119. Exhibit_N_Houlton_ME_DBT_MSR_FSL.pdf

swinslow Text Box

EXHIBIT N

Project Name 27 Customs Loop, Houlton, ME 04730

PROJECT ID (TRIRIGA # VT0014)

Minimum Security Requirements Facility Security Level & Level of Protection Values

Facility Security Level (FSL) - 2

Prepared by:

Shawn Seitz

Date:

May 30, 2024

MSR Version 1.0 (10/2022)

THE ATTACHED MATERIALS CONTAIN DEPARTMENT OF HOMELAND SECURITY INFORMATION THAT IS "FOR OFFICIAL USE ONLY", OR OTHER TYPES OF SENSITIVE BUT UNCLASSIFIED INFORMATION REQUIRING

PROTECTION AGAINST UNAUTHORIZED DISCLOSURE. THE ATTACHED MATERIALS MUST BE HANDLED AND SAFEGUARDED IN ACCORDANCE WITH DHS MANAGEMENT DIRECTIVES GOVERNING PROTECTION

AND DISSEMINATION OF SUCH INFORMATION.

AT A MINIMUM, THE ATTACHED MATERIALS WILL BE DISSEMINATED ONLY ON A "NEED-TO-KNOW"

BASIS AND WHEN UNATTENDED, MUST BE STORED IN A LOCKED CONTAINER OR AREA OFFERING

SUFFICIENT PROTECTION AGAINST THEFT, COMPROMISE, INADVERTENT ACCESS, AND UNAUTHORIZED

DISCLOSURE.

2022 # 2021 # 2020 # Violent Crime Violent Crime Violent Crime Homicide 0 Homicide 0 Homicide Not reported Rape 0 Rape 3 Rape Not reported Robbery 0 Robbery 0 Robbery Not reported Aggravated Assault 4 Aggravated Assault 7 Aggravated Assault Not reported Kidnapping/Abduction 0 Kidnapping/Abduction 0 Kidnapping/Abduction Not reported

Property Crime Property Crime Property Crime Arson 0 Arson 0 Arson Not reported Burglary 8 Burglary 16 Burglary Not reported Larceny-Theft 109 Larceny-Theft 182 Larceny-Theft Not reported Motor Vehicle Theft 0 Motor Vehicle Theft 12 Motor Vehicle Theft Not reported Vandalism 33 Vandalism 54 Vandalism Not reported

Indivdual Offenses Indivdual Offenses Indivdual Offenses Drug/Narcotics 47 Drug/Narcotics 59 Drug/Narcotics Not reported Embezzelment 0 Embezzelment 0 Embezzelment Not reported Extortion/Blackmail 0 Extortion/Blackmail 0 Extortion/Blackmail Not reported Hacking/Computer Invasion 0 Hacking/Computer Invasion 0 Hacking/Computer Invasion Not reported Prostitution 0 Prostitution 0 Prostitution Not reported Simple Assault 36 Simple Assault 56 Simple Assault Not reported Stolen Property 0 Stolen Property 4 Stolen Property Not reported Theft from building 0 Theft from building 0 Theft from building Not reported Wire Fraud 0 Wire Fraud 0 Wire Fraud Not reported

Data collected from the FBIs Crime Data Explorer @ https://cde.ucr.cjis.gov/LATEST/webapp/#/pages/explorer/crime/crime-trend

Data collected for the entire city of Houlton Maine as reported by the Houlton Police Department for the following years:

FEMA Risk Assessment Template

DRAFT

FSL Calculator Factor 1 2 3 4 Score Risk Score Mission Criticality Low Medium High Very High 3 Symbolism Low Medium High Very High 2 Facility Population <100 101-250 251-750 >750 1 Facility Size <10K SF 10K-100K SF 100K-250K SF >250K SF 2 Threat to Tenant/Agencies Low Medium High Very High 2

Preliminary FSL Score (5-7 Points) (8-12 Points) (13-17 Points) (18-20 Points) 10 Preliminary FSL FSL 1 FSL 2 FSL 3 FSL 4 2 Intangible Adjustment (+/- 1)

Final FSL: 2

Risk Identification Calculator Risk = ƒ (Threat*Vulnerability*Consequence)

Event DBT Baseline Threat Vulnerability Consequence Risk Score Threat Justification Vulnerability Justification Ramming - Aircraft as a Weapon Minimum 1 3 2 6

, , p countermeasures to space there is a moderate

Arson Medium 3 3 2 18 , , p countermeasures to space there is a moderate Assault High 4 3 2 24

, , p countermeasures to space there is a moderate

Ballistic Attack – Active Shooter Medium 2 3 2 12 pp ;

history in the area , , p countermeasures to space there is a moderate Ballistic Attack – Small Arms High 2 3 2 12 pp ;

historyin the area

, , p countermeasures to space there is a moderate

Ballistic Attack – Standoff Weapons Minimum 1 3 2 6 , , p countermeasures to space there is a moderate Breach of Access Control Point - Covert Low 2 3 2 12

, , p countermeasures to space there is a moderate

Breach of Access Control Point - Overt High 4 3 2 24 , , p countermeasures to space there is a moderate

CBR Release – External Medium 2 3 2 12 No crime statistics found to support; No history

Due to location, limited access, and preventive countermeasures to space there is a moderate possibiltiy

CBR Release – Internal High 2 5 2 20 No crime statistics found to support; No history

Due to location, limited access, and preventive countermeasures to space there is a moderate possibiltiy

CBR Release – Mailed or Delivered Low 2 5 2 20 No crime statistics found to support; No history CBR Release – Water Supply Minimum 1 5 2 10

Civil Disturbance Very High 3 3 2 18 No crime statistics found to support; No known intentions in area

Due to location, limited access, and preventive countermeasures to space there is a moderate possibiltiy

Cyber Attack - Unauthorized Access Very High 5 5 2 50 Cyber Attack - Interruption of Service High 4 5 2 40 Cyber Attack - Modification of Services Low 2 5 2 20

Adversarial Use of Unmanned Aircraft Systems (UAS) High 2 3 2 12 No crime statistics found to support; No known history

Due to location, limited access, and preventive countermeasures to space there is a moderate possibiltiy

