5200_dtd_25Sep2025_USCG_PACS_Operational_Requirements_Document_CRE_signed.pdf

Commandant United States Coast Guard

2703 Martin Luther King Jr Ave SE Washington, DC 20593-7324 Staff Symbol: SPM-1 Phone: (202) 372-3712

25 Sep 2025

MEMORANDUM

From:

To:

Thru:

Matthew T. Barido, GS-15

CG-SPM-1

Amy B. Grable, RDML Acting CRE

CG-SC

Reply to Attn of:

CG-761

LT Jeffrey Poe

Subj: U.S. COAST GUARD (USCG) PHYSICAL ACCESS CONTROL SYSTEMS (PACS)

OPERATIONAL REQUIREMENTS DOCUMENT (ORD)

Ref: (a) USCG PACS Mission Needs Statement (MNS) Endorsement Memo of 03 Jun 2025

(b) Physical Access Control, COMDTINST 5532.1

(c) Coast Guard Required Operational Capabilities (ROC) and Projected Operational

Environment (POE) Manual, COMDTINST M3501.26B

1. Executive Summary.

a. The lack of a robust enterprise Physical Access Control System (PACS) highlights a critical operational gap, hindering the USCG’s ability to effectively support its eleven statutory missions. This document outlines the operational requirements necessary to rapidly identify individuals seeking access to installations, assess their fitness and purpose for access, and integrate with interagency databases for comprehensive vetting.

A modern enterprise PACS will ensure that the USCG can address escalating threats, reliably control access to its installations, and maintain operational integrity across its area of responsibility.

b. This memo is part of a Consolidated Requirements Document (CRD) effort for the PACS materiel solution. It describes a solution to address the gaps described in reference (a) and is in accordance with references (b) and (c).

2. Operational Context.

a. Assumptions and Constraints. The operational assumptions and constraints related to current organizational priorities, regulations, inter-agency agreements and limitations, and existing infrastructure are outlined in reference (a). Additional assumptions and constraints include:

(1) Assumptions.

Subj: PHYSICAL ACCESS CONTROL SYSTEMS (PACS)

OPERATIONAL REQUIREMENTS DOCUMENT (ORD)

25 Sep 2025

(a) Cloud and data structure will be in place, but some capability/capacity may need to be on-premises to meet availability and reliability requirements.

(b) No environmental issues will be encountered during construction and implementation.

(2) Constraints.

(a) Access to Defense Enrollment Eligibility Reporting System (DEERS) may be subject to Department of Defense (DoD) restrictions.

(b) Connections to other Department of Homeland Security (DHS) personnel data may be subject to additional data security and privacy restrictions different from DoD.

(c) Background information may be constrained to Identity Matching Engine for Security and Analysis (IMESA) access to existing law enforcement (LE) databases.

b. Operational Environment. PACS must operate persistently (24x7) at USCG installations worldwide. PACS must maintain functionality and accessibility in a variety of operational and environmental conditions experienced at USCG facilities including extreme temperatures, high humidity, saltwater exposure, and heavy weather in both a fully-connected state and during limited connectivity situations. Meteorological conditions (e.g. tornados, hurricanes) could result in large-area utility outages and facility damage that impact PACS. While experiencing degraded connectivity conditions, PACS must remain accessible and able to perform validation functions.

c. Use Cases. Normally, personnel approaching a USCG installation Access Control Point (ACP) will present a valid photo identification (ID) or a credential, typically a Common Access Card (CAC) or Personal Identity Verification card (PIV). The sentry will visually inspect the credential for evidence of tampering and confirm that the photo matches the member. The sentry scans the credential, which provides the sentry with a digital photograph associated with the credential, debarment status, criminal history status, credential currency status, and access requirements. PACS will log the transaction, issue automated notifications required by policy and procedures, and record the information in the enterprise-level cloud.1

(1) Authorization for Unescorted Access (Normal Access Control Procedures). An active-duty USCG member approaches an ACP and presents a CAC. The sentry (via PACS utilization) confirms that there are no debarments for this member, no criminal history, the CAC is current, and unescorted access is authorized. The sentry returns the CAC to the member and permits passage.

