A1d revised DCMA Security Design Guide V4.1.pdf

Version 4.1, 2.28.24

DCMA Security Equipment and Systems Design Specification

Maintenance Criteria

Version 4.1 – February 2024

Point of Contact: DCMA Physical Security Program Manager, 804-609-4047

Contents

1. Purpose:

2. Background:

3. General Requirements:

4. Upgrades and Installs – General:

4.7. Section 508 Accessibility Standards Notice (September 2009)

4.8. Warranty

5. Physical Access Control Systems (PACS):

5.1. General Requirements

5.2. System Configuration Requirements

5.4. Card Reader Requirements

5.5. Provide for data backup:

6. Video Surveillance Systems (VSS) and Cameras:

6.1. General Standards and Typical Design Concept:

6.2. Camera Minimum Standards:

6.3. Video Management System & Network Video Recorder Minimum Standards:

6.4. Monitor Minimum Standards:

7. Intercom Phone System:

7.1. General Requirements

8. Intrusion Detection Systems (IDS) Criteria:

8.1. General Requirements

8.2. Conduit

8.3. Motion Sensors

8.4. Contact Sensors

8.5. Panic Buttons

8.6. Duress Buttons

9. Door and Window Criteria:

10. Locksets:

11. Uninterrupted Power Supply and Power Related Items:

12. Cybersecurity and Information Assurance Requirements:

13. Training Requirements:

14. Warranty Requirements:

14.1. Provide a one-year all-encompassing warranty

14.2. Warranty shall feature:

14.3. Preventive maintenance (PM)

14.4. Provide prompt response to trouble calls:

14.5. Warranty exclusions:

15. Service Level Agreement (SLA) Specifications

15.1. Background:

15.2. SLA Common Standards for all levels

15.3. Standard A - Emergency Coverage

15.4. Standard B - High Priority Response Standards

15.5. Standard C - Priority Response Standards:

15.6. Standard D - Routine Response Standards:

15.7. Preventive Maintenance Interval and performance standard:

16. IDS Testing Protocol and Requirements

Motion Detection Sensor Testing

High Security Sensor (HSS) Testing

Tamper Testing

17. Software and Licenses:

18. Security Requirements:

18.1. Security Clearances:

18.2. Personnel Security Requirements:

18.3. Security Practices:

18.4. Controlled Unclassified Information (CUI)

18.5. Access To and Use of Government Information:

18.6. Access To and Protection of Proprietary Information:

18.7. Data Retention:

18.8. Access to U.S. Government computing assets

18.9. Physical Security:

19. Drawing and Design Specifications during buildouts:

1. Purpose:

To serve as a reference document that standardizes DCMA Security’s acquisition of Electronic Security System (ESS) related components and systems for initial installs, refurbishment and lifecycle upgrades and incremental expansion and upgrades. Additionally, it is used to enumerate maintenance requirements and standards, and certain record keeping requirements.

When used in conjunction with a contract Performance Work Statement (PWS), Statement of Objectives (SOO), or Statement of Work (SOW), this document becomes prescriptive in nature.

2. Background:

2.1.The Department of Defense (DoD) Agencies require a safe and secure environment for their workforce and to protect DoD assets in accordance with the following regulatory requirements:

DoD Instruction O-2000.16, Volume 1 “DoD Antiterrorism (AT) Program Implementation: DoD AT Standards,” DoD Instruction O-2000.16, Volume 2 “DoD Antiterrorism (AT) Program Implementation: DoD Force Protection Condition (FPCON) System,” USNORTHCOM Instruction 10-222, “USNORTHCOM Force Protection (FP) Mission and Antiterrorism (AT) Program," DoD Instruction 5200.08, “Security of DoD Installations and Resources and the DoD Physical Security Review Board (PSRB),” Unified Facilities Criteria 04-010-01, “DoD Minimum Antiterrorism Standards for Buildings,” Unified Facilities Criteria 04-010-02, “DoD Minimum Antiterrorism Standoff Distances for Buildings” Unified Facilities Criteria 04- 020-01, “Security Engineering: Facilities Planning Manual.”

2.2.Therefore, in accordance with the above established regulations, the Defense Contract Management Agency (DCMA) uses both infrastructure and equipment alongside Electronic Security Systems (hereafter referred to as ESS) to achieve these goals.

2.3.The ESS types used include, Personnel Access Control System (PACS), Video Surveillance Systems (VSS) (also called CCTV), Audio- and Audio/Video Intercom Systems, Intrusion Detection Systems (IDS), Intercom Phone System, Safety-serving Public Address (PA) or Mass Notification Systems (MNS).

2.4.The security systems need to be maintained to continue to provide adequate security coverage and provide life-safety.

2.5.DCMA requires recurring preventive and routine maintenance to guarantee an acceptable level of service and to extend the life of components.

2.6.Periodically, system components fail and require servicing, repair, or replacement.

Repair coverage shall include blanket coverage for all currently-installed ESS nationwide.

2.7.DCMA requires the ability to upgrade or expand systems, components, and software.

2.8.In general, through this design specification the Contractor shall provide all management, administrative, and technical support, expertise, supervision, labor, all materials, supplies and equipment (except as otherwise specified herein), necessary to plan, schedule, coordinate, and carry out the provisions of the PWS/SOW and the requirements of this document, as applicable.

