Exhibit B3 - USCIS Physical Security Construction Standard.pdf

USCIS Physical Security Construction Standard

Office of Security and Integrity

December 2022

Version 1.8

This Publication Supersedes all Non‐Procedural Countermeasures Outlined in the USCIS IHB 121‐01‐601, Facility Security Standards Dated June 2010

Exhibit B-3 USCIS Physical Security Constuction Standard

1 / 119 Gov _____ / Lessor _____

Record of Changes

Date Version Description Author

10/14/2019 1.0 Approved Draft of PSCS Document Laflamme, Barbieri, Underwood

11/18/2019 1.1 Added Mega-Center Section Under

3.2 Intrusion Detection Equipment

Laflamme

12/02/2019 1.2 IDS Panel Update Underwood

12/02/2019 1.3 OIT Comments Added to Annex C McCarthy

12/03/2019 1.4 Added 3.1 ACS Test Requirements Young

12/13/2019 1.5 Added Annex K: USCIS District and Field Office Special

Requirements Document

Laflamme

03/31/2022 1.6 Annual review completed Laflamme

05/17/2022 1.7 Annex review completed by PSB Electronic Security Systems Engineer

Wolbach

12/2/2022 1.8 Formatting corrections made on annexes

Laflamme

Exhibit B-3

2 / 119 Gov _____ / Lessor _____

1.0 Purpose

Table of Contents

2.0 Device Location Standardizations

2.1 Card Reader Location

2.2 Request to Exit (REX) Location

2.3 Push to Exit (PEX) Location

2.4 Door Closers

2.5 Door Sweeps

2.6 Door Contacts

2.7 Balanced Magnetic Switches (BMS)

2.8 Locksets – Mechanical, Electrical, Magnetic

2.9 Security Hinges

2.10 Camera Locations

2.11 Blue Strobe

2.12 Motion Sensors

2.13 Glass Break Sensors

2.14 Duress Buttons

2.15 Alarm Keypads

2.16 Audio/Visual Intercom Transmitters (AVT)

3.0 Security Systems Requirements

3.1 Access Control Systems (ACS)

3.2 Intrusion Detection Equipment (IDS)

3.2.1 Balanced Magnetic Switches

3.2.2 Motion Sensors

3.2.3 Glass Break Sensors

3.2.4 IDS Panels

3.2.5 Duress Buttons

3.2.6 Alarm Keypads

3.3 Cameras

3.3.1 PTZ

3.3.2 Fixed

3.3.3 Dome – 360°

3.3.4 Dome – 180°

3.3.5 Specialty – Thermal Imaging, Fisheye

3.4 Cabling Requirements

3.5 Security Rack and Components

3.5.1 Network Switches

3.5.2 Network Video Recorder (NVR) Specifications

3.5.3 Keyboard, Monitor, Mouse (KMM)

Exhibit B-3

3 / 119 Gov _____ / Lessor _____

3.5.4 Access Control Server

3.5.5 Patch Panels

3.5.6 Uninterrupted Power Supply

3.6 Internet Protocol (IP) Addresses

4.0 Request For Lease Proposal Requirements (Public Facing)—FSL II & III

4.1 Site Security

4.1.1 Illumination of Entrances, Exits, Parking Lots and Garages

4.1.2 Visitor Access to Controlled Parking

4.1.3 Application of Barriers (e.g., Raised Curbs, Fencing, Bollards, Planters, etc.)

4.1.4 Authorized Parking

4.2 Structure Security

4.2.1 Blast Resistance Windows

4.2.2 Blast Resistance Façade/Structure/Progressive Collapse/Under

Building Parking

4.2.3 Burglary Resistance of Windows

4.2.4 Protection of Air Intakes

4.2.5 Security of Ventilation Equipment and Controls

4.2.6 Emergency Generators

4.3 Facility Entrance Security

4.3.1 Employee/Visitor Access Control

4.3.1.1 Occupant/Visitor Screening

4.3.2 Lobby Queuing

4.3.3 Perimeter Door and Door Locks

4.3.4 Control of Keys and Access Media

4.3.5 Emergency Exit Doors/Delayed Egress

4.3.6 Door Hardware Schedule

4.4 Interior Security

4.4.1 Blast Resistance Interior Spaces

4.4.2 Blast Resistance Mail Screening and Receiving Location

4.5 Electronic Security Systems (ESS)

4.5.1 Mailroom Security Considerations

4.5.2 Emergency Power Off (EPO) Button

Annex A: Acronyms and Definitions Annex F: Market Survey Template Annex B: Sample Key Plan Annex G: Security Recapitalization Program Flow Chart

Annex C: Access Control Annex H: LAP Flow Chart Annex D: Naming Conventions Annex I: Security Acceptance Checklist Annex E: Cable Labeling Conventions Annex J: Security Kickoff Handout

Annex K: USCIS District and Field Office Special

Requirements Document

Exhibit B-3

4 / 119 Gov _____ / Lessor _____

1.0 Purpose:

The purpose of this document is to provide procedural guidance for the Office of Security and Integrity Security Leads (SL), and the Regional Physical Security Specialists (RPSS), Facilities Project Managers (PMs) and General Services Administration (GSA) PMs with a tool to properly develop security measures when executing Lease Acquisition Projects/Major (LAP/Major), Minor Projects and Electronic Security System (ESS) Projects based on USCIS and Interagency Security Committee (ISC) requirements.

Included are general descriptions and specifications for USCIS security requirements. It is to be used in conjunction with the General Services Administration (GSA) Request for Lease Proposal (RLP), the District and Field Office Special Requirements document published by USCIS Facilities Management Division and the GSA Special Programs Division (SPD) USCIS Electronic Security Specifications guide when completing security projects for USCIS.

