Exhibit C VET CENTER Specific LEASE SECURITY REQUIREMENTS FOR VET CENTERS (v. 9-14-2019).pdf

THIS ATTACHMENT PROVIDES THE INTERAGENCY SECURITY COMMITTEE (ISC) LEVELS OF PROTECTION (LOP) NECESSARY

TO ACHIEVE A FACILITY SECURITY LEVEL II (FSL II).

OFFERERS ARE RESPONSIBLE FOR PROVIDING ALL ITEMS DESIGNATED AS “SHELL”. THESE ITEMS WILL NOT BE PRICED.

ITEMS DESIGNAGED “TI” FOR TENANT IMPROVEMENT, SHALL BE PRICED AND NEGOTIATED AFTER AWARD, USING THE

SECURITY PRICE LIST AND WITH INPUT FROM THE VA POLICE.

ADDITIONAL INFORMATION ON THE INTERAGENCY SECURITY COMMITTEE (ISC) RISK MANAGEMENT PROCESS IS AVAILABLE HERE: https://www.dhs.gov/interagency-security-committee

Video Surveillance System (VSS), is widely used throughout industry and the federal government. It covers both analog and digital systems and is referenced in the Department of Homeland Security (DHS) Science and Technology Digital Video Quality Handbook.

DEFINITIONS:

CRITICAL AREAS AND SYSTEMS - The areas that house systems that if damaged or compromised could have significant adverse consequences for the facility, operation of the facility, or mission of the agency or its occupants and visitors.

Critical areas do not necessarily have to be within Government-controlled space (e.g., generators, air handlers, electrical feeds which could be located outside Government-controlled space).

SENSITIVE AREAS – Sensitive areas include patient care spaces, or any area that houses medical, mental, or other services that require patient privacy. Sensitive areas are primarily housed within Government-controlled space.

VSS – Video Surveillance Systems

SITE SECURITY CRITERIA

IDENTIFICATION AS FEDERAL FACILITY: (SHELL)

• No special measures required.

LANDSCAPING: (SHELL)

• No special measures required.

PEDESTRIAN ACCESS TO SITE: (SHELL) No special measures required.

VEHICLE ACCESS POINTS: (SHELL): No special measures required.

SITE LIGHTING: (SHELL)

• No special measures required.

RESTRICTED AREAS OR SIGNIFICANT AREAS AND ASSETS: (SHELL)

No special measures required.

Exhibit C https://www.dhs.gov/interagency-security-committee

SIGNAGE – SENSITIVE AREAS: (SHELL)

• Prohibit signs that identify sensitive areas, unless required by other standards/codes.

• Avoid marking outside locations such as air intakes, fuel supply valves, gas or power distribution locations, evacuation assembly areas, etc.

CONTROL OF PARKING: No special measures required.

AUTHORIZED PARKING: (SHELL):

• Visitor parking should be located as far from the facility as practical. Assigned employee and government parking may be used to establish a “buffer zone.”

VEHICLE ACCESS TO CONTROLLED PARKING:

• ISC LOP II (SHELL): Designate employee and visitor parking areas.

VEHICLE BARRIERS: No special measures required

VEHICLE SCREEENING: No special measures required

PEDESTRIAN ACCESS TO CONTROLLED PARKING AREAS:

• ISC LOP II (SHELL): Minimize areas of concealment in and around parking areas.

HAZARDOUS MATERIALS (HAZMAT) STORAGE:

• ISC LOP II (SHELL): Locate HAZMAT storage in a restricted area away from loading docks, entrances, and uncontrolled parking.

RECEPTACLE AND CONTAINER PLACEMENT:

• ISC LOP II (SHELL): Position trash containers, mailboxes, donation/recycle containers, vending machines, etc., 25 feet away from building exterior and entry points, or implement blast containment measures to mitigate an explosion.

STRUCTURAL SECURITY CRITERIA

BLAST RESISTANCE-WINDOWS:

• ISC LOP III (TI): Utilize acceptable fragment retention film to reduce the glass fragmentation hazard.

o Acceptable Fragment Retention Film: In applications requiring retention film, film shall meet or exceed the following physical properties:

Film composite strength and elongation rate measured at a strain rate not exceeding 50% per minute shall not be less than the following:

Yield strength: 12,000 psi Elongation at yield: 3% Longitudinal tensile strength: 22,000 psi Traverse tensile strength: 25,000 psi Longitudinal elongation at break: 90% Traverse elongation at break: 75% In most cases, a 7-mil retention film will be sufficient to meet the minimum physical properties

BLAST RESISTANCE: FAÇADE AND STRUCTURE:

• ISC LOP II (SHELL): EXISTING BUILDING: Ensure building constructed with materials which have inherent ductility and which are better able to respond to load reversals (e.g., cast in place reinforced concrete column construction).

o All building materials and types acceptable under model building codes are allowed. Design detailing is required for material such as pre-stressed concrete, pre-cast concrete, and masonry to adequately respond to the design loads.

o Unreinforced masonry is unacceptable. Pre-stressed concrete is not very ductile and may not be appropriate where load reversals may occur.

