimates were provided for new projects and enhancements to existing SCIP projects. In the latter case, the ROM represents the value of the work to be added to the project scope.

3 Per VA Central Office (VACO), current direction is that Vet Centers will be acquired, operated, and maintained by Vet Center-specific personnel, unless this decision is changed in the future (current estimated effective date 10/1/2017). Therefore, any cost related to physical security improvements at Vet Centers would be borne by the Vet Center, not the VA Medical Center.

VACCHCS Corrective Strategy Frequency

Number of Deficiencies Addressed

ROM2

Estimate

New Project 2 87 $49,801,0003 Existing SCIP Project 5 86 $27,637,000 Other Corrective Strategy 3 14 N/A Totals 10 187 $77,438,000

Table 3: VACCHCS Corrective Strategy Summary

Final Report (100% Submission)

10 I P a g e

Fresno VAMC New Projects RCC Project ID Description ROM

570-VAMC-N1

"Construct PSDM Compliant Incident Command Center (ICC) and Off- Campus Parking Structure to Ensure Continuity of Operations": This project will develop an Incident Command Center (ICC), construct a parking structure (providing an estimated 700 spaces), and will include a redesign of facility traffic patterns and the main entrance to incorporate vehicle screening by "off-loading" to the new parking structure and prohibiting vehicle traffic and parking within the facility standoff.

$44,793,000

570-VAMC-N2

"Develop a Fully Integrated Campus-wide Electronic Security System (ESS)/Associated Physical Security Sub-Systems": All systems should be integrated forming the Electronic Security System (ESS). The ESS integrates Physical Access Control System (PACS); Intrusion Detection System (IDS);

Video Assessment and Surveillance System (VASS); Duress, Security Phones, and Intercom System (DSPI); and Detection and Screening System (DSS). The facility should also conduct a lighting survey during the hours of darkness to ensure all areas of campus are adequately illuminated, making corrections to dark areas as appropriate (e.g. install additional fixtures, upgrade existing fixtures).

$5,008,000

Total ROM Cost $49,801,000

VACCHCS Off-Site New Projects No new projects were developed for any VACCHCS off-site locations.

Fresno VAMC Existing SCIP Integration SCIP Project ID Description ROM

VHA21-570-2013-10068

“Improve Site Access and Physical Security Deficiencies”: This existing NRM project will be re-scoped to address additional physical security deficiencies. Work to be added includes: acquiring property along the north side of Harvard Ave to allow the loading dock to be redesigned and parking within the standoff to be relocated, providing fencing to alleviate the risk of standoff deficiencies (specifically the southeast corner of the Mental Health building), providing anti-ram protection for Building LC2, rebuilding existing barrier around Pump House 5 to meet VA PSDM standards, reinforcing the facades with blast shielding where there is vehicular access within the standoff distance, providing anti-fragmentation film on all windows/glazing, constructing a PSDM-compliant mailroom, installing a combination of anti-ram bollards and a seat-wall to provide increased protection for the north side of building 34 as well as prevent vehicular access within the standoff for building 34 and the generator farm.

$27,637,000

VHA21-570-2013-16550

This existing SCIP project will address physical security deficiencies by relocating the main computer room to a standalone building, currently in design.

N/A

Total ROM Cost $27,637,000

1.0 EXECUTIVE SUMMARY

FOR OFFICIAL USE ONLY (FOUO)

Final Report (100% Submission)

11 I P a g e

VACCHCS Off-Sites Existing SCIP Integration No existing SCIP projects will be enhanced to include correction of physical security deficiencies. Three

SCIP projects were identified as already resolving deficiencies identified in this assessment; for more information on these projects refer to Section 5 “Selected Corrective Strategies”.

The Way Forward As outlined in this summary, there are significant findings and critical projects which will require ongoing internal discussion regarding strategic/operational prioritization, integration, alternative considerations, and implementation.

Romanyk Consulting Corp. welcomed the opportunity to conduct a physical security survey of the VA Central California Health Care System. The Romanyk team remains available to provide additional information, clarification, and support as needed as VACCHCS continues to improve the safety of its facilities by incorporating these recommendations and the guidance provided in the VA Physical Security Design Manuals.

1.0 EXECUTIVE SUMMARY

FOR OFFICIAL USE ONLY (FOUO)

Final Report (100% Submission)

12 I P a g e

2.0 INTRODUCTION

Final Report (100% Submission)

13 I P a g e

Final Report (100% Submission)

14 I P a g e

Objectives The mission of the VA Sierra Pacific Network (VISN 21) is to provide the highest quality health care to the nation’s Veterans. This cannot be accomplished without ensuring and protecting the health and safety of all patients, employees, and visitors at VISN 21 facilities.

