5200_dtd_May_2025_USCG_PACS_Mission_Needs_Statement_CRE_signed.pdf

Commandant United States Coast Guard

2703 Martin Luther King Jr Ave SE Washington, DC 20593-7324 Staff Symbol: DCMS-34 Phone: (202) 372-3712

03 Jun 2025

MEMORANDUM

From: Matthew T. Barido, GS-15

DCMS-341

Reply to Attn of:

CG-761

LT Jeff Poe

To:

Thru:

CG-7D

CG-771

Subj: U.S. COAST GUARD (USCG) PHYSICAL ACCESS CONTROL SYSTEMS (PACS)

MISSION NEEDS STATEMENT

Ref: (a) Physical Access Control, COMDTINST 5532.1

(b) Coast Guard Required Operational Capabilities (ROC) and Projected Operational

Environment (POE) Manual, COMDTINST M3501.26B

1. Problem Statement. The USCG is vulnerable to security threats due to the absence of an enterprise PACS solution at its installations access control points (ACP). This gap compromises the verification of identity, fitness, and purpose for any individual attempting access. This deficiency not only jeopardizes the safety of personnel and assets but also risks non-compliance with federal mandates, potentially leading to unauthorized access and security breaches. Without timely funding and implementation of a comprehensive PACS solution, the USCG will continue to expose itself to significant threats, undermining its operational integrity and mission effectiveness. The objective is to develop a robust enterprise PACS that integrates with necessary databases to ensure secure access, thereby safeguarding USCG installations and fulfilling compliance requirements. The desired outcome is a fully-operational PACS aligned with the organizational policies in reference (a) that enhances security, mitigates risks, and meets all federal standards, ensuring only authorized individuals can access installations.

2. Mission Need. PACS serves as the first line of defense against threats to USCG personnel, assets, and resources by limiting access to authorized personnel. To ensure that PACS effectively supports the Coast Guard’s eleven statutory missions through the Mission Enablers (ME) and Mission Support (MS) functions described in reference (b), PACS must:

a. electronically interrogate credentials to verify identity, affiliation, fitness, purpose, and sponsorship with high accuracy and reliability. (Consolidated Required Operational Capabilities (ROC): MS2.1, 2.2; ME4.1, 6.2)

b. quickly identify conditions to deny authorization to individuals requesting entry, such as expiration, non-affiliation, debarment, or derogatory background information.

(Consolidated ROC: MS2.1, 2.2; ME4.1)

Subj: USCG PACS MISSION NEEDS STATEMENT 5200 03 Jun 2025

c. be continuously accessible with 24/7 authentication. (Consolidated ROC: ME6.2)

PACS is primarily a software solution with hardware components. Implementation of PACS may require hardwired and wireless IT connections, database access, additional facilities (such as access control and visitor control points), security and oversight personnel, and utility availability (power, heating, cooling).

3. Mission Deficiencies.

a. Mission Mapping. PACS is primarily a Mission Enabling and Mission Support capability.

Support to operational missions is secondary.

b. Capabilities Measurement. The following measures will assess PACS’ implementation:

(1) False acceptance and rejection.

(2) False issuance and denial of local credentials.

(3) Number of expired or invalid credentials confiscated.

c. Capabilities Baseline. Current access control capabilities primarily consist of visual and physical inspection of a presented credential to verify credential is unexpired, credential’s photo matches person presenting credentials, and no sign of alteration or tampering. (note:

this is not considered an authentication factor). Some installations supplement visual and physical inspection with electronic scanning systems with limited access to affiliation and background information (e.g. RapidGate).

d. Required Capabilities. PACS must:

(1) Employ electronic authentication factors appropriate for Facility Security Level.

(2) Authenticate own and other agency access credential electronically for access.

(3) Obtain information from external interagency databases.

(4) Identify debarments to prevent access.

(5) Deny access to those without valid credentials, fitness, or purpose/sponsorship.

(6) Credential visitors for unescorted access to installation.

(7) Credential visitors for escorted access to installation.

(8) Provide data for performance management.

e. Capability Gap(s). The USCG’s physical access control experiences the gaps below requiring a materiel solution to resolve:

(1) Lack of connection to necessary databases for identity proofing/affiliation, fitness, and sponsorship for federally-issued credentials.

(2) Absence of a central database to query for debarment letters.

(3) Lack of validation of revocation of a federally-issued credential bearer’s affiliation within the required timeframe.

(4) Insufficient data for performance management controls.