Explosive Device – Man Portable, External Medium 3 2 2 12 Due to location of office there is a low possibiltiy Explosive Device – Man Portable, Internal Medium 3 2 2 12 Due to location of office there is a low possibiltiy

Explosive Device – Suicide/Homicide Bomber Low 1 3 2 6

Due to location, limited access, and preventive countermeasures to space there is a moderate possibiltiy

Points

16Check if Child Care Center

FSL 1 FSL 2 FSL 3 FSL 4

Minimum 1-5 2-10 3-16 4-22

Low 6-10 11-20 17-31 23-41 Medium 11-15 21-31 32-46 42-62

High 16-20 32-41 47-61 63-81 Very High 21-25 42-50 62-75 82-100

Explosive Device – VBIED (Parked, Suicide) Low 1 3 2 6

Due to location, limited access, and preventive countermeasures to space there is a moderate possibiltiy

Explosive Device - Mailed or Delivered Low 1 3 2 6

Due to location, limited access, and preventive countermeasures to space there is a moderate possibiltiy

Hostile Surveillance Very High 2 3 2 12 No crime statistics found to support; No known history in area

Due to location, limited access, and preventive countermeasures to space there is a moderate possibiltiy

Insider Threat Medium 3 2 2 12 Due to limited personnel onsite there is a Low-moderate possibility

Kidnapping (Child, Low - Fed. emp., Medium) Low/Medium 2 3 2 12

Due to location, limited access, and preventive countermeasures to space there is a low- moderate possibiltiy

Release of on-site Hazardous Materials Minimum 1 2 2 4

Due to location, limited access, and preventive countermeasures to space there is a low- moderate possibiltiy

Robbery Low 3 2 2 12 Local crime statistics support higher robbery in area with intentions

Due to location, limited access, and preventive countermeasures to space there is a low- moderate possibiltiy

Theft Very High 3 3 2 18 No crime statistics found to support very high; No known intentions/targeting

Due to location, limited access, and preventive countermeasures to space there is a moderate possibiltiy

Unauthorized Entry – Overt/Forced High 4 3 2 24

Due to location, limited access, and preventive countermeasures to space there is a moderate possibiltiy

Unauthorized Entry – Surreptitious High 4 2 2 16

Due to location, limited access, and preventive countermeasures to space there is a low- moderate possibiltiy

Vandalism Very High 5 2 2 20 Due to location of office there is a low possibiltiy Ramming - Automobiles High 2 2 2 8 No crime statistics found to support; No history Due to location of office there is a low possibiltiy

Workplace Violence Medium 3 3 2 18 Due to limited personnel onsite there is a Low-moderate possibility

THREAT:

MINIMUM: A minimum rating generally implies there is EXISTENCE of a factor that indicates a “negligible” likelihood of a threat, weapon, or tactic being used against federal facilities. There may or may not also be a CAPABILITY LOW: A low rating generally means there are the EXISTENCE and CAPABILITY of a factor that indicates a “possible” likelihood of a threat, weapon, or tactic being used against federal facilities. There may or may not also be a HIST MEDIUM: A medium rating generally means there are the EXISTENCE, CAPABILITY, and HISTORY of a factor that indicates a “possible” likelihood of a threat, weapon, or tactic being used against federal facilities. There may or ma HIGH: A high rating generally means there are the EXISTENCE, CAPABILITY, HISTORY, and INTENTIONS of a factor that indicates the “expected” likelihood of a threat, weapon, or tactic being used against federal facilities. There m VERY HIGH: A very high rating generally means there are the EXISTENCE, CAPABILITY, HISTORY, INTENTIONS, and TARGETING of a factor that indicates the “imminent” likelihood of a threat, weapon, or tactic being used against f

VULNERABILITY:

VERY LOW: Based on the countermeasures present at the facility where the asset is located, there is a VERY LOW possibility of compromising or destroying the asset and escaping.

LOW: Based on the countermeasures present at the facility where the asset is located, there is a LOW possibility of compromising or destroying the asset and escaping.

MEDIUM: Based on the countermeasures present at the facility where the asset is located, there is a MODERATE possibility of compromising or destroying the asset and escaping.

HIGH: Based on the countermeasures present at the facility where the asset is located, there is a HIGH possibility of compromising or destroying the asset and escaping.

VERY HIGH: Based on the countermeasures present at the facility where the asset is located, there is a VERY HIGH possibility of compromising or destroying the asset and escaping.

FSL

Minimum 5 7 1 Low 8 12 2 Medium 13 17 3 High 18 20 4 Very High 5

Dropdown to allow differentiation < 100 Low (1 Po 1 of 751+ vs Child Care Center 101-250 Medium 2 Both cause population score 4 251-750 High (3 3

751+ Very High 4 CCC Very High 4

First 3 char test used for finding CCC FALSE FALSE 1 Final FSL but allows zero value!! 2

Prelim FSL Intangible Adjustment Options Not allow final FSL of zero: 1 0 0 1 Went with formula instead of lookup table. 2 -1 0 1

3 -1 0 1 4 -1 0 1

Ad ve rsa ria l U se of U nm an ne d A irc ra ft Sy ste ms

(U

AS

Ar so n

As sa ult

Ba llis tic A tta ck

A cti ve

S ho ote r

Ba llis tic A tta ck

S ma ll A rm s

Ba llis tic A tta ck

St an do ff W ea po ns

Br ea ch of

A cc es s C on tro l P oin t - C ov er t

Br ea ch of

A cc es s C on tro l P oin t - O ve rt

CB

R

Re lea se

Ex ter na l

CB

R

Re lea se

Int er na l

CB

R

Re lea se

Ma ile d o r D eli ve re d

CB

R

Re lea se

W ate r S up ply

Ci vil

D ist ur ba nc e

Cy be r A tta ck

Int er ru pti on of

S er vic e

Cy be r A tta ck

Mo dif ica tio n o f S er vic es

Cy be r A tta ck

Un au tho riz ed A cc es s

Ex plo siv e D ev ice

Ma n- Po rta ble

E xte rn al

Ex plo siv e D ev ice

Ma n- Po rta ble

In ter na l

Ex plo siv e D ev ice

Su ici de

/H om ici de

B om be r

Ex plo siv e D ev ice

Ve hic le

Bo rn e I

ED

Ex plo siv e D ev ice

Ma ile d o r D eli ve re d

Ho sti le Su rve illa nc e

Ins ide r T hr ea t

Ki dn ap pin g

Ra mm ing

Ai rcr aft as a W ea po n

Ra mm ing

Au tom ob ile

Re lea se of

O n-sit e H az ar do us

M ate ria ls

Ro bb er y

Th eft

Un au tho riz ed E ntr y –

F or ce d

Un au tho riz ed E ntr y –

S ur re pti tio us

Va nd ali sm

W or kp lac e V iol en ce

Undesirable Event Risk Score --> 12 18 24 12 12 6 12 24 12 20 20 10 18 40 20 50 12 12 6 6 6 12 12 12 6 8 4 12 18 24 16 20 18

