Att 03 - Boulder Laboratories Physical Access Control Standards.pdf

ESO SITE SECURITY SPECIFICATIONS

06/10/2019 by NIST ESO Office

Contents Camera standards:

Model:

Camera Control Software:

Exterior Doors:

PTZ Cameras External Cameras:

Large Exterior fixed locations:

Internal Cameras:

INSTALLATION:

Security Door Requirements:

Single Exterior:

Panic Bar

Alarm Contact

KeyPad:

Single Exterior Door WITHOUT Power, EMERGENCY EXIT ONLY

Panic bar:

Alarm Contact:

Double Door Exterior WITH Center Mullion:

Panic Bar:

Alarm Contact:

KeyPad:

Double Door Exterior WITHOUT Center Mullion:

High Visibility Area such as main entrances:

Mechanical Rooms and Low Visibility areas requiring Hirsch security:

Single door or Double Door with center mullion:

Double Door without Center Mullion:

INTERIOR SECURITY DOORS:

Single Door:

NON-SECURITY DOORS

INTERIOR NON-SECURITY DOORS: (Offices)

Standard Locking door:

Non-Latching Passage Door:

Latching Passage set:

Double Door:

Latching Passage set:

HANDICAP Controls:

Emergency Power:

Rack Mounted Equipment

UPS:

Networking Equipment:

Switch :

Uplink Module:

HARDWARE SUPPORT/Maintenance

Secondary Power Supply:

SFPs:

1G Single Mode:

1G Multi Mode:

Patch Panel Information

24 Port:

48 Port:

Cabling:

Avigilon Server Equipment:

Server:

Windows and Glass Breaks:

FENCING AND GATES

d. Lock type will be discussed at time of design. ........................................... Error! Bookmark not defined.

WIRING INFORMATION

1. Electrical

2. Network

NOTES & Supplemental Data:

REFERENCES:

Revision Table

Camera standards:

NOTE: All wiring diagrams will be handed over to NIST Government Contracting Office and ESO upon project completion due to security reasons. Contractor will not maintain diagrams of project after completion.

Model: AVIGILON, no substitutes

Camera Control Software: All onsite Cameras are controlled by the pre-existing Avigilon Camera Control Software. All new Cameras shall be provided by contractors and a license shall be provided for each camera installed.

Exterior Doors: 2MP fixed I/R camera set at 8 to 10’ height and no more than 45 degrees view angle.

Cameras are to be mounted on the interior unless otherwise specified.

PTZ Cameras External Cameras: 2MP All PTZ cameras shall be mounted at a height to give best possible situational awareness and sufficient numbers and locations to provide full exterior coverage. All roof mounts shall make camera accessible from the room.

Large Exterior fixed locations: Areas such as parking lots or areas designated as important by security will be fitted with a 5MP (or larger if situation requires) fixed I/R camera at sufficient height and location as to maximize situational awareness or to meet security requirements.

Internal Cameras: Will be determined on a case by case situation.

INSTALLATION: All new installs shall be connected via CAT 6 Ethernet, via Network switch and tied into the existing system.

CAT6 or CAT6+ cable is the ONLY Cat cable to be used.

+Cable to be BLACK.

Security Door Requirements:

Single Exterior:

Panic Bar: Von Duprin RX-98-LNL-LD panic bar.

QEL unit, 6300 series electric strike or Electrified Lever set can be used.

Alarm Contact:

Surface mount: Sentrol 2507A-L or In Door Mount can be used on High Visibility Door Only such as Main Entrance Doors: use appropriate magnetic mount depending on if it’s a metal or wooden door.

KeyPad: Interior and exterior on each door.

Identiv MRIA2 AND HID RPK40-H Model 921PHRNEK0005D required at EACH location, one set interior, one set exterior, no piggy backing or doubling. BOTH must be provided to onsite security group (ESD) at least 3 weeks prior to contractor needing to stall so we can modify them for site needs.

Mounting Box shall be ADA compliant Identiv mounting box such as the MB8 or MB9. An MB1 or MB2 can be used with an ADA angled adapter.

Single Exterior Door WITHOUT Power, EMERGENCY EXIT ONLY Panic bar: Von Duprin 98-LNL-LD

Alarm Contact: GE 2507A-L.