To provide guidance for all VISNs towards meeting this objective, the VA Office of Construction, Facilities and Management (OCFM) published Physical Security Design Manuals for Mission Critical and Life Safety Protected facilities. These manuals contain the physical security standards for improving the protection of life-safety protected and mission critical facilities. Life-safety protected facilities are required to protect the life safety of all patients, staff, and visitors in the case of an emergency, while mission critical facilities are required to continue operation during a natural or manmade extreme event.

In an effort to ensure compliance with the VA PSDMs at all VISN 21 facilities, Romanyk Consulting Corp. (RCC) was contracted to survey VISN 21 facilities pursuant to a listing provided by the VISN 21 Capital Asset Management (CAM) office and analyze each facility’s compliance with the physical security requirements for existing facilities described in the current (January 2015) edition of the PSDMs. Both VISN 21 Medical Centers and their associated off-site locations, owned and leased, were assessed through this task order against the PSDM requirements for existing facilities. The off-site locations included not only direct care clinical spaces but, for example, warehouses, Vet Centers, research facilities, and administrative annexes.

There were three specific tasks under this project:

1. Task 1: Develop a gap analysis of existing building and site conditions as they relate to the VA PSDM’s first and second level points of control.

This task applied to all owned and leased buildings.

2. Task 2: Develop a gap analysis of existing building conditions as they relate to the VA PSDM’s third through fifth points of control4. This task applied only to owned buildings (“owned” per the list provided by the VISN 21 CAM office).

3. Task 3: Develop “high-level” input by a qualified structural engineer for recommendations associated with Task 1 that focus on protection of building exteriors. While the VA PSDMs include certain requirements for

4 All points of control are defined in Appendix A.

PHYSICAL SECURITY

DESIGN MANUALS

(PSDM), JANUARY 2015

PSDM for Mission Critical Facilities (above)

2.0 INTRODUCTION

PSDM for Life Safety Protected Facilities (above)

FOR OFFICIAL USE ONLY (FOUO)

Final Report (100% Submission)

15 I P a g e

Figure 1: Project Phase 1 existing facilities in terms of blast and/or structural calculations, this project did not require or request such calculations.

Project Approach As stated, the RCC/VISN 21 Physical Security Design Facility Survey project involved a collaborative team effort between VA and RCC. To support a comprehensive understanding of the progression of this project, RCC defined four “phases” of project execution. This approach served to establish process, assign responsibility, enhance communications, and promote teamwork.

Phase 1 The first phase included the overall project kick-off, data gathering efforts, on-site kickoff, interviews, and surveys, and the associated preparation and review of findings. Site kick-off meetings were held at the main campus with multiple facility and service-level leadership participation from the primary disciplines involved in this project: Engineering, Police/Physical Security, Planning, IT, and Emergency Preparedness. The VA Central California Health Care System had one “kick-off meeting” in support of the Fresno VAMC and VACCHCS off-site locations. Following the kick-off meeting, “owner interviews” were conducted by the RCC Security Specialist asking a series of security-related questions covering the VA PSDM requirements. Physical security site surveys, per the VISN 21 SOW, included the non-invasive visual inspections of the exterior of buildings, grounds, site access, and utilities.

16 I P a g e

Phase 2 The second phase of the survey began with the first submittal (“Analysis” or 45% Submittal). The 45%

Submittal included a listing of all physical security “deficiencies” identified by RCC following the site survey. After the 45% Submittal was provided a review call was held with key VACCHCS and VISN 21 staff to provide an overview of both the findings and the review process, including the use of RCC’s Clarity site to facilitate the review process. Clarity, created and owned by IMAGINiT and licensed by Romanyk Consulting Corp. for use in this project, is a website that meets VA security requirements and allowed VA users to securely access and comment on project submissions. During the review period, VACCHCS and VISN 21 representatives were asked to focus on two points (right):

In the final step of Phase 2, RCC prepared recommended corrective actions and proposed project groupings to address the deficiencies. These corrective actions and project groupings formed the next RCC submittal (“Recommendations” or 65% Submittal).

Figure 2: Project Phase 2

1. A review of all deficiencies to ensure all issues were represented accurately.

2. Identifying any major considerations that would eliminate deficiencies (for example, ongoing or approved SCIP projects, or any buildings scheduled for disposal).