(2) CAC Expiry Approaching. A USCG Reservist approaches an ACP and presents a CAC. The sentry notes PACS identifies the CAC will expire within 60 days, returns the CAC to the member, informs the member of the approaching expiration date, and

1 Retention requirements for these logs, and others referenced later in the document, will be defined in the subsequent, more detailed, functional requirements documents, consistent with federal record retention requirements.

permits passage. PACS notifies the unit Command Security Officer (CSO) of the member’s upcoming CAC expiry.

(3) Credential Does Not Match Bearer. An active-duty USCG member approaches an ACP and presents a CAC. The sentry notices that the digital photograph of the CAC in PACS does not match the physical CAC. The sentry retains the CAC, denies passage, follows unit security procedures, and reports the incident to the command, which ensures the denial of entry and reason are recorded in PACS.

(4) Approved Visitor (Purpose and Sponsorship Provided by Escort). A DoD contractor and an active-duty USCG member approach an ACP and present their CACs. The USCG member notifies the sentry that he is the DoD contractor’s escort. The active-duty member is authorized unescorted access, and the DoD contractor requires escorted access. On the display resulting from scanning the contractor’s CAC, the sentry selects the escorted access option, assigns the USCG member, and confirms authorization of escorted access.

(5) Multi-factor Authentication Required. An active-duty USCG member approaches an ACP of a Facility Security Level (FSL) IV facility and presents a CAC. However, because multi-factor authentication (MFA) is required for access, the member additionally provides their Personal Identification Number (PIN) or biometric data to authenticate their identity and affiliation before being authorized access to the facility.

(6) Former Member with CAC but No Affiliation (Separated). A former USCG member approaches an ACP and presents a CAC. PACS indicates the CAC is invalid, the member is no longer affiliated with the USCG (due to separation from service) and must be escorted if visiting the installation. The sentry denies entry to the former USCG member, follows unit security procedures, and confiscates the CAC.

(7) Derogatory Law Enforcement Alert. A USCG member presents a CAC at an ACP.

PACS displays a code indicating that there is derogatory law enforcement information associated with the bearer. The sentry asks the member to stand aside and notifies the command. The command notes the member has been charged with driving under the influence and notifies the Officer of the Deck (OOD). The OOD authorizes conditional access for the member to report directly to the command, and the sentry allows the member to enter the ACP.

(8) Dependent Spouse of Active-Duty USCG Member Debarred for Protective Order.

The dependent spouse of an Active-Duty USCG Member approaches an ACP and presents a dependent ID. PACS displays a code indicating the dependent has been barred by the Installation Commander due to a protective order issued to prevent contact with the Active-Duty Member who works on board. The sentry returns the ID card and denies passage.

(9) USCG Civilian Employee Denied Unescorted Access for Disqualifying Conviction.

A civilian employee approaches an ACP and presents a CAC. PACS displays a code indicating a felony conviction notice from an authoritative law enforcement data source. The sentry asks the employee to stand aside and notifies the command. The command consults the servicing legal authority and Human Resources, confirming the employee is no longer eligible for unescorted access by USCG policy. The sentry selects the escorted access option and re-scans the employee’s CAC. The employee is escorted by a command member for further administrative action.

(10) USCG Member Debarment from Another Unit. An active-duty USCG member approaches an ACP and presents a CAC. PACS displays a code indicating a debarment notice from a separate USCG unit, with the conditions and expiration information. In accordance with policy covering response to the code, the sentry returns the CAC and denies passage.

(11) USCG Retiree with No Purpose for Access. A USCG retiree approaches the ACP of a FSL V installation and presents a retiree ID. PACS notifies the sentry that this installation does not allow access to retirees. The sentry returns the ID and politely turns the retiree away.

(12) DHS-Component Visitor Working with USCG Installation Tenant. A member of a USCG Maritime Safety and Security Team (MSST) accesses the PACS visitor request module and enters a request to sponsor a Customs and Border Patrol (CBP) agent with a federally-issued PIV for access to a USCG installation. The request includes visitor’s name, sponsoring command point of contact (POC) and a three-week operational time frame for unescorted access. PACS verifies the CBP member’s identity and affiliation via connected DHS data source (PACS Connector); performs a fitness determination via connected authoritative data sources; and notes no disqualifying information. The installation CSO receives notification of the request and endorses the request in PACS in accordance with installation command’s policy.

