Appendix 3-FDA Physical Security Requirements.pdf

PHYSICAL SECURITY

REQUIREMENTS

For FDA facilities

06/26/2024

This document is to provide the physical security requirements of GSA leased facilities. It covers both single occupancy and multi-tenant buildings. This document supersedes any other Electronic Security requirements that may exist.

Contents

I. INTRODUCTION

SECTION I. FDA SOLE OCCUPANT

PERIMETER FENCING

PERIMETER LIGHTING

FIRST FLOOR WINDOWS

PERIMETER DOORS

FIRE DOORS

SHIPPING AND RECEIVING DOORS (SOLE OCCUPANT ONLY)

MAIN ENTRANCE (ACCESS CONTROL SYSTEM) (More than one entry may be controlled)

ROOF HATCHES/ROOF DOOR (APPLIES FOR SOLE TENANT OR OCCUPATION OF TOP FLOOR)

GARAGE AREA (INSIDE PARKING)

SECURED AREA FOR GOVERNMENT VEHICLES

PERIMETER PARKING

INTERIOR CONTROLLED AREAS

ADDITIONAL ELECTRONIC ALARM /SURVEILLANCE EQUIPMENT

GUARD SERVICE

CLEANING PERSONNEL

MAINTENANCE PERSONNEL

OVERALL SECURITY

INTERIOR WALLS/CORRIDOR WALLS

WINDOWS

LIGHTING

PERIMETER DOORS TO FDA SPACE

INTRUSION DETECTION/ACCESS CONTROL SYSTEM

PROTECTION OF GOVERNMENT VEHICLES

SECTION II. FDA OCCUPANT IN MULTI-TENANT BUILDING

OVERALL SECURITY

INTERIOR WALLS/CORRIDOR WALLS

WINDOWS

LIGHTING

PERIMETER DOORS TO FDA SPACE

SECTION III. ACCEPTANCE AND CUTOVER

Testing

System programing

Acceptance and Cut over .......................................................................... Error! Bookmark not defined.

ATTACHMENT A Special contract requirements

ATTACHMENT B Typical Security Drawings

ATTACHMENT C Monitor Dynamics certified dealers

PHYSICAL SECURITY REQUIREMENTS/SPECIFICATIONS

FOR

FDA-OCCUPIED SPACE

I. INTRODUCTION

The following physical security requirements and specifications have been developed to assist in the development of the Program of Requirements (POR) for new facilities, and/or solicitation requirements involving GSA leasing agreements where relocation is required.

1. Specific use of brand names or model type may be included in some instances as a guide to the type of equipment required, and should not be misconstrued as a specific requirement, unless a specific type or model has been noted as part of the requirement. Specific security requirements will be determined upon selection of facility.

2. Monitor Dynamics Inc (MDI)- is the current Access Control System used by FDA for Access

Control and Intrusion Detection at FDA facilities.

3. Bosch- is the current Video Camera System used at FDA facilities.

4. LifeSafety- Power supplies shall be LifeSafety Power with NetLink integration

NOTE: All facilities will meet the minimum-security standards as set forth in the Interagency Security Committee Design – Basis Threat and Physical Security Criteria for Federal Facilities. These categories are based on such factors as size of a facility, number of employees, and use and mission of the agency. These categories range from Level I to Level V.

For further guidelines pertaining to physical security protection refer to the Code of Federal Regulations sections reference below.

41 CFR 101-20.103-1; Standard Protection 41 CFR 101-20.103-2; Special Protection

This document is meant to be a guidance in procuring an acceptable Electronic Security System for FDA Physical Security Office. This document is not a statement of work. A Statement of Work will be submitted once space is selected and floor plans are made available along with space usage.

SECTION I. FDA SOLE OCCUPANT

NOTE: All facilities will meet the minimum-security standards as set forth in the Interagency Security Committee Design – Basis Threat and Physical Security Criteria for Federal Facilities. These categories are based on such factors as size of a facility, number of employees, and use and mission of the

PERIMETER FENCING

1. The perimeter fence will be 8' chain link fence, zinc-coated, No. 9-gauge fabric, non-climbing mesh opening not larger than 2", twisted and barbed selvage at top and bottom. Top rail or top tension wire should be provided in addition to bottom tension wire if a bottom rail is not utilized. Fence should include a double overhang top guard extending 45 degrees outward and inward, 12-gauge three strand barbed wire six inches apart affixed to top of fence post running the entire perimeter fence line, to include gate(s).