3. General Requirements:

3.1.The Contractor shall furnish all personnel, required services, labor, tools, material, software, and equipment necessary to complete an installation for new and/or an upgraded ESS and all maintenance requirements.

3.2.The Contractor shall repair any damage to Government and government-leased property resulting from contractor activities/work and assure the property is returned to its original or a better condition upon completion.

3.3.The Contractor shall maintain the supporting equipment and its infrastructure, up to the point of connection with existing building distribution systems.

4. Upgrades and Installs – General:

4.1.Unless previous security systems have reusable network switches, new network switch(es) shall be provided by the contractor. No use of the DCMA/DoD network or network switchgear is permitted. Should efficiencies or cost savings be gained by using a sole network switch for all systems (PACS, IDS, VSS), a single switch is preferred.

4.2.The contractor shall provide all labor, materials, equipment, expertise, and software licenses necessary to install and test all systems/equipment to ensure proper operation.

4.3.Unless stipulated in the base PWS, to the maximum extent feasible, all wiring, components, and peripherals from the existing systems shall be reused so long as their use does not degrade or shorten the usable lifecycle of the new system(s). Where cabling, conduit, or similar elements of existing infrastructure from previous system are reusable, contractor may reuse after inspecting and testing. These reused items shall be warranted for the duration of the warranty period with no exclusions.

4.4. Unless stipulated in the base PWS the Contractor shall utilize existing infrastructure and cabling to the maximum extent practicable.

4.4.1. The contractor shall provide all labor and materials to pull new communication lines when necessary from the new location(s) to all associated equipment.

4.4.2. The contractor shall provide and install cables to include all necessary cabling, connectors, and components.

4.4.3. The contractor shall utilize industry best practices in running cabling and may utilize DCMA Network cable trays

4.4.4. Contractor shall utilize appropriate connectors and methods of installation and protection for all exterior mounted components or those in areas otherwise subject to weather or water.

4.5.The Contractor shall clean-up and remove all debris at the completion of a workday or an installation, whichever is first to ensure work areas are safe and egress from areas is not hindered.

4.6.The Contractor shall comply with the following requirements of the 2019 National Defense Authorization Act prohibitions:

FAR Clause 52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.

As prescribed in 4.2105(b), insert the following clause:

Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (Aug 2019)

(a) Definitions. As used in this clause—

“Covered foreign country” means The People’s Republic of China. “Covered telecommunications equipment or services” means–

(1) Telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation (or any subsidiary or affiliate of such entities);

(2) For the purpose of public safety, security of Government facilities, physical security surveillance of critical infrastructure, and other national security purposes, video surveillance and telecommunications equipment produced by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, or Dahua Technology Company (or any subsidiary or affiliate of such entities);

(3) Telecommunications or video surveillance services provided by such entities or using such equipment; or

(4) Telecommunications or video surveillance equipment or services produced or provided by an entity that the Secretary of Defense, in consultation with the Director of National Intelligence or the Director of the Federal Bureau of Investigation, reasonably believes to be an entity owned or controlled by, or otherwise connected to, the government of a covered foreign country.

“Critical technology” means–

(1) Defense articles or defense services included on the United States Munitions List set forth in the International Traffic in Arms Regulations under subchapter M of chapter I of title 22, Code of Federal Regulations;

(2) Items included on the Commerce Control List set forth in Supplement No. 1 to part 774 of the Export Administration Regulations under subchapter C of chapter VII of title 15, Code of Federal Regulations, and controlled-

(i) Pursuant to multilateral regimes, including for reasons relating to national security, chemical and biological weapons proliferation, nuclear nonproliferation, or missile technology; or

(ii) For reasons relating to regional stability or surreptitious listening;

(3) Specially designed and prepared nuclear equipment, parts and components, materials, software, and technology covered by part 810 of title 10, Code of Federal Regulations (relating to assistance to foreign atomic energy activities);

(4) Nuclear facilities, equipment, and material covered by part 110 of title 10, Code of Federal Regulations (relating to export and import of nuclear equipment and material);

(5) Select agents and toxins covered by part 331 of title 7, Code of Federal Regulations, part 121 of title 9 of such Code, or part 73 of title 42 of such Code; or

(6) Emerging and foundational technologies controlled pursuant to section 1758 of the Export Control Reform Act of 2018 (50 U.S.C. 4817).

“Substantial or essential component” means any component necessary for the proper function or performance of a piece of equipment, system, or service.

(b) Prohibition. Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. The Contractor is prohibited from providing to the Government any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless an exception at paragraph (c) of this clause applies or the covered telecommunication equipment or services are covered by a waiver described in Federal Acquisition Regulation 4.2104.

(c) Exceptions. This clause does not prohibit contractors from providing—

(1) A service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(2) Telecommunications equipment that cannot route or redirect user data traffic or permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(d) Reporting requirement.