PACS notifies the CBP agent, sponsoring command POC, and installation CSO that access has been approved. The CBP agent approaches the installation ACP, presents their federally-issued PIV. PACS displays the CBP agent’s identity, purpose and sponsorship, the sentry confirms the agent’s identity matches their PIV photo and grants unescorted access for any day during the requested timeframe.

(13) Unaffiliated Visitor Requests Access to a USCG Installation. An unaffiliated visitor enters a request for access to a base in the public-facing PACS visitor request module. The visitor provides all personal information and notes the sponsor for the request. The sponsor receives PACS notification of the visitor’s request and endorses the request in PACS. PACS performs a fitness determination via connected authoritative data sources and notes no disqualifying information. PACS notifies the visitor and sponsor that preliminary access has been approved pending identity proofing and provides printable documentation. The visitor approaches the ACP and presents the PACS preliminary access approval with two valid forms of identification in accordance with USCG policy. The sentry visually inspects both forms of identification and confirms the photos and biographical information match the visitor.

The sentry uses PACS to issue a printed access credential to the visitor and grants access.

(14) Program Oversight. CG-SPM queries PACS to determine the number of entry denials and confiscated CACs to assess system performance. Additionally, having received anecdotes indicating latency in scan reports, CG-SPM pulls maintenance records and data on hang-time between scan and results. Separately, the Area Security manager pulls information on expired CACs collected at the ACP, and compares it against the number of separations, to assess the degree to which commands are collecting CACs from personnel separating from the USCG.

(15) Casualty Response. At a local Base, PACS displays a fault code indicating loss of connection to external databases. The sentry continues to scan CACs and PACS grants access to individuals previously granted unescorted access to the installation and stored in the local system cache. For individuals not previously stored in the local cache, PACS can only identify CAC validity and expiry. The sentry passes individuals based on positive physical CAC inspection only. One member attempts to access the installation with an expired CAC. The sentry denies the individual access to the base, confiscates the CAC, follows unit security procedures and notes an exception. The exception is locally cached, and the information is synced once the connection is restored.

d. User Interactions.

(1) Users.

(a) Headquarters CG-SPM program managers issue policy, guidance, objectives and standards, align activities, and measure performance using PACS performance data and metric extraction.

(b) Area/District Commanders & Security Managers oversee and advise field installations executing ACP functions, and measure performance using PACS-supplied data and metrics.

(c) Installation Commanders, CSOs, and ACP watchstanders use PACS to control access to installations and tenant facilities using electronic interrogation of credentials, visitor request processing, entering and enforcing debarments, and measuring performance via system data and metrics.

(d) Sponsors (i.e. tenant commands, installation activities and personnel) submit visitors, contractors and new employees for identity proofing and vetting to ensure proper fitness determination.

(e) Access credential holders (ID card holders, pass holders, and visitors requesting access to the installation) present credentials at ACPs for access determination, and adhere to command policy for access.

(f) Unaffiliated visitors submit requests for access which are endorsed by the identified Sponsor and further submitted for identity proofing and vetting to ensure proper fitness determination.

(g) CG Chief Information Officer (CG-CIO); Command, Control, Communications, Computers, Cyber, and Intelligence Service Center (C5ISC), and CG Cyber Command (CGCYBER) sustain life-cycle development, cybersecurity, and maintenance of PACS, networks, data connections and other electronic support.

