Exhibit B-1. Security Standards Warehouse.pdf

Exhibit B-1 Page 1 of 7 RLP No. 36C24424R0041 Lease No. 36C24424L0006

Department of Veterans Affairs VA Handbook 0730/4

Transmittal Sheet March 29, 2013 Security and Law Enforcement

Physical Security Requirements and Options

(X) - Applicable Requirements, (O) - Optional Measures

Location A B C D E F G H I J K L M N O P Q R S

Warehouse Storage/Bulk

O X X X X X X X O X

Commercial Electrical Power Connections

X O X X O O X X

Primary Inventory (medical supplies)

O X O O O O X O O O

New Linen Storage

X X X X X O

Medical Media Equipment Rooms

X X X X X O X X O

Exhibit B-1 Page 2 of 7

Applicable Requirements (VA Handbook 0730/4)

A - Windows. When below 12 m (40 ft.) from ground level or the roof of a lower abutment, or less than

7.5 m (25 ft.) from windows of an adjoining building, or accessible by a building ledge leading to windows of other floor rooms, security mesh screening for windows is required. Security measures that exceed these requirements may be authorized in writing by OS&LE. Required specifications for stainless steel security mesh screening are:

1. All #304 stainless steel woven mesh 0.7 mm (.028 in.) wire diameter, with tensile strength of 15 kg/mm (800 pounds per linear inch).

2. Mesh 12x12 per 25 mm (1 in.) with main and sub frames of 2.7 mm (12 gauges) carbon steel with baked enamel finish and internal key locking slide bolts.

B - Walls. Exterior walls of brick and masonry construction are acceptable. Exterior walls which are composed of wood frame and siding require an interior backing of steel security screen mesh or sheet partition. Pharmacy and Agent Cashiers perimeter walls shall be full height, floor to underside of slab above. Interior walls containing dispensing windows shall be a minimum of 100 mm (4 in.) solid concrete masonry units to ceiling height with either masonry or gypsum wallboard to underside of slab above. Bulk control substance storage vaults require perimeter walls of brick or masonry construction full height.

C- Doors and Door Locks. The locking requirements (including access-controlled egress doors) outlined in National Fire Protection Association (NFPA) Life Safety Code standard, latest edition, 101-7.2.1.5 and 7.2.1.6 must be followed.

1. Door Construction: Doors are of 45 mm (1-3/4 in.) solid core hardwood or hollow steel construction. Dutch or half doors are unacceptable. Removable hinge pins on door exteriors must be retained with set pins or spot welded, preventing their removal. This applies only if the hinge pins are on the outside of the doors and door frames. Hinge pins will be on the outside if the door opens outward,

2. Mechanical locking systems. Where mechanical lock systems are used, installed lock sets must allow for single motion egress. The installation of high security exit devices meeting NFPA Life Safety Code standards is appropriate.

(a) Glass doors or doors with glass panes must have one lock set that is key operated from the interior of the protected area.

Note: Fire code prohibits locks from being locked from the inside that require a key to exit. The intent is that there must be two locks, one of which must be key operated. The other lock can be key, combination or electronic. (NFPA 101, 7.2.1.5.2 Locks if provided, shall not require the use of a key, a tool or special knowledge or effort for the operations from the egress side

(a) Steel doors will not be set into wooden frames.

(b) Doors set in steel frames must be fitted with a mortise lock with a deadlock feature.

IAW ANSI/BHMA Al 56.13 American National Standards for Mortise Locks

(c) The day lock on the main door must be automatically locking, with a minimum 19 mm (3/4 in.)

dead bolt and inside thumb latch. Combinations or keys to day locks will be restricted to service employees and combinations changed immediately on the termination or reassignment of an employee. See paragraph 8 of this appendix for a detailed description of key control systems.

Exhibit B-1 Page 3 of 7

3. Electronic/Magnetic locking systems. Where installed, electronic locking systems will include an automatic "request to exit" sensor and a "push to exit" manual lock release switch. Refer to the NFPA Life Safety Code for details.

D - Other Room Access Means. Interstitial overhead areas which enable entry into a secure room from an unsecured room must be barricaded by the installation of a suitable partition in the interstitial space which prevents "up and over" access. Openings in construction above ceilings or below raised access floors shall be protected as below requirement.