(1) In the event the Contractor identifies covered telecommunications equipment or services used as a substantial or essential component of any system, or as critical technology as part of any system, during contract performance, or the Contractor is notified of such by a subcontractor at any tier or by any other source, the Contractor shall report the information in paragraph (d)(2) of this clause to the Contracting Officer, unless elsewhere in this contract are established procedures for reporting the information; in the case of the Department of Defense, the Contractor shall report to the website at https://dibnet.dod.mil. For indefinite delivery contracts, the Contractor shall report to the Contracting Officer for the indefinite delivery contract and the Contracting Officer(s) for any affected order or, in the case of the Department of Defense, identify both the indefinite delivery contract and any affected orders in the report provided at https://dibnet.dod.mil.

(2) The Contractor shall report the following information pursuant to paragraph (d)(1) of this clause

(i) Within one business day from the date of such identification or notification: the contract number; the order number(s), if applicable; supplier name; supplier unique entity identifier (if known); supplier Commercial and Government Entity (CAGE) code (if known); brand; model number (original equipment manufacturer number, manufacturer part number, or wholesaler number); item description; and any readily available information about mitigation actions undertaken or recommended.

(ii) Within 10 business days of submitting the information in paragraph (d)(2)(i) of this clause: any further available information about mitigation actions undertaken or recommended. In addition, the Contractor shall describe the efforts it undertook to prevent use or submission of covered telecommunications equipment or services, and any additional efforts that will be incorporated to prevent future use or submission of covered telecommunications equipment or services.

(e) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (e), in all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial items.

4.7. Section 508 Accessibility Standards Notice (September 2009)

4.7.1. This contract is subject to Section 508 of the Rehabilitation Act (the Act) of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, and the Architectural and Transportation Barriers Compliance Board (Access Board) Electronic and Information Accessibility Provisions (36 CFR Part 1194). Section 508 of the Act requires that, unless an exception applies, all communications products and services that require a contractor or consultant to produce content in any format that is specifically intended for publication on, or delivery via, a federally owned or federally funded website permit the following:

4.7.2. Federal employees with disabilities to have access to and use information and data that is comparable to the access and use of information and data by federal employees who are not individuals with disabilities.

4.7.3. Members of the public with disabilities seeking information or services from a federal agency to have access to and use of information and data that is comparable to the access and use of information and data by members of the public who are not individuals with disabilities.

4.7.4. Information about Section 508 of the Act is available at http://www.section508.gov/. The complete text of Section 508 can be accessed at http://www.access-board.gov/sec508/provisions.htm.

4.7.5. Typical requirements of Section 508 as applied to security systems contracts include documentation/materials and reports to be Section 508 compatible. This is typically done with standard desktop office software (e.g. Microsoft Office, Adobe PDF with appropriate settings. Section 508 also applies to the software used for administration of security equipment being 508 compatible. This is typically done via MS Windows native capabilities.

4.8. Warranty.

4.8.1. A warranty is required for all new equipment. The one-year warranty period begins after the completion of Contractor Verification Testing (CVT) and the successful completion of Government Acceptance Testing (GAT) including any follow-on regression testing. Because DCMA Security is centrally-managed requiring travel, GAT period shall be 30 days. Warranty shall feature:

http://www.access-board.gov/sec508/provisions.htm

4.8.2. Include full, equivalent coverage and provisions as stipulated in maintenance section of this document. Contractor shall:

4.8.2.1. Provide tracking and trouble ticket requirements after GAT is completed.

4.8.2.2. Respond in accordance with the SLA stipulated in the primary

PWS/SOW. Standard SLA requirements are found in the maintenance section of this document

4.8.2.3. Provide preventive maintenance at a periodicity as stipulated the base

PWS/SOW

4.8.2.4. Provide all software licenses/agreements for the entirety of the warranty period.

5. Physical Access Control Systems (PACS):

5.1. General Requirements

5.1.1. Vendor shall install standalone Physical Access Control System (PACS) which uses the DoD Common Access Card (CAC)/Federal Personal Identity Verified (PIV) Card.

5.1.2. PACS shall be sourced using approved components and configuration method from the APL however full Homeland Security Presidential Directive (HSPD)-12 /Federal Information Security Processing (FIPS) standard 201-2 compliance is not required unless specifically called out in the base SOW/PWS. Software must be Federal Information Security Processing (FIPS) standard 201-2 compliant.

5.1.3. The PACS will at this time not require validation with a Certificate Revocation List (CRL) or Online Certificate Security Protocol (OCSP) responder.

5.1.4. PACS configuration and methods shall be reviewed by an engineer possessing the Certified System Engineer, Identity, Credential, Access Management (ICAM) Physical Access Control System [CSEIP] credential issued by the Secure Technology Alliance. Review shall be annotated in a memo accompanying the design submittals and post-project report/submittals.

5.1.5. The configuration shall be Contactless Card + PIN (to PACS). Card readers shall be contactless and can use the Cardholder Unique Identifier (CHUID) attribute of the CAC. FICAM Card Authentication Key (CAK) certificates are not provisioned on the current CACs used by the DoD.

5.1.6. The Contractor shall install all other necessary access control devices, including request to exit (REX) motion sensors or other REX devices, as well as any currently-installed assisted opening devices.