(2) Software System Interactions: PACS will replace all legacy electronic interrogation capabilities at USCG-owned ACPs. PACS is expected to connect to personnel databases (currently DEERS) for identity proofing and affiliation, and law enforcement and debarment databases for fitness. PACS will assess purpose and sponsorship as set by USCG and command policy such as DoD CAC holder access presumptions, federally-issued PIV holder and visitor approvals, and Force Protection Condition (FPCON) limitations.

e. System Interfaces. PACS will be capable of residing on the DoD Information Network (DoDIN). PACS interfaces include:

(1) Identity Proofing and Affiliation Databases (unidirectional pull). Currently DEERS, with potential addition of other government identity management systems (e.g. DHS PACS Connector);

(2) Fitness assessment via Identity Matching Engine for Security and Analysis (IMESA) (unidirectional pull); Criminal Justice Information System (unidirectional pull);

debarment database (bidirectional);

(3) Visitor Approval (manual entry and IL2-compliance public-facing portal – bidirectional);

(4) CG Cloud / Data Fabric (metrics, access data – bidirectional);

(5) Authentication equipment (electronic interrogation, PIN entry pad, biometric scanner).

3. Operational Requirements. All requirements are assumed to be at the Threshold level, unless otherwise denoted by “(T)” for Threshold, and an “(O)” for Objective.

a. Effectiveness.

Req. ID Requirements Description ER 1 System Requirements

ER 1.1 PACS shall collect identity information via valid government-issued credential in accordance with policy.

ER 1.2 PACS shall determine physical access authorization based on aggregate conditions of identity, fitness, purpose and sponsorship.

ER 1.3 PACS shall allow authorized users to modify access authorization conditions (e.g., FPCON change, debarment change).

ER 1.4 PACS shall import information (e.g., DEERS affiliation, IMESA, law enforcement, debarment) from authoritative sources.

ER 1.5 PACS shall perform data management.

ER 1.6 PACS shall perform role-based access control.

ER 1.7 PACS shall notify users when actions are required.

ER 1.8 PACS shall perform data entry validation.

ER 1.9 PACS shall record the outcome of each ACP event (IAW DHS Records Management).

ER 1.10

KPP 1

PACS’ probability of granting entry to an unauthorized individual (false acceptance rate) shall be less than: 0.1 percent (T); 0.01 percent (O).

ER 1.11 PACS’ probability of denying entry to an authorized individual (false rejection rate) shall be less than: 1 percent (T); 0.1 percent (O).

ER 1.12

PACS shall notify the sentry whether conditions for access are met, or not, and why within: 1 second 75% of the time (T); 5 seconds 95% of the time (O).

25 Sep 2025

ER 1.13 PACS shall connect system devices to the installation network (e.g., scanner, PIN pad, etc.).

ER 1.14 PACS shall employ multi-factor authentication (MFA) as a condition of access in accordance with policy.

ER 2 Administration Requirements

ER 2.1 PACS shall allow authorized users to manage visitor requests at each unit.

ER 2.2 PACS shall manage debarments and conditions.

ER 2.3 PACS shall issue temporary / visitor badges / credentials.

ER 3 Sentry Requirements

ER 3.1

PACS shall accept an exception entry from the sentry when entry is denied due to negative physical inspection of a credential (such as ID tampered with, or the credential picture doesn’t match the individual).

ER 4 Entrant (Visitor/Applicant) Requirements ER 4.1 PACS shall manage visitor access to installations (IL2).

ER 4.2 PACS shall streamline processing of repeat visitor access requests. (O)

Table 1. PACS Effectiveness Requirements

b. Suitability2.

Req. ID Requirements Description SR 1 Interoperability/Integration

SR 1.1 PACS shall interoperate with external systems to access authoritative data sources.

SR 2 Environmental

SR 2.1 PACS shall operate within the environmental conditions experienced by USCG installations.

SR 3 Reliability3

SR 3.1 PACS shall have a MTBF not less than __ hours under normal operating conditions. 360 hours (T); 1440 hours (O)

SR 4 Materiel Availability

SR 4.1 PACS shall be available for at least ___ concurrent users (there are approximately 100 Level III and IV installations). 300 (T); 1,000 (O).

SR 4.2 PACS shall be available for at least ____ USCG user profiles, excluding temporary profiles (e.g., daily visitors). 1,000 (T); 2,000 (O).

SR 4.3

PACS shall be available for __ users accessing the system to create temporary profiles to support installation visit requests: 1,000 steady state with dynamic scaling to accommodate large events.

