5IN0176 Security Requirements (FSL Level III) (Oct. 2024).pdf

LESSOR: ________ GOVERNMENT: ________ SECURITY REQUIREMENTS (LEVEL III)

REV (10/2024)

SECURITY REQUIREMENTS - FACILITY SECURITY LEVEL III

THESE PARAGRAPHS CONTAIN ADDITIONAL SECURITY REQUIREMENTS THAT MAY BE

INSTALLED IN THE LEASED SPACE, AND UNLESS INDICATED OTHERWISE, ARE TO BE

PRICED AS PART OF THE GOVERNMENT’S TI COSTS. BECAUSE EACH BUILDING IS

UNIQUE, THE FINAL LIST OF SECURITY COUNTERMEASURES WILL BE DETERMINED

DURING THE POST AWARD PHASE. AFTER FINAL SECURITY REQUIREMENTS ARE

DETERMINED, THE LESSOR SHALL SUBMIT A LIST OF THE ITEMIZED COSTS. SUCH

COSTS SHALL BE SUBJECT TO NEGOTIATION. MAINTENANCE COSTS ARE TO BE

INCLUDED IN THE OPERATING RENT.

NOTE THAT ITEMS IDENTIFIED AS “SHELL *” REPRESENT A LESSOR’S OBLIGATIONS OR

THE GOVERNMENT’S RIGHTS AND ARE NOT NECESSARILY ITEMS TO BE CONSTRUCTED.

(PARTS OF THE PARAGRAPH ABOVE HAVE BEEN INTENTIONALLY DELETED/MODIFIED)

DEFINITIONS: Definitions are the same as those used in the Lease unless re-defined in these Security Requirements.

CRITICAL AREAS AND SYSTEMS- The areas that house systems that if damaged and/or compromised could have significant adverse consequences for the facility, operation of the facility, or mission of the agency or its occupants and visitors. These areas may also be referred to as “limited access areas,” “restricted areas,” or “exclusionary zones.” Critical areas do not necessarily have to be within Government-controlled Space (e.g., generators, air handlers, electrical feeds, utilities, telecom closets or potable water supply that may be located outside Government-controlled Space).

DESIGN-BASIS THREAT – MODIFIED

The Design-Basis Threat (DBT) is the profile and estimate of the threats to a Government facility across a range of specific undesirable events, and serves as the basis for determining appropriate security standards.

The Lessor’s technical consultant(s) shall work in conjunction with the Government, including the Federal Protective Service (FPS), to apply the DBT to the post-award risk assessment. The risk assessment identifies recommended countermeasures and security design features that achieve the minimum baseline level of protection for a particular facility. The baseline level of protection may be further customized to address facility-specific conditions. The Lessor is responsible for providing countermeasure provisions outlined in this FSL document, as well as for additional items identified during the post-award risk assessment. Any additional countermeasures identified during this assessment shall be priced as a Government TI cost.

I. FACILITY ENTRANCES, LOBBY, COMMON AREAS, NON-PUBLIC, AND

UTILITY AREAS

A. FACILITY ENTRANCES AND LOBBY

INTENTIONALLY DELETED

1. LIMITING LOBBY QUEUING

INTENTIONALLY DELETED

2. PHYSICAL BOUNDARIES TO CONTROL ACCESS TO PUBLIC AND NON-PUBLIC AREAS

INTENTIONALLY DELETED

3. MAGNETOMETERS AND X-RAYS AT PUBLIC ENTRANCES

INTENTIONALLY DELETED

B. ADDITIONAL REQUIREMENTS

1. EMPLOYEE AND VISITOR SIGN-IN/OUT AFTER HOURS

INTENTIONALLY DELETED

2. ACCOMMODATION OF RETAIL/MIX USE SPACE (SHELL)

INTENTIONALLY DELETED

C. COMMON AREAS, NON-PUBLIC, AND UTILITY AREAS

1. PUBLIC RESTROOMS ACCESS (SHELL)

INTENTIONALLY DELETED

2. SECURING CRITICAL AREAS

INTENTIONALLY DELETED

3. VISITOR ESCORT AND ID REQUIREMENTS

INTENTIONALLY DELETED

4. SECURING COMMON BUILDING UTILITIES, SERVICE ROOMS, AND ACCESS TO ROOF

INTENTIONALLY DELETED

5. CRITICAL SYSTEM LOCATION

INTENTIONALLY DELETED

6. RESTRICT CONTACT FROM PUBLIC AREAS WITH PRIMARY VERTICAL LOAD MEMBERS

INTENTIONALLY DELETED

7. RESTRICT CONTACT FROM MAIL AREA WITH PRIMARY VERTICAL LOAD MEMBERS

II. INTERIOR (GOVERNMENT SPACE)

A. WEARING PHOTO ID IN GOVERNMENT SPACE

The Lessor and his/her contractors shall be required to wear a photo ID to be visible at all times when in Government- controlled Space.

