Appendix A - Contractor Security Requirements.pdf

APPENDIX A

CONTRACTOR SECURITY REQUIREMENTS

SEM003 - Contractor Security Requirements

STATUS: [ ] DRAFT [X] IN EFFECT AS OF 5/9/2018 Revised May 9, 2018

PURPOSE

This document details requirements for contractors and associated personnel performing on-site work for MassDOT or the MBTA. The procedures herein shall apply to all projects and work which require a

Contractor Responsible Party (as that term is defined below) to be present on MassDOT or MBTA property.

SECURITY ENVIRONMENT

The safety and security of MassDOT and MBTA employees, as well as contractors and other visitors, is of the highest importance at all times. To this end, a number of security measures are in effect that may affect contractors accessing MassDOT or MBTA properties:

• Security Badges. All contractors performing work on MassDOT or MBTA property are expected to either obtain and carry security badges issued by MassDOT / MBTA, or follow applicable facility visitor registration requirements. Security badges are programmed to provide access to doors controlled with Electronic Access Control (see below).

• Electronic Access Control System (EACS). MassDOT and the MBTA utilize an electronic access control system (EACS) to secure certain facilities, rooms, area, gates, etc. The system requires the user to “tap” their security badge to an adjacent reader to verify access and unlock the door.

Security badges are programmed with access privileges based on project scope, need, and other considerations.

• Physical Keys. Some doors are not equipped with electronic access control. Where appropriate, and based on project needs, physical keys may be issued to contractors requiring unsupervised access to such areas.

• Security Cameras. Thousands of security cameras are installed across MassDOT and MBTA properties to protect personnel and safeguard assets. Key cameras are monitored, and all cameras record 24/7.

• Intrusion Alarms. In certain facilities, intrusion alarm systems operate and require assignment of codes for arming/disarming the system. Where appropriate, and based on project needs, codes may be issued to contractors requiring unsupervised access to such areas

• Gates. Vehicle and pedestrian security gates are in place at certain facilities. For some gates, card readers allow security badges to provide access similar to a door.

• Monitoring. Doors with electronic access control that are opened or secured improperly, such as doors held open or opened with keys, will generate alarms along with live video; such alarms are monitored by the 24/7 MassDOT Security Operations Desk and may result in a management or public safety response as warranted.

REGULATIONS

1. Any Contractor Responsible Party present on MassDOT or MBTA property that has been issued a security badge shall at all times be properly carrying AND displaying the such badge, in accordance with this policy and all applicable federal and state laws, the rules, regulations and all directives of MassDOT, the MBTA, and other governmental entities.

2. Access to MassDOT or MBTA property as a visitor, without an assigned security badge, shall require conformance to all applicable facility registration and sign-in requirements for visitors.

3. Any Contractor Responsible Party will immediately, upon request, present their security badge to any MassDOT or MBTA employee.

4. Many MassDOT and MBTA are linked to an electronic access control system (EACS) that requires a programmed badge for entry. Although such doors typically retain standard key locks, it is a violation of policy to access an EACS controlled door with a regular key.

5. A Contractor Responsible Party shall never swap or share security badges, keys, or codes, even temporarily, to access a single door or area or arm/disarm an intrusion alarm system.

6. No one shall ever carry or use any ID but their own.

7. At no time will copies or imitations of access cards or keys be produced.

8. Security badges remain property of MassDOT / MBTA, are subject to revocation at any time without notice or cause, and shall be promptly (within 24 hours) returned upon separation of service.

9. All Contractor Responsible Parties shall be responsible for observing and reporting suspicious activity, items, vehicles, and individuals to their supervisor, a MassDOT or MBTA employee, and/or a law enforcement officer in a timely manner.

10. At no time will a Contractor Responsible Party leave doors, gates, or other means of access open in such a way which may allow unauthorized persons to gain access to secured areas.

11. Any lost security badge or key shall be immediately (and no later than within 48 hours) reported to MassDOT Security & Emergency Management.

12. No firearms shall be carried on MassDOT or MBTA property.

13. All visits to MassDOT or MBTA property shall be authorized in advance.

ROLES

MassDOT Security & Emergency Management

The MassDOT Security & Emergency Management Department is a shared service department that is responsible for security and emergency management projects and operations across all MassDOT divisions, including the MBTA. The department is responsible for issuing contractor security badges and identification and operates a 24/7 Security Operations Center which monitors cameras and access to doors and gates at various facilities.

The department also makes final determinations as to which contractor responsible parties will be issued security badges. Some projects and scopes of work will not require a security badge and site activity can instead be performed under applicable facility visitor registration requirements and procedures.

MassDOT/MBTA Project Manager

This is the individual overseeing the Contractor’s work for MassDOT and the MBTA and as such is responsible for facilitating contractor access requests and approving contractor access request forms.

The Project Manager is also responsible for notifying MassDOT Security & Emergency Management of any Contractor Responsible Parties that have been terminated, whether due to conclusion of the project/contract or other reasons.