Double Door Exterior WITH Center Mullion:

Panic Bar: Von Duprin QEL-RX-98-LNL-LD panic bar. Both doors are to be fully operable from interior and exterior.

Alarm Contact:

Surface mount: GE 2507A-L or In Door Mount can be used on High Visibility Door Only such as Main Entrance Doors: use appropriate magnetic mount depending on if it’s a metal or wooden door.

KeyPad: Interior and exterior required on each door.

Identiv MRIA2 AND HID RPK40-H Model 921PHRNEK0005D required at EACH location, one set interior, one set exterior, no piggy backing or doubling. BOTH must be provided to onsite security group (ESD) at least 3 weeks prior to contractor needing to stall so we can modify them for site needs.

Mounting Box shall be ADA compliant Identiv mounting box such as the MB8 or MB9. An MB1 or MB2 can be used with an ADA angled adapter.

Double Door Exterior WITHOUT Center Mullion:

High Visibility Area such as main entrances:

Panic Bar: Von Duprin QEL-RX-9849-LNL-LD, Both doors are to be fully operable from interior and exterior.

Alarm Contact:

Surface mount: GE 2507A-L or In Door Mount can be used on High Visibility Door Only such as Main Entrance Doors: use appropriate magnetic mount depending on if it’s a metal or wooden door.

KeyPad: Interior and exterior on each door.

Identiv MRIA2 AND HID RPK40-H Model 921PHRNEK0005D required at EACH location, one set interior, one set exterior, no piggy backing or doubling. BOTH must be provided to onsite security group (ESD) at least 3 weeks prior to contractor needing to stall so we can modify them for site needs.

Mounting Box shall be ADA compliant Identiv mounting box such as the MB8 or MB9. An MB1 or MB2 can be used with an ADA angled adapter.

Mechanical Rooms and Low Visibility areas requiring Hirsch security:

Single door or Double Door with center mullion:

Panic Bar: Von Duprin QEL-RX-98-LNL-LD, if Double doors then both doors are to be fully operable from interior and exterior.

Alarm Contact:

Surface mount: GE 2507A-L

KeyPad: Interior and exterior on each door.

Identiv MRIA2 AND HID RPK40-H Model 921PHRNEK0005D required at EACH location, one set interior, one set exterior, no piggy backing or doubling. BOTH must be provided to onsite security group (ESD) at least 3 weeks prior to contractor needing to stall so we can modify them for site needs.

Mounting Box shall be ADA compliant Identiv mounting box such as the MB8 or MB9. An MB1 or MB2 can be used with an ADA angled adapter.

Double Door without Center Mullion:

Panic Bar: Von Duprin QEL-RX-9827-LNL-LD both doors are to be fully operable from interior and exterior.

Alarm Contact:

Surface mount: GE 2507A-L

KeyPad: Interior and exterior on each door.

Identiv MRIA2 AND HID RPK40-H Model 921PHRNEK0005D required at EACH location, one set interior, one set exterior, no piggy backing or doubling. BOTH must be provided to onsite security group (ESD) at least 3 weeks prior to contractor needing to install so we can modify them for site needs.

Mounting Box shall be ADA compliant Identiv mounting box such as the MB8 or MB9. An MB1 or MB2 can be used with an ADA angled adapter.

INTERIOR SECURITY DOORS:

Single Door:

Identive security door: Schlage ND96PD with RX, Rhodes handle, Small Format Interchangeable Core.

or

Electric Latch: Schlage ND80PD with RX, Von Duprin 5100 Series electric strike.

Alarm Contact: GE 2507A-L

High Security or SKIFF: Kaba CDX10

NON-SECURITY DOORS

INTERIOR NON-SECURITY DOORS: (Offices) Standard Locking door: NON-Hirsch/Identiv lockable door

ESO will be consulted in order to identify type of door and lock prior to decision

Wireless Electronic Controlled interior door:

ASSA ABLOY IN120 Wireless Locks will be used. One Lock License shall be provided with each Lock. **If ordered through RS2, S-IP lock interface license is provided, if not the license will need to be purchased in addition. **License serial number is required before purchase, and will be made available upon request.

https://www.sargentlock.com/products/product_overview.php?item_id=2242

ASSA ABLOY SARGENT IN120 WiFi Multi-class- PIV Reader, Cylindrical , Less Core (PART # IN120-10G77-IPS-B-L-

L-26D-XXX)

IN120= Wireless Reader with (GS2011 wireless radio)

10G777 = Cylindrical Lock Body

IPS= All Credentials supported by IP to include Mifare and Desfire

B= Reader Color (Black)

L= Lever Type

L= Rose Type

26D= Finish

XXX- Handling – Contractor to identify handling based upon construction requirements. Handling codes available on Manufacture website for Cylindrical Series IN120.

