Attachment 2 Physical Security.pdf

For Official Use Only

Orlando VA Health Care System

Electronic Security System, Locks and Keys Specifications Contact VA Police for the most current specifications, this is a living document that will frequently change. All proposed security systems shall be presented to the Physical Security Specialist or Police Service delegated person for approval, and a list of proposed components shall be provided. Please refer to the VA Physical Security and Resiliency Design Manual and VA Handbook 0730 for the minimum required electronic security system components. All Electronic Security Systems such as but not limited to cameras, intrusion, key management, etc… shall be integrated into the access control system where and when possible. All equipment must be TAA and NDAA compliant. Equipment should be on the GSA Advantage site to avoid additional vetting requirements. VA Police Physical

Security may be contacted at vhaorlpolicephyssecurity@va.gov.

Surveillance Camera Systems:

1) Lake Nona is the head end and runs Pelco VideoXpert Enterprise

2) Other than Lake Nona:

a. Locations that are not expected to go over 100 cameras: VideoXpert Pro and all required components and licenses to allow integration into the Lake Nona Enterprise (Head End) system.

i. Pro servers shall be “Power” series running Windows Server 2019 or better with a RAID 6 storage configuration.

ii. Contact Physical Security to determine what licenses if any are needed for expansions.

iii. New locations shall support a minimum 10% growth.

b. Locations with over 90 cameras (within 10% of the 100 camera recommendation) shall use a VideoXpert Enterprise setup all required components and licenses to allow integration into the Lake Nona Enterprise system.

i. Each Enterprise site shall have a CMG (CMG/CMG2/CMG3/etc…) and appropriate storage for the number of cameras on site.

ii. Each Enterprise site (other than Lake Nona) shall have sufficient Enterprise Aggregation Licenses added to the Lake Nona head end to aggregate the system.

iii. Each Pro site shall have sufficient Pro Aggregation licenses added to the Lake Nona head end to aggregate the system.

iv. New locations shall support a minimum 10% growth.

v. Existing locations that reach 90 cameras shall be evaluated by Physical Security to determine if migration to an Enterprise system is needed.

c. Storage servers shall be:

i. Checked to ensure they are set to RAID 6 with the formatting to allow the maximum expansion capability for that server.

ii. Checked to confirm the storage array is set as the recording pool

iii. Checked to confirm the OS drive is not in the recording pool

3) We are currently running VideoXpert 3.19 (Enterprise and Pro) 02-10-2023.

mailto:vhaorlpolicephyssecurity@va.gov

4) Cameras:

a. When adding cameras or upgrading existing cameras the vendor must confirm the required storage is available and include additional storage when needed.

i. Storage capacity must allow for a minimum of 30 days 24/7 recording

ii. Storage shall be based on the camera’s maximum resolution settings

iii. Storage shall be based on recording at 30 fps

iv. Smart compression should be set to low

v. Storage shall have an additional 10% buffer to the above.

vi. Storage servers shall be upgradeable to the maximum capacity, currently 288TB.

I.E. Pelco E series chassis with open bays allowing expansion to 288TB of storage.

b. Cameras shall be powered via PoE unless approved by the COR/Program Manager.

i. Media converters may be used when distances are greater than the distances certified for ethernet Cat6a cabling.

ii. Media converters shall have Uninterruptable Power Supplies (UPS) supplying the camera end to ensure operation until generator power is established during outages.

c. Cat6a or better cabling shall be used.

d. Pelco is the preferred camera manufacturer. Cameras shall be the better of Pelco professional or enterprise-grade cameras and be submitted for approval to Physical Security. Other manufacturers’ cameras may be submitted for approval and shall be equivalent or better of the closest Pelco equivalent.

e. Cameras housings in “Clean” areas (surgery, sterile storage, etc...) shall be of appropriate materials for the area and suitable for cleaning with chemicals used for sterile area cleaning.

f. Must be capable of H.264 recording, H.265 preferred

g. 1080p (1920X1080) resolution or better

h. Must include all required licensing for a minimum of 3 years.

i. Contact VA Police Physical Security prior to purchasing licenses.