5.1.7. All reader installation and access control devices shall meet Americans with Disabilities Act (ADA) compliance.

5.1.8. Install head-end equipment in a properly-secured room (to be determined in base PWS). DCMA policy requires that local management will ensure all PACS equipment (control panels, registration terminals, and other credential issuing equipment) is safeguarded and controlled so that just those authorized to issue credentials or enroll and grant permissions have access to them.

5.1.9. PACS shall not include proprietary locks

5.2. System Configuration Requirements

5.2.1. Override: The contractor shall provide the Command Control Display Equipment

(CCDE) operator (via the head-end) the capability of simultaneously overriding or locking out any or all of the personnel entry control points.

5.2.2. The system shall possess the capability to limit access based on such factors as Force Protection Condition (FPCON), duty schedules, access lists, etc.

5.2.3. System shall enroll data from the certificate data contained within the card or from an authoritative data source. Enrollment information will not be hand-entered.

5.2.4. PACS configuration shall support different user groups and access levels. This configuration shall be developed in coordination with local security and maintenance representatives and DCMA HQ Security personnel. Administration and enrollment should, in many cases, not run in full “admin”/full-control mode to prevent inadvertent system configuration changes beyond standard user privileges.

5.2.5. The setup of these requirements is a requirement of installation. Vendor must also develop and furnish enduring documentation of system configuration (e.g.

“Standard user group” provides access M-F, No weekends/holidays, 0600-1800, on doors X, Y, and Z, The software button marked “lockdown” locks all doors except XX, etc.)

5.3. Provisioning, Printers, and Card Stock

5.3.1. Unless described in the base PWS, new card printers or FIPS/FICAM card provisioning systems are not required as DoD personnel are issued Common Access Card (CAC) smartcards by the DoD.

5.3.2. If, due to reader or system configuration, the system cannot use standard proximity cards, to facilitate visitors who do not have CACs/PIVs, vendor shall furnish blank Personal Identity Verification – Interoperable style cards. The quantities below are guidelines and specifics will be determined in base PWS:

• Small Offices (10 cards)

• Medium Offices (15 cards)

• Large Offices (20 cards)

• Regional HQ (40 cards)

5.4. Card Reader Requirements.

5.4.1. Card Readers Must:

5.4.1.1. Incorporate two means of authorizing access at exterior doors to DCMA controlled space and other locations where general access is restricted (example: design systems to require both an access credential and a personal identification number before access is granted, similar to that employed by DCMA computer network systems).

5.4.1.2. All reader installation and access control devices shall meet Americans with Disabilities Act (ADA) compliance.

5.5. Provide for data backup:

5.5.1. In order to ensure data continuity and protection, the vendor shall furnish a backup hard drive which becomes the property of the government.

5.5.2. The drive must be capable of storage and encryption of all data at rest, to industry encryption standards.

5.5.3. The intent is for the local government security staff to periodically connect the drive to the PACS and an automated backup of all configuration and database be transferred. This connection and backup will occur on a schedule determined by the local security representative. The remainder of the time the drive would be disconnected and secured.

5.5.4. At every PM visit, the vendor shall also inspect the drive to ensure backups are being successfully completed, and complete an additional vendor-conducted backup at that time.

6. Video Surveillance Systems (VSS) and Cameras:

6.1. General Standards and Typical Design Concept:

6.1.1. Vendor shall design the system and site the cameras, monitors, and components based upon the concept and minimum standards below.

6.1.1.1. When sketches or numbers of cameras are specified in the primary PWS/SOW, they should be viewed as recommended or conceptual, with the specific design methodology left to the vendor to propose.

6.1.1.2. Generally, camera sighting will be indicated on a camera schedule and indicate approximate direction/focal point, approximate distance, and where the camera feed should display. If no display is noted, the camera will likely be fed to the Video Management System (VMS)/Network Video Recorder (NVR), for use after an incident and/or monitored on a large multiplexed display by a security representative.

6.1.2. Components (monitoring station, network video recorder (NVR), cameras, etc.)

shall be protected against unauthorized use, manipulation or damage.

6.1.3. VSS installation must include the installation of warning signs alerting personnel that the area is under surveillance if such signs are not already present from a previous project.

6.1.4. Typical design elements:

6.1.4.1. Cover outside of entrance/exit doors leading to DCMA space with monitor inside all entry doors

6.1.4.2. Cover interior critical spaces (e.g. network nodes, secure rooms, guard stations).

6.1.4.3. Cover exterior spaces and assets such as building generators, government vehicle parking lots, complex vehicle entrances, parking areas, etc as applicable.

6.1.4.4. Record and also display video at a primary monitor or monitors, typically located at the security representative’s office, subject to diagram location or local office management guidance

6.2. Camera Minimum Standards:

6.2.1. Possess the ability to detect and track movement

6.2.2. Operate in extremely low light (0.2 lux) or be supplemented with infrared illuminators that cover the same visual range and distance to provide equivalent level of image quality.

6.2.3. Record at 30 frames per second (FPS)

6.2.4. Be digital, high-definition (1080p) unless otherwise specified, and be sited to capture/display at not less than 50% Rotakin standard without digital zoom.