SR 5 Operational Availability (Ao)4

2 Suitability requirements are applicable only within the system boundary.

3 PACS functionality will depend on enabling capabilities that reside outside the PACS system boundary (e.g., electrical power, external databases (DEERS, law enforcement, etc.) functionality, internet access). These capabilities are assumed to be available for reliability and availability calculations.

4 Two software instances of the PACS solution operating in the cloud with failover capability would dramatically improve system-wide Ao without requiring extremely high availability for a single instance. For example, two active

SR 5.1 PACS shall have an Ao of at least __ for software systems. 99% (T);

99.9% (O).

SR 5.2 PACS shall have an Ao of at least __ for hardware systems. 99% (T);

99.9% (O).

SR 5.3 PACS shall maintain operational availability during loss or degradation of external connectivity with authoritative data sources.

SR 5.4

KPP 2

PACS recovery time objective (RTO) for system-wide outages shall be no more than 2 hours.

SR 6 Maintainability

SR 6.1

PACS software system’s mean time to repair (MTTR) for unscheduled local outages shall be no more than: 24 hours (T); 12 hours (O).

SR 7 Cybersecurity: These requirements specify the resilience of the system to cyberattacks and threats.

SR 7.1 PACS shall maintain compliance to meet Authority to Operate (ATO) requirements.

SR 7.2 PACS shall incorporate Zero Trust Architecture (ZTA).

SR 8 Human System Interface (HSI)

SR 8.1 PACS shall be accessible from USCG approved endpoints.

SR 8.2 PACS shall allow secure access from non-USCG internet connections.

SR 8.3 PACS shall provide user enablement to support effective operation.

SR 9 Data Protection and Critical Information Assurance SR 9.1 PACS shall protect all data in accordance with its assigned impact levels

Table 2. PACS Suitability Requirements

4. Key Performance Parameters (KPPs).

KPP ID Description

KPP 1

PACS’ probability of granting entry to an unauthorized individual (false acceptance rate) shall be less than: 0.1 percent (T); 0.01 percent (O).

(ER 1.10)

KPP 2 PACS recovery time objective (RTO) for system-wide outages shall be no more than 2 hours. (SR 5.4)

Table 3. PACS Key Performance Parameters

5. Critical Operational Issues (COIs).

COI ID Description

COI1

Mission Support Operations: Can PACS effectively support elements of Force Protection capabilities (e.g., Installation Access Control Point) in support of USCG personnel and installations?

instances, each at 99% Ao would provide a total system Ao of 99.9%. Similarly, multiple hardware devices (e.g., three identity scanning devices per entry gate), each with modest availability, would provide relatively high system-wide availability.

COI2

Reliability: Will PACS be reliable in its intended operating environment at the level required to support its contribution to mission completion?

COI3 Maintainability: Will PACS be maintainable in its intended operating environment?

COI4 Availability: Will PACS’ availability support the completion of its assigned missions?

COI5 Logistics Supportability: Will PACS be logistically supportable?

COI6 Is PACS capable of maintaining the complete record of individual installation access data?

COI7 Does PACS efficiently and accurately collect data from unaffiliated entrants at entry checkpoints?

COI8 Does PACS ingest from and accurately represent data from authoritative data sources?

COI9 Does PACS have intuitive business intelligence analysis and queries?

COI10

Does PACS locally store frequent accessors and query their fitness, suitability, and debarment status so that is accessible when the system is offline?

COI11 Does PACS rapidly and accurately inform sentries of the admissibility of entrants at entry checkpoints?

Table 4. PACS Critical Operational Issues

6. Timeline. PACS will achieve Initial Operational Capability when the system is delivered, including infrastructure, maintenance support, and training sufficient to support Initial Operational Test and Evaluation (IOT&E). It will attain Full Operational Capability when it has completed OT&E. Pending availability of funds, PACS will be fielded in accordance with the following schedule:

a. Phase I - Units with CG Police Department (CGPD)/Security Forces (SF)

b. Phase II - Auxiliary units with manpower capabilities

c. Phase III - Remaining units with CGPD/SF

d. Phase IV - Units with no CGPD/SF or other manpower support

7. Decision. Validate PACS operational requirements.

Approve

Disapprove

Enclosures: (1) Physical Access Control System (PACS) OV-1

(2) Glossary

Enclosure (1)

Enclosure (1): Physical Access Control System (PACS) OV-1

Enclosure (2)

Enclosure (2): Glossary

Access Control Point (ACP): The point at which access control to a facility or installation is maintained to restrict access to property or space. This term is inclusive of any access point, whether internal to a secure perimeter, or at the outermost point at which access is controlled to the facility or installation. Manning and arming requirements of an ACP are determined based upon the location and purpose of the ACP, not merely upon the fact that it is a point of access control.