Identification as Federal Facility 18 24 12 12 6 12 24 12 20 20 10 18 12 12 6 6 6 12 12 6 8 4 12 18 24 16 20 Landscaping 18 24 12 12 10 12 12 12 4 12 24 16 20 Pedestrian Access to Site 18 24 12 12 6 12 10 18 12 6 12 12 12 4 12 18 24 16 20 Vehicle Access Points 24 12 12 6 12 18 12 6 12 12 12 6 8 4 24 16 20 Site Lighting 18 24 12 12 10 12 12 12 12 4 12 18 24 16 20 Restricted Areas 18 12 10 12 6 12 12 4 24 16 Signage - Sensitive Areas 18 12 10 12 6 12 12 6 8 4 24 16 Control of Parking 6 12 12 18 20 Authorized Parking 6 12 Vehicle Access to Controlled Parking 6 12 6 8 Vehicle Barriers 6 12 6 8 Vehicle Screening 18 24 12 12 6 12 24 12 20 20 10 18 12 12 6 6 6 12 12 12 6 8 4 12 18 24 16 20 18 Pedestrian Access to Controlled Parking Areas 18 24 12 18 12 12 12 12 12 18 20 Hazardous Materials Storage 18 12 4 20 Receptacle and Container Placement 18 12 12 12 Blast Resistance - Windows 12 6 12 6 6 12 Blast Resistance - Façade and Structure 12 6 12 6 6 12 Blast Resistance - Progressive Collapse 12 6 12 12 6 6 12 Blast Resistance - Under-Building Parking 12 6 12 Burglary Resistance of Windows 18 12 12 18 24 16 20 Walls and nonwindow Openings 18 12 18 24 16 20 Windows in Critical Areas - Ballistic Protection 12 12 6 12 12 Protection of Air Intakes 12 12 20 Isolated Ventilation Systems 12 20 20 12 HVAC Control 18 12 20 20 12 CBR Detection Technology 12 20 20 12 Biological Filtration - General Building 12 20 20 12 Biological Filtration - Lobbies and Mailrooms 12 20 20 12 Chemical Filtration 12 20 20 12 Security of Ventilation Equipment and Controls 12 20 20 12 Location of Utilities and Feeders 12 18 12 12 6 6 6 12 6 8 20 Separation of Emergency and Normal Power Distribution 12 18 12 12 6 6 6 12 6 8 20 Emergency Generator Protection 12 18 12 12 6 6 12 6 8 20 Protection of Water Supply 10 12 20 Blast Resistance - Interior Public Spaces 12 6 12 Blast Resistance - Mail Screening and Receiving Location 6 12 Badge Identification (ID) System 18 24 12 12 20 12 12 12 12 4 18 16 Regulatory Signage 12 20 18 12 12 12 4 12 18 24 16 20 18 Employee Access Control 24 12 12 24 20 12 12 12 12 4 12 18 16 18 Visitor Access Control 18 24 12 12 24 20 20 18 12 6 6 12 12 12 4 12 18 16 20 Occupant Screening 18 24 12 12 6 12 24 12 20 20 10 18 12 12 6 6 12 12 12 6 8 4 12 18 24 16 20 18 Visitor Screening 18 24 12 12 6 12 24 12 20 20 10 18 12 12 6 6 12 12 12 6 8 4 12 18 24 16 20 18 Ballistic Protection at Screening Locations 24 12 12 24 12 12 6 6 12 12 Lobby Queuing 24 12 12 6 12 24 20 12 6 12 12 12 18 16 After Hours Access Control 18 12 12 24 20 20 18 12 6 12 12 12 4 18 16 20 Limit Building Entry Points 24 12 12 24 12 20 18 12 6 12 12 12 4 12 18 24 16 Entrance Co-location 24 12 12 24 20 6 6 12 12 12 18 Perimeter Doors & Door Locks 12 12 24 20 10 18 12 12 12 4 12 18 24 16 Control of Keys and Access Media 12 12 4 12 18 16 18