GS2011 Radios are Required in order to support the use of EAP-TLS.

Lever to accept Best (or equivalent) 6 pin, Small Format Interchangeable Core

Contractor to provide core (A2 keyway), 1 per lock

Cores to be keyed by Government.

Power over Ethernet: (All doors will be wired for POE locks unless specified)

ASSA ABLOY SARGENT IN220 PoE Multi-class- PIV Reader, Cylindrical, Less Core https://www.sargentlock.com/products/product_overview.php?item_id=2242

Power over Ethernet:

ASSA ABLOY SARGENT IN220 PoE Multi-class- PIV Reader, Cylindrical, Less Core (PART # IN220-10G77-IPS-B-L-L- 26D-XXX) SPECS OUTLINED ABOVE FOR FIT, FINISH, and HANDLING and licensing information..

Mechanical Door Control: (example: Closets, conference Rooms, Rooms which do not contain PII or BII, or do not require security locks)

Single Door:

Non-Latching Passage Door: Standard Push Plate and Pull Handle

Latching Passage set: Schlage ND10S

Double Door:

Inactive leaf: Manual Flush Bolt ONLY

Latching Passage set: Schlage ND10S

Latching Keyed Access set: Schlage ND70PD

ALL Doors:

Door Coordinators or Automatic Flush bolts will NOT be used. This is due to reliability issues that start to occur after a short period of time.

Best or equivalent Small Format Interchangeable Core to be provided by contractor and pinned by Government.

HANDICAP Controls:

All keypads must be mounted at ADA approved height.

Handicap openers shall be integrated into security controls to prevent access from exterior without authorization/approval from security system (i.e. Access granted by badging in.) All integration shall be coordinated with on-site Emergency Services Office to ensure proper operability.

All ADA equipment and hardware connected to the site security system must be reviewed and approved by Emergency Services Office to ensure proper functionality and operability.

All ADA openers shall have independent control. They will NOT be RX controlled by Security system. See ESO for clarification if needed.

Emergency Power:

All Security equipment will be installed with Emergency Power/ surge protection capable of supporting security related equipment (VSS and PACS) for up to 24 hours..

Rack Mounted Equipment This equipment includes switches, routers, servers, and other rack mounted hardware.

UPS:

All Security equipment will be connected to UPS equipment capable to support the connected equipment until power can be transferred successfully to emergency power.

Networking Equipment:

ALL NETWORKING EQUIPMENT WILL BE COORDINATED WITH OISM POC, WILL JENKINSON

All Networking hardware and components will be “TAA” and “Buy American” Compliant.

Switch : WS-C3850-24U-S

Uplink Module: C3850-NM-4-1G

HARDWARE SUPPORT/Maintenance CON-SSSNT-WS8524US

Secondary Power Supply: PWR-C1-1100WAC/2

Part # Description Approx. Cost

WS-C3850-24U-S Cisco Catalyst 3850 24 port UPOE IP Base $7850.00 (without 40% discount)

CON-SSSNT-WS8524US SQLN SUPP 8X5XNBD Cisco Catalyst 3850 24 Port UPOE IP Base (1yr)

$616.00 (without 40% discount)

S3850UK9-163 UNIVERSAL

C3850-NM-4-1G Cisco Catalyst 3850 4 x 1GE Network Module $520.00 (without 40% discount) CAB-C15-CBN-JP Japan Cabinet Jumper Power Cord, 250 VAC

12A C14-C15 (x2)

CAB-SPWR-30CM Catalyst Stack Power Cable 30 CM $95.00 (without 40% discount)

PWR-C1-1100WAC 1100W AC Config 1 Power Supply PWR-C1-1100WAC/2 1100W AC Config 1 Secondary Power Supply $1800.00 (without 40% discount) **NOTE: Check with ESO representatives prior to purchasing to ensure the latest information is specified.