2.0 INTRODUCTION

FOR OFFICIAL USE ONLY (FOUO)

Final Report (100% Submission)

17 I P a g e

Figure 3: Project Phase 3 and Phase 4

Final Project Phases (Phases 3 and 4) After the 65% Submittal, a review and comment period for VACCHCS/VISN 21 representatives preceded the 65% Review Meeting; a day-long, face-to-face meeting where RCC and VA representatives focused on identifying final corrective strategies, groupings, and any waivers or equivalencies to be pursued. The VACCHCS 65% Review Meeting was held on-site at the Fresno VAMC and supported a review of recommended corrective actions for the entire health care system.

Once a consensus was reached on the final strategies and groupings, RCC prepared this document, which builds on all previous phases and serves as a record of the project purpose and scope, all findings presented and discussions held under this survey, and ROM estimates for the work to be added as an Annex to the VACCHCS Facility Master Plan.

2.0 INTRODUCTION

FOR OFFICIAL USE ONLY (FOUO)

Final Report (100% Submission)

18 I P a g e

Team Composition The Romanyk Consulting team assigned to this project included certified security protection professionals, registered architects, professional engineers, Building Information Modeling (BIM) experts, structural blast specialists, healthcare facility managers, and healthcare planners. The Romanyk team brought its extensive and varied security and healthcare planning experience, combined with the structural expertise of their partner for this project (Black & Veatch) to assess current VACCHCS physical security conditions, assess risk, and recommend executable corrective strategies.

Considerations Security of Information

Important throughout this project was the security of information. Due to the nature of this survey and its findings, any information related to this project should be considered For Official Use Only (FOUO). To protect information and reduce the cost to the government, RCC developed an electronic review process for all submissions and review periods leading up to the final report. That process involved utilizing Clarity (Clarity home screen shown in Figure 4), an online access portal that meets all VA security requirements and allowed VA representatives to view all submittal materials and make comments.

Figure 4: Romanyk Consulting Clarity homepage (VACCHCS user view)

19 I P a g e

Progressive Collapse The VA Physical Security Design Manuals (Section 7.2.1) establish that existing facilities have “no additional physical security requirements” regarding progressive collapse. However, due to seismic vulnerability throughout the geography of VISN 21, Task 3 of the Scope of Work calls for the development of a list of owned and leased buildings to be targeted for future seismic analysis by the VA outside the requirements of this physical security assessment. The VA conducts independent seismic studies resulting in the classification of buildings located within highly sensitive seismic zones as “Extremely High Risk” (EHR) and “High Risk” (HR). These studies also identify seismic remedial actions to meet current seismic requirements for existing facilities. Not all buildings within VISN 21 have a completed seismic study therefore remedial actions that could have an impact on progressive collapse through seismic retrofits have not been completely identified calling for further investigation. Therefore, germane to this physical security assessment was the need to identify buildings greater than one story that require a seismic study assessment that has not been performed.

RCC’s methodology to develop the unstudied list of buildings is as follows: data was collected by RCC from the VA Capital Asset Inventory (CAI) that serves as the VA repository for the status of seismic reports and final seismic classifications. The seismic status report was analyzed to determine those buildings with classifications of “Extremely High Risk” (EHR) and “High Risk” (HR) Buildings Status, indicating that a report has been completed. Next, buildings more than one story tall with a seismic status “E0”, (meaning “Not Exempt”) and without a VA seismic status shown as EHR or HR were shortlisted as the high-risk list of buildings that do not have completed seismic studies. No buildings for Fresno VAMC met these criteria (more than one story tall with seismic status of E0); the complete Fresno VAMC “Seismic Building Information” report is included herein as a reference, see Appendix D.

2.0 INTRODUCTION

FOR OFFICIAL USE ONLY (FOUO)

Final Report (100% Submission)

20 I P a g e

3.0 EXISTING CONDITIONS

21 I P a g e

22 I P a g e

The Fresno VAMC sits on a 20-acre parcel of land in the city of Fresno, CA (2014 population of 515,986).

The city of Fresno is located in Fresno County, in the center of the San Joaquin Valley at the southern portion of California's Central Valley. The US Geological Survey (USGS) has assessed that the Fresno, CA as a high earthquake risk. There is a 53.31% chance of a major earthquake (5.0M) in the Fresno region between 2014- 2043. The largest earthquake within the Fresno region was a 4.1 Magnitude in 1973.

The properties immediately adjacent to the Fresno VAMC are mostly single family residential homes as well as a low income (Section 8) housing complex and some small businesses. Per information provided by Fresno VAPD during owner interviews, within a three-mile radius of campus there are approximately 28 known active gangs. There have been past incidents where VA police assisted Fresno Police Department in setting up a perimeter to contain a fleeing suspect, resulting in partial lockdown of the VA campus. There have been past shootings, break-ins, and vehicle thefts in the area, as well as vandalism to VA property and gang activity. VA police have found people loitering on VA property, including some homeless individuals sleeping in exterior stairways.