2. Gates will consist of the above specifications (fabric) and overhang top guard. Gate opening, (swing, slide, single, or double) will be determined prior to construction.

PERIMETER LIGHTING

1. The FDA standard for foot candles, horizontal plane at ground level is from 2.5 and shall be used for perimeter lighting, exact illumination will be determined for the following areas once the building site has been selected:

- Perimeter of outer Area (fence line)

- Vehicle entrance

- Building face boundary

- Parking lot

- Pedestrian entrance/exit

- Shipping & receiving area

2. Perimeter security lighting should be placed on the Emergency Power Backup Supply.

FIRST FLOOR WINDOWS

1. Permanently sealed.

2. Windows shall be covered with mylar film and anchored

3. Alarmed passive inferred motion detectors in each room containing a window that is below 12 feet.

Detectors will be monitored by the FDA Security Command Center. Monitor Dynamics Inc (MDI) is the current Access Control System manufacture used by FDA.

PERIMETER DOORS

1. Doors will be equipped with interior hinges. If hinges are exterior, hinges will be "pinned" or "spot-welded" to prevent pins or door from being removed. Interior hinges are preferred.

2. If entrance doors are glass, or entryways contain glass panels, all glass will be equipped with alarmed shock sensors or glass break detectors monitored by the FDA Command Center (central alarm station).

3. If entrance doors are glass, doors shall be equipped with a frame that can accommodate an electric strike (fail secure).

4. "Jimmy plates", or "astragals" will be permanently affixed to entry doors over locking mechanism to prevent tampering with door lock.

5. Doors shall be equipped with high security locks the support the Schlage large format core security locks shall be keyed separately from the interior building master key system. All card reader doors will be keyed alike on a separate master system.

6. Doors equipped with card readers will require locking hardware which will be electric strikes (fail secure).

7. Door that are all glass should be avoided.

Monitor Dynamics Inc (MDI) is the current Access Control System manufacture used by FDA.

8. All perimeter doors will be equipped with recessed magnetic door intrusion alarm contacts including doors with card readers.

9. Door alarms will be monitored by FDA Security Command Center.

10. Doors scheduled for access control shall have a REX motion detector, door position switch, card reader, electronic unlocking device that meets NFPS and local building codes.

FIRE DOORS

1. Fire doors will meet all fire standards/codes, (NFPA or local codes).

2. Doors will have, as a minimum, two-point locking latch.

3. Interior hinges.

4. Exterior knob sets, handles, or latches will not be installed, or removed if present.

5. Doors will be equipped with recessed magnetic door intrusion alarm contacts.

6. Door alarms will be monitored by FDA Security Command Center.

SHIPPING AND RECEIVING DOORS (FDA SOLE OCCUPANT ONLY)

1. Metal type roll-up door.

2. Electrically powered with key-controlled "on/off" system.

3. Manual chain in the event of power failure.

4. Floor mounted/door mounted balanced magnetic door intrusion alarm contacts.

5. Door alarms will be monitored by FDA Security Command Center.

MAIN ENTRANCE (ACCESS CONTROL SYSTEM) (More than one entry may be controlled)

REQUIREMENTS

5. Locking hardware will be electric strikes (fail secure).

6. System will have a key override feature to deactivate door lock if required.

7. Card access system will be tied into generator and UPS system.

8. Install a Building Access Control System per specification outlined by the FDA Physical Security

Branch. Monitor Dynamics Inc (MDI) is the current Access Control System manufacture used by

FDA.

9. Interior shunt (mounted in panic hardware) to deactivate alarm upon egress during security hours.

10. Access system will have minimum 24-hour back-up battery for system memory in the event of power failure.

ROOF HATCHES/ROOF DOOR (APPLIES FOR SOLE TENANT OR

OCCUPATION OF TOP FLOOR)

REQUIREMENTS

1. Hollow metal.

2. Interior hinges.

3. Locking mechanism will be a double cylinder Schlage or similar high security lock (deadbolt) with a minimum1 inch-bolt throw. Lock will not be keyed on the master perimeter system.