4. Scope. The USCG will implement the PACS solution at all USCG-managed major installations assessed as Facility Security Level III and higher. The PACS will electronically interrogate the credentials of all individuals seeking access to USCG installations, assess purpose based on USCG and facility policies, and verify fitness using debarment and law enforcement databases. The PACS will also manage visitor access for unaffiliated individuals and have the ability to produce compliant visitor credentials.

a. Boundaries. PACS will be implemented at USCG-staffed ACPs. PACS will operate on the DoD Information Network (DoDIN) and connect to databases for affiliation, ID proofing, wants/warrants, and debarment notices. PACS will have, or interface with, visitor access request systems to enable validation and vetting of visitors prior to arrival at the installation

ACP.

b. Stakeholders. DCMS-34, Area Security Managers, installation commanders; tenant commands, system administrators, and support providers.

c. Constraints. Only a limited number of installations possess the necessary infrastructure for PACS implementation. Dedicated security staffing exists only at 24 installations, and even those may lack adequate personnel to fully operate the PACS. Deployment priority will be given to those locations that have both the required infrastructure and sufficient manpower.

As such, any resourcing strategies must acknowledge these constraints and outline a way forward for addressing both infrastructure and manpower needs. Environmental factors, including humidity and moisture, will be critical in system design, necessitating compliance with standards such as NEMA 250 for equipment enclosures, IP ratings for moisture protection, and MIL-STD-810 for environmental testing. Logistical challenges will primarily focus on deployment, with funding and staffing identified as the biggest obstacles in developing a robust product line for equipment sustainment post-deployment.

PACS sustainment will be constrained by a three-year recapitalization cycle, ensuring that it remains effective and up-to-date throughout its operational lifespan.

d. Assumptions. This system will adhere to established federal guidelines, including Homeland Security Presidential Directive 12, FIPS PUB 201-3 for Personal Identity Verification, and relevant NIST publications such as SP 800-53, ensuring compliance throughout its lifecycle. The PACS will leverage existing commercial off-the-shelf (COTS) software solutions where possible, incorporating hardware such as computer terminals (enrollment stations), credential printers, card scanners, and card stock. All hardware is assumed to be sourced from the GSA Approved Products List (APL). This document assumes the supply chain will remain stable with no known vulnerabilities impacting the procurement of necessary components enabling a phased PACS deployment expected to begin in FY28, with an anticipated five-year timeline for completion.

e. Background and Resources. The ROM estimate for acquisition (exclusive of facilities) is $16M. Operations and Support (including security guard contracts) is estimated as $116M over 10 years.

f. Dependencies and Deliverables. The main deliverable is a solution which enhances installation access control. The solution consists of software and hardware, such as access control workstations, credential scanners, printers, and multi-factor authentication equipment (PIN entry, biometrics).

g. Timeline. The solution will be implemented over five years,

h. Risk Management. Implementation risk is reduced via the use of existing databases and referring to existing specifications for PACS contracts supporting other federal agencies.

5. Urgency. The increasing operational focus on border and migrant interdiction mission sets combined with a much tighter coupling with our DoD counterparts increases the USCG risk profile to levels not previously seen. The USCG lacks an enterprise-wide capability for single-or multi-factor authentication (physical inspection is not considered single-factor authentication). The USCG cannot reliably verify affiliation and fitness. The USCG risks granting access to personnel who lack fitness, adversaries with fake credentials that pass visual inspection, and former employees whose credentials show an expiration date after the employee was separated.

6. Threat Review and System Drivers.

a. (U//FOUO) Threat Intelligence. The ICC’s September 2024 Acquisition Threat Review identified threats in Cyber; Ports, Waterways, and Coastal Security; Migrant Interdiction;

Drug Interdiction; Living Marine Resources/Illegal, Unreported, Unregulated Fishing; and Defense Readiness. Cyber threats are the most applicable and include:

(1) (U//FOUO) Malicious Cyber Actors (MCA) likely pose a moderate threat of Cyber Operations against the PACS solution.

(2) (U//FOUO) The most impactful cyber threat to USCG Information and computer technology from MCAs is through upstream supply chain attacks.

(3) (U) Insiders pose the most likely threat to USCG Industrial Control Systems.

(4) (U) The degradation or denial of external voice and data communications for USCG operational assets due to non-adversarial threat sources almost certainly poses a high threat to mission execution, especially as USCG operational assets increasingly deploy outside of traditional theatres.

b. Other Solution Drivers. Other threats and weaknesses to PACS include inability to detect of expired, unaffiliated, or counterfeit credentials; acts of physical evasion or circumvention of PACS (covert entry) by individuals seeking unauthorized access;

interruptions to power and database connections; exposure of hardware to elements; and non-compliance with statute, directives, policy, or standards.