1. Currently, Enterprise Channel Licenses are not needed for the Lake

Nona system due to unused licenses in that system. Date: 02-10-2023.

2. Enterprise channel licenses may be needed for other Enterprise systems.

3. Pro channel licenses may be needed for Pro systems.

4. Contact VA Police Physical Security for Software Upgrade Program (SUP) license requirements. SUP’s may be required for new installs, this determination shall be made by the Physical Security team.

5. Must include Enterprise aggregation or Pro aggregation licenses as applicable.

6. Must include all required licensing to allow integration into the ePACS and associated Electronic Security Systems (ESS).

7. Contact Physical Security to determine what licenses if any are needed.

i. Camera maps shall be created/updated when new cameras are installed.

j. Cameras shall be approved by VA Police Physical Security and the VA Locksmith.

5) Cameras shall be configured to:

a. ICS network Time Server

b. 16:9 or better if capable

c. Video Streams

i. Primary stream shall be set to the maximum resolution 15fps

ii. Secondary shall be one setting down 7.5fps

iii. Tertiary shall be one setting down from secondary 5fps

iv. Some cameras may be set to higher recording rates at the discretion of VA

Police Physical Security

d. Pan Tilt Zoom (PTZ) cameras shall have their “startup point” defined and set to a

“useful” location. See item 11.

e. PTZ cameras should be paired with “Multiview” cameras for full coverage

f. Audio shall be disabled as a default. Specific cameras may be identified as needing audio enabled.

6) Must provide the greater of 1-year parts and labor warranty or manufacturer warranty with labor costs included for all systems to be maintained by the OVAHCS

7) Must be installed and supported by a Pelco VideoXpert Enterprise Certified installer

8) A workstation shall be provided for local camera viewing at all new facilities.

a. Multiple shared displays may be needed at new locations. Contact Physical Security for locations.

9) All computers/servers

a. Including shared displays shall have “turn on after power loss” enabled in BIOS

b. Configured for remote desktop connections.

c. Turn off IPV6 in the network settings.

d. Updated to the current VideoXpert version being used by the OVAHCS

e. Once connected and after update, toolbox shall be checked to confirm the version shows correctly in Toolbox.

10) Network interface cards (NIC) Teaming shall be set up for storage servers when they have more than one NIC. Contact the VA Locksmith for clarification and correct configuration.

11) Contractors working on the servers must be Pelco VideoXpert Enterprise certified and have the appropriate background check level.

12) Contact Physical Security for clarification.

Electronic Physical Access Control System (ePACS):

1) Contact VA Police Physical Security to confirm the ePACS system to be installed.

2) The Orlando VA HCS uses PIV 5.5, 7, and 8.1 cards. Currently, PIV 8.2 cards are approved but have not been deployed by the federal government. The ePACS systems shall be able to use all cards deployed by the federal government and be upgradeable for future PIV cards.

3) Contact Physical Security to determine what licenses if any are needed.

4) The Orlando VA Health Care System is transitioning all sites to LenelS2 OnGuard Professional

8.1:

a. All systems will be connected to the “Head End” at Lake Nona.

b. System will use GSA IDManagement.gov APL 10126. See FIPS 201 Approved Products

List - Physical Access Control System Components (idmanagement.gov) for details.

c. Power supplies and door controllers shall be life safety with batteries for redundant power.

d. System Controllers: LenelS2 – LNL-X4420. (This is the only allowable controller for readers for a FICAM-compliant OnGuard system). 16 door readers max per LNL-X4420 to ensure future FICAM upgradability. 8 doors max if all require high security.

https://www.idmanagement.gov/approved-products-list-pacs-products/ https://www.idmanagement.gov/approved-products-list-pacs-products/

e. Interface boards LenelS2- LNL-1300-S3, LNL-1320-S3, LNL-1324e and the LNL-1100-S3, LNL-1200-S3.

