Attachment 1 - AECS Bldg 24 Draft Requirements Document.pdf

DRAFT

--FOR OFFICIAL USE ONLY—

Requirement for Automated Entry Control System (AECS)

Bldg. 24 – Spangdahlem AB, Germany

1. Requirement description: The proposed open storage area is very large and contains three separate rooms apart from the entry way. This prevents proper visual control of the entry when the area is manned, and the area does not have an Automated Entry Control System (AECS) installed in accordance with DoDM 5200.01 Volume 3 AFMAN 16-1404 Volume 3, Information Security Program: Protection of Classified Information.

The requirement is to install a stand-alone AECS. This system should control entry at two doors in Bldg. 24 to limit access into the open storage area and prevent entry by unauthorized personnel. The open storage area will include rooms 101, 102, 103, 109, and 110. First door is at the exterior building, room 110, equipment room. Second door is at interior of building, room 102, tech control office from hall. See attached building drawing.

The AECS must comply with the requirements listed in AFMAN 16-1404 Volume 3, subparagraph 3.a.(2), which states “The AECS shall identify an individual and authenticate the person’s authority to enter the area through the use of an identification (ID) badge or card.” Subparagraph 3.2(2)(a) states, “The ID badge or key card shall use embedded sensors, integrated circuits, magnetic stripes, or other means of encoding data that identifies the facility and the individual to whom the card is used.” In accordance with AFMAN 16-1404 Volume 3, subparagraph 3.b.(1, “The key card system shall meet the level 1 requirement, with the AECS providing a .95 probability of granting access to an authorized system to an authorized user providing the proper identifying information within three attempts. In addition, the system shall ensure an unauthorized user is granted access with less than 0.05 probability after three attempts to gain entry.”

The AECS shall require the use of a Personnel Identification Number (PIN) to be used in conjunction with the ID badge/card or the biometrics authentication method. AFMAN 16- 1404 Volume 3, subparagraph 3.a.(3) states, “In conjunction with subparagraph 3.a.(2)(a) of this section, a personal identification PIN (PIN) may be required. The PIN shall be separately entered into the system by each individual using a keypad device and shall consist of four or more digits, randomly selected, with no known or logical association with the individual.”

Subparagraph 3.a.(5)(c) states, “Keypad devices shall be designed or installed to prevent unauthorized persons in the immediate vicinity to observe the selection of input numbers.”

AFMAN 16-1404 Volume 3, subparagraph 3.a.(5)(b) states, “All card readers, keypads, communication or interface devices located outside the entrance to the controlled area shall have tamper resistant enclosures and be securely fastened to the wall or other permanent structure.” Transmission lines between all devices must be kept separate from existing communications cabling. AFMAN 16-1404 Volume 3, subparagraph 3.a.(5)(e) states, Page | 2

--FOR OFFICIAL USE ONLY—

“Electric strikes used in access control systems shall be heavy duty, industrial grade.” In accordance with AFMAN 16-1404 Volume 3, subparagraph 3.b.(4), Electrical components, including wiring, or mechanical links shall be accessible only from inside the controlled area, or, if they traverse an uncontrolled area, they shall be secured within conduit to preclude surreptitious manipulation of components.”

The computer managing the AECS, and allowing authorized personnel to be entered, or removed from the system, must be located within the open storage area and have connectivity to the systems installed at both doors. This management computer will require only a minimal degree of physical security designed to prevent unauthorized access to the panel. The computer must have the ability to remove or add an individual’s authorization to enter the area. The computer must only be accessible by individuals with a username and password. AFMAN 16-1404 Volume 3, subparagraph 3.a.(5)(d) states, “Systems that use transmission lines to carry access authorizations, personal identification data, or verification data between devices or equipment located outside the controlled area shall have line supervision.”

The existing entry control system located at both doors shall be removed after the AECS system is installed, operational, and whose function is verified by authorized personnel.

This requirement also includes all manuals and other documentation necessary to operate and maintain the AECS. All equipment must be Trade Agreements Act (TAA) compliant, ensuring that products are made in the USA or an approved country. The installation of all equipment associated with the AECS must be accomplished, or overseen, by cleared United States contractors. Finally, training on the administration, daily usage, and troubleshooting must also be included.

2. Mission Impact: To position classified networks supporting Spangdahlem and its

Geographically Separated Units (GSU) into a more resilient system, it is necessary to move a portion of Spangdahlem’s network into a second Open Storage location. During a site survey to determine the ability of Building 24 to be certified for Open Storage, it was determined that the building was missing an Automated Entry Control System (AECS). Without this AECS, building 24 cannot be Open Storage certified, impeding our ability to harden our network posture supporting Command and Control supporting USAFE and our coalition partners within NATO.

3. DAFMAN 16-404 V1 states “Foreign nationals may not engage in the following DoD security administrative activities: l. Accessing codes or functions associated with the intrusion detection system or master codes associated with access control devices.”

Therefore, foreign companies will not be included in this requirement and only US companies will be considered.