SFPs:

1G Single Mode: GLC-LH-SMD (Between Buildings)

1G Multi Mode: GLC-SX-MMD (Inside Buildings/ Switch to Switch)

Patch Panel Information 24 Port:

Part Number: 760118323

Description: M2400-1U-GS 24 Port 1U PP Manufacturer: Systimax

48 Port:

Part Number: 760105429 Description: M4800-1U-GS 48 Port 1U PP Manufacturer: Systimax

Cabling:

Part Number: CACAD55HA2ZF057 Description: Instapatch CU Right Series Flat 12 outlet cat 6A assembly 57” Manufacturer: Systimax

Part Number: CACAD33HA2ZF044 Description: Instapatch CU Left Series Flat 12 outlet cat 6A assembly 44” Manufacturer: Systimax

Avigilon Server Equipment:

**NOTE: CONTACT ESO prior to purchasing equipment. Device Size and Type to be determined by ESO Representatives at time project requirements are reviewed.

Server:

64.0 TB NVR4 PRM

96 TB NVR4 PRM

128 TB NVR4 PRM

157 TB NVR4 PRM

Windows and Glass Breaks:

Requirement: ISC and Security Criterion #20 o Exterior windows shall Utilize acceptable fragment retention film, or an acceptable glazing system to reduce the glass fragmentation hazard o No operable windows on ground floor level o Provide IDS/Glass breaks for all Ground floor windows. Glass break sensors will be wired independently per room back to approved Identiv MX panel and security system. All glass break sensors/ ids will be tested and certified. All certification documentation and wiring diagrams will be provided to ESO upon project completion.

FENCING AND GATES

Requirements shall meet those specifications outlined in the DOC Security Manual. Current Version is December 2012. http://home.osec.doc.gov/osy/SecurityManual/Security%20Manual.pdf

WIRING INFORMATION

1. Electrical

2. Network

NOTES & Supplemental Data:

ANY DEVIATIONS FROM THESE SPECS MUST BE APPROVED BY ESO.

1. All new security panels shall be tied into the existing Hirsch/Identiv software control system.

This work will be coordinated with the onsite ESO Supervisor.

2. All security control panels shall be identiv MX panels.

3. All cabling and power supplies shall be manufacturers recommended and meet equipment specifications.

4. Any wiring associated with security, surveillance or video systems MUST be wired in such a way as to allow easy access for future repair or replacement. If wiring is run inside a wall or structure it must be in conduit so new wire can be pulled in or old wiring pulled out.

5. Any adapters that are required shall accept the Small Format Interchangeable cores and be provided by the contractor and installed by the contractor.

6. Key Cores shall be Small Format Interchangeable Core (Best or equivalent). Best A2 keyway

7. Contractor shall provide 1 (one) core per lock, core to be pinned by Government.

8. Springs and Pins will be provided by contract for all new installations or replacement/upgrades

9. All equipment requiring an IP address will be provided to ESO at least 3 weeks prior to it being installed and will be configured by NIST Staff, including IP, Configurations and naming.

10. A list of all new devices/panels and how they are wired will be provided to ESO at least 2 weeks in advance of any testing by ESD staff to allow pre-programming of the software. All Devices will be identified by the type of device and its location (i.e., Door Number 2, Room 304, MELM 3, Door 3, Room 305 MELM2, Glass Break AEB position 3, Room 305, MELM1).

11. Within 30 days of project completion all security and surveillance related blueprints, including wire type and runs will be provided to ESO in digital format for our records.

12. All wiring/cabling shall be labeled to reflect start and end locations. I.e., at the door the keypad wiring could read, panel 3060, door 3.

13. All projects internal and external will use Single Mode Fiber, to include switch to switch, and building to building.

14. All fiber optic cable installed shall be tested for total loss with test results given to ESO (in digital format for our records) prior to acceptance.

15. All network fiber/ copper connectivity will be end to end. No injectors or other extension methods for power/data transmission will be used. Device to Switch or Switch to switch http://home.osec.doc.gov/osy/SecurityManual/Security%20Manual.pdf

16. In housing back up batteries shall be provided and installed for all security components in accordance with manufacturers recommendations. I.e., batteries installed inside MX panels.

17. All security equipment shall be installed in its own secured and climate controlled spaces. Air conditioning shall be spec’d out for maximum usage.