B. SECURE EMPLOYEE ENTRANCE DOORS

INTENTIONALLY DELETED

C. LIMIT ON ENTRY POINTS (SHELL)

INTENTIONALLY DELETED

D. FORMAL KEY CONTROL PROGRAM (SHELL)

INTENTIONALLY DELETED

E. ELECTRONIC ACCESS FOR EMPLOYEES- MODIFIED

The Lessor shall provide a PACS card reader for employee entry without a guard post (including after-hours access) in conjunction with Video Surveillance System (VSS) coverage.

F. 552.270-34 ACCESS LIMITATIONS FOR HIGH-SECURITY LEASED SPACE (JUN 2021) (SHELL * )

INTENTIONALLY DELETED

III. SITE AND EXTERIOR OF THE BUILDING – PART OF THIS PARAGRAPH HAS BEEN

INTENIONALLY DELETED

A. SIGNAGE

1. POSTING OF SIGNAGE IDENTIFYING THE SPACE AS GOVERNMENTAL (SHELL) – PART OF THIS

PARAGRAPH HAS BEEN INTENIONALLY DELETED

The Lessor shall not post sign(s) or otherwise identify the parking areas as a Government or specific Government tenant, occupied facility, including during construction, without written Government approval.

2. POSTING OF REGULATORY SIGNAGE (SHELL)

The Government may post or request the Lessor to post regulatory, statutory, sensitive areas, and site-specific signage.

B. LANDSCAPING AND ENTRANCES

1. CRIME PREVENTION THROUGH ENVIRONMENTAL DESIGN (SHELL) – PART OF THIS

PARAGRAPH HAS BEEN INTENIONALLY DELETED/MODIFIED

a. If Landscaping exists, it shall be neatly trimmed in order to minimize the opportunity for concealment of individuals, packages/containers, and parking areas. Landscaping shall not obstruct the views of security guards and VSS cameras or interfere with lighting or security equipment.

2. HAZMAT STORAGE

3. PLACEMENT OF RECEPTACLES, CONTAINERS, AND MAILBOXES

INTENTIONALLY DELETED

4. VEHICLE BARRIERS

In accordance with the post-award DBT analysis, the Lessor shall provide vehicle barriers to protect pedestrian entrances from penetration by a vehicle (e.g., concrete bollards, concrete planters, concrete retention walls).

Minimum barrier height is 30 inches, and maximum clear spacing between vehicle barriers is 4 feet. The Lessor shall use barriers to ensure that vehicles cannot pass beyond the screening check point until cleared.

C. PARKING

1. NUMBER OF PARKING ENTRANCES

The number of parking entrances shall be limited to the minimum required for efficient operations or local code, (giving consideration to minimizing queuing). Entrances to parking areas shall be equipped with vehicle gates to control access to authorized vehicles (employee, screened visitor and approved Government vehicle). Gates controlling vehicles may include, but are not limited to, barriers (drop arm/wedge), garage style doors, and traditional chain link fences.

2. AUTHORIZED ACCESS TO PARKING (SHELL)

Lessor shall limit parking and access to parking to employee vehicles, authorized visitor vehicles, approved government vehicles, and other authorized vehicles.

3. VEHICLE SCREENING

The Government may elect to screen all visitor vehicles (before entry into the controlled parking area) as prescribed by the Government. This screening shall include ID verification and visual inspection of the vehicle, including undercarriage. The Lessor shall provide adequate lighting in screening area to illuminate the vehicle exterior and undercarriage. VSS coverage of the screening area shall be provided by the Lessor (see VSS requirements).