This document should be used to objectively design projects and assist the SL, RPSS and PMs in meeting the needs of USCIS by incorporating the theories of “rightsizing” and “customization” when developing individual Scopes of Work (SOW), all the while maintaining the spirt and intent of USCIS and the Interagency Security Committee. (See Annex A for definitions of rightsizing and customization).

2.0 Device Location and Standardizations:

Not all USCIS facilities require the same level of protection, nor do they have the same physical characteristics; consequently, there is no way to standardize Access Control Systems (ACS), Intrusion Detection Systems (IDS) or Internet Protocol Video Surveillance Systems (IPVSS). What can be standardized, however, is the physical location in which devices and hardware should be installed. The need to consider alternative installation locations may arise. The SL or RPSS should always consider the cause and effect of relocating a device before authorizing its relocation.

2.1 Card Reader Location

▪ With very few exceptions, all USCIS card readers will be installed on the ingress side of the door. In limited circumstances where access control of both the ingress and egress sides of the door must be maintained, employing the use of a card reader on both sides may be considered. In these scenarios, the SL and RPSS along with the regional Industrial Hygienist will review the building path of egress, as determined by the Fire Marshal, to determine if delayed egress equipment and/or a door prop alarm should be installed.

▪ Card readers will be surface mounted near the door (Interior/Exterior)

Exhibit B-3

5 / 119 Gov _____ / Lessor _____ and located in a position to meet federal, state, local and Americans with Disabilities Act (ADA) laws.

NOTE: Card readers will be located adjacent to ADA devices.

▪ In limited circumstances, card readers that are placed back‐to‐back on the ingress and egress side of a door are to have a Radio Frequency Identification (RFID) inhibitor plate installed to prevent cross frequency interference. Card readers may also be staggered (>6 inches apart to avoid the installation of the RFID inhibitor

▪ When installing card readers on the exterior of USCIS facilities, ensure that they are protected from all harsh elements and vandalism.

NOTE: This will include all card readers mounted to pedestals.

2.2 Request to Exit (REX) Location

▪ REX sensors will be mounted above an ACS equipped door on the egress side, unless an electrified lockset equipped with a built‐in REX is installed.

The sensor will be angled to detect motion within five feet of the door.

NOTE: REX devices will not release electric strikes. Electric door strikes will solely be controlled by the access control system relays when an authorized card read is granted.

2.3 Push to Exit (PEX) Location

▪ PEX actuators will be surface mounted near the strike side of the door and located in a position to meet federal, state, local and ADA laws.

2.4 Pneumatic Door Closers

▪ Generally installed at the top of the door by the side of the hinge.

▪ All ACS equipped doors must have a pneumatic door closer installed to ensure door closes, and latches after use.

NOTE: All fire rated doors must be equipped with a door closer or self‐ closing hinges.

2.5 Door Sweeps

▪ Install automatic door bottom and floor threshold devices on HSDN/Talon rooms. See USCIS Special Requirements for the make/model of the door sweep.

Exhibit B-3

6 / 119 Gov _____ / Lessor _____

2.6 Door Position Switches (DPS)

▪ When feasible, DPS, also known as door contacts, will be securely mounted on the door head and the top rail of the door.

▪ There may be instances when the door contact will need to be installed on the vertical doorjamb and the lock stile.

2.7 Balanced Magnetic Switches (BMS)

▪ In USCIS single tenant facilities, all exterior perimeter doors and roof hatches will be equipped with a BMS.

▪ In multitenant facilities, doors leading into USCIS space from common areas will be considered perimeter doors and will require

BMS.

▪ GSA federally owned facilities that house multiple federal agencies in which USCIS is not the lead tenant agency, do not require BMS on the exterior perimeter doors if the following conditions exist:

➢ Lead tenant agency at the facility has operational BMS in place.

➢ Facility is manned by government contracted Protective Security Officers (PSOs) on a 24/7 basis and USCIS is able to install door contact monitoring workstation.

2.8 Locksets—Mechanical, Electrical, Magnetic

▪ Mechanical and electric locksets will be installed on the lock stile.

o Storeroom function locks and hardware are required for all doors receiving card readers. These locksets/hardware have a lever on both sides, but the outside is stationary and cannot be moved.

From the outside, the door latch is operated with a key. On the inside, simply engaging the lever will retract the latch. In no circumstance will a classroom function lockset be used on a door with a card reader.

o Locksets will be high‐security, tamper‐resistant, commercial‐ grade mortise locksets with storeroom function lock.

o Locksets will be on the master key system determined by USCIS.

o The lessor will provide and install a wall‐mounted, organized, lockable key box to accommodate all required keys to USCIS space. A minimum of two (2) keys that open the key box will be

Exhibit B-3

7 / 119 Gov _____ / Lessor _____ provided to USCIS.

o Locksets will be six‐pin cores.

o Locksets will have interchangeable cores, and the Security Integrator will provide a core removal key to

USCIS.

o A key plan will be developed with coordination from USCIS displaying key cut codes, pin codes, key numbers, and their corresponding door access will be provided by the Security

Integrator. (The number of keys required will be determined during the key plan development.)

NOTE: A KNOX BOX may be required by local code or by USCIS guidance to secure an access device (i.e., key or access card) to expedite Fire Department entry. If required, a tamper switch alarm will be installed.

o If electric strike opens from unsecure space, install strike latch guard.

▪ Magnetic locksets will be installed on the top rail of the door.

o Only use magnetic locksets on double doors/single doors, with or without framing, and do not have astragal (center piece).