BLAST RESISTANCE: PROGRESSIVE COLLAPSE:

• ISC LOP II: (SHELL) Given the low occupancy and risk level associated with these types of facilities, progressive collapse design is not required for FSL I and II, regardless of the number of floors.

BLAST RESISTANCE – UNDER BUILDING PARKING: Under building parking is highly discouraged. However, if under building parking is required; the Lessor will ensure access to under building parking is limited with the Lessors guarantee that all parking under the structure will be controlled through active screening or another access control method to ensure only authorized, vetted personnel may park under the building. No unscreened public parking access will be allowed under VA leased space.

• ISC LOP II (SHELL): Use construction materials which have inherent ductility and which are better able to respond to load reversals (e.g., cast in place reinforced concrete column construction).

BURGLARY RESISTANCE OF WINDOWS AND GLASS DOORS:

• ISC LOP II (SHELL): All operable ground floor windows shall be locked and monitored via IDS.

o The degree of penetration resistance should be commensurate with the delay necessary to protect assets while security and law enforcement personnel are notified and respond. Additional solutions may include burglary-resistant bars, wire mesh window systems, pin, epoxy, film, laminate, etc.

WALLS AND NON-WINDOW OPENINGS:

• ISC LOP II (SHELL): Protect non-window openings such as mechanical vents and exposed plenums to resist forcible entry.

WINDOWS IN CTRICIAL AREAS- BALLISTIC PROTECTION:

• ISC LOP II (SHELL): No special measures required.

PROTECTION OF AIR INTAKES:

• ISC LOP II (SHELL): Secure accessible air intake grilles from tampering or removal.

ISOLATED VENTILATION SYSTEMS:

• ISC LOP II (SHELL): No special requirements

HVAC CONTROL:

• ISC LOP II (SHELL): Lessor shall develop written procedures for the emergency shut-down or exhaust of air handling systems.

o A “one-step shutoff” is a mechanism that requires only a single action by an individual (e.g., engineer or security personnel) to initiate the immediate shut down of all air handling equipment in the building.

CBR DETECTION TECHNOLOGY:

• ISC LOP II: (SHELL): No special measures required.

BIOLOGICAL FILTRATION – GENERAL BUILDING:

• ISC LOP II (SHELL): No special measures required

BIOLOGICAL FILTRATION – LOBBIES AND MAILROOMS:

• ISC LOP II (SHELL): No special measures required.

CHEMICAL FILTRATION:

• ISC LOP II: (SHELL): No special measures required.

SECURITY OF VENTILATION EQUIPMENT AND CONTROLS:

• ISC LOP II: (SHELL): The lessor shall protect the system controls from unauthorized access.

o Access to government space shall be managed by installing compliant Physical Access Control in compliance with OMB policy M-05-24, NIST SP-800-116-1, and all other applicable standards established by OMB, NIST, and the OCIO Council.

o To ensure HVAC system operation cannot be disrupted by someone physically accessing the controls, HVAC equipment shall be located in a secure area with access limited to authorized staff.

LOCATION OF UTILITIES AND FEEDERS:

• ISC LOP II: (SHELL): No special measures required.

SEPARATION OF EMERGENCY AND NORMAL POWER DISTRIBUTION:

• ISC LOP II: (SHELL): No special measures required.

EMERGENCY GENERATOR PROTECTION:

• ISC LOP II: (SHELL): If an emergency generator is used, secure against unauthorized access and locate the emergency generator and fuel tank at least 25 feet away from loading docks, entrances, and parking, or implement standoff, hardening, and venting methods to protect utilities from the DBT at these locations.

o If the emergency generator is installed outdoors at grade, it should be protected by perimeter walls and locked entrances. The generator should not be located in any areas that are prone to flooding.

o More secure locations include the roof, protected grade level, and protected interior areas. VSS, electronic Physical Access Control, and IDS coverage should be utilized.

o Provisions for securing any refueling and shutoff valves in fuel lines within or in close proximity to the building must be addressed.

PROTECTION OF WATER SUPPLY:

• ISC LOP II (SHELL): Secure handles, control mechanisms, and service connections at onsite publicly accessible locations with locks or other anti-tamper devices.

