Attachment 01b3 Task Order 1 Appendix B (Directives-Regulation).pdf

Appendix B: References (PFPA Version January 2016) Integrated Security Services

CONTROLLED UNCLASSIFIED INFORMATION

APPENDIX B: REFERENCES

All references are applicable for work performed this contract. Government regulations, Government criteria, national and international codes and standards, as well as industry standards available with the latest dates of issue shall be used for design, installation, all equipment selection, software features and selection for this contract.

Government Documents

Code of Federal Regulations (CFR)

47 CFR 15 Radio Frequency Devices

21 CFR 1020 Performance Standards for Ionizing Radiation Emitting Products

32 CFR 234 Conduct on the Pentagon Reservation

Department of Defense (DoD)

AI 30 Administrative Instruction 30, Force Protection on the Pentagon

Reservation, Incorporating Change 2, September 27, 2012

AR 25-2 Information Assurance

DCSSC (May 2002) Pentagon Renovation (PENREN) Design and Construction, Security Standards and Criteria

DoD ATO Guide December 2012 (Replaced DoD 2000.12H)

DoDI 2000.12 DoD Antiterrorism (AT) Program, Incorporating Change 1, September 9, 2013

DoDI 2000.16 DoD Antiterrorism (AT) Standards, Incorporating Change 2, December 8, 2006

DoD 5220.22-M National Industry Security Program Operating Manual, Incorporating Change 1 March 28, 2013

DoDM 5200.01,V1 DoD Information Security Program: Overview, Classification, and

Declassification, February 24, 2012

DoDM 5200.01,V3 DoD Information Security Program: Protection of Classified

Information, Incorporating Change 2, March 19, 2013

DoDI 5200.02 DoD Personnel Security Program (PSP), Incorporating Change 1, September 9, 2014

DoDI 5200.08 Security of DoD Installations and Resources and the DoD Physical

Security Review Board (PSRB), Incorporating Change 2, April 8, DoD DTM 09-012 Interim Policy Guidance for DoD Physical Access Control, Incorporating Change 5, March 3, 2015

DoD 5200.400 Information Technology Security Certification and Accreditation

Process

DoDI 8500.01 Cybersecurity, March 14, 2014

DoDD O-8530.1 Computer Network Defense (CND)

DoDD 8570.01 Information Assurance Training, Certification, and Workforce

Management

DoDD 5400.07 DoD Freedom of Information Act (FOIA) Program

DoDI 1000.13 Identification (ID) Cards for Members of the Uniformed Services, Their Dependents, and Other Eligible Individuals

DoDI 8510.01 Risk Management Framework (RMF) for DoD Information

Technology (IT), March 12, 2014

Office of Director of National Intelligence (ODNI)

Intelligence Community

Directive (ICD) 503 Intelligence Community Information Technology Systems Security

Risk Management, Certification and Accreditation (15 September

2010)

ICD 704 Personnel Security Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information and Other

Controlled Access Program Information (01 October 2008)

ICD 705 Sensitive Compartmented Information Facilities (26 May 2010)

ICS 705-1 Physical and Technical Security Standards for Sensitive

Compartmented Information Facilities (17 September 2010)

ICS 705-2 Standards for the Accreditation and Reciprocal Use of Sensitive

Compartmented Information Facilities (17 September 2010)

Department of Homeland Security, Interagency Security

Committee (ISC)

The Risk Management Process for Federal Facilities: An

Interagency Security Committee Standard, 1rst Ed. (August 2013)

Facility Security Committees, An Interagency Security Committee

Standards, 2nd Ed. (1 January 2012)

Facility Security Level Determinations for Federal Facilities: An

Interagency Security Committee Standard (2008)

National Institute of Standards and Technology (NIST)

FIPS Pub 46-3 Data Encryption Standard

FIPS Pub 140-2 Security Requirements for Cryptographic Modules (25 May 2011)

FIPS 197 Advanced Encryption Standard (26 May 2002)

FIPS 201 Federal Information Processing Standards

FIPS 201-2 Personal Identity Verification (PIV) of Federal Employees and

Contractors (August 2013)