The overall crime rate in Fresno, CA is 54% higher than the California average and 64% higher than the national average. Violent crimes (particularly murder) in Fresno, CA occur at a rate 29% higher than the California average and 48% higher than the national average. With regard to property crime, the crime rate in Fresno is 58% higher than the average of California and is 67% higher than the national average. The campus is protected by sworn VA Police Officers, who have twenty-four-hour presence on campus. Fresno Fire Station #5 is within approximately one mile of the campus. There are several other fire stations in Fresno area that could provide support for a multiple alarm fire.

Figure 5: Fresno VAMC Site Map (source: Fresno Facility Master Plan)

23 I P a g e

Fresno VAMC does not serve as backup to any DoD or community/public health care system but does operate an emergency room. It also provides inpatient and outpatient services. The campus contains 57 acute care beds and a 54-bed Community Living Center (CLC), and offers primary care services, emergency care services, and multiple outpatient specialty clinics including dental, mental health, and prosthetics. The Central California Health Care System also utilizes telehealth to provide services such as neurology, dermatology, mental health, and other services to rural and/or homebound Veterans. VACCHCS currently serves more than 28,000 Veterans across six counties in the San Joaquin Valley.

The campus layout/footprint is condensed. Unlike other stations which have formal entrances to the campus with internal (VA owned) roadways to navigate the campus, the Fresno VAMC campus is accessed by the surrounded municipal roadways. The municipal roadway to the north (Harvard Ave) and east (N. Angus St.)

are within both Mission Critical and Life Safety Protected facilities’ standoff distances and these roadways also provide curbside parking. This makes blast resiliency, unscreened vehicle and pedestrian access as well as vehicle/parking standoff the major areas of concern.

Twenty-five VACCHCS buildings were assessed under this survey; of these, 10 are considered mission critical and the remaining 15 are life-safety protected (building classifications per VA PSDM guidelines, Section 1.2). Nineteen of the twenty-five buildings are located at the main medical center in Fresno, CA; six are leased facilities spread throughout Fresno’s catchment area in Southern portion of California’s Central Valley. One building on the provided building list was excluded as it was demolished before the RCC site survey. The table below shows the full list of buildings for VACCHCS and the classification of each. Note that if a campus has mission critical buildings, the “site” is measured against the VA PSDM for Mission Critical Facilities. Based on VA PSDM guidance, mission critical buildings include:

• Building 1: Main Hospital

• Building 2: Boiler Plant

• Building 18: Handicap Elevator

• Building 19: Switch Gear

• Building 22: Chiller Plant

• Building 25: Mental Health Program Building

• Building 32: Warehouse

• Building 34: Mental Health/Rehabilitation/Prosthetics

• Building OPC: Outpatient Clinic: Emergency Dept/Primary Care

• Building OPC2: Outpatient Addition: Eye/Audio/Dental/Minor Procedures

These 10 buildings are considered mission critical because their continuous operation is required to support continuity of care and operations within VACCHCS. Per the Physical Security Design Manual for Life- Safety Protected Facilities, Community Living Center (CLC) buildings are considered "Life Safety Protected with Mission Critical Level Utility and System Redundancy/Capacity". This applies to Building 31 at the Fresno VAMC.

Building 27 and Building 22A were activated/opened after this project was contracted (February 2016 and September 2016 respectively) and therefore were not included in this assessment. This assessment also does not include the ongoing expansion of the CLC (Building 31).

24 I P a g e

Attachment A VISN 21 Building List Station Number

Station Name

Building Number Building Function Title Year

Built Le as ed

Floors Site

Around Building

Total

GSF

Mission Critical or Life Safety

570 Fresno 1 Main Hospital 1949 N 11 1

245,263 MC

570 Fresno 18 Handicap Elevator 1987 N 1 1 254 MC 570 Fresno 19 Switch Gear 1949 N 1 1 2,401 MC 570 Fresno 2 Boiler Plant 1949 N 1 1 6,292 MC 570 Fresno 22 Chiller Plant 1978 N 1 1 2,534 MC 570 Fresno 24 Education Building 1981 N 5 1 40,575 LS