6.2.5. Must feature the ability to adjust to bright or low light without losing image clarity.

6.2.6. Interior camera placement will be limited to those areas where a reasonable expectation to privacy does not exist (doorways, hallways, stairwells, common areas, etc.). Camera sighting will be subject to written approval from the DCMA security project manager.

6.2.7. When installed interior to the space to be focused on specific assets or common areas, cameras should still not be installed above or immediately adjacent to areas such as cubicles or lavatories.

6.2.8. Exterior mounted cameras and all supporting equipment/accessories shall be adequately protected from weather.

6.3. Video Management System & Network Video Recorder Minimum Standards:

6.3.1. Where appropriate, these systems will integrate with any alarm systems and/or

PACS deployed at the location. Unless specifically excluded in the underlying PWS/SOW, VSS shall be integrated with other ESS such that alarm/events are either tagged within the VSS event/alarm log for rapid call-up and where pan/tilt, pan/tilt/zoom, or digitally zoomed cameras are used, that the camera either slews to the cue or focuses on the alarm/trigger event and allows for rapid alarm investigation. (example: if an alarm or door prop incident is activated, the surveillance system should immediately focus on the alarmed area and/or tag that event into the video management system events log for rapid call-up and alarm investigation when system is being actively monitored).

6.3.2. Feature open video management software and not a vendor-specific file types.

System shall be export-capable using open industry standards, to CD/DVD/External hard drive should an incident take place requiring investigation. Captured images shall be streamed using industry standard compression techniques. No proprietary file types are permitted.

6.3.3. Digitally record activity and feature sufficient storage capacity for all camera feeds, to be stored at un-compressed resolution, at a minimum of 30 days.

Framerate during storage can be reduced to 15 FPS after 10 days (note this differs from minimum camera standards. To control costs, frame rate can be decremented upon storage.

6.3.4. System configuration shall be set to retain surveillance system recordings for a period of 30 days or greater before over-writing.

6.4. Monitor Minimum Standards:

6.4.1. Monitors (wall-mounted and desktop) must handle the pixel rate from the cameras without image degradation.

6.4.2. Wall mounted primary displays: shall be high definition and minimum 42” or larger. Mount shall be sturdy and be capable of either locking into place or pivoting/tilting.

6.4.3. Door-side monitors: shall be high definition and typically 22-24.” Mount shall be sturdy and be permanently locked into place so that office occupants can view the camera feeds from the distant (attack) side of the door.

6.4.4. Desktop: shall be high definition and typically 22-24.” Desktop monitors are typically placed on desks but may need to be mountable for security representatives/management that use sit-to-stand, or standup desks or other configurations.

7. Intercom Phone System:

7.1. General Requirements

Install master station phone(s) that connects to the Exterior Door Intercom and provides full visual of exterior walkway in front of door(s). User must be able to remotely open exterior door from master phone station. Master phone stations should be in a centralized office area. Final master phone station placement determined by DCMA occupants with approval by DCMA Security Project Lead. Install additional 75 feet of cabling placed above ceiling tiles in the event phones need to be moved at a later date.

8. Intrusion Detection Systems (IDS) Criteria:

8.1. General Requirements

8.1.1. In the vast majority of cases, DCMA utilizes the Federal Protective Services, MegaCenter for alarm monitoring. Unless specified in the underlying PWS/SOW, the IDS must be compatible with the MegaCenter’s monitoring capability. Systems shall meet the requirements listed in the FPS MegaCenter Alarm Requirements

(MAR).

8.1.2. The Contractor shall incorporate a control unit that receives alarm and tamper signals from the sensors and passes appropriate signals to the monitoring center.

8.1.3. The IDS shall possess line supervision that constantly monitors voltage/amperage from the alarm sensor to the control unit.

8.1.4. The contractor shall provide and install a surge-protected battery backup sufficient to provide a minimum of 4-hours of backup capability. Should efficiencies or cost savings be gained by using a sole backup power supply for all systems (PACS, IDS, VSS), that would be preferred.

8.1.5. All commercial IDS system components shall be UL listed.

8.1.6. The Premise Control Units (PCU) and Control Panels shall be installed inside the secured area (within DCMA controlled space).

8.1.7. The head-end shall be located within a secured space, typically within a Security

Room or LAN closet. Specific location will be called out in the underlying PWS/SOW. This head-end shall feature tamper alarms.

8.1.8. The contractor shall submit an alarm permit with the local county law enforcement office if necessary and be expected to input necessary information in to the MAR form.

8.1.9. The Arm and Disarm panels, if not integrated with the access control system keypads, shall be located per the underlying PWS/SOW, and typically a minimum at two (2) locations per floor.

8.1.10. Cross zoning (the requirement of two or more sensors to be activated in a specific amount of time before activating an alarm) should be avoided.

8.1.11. Door contacts should be installed on the opening side of the door and should not allow the door to open far enough to provide the ability to tamper with the contact inside the door without going into alarm.

8.1.12. Double doors – Double doors or split doors should be zoned on each leaf, not both doors on one zone.

8.2. Conduit

8.2.1. All IDS cabling shall be secured in metal conduit or imbedded in the wall of the facility so as to prevent easy access and to facilitate the detection of attempted manipulation.

8.2.2. Where cabling must extend to sensors from outside of walls/hard-capped ceilings, flexible metal conduit or armored cabling is permitted.