FACILITY ENTRANCE CRITERIA

If the leased Space is greater than 75% of the space in the Building (based upon ABOA measurement), the requirements of FACILITY ENTRANCES AND LOBBY Section below shall apply to the entrance of the Building. If the leased Space is less than or equal to 75% of the space in the Building (based upon ABOA measurement), then the requirements of FACILITY ENTRANCES AND LOBBY Section below shall apply to the entrance of the leased Space.

REGULATORY SIGNAGE:

• ISC LOP II: (SHELL): Post necessary regulatory, statutory, and/or site-specific signage.

EMPLOYEE ACCESS CONTROL:

• ISC LOP II (SHELL): Provide a means to secure employee entrance doors by physical or electronic means.

VISITOR ACCESS CONTROL:

• ISC LOP II (SHELL): Always require visitors to nonpublic areas be sponsored by a tenant and either approved for unescorted access or escorted at all times.

LIMIT BUILDING ENTRY POINTS:

• ISC LOP II (SHELL): No special measures required

ENTRANCE CO-LOCATION: (SHELL):

• No special measures required.

PERIMETER DOORS AND DOOR LOCKS:

• ISC LOP II: (SHELL): Secure government space perimeter doors with non-removable hinges and high-security mechanical or electronic locks.

o Hinge pins located on the unsecured side of perimeter and critical interior doors must be designed to preclude door removal. Ensure magnetic locks have at least 1,200 pounds of shear holding power.

o Electric strikes must meet all specifications of UL Standard 1034, Burglary-Resistant Electric Locking Mechanisms. For more information on electric strikes, refer to American National Standards Institute

(ANSI) A156.25.

o Door strikes should not allow the dead latch to be in the fully extended position when the door is closed.

o Entrance Doors shall be capable of being remotely locked and unlocked from the reception desk or other designated position o Glass for entrance and egress doors shall have shatter-resistant material not less than 0.18 millimeters

(7 mil) thick– Film composite strength and elongation rate measured at a strain rate not exceeding 50% per minute shall not be less than the following:

• Yield Strength: 12,000 psi

• Elongation at yield: 3%

• Longitudinal Tensile strength: 22,000 psi

• Traverse Tensile strength: 25,000 psi

• Longitudinal Elongation at break: 90%

• Traverse Elongation at break: 75%

CONTROL OF KEYS AND ACCESS MEDIA: (SHELL):

• Implement a formal key control program and electronically disable lost or stolen access media.

EMERGENCY EXIT DOORS: (SHELL):

• Secure emergency exit doors using an automatic door closer and exit hardware that are compliant with applicable life safety codes and standards. Monitor all emergency exits via visual, electronic, or audible means.

DELAYED EGRESS: (SHELL):

• No special measures required.

INTERIOR SECURITY CRITERIA

SPACE PLANNING:

• ISC LOP II (SHELL): No special measures required

BUILDING SYSTEMS AND ROOF ACCESS:

• ISC LOP II (SHELL): Secure utility, mechanical, electrical, and telecom rooms, and access to interior space from the roof with high-security locks.

PUBLICALLY ACCESSIBLE RESTROOMS:

• ISC LOP II (SHELL): Control access to public restrooms

PUBLICLY ACCESSIBLE RETAIL AND MIXED-USE SPACE:

• ISC LOP II (SHELL): Accommodate publicly accessible retail and mixed-use space through such means as separating entryways.

INTERIOR WINDOWS:

• ISC LOP II: (SHELL): No special measures required.

SECURITY SYSTEMS CRITERIA

VSS COVERAGE:

• ISC LOP III(TI): Provide VSS coverage of personnel entrances and exits, parking lots, loading docks, and lobbies and other areas reviewed by VA Police.

o VA Police will designate a purpose and goal for each security camera installed and verify/test that the VSS is designed to meet the physical security needs of the space and occupants.

VSS MONITORING AND RECORDING:

• ISC LOP II (SHELL): Record CCTV views using a digital medium.

o Firmware and software updates from the manufacturer should be installed as soon as possible to prevent any breach.

A chain of custody and written procedures for evidence retrieval must be developed (contact isfubgroup@tswg.gov for a publication on Best Practices for the Retrieval of Video Evidence from Digital VMS Systems or visit www.tswg.gov).

The need for disaster recovery and remote operational capability, including offsite storage of data, should be considered when designing the VSS.

o When possible the images shall be recorded at a minimum rate of 15 frames per second on digital media.