570 Fresno 25 Mental Health Program Building 2014 N 2 1 13,507 MC

570 Fresno 3 Engineering Shops/Administration 1949 N 1 1 9,689 LS

570 Fresno 31 Community Living Center-

(GECU) 1982 N 2 1 33,724 LS

570 Fresno 32 Warehouse 1988 N 3 1 17,458 MC

570 Fresno 34 Mental Health/ Rehabilitation/Prosthetics 2012 N 2 1 18,599 MC

570 Fresno 36 Facility/Safety - Warehouse 2011 N 1 1 1,830 LS 570 Fresno 4 Pump House West 1949 N 1 1 537 LS 570 Fresno 5 Pump House East 1949 N 1 1 220 LS 570 Fresno 7 Engineering Bullpen 1977 N 1 1 2,073 LS 570 Fresno 8 Engineering Bullpen 1977 N 1 1 1,400 LS

570 Fresno Lot-C Trailer

Fiscal/Human Resource/psychology 2012 N 1 1 6,633 EXCLUDED

570 Fresno OPC Outpatient Clinic: Emergency Dept/Primary Care 1981 N 2 1 31,967 MC

570 Fresno OPC2 Outpatient Addition:

Eye/Audio/Dental/Minor Proced

1988 N 3 1 36,248 MC

570 Fresno T-5 Engineering Administration 2008 N 1 1 600 LS

570 Fresno

155 E Shaw

Homeles Prgm

Fresno Homless Program Building 1983 Y 1 1 3,467 LS

Continued on next page.

25 I P a g e

Station Number

Station Name

Building Number Building Function Title Year

Built Le as ed

Floors Site

Around Building

Total

GSF

Mission Critical or

Life Safety

570 Fresno 570/561 S. Pink-ham Visalia Rural Health 2005 Y 1 1 1,268 LS

570 Fresno Merced CBOC Merced CBOC 2010 Y 1 1 8,620 LS

570 Fresno Oakhurst CBOC Oakhurst CBOC 2011 Y 1 1 8,500 LS

570 Fresno Tlre Tulare CBOC 1999 Y 1 1 6,797 LS 570 Fresno VtCtr Vet Center 1975 Y 1 1 4,186 LS

3.0 EXISTING CONDITIONS

FOR OFFICIAL USE ONLY (FOUO)

Final Report (100% Submission)

26 I P a g e

4.0 GAP ANALYSIS

27 I P a g e

Final Report (100% Submission)

28 I P a g e

Approach The physical security gap analysis was a collaborative, interactive process requiring the participation of key VA stakeholders in “owner interviews” and both daytime and nighttime “boots on the ground” site surveys.

Romanyk Consulting Corp.’s team of security experts, who possess significant law enforcement command experience as well as crime prevention and physical security certifications, conducted the assessment and evaluation of all deficiencies. The result for VACCHCS was a total of 187 deficiencies, 145 at the medical center in Fresno and 42 at all off-site locations combined.

Owner interviews were conducted at the Fresno VAMC with various Subject Matter Experts (SMEs), including representatives from Engineering, Police, Research, Safety/Emergency Preparedness, Medical Administration Service (MAS), Acquisition and Material Management Service (A&MMS), Pharmacy, Emergency Department, Fiscal, and Information Resource Management (IRM). These SMEs were asked a series of questions designed to assess the facility’s compliance with the VA PSDMs.

A total of 563 questions were asked for mission critical buildings/sites (456 for life safety protected buildings/sites).

During the site walkthrough, a two-person Romanyk team including one engineer and one analyst looked at the entire perimeter of the Fresno VAMC campus, the exterior of all buildings, and other critical infrastructure such as water storage, generators, and utility entrance points onto the campus, all as prescribed by the statement of work. The RCC Team was escorted by VA staff members who provided information as to utility connections, projects under way, and future plans. Assessment of VACCHCS off-site locations was done through analysis of satellite imagery.

After the site survey was complete, RCC security experts conducted a risk assessment, the findings of which were presented to the facility as the 45% (“Analysis”) Submittal. The submittal included a report showing detailed information on each deficiency and a site map showing the location of deficiencies5. The site map showed all buildings included in the survey color-coded by building type. A lighter color “halo” shows where there are standoff deficiencies, indicating at a glance where there was parking or a roadway that passed with in the 25-ft. standoff (for life-safety protected buildings) or 50-ft. standoff (for mission critical buildings).

A complete listing of the 45% VA PSDM interview questions and answers are included in Appendix E;

the locations of the findings are graphically shown on the site plan included in Appendix F.

5 Locations shown where applicable. Some deficiencies did not have specific physical locations (for example, a deficiency relating to utility systems redundancy that applied to the entire site) and are shown in the deficiency report but do not have a corresponding flag on the site map.