4. Card reader doors will be keyed alike.

5. Doors will be equipped with card reader. Monitor Dynamics Inc (MDI) is the current Access Control System manufacture used by FDA.

6. Door will be equipped with recessed magnetic intrusion door alarm contacts that are will be monitored by the FDA Security Command Center.

GARAGE AREA (INSIDE PARKING)

1. Metal type roll-up door.

2. Electrically powered with key-controlled "on/off" system.

3. Manual chain in the event of power failure.

4. Floor mounted/door mounted balanced magnetic door intrusion alarm contacts.

5. Door alarms will be monitored by FDA Security Command Center.

6. If a pedestrian door is part of the overhead door, or is separate, it will be equipped with recessed magnetic door intrusion alarm contacts.

7. Garage door will be equipped with heavy-duty floor mounted contacts. Door alarm will be monitored by the FDA Security Command Center.

8. Card access will be required to access garage with loop detector for egress from garage.

SECURED AREA FOR GOVERNMENT VEHICLES

1. If an outside, secured area has been provided for government vehicles, i.e. fenced area, the same specifications shall be used as outlined in perimeter fencing except that the height may be 6 feet in lieu of 8 feet.

2. Gate type will be developed during construction, i.e. swing, slide, double or single gates, etc.

3. Lighting requirements must meet lighting standards for parking lots per Federal Facilities and ISC

Security Design Criteria.

PERIMETER PARKING

1. All FDA facilities must have minimum set back requirements as specified under the Federal Facilities and ISC Security Design Criteria.

2. Control of parking to include gates, bollards, and physical barriers, arms, guard houses, loop detectors, etc.

3. Control of adjacent parking where necessary.

4. Poles for camera installation.

5. Card readers for gate or arm entrance.

6. Closed circuit television (CCTV) surveillance cameras with digital recorders and emergency call stations if necessary.

INTERIOR CONTROLLED AREAS

The following areas have been designated as Controlled Areas:

Solvent storage area/alcohol storage IT and IT equipment room Drug vault or drug storage room Sample storage room Document room Bio-Safety Level 3

REQUIREMENTS

1. Perimeter walls shall be true “slab-to-slab”.

2. Entrance doors to these areas will be hollow metal or solid wood.

3. Interior hinges, or "pinned" or "spot-welded" pins if exterior hinges.

4. Doors shall be equipped with high security locks that support the Schlage large format core. Security locks shall be keyed separately from the interior building master key system. All card reader doors will be keyed alike on a separate master system.

5. Doors with card readers must be equipped with an electric strike (fail secure) and a storeroom function knob lock with a high security cylinder as noted in number 4.

6. Doors will be equipped with card readers, recessed magnetic contacts where applicable.

ADDITIONAL ELECTRONIC ALARM /SURVEILLANCE EQUIPMENT

1. Closed Circuit Television (CCTV) with monitors and digital video recorders are required at entrances, parking areas, shipping and receiving, and isolated areas needing additional protection or surveillance.

2. Intrusion Detection Systems are required, (i.e. document areas, IT areas, etc. and any other controlled areas).

GUARD SERVICE

1. If guard service is not provided by GSA or the building owner, FDA will have the option to request the delegation for contract guard service. Guards/Contract will meet all requirements set forth for contract guards as outlined by Department of Homeland Security (DHS) and (FDA).

CLEANING PERSONNEL

1. Under Section 301(j) of the Food, Drug, and Cosmetics Act, to protect non-public and trade secret information all cleaning of FDA space will be done during normal work hours Monday through Friday between 8:00 a.m. to 4:30 p.m. All controlled areas will be cleaned under the escort of a guard or a FDA employee.

2. All cleaning personnel must complete and pass Presidential Directive HSPD-12. (See Attachment A.)

MAINTENANCE PERSONNEL

Maintenance personnel will also be required to complete and pass HSPD-12 requirements as specified under Presidential directive. (See Attachment A.)

OVERALL SECURITY

FDA will not share or occupy office space with any non-FDA occupants.