f. Validation system software, components, and licenses (All purchased through LenelS2)

i. TI EntryPoint EP—EWS base License

ii. TI EntryPoint EP-PNL-RDR Panel/Server License, per controller, 2 readers

iii. TI EntryPoint EP-ADD-RDR-2 Additional 2-reader license

iv. TI EntryPoint EP-ADD-BWS Additional Enrollment Station

v. LenelS2 SWG-AUTH-002 – OnGuard High Assurance reader, bundle of 2.

vi. PIV Readers licenses (All purchased through LenelS2) LenelS2 Veridt 900W2036- QXYON Stealth Dual (Part number not yet verified for appropriate firmware version. Alternate part number may be required.)

g. Card Reader: Veridt 900W2036. Must be compatible with PIV 5.5, 7, 8.1 and 8.2 cards.

h. The door access control communications protocol is currently Wiegand. This will be converted to OSDP in the future and the appropriate cabling shall be in place to allow for this.

i. Enclosure and contents must be UL certified as a complete unit.

j. Contact VA Police Physical Security if any clarification is needed.

5) Orlando VA HCS Legacy ePACS systems:

a. AMAG/Symmetry 8.0.2 Homeland Security Edition (Lake Nona)

i. Javelin S8 series card reader with PIV 5.5, 7, 8.1 and 8.2 compatible firmware.

ii. Contact VA Police Physical Security for panel information.

b. Identiv Hirsch hardware. (all other locations)

i. Currently running Velocity 3.8.4

ii. Mx series control panel’s.

iii. Must use SNIB 3’s for FIPS compliance.

iv. Must include components for FICAM HSPD-12 compliance.

v. Must use PIV Class card plus Pin pad reader that can read PIV 5.5, 7, 8.1 and 8.2 cards.

1. Preferred Card Reader: Veridt 900W2036 using Weigand protocol with capability to be used with Lenel OnGuard.

2. All others must be approved

3. Potential alternate readers

a. HID pivCLASS RPK40

b. HID pivCLASS RKCL40

c. HID pivCLASS Biometric Reader

d. HID Signo 20K PIV

e. HID Signo 40K PIV

c. The Orlando VA HCS expects to start transitioning to LenelS2 OnGuard in May 2023. All ePACS installations (expansions of existing facilities and new facilities) expected to come online after this date shall be LenelS2 OnGuard unless otherwise approved by VA Police Physical Security.

6) Must include all required additional licensing where applicable. Contact Physical Security to determine what licenses if any are needed to include required integrations such as but not limited to:

a. Key management

b. Camera system

c. Intrusion Detection

d. Intercom

e. Camera Analytics

f. Visitor Management

7) All systems must be installed by installers certified by the appropriate manufacturer.

8) When installing new readers, the access control cabling must be OSDP compatible.

a. May be composite cable such as ANSI: 4461030-500/OSDP 1 4 Elem Comp Cable CMP Ylw Jacket along with any additional cabling needed for FICAM compliance to include meeting manufacturers’ recommendations for cabling or similar cabling meeting the manufacturer’s requirements. We have been advised the requirements for cable are:

b. 1-22/24awg 2 twisted individually shielded pairs (TSP) for reader.

c. Longer distances may need dedicated power to the reader.

d. 1-18awg 4 conductor for rex.

e. 1-18/22awg 2 conductor for contact.

f. 1-18awg 4 conductor for electric locking hardware.

g. Contact Physical Security if there are more than 4 end devices.

9) Greater of 1-year parts and labor warranty or manufacturer warranty with labor shall be included for systems to be maintained by the OVAHCS.

10) Contact Physical Security for location requirements.

11) Systems shall be managed by the VA.

12) The Orlando VA HCS is in the process of migrating to LenelS2 OnGuard Professional 8.1 Contact

Physical Security for the most recent information on what system to install.

Intercom Systems

1) OVAHCS is currently using AIPHONE for its intercom solution.