NIST SP800-73 Interfaces for Personal Identity Verification

NIST SP800-76 Biometric Data Specification for Personal Identity Verification

(July 2013)

NIST SP800-79 Guidelines for the Certification and Accreditation of PIV Card

Issuing Organizations

NIST SP800-116 A Recommendation for the Use of PIV Credentials in Physical

Access Control Systems (PACS) (November 2008)

NIST SP800-37, Rev1 Guide for Applying the Risk Management Framework to Federal

Information Systems (February 2010)

Office of Management and Budget (OMB)

HSPD-12 Homeland Security Presidential Directive #12 (August 2004)

OMB 05-24 Implementation of HSPD-12 (August 5, 2005)

OMB M-11-11 Continued Implementation of Homeland Security Presidential

Directive (HSPD) 12– Policy for a Common Identification

Standard for Federal Employees and Contractors (February 3, 2011)

U.S. Army, Corps of Engineers

Unified Facilities Criteria

UFC 4-010-01 DoD Minimum Anti-Terrorism Standards for Buildings, Incorporating Change 1, 1 October 2013

UFC 4-020-01 DoD Security Engineering Facilities Planning Manual (11

September 2008)

UFC 4-020-02 Security Engineering Design: Concept Design (FOUO)

UFC 4-020-03 Security Engineering Design: Final Design (1 March 2005)

UFC 4-022-01 Security Engineering Entry Control Facilities/Access Control

Points (25 May 2005)

UFC 4-022-02 Selection and Application of Vehicle Barriers, Incorporating

Change 1, (9 August 2010)

UFC 4-022-03 Security Engineering: Fences, Gates, and Guard Facilities (14 June

2007)

Unified Facility Guide Specifications (UFGS)

UFGS 02841N Traffic Barriers

UFGS 07 84 00 Fire Stopping including Change 1

UFGS 08 39 54 Blast Resistant Doors

UFGS 08 87 16 Fragment Retention Film for Glass

UFGS 08 34 02 Bullet Resistant Components

UFGS 28 20 00.00 20 Electronic Security System (ESS), Commercial

UFGS 26 55 53.00 10 Exterior Lighting Including Security and CCTV Applications

UFGS 28 23 23.00 10 Closed Circuit Television Systems

UFGS 28 20 01.00 10 Electronic Security Systems

UFGS 32 31 13 Chain Link Fence and Gates

UFGS 32 31 13.53 High Security Chain Link Fences and Gates

UFGS 34 41 26.00 10 Access Control Point Control System

UFGS 34 71 13.19 Active Vehicle Barriers

Interagency Security Committee

The Risk Management Process for Federal Facilities: An Interagency Security Committee

Standard, 2nd Ed., January 7, 2016

Commercial Standards and Documents

Applicable commercial standards, including but not limited to those listed below are applicable to the ISSC contract. Other standards and codes applicable are in the UFCs and UFGs; in addition other standards, codes and regulations may be listed in individual delivery orders issued under the ISSC contract.

American National Standards Institute (ANSI)

ANSI A 1.4 (1983) Sound Level Meters

ANSI C2 (1993) National Electrical Safety Code

ANSI C2 (2002) National Electrical Safety Code

ANSI X3.64 (1979; R 1990) Additional controls for Use with American

National Standard Code for Information Interchange

ANSI INCITS 135 (1992) Information Systems - Database Language SQL (Includes

ANSI X3.168-1989)

ANSI INCITS 154 (1988) Office Machines and Supplies - Alphanumeric Machines -

Keyboard Arrangement

ANSI INCITS 166 (1990) Information Systems - Fiber Data Distributed Interface

(FDDI) - Token Ring Physical Layer Medium Dependent (PMD)

ANSI INCITS 92 (1980) Data Encryption Algorithm

Institute of Electrical and Electronics Engineers (IEEE)

IEEE Std 100-2000 IEEE Standard Dictionary of Electrical and Electronics Terms

IEEE Std C62.41.1-2002 IEEE Guide on the Surge Environment in Low-Voltage (1000 V and Less) AC Power Circuits

IEEE Std C62.41.2-2002 IEEE Recommended Practice on Characterization of Surges in

Low Voltage (1000V and less) AC power circuits

IEEE Std C62.42-2005 IEEE Guide for the Application of Component Surge-Protective

Devices for Use in Low-Voltage [Equal to or Less than 1000 V

(ac) or 1200 V (dc)] Circuits

IEEE Std C62.43 -2005 IEEE Guide for Application of Surge Protectors Used in Low

Voltage (Equal to or less than 1000 V, rms or 1200 V, dc) Data, Communication and Signaling Circuits.