The use of electrified vertical rods is not acceptable.

o Locks will be mounted/installed in accordance with security industry standards as well as federal, state, local, fire and ADA laws.

o Locks will be powered with dedicated Direct Current (DC) power. Doing this will protect ACS components from potential transient EMF these magnetic locking devices can generate.

o A single motion PEX or touch‐sensitive panic bar with built‐in request to exit will be installed on the egress side to deactivate the magnetic field for exit. Request to Exit (REX) device will depend on the door type and location.

o Magnetic locking devices without built‐in Electronic Magnetic

Exhibit B-3

8 / 119 Gov _____ / Lessor _____

Field (EMF) suppression and/or magnetic locking devices that draw large amounts of current (typically older models), shall be installed using external isolation relay(s).

o Battery uninterruptible power supply (UPS) will be supplied and support a minimum of 4 hours.

o For main entrance visitor doors, a toggle switch accessible on interior above door will be provided to disable magnetic locks during business hours.

o Doors equipped with magnetic locksets will also have mechanical vertical locksets that can be actuated with panic hardware, locked in open position by locking down panic bar with hex key, and either secured or unlocked using a mechanical lockset and key from exterior.

2.9 Security Hinges

▪ Secure perimeter doors with non‐removable hinges.

2.10 Camera Locations

▪ Install cameras where field of view (FOV) provides optimal forensic details.

o Internet Protocol Video Surveillance System (IPVSS) Field of View:

The Interagency Security Committee outlines the IPVSS field of view requirements. The design of the IPVSS will vary depending on the objective of the surveillance, environment, facility type, and end‐user requirements. Coordination between the on‐site security representative and the Security Integrator is essential to maximize the operational effectiveness of the IPVSS and integration with other physical security equipment. The IPVSS field of view will be based on primary objective/purpose of the IPVSS scene content.

o Recognition – Recognition is best described as a camera designed to observe and identify a person or object with enough detail for courtroom quality. This level is often utilized as facial recognition or license plate recognition. The minimum horizontal resolution should be 80 pixels per foot (ppf). Recognition view should be utilized for facility entrances and exits when possible.

Exhibit B-3

9 / 119 Gov _____ / Lessor _____ o Forensic Review – Forensic Review is best described as being designed for use at a later time to identify objects of interest.

For example, type (make/model) of a car in a parking lot. The minimum horizontal resolution should be 40 pixels per foot.

o Observation – Observation is defined as a continuous overview of scene content captured. The camera purpose is best described as being capable of capturing an image that can be utilized to verify the general characteristics of the image. For example, the number of cars or people in a parking lot. The minimum horizontal resolution should be 20 pixels per foot.

▪ Install interior cameras 8 to 10 feet from the ground when feasible.

▪ Cameras will be positioned to view activities in the following areas:

loading docks, PSO screening areas, lobbies, waiting room/information counters, entrance doors, ceremony rooms and Government Owned Vehicle (GOV) parking areas.

▪ Cameras will provide complete 360° video coverage of all exterior perimeters controlled by USCIS; visitor and employee entrances into USCIS space.

▪ Specialty cameras will be installed as prescribed by the SL and/or RPSS;

for example, fisheye cameras over X‐Ray screening areas.

2.11 Blue Strobe

▪ Install a blue strobe light in a conspicuous location at the screening or PSO workstation. Consider the most advantageous location to ensure visibility when an alarm or duress button is activated.

Exhibit B-3

10 / 119 Gov _____ / Lessor _____

2.12 Motion Sensors

▪ Locate motion sensors in close proximity to all skylights, guard screening areas and main hallways leading to exterior exits.

▪ Glass perimeter doors in non‐federal facilities will be covered by motion sensors and BMS.

2.13 Glass Break Sensors

▪ Mount glass break sensors in the ceiling, where feasible, to cover all glass that is less than or equal to 16ft above street level. In addition, all USCIS glass/windows that are accessible by permanently affixed ladder, roof, or skywalk will have glass break sensors.

2.14 Duress Buttons

▪ Locate Duress buttons at each info counter window and guard work area.

Duress alarms will be desk mounted, recessed, and out of sight from the general public, visitors, and customers. The duress alarm will be positioned within arm’s reach of the user when seated at their respective desk/stations.

2.15 Alarm Keypads

▪ Keypads will be mounted inside secured space near main entrances, employee entrances and PSOs desk. Keypads are to be located in a position to meet federal, state, local, and ADA laws.

2.16 Audio/Visual Intercom Transmitters (AVT)

▪ AVT will be located at mailrooms, select suite entrances and loading dock areas and capable of remote door release. Audio/Visual receivers (AVR) will be located at PSO station and/or the mission support area.

3.0 Security Systems Requirements:

The Security Integrator will furnish and install the following security system components, as defined by the SOW:

Exhibit B-3

11 / 119 Gov _____ / Lessor _____

➢ Access Control System (ACS)

➢ Intrusion Detection System (IDS)

➢ Internet Protocol Video Surveillance System (IPVSS)

Each system will be capable of initially operating on an integrated standalone platform which can provide USCIS with the ability to access, monitor, administer and control all three systems through a single client.

This section will detail the Security Integrator’s responsibility for providing a fully operational ACS, IDS, IPVSS and security rack configuration. USCIS security systems will have the below listed salient characteristics.

3.1 Access Control Systems (ACS)

See Annex C for specific system requirements for Gallagher. CCure and Lenel will be added to Annex C upon receiving an authority to operate (ATO) on the network. Security Integrators may provide bids for ACS that have the same salient characteristics as those mentioned above; however, before any alternate ACS system will be considered, it will have to be certified in the USCIS Information Technology Lab before being allowed to operation on the USCIS Enterprise. It should be noted that this process is lengthy and will significantly impact the Security Recapitalization Project (SRP) upgrade timelines, potentially disqualifying a Security Integrator from placing a bid. The Security Integrator may be liable for partial or full compensation for costs incurred to USCIS when testing a proposed solution. Contribution amount will be defined by USCIS before procuring the equipment.