Intrusion Detection Systems (IDS):

1) All VA managed IDS not integrated with the access control systems will be monitored by the Department of Homeland Security, Federal Protective Services, MegaCenter when the VA is responsible for the alarm. All equipment must be compatible with their monitoring.

https://www.dhs.gov/megacenters Battle Creek MegaCenter: 269-565-9616. They may be contacted for current standards.

2) Some sites IDS may be integrated into the access control system. Contact the physical security group to determine which solution is appropriate.

3) Greater of 1-year parts and labor warranty or manufacturer warranty with labor shall be included for systems managed by the OVAHCS.

4) If the lessor owns/manages the IDS, it shall be installed and monitored by UL certified entities and must comply with all Federal, VA, State and local regulations and requirements.

Duress:

1) VA Police staffed locations

a. Lynx computer-based panic system shall be used in areas with VA computers.

b. Physical Lynx panic buttons may be used if the area has no VA computers.

c. Contact Physical Security to determine what licenses if any are needed.

https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.dhs.gov%2Fmegacenters&data=04%7C01%7C%7C62dfb04f5b4242926f7c08d925c34059%7Ce95f1b23abaf45ee821db7ab251ab3bf%7C0%7C0%7C637582342789598756%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=1eVVfUfRDb0OSkVRcIxXECdqxzZqNQPfoHcMsDFwoBY%3D&reserved=0

2) Non VA Police staffed locations

a. Lynx computer-based panic system is preferred. Notification of duress can be set so that all employees receive notification

b. Please contact VA Police Physical Security for Lynx capabilities to determine if another solution is needed

3) Duress may also be integrated into the ePACS system instead of using Lynx if approved by

Physical Security.

4) Physical Security shall be contacted to determine if Lynx licenses need to be purchased.

Key Management:

1) Traka Touch Pro Intelligent Electronic Key Cabinets.

a. Key Cabinets shall be installed in all expansions, remodels, and new facilities.

b. The size/model of the cabinet is dependent on the number of expected users/keys to be maintained in that Facility/Building/Area.

i. Small locations and buildings may only require 1 key cabinet.

ii. Medium and Large facilities shall have a key cabinet in each clinic and department.

iii. Contact VA Police Physical Security who will coordinate with the VA Locksmith and other key VA personnel to asses how many key cabinets are needed and where they shall be located.

iv. Key cabinets shall have power and data installed behind the cabinet

c. Key Cabinets shall be managed via Traka Web v03.14.0001 (may be upgrading to a newer version).

d. Key Cabinets shall be integrated into the LenelS2 access control system.

2) Contact Physical Security to determine what licenses if any are needed.

Network and networked devices:

The electronic security systems shall be on an isolated network. The VA Locksmith will provide specifications and guidance on if switches need to be acquired. All copper ethernet cabling shall be red in color Cat6a or better and be in conduit unless otherwise approved by Physical Security. All cabling shall be labeled with the termination points on both ends. UPS’s may need to be supplied if switches are needed. Contact VA Police Physical Security who will coordinate with the VA Locksmith to determine if additional switches and related equipment are needed for any project with electronic security system components.

1) Switches

a. Copper switches shall be Cisco 9300-24/48H Network Advantage with C9300-NM-

4M/2Y/8X uplink module with a base 1100W AC or better power supply or equivalent.

Contact the VA Locksmith for the appropriate switch model. All other switches must be approved by the VA Locksmith.

b. Switches shall have modular or fixed uplinks.

c. Switches shall have secondary 1100W AC or better power supplies.

d. Switches shall be capable of 90 watts PoE (PoE++, UPoE, etc…). For projects requiring switches, the camera types to be installed shall determine if the full 90 watt PoE capability is needed. For switch orders, check with the VA Locksmith to determine PoE wattage needed.

e. Fiber switches shall be Cisco 9300 series, check with VA Locksmith for the correct switch and configuration.

f. Core switches, check with VA Locksmith for correct configuration.