IEEE Std C62.48 -2002 IEEE Guide on Interactions Between Power System Disturbances and Surge-Protective Devices

IEEE Std C62.64 -2009 IEEE Standard Specifications for Surge Protectors Used in Low-

Voltage Data, Communications, and Signaling Circuits

IEEE Std C62.72 -2007 IEEE Guide for the Application of Surge-Protective Devices for

Low-Voltage (1000 V or Less) AC Power Circuits

IEEE Std 142 -2007 IEEE Recommended Practice for Grounding of Industrial and

Commercial Power Systems

IEEE Std 446 -1995 IEEE Recommended Practice for Emergency and Standby Power

Systems for Industrial and Commercial Applications

IEEE Std 1100 -2005 IEEE Recommended Practice for Powering and Grounding

Electronic Equipment (IEEE Emerald Book) [ANSI]

International Telegraph and Telephone Consultative Committee (CCITT)

CCITT-01 (1988) Data Communication Over the Telephone Network, Series

V Recommendations (CCITT Blue Book - Vol. VIII - fascicle

VIII.1)

International Organization for Standardization (ISO)

ISO 7810 (2003) Identifications Cards - Physical Characteristics

ISO 7811/1 (2014) Identification Cards - Recording Technique, Part 1:

Embossing

ISO 7811/2 (2014) Identification Cards - Recording Technique, Part 2:

Magnetic Stripe - Low Coercivity

ISO 7811/3 (1995) Identification Cards - Recording Technique, Part 3:

Location of Embossed Characters on ID-1 Cards

ISO 7811/4 (1995) Identification Cards - Recording Technique, Part 4:

Location of Read-Only Magnetic Tracks 1 and 2

ISO 7811/5 (1995) Identification Cards - Recording Technique, Part 5:

Location of Read-Write Magnetic Track - Track 3

ISO 7816 Identification Cards – Integrated Circuit Cards – Parts 1 – 15

ISO/IEC 8802.3 (1993) [ANSI/IEEE Std. 802.3, 1993 Edition], Information

Technology -- Local and Metropolitan area networks -- Part 3:

Carrier Sense Multiple Access with collision detection

(CSMA/CD) access method physical layer specifications

ISO 9001 Certification of Management System Standards (2008)

ISO 10007 Quality Management - Guidelines for Configuration Management

ISO 14443-1 Identification Cards – Contactless Integrated Circuit Cards –

Proximity Cards – Part 1 – Physical Characteristics

ISO 14443-2 Identification Cards – Contactless Integrated Circuit Cards –

Proximity Cards – Part 2 – Radio Frequency Power and Signal

Interface

ISO 14443-3 Identification Cards – Contactless Integrated Circuit Cards –

Proximity Cards – Part 3 – Initialization and Anti-collision

ISO 14443-4 Identification Cards – Contactless Integrated Circuit Cards –

Proximity Cards – Part 4 – Transmission Protocol

National Fire Protection Association (NFPA)

NFPA 70 National Electrical Code (2011 Edition)

NFPA 72 National Fire Alarm and Signaling Code (2008)

NFPA 101 Life Safety Code (2009 Edition)

NFPA 780 Standard for Installation of Lightning Protection Systems (2011

Edition)

Underwriters Laboratory (UL)

UL 294 Standard for Access Control System Units (2013)

UL 681 Standard for Installation and Classification of Burglar and Holdup

Alarm Systems (2014)

UL1076 Standard for Proprietary Burglar Alarm Units and Systems (1995)

UL 1981 Standard for Central-Station Automation Systems (2014)

UL 1449 Surge Protection Devices (2014)

UL 1635 Standard for Digital Alarm Communicator System Units (1996)

UL 2050 National Industrial Security Systems for the Protection of

Classified Materials (2007)