3.2 Intrusion Detection Equipment (IDS)

The Security Integrator shall completely install the security system. The liability of all installation and complete testing is the sole responsibility of the Security Integrator and includes the proper functioning of the zones into the Mega-Center. The FPS Mega-Center will provide minimal support for troubleshooting, but this does not reduce any of the Security Integrator’s responsibilities. The Security Integrator should have working-knowledge of the manufacturer’s system they are installing. The Mega-Center Technical Service Desk (TSD) will not walk the Security Integrator through the installation process. The Security Integrator shall contact the Mega-Center Alarm Services Desk for programming standards. Once installation is completed, notify the Mega-Center that the panel is ready to be programmed. Local keypad programming will be locked out and all future programming issues will be handled through the Mega-Center. If installation issues arise, the Security Integrator shall contact the equipment manufacturer’s technical support for the system they are installing.

Exhibit B-3

12 / 119 Gov _____ / Lessor _____

When the alarm system is completely installed and programmed to the Mega-Center’s specifications, it must be fully tested with the Mega-Center Alarm Services Desk and the Security Integrator. If required by the installation contract, the Security Integrator must then schedule an acceptance inspection. Once this inspection is completed and the work determined satisfactory, (by someone other than the Installer, i.e., FPS, COTR, or USCIS) the Mega-Center can issue a test report indicating all zones have been tested successfully to FPS, COR, or client agency conducting the inspection.

Once all the information is received, the Mega-Center will provide an account number for the project. The alarm will be disabled during testing and placed online when all of the required information and testing has been completed.

IDS will include Federal Protective Services (FPS) Mega-Center approved alarm panels, passive infrared (PIR) dual-technology sensors, balance magnetic switches, duress alarms, glass break sensors, dual technology motion detection sensors and tamper alarms. NOTE: Each sensor will have tamper indicating circuitry installed. Device tamper alarms will be annotated on the Mega-Center Alarm Requirements (MAR) document.

IDS is required for all perimeter access, ground floor windows, and any other windows with direct access from adjacent rooftops, and roof hatches into USCIS space. IDS will include Federal Protective Services (FPS) Mega-Center approved alarm panels, passive infrared (PIR) dual-technology motion sensors, balance magnetic switches, duress alarms, glass break sensors and tamper alarms.

NOTE: BMSs and IDS panels will have tamper alarms indicating circuitry installed. Device tamper alarms will be annotated on the Mega-Center Alarm Requirements (MAR) document. The IDS keypad(s) (arm/disarm control) must also be located near the employee entrance.

All sensors will be individually zoned such that the alarm location can be easily located through the use of simple zone maps by responding forces. For this reason, the daisy chaining of sensors, alarms, or zones is prohibited.

Alarm messaging language will meet the FPS Mega-Center Monitoring Station requirements.

The Security Integrator will provide enough battery backup power to support a minimum of (4) hours of continuous power to intrusion detection equipment in the event of power loss. Batteries will be machine labeled with the date of install.

Exhibit B-3

13 / 119 Gov _____ / Lessor _____

3.2.1 Balanced Magnetic Switches

▪ BMS will act as an alarm to the IDS when armed and provide door status notifications to ACS.

NOTE: Install double pole, double throw (DPDT) to provide door contact monitoring to the ACS when the BMS is not activated.

▪ BMS will be housed in weatherproof enclosures when exposed to outside elements.

▪ BMS will incorporate removal (pry) tamper circuit. Surface mounted switches may be used at the approval of SL and/or RPSS, but they must meet salient features stated above.

▪ BMS will be Harco Magnasphere HSS L2 series or equivalent.

3.2.2 Motion Sensors

▪ Dual-technology consists of PIR, and microwave detection technology integrated into a single enclosure.

▪ Must have a 360° capability to provide effective coverage of area.

▪ Motion sensors will be on different microwave frequencies when positioned in same area.

▪ If installed in an IDF or MDF, the motion sensor will be set to microwave detection only.

▪ Motion sensors will not be mounted on or near pipes, steel girders, or

HVAC systems as doing so may result in false alarms (i.e., hanging microphones, fans, venetian blinds, and open windows).

OPTIONAL: 360‐degree, ceiling‐mounted, dual‐technology motion sensors may be used for large areas or where the use of directional sensors is not feasible.

3.2.3 Glass Break Sensors

▪ All sensors will be based on the flex‐guard technology (once the glass break detects both audio and impact signals, it will send an alarm virtually eliminating false alarms).

▪ Glass break sensors will be ceiling mounted devices, where feasible.

▪ Contractor will provide a glass break testing device matching devices installed.

▪ Glass break sensors will provide detection of plate, safety, laminated and tempered glass breakage.

▪ Glass break sensors will be Honeywell FG1625 or equivalent.

Exhibit B-3

14 / 119 Gov _____ / Lessor _____

3.2.4 IDS Panels

▪ Each IDS Panel will be connected to the FPS Mega-Center servicing the area for alarm monitoring via an individual analog “POTS” (Plain Old Telephone System) landline. The Lessor will be responsible for providing the analog telephone line (POTS) for the required communication to the Government’s alarm answering service. The Lessor will pay for and maintain this line for the term of the lease. NOTE: Denver, Philadelphia and Battle Creek will accept Voice Over Internet Protocol (VoIP) on a case‐by‐case basis.

▪ Connection to the Mega-Center requires the use of panels from the following manufacturers: Bosch (Model: D9512G) or Digital Monitoring Products (DMP Model: XR550).

▪ Mega-Center Alarm Requirements (MAR) Request Form is required to be completed and approved by FPS prior to connecting. Portions of the

MAR are required to be completed by the Security Integrator and Field

Security Manager (FSM) and or/RPSS.

NOTE: Alarm systems will be configured for manual arming/disarming unless otherwise specified by USCIS.