20Structure

Security

ISC Criteria Risk Management Summary

Highest Risk Score

ISC Criterion Type

Site Security 20

Facility Entrance Security

Employee Convenience Doors 12 12 24 20 18 12 6 12 12 12 4 12 18 24 16 20 Emergency Exit Doors 12 12 24 20 18 12 6 12 12 12 4 12 18 24 16 20 Delayed Egress 12 12 12 Space Planning 12 18 24 12 12 6 20 20 18 12 12 6 6 6 12 12 12 6 8 4 12 18 18 Access to nonpublic Areas 18 24 12 12 24 20 10 18 12 6 12 12 12 4 12 18 16 18 Security of Critical Areas 18 20 10 12 6 12 12 12 4 18 24 16 18 Building Systems and Roof Access 18 24 12 12 20 12 12 20 Publicly Accessible Restrooms 18 24 12 12 20 12 6 12 12 12 12 18 16 20 Publicly Accessible Retail and Mixed Use Space 18 24 12 12 20 12 6 12 12 12 12 18 16 20 Interior Windows 12 12 6 6 12 VSS Coverage 18 24 12 12 12 24 12 20 10 18 12 12 6 12 12 12 4 12 18 24 16 20 VSS Monitoring and Recording 18 24 12 12 12 24 12 20 10 18 12 12 6 12 12 12 4 12 18 24 16 20 Security Control Center 12 18 24 12 12 6 12 24 12 20 20 10 18 12 12 6 6 6 12 12 12 6 8 4 12 18 24 16 20 18 VSS Surveillance Advisory 18 24 12 12 12 24 12 20 10 18 12 12 12 12 12 4 12 18 24 16 20 Intrusion Detection System (IDS) Coverage 12 24 12 20 12 12 4 12 24 16 Intrusion Detection System (IDS) Monitoring 12 24 12 20 12 12 4 12 24 16 Duress Alarms or Assistance Stations 24 12 12 24 12 12 4 12 18 Security System Integrity 18 24 12 12 12 24 12 20 10 18 12 12 12 12 12 4 12 18 24 16 18 Security Communications 12 18 24 12 12 6 12 24 12 20 20 10 18 12 12 6 6 6 12 12 12 6 8 4 12 18 24 16 20 18 Building Communication System 12 18 24 12 12 6 12 24 12 20 20 10 18 12 12 6 6 6 12 12 6 8 4 12 18 Emergency Power for Security Systems 18 24 12 12 12 24 12 20 10 18 12 12 6 12 12 12 4 12 18 24 16 18 Security System Testing 18 24 12 12 12 24 12 20 10 18 12 12 12 12 12 4 12 18 24 16 18 Security System Maintenance 18 24 12 12 12 24 12 20 10 18 12 12 12 12 12 4 12 18 24 16 18 Facility Security Committee (FSC) 18 12 12 6 12 24 12 20 20 10 18 12 12 6 6 6 12 12 12 6 8 4 12 18 Facility Security Committee Chairperson 18 24 12 12 6 12 24 12 20 20 10 18 12 12 6 6 6 12 12 12 6 8 4 12 18 24 16 20 18 Security Operations Management 18 24 12 12 6 12 24 12 20 20 10 18 12 12 6 6 6 12 12 12 6 8 4 12 18 24 16 20 18 Security Force Fixed Post - Exterior 18 24 12 12 12 24 12 20 10 18 12 12 6 12 12 12 12 18 24 16 20 Security Force Fixed Posts - Screening Checkpoints 24 12 24 18 12 6 12 12 12 18 Security Force Patrols 18 24 12 12 6 12 24 12 20 10 18 12 12 6 6 6 12 12 12 6 8 4 12 18 24 16 20 18 Security Force Response 18 24 12 12 6 12 24 12 20 20 10 18 12 12 6 6 6 12 12 12 6 8 4 12 18 24 16 20 18 Facility Security Plan (FSP) 18 24 12 12 6 12 24 12 20 20 10 18 12 12 6 6 6 12 12 12 6 8 4 12 24 16 18 Occupant Emergency Plan (OEP) 18 24 12 12 6 12 24 12 20 20 10 18 12 12 6 6 6 12 12 6 8 4 12 18 Availability of Emergency Plans and Documents 18 24 12 12 6 12 24 12 20 20 10 18 12 12 6 6 6 12 12 12 6 8 4 12 Protection of Construction Information 12 6 12 24 12 20 10 12 12 6 6 12 12 4 24 16 Security During Construction and Renovation 18 24 12 20 10 12 6 12 12 4 18 24 16 20 Mail/Package Handling and Other Deliveries 20 6 12 Security Awareness Training 18 24 12 12 6 12 24 12 20 20 10 18 12 12 6 6 6 12 12 12 4 12 18 24 16 20 18 Identify and Define BACS Devices and Networks 40 20 50 Segment BACS from Business Network(s) 40 20 50 Establish and Maintain BACS Configuration Management 40 20 50 Maintain BACS Infrastructure 40 20 50 Ensure the Integrity and Availability of BACS Operational Data 40 20 50 Identify and Manage All Access Points for Network Communications 12 40 20 50 Establish Processes for Incident Response for BACS 40 20 50

Cyber Security

Interior Security

“WARNING: This document contains Sensitive Security Information that is controlled under 49 CFR 1520. No part of this document may be released to persons without a need to know, as defined in 49 CFR 1520, except with the written permission of the Administrator, Washington, DC. Unauthorized release may result in civil penalty or other action. For U.S. Government agencies, public release is governed by 5 U.S.C. 552.”

Security Ops & Admin

Security Systems

Identification as Federal Facility 2 Landscaping 2 Pedestrian Access to Site 2 Vehicle Access Points 2 Site Lighting 2 Restricted Areas 2 Signage - Sensitive Areas 2 Control of Parking 2 Authorized Parking 1 Vehicle Access to Controlled Parking 1 Vehicle Barriers 1 Vehicle Screening 2 Pedestrian Access to Controlled Parking Areas 2 Hazardous Materials Storage 2 Receptacle and Container Placement 2 Blast Resistance - Windows 1 Blast Resistance - Façade and Structure 1 Blast Resistance - Progressive Collapse 1 Blast Resistance - Under-Building Parking 1 Burglary Resistance of Windows 2 Walls and nonwindow Openings 2 Windows in Critical Areas - Ballistic Protection 1 Protection of Air Intakes 2 Isolated Ventilation Systems 2 HVAC Control 2 CBR Detection Technology 2 Biological Filtration - General Building 2 Biological Filtration - Lobbies and Mailrooms 2 Chemical Filtration 2 Security of Ventilation Equipment and Controls 2 Location of Utilities and Feeders 2 Separation of Emergency and Normal Power Distribution 2 Emergency Generator Protection 2 Protection of Water Supply 2 Blast Resistance - Interior Public Spaces 1 Blast Resistance - Mail Screening and Receiving Location 1 Badge Identification (ID) System 2 Regulatory Signage 2 Employee Access Control 2 Visitor Access Control 2 Occupant Screening 2 Visitor Screening 2 Ballistic Protection at Screening Locations 2 Lobby Queuing 2 After Hours Access Control 2 Limit Building Entry Points 2 Entrance Co-location 2 Perimeter Doors & Door Locks 2 Control of Keys and Access Media 2 Employee Convenience Doors 2 Emergency Exit Doors 2 Delayed Egress 1 Space Planning 2 Access to nonpublic Areas 2 Security of Critical Areas 2 Building Systems and Roof Access 2 Publicly Accessible Restrooms 2