8.2.3. Where unique or difficult circumstances are encountered that preclude standard conduit, flexible metal conduit may be permissible after discussion with the security project manager.

8.2.4. When panic or duress buttons are stipulated, conduit for those sensors/buttons are not mandatory. Wireless functions are permissible as well.

8.3. Motion Sensors

8.3.1. High Security Motion Sensors shall meet the requirements of and be listed as compliant with Underwriters Laboratory (UL) standard 639.

8.3.2. Standard Sensors: sensors must be UL listed but need not be UL 634.

8.4. Contact Sensors

8.4.1. High Security Switches (HSS), also known as High Security Sensors shall meet the requirements of and be listed as compliant with Underwriters Laboratory (UL) standard 634.

8.4.2. Standard Sensors, also known as balanced magnetic switches (BMS) sensors must be UL listed but need not be UL 634.

8.5. Panic Buttons

8.5.1. When specified in the accompanying, the IDS shall also feature a single “panic button” near each perimeter door on each floor capable of being activated to summon a police/armed security response in the event of a hostile event/active shooter incident.

8.5.2. The button shall be installed in such a means to preclude easy accidental activation (e.g. covered in a clear plastic housing that must be raised before button is pushed).

8.5.3. This button shall be easily distinguishable from a fire alarm (e.g. blue vs. red) and state Emergency, Police, or similar text.

8.5.4. The configuration of panic buttons shall operate in overt alarm annunciation status (as opposed to covert/silent alarm annunciation).

8.5.5. Panic button cabling need not be in conduit and may be wireless unless specified to the contrary unless specified to the contrary in the base PWS.

8.6. Duress Buttons

8.6.1. When specified in the accompanying PWS/SOW, the IDS shall also feature duress buttons capable of being surreptitiously activated to summon a police/armed security response in the event of a hostile event.

8.6.2. The button shall be installed in such a means to preclude easy accidental activation and concealed to allow for surreptitious activation.

8.6.3. The configuration of duress buttons shall operate in covert/silent alarm annunciation status.

8.6.4. Duress button cabling need not be in conduit and may be wireless unless specified to the contrary in the base PWS.

9. Door and Window Criteria:

9.1.When an ESS project requires new exterior or critical interior doors or door hardware, the following are applicable:

9.1.1. Exterior doors with access to DCMA occupied space will provide an equivalent level of protection as that of exterior wall construction featuring solid core wood or metal construction. No glass insets are to be used either on the door or as part of the door frame. Doors shall not include sidelights. Any transom lights planned for the design must be approved by DCMA Security.

9.1.2. Exterior doors will be equipped with a deadbolt or other locking device that provides a similar level of protection.

9.1.3. Latches on exterior doors will extend at least one inch into the strike plate and include a latch guard in order to protect from easy manipulation.

9.1.4. For doors with panic exit bars that utilize a wedge-shaped latch, utilize the highest commercially available grade of latch.

9.1.5. For electromagnetically retained doors (maglocks), ensure the lock has a minimum of 1,200lbs of shear strength and either features a minimum 4-hour backup power capability or fails secure during power interruptions.

9.1.6. Hinges/Hinge Pins to exterior doors will be protected to prevent easy removal (mounted on the interior of DCMA controlled space, peened, spot welded, etc.);

nails will not be used to hang door hinges.

9.1.7. If using double doors there will be no more than a 4mm gap between doors and astragal will be utilized to fill the gap between the doors.

9.1.8. Interior office doors must be constructed of solid wood with no windows.

9.1.9. Doors must meet all Fire Code requirements and any security design requirements. Fire Codes in conflict with security design will be coordinated with the DCMA Security Project Manager for a resolution.

9.2. When an ESS project requires window coverings, reflective film and/or fragmentation film, the following are applicable:

9.2.1. Window furnishings such as blinds or reflective film on all exterior windows to completely obscure exterior view into DCMA office space.

9.2.2. If blinds are used, they should be able to be opened from the inside so DCMA personnel can see out as required and should cover entire window. Blinds must ensure that person’s exterior of the building are unable to see silhouettes of personnel inside the building.

9.2.3. If reflective film is used, DCMA employees should be able to see out and personnel outside should not be able to see inside the space at all times.

9.2.4. Fragmentation film is required for GSA & USACE leased facilities with an Facility Security Level (FSL) rating of III or higher.

9.2.5. Use acceptable fragment retention film or preferred glazing systems to reduce the glass fragmentation hazard is required in FSL III level facilities. Film composite strength and elongation rate measured at a strain rate not be less than the following criteria. Acceptable fragment retention film is defined as “shall meet or exceed the following criteria: yield strength: 12,000 psi, elongation at yield: 3%, longitudinal tensile strength: 22,000 psi, traverse tensile strength: 25,000 psi. longitudinal elongation at break: 90%, and traverse elongation at break: 75%.

9.2.6. Use window glazing or treatments to achieve a Low Hazard Rating in accordance with ASTM F2912-17 (Standard Specification for Glazing and Glazing Systems Subject to Air blast Loadings). Typically, this includes a daylight application of 7 mil retention/blast film supported by structural silicone attaching the film to the frame, with at least 1/2 inch of “bite to achieve the minimum recommendation for improving the performance of annealed glass windows. This is a requirement for all FSL IV facilities and higher.