4. PUBLIC ACCESS TO GOVERNMENT PARKING AREAS

Where there is Government controlled parking the area shall be controlled by limiting pedestrian access to the controlled parking areas. Pedestrian and vehicle access points to all parking areas shall be monitored by VSS camera(s) at all times

IV. SECURITY SYSTEMS

A. SECURITY SYSTEM TESTING AND MAINTENANCE CRITERIA: - MODIFIED

The Lessor in consultation and coordination with a security provider, either internal or external, as determined by the Lease Contracting Officer, and the Government security representative shall implement a testing and preventive maintenance program for all security systems the Lessor has installed. Testing must be based on established, consistent, agency-specific protocols, to be determined at the time of design. All testing shall be documented. Operational performance testing shall be conducted annually and functional testing shall be conducted more frequently, as determined by the Government. Components which fail, either during testing or throughout the life of this lease shall be repaired or replaced by the Lessor within a reasonable timeframe as determined by the Government. Any critical component that becomes inoperable must be replaced or repaired by the Lessor within 72 hours. Critical components are those required to provide security (VSS, PACS, etc.) for a perimeter access point or critical area. "Replacement" may include implementing other temporary measures in instances where the replacement or repair is not achievable within the specified time frame (e.g. a temporary barrier to replace an inoperable pop-up vehicle barrier, etc.). Failure by the Lessor to provide sufficient replacement measures within the timeframe identified above may result in the Government providing guard service, the cost of which must be reimbursed by the Lessor.

B. VIDEO SURVEILLANCE SYSTEM

LESSOR PROVIDED DESIGN, INSTALLATION, AND MAINTENANCE

The Lessor shall design, install, and maintain a Video Surveillance System (VSS) system as described in this section. The VSS system will support the entry control system (at screening check points, personnel and vehicle entrances, exits, loading docks, and lobbies), with time lapse video recording and digital image storage, that will allow Government employees to view and communicate remotely with visitors before allowing access to the Space. As determined by the Government the VSS shall provide unobstructed coverage of designated pedestrian entrances and exits. Technical review of the proposed system shall be coordinated with the Government security representative, at the direction of the Contracting Officer, prior to completion of the CDs, as well as prior to installation. VSS system testing, and acceptance shall be conducted by the Government prior to occupancy. The VSS system shall comply with the Architectural Barriers Act, section F230.0. The Government will centrally monitor the VSS system. Government specifications are available from the Lease Contracting Officer. VSS system components which fail or require maintenance, or which fail during testing should be serviced in accordance with the Security System Maintenance Criteria listed above.

The Lessor shall comply with FAR 52.204-25: Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (Nov 2021). See https://www.acquisition.gov/far/part-

52#FAR_52_204_25.

C. INTRUSION DETECTION SYSTEM

D. DURESS ALARM

LESSOR PROVIDED DESIGN, INSTALLATION, AND MAINTENANCE

The Lessor shall design, install, and maintain a duress alarm system as described below. The system will include, at a minimum, duress buttons or call buttons at security force posts and sensitive public contact areas, and other areas that are identified as high-risk locations. Technical review shall be coordinated with https://www.acquisition.gov/far/part-52#FAR_52_204_25 https://www.acquisition.gov/far/part-52#FAR_52_204_25 the Government security representative, at the direction of the Contracting Officer, prior to completion of the CDs, as well as prior to installation. System testing and acceptance shall be conducted by the Government prior to occupancy. This system shall comply with the Architectural Barriers Act, section F230.0.

The Lessor in consultation and coordination with the security provider and Government shall conduct security system performance testing annually. Testing must be based on established, consistent agency-specific protocols, documented and furnished to the Lease Contracting Officer. Components which fail or require maintenance, or which fail during testing should be serviced in accordance with the Security System Maintenance Criteria listed above.

E. SECURITY SYSTEMS DESIGN

The Lessor, in consultation and coordination with security providers (internal or external) and the agency designated security representative, shall ensure at the time of system design, system construction, and throughout the term of the Lease, that alarm and Physical Access Control Panel, VSS components, controllers, and cabling shall be secured from unauthorized physical and logical access.

F. CENTRAL SECURITY CONTROL CENTER

1. CENTRALIZED COMMUNICATIONS SYSTEM

The Lessor, in consultation and coordination with security providers (internal or external) and the agency designated security representative, shall provide and maintain a communication system for security and emergency announcements. Communication may be achieved through public address systems, specially-designed phone systems, and computer-based mass delivery. This communication system should be utilized to provide emergency announcements, alerts and instructions to occupants. On site communication with guards (if applicable), designated response personnel and Occupant Emergency Plan (OEP) support employees is essential during an incident. Procedures for standard announcements and drills shall be developed. Standard announcements may be prerecorded into the Building communication system for immediate notification.