▪ The Security Integrator is responsible for pre‐testing and programming the IDS with the Mega-Center (at a minimum) three (3) weeks prior to security acceptance. Pre‐testing will consist of actuating each individual zone then restoring the zone on the associated IDS keypad. The Mega Center must confirm the restored zone verbally and in the alarm history report to pass a zone.

3.2.5 Duress Buttons

▪ Info‐counter duress alarms shall annunciate at the PSOs desk via audible and visual (blue strobe) notification. The PSO visitor screening station duress alarm will annunciate at the Mega‐Center. If the facility does not have PSO service, all duress alarms will annunciate at the Mega‐Center.

All other offices are able to call the PSO desk through 911 services and speed dial.

▪ Duress alarm annunciations will be distinguishable from other alarm annunciations.

▪ Duress alarms must have a method to prevent accidental annunciation.

▪ Duress alarms will lock‐in alarm mode until manually reset by key or similar device. NOTE: Key or similar device will be kept with the PSO and FSM/LSO on site.

▪ Blue Strobe light will turn on when one of the InfoPass Duress Buttons is activated.

Exhibit B-3

15 / 119 Gov _____ / Lessor _____

3.2.6 Alarm Keypads

▪ A BoschB942 or a DMP 7873/7873H keypad or equivalent shall be used. Keypads will be mounted inside secured space near main entrances, employee entrances, and PSO’s desk. Keypads are to be located in a position to meet federal, state, local, and ADA laws. The alarm delay will be set at minimum of 30 seconds and maximum of 60 seconds. Keypad alarm locations will be clearly indicated on construction documents. Quantity of keypads will depend on number of partitions, floors, zones, etc.

3.3 Cameras

USCIS employs Fixed, Pan/Tilt/Zoom (PTZ) and dome form factors. Cameras will be positioned to view activities at the loading dock, PSO screening areas, lobbies, waiting room information counters, perimeter entrance doors, and the exterior of the building/parking areas. In some instances, cameras will be positioned to view the entry/egress of large file storage areas. All cameras will have the following general features:

▪ A minimum Axis P‐Series or equivalent. The P‐Series is considered versatile and an advanced video product.

▪ Will be ONVIF compliant.

▪ Exposed camera wires will be covered by flex conduit or installed in a neck mount system to deter tampering.

▪ Camera housings will have a vandal resistant rating unless otherwise directed by SL and/or RPSS.

▪ Exterior camera housings must be weather resistant and capable of operating in extreme hot/cold environments as well as high and low humidity environments.

▪ Optical lens will be determined by the scope of the project.

▪ Cameras will be at minimum high definition at 1080P.

▪ Cameras will be at minimum Microsoft Windows 10 Server compatible.

▪ Cameras will be equipped with motion detection for motion detected recording unless directed otherwise by SL and/or RPSS.

▪ Cameras will be equipped with Light Finder or Optimized Infrared (IR)

Illuminator technology to allow viewing out to the maximum optical zoom capability of the camera.

▪ Cameras will support Axis Zipstream technology (or equivalent).

▪ Cameras will have a Wide Dynamic Range (WDR) function.

3.3.1 PTZ

▪ Cameras will be mounted on parapet style mounts with swing‐in arms for maintenance/repairs to camera from roof access. Parapet length determined by SL and/or RPSS as needed.

Exhibit B-3

16 / 119 Gov _____ / Lessor _____

▪ Cameras will hang out and above corner of facility to allow an unimpeded360° view. Cameras will be powered by dedicated AC/DC or Power Over Ethernet (PoE) with Injector.

▪ Will be used in combination with joystick.

▪ SL and/or RPSS will determine programming.

3.3.2 Fixed

▪ Will have corridor format as determined by the SL and/or RPSS.

▪ Power‐Over‐Ethernet (PoE) for network connectivity and power with a single cable.

▪ Cameras will be Indoor/Outdoor rated.

3.3.3 Dome—360°

▪ 8 MP, 360° multidirectional camera, one IP address

▪ 360° IR illumination and remote zoom and focus

▪ Axis Lightfinder and Forensic WDR or equal

▪ Flexible positioning of four varifocal camera heads

▪ Axis Zipstream for reduced bandwidth and storage needs or equal

3.3.4 Dome—180°

▪ Seamlessly stitched images

▪ 180° horizontal and 90° vertical coverage

▪ 8.3 MP resolution at full frame rate

▪ Axis Lightfinder and Forensic WDR or equal

▪ Axis Zipstream or equal for reduced bandwidth and storage needs

180° view capability with minimum 4320x1920 resolution

3.3.5 Specialty—Thermal Imaging, Fisheye

▪ Fisheye will be defined in a project by the SL and/or RPSS to provide the camera image output characteristics of a convex non‐rectilinear appearance.

▪ Thermal capable cameras will be defined by the SL and/or RPSS to produce images, or thermograms, as visual displays of the amount of infrared energy emitted, transmitted, and reflected by an object.

NOTE: There will be instances where dewarping software is needed with specialty cameras. Ensure it is included if needed for the camera selected.

3.4 Cabling Requirements

17 / 119 Gov _____ / Lessor _____

▪ All cabling will be plenum rated under National Fire

Protection Association (NFPA) Standard 90A. No riser cabling will be used in any project. Wire will be sized according to the manufacturer's specification. Wire must be upsized after considering voltage drop and load calculations as specified in the technical portions of this specification.

o All cabling will be labeled and identified in accordance with Annex

E. Label makers will be used to mark cabling (BLACK lettering on WHITE background). Permanent markers used to label cable is not acceptable.

▪ Cat 6A shielded cable will not be accepted.

▪ A Fluke Level 5 or higher cable tester must be used to certify the Cat

6A cable installation. All card reader wire and/or cable installations shall have continuity testing performed. Fluke Linkware™ format (.flw) or suitable PDF is required for technical deliverables package.

