ATTACHMENT 16 - Physical Security Resiliency Design Manual - PSRDM.pdf

jross Snapshot

1 FOUO

FOR OFFICIAL USE ONLY (FOUO)

Miami VA Construct New Boiler Building Temporary Boiler Protection

Force Protect Security Consultants 10901 Front Beach Road, Suite 1415

Panama City Beach, FL 32407

MEMORANDUM FOR RECORD (MFR) 28 Jan 2025

TO: RDC John Poe Architects

SUBJECT: Miami VA Construct New Boiler Building - Temporary Boiler Protection

REFERENCES: VA Physical Security & Resiliency Design Manual (PSRDM)

VISN 8 Physical Security Design Manual Study, Project# 485-16-100

1.1 – VA Physical Security & Resiliency Design Manual (PSRDM) Considerations

1.1.1 – Protection of Temporary Equipment

Per PSRDM Section 8.4.4, temporary boilers must provide for additional physical protection and/or installation of redundant equipment (such as physically separated distributed N+1 strategies) or connections (to facilitate portable temporary plant equipment such as truck mounted air-cooled chillers) that will alleviate extended shutdown time. Additionally, and per PSRDM Table 1-5, physical security requirements for temporary buildings and equipment must be evaluated and adjudicated by the Healthcare Engineering Oversight Committee on Physical Security and Resiliency (HEOC).

As such, and in compliance with the requirements of PSRDM, this document is to serve as the basis of design for the physical security and resiliency protections as they apply to the Miami VA Temporary Boiler Plant.

1.1.2 – Risk Assessments

PSRDM Section 2.2 “Risk assessments during the project planning phase must be conducted for all VA facilities to address site/facility specific conditions and support reduction or

2 FOUO

Temporary Boiler Protection deviation from the baseline physical security and resiliency requirements”. Also, per PSRDM Sections 1.3, 2.1, and 2.2, “a risk assessment during the project planning phase is allowed to evaluate the deletion or incorporation of other specific requirements (see PSRDM Section 2.3 Exceptions and Deviations). Deviations from the baseline requirements in PSRDM must be supported by a risk assessment of both the site and facility during the planning phase of the project. Interpretations or deviations from requirements for VHA facilities must be evaluated and adjudicated by the Healthcare Engineering Oversight Committee on Physical Security and Resiliency. “VISN 8 Physical Security Design Manual Study”, Project# 485-16-100, dated 29 March 2018, is the most recent risk assessment available for the campus. These security master plan risk mitigation measures are taken into consideration as part of this report.

1.2 – Risk Mitigation Measures

1.2.1 – Temporary Boiler Site

1. Location: The proposed site location for the temporary boiler is within the contractor laydown area, which is in the west patient parking lot, directly to the west of the existing Energy Center. This location is not adjacent to any high-risk areas and has no direct line-of-site to any drop-off areas, emergency department, mailroom, or loading docks.

2. Standoff: Historically, HEOC will require both the temporary boiler and temporary control room to meet the minimum standoff distance required by PSRDM Section 3.3. As the temporary boiler operation is supporting the entire Miami VAMC campus, this equipment is to be considered ‘Critical’. Critical facilities and equipment must not allow unscreened public vehicles to travel closer than 50’ to any façade of the temporary boiler or temporary control room (and any critical supporting equipment within the project area).

PSRDM Chapter 11 defines screened vehicles and vehicle screening as follows:

Screened Vehicle: A screened vehicle is a motor vehicle that has undergone a vehicle inspection to determine whether a security threat is present. A vehicle is considered screened if it is operated by pre-authorized individuals who have followed VA’s security pre-screening processes and/or have been issued a VA Personal Identity Verification (PIV) card, a vendor/contractor badge, or has been provided with an access code for deliveries within secured areas. Vehicle inspections and the pre-authorized individuals must pass through a vehicle access control point operating 24/7/365.

Screening: The process of searching and/or validating an individual and/or vehicle in order for them to attain access to a controlled area/building/facility. See “Screened Vehicle”.