Figure 6: Fresno VAMC (Photo credit: www.fresno.va.gov)

29 I P a g e

Deficiency Identification In practical terms, a security assessment is a comprehensive look at the concentric levels of control and protection in place at a facility to identify one or both deficiencies and vulnerabilities. Concentric levels of control and protection refer to the protection of assets with multiple layers of security measures such that the asset is least exposed to threats. Where a single line of defense might be easily breached, the concentric levels approach provides redundancy and lines of defense that are less likely to be breached.

The VA PSDMs identify five points of control. The first and second points of control are located from the perimeter of the building outward; the third, fourth, and fifth points of control are located at points within the building. Below are definitions of each of the five points of control, followed by a summary of the number of deficiencies related to each point of control (grouped into the 1st/2nd point of control [building exterior] and 3rd/4th/5th point of control [building interior]). This analysis is based on a cross-reference between VA PSDM sections and the five points of control, included as a reference in Appendix A.

Points of Control The five points of control, as described in the VA PSDMs, are:

1. First Point of Control: The outermost level, located at the perimeter of the property. Depending on the location (e.g. in certain urban sites) the first point of control may be on the property line.

2. Second Point of Control: This point of control is at the building perimeter and includes access control hardware (e.g. card readers) on doors and other openings into the building and, at selected entrances at various times, personnel for control and screening.

3. Third Point of Control: At the third point of control, inside the building, staff-only areas are segregated from public areas. This can be accomplished through similar means of protection used at the second point of control (e.g. access control hardware).

4. Fourth Point of Control: The fourth point of control is segregation of staff-only areas into levels of authorization, where not all staff will have access and additional access may need to be granted on an individual basis. Card readers are an appropriate control measure at this point;

examples of authorized access include patient records and vivarium space.

5. Fifth Point of Control: At the innermost level, access is further restricted and multiple control measures may be present (e.g. card readers, VASS monitors, intrusion detection alarms, and/or ballistic-resistant construction.

Figure 7: Concentric Levels of Control and Protection

30 I P a g e

Table 4: Fresno VAMC Campus Deficiencies by Point of Control

Points of Control: Fresno VAMC Deficiencies identified at the Fresno VAMC were distributed across the points of control as follows:

First and Second Point of Control Deficiencies A majority of the deficiencies related to the first and second points of control were standoff deficiencies, with either roadways or parking falling within the standoff distance (either 50 feet from a mission critical building or 25 feet from a life safety protected building). Second-most common were deficiencies related to Video Assessment and Surveillance (VASS). There were also a series of deficiencies related to perimeter fencing.

Third, Fourth, and Fifth Point of Control Deficiencies Roughly 34% of Fresno VAMC’s total deficiencies related to the third, fourth, or fifth points of control.

Most related to functional spaces defined by the VA PSDM; in this case, the mailroom, Incident Command Center, Security Control Center, main computer room, police operations holding room, records storage and archives, child care, and agent cashier One additional deficiency was related to unprotected electrical distribution devices along the north property line.

Points of Control: VACCHCS Off-Site Locations All deficiencies identified at VACCHCS off-site locations (total of 42) related to the first and second points of control; the majority were standoff deficiencies, with either roadways or parking falling within the standoff distance (either 50 feet from a mission critical building or 25 feet from a life safety protected building). The remainder of the deficiencies related to the primarily to the perimeter barrier, lighting, and patient drop offs.

Point of Control Number of Deficiencies First & Second 96 Third, Fourth & Fifth 49

31 I P a g e

Table 5: Fresno VAMC Deficiencies by Risk Level

Risk Assignment: Overview Risk is calculated for all threats (natural6, human7, or technological8) based on the likelihood of a particular incident occurring in conjunction with the potential severity of loss (cost/consequence) if that incident were to occur. The VA PSDM standards are designed in response to an “extreme manmade or natural” threat. Each deficiency identified through the interviews and walkthroughs marks a vulnerability to such threats and the risk level is assessed.

Noted deficiencies were assessed using a matrix of the likelihood of an occurrence in relation to the severity of an incident (see Figure 8), which rated on a scale from “very low” to “very high”9. When considering projects for funding, the risk level in conjunction with existing conditions should be evaluated to prioritize projects to mitigate risk. Risk levels were assigned based upon the evaluations and expertise of the Romanyk Consulting security team based on existing conditions for the Palo Alto Division, considering CPTED principles and concentric levels of protection. Veterans Affairs representatives were provided the opportunity to review and comment on the assigned risk levels during the review process.