▪ The manufacturer of the conductivity/termination hardware is responsible for supporting the single‐source warranty of the complete cable plant installation. The selected cabling contractor is required to be a certified installer with trained technicians of the proposed manufacturer’s product. The proposed cable plant solution must meet the minimum 15‐year application assurance warranty to include product, cable, etc. and labor for the provided installation.

▪ Terminate Category 6A horizontal cables on patch panels and modular outlets to meet manufacturer’s requirements. (Do NOT allow pairs to untwist, and outer jacket should only be a ½ inch from termination point). Route cables from both sides of equipment rack when terminating on patch panels with separation down center of rack, and use wire management, supporting bars, etc.

▪ Cable labeling requirements:

o Naming conventions (See Annex D) shall be used throughout the system architecture, reflected on submittals and as‐built documentation, and when programming or configuring ACS database objects.

o Each of the Category 6A horizontal cables shall be labeled with the designated cable number at the following locations:

i. Termination points at the back of patch panel in the corresponding rack

ii. Termination points at the front of the patch panel in the corresponding rack

iii. At each end of each device including (for cameras) the surface box at the drop location (mounted inside the provided lockable security enclosure)

Exhibit B-3

18 / 119 Gov _____ / Lessor _____

iv. 1‐port surface boxes with identification

v. As close as possible to the terminating point in the controller

vi. At each end of the device location (for all controller Ethernet connections).

3.5 Security Rack and Components

▪ The Security Rack and Components will be provided by the Security

Integrator according to the model number and build specifications contained in Annex C.

▪ The security rack components will consist of the following: Network Switches, Network Video Recorder (NVR), Multi input Keyboard, Video, Mouse (KVM), ACS Server, Patch Panels, and UPS.

3.5.1 Network Switches

Network switches will integrate all components of the ACS and IPVSS.

▪ All network switches will have Power Over Ethernet (PoE) capability and must be approved by USCIS Office of Information Technology

(OIT).

▪ Switches will be securely mounted and provided proper ventilation.

▪ The default configuration is half PoE On/Off commiserate with the number of ports available on the switch.

▪ Network switches will not be configured with port security.

▪ All network switches will be configured to full duplex.

▪ Network switches will be procured and provided by OSI Field Security

Division (FSD), Operations Branch, Physical Security Section for ESS Modernization Projects unless stated otherwise; however, for LAP projects network switches and switch peripherals (i.e., fiber jumpers, SFP, etc.) will be procured by the Security Integrator.

▪ All network switches are accountable property and will be placed into USCIS Sunflower Asset Management System (SAMS) by a USCIS Property Custodian.

3.5.2 NVR Specifications

▪ Video system shall be based on Milestone Video System with Axis cameras or equivalent. Security Integrator will verify that all video components are compatible with the current or awarded ACS and will provide all necessary integration licenses to provide full interoperability between the ACS and IPVSS.

▪ The NVR will be mounted in the security rack within the Local Area Network (LAN) room. The Security Integrator is responsible for assessing

Exhibit B-3

19 / 119 Gov _____ / Lessor _____ pre‐existing racks that may be used as part of the project, as determined in the bid‐walk.

▪ The NVR will record at a minimum of 15 frames per second for 30days for all cameras, as defined by the National Archives and Records Administration (NARA) GRS 21, Items 11 and 18.

▪ The NVR will have a minimum of 10 Terabytes of storage capacity for recording all cameras. USCIS’ standard for recording is motion activation to reduce storage capacity while still meeting the 30-day requirement.

▪ Exceptions may be made for 24-hour recording as determined by the SLand/or the RPSS. Note: NVR will overwrite video stored by oldest date automatically once it has reached capacity.

▪ NVR will allow playback by choosing date and time and must auto adjust for daylight savings time changes.

▪ NVR will support the number of cameras on the system using IP based Ethernet (RJ45) connections.

▪ NVR will have Microsoft Windows 10 server compatibility or better.

▪ NVR will be capable of recording up to 2 MP resolution at 15 frames per second.

▪ NVR video compression will be H.264 or MPEG‐4.

▪ NVR will be capable of alarm triggered camera action.

▪ NVR will allow export to secure digital device (i.e., encrypted thumb drive).

▪ NVR will support remote management and configuration.

▪ NVR will support activity log.

▪ Functions will include alarm outputs, time/date stamps, motion detection, and management software, manage color/black and white cameras, and allow operation in duplex mode.

▪ NVR will produce footage copies with watermarks or security stamps to prevent tampering and/or manipulation. A sample of the watermark or stamp must be provided to the SL and/or RPSS prior to the close of the project for approval.

▪ When it is determined that cameras will record on motion, Security Integrators will create a rule in the Milestone NVR to record five seconds before motion is detected and stop recording three seconds after motion ends to ensure full motion incident is recorded, within the determined motion detection overlay.

3.5.3 Keyboard, Video, Mouse (KVM)

▪ The Security Integrator will supply a KVM. See Annex C for specifications.

3.5.4 Access Control Server

20 / 119 Gov _____ / Lessor _____

▪ The Security Integrator will supply a server according to the model number and build specifications found in Annex C.

▪ The servers will come preconfigured with the defined ACS operating and management software.

3.5.5 Patch Panels

▪ Will be provided by Security Integrator to streamline the cabling infrastructure within the rack. Patch cables will be consistent with OIT cabling standards (e.g., the Security Integrator will not install CAT5 patch cables when CAT6A is utilized elsewhere).

3.5.6 Uninterrupted Power Supply

▪ The Security Integrator will supply a UPS Battery Backup capable of providing:

o Minimum of 60 minutes (no load) of power backup for the ACS.

o Minimum of 60 minutes (no load) of power backup for IPVSS.

▪ Prior to site acceptance the Security Integrator is responsible for testing the UPS for each system at rest to ensure minimum runtime requirements are satisfied.