3 FOUO

Temporary Boiler Protection

The current location shown for the temporary boiler plant does not achieve the minimum 50’ standoff distance. The 50’ standoff distance is encroached along the public campus roadway and parking lots to the north of the proposed location for the temporary boiler plant. As such, the temporary boiler should be relocated within the contractor laydown area to achieve this minimum standoff distance, or vehicle screening should be implemented. Options for achieving standoff are presented below.

Options 1-A and 1-B concern the relocation of the boiler plant footprint within the proposed contractor laydown area. Option 2 concerns the establishment of vehicle screening at main public vehicle entrance to enforce vehicle screening for all public vehicles entering the campus, which would reduce the standoff distance within the adjacent public parking lots from 50’ down to 5’, per PSRDM Section 3.3.

STANDOFF OPTION 1-A: Using the perimeter fence of the contractor laydown area as the start of the 50’ standoff distance for the temporary boiler, relocate the entire temporary boiler plant further south, and outside of the minimum 50’ standoff distance from the public roadway to the north and parking lot to the west. Due to the proposed layout and as a means of enforcing the 50’ standoff for the temporary boiler plant, the contractor laydown area will require access control for any vehicle and pedestrian access through the perimeter fence. As such, implement the following:

1. Ensure all access gates are sliding and set to a default closed and locked position.

Program all sliding gates to automatically close after use.

2. Arm all sliding gates with PACS per Section 1.2.4 of this report.

3. Ensure all contractors are provided proximity cards or are issued PINs to access these sliding gates. Refer to Section 1.2.4 below for PACS location details.

4. Install temporary anti-ram barriers along the inner contractor laydown perimeter fence to enforce standoff from the west. Install anti-ram devices flush with the medians to the north to maximize standoff from this direction, where needed.

5. Install a pole-mounted 180-degree multi-sensor camera outside of the northwest corner of the contractor laydown area to observe all contractor access into the laydown area. Program the device to authenticate contractor vehicles.

NOTE: The Chiller Plant project’s construction crane may not provide for enough space to relocate the entire temporary boiler plant further south, and alternative construction crane locations may not be available. In this event, refer to Option 1-B below.

4 FOUO

Temporary Boiler Protection

STANDOFF OPTION 1-B: Using the perimeter fence of the contractor laydown area as the start of the 50’ standoff distance for the temporary boiler, relocate the entire temporary boiler plant further south and to the west, and outside of the minimum 50’ standoff distance from the public roadway to the north and parking lot to the west. Implement the PACS, sliding gate, gate operation, and SSTV mitigation measures of Option 1-A as part of this option.

NOTE: This layout may negatively affect the contractor laydown area and loading/unloading from the construction crane. This may also propose infeasibility of the temporary boiler piping, if these are to be above grade and maintain accessibility to the construction crane.

Figure 1 – Standoff Option 1-A

5 FOUO

Figure 2 – Standoff Option 1-B

STANDOFF OPTION 2: Enforce vehicle screening at the main public vehicle entrance directly to the west of the contractor laydown area. Per PSRDM Section 3.3, the minimum 50’ standoff distance required for the temporary boiler plant applies only to “unscreened vehicles”. As such, in lieu of relocating the temporary boiler plant within the contractor laydown area proposed in Options 1-A and 1-B above, implement measures of vehicle screening at the main public vehicle entrance as detailed in the Miami VA Physical Security Master Plan via the installation of facial analytics cameras and license plate readers (LPR) to meet the PSRDM definition of “Screened Vehicles”.

Per the campus’ Physical Security Master Plan (“VISN 8 PHYSICAL SECURITY DESIGN MANUAL STUDY”, Project# 485-16-100), it is proposed to designate the west central entrance (NW 14th Avenue) as the primary vehicle entrance (patients, visitors, employees, vendors, deliveries) and staff the gate 24/7. This entrance is to be designated “ENTER ONLY”, while the northwest corner gate (NW 14th Avenue) is to become “EXIT

ONLY”.