Risk Calculated LOP

Highest Risk Score

Structure Security

Facility Entrance Security

Interior Security

Site Security

ISC Criteria Risk Management Summary

Risk Calculated LOPHighest Risk Score

ISC Criteria Risk Management Summary

Publicly Accessible Retail and Mixed Use Space 2 Interior Windows 1 VSS Coverage 2 VSS Monitoring and Recording 2 Security Control Center 2 VSS Surveillance Advisory 2 Intrusion Detection System (IDS) Coverage 2 Intrusion Detection System (IDS) Monitoring 2 Duress Alarms or Assistance Stations 2 Security System Integrity 2 Security Communications 2 Building Communication System 2 Emergency Power for Security Systems 2 Security System Testing 2 Security System Maintenance 2 Facility Security Committee (FSC) 2 Facility Security Committee Chairperson 2 Security Operations Management 2 Security Force Fixed Post - Exterior 2 Security Force Fixed Posts - Screening Checkpoints 2 Security Force Patrols 2 Security Force Response 2 Facility Security Plan (FSP) 2 Occupant Emergency Plan (OEP) 2 Availability of Emergency Plans and Documents 2 Protection of Construction Information 2 Security During Construction and Renovation 2 Mail/Package Handling and Other Deliveries 2 Security Awareness Training 2 Identify and Define BACS Devices and Networks 3 Segment BACS from Business Network(s) 3 Establish and Maintain BACS Configuration Management 3 Maintain BACS Infrastructure 3 Ensure the Integrity and Availability of BACS Operational Data 3 Identify and Manage All Access Points for Network Communications 3 Establish Processes for Incident Response for BACS 3

Cyber Security

Security Ops &

Admin

Security Systems

“WARNING: This document contains Sensitive Security Information that is controlled under 49 CFR 1520. No part of this document may be released to persons without a need to know, as defined in 49 CFR 1520, except with the written permission of the Administrator, Washington, DC. Unauthorized release may result in civil penalty or other action. For U.S. Government agencies, public release is governed by 5 U.S.C. 552.”

ISC Criterion Type Row

ID

Security Criterion Level I - Minimum Level II - Low Level III - Medium Level IV - High Level V - Very High

Site Security 1 Identification as Federal Facility No special measures required. Signage identifying a facility as a Federal facility should only be posted when necessary to achieve the mission of the tenants, or when the facility is readily identified or well-known as a government facility based on the nature of public contact or other operations.

Signage identifying a facility as a Federal facility should only be posted when necessary to achieve the mission of the tenants, or when the facility is readily identified or well-known as a government facility based on the nature of public contact or other operations.

Signage identifying a facility as a Federal facility should only be posted when necessary to achieve the mission of the tenants, or when the facility is readily identified or well-known as a government facility based on the nature of public contact or other operations.

Signage identifying a facility as a Federal facility should only be posted when necessary to achieve the mission of the tenants, or when the facility is readily identified or well-known as a government facility based on the nature of public contact or other operations.

Site Security 2 Landscaping Minimize areas of concealment in and around facilities.

Minimize areas of concealment in and around facilities. Establish a clear zone around barriers or fences, and restrict landscaping from obstructing views of the security force and VSS cameras, or interfering with lighting or IDS.

Minimize areas of concealment in and around facilities. Establish a clear zone around barriers or fences, and restrict landscaping from obstructing views of the security force and VSS cameras, or interfering with lighting or IDS.

Minimize areas of concealment in and around facilities. Establish a clear zone around barriers or fences, and restrict landscaping from obstructing views of the security force and VSS cameras, or interfering with lighting or IDS.

Minimize areas of concealment in and around facilities. Establish a clear zone around barriers or fences, and restrict landscaping from obstructing views of the security force and VSS cameras, or interfering with lighting or IDS.

CBP Supplemental Landscaping Establish clear zone no less than 20 ft.

from any structure or object inside the perimeter fence and 10 ft. from any structure or object outside of the fence.

Establish clear zone no less than 20 ft.

from any structure or object inside the perimeter fence and 10 ft. from any structure or object outside of the fence.

Establish clear zone no less than 20 ft.

from any structure or object inside the perimeter fence and 10 ft. from any structure or object outside of the fence.

Establish clear zone no less than 20 ft.

from any structure or object inside the perimeter fence and 10 ft. from any structure or object outside of the fence.

Establish clear zone no less than 20 ft.

from any structure or object inside the perimeter fence and 10 ft. from any structure or object outside of the fence.

Site Security 3 Pedestrian Access to Site No special measures required. No special measures required. In a campus environment, install fence, landscaping, or other barriers to channel pedestrians to authorized areas or entrances.

In a campus environment, install fence, landscaping, or other barriers to channel pedestrians to authorized areas or entrances.

Install fence, landscaping, or other barriers to channel pedestrians to authorized areas or entrances.

CBP Supplemental Pedestrian Access to Site If the site requires or currently has perimeter fencing, it must comply with OPR Physical Security Handbook construction standards.

If the site requires or currently has perimeter fencing, it must comply with OPR Physical Security Handbook construction standards.

If the site requires or currently has perimeter fencing, it must comply with OPR Physical Security Handbook construction standards.

If the site requires or currently has perimeter fencing, it must comply with OPR Physical Security Handbook construction standards.

If the site requires or currently has perimeter fencing, it must comply with OPR Physical Security Handbook construction standards.

CBP Supplemental Pedestrian Access to Site Protect against unauthorized entry all man-passable openings for culverts, storm drains, sewers, air intakes, exhaust tunnels, and utility openings that pass through cleared areas or traverse under or through security fences.

Protect against unauthorized entry all man-passable openings for culverts, storm drains, sewers, air intakes, exhaust tunnels, and utility openings that pass through cleared areas or traverse under or through security fences.

Protect against unauthorized entry all man-passable openings for culverts, storm drains, sewers, air intakes, exhaust tunnels, and utility openings that pass through cleared areas or traverse under or through security fences.

Protect against unauthorized entry all man-passable openings for culverts, storm drains, sewers, air intakes, exhaust tunnels, and utility openings that pass through cleared areas or traverse under or through security fences.