All vents, ducts, and similar openings in excess of 96 square inches (620 cm2) that enter or pass-through space shall be protected with either bars or grills. If one dimension of the duct measures less than six inches (150 mm) or duct is less than 96 square inches (620 cm2), bars are not required;

however, all ducts must be treated to provide sufficient sound attenuation. If bars are used, they must be 1/2-inch (12.7 mm) diameter steel welded vertically and horizontally six (6) inches (150 mm) on center;

if grills are used, they must be of 9-gauge expanded steel.

E - Motion Intrusion Detectors. An intrusion detection alarm system which detects entry into the room, and which broadcasts a local alarm of sufficient volume to cause an illegal entrant to abandon a burglary attempt. Intrusion detector equipment which operates on the principle of narrow beam interception, door contacts, microwave, or photoelectric eyes are unacceptable as the primary means of detection. Intrusion detectors must have the following essential features.

1. An internal, automatic charging DC standby power supply and a primary AC power operation.

2. A remote, key operated activation/deactivation switch installed outside the room and adjacent to the room entrance door frame and/or a central alarm ON-OFF control in the Police office or other monitoring location.

3. An automatic reset capability following intrusion detection.

4. A local alarm level of 80 dB (min) to 90 dB (max) within the configuration of the protected area.

5. An integral capability for the attachment of wiring for remote alarm and intrusion indicator equipment (visual or audio).

6. A low nuisance alarm rate as defined in VA Master Specifications, Division 28 Electronic safety, and Security "28 16 1 1 INTRUSION DETECTION SYSTEM."

7. Installation Notes

(a) A locally sounding alarm should not be installed in a room which is close to an ICU, cardiac care, or other special treatment areas where a loud alarm would have an injurious effect on patients.

(b) In addition to the locally sounding alarm, remote visual and/or audio annunciators must be at a location within the facility which ensures 24-hour monitoring. These annunciators will have the capability of identifying individually protected zones.

(c) In protected rooms of outpatient clinics not on facility grounds, intrusion detector alarms may be routed to a commercial security alarm monitoring firm, a local police department, or a security office charged with building security. The remote alarms will be in addition to locally broadcast alarms in the protected areas.

(d) Remote bulk storage warehouse facilities will have one or more local broadcasting alarms inside and outside of the protected area.

Exhibit B-1 Page 4 of 7

(e) When replacing existing systems, or purchasing new, consideration will be given to intrusion detection equipment that integrates with CCTV and physical access control systems.

F - Pharmacy Dispensing Counter. Windows and walls of pharmacy dispensing must meet the U.L.

Standard 752 for Class Ill Ballistic Level. VA Architectural Standard Detail 67 B applies to pharmacy dispensing windows, but the window should be set in a minimum 100 mm (4 in.) solid concrete masonry units to ceiling height with either masonry or gypsum wallboard to underside of slab above.

G - Agent Cashier Counter. Bullet resistive service windows must meet the U.L. Standard 752 for Class Ill Ballistic Level. VA Architectural Standard Detail 67 applies to cashier counter construction. Applicable also to other cash transaction facilities. The windows should be set in a minimum 100 mm (4 in.) solid concrete units to ceiling height with either masonry or gypsum wallboard to underside of slab above

H - Bulk Drug Storage Safes and Vaults. Drugs classified as schedule l, Il, or Ill (narcotic controlled substances under the Controlled Substance Act of 1970 must be stored in safes or vaults which conform to the following specifications:

1. Safes will be GSA class 5 security containers weighing no less than 340 kg (750 pounds).

2. Where bulk quantities or controlled substance handling requirements deem safes impractical, vaults must be used. Specifications for two types of vaults are given: Type I for outpatient clinic or center use, and type Il for construction in medical centers only. The type I vault is not as formidable and permanent a structure as the type Il concrete vault and, therefore, schedule l, Il, and Ill (narcotic) controlled substances may not be stored on open shelving within the type I vault. To compensate for the lower security of type I vaults lockable steel cabinets installed within the vault must be used for schedule I Il, and Ill (narcotic) substances. Vault specifications are as follows:

(a) Type I Vault. Enclosure constructed of steel security screen, woven mesh, 1.2 mm (.047 in.) wire diameter alloy #304 stainless steel, with tensile strength of 29 kg/mm (1 ,600 pounds per linear inch). Mesh 10 x 10 per 25 mm (1 inch) with main frame and sub frames of 2.4 mm (13 gauge) alloy #304 steel. In rooms with dropped ceilings, the vertical frames and mesh walls must meet the actual ceiling, or a security mesh ceiling installed below the false ceiling. In lieu of security mesh screening enclosures, type I vaults may be constructed of 2.4 mm (13 gauge) steel wall partition material with corner brackets welded and floor/ceiling anchors firmly set to prevent disassembly. Mesh vaults may be enclosed with drywall or paneling with appropriate ventilation openings.