2) Switches and other networked devices such as access control boards and workstations shall only be installed once the room is turned over to the VA and secured. Peripheral devices without onboard storage such as card readers and cameras may be installed in their final locations.

3) Alternate manufacturers or models require approval from the VA Locksmith and Physical Security.

Door Locking Hardware:

1) The VA Locksmith shall be consulted on all proposed door locking hardware to ensure it conforms with requirements and can be serviced by the Locksmith.

a. Door lock Core shall be 7 pin Small Format Interchangeable Core (contact the VA Locksmith for that facility’s lock pin count).

b. Door lock Brand and model shall be approved by the VA Locksmith.

c. Approval is needed for all locks.

i. All locks shall accept 7 pin small form factor interchangeable core.

ii. All locks shall be Grade 1.

iii. Locking hardware should be Sargent hardware.

2) All door hardware shall follow the PSRDM guidelines.

3) Electric Mortise locks shall be the preferred type of electronic lock.

4) Pin pad type and other mechanical “cipher” locks are not allowed.

5) Electronic Panic hardware may be used when appropriate and approved.

6) Magnetic locks.

a. Shall have a mechanical backup.

b. Shall have key override switches installed on the nonsecure side.

c. Shall have an override button on the secure side.

d. Shall not be used for exterior doors.

e. Should only be used for opposing doors.

7) Wireless automatic door opener buttons must be approved by VA Police Physical Security in coordination with the VA Locksmith.

8) Copies of keys.

a. VA Police shall have override keys to all doors in accordance with VA handbook 0730.

b. Master keys shall be provided to minimize the number of keys held by VA police.

c. VA Police shall have a copy of all Special Key Different (SKD) keys that are not on the master key system.

d. VA Locksmith shall be given all required information to make duplicate keys.

General

1) All guidance from the VA CFM TIL and other VA guidelines shall be followed. Waivers may be reviewed for approval when necessary.

2) All contractors working on these systems must have the appropriate certifications, IE Pelco VideoXpert Enterprise to work on the Pelco servers.

3) All contractors doing installation or service and maintenance must have completed the OSHA 10 hour construction safety course.

4) The contractor shall provide a “Competent Person” as defined by OSHA when applicable.

5) A contractor using a lift must have a lift certification.

6) All certifications shall be provided to the COR or VA Program/Project manager prior to starting work.

7) Background checks may be required at the discretion of the VA based on the type of work to be done by each person.

8) All electronic security system cabling shall follow VA requirements for being in conduit. Waivers may be required if this cannot be met due to where it needs to be installed or budget.

VA shall retain ownership of all components with onboard storage/memory even when installed by a lessor.

Reference: https://www.cfm.va.gov/til/dManual.asp#PSR Physical Security and Resiliency section

1) Camera/ePACS locations: https://www.cfm.va.gov/til/PhysicalSecurity/dmPhySecAppxB.xlsx

2) Door type location guide: https://www.cfm.va.gov/til/PhysicalSecurity/dmPhySecAppxA3.xlsx

3) Door type requirements: PSRDM - Appendix A2 Security Door Opening Schedule (va.gov)

4) Security door types: PSRDM Appendix A1-Security Door Types (va.gov)

5) VA Handbook 0730 http://www.va.gov/vapubs/search_action.cfm?formno=730&SortBy=Pub_Type_Desc https://www.cfm.va.gov/til/dManual.asp#PSR https://www.cfm.va.gov/til/PhysicalSecurity/dmPhySecAppxB.xlsx https://www.cfm.va.gov/til/PhysicalSecurity/dmPhySecAppxA3.xlsx https://www.cfm.va.gov/til/PhysicalSecurity/dmPhySecAppxA2.pdf https://www.cfm.va.gov/til/PhysicalSecurity/dmPhySecAppxA1.pdf http://www.va.gov/vapubs/search_action.cfm?formno=730&SortBy=Pub_Type_Desc