Protect against unauthorized entry all man-passable openings for culverts, storm drains, sewers, air intakes, exhaust tunnels, and utility openings that pass through cleared areas or traverse under or through security fences.

Site Security 4 Vehicle Access Points No special measures required. No special measures required. Limit the number of vehicle access points. Provide VSS coverage.

Limit the number of vehicle access points. Provide VSS coverage.

Limit the number of vehicle access points. Provide VSS coverage.

CBP Supplemental Vehicle Access Points Position gate power operators so they cannot be reached or tampered with from outside the perimeter fence.

Position gate power operators so they cannot be reached or tampered with from outside the perimeter fence.

Position gate power operators so they cannot be reached or tampered with from outside the perimeter fence.

Position gate power operators so they cannot be reached or tampered with from outside the perimeter fence.

Position gate power operators so they cannot be reached or tampered with from outside the perimeter fence.

CBP Supplemental Vehicle Access Points Gate power operators incorporate power failure features, to include manual disconnect or manual operation features.

Gate power operators incorporate power failure features, to include manual disconnect or manual operation features.

Gate power operators incorporate power failure features, to include manual disconnect or manual operation features.

Gate power operators incorporate power failure features, to include manual disconnect or manual operation features.

Gate power operators incorporate power failure features, to include manual disconnect or manual operation features.

CBP Supplemental Vehicle Access Points When gate is closed, it provides a barrier structurally comparable to their associated barriers. Care is afforded against the ability to crawl under gates.

When gate is closed, it provides a barrier structurally comparable to their associated barriers. Care is afforded against the ability to crawl under gates.

When gate is closed, it provides a barrier structurally comparable to their associated barriers. Care is afforded against the ability to crawl under gates.

When gate is closed, it provides a barrier structurally comparable to their associated barriers. Care is afforded against the ability to crawl under gates.

When gate is closed, it provides a barrier structurally comparable to their associated barriers. Care is afforded against the ability to crawl under gates.

Site Security 5 Site Lighting Install exterior lighting at entrances and exits.

Install exterior lighting at entrances, exits, parking lots, garages, and VSS locations.

Install exterior lighting at entrances, exits, parking lots, garages, VSS locations, and walkways from parking areas to entrances.

Install exterior lighting at entrances, exits, parking lots, garages, VSS locations, and walkways from parking areas to entrances.

Install exterior lighting at entrances, exits, parking lots, garages, VSS locations, walkways from parking areas to entrances, and around building perimeter areas. For facilities where UAS are a significant threat, additional site lighting may be required.

Security Criterion Level I - Minimum Level II - Low Level III - Medium Level IV - High Level V - Very High

CBP Supplemental Site Lighting When equipped with VSS, security lighting system provides adequate and uniform vertical illuminance to facilitate proper utilization of VSS cameras.

When equipped with VSS, security lighting system provides adequate and uniform vertical illuminance to facilitate proper utilization of VSS cameras.

When equipped with VSS, security lighting system provides adequate and uniform vertical illuminance to facilitate proper utilization of VSS cameras.

When equipped with VSS, security lighting system provides adequate and uniform vertical illuminance to facilitate proper utilization of VSS cameras.

When equipped with VSS, security lighting system provides adequate and uniform vertical illuminance to facilitate proper utilization of VSS cameras.

CBP Supplemental Site Lighting Protective lighting located where it illuminates shadowed areas and is it directed at probable routes of intrusion.

Protective lighting located where it illuminates shadowed areas and is it directed at probable routes of intrusion.

Protective lighting located where it illuminates shadowed areas and is it directed at probable routes of intrusion.

Protective lighting located where it illuminates shadowed areas and is it directed at probable routes of intrusion.

Protective lighting located where it illuminates shadowed areas and is it directed at probable routes of intrusion.

CBP Supplemental Site Lighting The lighting system is maintained and operative. Light distribution is not obstructed by the foliage of trees, shrubs, or other vegetation as it matures or as seasons change.

The lighting system is maintained and operative. Light distribution is not obstructed by the foliage of trees, shrubs, or other vegetation as it matures or as seasons change.

The lighting system is maintained and operative. Light distribution is not obstructed by the foliage of trees, shrubs, or other vegetation as it matures or as seasons change.

The lighting system is maintained and operative. Light distribution is not obstructed by the foliage of trees, shrubs, or other vegetation as it matures or as seasons change.

The lighting system is maintained and operative. Light distribution is not obstructed by the foliage of trees, shrubs, or other vegetation as it matures or as seasons change.

Site Security 6 Restricted Areas or Significant Areas and Assets

No special measures required. Use trees, hedges, berms, or any combination of these elements to create buffer zones to separate public areas and other functions.

Provide fences, walls, gates or other barriers to prevent unauthorized access to restricted areas.

Provide fences, walls, gates or other barriers to prevent unauthorized access to restricted areas.

Provide fences, walls, gates, or other barriers to prevent unauthorized access and observation to restricted areas, and monitor with VSS or security force patrols. Use High Security Locks, access control and Intrusion Detection systems.

Site Security 7 Signage - Sensitive Areas No special measures required. Prohibit signs that identify sensitive areas, unless required by other standards/codes.

Prohibit signs that identify sensitive areas, unless required by other standards/codes.

Prohibit signs that identify sensitive areas, unless required by other standards/codes.

Prohibit signs that identify sensitive areas, unless required by other standards/codes.

Site Security 8 Control of Parking No special measures required. No special measures required. Restrict access to underground/in-building parking and onsite surface or structured parking to authorized vehicles and personnel.

Restrict access to underground/in-building parking and onsite surface or structured parking to authorized vehicles and personnel.

Restrict vehicle access to the area required to meet the setback from the DBT; restrict parking to authorized vehicles and personnel.

Site Security 9 Authorized Parking No special measures required. No special measures required. Limit parking to employee vehicles, authorized visitor vehicles, approved government vehicles, and other authorized parkers.

Limit parking to employee vehicles, screened visitor vehicles, and approved government vehicles.

Limit parking to employee vehicles, screened visitor vehicles, and approved government vehicles.

Site Security 10 Vehicle Access to Controlled Parking No special measures required. Designate employee and visitor parking areas.