2. EMERGENCY POWER TO SECURITY SYSTEMS

The Lessor, in consultation and coordination with a security provider (internal or external) and the agency designated security representative, shall provide uninterruptible emergency power to essential electronic security systems for a minimum of 4 hours. Uninterruptable power can be provided through the use of batteries, emergency generators, UPS, or a combination thereof to meet the requirements.

V. STRUCTURE

A. WINDOWS

1. SHATTER-RESISTANT WINDOW PROTECTION

2. LOCK GROUND FLOOR WINDOWS

3. SECURE NON-WINDOW OPENINGS (SHELL)

INTENTIONALLY DELETED

4. PREVENT VISUAL OBSERVATION INTO EXTERIOR OFFICES (T.I.)

INTENTIONALLY DELETED

B. BUILDING SYSTEMS

1. EMERGENCY GENERATOR PROTECTION (T.I.)

2. SECURING ON-SITE PUBLICLY ACCESSIBLE UTILITIES

3. SECURING AIR INTAKE GRILLES

INTENTIONALLY DELETED

4. HVAC SYSTEM FOR CHEMICAL, BIOLOGICAL AND RADIOLOGICAL (CBR) ATTACK-SUSCEPTIBLE

AREAS

INTENTIONALLY DELETED

5. HVAC CONTROL

VI. OPERATIONS AND ADMINISTRATION

A. FACILITY SECURITY COMMITTEE (SHELL *)

The Lessor shall cooperate and work with the buildings Facility Security Committee (FSC) throughout the term of the Lease. The FSC is responsible for addressing facility-specific security issues and approving the implementation of security measures and practices. The FSC consists of representatives of all Federal tenants in the facility, the security organization, and the leasing department or agency.

B. ACCESS TO BUILDING INFORMATION (SHELL *)– MODIFIED

Building Information—including mechanical, electrical, fire and life safety, security system plans and schematics, computer automation systems, and emergency operations procedures—shall be strictly controlled. Such information shall be released to authorized personnel only, approved by the Government, by the development of an access list and controlled copy numbering. The Lease Contracting Officer may direct that the names and locations of Government tenants not be disclosed in any publicly accessed document or record. If that is the case, the Government may request that such information not be posted in the building directory.

Lessor shall have emergency plans and associated documents readily available to the Government in the event of an emergency.

C. SECURITY PLANS AND LAYOUTS

The Lessor shall secure and keep safe any security plans, construction and alteration plans and layouts. This shall be addressed in the construction security plan. The Lessor shall treat and safe keep any plans and specifications related to security measures as For Official Use Only (FOUO).

D. CONSTRUCTION SECURITY PLAN (SHELL)

The Lessor shall develop and implement a construction security plan. The plan should specify who is responsible for the security of the site during each phase of the project until final completion. The construction security plan shall describe in detail, how the Government’s information, assets, equipment, and personnel will be protected during the construction process. (This shall include background checks, restrictions on accessibility, and escorts for the construction personnel). The required security measures will vary with the risk presented during the project. The Lessor shall also submit a security plan for all post-occupancy construction and alterations projects in the leased Space, throughout the term of this Lease.

E. SCREENING OF MAIL AND PACKAGES

INTENTIONALLY DELETED

F. SECURITY GUARD POSTINGS

The Government may elect to post armed security guards at all screening checkpoints and at the entrances to Government-occupied Space.

G. SECURITY GUARD PATROLS – MODIFIED

The Government may elect to provide exterior roving guard patrols which may be conducted four times each day during normal business hours. The security guard force, provided by the U.S. Department of Homeland Security Federal Protection Service, will be armed and equipped with a centralized radio network with incident response dispatch capability from the on-site central security control center. The Lessor and the Government shall develop in coordination with the Government’s Designated (security) Official, the security guard response SOPs to alarms and incidents to ensure full coordination and cooperation between the on-site Lessor representative and the Government tenant(s).

VII. CYBERSECURITY (SHELL *) –MODIFIED

A. Lessors are prohibited from connecting any portion of their Building and access control systems

(BACS) to any federally-owned or operated IT network. BACS include systems providing fire and life safety control, physical access control, Building power and energy control, electronic surveillance, or Building monitoring and control services (including IP addressable devices, application servers, or network switches).