Authentication: A process that matches presented information to the established origin of that information.

Authority to Operate (ATO): Formal approval granted by a senior official within a government agency, signifying that an information system meets the required security standards and is authorized to operate. The system's security posture is deemed acceptable, and the risk associated with its operation is within acceptable limits.

Biometric: A measurable, physical characteristic or personal behavioral trait used to recognize the identity or verify the claimed identity of an individual. Facial images, fingerprints, and iris scan samples are all examples of biometrics. An authenticator produced from measurable qualities of a living person.

Common Access Card (CAC): A "smart" card about the size of a credit card, is the standard identification for active-duty uniformed Service personnel, Selected Reserve, DoD civilian employees, and eligible contractor personnel. It is also the principal card used to enable physical access to buildings and controlled spaces, and it provides access to DoD computer network and systems.

Debarment: To exclude an individual from a facility or installation.

Fitness: Level of character and conduct determined, via a vetting process, necessary for the basis of physical access control decisions.

Force Protection Condition (FPCON): System used by the DoD to outline security measures against potential terrorist threats. It ranges from FPCON Normal (no specific threat) to FPCON Delta (an attack is occurring or has just occurred). Each level specifies actions like increased security checks, restricted access, and enhanced surveillance.

Functional Requirements Document (FRD): Needed future document that will include all functional specifics (e.g., identify mandatory fields, formatting, decision points to be logged, etc.) required of the system.

Identity: The set of physical and behavioral characteristics by which an individual is uniquely recognizable.

Enclosure (2)

Impact Level (IL): Impact Levels are the combination of the sensitivity of the information to be stored and/or processed in the cloud; and the potential impact of an event that results in the loss of confidentiality, integrity or availability of that information.

Impact Level 2 (IL2): Non-Controlled Unclassified Information. Impact level 2 accommodates publicly releasable data or non-public unclassified data where the unauthorized disclosure of information could be expected to have a limited adverse effect on organizational operations and assets, or individuals

Impact Level 4 (IL4): Controlled Unclassified Information. Impact level 4 accommodates non-public, unclassified data where the unauthorized disclosure of information could be expected to have a serious adverse effect on organizational operations and assets, or individuals.

Impact Level 5 (IL5): Controlled Unclassified Information and Unclassified National Security Information (U-NSI). Impact level 5 accommodates non-public, unclassified National Security System (NSS) system data (i.e., U-NSI) or non-public, unclassified data where the unauthorized disclosure of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.

Installation: Units, camps, campuses, facilities, posts, stations, centers, and other needful buildings within the geographic authority of the United States.

Multi-Factor Authentication (MFA): Security system that requires users to provide two or more verification factors (e.g. something you have, something you know, something you are) to gain access to an account or resource.

Physical Access Control System (PACS): An electronic system that controls the ability of people or vehicles to enter a protected area, by means of authentication and authorization at access control points.

Purpose: Valid need to access an installation or facility, such as official duties as uniformed military personnel, CG civilian employees, and contractors; use of facility or installation services by military retirees, family members, dependents, and other authorized patrons; deliveries and other commercial services for the facility or installation; Visiting personnel in housing; and special events.

Sponsor: The person affiliated with USCG/DoD or other Federal agency who takes responsibility for verifying and authorizing a visitor’s need for an identification card.

Vetting: An evaluation of an individual’s or a card holder’s character and conduct for approval, acceptance, or denial for the issuance of an access control credential for physical access.

Zero Trust Architecture (ZTA): Cybersecurity framework that assumes no user or device can be inherently trusted, regardless of whether they are inside or outside the network perimeter.