Risk Assignment: Fresno VAMC Thirty-three percent of the 145 deficiencies identified at the Fresno VAMC were considered very high risk and over half of Fresno VAMC deficiencies (57%) were determined to be high-risk. Very high-risk deficiencies related to vehicle access (parking and roadway) within the standoff distance and vehicle screening. Most high-risk deficiencies related to one of three issues:

1. VASS and Security Subsystem Integration Relates to Task 1 (1st/2nd point of control)

2. Security Control Center Relates to Task 2 (3rd/4th/5th point of control)

3. Lighting

Relates to Task 1 (1st/2nd point of control)

6 Natural threats include extreme events such as earthquakes.

7 Human threats include active shooters (these can be visitors or staff) and explosive devices (car or trashcan bombs).

8 Technological threats include electronic threats such as computer viruses or hackers attempting to breach VA firewall.

9 Definitions of each risk level and likelihood of incident/severity of loss category are included in Appendix B.

Risk Level Number of Deficiencies % of Total

VERY HIGH 48 33%

HIGH 82 57%

MEDIUM 13 9%

LOW 2 1%

VERY LOW 0 0%

Total 145 100%

Figure 8: Risk Matrix

32 I P a g e

Table 6: VACCHCS Off-Site Location Deficiencies by Risk Level

Risk Assignment: VACCHCS Off-Site Locations Approximately half of all deficiencies at VACCHCS off-site locations (20 deficiencies, 48%) were identified as high-risk; none were identified as very high-risk. The high-risk deficiencies were all related to vehicle access and parking within the standoff distance.

A detailed report of all deficiencies identified within VACCHCS is included in Appendix E of this report;

a detailed summary analysis of the issues that in each risk level is included in Appendix F.

Risk Level Number of Deficiencies % of Total

VERY HIGH 0 0%

HIGH 20 48%

MEDIUM 16 38%

LOW 6 14%

VERY LOW 0 0%

Total 42 100%

33 I P a g e

Recommendations After the 45% submission VA review and comment period concluded, RCC’s Security Specialists examined VACCHCS deficiencies at all owned and leased spaces and recommended a series of corrective actions that, if implemented, would support VA PSDM compliance. The deficiencies were grouped according to the corrective action recommended to address each one, based on where common strategies would likely be developed (e.g. projects, waiver request). Where possible, the Romanyk team examined the projects in the facility’s current Strategic Capital Investment Planning (SCIP) Action Plan (in this case, the SCIP 2019 cycle) to identify opportunities to incorporate physical security corrections into planned projects.

Many of the recommended corrective actions have several components, all of which have a wide range of potential product types, approaches, or even protection methodologies (Figures 9-11 below represent sample components of corrective actions recommended for the Fresno VAMC campus). A summary of all corrective actions recommended is included in Appendix G of this report.

The recommendations incorporated the principles of Crime Prevention Through Environmental Design (CPTED) where possible, and relied on the concentric levels of protection by recommending multiple layers of security be put in place. Both CPTED and concentric levels of protection are established best practices within the security field. In general, the goal is to resolve deficiencies; however, some solutions may not be practical or feasible. For example, when reinforcing the first point of control (the property perimeter) is not feasible, additional security measures are added to the second point of control (the building perimeter). In other cases, where a solution is not practical or possible, it may be possible to put alternate security measures in place that reduce the risk level to an “acceptable” level and pursue and equivalency or waiver. Ultimately, the goal is to put as many layers of protection in place as is possible. At VACCHCS locations, many of the recommendations focused on the second point of control, increasing security of the building perimeter by installing cameras and other access control measures, as well as securing non-patient areas like loading docks from unauthorized access.

Figure 9: Blast Shielding Figure 10: Anti-ram protection (seat wall) Figure 11: Perimeter fencing (in specific areas)

34 I P a g e

The recommended corrective actions were categorized as either a new project, enhancement of an approved or pending SCIP project station-level action or purchase, procedural change, or a recommendation to pursue a waiver or an equivalency. A waiver was defined as an instance where meeting the VA PSDM requirement was either not feasible and/or not practical10. Other proposed recommendations may mitigate (reduce) risk, but ultimately a waiver would need to be sought for the remainder of the gap between the site condition and the VA PSDM standard. By contrast, an equivalency was defined as a condition, either existing or planned through future action, that may not be what was prescribed by the VA PSDM but provided an acceptable level of protection.