B. In the event of a cybersecurity incident related to BACS, the Lessor shall initially assess the cyber incident, identify the impacts and risks to the Building and its occupants, and follow their organization’s cyber and IT procedures and protocols related to containing and handling a cybersecurity incident. In addition, the Lessor shall immediately inform the Lease Contracting Officer’s (LCO’s) designated representative, i.e., the Lease Administration Manager (LAM), about cybersecurity incidents that impact a federal tenant’s safety, security, or proper functioning.

C. Lessors are encouraged to put into place the following cyber protection measures in order to safeguard facilities and occupants:

1. Engineer and install BACS to comply with the Department of Homeland Security Industrial Control Systems Computer Emergency Response Team (DHS ICS-CERT) cyber security guidance and recommendations (https://ics-cert.us-cert.gov/Recommended-Practices).

2. Refer to the National Institute of Standards and Technology Cyber Security Framework (NIST- CSF) (https://www.nist.gov/cyberframework) and cybersecurity guidance in the DHS Commercial Facilities Sector-Specific Plan (https://www.dhs.gov/publication/nipp-ssp-commercial-facilities-2015) for best practices to manage cyber risks.

3. Encourage vendors of BACS to secure these devices and software through the following:

a. Develop and institute a proper Configuration Management Plan for the BACS devices and applications, so that the system can be supported.

b. Safeguard sensitive data and/or login credentials through the use of strong encryption on devices and applications. This means using NIST- approved encryption algorithms, secure protocols (i.e., Transport Layer Security (TLS) 1.1, TLS 1.2, TLS 1.3) and Federal Information Processing Standard (FIPS) 140-2 validated modules.

c. Disable unnecessary services in order to protect the system from unnecessary access and a potential exposure point by a malicious attacker. Examples include File Transfer Protocol- FTP (a protocol used for transferring files to a remote location) and Telnet (allowing a user to issue commands remotely). Additionally, use of protocols that transmit data in the clear (such as default ZigBee) should be avoided, in favor of protocols that are encrypted.

d. Close unnecessary open ports to secure against unprivileged access.

e. Monitor and free web applications and supporting servers of common vulnerabilities in web applications, such as those identified by the (Open Web Application Security Project (OWASP) Top 10 Project (https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project).

f. Enforce Least Privilege, where proper permissions are enforced on a device or application so that a malicious attacker cannot gain access to all data. Enforcing Least Privilege will only https://ics-cert.us-cert.gov/Recommended-Practices https://www.nist.gov/cyberframework https://www.dhs.gov/publication/nipp-ssp-commercial-facilities-2015 https://www.dhs.gov/publication/nipp-ssp-commercial-facilities-2015 https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project allow users to access data they are allowed to see. Additional information can be found at https://www.beyondtrust.com/blog/what-is-least-privilege/

g. Protect against Insufficient User Access Auditing, where device or application does not have a mechanism to log/track activity by user. Enforce changing of factory default Username and Password to prevent unauthorized entry into the BACS system.

h. Use updated antivirus software subscription at all times. Kaspersky-branded products or services, prohibited from use by the Federal Government, are not to be utilized.

i. Conduct antivirus and spyware scans on a regular basis. Patching for workstations and server Operating System (OS), as well as vulnerability patching should follow standard industry best practices for software development life cycle (SDLC).

j. Discontinue the use of end of life (EOL) systems and use only applications/systems that are supported by the manufacturer.

k. Operating Systems must be supported by the vendor for security updates (e.g., do not use Windows Server 2003).

l. Proposed standard installation, operation, maintenance, updates, and/or patching of software shall not alter the configuration settings from the approved United States Government Configuration Baseline (USGCB) or tenant agency guidance (if applicable).

m. Disallow the use of commercially-provided circuits to manage building systems and install building systems on a protected network, safeguarded by the enterprise firewalls in place.

Workstations or servers running building monitor and control systems are not connected and visible on the public internet.

n. Systems should have proper system configuration hardening and align with Center for Internet Security (CIS) benchmarks or other industry recognized benchmarks. Additional information can be found at https://www.cisecurity.org/cis-benchmarks/.

https://www.beyondtrust.com/blog/what-is-least-privilege/ https://www.cisecurity.org/cis-benchmarks/