6 FOUO

However, the existing vehicle entrances have not been designed per this recommendation. The existing condition of the vehicle entrances which access the western portion of the campus consists of the following:

1. Main Vehicle Entrance (NW 14th Ave.): The entrance is established as the primary vehicle entrance and exit, with ID checks being performed by assigned gate guards.

Additionally, this vehicle entrance does not screen public vehicles in accordance with PSRDM Section 3.3. As such, and as part of this option, additional measures of vehicle screening must be undertaken for standoff to be reduced down to 5’.

2. NW Vehicle Entrance (NW 14th Ave.): This entrance is reported to not be in use and the gate entrance is secured and locked at all times. For the purpose of enforcing standoff for the temporary boiler plant, this is considered acceptable. However, the campus should revisit the perimeter access and screening recommendations from the aforementioned Physical Security Master Plan and implement as part of a dedicated campus-wide traffic control project.

3. Fisher House Access Road (from south end of the public parking lot): The roadways and parking lot directly south of the Fisher House currently have drop-arm gates which access the fisher-house-only parking lot. This lot further restricts vehicle travel from entering the main public parking lot to the north via temporary anti-ram barriers.

For the purpose of enforcing standoff for the temporary boiler plant, this is considered acceptable. However, the campus should revisit the campus access and screening recommendations from the aforementioned Physical Security Master Plan and implement as part of a dedicated campus-wide traffic control project.

7 FOUO

Figure 3 – Existing condition of the western end of the campus.

8 FOUO

Temporary Boiler Protection

The main vehicle entrance from NW 14th Ave. must be upgraded with the following to achieve PSRDM Section 3.3’s definition of “Screened Vehicles” and thus reduce the standoff to the temporary boiler plant from 50’ down to 5’. Thus, the main entrance must meet the requirements of PSRDM Section 3.5, as detailed in the Physical Security Master Plan:

1. Install a fixed camera within each entry lane of the main campus vehicle entrance, programmed with facial analytics and tied in with the SCC central database (total = 2 cameras). This discourages trespass by perpetrators due to observation, gives alert to “black-listed” trespassers (i.e., felons, listed terrorists, listed extremists, etc), gives monitoring a view of suspicious visitors, as well as records all personnel for use as evidence, if needed.

2. Install License Plate Readers (LPRs) within each entry lane of the main campus vehicle entrance, tied in with the SCC central database (total = 2 cameras).

3. Install ASTM F2656 FS30 rated anti-ram bollards along the main entrance to prevent circumvention of the screening checkpoint.

4. Install an ID card scan system, arming the sentries/guards with a hand-held scanner, tied in with an accountability system that logs the visitor’s presence on campus. This will not only ensure 100% true ID check, but will also serve as a deterrent to unwanted visitors to attempt entry. Additionally, this system will collect data that will be needed in a court of law as evidence, were an event on campus to occur.

5. The gate guards should also check in delivery trucks/vehicles that are not already on the “cleared” list. This screening process for delivery trucks/transport vehicles requiring entry to the warehouse loading dock service yard is to consist of vehicle search (inside and out, including under-mirror checks). Therefore, a pull off/ search staging lane should be designated (recommend current bus stop pull-off, outer-most lane). Upon vetted screening, the gate guard should then contact the Service Yard Dock Manager and advise approach of the vehicle, therefore allowing the service yard gate to also be opened for them.

6. Install efficient security lighting at this checkpoint, per PSDM Section 3.6.

7. Refer to Figure 4 below for details.

9 FOUO

Figure 4 – Main entrance retrofit as part of Option 2.

Figure 5 – Example, Two-lane triple-authentication drop-arm gate system.