▪ UPS must have a self‐test function. The Security Integrator will provide end user training for self‐testing and any UPS remote alarm set-ups.

▪ The Security Integrator shall set-up any remote notification software (e.g., APC PowerChute™) in UPS Battery Backup to remote alert via e-mail alarms of UPS.

3.6 Internet Protocol (IP) Addresses

The GSA project manager or the Security Integrator will inquire/request IP Addresses from OSI FSD POC via the SL. For each project category (LAP, ESS, Minor) that is adding electronic security components, IP addresses will be needed. The following is a list of components that may require IP addresses:

o Card Readers o Door Controllers o Security Server o Enrollment Workstations o PSO Stations o Security Cameras o Network Video Recorder (NVR) o Video Encoders/Splitters connected to Large Security Monitors

(i.e., Smartwall) o Network Switches connected to Security System o Life Safety Power Module o Audio Video Transmitter/Receiver

Exhibit B-3

21 / 119 Gov _____ / Lessor _____

NOTE: OSI FSD POC will request additional IP addresses congruent with potential expansion of the security system (USCIS Standard is 10%).

4.0 Request for Lease Proposal Requirements (Public Facing)—FSL II & III

This section will discuss Request for Lease Proposal (RLP) requirements for Facility Security Level II and III public facing facilities. A risk assessment may determine the need for further or enhanced countermeasures to be included as part of the lease. All level II measures in the GSA Public Buildings Service (PBS) desk guide apply, plus the additional USCIS measures below:

4.1 Site Security

4.1.1 Illumination of Entrances, Exits, Parking Lots and Garages

▪ Exterior parking areas, vehicle driveways, pedestrian walks, and the building perimeter lighting levels shall be designed per current Illuminating Engineering Society (IES) standards. Provide 5 foot‐candles for doorway areas, 3 foot‐candles for transition areas and at least 1 foot‐candle at the lot surface throughout the parking area. Parking lot fixtures shall provide a maximum to minimum uniformity ratio of 15:1 and a maximum to average uniformity ratio of 4:1.

4.1.2 Visitor Access to Controlled Parking

▪ Designate employee and visitor parking areas. Use signs designating visitor and/or employee parking areas.

▪ Designate Government‐Owned Vehicle (GOV) parking areas. GOV parking should be parking areas closest to facility.

4.1.3 Application of Barriers (e.g., Raised Curbs, Fencing Bollards, Planters, etc.)

▪ Will be determined during Preliminary Facility Security Level (FSL) Assessment.

▪ In new construction, Crime Prevention through Environmental Design (CPTED) methods will be utilized to control flow of persons and vehicles. The use of natural barriers will be utilized when available.

4.1.4 Authorized Parking

▪ Access to Government‐Owned Vehicles (GOV) must be covered by

22 / 119 Gov _____ / Lessor _____ video surveillance.

4.2 Structure Security

4.2.1 Blast Resistance Windows

▪ Film will be applied to all external windows.

▪ The Lessor shall provide and install shatter‐resistant material.

▪ Security window film, in the context of mitigating hazards from blast, is 7‐mil (7/1000 in.) thick or thicker on all exterior glass windows and doors in Government‐occupied space, meeting the following properties ‐ Film composite strength and elongation rate measured at a strain rate not exceeding 50% per minute shall not be less than the following:

o Yield Strength: 12,000 psi o Elongation at yield: 3% Longitudinal Tensile strength: 22,000 psi o Traverse Tensile strength: 25,000 psi o Longitudinal Elongation at break: 90% o Traverse Elongation at break: 75%

▪ New glazing systems will be designed with a minimum ½‐inch bite.

4.2.2 Blast Resistance Façade/Structure/Progressive Collapse/Under Building Parking

▪ Use of construction materials which have inherent ductility, and which are better able to respond to load reversals (e.g., cast in place reinforced concrete column construction).

4.2.3 Burglary Resistance of Windows

▪ Windows in FSL II facilities that are on the ground floor will be lockable and monitored by IDS if they can be opened.

▪ Windows in FSL III facilities shall be non‐operable and will be monitored by IDS.

4.2.4 Protection of Air Intakes

▪ Lessor will provide emergency shutoff equipment for HVAC systems and will secure accessible air intake grilles from tampering and removal.

4.2.5 Security of Ventilation Equipment and Controls

23 / 119 Gov _____ / Lessor _____

4.2.6 Protect the systems controls from unauthorized access. Emergency Generators

▪ If provided, the Lessor will locate emergency generators, either pre‐existing or installed as part of tenant improvements, in a secure area, protected from unauthorized access and vehicle ramming, if outdoors. Generator to be grounded to building to maintain single point grounding for maximum site protection.

4.3 The emergency generator, and its fuel tank, must be located at least 25 feet from loading docks, entrances, and parking areas’ Facility Entrance Security (if the 25-foot distance cannot be achieved, a combination of standoff, hardening, and venting methods must be implemented to protect utilities from vehicle borne improvised explosive devices).

4.3.1 Employee/Visitor Access Control

4.3.1.1 Occupant/Visitor Screening

▪ Magnetometers and X‐rays at public entrances. Magnetometers and X‐ray machines will be installed by the Government at the public entrance.

▪ Armed PSOs, provided by the Government, will direct the occupants and visitors through the screening equipment.

Appropriate lobby and entrance/exit space will be made available for this purpose. This space will be considered part of the lease common area and not ABOA (Usable) square footage.

NOTE: OSI will conduct a security assessment for non‐public facing FSL II facilities to determine PSO requirements.

4.3.2 Lobby Queuing

▪ Lobby should be designed to accommodate PSO station, Magnetometer and X‐Ray machine.

▪ The Architecture and Engineering (A&E) firm will work with USCIS project manager to determine throughput and pedestrian traffic flow to minimize queuing.