(b) Type Il Vault. Constructed of walls, floors, and ceilings of minimum of 200 mm (8 in.)

reinforced concrete or other substantial masonry, reinforced vertically and horizontally with 13 mm (1/2 in.) steel rods tied 150 mm (6 in.) on center. Doors and day gates must meet GSA class 5 criteria. Vault ventilation and utility ports may not exceed 0.06 m (100 square in.) in area

I - Bulk Drug Storage Cabinets. Steel cabinets with adjustable shelving and built in locking devices are required for the storage of bulk supplies of schedule Ill, Nonnarcotic, to V controlled substances.

J - Closed Circuit TV. Security Surveillance TV camera with motion detector feature on cameras and at monitor location. Telecommunications Support Service (197) may be contacted for obtaining technical assistance. See VA Handbook 0730, Part E for further details and considerations.

K - Special Key Control. Room door lock keys and day lock combinations, where applicable, are Special Keys as defined in paragraph 9.d.(10) of this appendix.

L - Drug Cabinets. Key locked, all steel cabinets, firmly anchored in place are required for ward, emergency room or treatment room storage of small quantities of controlled substances. Locked unit dose carts are acceptable; but must be positioned in a supervised area when not in use. Glass front drug cabinets are not

Exhibit B-1 Page 5 of 7 acceptable for controlled substance storage. Plexiglas front cabinets 10 mm (3/8 in.) or greater in thickness, are acceptable.

M - Refrigerators. To be equipped with a built-in lock mechanism or hasp with padlock when used to store controlled substances (all schedules) and other potentially dangerous drugs and when located outside a locked or attended drug storage room.

N - Medical Supply Rooms and Closets. Service key control and accountability are required in accordance with paragraph

O - Cash Safes, Cabinets, and Lockers. For the security of cash deposits and valuables, safes, cabinets, or lockers meeting the following criteria should be used. The size and configuration of commercially available safes, cabinets, and lockers are optional.

1. The minimum requirement for the storage of currency or negotiable instruments is a container that is resistant to 20 man-hours surreptitious entry, 30 man-minutes covert entry and 10 man-minutes forced entry or greater. Commercial burglary resistant safes meeting this requirement and approved for use are certified by Underwriters' Laboratories, according to the following classifications:

a. Tool-Resistant Safe TL-30

b. Torch and Tool-Resistant Safe - TRTL-30

c. Torch and Tool-Resistant Safe - TRTL-60

d. Torch, Tool & Explosive Resistant Safe — TXTL-60

2. Safes rated as Tool-Resistant Safe- TL-15 are not acceptable.

P - Secure Property Storage Containers. For bulk retail merchandise, medical supplies and other items requiring off-shelf protection, steel storage cabinets with adjustable shelving are available through the Federal supply service, group 71 , class 7125.

Q — Electronic Physical Access Control Systems (PACS). For monitoring and controlling access to areas identified as requiring high or medium levels of assurance. PACS systems are not used for recording employee time and attendance.

1. Access Safeguard. To prevent learning codes through keypad observations or use of stolen or found access cards.

2. Time Sensitive. The ability to program access by user, by shift and day.

3. Area Sensitive. The ability to program access by door and area for each individual user.

4. Fail-Safe. The ability to maintain access security if the system goes down (i.e. bypass key).

5. Access Record/Audit Trail. The ability to provide for periodic or on demand print-out of names and time/dates of individual accessing. Records of access or audit trails will not be used for employee time and attendance purposes.

6. User Coverage. The number of individual access codes that the system will accommodate.

7. Personal Identifier Number (PIN) Codes. Access control systems protecting PACS high security areas, such as controlled substance storage, primary computer and communications rooms, research or clinical laboratories that store, use or develop biohazardous materials, require a PIN number as a secondary personal authentication to be used in addition to card readers. "Scramble Pad" type PIN readers are

Exhibit B-1 Page 6 of 7 recommended when PIN systems are installed. See the table below for specific VA identified required locations.