10 FOUO

Figure 6 – Campus Defense Plan from “VISN 8 PHYSICAL SECURITY DESIGN MANUAL STUDY”

11 FOUO

Temporary Boiler Protection

3. Fencing: Per the site plan, the entire contractor laydown area is to be fenced with ARX high-security portable fencing or equivalent. The temporary boiler and temporary control room are to be further fenced off from the contractor laydown area. This is considered acceptable, however, ensure all fencing is at least 8’-10’ in height. Install anti-ram barriers along the entire temporary boiler plant that lies within the contractor laydown area at risk of vehicle strikes. Refer to Figure 7 below for location details.

4. Gates: The temporary boiler plant area should be considered restricted space, with access granted only to credentialed VA-staff. As such, entrance gates into the temporary boiler plant site area should be sliding type gates, armed with PACS per Section 1.2.4 of this report, and should default to a closed and locked position. Ensure all entrance gates into the temporary boiler plant area is accessed from outside of the contractor laydown area, to prevent cross traffic between these spaces.

If selecting Standoff Option 1-A or 1-B, ensure the access gates into the contractor laydown area are also armed with PACS, and gates have sliding operation which is set to default closed position. Refer to Section 1.2.4 below for PACS location details.

Figure 7 – Perimeter Fencing and Anti-ram.

12 FOUO

Figure 8 – Example, ARX High Security Fence

5. Anti-ram: As mentioned previously, the temporary boiler plant is considered Critical per

PSRDM. As such, the temporary boiler plant is vulnerable to the risk of vehicle strikes in select locations, which could result in a shutdown of boiler plant operations campus-wide.

Ensure all sections of the temporary boiler plant perimeter fence that lies within the contractor laydown area are protected with anti-ram barriers, such as jersey barriers. Use additional anti-ram barriers to enforce standoff, where applicable, and as detailed in Section 1.2.1.2 above. Refer to Figure 7 above for location details.

1.2.2 – Temporary Boiler Blast Protection

While the temporary boiler plant is considered Critical per PSRDM, this boiler plant operation is temporary, and does not reflect a permanent condition. As such, it is not recommended to blast protect the temporary boilers, temporary control room, or temporary utility routing.

However, as a means of ensuring utility redundancy in the unlikely case of a loss event affecting the temporary boiler plant, ensure the utility redundancy and resiliency mitigation measures from Section 1.2.3 below are implemented as an equivalent level of protection.

13 FOUO

Temporary Boiler Protection

However, and as mentioned in Section 1.1.1 of this report, the COR must submit for adjudication of this protection plan, as well as clarification of the requirements for blast protection to be implemented as part of the protection of the temporary boiler operation.

In the event HEOC requires blast protection of the temporary boiler plant, a simple solution would be to replace the temporary boiler plant’s perimeter fence with a blast-resistant masonry screen wall system and designed with withstand the W2 threat design at the 50’ standoff distance. Additionally in this event, all buried utility piping should be buried and routed through locations where unscreened vehicles cannot travel.

1.2.3 – Temporary Boiler Utility Redundancy

Ensure the temporary boiler plant is on emergency power, with sufficient fuel storage to support 96 hours of utility redundancy. Ensure the temporary boiler plant has sufficient boiler fuel to support the normal demands of continuous operation for a period of 15 most extreme days of the heating season.

Additionally, install emergency connections for steam services at or near the building entrance point, where it will be unobstructed and accessible, above grade, in an area not subject to flooding. Where looped systems enter the building at two points, the emergency connections need only be installed on one entry.

1.2.4 – Temporary Boiler Physical Access Control System (PACS)

Per PSRDM Section 5.12, access into restricted spaces must be controlled using electronic access control devices and in accordance with PSRDM Appendices A and B. Arm the following doors with access control per the chart below, ensuring dual authentication (PIV & PIN), as well as interlocking PACS with adjacent SSTV, all tied to the Miami VAMC SCC:

DOOR LOCATION TOTAL NOTES

Temp Boiler Plant Sliding Gate 1

Arm per SDO 103:

Hardware Devices:

1. Card Reader

2. Closer

3. Continuous Hinge

4. Deadbolt

5. Door Contact

6. Electric Strike, Magnetic Lock, or Electric

Mortise Lock

7. Exit Device

8. Hold-open Alarm

14 FOUO

Temporary Boiler Protection

Operation at All Times:

1. Outside lever always rigid

2. Card reader releases electric strike

3. Free operation from interior at all times

Temporary Control Room Single Door 1

Arm per SDO 103:

Hardware Devices:

1. Card Reader

2. Closer

3. Continuous Hinge

4. Deadbolt

5. Door Contact

6. Electric Strike, Magnetic Lock, or Electric

Mortise Lock

7. Exit Device

8. Hold-open Alarm

Operation at All Times:

1. Outside lever always rigid

2. Card reader releases electric strike Free operation from interior at all times

For Standoff Options 1-A and 1-B: Contractor Laydown Area Entrance Sliding Gates

Arm per SDO 103:

Hardware Devices:

1. Card Reader

2. Closer

3. Continuous Hinge

4. Deadbolt

5. Door Contact

6. Electric Strike, Magnetic Lock, or Electric

Mortise Lock

7. Exit Device

8. Hold-open Alarm

Operation at All Times:

1. Outside lever always rigid

2. Card reader releases electric strike Free operation from interior at all times

NOTE: The assigned ASIS PSP is to conduct a QAQC peer review of each design submission (schematic, DD, CD, 100%) prior to submission to the VA per PSRDM Section 2.1.2.

1.1.1 –Temporary Boiler Security Surveillance Television (SSTV)

Install exterior pole mounted 360-degree multi-sensor cameras within the temporary boiler plant perimeter fence per the chart below to cover areas dictated by PSRDM Appendix B.

Ensure SSTV is tied to PIV/PACS and linked to the Miami VAMC SCC and installed as specified

15 FOUO

Temporary Boiler Protection by PSRDM Appendix B. Note: as these are pole-mounted, there will be blind-spots due to the presence of the pole. Ensure all poles are located such that the blind spots are outside of the interior temporary boiler plant area.

SSTV LOCATION TOTAL NOTES

Exterior, NE Corner 1 Install a pole-mounted 360-degree multi-sensor camera.

Exterior, SW Corner 1 Install a pole-mounted 360-degree multi-sensor camera.

For Standoff Options 1-A and 1-B: Exterior, Outside of NW Corner of Contractor Laydown Area

Install a pole-mounted 180-degree multi-sensor camera to observe all access into the contractor laydown area. Program device to authenticate contractor vehicles.

Figure 9 – Temporary Boiler Plant SSTV Devices

NOTE: The assigned ASIS PSP is to conduct a QAQC peer review of each design submission (schematic, DD, CD, 100%) prior to submission to the VA per PSRDM Section 2.1.2.

16 FOUO

END OF REPORT

This report is confidential. It is intended for the information and use of the client to whom it is addressed. Force Protect Security Consultants does not guarantee the accuracy and completeness of outside agency records.

STEVEN WILBANKS, PSP

Physical Security Consultant steven@force-protect.com 502-930-0010

17 FOUO

ACRONYMS AND ABBREVIATIONS

AHJ Authority Having Jurisdiction ASIS American Society of Industrial Security AT Anti-Terrorism CPTED Crime Prevention Through Environmental Design FPCON Force Protection Condition HEFP Healthcare Environmental & Facilities Programs HEOC Healthcare Engineering Oversight Committee IDS Intrusion Detection Systems IED Improvised Explosive Device LPR License Plate Reader PACS Physical Access Control Systems PIN Personal Identification Number PIV Personal Identity Verification PSP Physical Security Professional PSRDM Physical Security & Resiliency Design Manual SCIP Strategic Capital Investment Plan SPS Sterile Processing Service UCR Uniform Crime Report VA Department of Veterans Affairs VACO Veterans Affairs Central Office VAMC Veterans Affairs Medical Center VBIED Vehicle Borne Improvised Explosive Device VMS Video Management System