INTERIOR WALLS/CORRIDOR WALLS

1. Where FDA space (perimeter walls) abuts a non-FDA tenant, that perimeter wall will be “true” slab-to-slab. If current walls are not slab-to slab, walls should be extended with expanded metal placed between drywall to prevent access through wall(s) and/or over "drop ceiling".

2. When FDA occupies more than one floor, controlled access is required on entrance doors and stairwell side of stairwell doors, i.e. keypads.

WINDOWS

1. Whenever windows grant access to FDA space (first floor windows), they should be modified to reduce that possibility, e.g. permanently sealed or window security locks.

LIGHTING

1. Adequate perimeter lighting will be checked to ensure all exit/entrance doors have sufficient lighting and that they are working properly. Lighting levels should be 2.5 foot-candle.

NOTE: This includes emergency/fire doors if applicable.

PERIMETER DOORS TO FDA SPACE

Where applicable, the selection of perimeter doors should include:

1. Solid wood or hollow metal doors.

2. Interior door hinges. If existing doors have exterior door hinges, they should be “pinned” or “spot welded” to prevent removal of pins and/or doors.

3. Locking hardware should include “high security” lever-sets lock with a high security cylinder, in addition to single cylinder dead bolts, minimum bolt throw 1” mounted above lever set. Both lever-set and dead bolt should be keyed-alike.

4. Jimmy plates shall be installed over all perimeter locks if dead-bolt locks.

5. All interior locks will be keyed different from building master key for all FDA space.

6. All perimeter doors will be checked to ensure heavy duty door closures are installed, working properly and that existing doors are not warped, preventing them from normal closing and proper locking.

INTRUSION DETECTION/ACCESS CONTROL SYSTEM

1. Card readers will be utilized on all perimeter door entrances. Monitor Dynamics Inc (MDI) is the current Access Control System manufacture used by FDA.

2. Intrusion alarms, door contacts, and window sensors will be utilized to protect all FDA space.

3. Video intercoms with remote release stations may be utilized.

PROTECTION OF GOVERNMENT VEHICLES

1. Protection should be afforded to government vehicles leased from GSA.

2. Protection shall be by means of protective fencing and/or enclosed garage or parking areas that can be properly secured during non-working hours. (For further guidelines refer to the Code of Federal Regulations reference below).

41 CFR 101-20.103-1; Standard Protection 41 CFR 101-20.103-2; Special Protection

SECTION II. FDA OCCUPANT IN MULTI-TENANT BUILDING

Note: Multi-tenant space with commercial tenants is not recommended. Housing FDA in a federal facility with other Government agencies is preferred. FDA Occupant in Multi-Tenant Building (Multi-tenant space with commercial tenants is not recommended. FDA will not share or occupy office space with any non-FDA occupants).

NOTE: All facilities will meet the minimum-security standards as set forth in the Interagency Security Committee Design – Basis Threat and Physical Security Criteria for Federal Facilities. These categories are based on such factors as size of a facility, number of employees, and use and mission of the

OVERALL SECURITY

FDA shall not share or occupy office space with any non-FDA occupants/tenants.

INTERIOR WALLS/CORRIDOR WALLS

1. Whenever FDA (perimeter walls/space) abuts a non-FDA tenant, that perimeter wall shall be true “slab-to-slab” construction. If not, “expanded metal” shall be installed between the top of the wall and the slab above to prevent access.

REQUIREMENTS

Under Section 301(j) of the Food, Drug, and Cosmetics Act, to protect non-public and trade secret information all cleaning of FDA space will be done during normal work hours Monday through Friday between 8:00 a.m. to 4:30 p.m. All controlled areas will be cleaned under the escort of a guard or a FDA employee.

All cleaning personnel must complete and pass Presidential Directive HSPD-12. (See Attachment A.)

WINDOWS

REQUIREMENTS

1. Whenever windows grant access to FDA space (i.e., first floor windows), they shall be modified to prevent that possibility, (e.g., permanently sealed or have window security locks installed).

LIGHTING

1. Adequate perimeter lighting will be checked to ensure all exit/entrance doors have sufficient lighting and that they are working properly. Lighting levels shall be no less than 2.5 foot-candle.