18. All Security equipment shall be on emergency power and UPS backup (Outage time requirement to be discussed per system, hardware, device). Including but not limited to, panels, switches, door power supplies, etc...

19. All security and surveillance systems MUST be inspected, tested and accepted by ESO staff prior to going live.

20. All security panels/switches and surveillance switches must have connectivity back to the main systems. This will be tested prior to acceptance by ESO.

21. All security equipment shall have its own dedicated secure closet and /or rack- and if a dedicated closet / rack is not available, shall be secured from common access by a fence or other ESO pre-approved method. Deviations can be approved by ESO.

22. All security equipment shall be installed by factory Certified installers (i.e. HIRSCH or Avigilon.)

23. MX controllers shall be installed in such a manner as to leave a minimum of 1 door set open for future expansion.

24. MELM Usage: An MELM shall be used on each security door or system connected to the security panel. With the following uses as per MELM type.

1. MELM 1: single alarm such as door contact or glass break

2. MELM 2: dual use such as RQE and door contact.

3. MELM 3: triple use such as RQE, Door Contact and micro switch

25. A Memory Expansion board shall be provided and installed for Each MX panel installed

26. A copy of ALL purchase orders or shipping receipts for all security related items will be provided to ESO so property tags can be issued and items tracked after contract completion.

27. All security equipment (fences, control panels, etc..) will be mounted with Security bolts.

28. All wiring will be placed in metallic rigid conduit. Existing Conduit will not be filled past 75%, and new conduit will be installed. New Conduct installation will be Maxcell 3-cell innerduct. No power will be installed in conduit containing data or video communications.

29. All internal release mechanisms will be secured in such a manner to prevent exterior access/ control of those mechanisms.

30. NOTE: All wiring diagrams will be handed over to NIST Government Contracting Office and ESO upon project completion due to security reasons. Contractor will not maintain diagrams of project after completion.

31. All IT systems, hardware, and software must be compliant with National Defense Authorization Act.

REFERENCES:

1. US GSA Standard Test Method for Glazing and Window Systems:

https://www.gsa.gov/graphics/pbs/Standards_GSATestingStandard.pdf

2. GSA P100: http://www.wbdg.org/ffc/gsa/criteria/pbs-p100

3. Risk Management Process for Federal Facilities: An Interagency Security Committee Standard Appendix B: Countermeasures (2018): https://www.dhs.gov/publication/isc-risk-management-process https://www.gsa.gov/graphics/pbs/Standards_GSATestingStandard.pdf http://www.wbdg.org/ffc/gsa/criteria/pbs-p100 https://www.dhs.gov/publication/isc-risk-management-process

4. ISC Security Standards “ The Risk Management Proces for Federal Facilities: An Interagency Security Committee Standard: Appendix B: Countermeasures; Dated 2018

Revision Table Date Name Comment 3/27/2018 Phil Kemp Updated Springs and Pins 4/2/2018 Phil Kemp Updated Wireless information 4/4/2018 Phil Kemp Removed Mortise info for Wireless locks. Added Lock License fee info.

4/13/2018 Phil Kemp Input of UPS information – Not completed 5/2/2018 Phil Kemp Added Page numbers, added comments about MRIA2 per reader

(1to1) 5/9/2018 Ed Oliver Added core adapter language.

6/8/2018 Phil Kemp Added Fiber requirement information 6/19/2018 Phil Kemp Added Fencing Requirements, and items 26-27 7/23/2018 Phil Kemp Updated Emergency and UPS annotations as well as added information about wiring diagrams being returned to ESO after project completion.

10/18/2018 Ed Oliver Updated Notes and Specifications with the following: Any wiring associated with security, surveillance or video systems MUST be wired in such a way as to allow easy access for future repair or replacement

10/23/2018 Phil Kemp Added Patch Panel and Cabling information Added comments Updated Reference to New 2018 ISC Standards document

11/27/2018 Phil Kemp Added section on wiring and updated Wireless cyberlock information.

3/13/2019 Phil Kemp Updated section 28, conduit requirements.

5/8/2019 Ed Oliver Made updates to all sections

5/9/2019 Phil Kemp Reviewed and approved updates, added ISC Standards Reference

6/10/2019 Phil Kemp Updated Licensing information for IN120 and IN220 locks. Updated Fencing and Gate requirements. Updated UPS information statement.