▪ Consider power supply locations and limit exposed wires to prevent tripping hazards.

4.3.3 Perimeter Door and Door Locks:

▪ Secure perimeter doors with non‐removable hinges and electronic security system devices.

▪ Doors will have mechanical locksets for manual key override.

Exhibit B-3

24 / 119 Gov _____ / Lessor _____

4.3.4 Control of Keys and Access Media

▪ Lessor will provide a key plan and provide high security locksets with interchangeable removable cores with core change key.

▪ Lessor will also provide construction cores to be exchanged with permanent cores at acceptance.

4.3.5 Emergency Exit Doors/Delayed Egress

▪ All doors designated “emergency exit only” will be equipped with automatic door closer and delayed egress panic hardware with a local audible alarm with key reset.

▪ The delay time will meet local fire code requirements.

4.3.6 Door Hardware Schedule

▪ See USCIS District and Field Office Special Requirements Document published by Facilities Management Division Field Space Management Branch.

4.4 Interior Security

4.4.1 Blast Resistance Interior Spaces

▪ Use of construction materials which have inherent ductility and which are better able to respond to load reversals (e.g. cast in place reinforced concrete column construction).

4.4.2 Blast Resistance Mail Screening and Receiving Location

▪ Use of construction materials which have inherent ductility and which are better able to respond to load reversals (e.g. cast in place reinforced concrete column construction).

4.5 Electronic Security Systems (ESS)

▪ The Lessor will be responsible to provide and install all electronic security systems. The Lessor will maintain these systems and all associated security equipment for 364 days which will commence on the official date of GSA facility acceptance. The lessor is responsible for transferring all security warranty information and software licenses to USCIS at the end of the lessor’s maintenance

Exhibit B-3

25 / 119 Gov _____ / Lessor _____ responsibility; at which time the government will take complete ownership and maintenance responsibility through the remaining term of the lease. The complete requirements for the electronic security systems are provided in the attached annexes. All security equipment will become the property of the government at the end of the 364-day period and at its sole option, the Government may abandon property in the space following the expiration of the Lease or retain the right to remove the equipment. The Lessor will be relieved of any liability in connection therewith after the initial 364 days post GSA facility acceptance. All installed systems, components and devices will comply with all referenced codes, standards and/or government requirements. It will be the Lessor’s responsibility to ensure that the proper coordination between all trade divisions be accomplished so that the ESS system is complete.

▪ The Lessor’s designer and installing Security Integrator will be certified and/or licensed by the manufacturer of the systems, equipment, and components that they are installing. Copies of certification documentation will be provided to USCIS prior to the security kickoff meeting.

▪ The Lessor will provide adequate training to USCIS personnel on the operation of all installed electronic security systems and equipment. A minimum of eight hours of training will be included.

▪ The Lessor will provide to GSA/USCIS shop drawings, product data, material list and/or cut sheets on all devices, systems and/or components which are to be provided under the scope of work. USCIS will review and provide comments on the provided information.

▪ All ESS wiring will follow the USCIS cable plant standards.

4.5.1 Mailroom Security Considerations

▪ Lessor will provide space suitable for the Government to inspect and screen all mail and packages using X‐ray in the mailroom.

▪ Mailrooms will be located on exterior walls with direct adjacency to bulk storage rooms. (See USCIS District and Field Office Special Requirements Document published by Facilities Management Division Field Space Management Branch).

▪ If there is no mailroom or mailroom is located above ground level, Lessor will provide space at an existing screening location or at an alternative location in the building acceptable to the

Exhibit B-3

26 / 119 Gov _____ / Lessor _____

Government.

▪ The space will be located on an exterior wall, 25 feet or less from an exterior door, with a stand‐alone air handling system.

▪ The screeners will physically inspect items that cannot be passed through screening equipment before distribution to the Government agencies throughout the facility.

▪ This space will be considered part of the lease common area and not ABOA square footage. All mail and packages not examined at a Consolidated Remote Delivery Site (CRDS) will be subject to X‐ ray screening and/or visual inspection.

4.5.2 Emergency Power Off (EPO) Button

▪ The Lessor will be responsible to provide and install an EPO with protective cover to function as an air shut off button for the HVAC system located inside the mail room and near the mail screening area. The EPO will eliminate all supply air into the space thereby increasing the negative air pressure in the event of an emergency.

The EPO button must also be tied into the IDS panel and directly alarm to the Mega Center and the Alarm Keypad at the PSO Desk.

The EPO will be indicated on the MAR document as an individual zone: Device Type: FIR, Zone Description: Mailroom Emergency/Call 911, and Response Type: 24-hours. Additionally, the EPO must also activate an audio and visual alarm (Blue Strobe Light) equipment to warn personnel of the emergency. The USCIS SL or FSM will determine the location of where the audio and visual alarm will be installed. When pressed, the EPO must simultaneously activate all functions mentioned.

This document is the final version of the USCIS Physical Security Construction Standard. The information contained herein is subject to change. The document will be reviewed annually for consistency and applicability.

Alan G. Young Chief, Physical Security Section, OSI, FSD

Exhibit B-3

27 / 119 Gov _____ / Lessor _____

ANNEX A: Acronyms and Definitions

ACS Access Control Systems ADA Americans with Disabilities Act BMS Balanced Magnetic Switches CPTED Crime Prevention through Environmental Design CRDS Consolidated Remote Delivery Site DMP Digital Monitoring Products DPDT Double pole, double throw DPS Door position switches EPACS Enterprise Physical Access Control System EPO Emergency Power Off ESS Electronic Security System FOD Field Office Director FOV Field of view FPS Federal Protective Services FSL Facility Security Level FSM Field Security Manager FSOB Field Security Operation’s Branch GOV Government Owned Vehicle GSA General Services Administration HSDN Homeland…