Blast Resistance As part of this process, RCC security experts have developed corrective actions and recommendations designed to mitigate the loss of life, protect the critical infrastructure, and maintain the continuity of operations of the main VA health care system mission critical buildings after a vehicle-borne or other explosive threat. The recommendations and corrective actions associated with standoff and blast resistance were reviewed by blast engineering specialists, and the results of this review can be found in Appendix E. While blast mitigation or hardening techniques cannot completely eliminate the threat of explosive devices, these corrective actions will afford the facility an acceptable level of protection in accordance with the VA Physical Security Design Manual dated January 2015. Chapter 6 of the Physical Security Design Manual for VA Mission Critical Facilities requires blast-protective considerations in addition to protection from “hurricane, earthquake, and any other extreme loading” conditions. Magnitudes for the blast analysis are W1 and GP2 as defined and provided by the Office of Construction and Facilities Management. Walls, windows, skylights, doors and roofs are all components of blast protection.

Blast resistance standards are some of the most challenging VA PSDM requirements to meet, in part due to the high cost of construction required to meet these standards, especially with historic buildings, and the disruption of operations while corrections are ongoing. There are requirements that are recommended to be implemented over time using a phased approach and may be completed with scheduled maintenance. Of note is the interim option to use anti-fragmentation film for glazing instead of laminated glass.

Based on discussions with the VA engineering team at the VISN and OCAMES, it is recommended that laminated glass be programmed for installation due to the increased protection factors, aesthetics, durability, and a slight energy conservation savings. It is noted that laminated glass installation in new or existing facilities can be costly and involves a special framing with attachment to the building structure. Replacement with the specified laminated glazing shall be, at the very latest, accomplished upon replacement of existing windows due to age and condition. However, new construction, renovation or heightened security conditions can also be an impetus for installing laminated glazing. With this guidance in mind, all cost estimates performed in this study are based on laminated glass installation or replacement.

10 Reasons why becoming VA PSDM compliant would not be practical may include low return on investment (relatively small reduction of risk compared to high cost of corrective actions) or corrective actions that may cause a severe disruption of operations.

35 I P a g e

36 I P a g e

5.0 SELECTED CORRECTIVE STRATEGIES

37 I P a g e

38 I P a g e

The purpose of the 65% Conference was to select corrective strategies to address all physical security deficiencies identified through this survey. Romanyk Consulting Corp., VACCHCS, and VISN representatives worked collaboratively to identify these final strategies, proactively seeking opportunities to incorporate deficiency corrections into current 2019 SCIP cycle projects. The 2019 VA SCIP guidance ranks safety as a high priority in scoring SCIP projects. As such, incorporating physical security corrections into existing projects not only accelerates the timeframe for implementing corrections, but also better positions projects to garner additional points when competing for funding.

During discussion of deficiencies for some off-site leased facilities, station representatives indicated that a replacement lease was imminent. In those cases where the lease would expire within five years, the direction from the VA was that the lease replacement would serve as the resolution for correcting deficiencies at the lease, and no further action is necessary. Per VA Central Office (VACO), moving forward Vet Centers will be acquired, operated, and maintained by Vet Center-specific personnel (estimated effective date 10/1/2017).

Since this report was published prior to that date, all deficiencies and corrective actions for Vet Centers currently associated with VACCHCS are included herein but it will not be the responsibility of the station to implement any corrections (unless this decision is changed in the future). The findings and corrective actions will be shared with the appropriate Vet Center personnel for their action as appropriate.

The selected VACCHCS corrective strategies are summarized below to include an identifier for each group, the description of the corrective strategy, and an ROM estimate (if applicable). Unless otherwise noted, ROM estimates were provided for new projects and enhancements to existing SCIP projects. In the latter case, the ROM estimate represents the cost of the work to be added to the project scope. For additional detail on the corrective strategies, including a listing of deficiencies addressed and potential SCIP first year funding (for new projects) refer to the individual corrective strategy tabs following the summary pages.

Two New Projects For the purposes of this assessment, a “new project” is a project that does not currently exist in SCIP and is not already planned by the station. These were usually PSDM-specific projects; for example, projects related to electronic security systems (e.g. security cameras, duress/panic buttons, and access control technology).

These groups were named based on the following convention: “station number” – “location11” – N – #

11 Main stations designated by “VAMC”, off-site locations (owned and leased) designated by “OS” followed by an abbreviated site name.

39 I P a g e

Fresno VAMC RCC Project ID Description ROM

570-VAMC-N1

"Construct PSDM Compliant Incident Command Center (ICC) and Off- Campus Parking Structure to Ensure Continuity of Operations": This project will construct an off-site parking structure (providing an estimated 700 spaces), develop an Incident Command Center (ICC) within the parking structure, and will include a redesign of facility traffic patterns and the main entrance to incorporate vehicle screening by…