Motion recording with conditional refresh is recommended to reduce bandwidth and storage challenges. External entrance/exit cameras and any cameras covering significant areas or assets (identified during the risk assessment) should record at all times. Recorded images should be at the camera’s maximum resolution.

o Edge recording capabilities should be considered when network bandwidth or network outages are a concern.

o Storage:

According to the NARA General Records Schedule (GRS) 5.6: Security Records, surveillance video must be stored for 30 days (https://www.archives.gov/files/records-mgmt/grs/grs05-6.pdf).

Longer retention is authorized if required for business use. If less than 30 days of video images are to be kept, then a waiver should be granted from NARA utilizing SF 115.

SECURITY CONTROL CENTER:

• ISC LOP II (SHELL): No special measures required

VSS SURVEILLANCE ADVISORY:

• ISC LOP II: (SHELL): When VSS is utilized, post signage at the entrance of the location.

o Post signs at entrances to the site, facility, parking garages, etc., where VSS coverage exists.

o Signs should be large enough to be noticed, placed in an easily seen location, and have both words and pictures indicating video surveillance is being conducted at the location.

INTRUSTION DETECTION SYSTEM (IDS) COVERAGE:

• ISC LOP II (SHELL): Provide IDS on perimeter entry and exit doors and all ground-floor windows.

• UL 2050 Listed intrusion detection equipment is strongly recommended. Initial installation should include validation (testing) of the entire system, including monitoring center notification and connected equipment.

• The following descriptions are provided as benchmarks in considering the appropriate system technologies. An access control system can serve as an IDS as long as it meets the IDS details listed here and has provisions for monitoring (see IDS Monitoring).

o Entry Doors will have:

Magnetic switch;

Alarm system keypad (at main employee entrance); and Motion Sensor coverage (passive infrared sensor (PIR), microwave, ultrasonic, or similar device).

o Windows and other openings greater than 96 square inches:

Glass-break detector; and Magnetic switches or shock sensors.

Non-opening windows should utilize glass break detectors and/or motion sensor coverage.

o Installation Practices: No matter the system type listed above the following installation practices should be used:

All IDS devices should be on a supervised circuit.

https://www.archives.gov/files/records-mgmt/grs/grs05-6.pdf

End-of-line resistors for supervision must be placed in the individual sensor and not in the alarm panel.

Alarm panels should be in a locked tamper-proof container with a tamper switch.

Alarm panels should be located in a locked area that is only assessable to authorized individuals.

Area should be protected by IDS.

External facility entrances and high-security applications should be designed in a multi-layered approach (e.g., doors that have magnetic or balanced magnetic switches should also be protected with a motion sensor).

Zoning – Each alarm sensor or alarm point should have its own zone. This will help with troubleshooting alarm points and response to alarms.

Double doors – Double doors or split doors should be zoned on each leaf, not both doors on one zone.

Cross zoning (the requirement of two or more sensors to be activated in a specific amount of time before activating an alarm) should be avoided.

Garage doors – Garage doors should have a sensor on each side to prevent the lifting on one side without an alarm.

Accessible external facility openings that are 96 square inches or more should be alarmed.

Door contacts should be installed on the opening side of the door and should not allow the door to open far enough to provide the ability to tamper with the contact inside the door without going into alarm.

INTRUSTION DETECTION SYSTEM (IDS) MONITORING:

• ISC LOP II (SHELL): Monitor at a central station with notification to law enforcement or security responders.

DURESS ALARMS OR ASSISTANCE STATIONS:

• ISC LOP II: (SHELL): Utilize existing system if applicable.

BUILDING COMMUNICATON SYSTEM:

• ISC LOP II (SHELL): No special measures required.

EMERGENCY POWER FOR SECURITY SYSTEMS:

• ISC LOP II (SHELL): No special measures required.

SECURITY SYSTEM TESTING: (SHELL):

• Conduct security system performance testing annually and provide documentation.

SECURITY SYSTEM MAINTENANCE:

• ISC LOP II (SHELL): Implement a maintenance program for all security systems. Any critical component that becomes inoperable must be replaced or repaired within five business days.

SECURITY OPERATIONS AND ADMINISTRATION

FACILITY SECURITY PLAN: (SHELL):

• Develop a written Facility Security Plan that identifies security responsibilities, emergency contacts, response procedures for incidents, and contingency plans for temporary upgrades in accordance with the National Terrorism Advisory System.

SECURITY DURIGN CONSTRUCTION AND RENOVATION (SHELL):

• Develop and implement a Construction Security Plan.

PROTECTION OF CONSTRUCTION INFORMATION: (SHELL):

• Limit access to construction documents to those persons with an established need-to- know.