8. Biometric Systems, Biometric security systems are those that use a personal measurement, such as fingerprints, hand geometry, facial geometry, or iris scans, as authentication. Biometric devices can be used in lieu of PIN systems in PACS high protected spaces, but only as a secondary form of authentication.

Biometric measurements may also be used in addition to a PIN in high security applications.

9. Compliance with Federal Standards. New installations or retrofitted access control systems will be compliant with technology described in Federal Information Processing Standard (FIPS) Publication 201, Personal Identity Verification of Federal Employees and Contractors, and the document "PACS Implementation Guidance, Version 2.2 (July 30, 2004), published by the Physical Access Interagency Interoperability Working Group of the GSA Government Smart Card Interagency Advisory Board. This requires that such systems will meet the ISO/IEC 14443 a, Parts 1-4 standard for contactless (proximity) card systems, or the ISO/IEC 7816 Standard for contact-type cards.

Facilities may continue to use existing PACS that operate on older technology (Magnetic Stripe, 2 nd

Generation bar code, etc.) as an interim measure until replacement systems are acquired and installed as part of normal equipment lifecycles. Further information on VA Smart Card operated PACS requirements can be found in the most recent edition of the document: "Physical Access Control Recommendations for the Department of Veterans Affairs." Guidance and assistance with the standards can be obtained from the OS&LE.

10. PACS Assurance Level Designations

(a) PACS provide a level of assurance regarding the identity of persons entering a protected space. The levels of assurance required are determined as a result of vulnerability or risk assessments and physical security surveys. In addition, the following chart indicates minimum requirements for specified VA protected activities. For purposes of this policy, levels of assurance are defined as:

High - Entry requires a valid access card used in conjunction with a secondary form of authentication. Either a Personal Identification Number (PIN) known only to the card holder, or a biometric measurement, or both, is used as the secondary authenticator.

Medium - Entry requires the use of a valid access card.

Low - Entry requires the visual authentication of a valid access card or facility identification card. The card may be inspected by a police officer or other designated staff upon entry into the protected space or may just require that it is worn at all times in a visible manner; see VA Directive 0730, paragraph 2.n.

Facilities may choose to use a more stringent protection level for any of these locations. In addition, facilities may choose to protect other activities with PACS.

P - Robbery/Panic/Duress Alarms. These types of alarm systems are used to provide rapid notification of police during an actual incident. The alarm may be activated by a covertly placed switch or button. Once activated, the switch or button can only be re-set by a key or other special tool that is in the possession of the VA police unit or other responder. The alarm annunciator will be monitored by police whenever the protected area is operational. The exact location of panic/duress alarm switches will be determined by a physical security survey of the protected area.

Panic/Duress alarms will always be installed in the interior of pharmacy-controlled substance or other Type I or Type Il vaults.

S - Perimeter Barriers. Perimeter barriers are defined as concrete bollards; concrete filled steel bollards;

or concrete planters. Appropriate fencing may also be a perimeter barrier, depending on the application.

Barriers must be of sufficient strength/weight to stop a passenger-car sized vehicle from breaching the protected space. For Child Care Centers, a minimum 7-foot height vinyl coated 6-gauge core steel fence

Exhibit B-1 Page 7 of 7 will be erected around all playground areas and around areas containing multiple non-primary entrance doors.

8. Physical Security Surveys

a. Physical security surveys and appropriate follow-up surveys are conducted of the locations identified in the Page B-l matrix of this Appendix. Surveys will be conducted at a minimum of once every twelve months. Surveys will be conducted in accordance with the training provided in VA Police Training Unit #11 , Physical Security.

b. When these protected assets and controlled areas are located in VA properties that are not contiguous to a VA medical center or campus (Community Based Outpatient Clinics, for example) they are still subject to the physical security surveys defined in Paragraph 8.a.

c. Results of each survey will be routed through the VA facility director to the service chief with responsibility for the protected space. An action plan for mitigation of security risks will be sent by the responsible service chief to the VA chief of police. Records of surveys and mitigation plans will be maintained in VA Police RCS files.

d. Facilities that do not have a matrix- identified activity, such as Child Care Centers, are not required to conduct or keep a record of such surveys.

e. Records of facility physical security surveys are reviewed as part of routine police program inspections conducted by the Office of Security and Law Enforcement.