Use vehicle gates to limit access of vehicles to authorized vehicles only.

Provide vehicle barriers to protect parking entrances from penetration by a vehicle meeting the DBT.

Provide vehicle barriers to protect parking entrances from penetration by a vehicle meeting the DBT. Vehicle entrances shall be staffed by a security force who has the ability to raise the barriers quickly in an emergency, or utilize a dual-barrier vehicle trap system to prevent piggybacking.

Site Security 11 Vehicle Barriers No special measures required. No special measures required. Provide vehicle barriers to protect pedestrian entrances from penetration by a vehicle meeting the DBT.

Provide vehicle barriers to protect pedestrian and vehicle access points, and critical areas/utilities from penetration by a vehicle meeting the

DBT.

Provide vehicle barriers around the entire facility at the established setback distance from penetration by a vehicle meeting the DBT.

Site Security 12 Vehicle Screening No special measures required. No special measures required. Screen visitor vehicles before entry into the controlled parking area. Establish a list of prohibited items, including potential weapons. Refer to ISC- Items Prohibited from Federal Facilities- An ISC Standard.

Screen visitor vehicles before entry into the controlled parking area. Randomly screen employee and contractor vehicles during heightened security alerts. Establish a list of prohibited items, including potential weapons.

Refer to ISC- Items Prohibited from Federal Facilities- An ISC Standard.

Screen visitor vehicles before entry into the controlled parking area. Randomly screen employee and contractor vehicles during heightened security alerts. Establish a list of prohibited items, including potential weapons.

Refer to ISC- Items Prohibited from Federal Facilities- An ISC Standard.

Security Criterion Level I - Minimum Level II - Low Level III - Medium Level IV - High Level V - Very High

Site Security 13 Pedestrian Access to Controlled Parking Areas

No special measures required. Minimize areas of concealment in and around parking areas.

Monitor pedestrian access to parking areas utilizing security force and/or

VSS.

Monitor pedestrian access to parking areas utilizing security force and/or VSS. Provide barriers to restrict pedestrian access into parking areas to authorized entry points.

Monitor pedestrian access to parking areas utilizing security force and or VSS. Provide barriers to restrict pedestrian access into parking areas to authorized entry points. Limit pedestrian access to controlled parking areas to authorized personnel only.

Site Security 14 Hazardous Materials (HAZMAT) Storage

No special measures required. Locate HAZMAT storage in a restricted area away from loading docks, entrances, and uncontrolled parking.

Locate HAZMAT storage in a restricted area away from loading docks, entrances, and uncontrolled parking.

Monitor storage area using IDS and/or VSS. Control access to areas.

Locate HAZMAT storage in a restricted area away from loading docks, entrances, and uncontrolled parking.

Monitor storage area utilizing security force, IDS and/or VSS. Control access to areas.

Locate HAZMAT storage in a restricted area away from loading docks, entrances, and uncontrolled parking.

Monitor storage area utilizing security force, IDS and/or VSS. Control access to areas.

Site Security 15 Receptacle and Container Placement No special measures required. Position trash containers, mailboxes, vending machines, or other fixtures and features that could conceal devices away from building entrances.

Position trash containers, mailboxes, donation/recycle containers, vending machines, etc., away from building exterior and entry points, or implement blast containment measures to mitigate an explosion.

Position trash containers, mailboxes, donation/recycle containers, vending machines, etc., away from building exterior and entry points, or implement blast containment measures to mitigate an explosion.

Position trash containers, mailboxes, donation/recycle containers, vending machines, etc., away from building exterior and entry points, or implement blast containment measures to mitigate an explosion.

Structure Security 16 Blast Resistance - Windows No special measures required. No special measures required. Utilize acceptable fragment retention film, or preferred glazing systems to reduce the glass fragmentation hazard.

Use a combination of protected setback and window glazing or treatments to achieve a Low Hazard Rating in accordance with ASTM F2912- 17 (Standard Specification for Glazing and Glazing Systems Subject to Air blast Loadings) in response to the DBT.

Use a combination of protected setback and window glazing or treatments to achieve Minimal Hazard Rating in accordance with ASTM F2912- 17 (Standard Specification for Glazing and Glazing Systems Subject to Air blast Loadings) in response to the DBT.

Structure Security 17 Blast Resistance - Façade and Structure

No special measures required. Use construction materials which have inherent ductility, and which are better able to respond to load reversals.

Use construction materials which have inherent ductility, and which are better able to respond to load reversals.

Provide a balanced design approach to ensure a ductile mode of failure is achieved or design for the DBT whichever is less severe. Provide a Level of Protection I in accordance with American Society of Civil Engineers

(ASCE) 59.

Use a combination of setback, site planning, façade hardening, and structural measures to provide a Level of Protection II in accordance with

ASCE 59.

Use a combination of setback, site planning, façade hardening, and structural measures to provide a Level of Protection III in accordance with

ASCE 59.

Structure Security 18 Blast Resistance - Progressive Collapse

No special measures required. Use construction materials for structural framing system which have inherent ductility, and which are better able to respond to load reversals (e.g., cast in place reinforced concrete and steel construction).

For buildings four stories and higher, use a combination of setback, site planning, façade hardening, and structural measures to prevent progressive collapse from the DBT or the loss of any single exterior column or load-bearing wall, whichever scenario is less severe.

For buildings, four stories or higher, use a combination of setback, site planning, façade hardening, and structural measures to prevent progressive collapse from the DBT or the loss of any single exterior column or load-bearing wall, whichever scenario is less severe.

Interior columns shall also be considered in buildings with an uncontrolled lobby.

For all buildings use a combination of setback, site planning, façade hardening, and structural measures to prevent progressive collapse from the DBT or the loss of any single column, whichever scenario is more severe.

Structure Security 19 Blast Resistance - Under-Building Parking

No special measures required. Use construction materials which have inherent ductility and which are better able to respond to load reversals (e.g., cast in place reinforced concrete column construction).

Implement architectural or structural features, or other positive countermeasures (e.g., vehicle screening), that deny contact with exposed primary vertical load members in these areas. A minimum standoff of at least 150 mm (six inches) from these members is required.

Utilize hardening and venting methods to limit air blast injuries in occupied areas from the DBT in a parking area.