Contractor Responsible Party

Defined as contractor employees, members, officers, agents, guests, invitees or volunteers and employees, members, officers, agents, guests, invitees or volunteers of its subcontractors of any tier. All are responsible for following this policy and any other security requirements or instructions provided.

Contractor Access Coordinator

The Contractor shall appoint a Contractor Access Coordinator who shall be responsible for submitting all access card and access requests on behalf of all Contractor Responsible Parties; this includes identifying who needs an access card, assembling the information required for them to receive an access card, and submitting the required documentation using the required form to obtain the access card.

REQUIREMENTS

Background Check

All Contractor Responsible Parties that will perform work in conjunction with this contract and will require a security badge must have passed a CORI, or equivalent, background check within 90 days of the security badge application and must be able to, upon request, provide evidence to this effect.

Any change in the ability of a Contractor Responsible Party to pass such background check shall require termination of that individual from work associated with the MassDOT/MBTA.

Training

As directed, some or all Contractor Responsible Parties, including the Contractor Access Coordinator him/herself, may be required to attend the MassDOT/MBTA “Security Awareness & Emergency

Preparedness (SAEPET)” training class. Upon contract start / Notice of Award, the Contractor Access

Coordinator shall contact the MassDOT Security & Emergency Management Department for a schedule of available SAEPET classes. The MassDOT Security & Emergency Management Department will provide the information and schedules necessary to ensure all Contractor Responsible Parties are able to complete the required training.

All Contractor Responsible Parties, including the Contractor Access Coordinator, attending the required training program shall sign-in on the provided roster to confirm their understanding and acceptance of the training course content as well as to document their attendance.

In addition, all Contractor Responsible Parties shall attend future training relating to security awareness as may be directed by MassDOT or the MBTA.

Audits

The Contractor assumes full responsibility for ensuring that all aspects of this policy are properly implemented and followed. MassDOT or the MBTA may at any time require the Contractor, at the

Contractor’s expense, to verify the accountability of all access cards issued to Contractor Responsible

Parties.

Terminated Contractor Responsible Parties

Within twenty-four (24) hours after the expiration of a contract or agreement, or completion of the services under thereunder, whichever comes first, the Contractor shall return to the MassDOT Security

& Emergency Management Department all security badges issued to all Contractor Responsible Parties in connection with this Agreement. During the term of contract, agreement, or work performed, the

Contractor shall immediately (and within 24 hours) return to the MassDOT Security & Emergency

Management Department any security badges issued to any Contractor Responsible Party whose employment has been terminated, or who no longer requires access to MassDOT or MBTA property, or whose access card has expired.

ACCESS REQUEST PROCESS

1. Upon contract start and/or receiving Notice of Award, the contractor will designate its

Contractor Access Coordinator and contact MassDOT Security & Emergency Management for a copy of the Access Request Form.

2. The form shall be filled out completely, legibly, and truthfully. Each form shall be signed by the

Contractor Access Coordinator as well as the MassDOT / MBTA project manager. An excel spreadsheet may be used in conjunction with a single copy of the form for requests involving large numbers of similar Contractor Responsible Parties.

3. The completed form shall be submitted to the MassDOT Security & Emergency Management

Department and will be processed; there may be follow-up questions. Badges will be provided and pre-programmed with the necessary access. If adjustments are necessary, contact the

MassDOT Security & Emergency Management department.

4. Upon termination of an individual or the company’s work as part of this project or services, MassDOT Security & Emergency Management shall be notified and the security badge(s) and any keys shall be collected and returned within 30 days.

5. In the event of lost or damaged badges needing replacement, the Contractor Access Coordinator should submit a new Access Request Form to MassDOT Security & Emergency Management on behalf of the affected badge holder.

VIOLATIONS

The Contractor is responsible for complying with all MassDOT and MBTA policies, procedures, rules and regulations, including without limitation those set forth herein, and all applicable federal, state and local laws, rules and regulations, as any of the aforesaid may change from time to time. Failure to abide by this policy shall constitute a material breach of the project / services contract with MassDOT or the

MBTA and may result in:

• Removal of the offending party from MassDOT or MBTA property

• Barring of offending party from projects for MassDOT or the MBTA

• Barring of contractors from performing work for MassDOT or the MBTA

• Other consequences, as deemed appropriate and necessary based on the nature and severity of the infraction(s)

Except if otherwise expressly set forth in the Contractor's Agreement with MassDOT or the MBTA, the

Contractor's compliance with security policies shall be considered incidental to Contractor's work and no further or additional payment will be made therefor by MassDOT or the MBTA to the Contractor.

POINTS OF CONTACT

All inquiries, reporting, requests, and interaction relating to the policies outlined herein shall be communicated to the MassDOT Security & Emergency Management Department at the address(es) below:

MassDOT: dotsecurity@state.ma.us

MBTA: securitydepartment@mbta.com

In addition, 24/7 support is available via the MassDOT Security Operations Desk at 617-222-6222; the desk can provide immediate assistance regarding any access or security questions or needs.

mailto:dotsecurity@state.ma.us mailto:securitydepartment@mbta.com