Note: This requirement shall include emergency/fire doors whenever applicable.

PERIMETER DOORS TO FDA SPACE

Where applicable, the selection/hardware setup of the perimeter doors should include:

1. Solid wood or hollow metal doors.

2. Interior door hinges. If existing doors have exterior door hinges, they should be

“pinned” or “spot welded” to prevent removal of pins and/or doors.

3. Locking hardware should include “high security” lever-sets lock with a high security cylinder in addition to single cylinder dead bolts, minimum bolt-throw 1” mounted above lever set.

Note: Both knob-set and dead bolt should be keyed-alike.

4. Jimmy plates shall be installed over all perimeter locks if dead-bolt locks.

5. All interior locks will be keyed different from building master key for all FDA space.

6. All perimeter doors will be checked to ensure heavy duty door closures are installed, working properly and that existing doors are not warped, preventing them from normal closing and proper locking.

SECTION III. ACCEPTANCE AND CUTOVER

TESTING

REQUIREMENTS

The lessor will have the security contractor submit a testing plan 10 days after notice to proceed. The testing plan will cover 100% of the field devices and main panel with associated powering devices. The testing plan will be reviewed by FDA physical security office. Comments will be made and returned. The contractor will conduct the approved test plan with 100% accuracy before scheduling the FDA witnessed test.

REQUIREMENTS

FDA Physical Security office will review and comment on test plan. FDA will approve test plan. FDA will witness the test up to 100%.

SYSTEM PROGRAM

The lessor will have the security contractor submit a design package to the FDA physical security. The contractor will use the approved system programing sheets for system layout and panel programing. The security contractor will work hand in hand with FDA security to ensure the system is a turnkey system

REQUIREMENTS

FDA will review and comment on system design. FDA will provide system hardware addressing and IP and subnet addresses for the system. FDA Security or appointed contract will program the headend to match the design documents.

ATTACHMENT A Special contract requirements

Security Clearance Requirements for (Janitorial, Maintenance, Etc.)

All FDA Locations

A. Contractors shall contact the FDA Personnel Security Branch, (Badging Office 301-796-4000) to obtain the necessary forms needed for the “security clearance” process.

B. These forms are required for all replacement employees before entrance on duty.

C. The Government shall have and exercise full and complete control over granting, denying, withholding, or terminating clearances for Contractor employees.

D. If the Contracting Officer receives an unsuitable report of any employee after processing the required forms, or if the Contracting Officer's Representative finds a prospective employee to be unsuitable or unfit for his assigned duties, the contractor shall be advised immediately that such employee cannot continue to work or be assigned to work under the contract.

E. For employees cleared through this process while employed by a contractor who is subsequently replaced by another contractor, in the same building, the new contractor shall only be required to submit another set of these forms if the employee has not been cleared within the last 2 years.

F. Only upon completion of all the required forms and a receipt of a “favorable” fingerprint certification will a contractor be cleared to receive an FDA access badge.

ATTACHMENT B Typical Security Drawings

Preferred Equipment

Access Control System- Monitor Dynamics (MDI)

Camera System- Bosch Equipment

Video Intercom- Aiphone

ATTACHMENT C Monitor Dynamics certified dealers

The installer and provider of the access control and intrusion detection system must be a dealer in good standing with Monitor Dynamics Inc. The contact information for this manufacture is listed below:

1. Geoff Sanderlin Director of Operations Cell: 210-535-2694 Email: geoff.sanderlin@beta-it-solutions.com

BITS -- 2939 Mossrock Suite 180 -- San Antonio, Tx 78230

2.Joe Barnhart -- Birdi Systems- Project Manager

Cell 443-802-0674 -- joseph.barnhart@fda.hhs.gov

3.Mark Garrett MDI Security, LLC dba Monitor Dynamics

(Main Manufacturer) Director of Federal Sales

202-697-3945 Mark.Garrett@mondyn.com

6800 Alamo Downs Parkway | San Antonio, TX 78238

FDA recommends contacting Monitor Dynamics Inc and requesting a list of dealers that can support the project. FDA Physical Security Office will provide additional Security Contractors when requested.