Significant structural damage to the walls, ceilings, and floors of the parking area may occur. However, the occupied areas above should not experience severe damage or collapse.

Design all columns in the garage area for an unbraced length equal to two floors, or three floors where there are two levels of parking.

Security Criterion Level I - Minimum Level II - Low Level III - Medium Level IV - High Level V - Very High

Structure Security 20 Burglary Resistance of Windows Lock all operable ground floor windows.

Lock and monitor via IDS all operable ground floor windows.

No operable windows on ground floor level. Monitor via IDS.

No operable windows within 16 feet of the ground or other access point.

Monitor via IDS.

Design exterior windows in publicly accessible locations to resist forced entry. Monitor via IDS.

Structure Security 21 Walls and Non-Window Openings Protect non-window openings such as mechanical vents and exposed plenums to resist forcible entry.

Protect non-window openings such as mechanical vents and exposed plenums to resist forcible entry.

Protect non-window openings such as mechanical vents and exposed plenums to resist forcible entry.

Protect non-window openings such as mechanical vents and exposed plenums to resist forcible entry.

Protect walls and non-window openings in publicly accessible areas such as mechanical vents and exposed plenums to resist forcible entry.

Structure Security CBP Supplemental Walls and Non-Window Openings If building entryway is not forced entry resistant, they open into a hardened lobby or waiting area.

If building entryway is not forced entry resistant, they open into a hardened lobby or waiting area.

If building entryway is not forced entry resistant, they open into a hardened lobby or waiting area.

If building entryway is not forced entry resistant, they open into a hardened lobby or waiting area.

If building entryway is not forced entry resistant, they open into a hardened lobby or waiting area.

Structure Security 22 Windows in Critical Areas - Ballistic Protection

No special measures required. No special measures required. Provide blinds, curtains, or other window treatments in critical areas that can be used to prevent visual observation into critical areas when temporary conditions warrant.

Prevent visual observation from the exterior into critical exterior offices.

Provide ballistic windows for critical exterior offices.

Structure Security CBP Supplemental Windows in Critical Areas - Ballistic Protection

If ballistic resistant windows are required, surrounding wall system is able to resist the same level of threat.

If ballistic resistant windows are required, surrounding wall system is able to resist the same level of threat.

If ballistic resistant windows are required, surrounding wall system is able to resist the same level of threat.

If ballistic resistant windows are required, surrounding wall system is able to resist the same level of threat.

If ballistic resistant windows are required, surrounding wall system is able to resist the same level of threat.

Structure Security 23 Protection of Air Intakes Provide emergency shutdown, shelter-in-place (SIP), and evacuation procedures.

Provide emergency shutdown, SIP, and evacuation procedures, and secure accessible air intake grilles from tampering or removal.

Provide emergency shutdown, SIP, and evacuation procedures, and protect accessible air intakes with fencing.

Monitor with VSS monitoring or security force patrols.

Provide emergency shutdown, SIP, and evacuation procedures, and place air intakes on rooftop or on wall at least 30 feet or three stories above grade.

Provide emergency shutdown, SIP, and evacuation procedures, and place air intakes on rooftop or on wall at least 30 feet or three stories above grade.

Structure Security 24 Isolated Ventilation Systems No special measures required. No special measures required. Provide separate isolated HVAC systems in lobbies, loading docks, mailrooms and other locations susceptible to CBR attack that are isolated from other building areas.

Provide separate isolated HVAC systems in lobbies, loading docks, mailrooms and other locations susceptible to CBR attack that are isolated from other building areas.

Ensure that the envelope of the isolated loading docks and mailrooms are full-height construction and are sealed to the floor, roof or ceiling above.

Provide separate isolated HVAC systems in lobbies, loading docks, mailrooms and other locations susceptible to CBR attack that are isolated from other building areas.

Ensure that the envelope of the isolated loading docks and mailrooms are full-height construction and are sealed to the floor, roof or ceiling above. Provide instrumentation to monitor pressure relationship established by the isolated systems.

Structure Security 25 HVAC Control Develop written procedures for the emergency shut-down or exhaust of air handling systems.

Develop written procedures for the emergency shut-down or exhaust of air handling systems.

Install an emergency shut-off and exhaust system for air handlers.

Control movement of elevators and close applicable doors and dampers to seal building.

Install a one-step shut-off and exhaust system for air handlers. Control movement of elevators, and close applicable doors and dampers to seal building. Provide an emergency response module to the buildings energy- management system to switch the system to a prescribed emergency response mode.

Provide two or more redundant locations for one-step shut-off or exhaust system for air handlers.

Control movement of elevators and close applicable doors and dampers to seal building. Provide an emergency response module to the buildings energy-management system to switch the system to a prescribed emergency response mode.

Structure Security 26 CBR Detection Technology No special measures required. No special measures required. No special measures required. No special measures required. Install CBR detection technology to protect critical areas against a known credible threat.

Structure Security 27 Biological Filtration - General Building No special measures required. No special measures required. Use a Minimum Efficiency Reporting Value (MERV) 10 particulate filter on all exterior air handling units (AHUs).

Use a MERV 13 particulate filter on all AHUs, including the supply air stream for recirculating AHUs.

Use a high efficiency particulate air (HEPA) filter or functional equivalent on AHUs serving critical areas.

Structure Security 28 Biological Filtration - Lobbies and Mailrooms

No special measures required. No special measures required. Use a MERV 13 particulate filter on all AHUs in mailrooms and lobbies.

Use a MERV 13 particulate filter on all AHUs, including the supply air stream for recirculating AHUs in mailrooms and lobbies.

Use a HEPA filter or functional equivalent on AHUs serving mailrooms and lobbies, including outside units and in the supply air stream of recirculating AHUs.

Security Criterion Level I - Minimum Level II - Low Level III - Medium Level IV - High Level V - Very High

Structure Security 29 Chemical Filtration No special measures required. No special measures required. No special measures required. No special measures required. Provide gas adsorption filters on recirculated air as well as on outside air intakes which serve critical areas.

Structure Security 30 Security of Ventilation Equipment and Controls

Protect the system controls from unauthorized access.

Protect the system controls from unauthorized access.

Protect the system…