10. Locksets:

10.1. Exterior doors will be equipped with a deadbolt or other locking device that provides a similar level of protection.

10.2. Latches on exterior doors will extend at least one inch into the strike plate and be protected from easy manipulation.

10.3. For interior doors where deadbolts are called-out in the underlying PWS/SOW, bolts must extend sufficiently into the strike plate to withstand amateur attempts to breach them (e.g. ramming with shoulder/kicking).

10.4. Interior door locking mechanism must include handles that have the ability to lock the door from inside using a thumb turn or pushbutton lock. Locks must be able to open using a key.

10.5. For doors with panic exit bars that utilize a wedge-shaped latch, utilize the highest commercially available grade of latch.

10.6. Key Control. The Contractor shall develop procedures covering key control that shall be included in the Quality Control Plan. For efforts that require the installation of new door locks, locking mechanisms, and cores, key control must also be established for those new locks from the outset until turn-over to the government.

10.7. Magnetic Door Locks shall not be installed on perimeters doors that allow access to DCMA occupied space. In the event of power failure, magnetic locks are designed to operate in a “FAIL/SAFE” mode which allows free access to DCMA space without use of a credential or key. If magnetic door locks must be used, the following conditions must be met.

10.7.1. The DCMA office is in a facility that has a backup emergency generator, and it is verified that the entire ESS is powered by the generator in the event of a power failure.

10.7.2. If the building does not have a generator that supplies power to the entire ESS, the door on which the magnetic lock is installed, has a commercial grade, key operated, lock set installed so that in the event of a power failure, and the magnetic lock defaulting to FAIL/SAFE, the doors can be secured unitizing a physical key.

10.8. Magnetic locks can be used on interior doors provided the space does not contain, store, or process classified material, and the door has a locking device installed as identified in paragraph 10.7.2.

10.9. Electric strikes are the preferred locking devices that shall be installed on perimeter doors that allow access to DCMA occupied space. ESL Sets used in DCMA access control systems shall be heavy duty, industrial grade. In the event of power failure, electric strikes are designed to operate in the “FAIL/SECURE” mode. All doors that have an Electric Strike lock set installed, shall have a key override installed within the lockset, that allows for authorized personnel, with a key, to allow emergency services to access the space in the event of a power failure. “FAIL/SECURE” mode operation allows DCMA personnel to exit the space during an emergency involving the loss of power, but prevents unauthorized personnel from accessing the space, unless they have an issued key.

10.10. Where Electric Strikes are installed, request to exit (REX) sensors shall not be installed above or in the vicinity of the door. This is to prevent the door from releasing in the event individuals inside the DCMA space, walk by and release the door.

11. Uninterrupted Power Supply and Power Related Items:

11.1. Head ends and control devices shall feature adequate surge protection.

11.2. The Contractor shall connect all equipment and systems to power circuits that have the capacity to support the additional electrical load.

11.3. For circuits that are connected to back up generators, the backup power capability stipulated within the subordinate PWS’ is in addition to the time notionally-provided by the generator to provide for cut-over and subsequent refueling time as needed for longer-duration outages.

11.4. Should efficiencies or cost savings be gained by using a sole backup power supply for multiple systems (PACS, IDS, VSS), that would be preferred.

11.5. Unless otherwise noted, any new circuits and power outlets required for any new components are the responsibility of the contractor.

11.6. When backup power supplies are used, after all other components are installed and functional, the vendor shall conduct a full power-out test through full battery discharge to validate installed battery life meets the time stipulated for all ESS types.

11.6.1. The vendor shall also confirm that upon restoration of grid power, that all components remain functional, or return to function after a restart.

11.6.2. If a particular restart/reset sequence is required, vendor shall document the process and cover during the training described in Section 12.

11.6.3. Vendor shall describe the results of this power-out test in the reports section of the underlying PWS/SOW.

11.6.4. The government reserves the right to witness and validate the power-out test.

Therefore, the vendor shall coordinate the test with local management and the DCMA Security Division.

11.6.5. When an Uninterrupted Power Supply (UPS) is required, it must provide uninterruptible emergency power to essential electronic security systems for a minimum of four hours. If an Intrusion Detection Systems (IDS) is installed it shall have an internal uninterrupted power supply. The power shall be in the form of a 12 volt battery, located inside the premise control unit that receives a trickle charge during day to day operations. The battery shall have the capacity to provide emergency backup power to the IDS system for eight (8) hours in the event of primary power failure. Batteries shall be inspected, and voltage tested during preventive maintenance inspections. Batteries that fail to maintain sufficient voltage, or show signs of excessive charging such as bulging, or leakage shall be replaced immediately. Regardless of test results, batteries shall be replaced every three years from installation date. Date of battery installation shall be written on the side of the battery by the technician installing the battery.

12. Cybersecurity and Information Assurance Requirements:

Vendor shall reference the DCMA Security Cybersecurity Requirements for Air-Gapped Systems for all cybersecurity requirements. The requirements contained within the referenced document are prescriptive and to be construed as part of this overarching design specification, organized under separate cover for ease of use.

13. Training Requirements:

Provide hands-on training on all new equipment to DCMA employees who will use the equipment

• Training date(s) to be coordinated with local Security representatives or security staff and ensure the COR is advised upon completion.

• For any newly-installed equipment, the Contractor shall incorporate instructor-led and hands-on training.

• The instructor shall demonstrate the use of the system as part of the instruction.

• The instructor shall teach by example, followed by the student having the opportunity to use the system as well.

• This hands-on training will effectively reinforce previously presented material.

• Contractor shall consent to recording of the training session by the government for future reference.

• Provide prior to the training, not later than 15 days from the conclusion of the install, all applicable references, manuals, guides, and training aides to the Government in, at a minimum, soft-copy on CD/DVD. Hard copy is preferred.

14. Warranty Requirements:

14.1. Provide a one-year all-encompassing warranty.

14.1.1. The one-year warranty period begins after the completion of Contractor Verification Testing (CVT) and the successful completion of Government Acceptance Testing (GAT) including any follow-on regression testing.

14.1.2. To facilitate data tracking, every maintenance visit will result in a PM report. The report must include the issue being addressed unless its preventive maintenance and the resolution to fix the issue.

14.1.3. Any call for service will be issued a ticket number and be recorded in a tracking system. Upon remedy, the ticket system must include approximate time spent on-premises.

14.1.4. PM logs are to be submitted semi-annually to the COR on the 15th day of the following month.

14.1.5. The final PM report shall be due no later than 15 days prior to the end of the warranty period.

14.2. Warranty shall feature:

14.2.1. Contractor-provided maintenance to full system function in accordance with industry standards for each type of system.

14.3. Preventive maintenance (PM)

14.3.1. PM shall meet the following criteria and each PM visit shall result in a report.

For new system installs, contractor shall provide biannual PM; specifically PM twice during the 1-year warranty period.

14.3.2. The first PM visit shall occur between the third and fifth month of warranty coverage and the final PM visit shall occur between the final 60 and 30 days prior to the end of the warranty period.

14.3.3. Scheduling of preventive maintenance shall be the responsibility of the contractor.

Should the contractor encounter difficulty in contacting or scheduling of visits, the contractor PM shall notify the responsible COR and Alternate COR or the DCMA Security Management chain.

14.3.4. Contractor shall:

14.3.4.1. Conduct standard diagnostics and preventive maintenance checks at the system and all significant components

14.3.4.2. Provide firmware and software patches

14.3.4.3. Provide routine maintenance, and

14.3.4.4. Conduct recommended file and database backup and maintenance protocols

14.3.4.5. Ensure camera siting and aiming are sufficient to meet the intent of the camera, and re-aim fixed cameras upon request of the local office.

14.3.4.6. Provide abbreviated refresher training on the use of the installed systems

14.3.4.7. The contractor shall document names and obtain student initials, along with a brief description of the training offered or document refusal from the office if training was not desired.

14.4. Provide prompt response to trouble calls:

14.4.1. Response and repair timeline requirements are broken into 4 levels called Service

Level Agreements (SLAs). The SLAs are enumerated in Section 5, Service Level Agreement (SLA) Specifications.

14.4.1.1. Receive and respond to trouble calls or tickets within parameters specified below.

14.4.1.2. Operate a single common point-of-entry for calls for service such as a nationwide telephone number or website. Email/ website-entry, while a preferred feature, shall not be the sole means to enter information.

14.4.1.3. Diagnose, troubleshoot, dispatch, and repair all systems to minimum standard specified below.

14.4.1.4. Ensure prompt system fixes.

14.5. Warranty exclusions:

14.5.1. Failures or degradation caused by the following are the only exceptions to contractor coverage: Acts of Nature (e.g. lightning strike), power surges when systems are not adequately protected by surge suppression at the outset of a maintenance contract, water damage in areas not normally exposed to weather or connected to weather-exposed components (e.g. sprinkler system leak in the server room), vandalism or intentional misuse.

14.5.2. Batteries to include IDS/PACS/Door Controller batteries and other consumable supplies such as badge printer ribbons/laminate overlays. This also includes the battery component of uninterruptable power supplies (UPS) after the UPS factory warranty period or one year from government acceptance, whichever is longest.

14.5.3. If failures are discovered that are specifically excluded in accordance with this paragraph, all work must immediately cease, and the technician shall contact the contractor PM, the COR, and Contracting Officer. Work performed in violation of this element shall fall under the provisions of No Payment for Unauthorized Work.

No payments will be made for any unauthorized supplies and/or services or for any unauthorized changes to the work specified herein. This includes any services performed by the Contractor of their own volition or at the request of an individual other than a duly appointed Contracting Officer. Only a duly appointed Contracting Officer is authorized to change the specifications, terms, and conditions under this effort.].

15. Service Level Agreement (SLA) Specifications

15.1. Background:

15.1.1. DCMA requires differing levels of service for different locations based upon the assets contained within the space.

15.1.2. The government also requires differing level of service based upon system type and location. This means that some locations may need higher priority response than others, based upon their assets.

15.1.3. Details of the minimum SLA can be found…