Exhibit D Minimum Security Requirements.pdf

MINIMUM SECURITY REQUIREMENTS

DEFINITIONS:

CRITICAL AREAS - The areas that house systems that if damaged or compromised could have significant adverse consequences for the facility, operation of the facility, or mission of the agency or its occupants and visitors. These areas may also be referred to as “limited access areas,” “restricted areas,” or “exclusionary zones.” Critical areas do not necessarily have to be within Government-controlled space (e.g., generators, air handlers, electrical feeds which could be located outside Government-controlled space).

SENSITIVE AREAS – Sensitive areas include vaults, Open storage areas, Emergency Operations Centers, Controlled security areas, and sensitive documents areas. Sensitive areas are primarily housed within Government-controlled space.

1. Site Security Criteria

1.1 Identification as Federal Facility:

Signage identifying a facility at a federal facility should only be posted when necessary to achieve the mission of the tenants, or when the facility is readily identified or well-known as a government facility based on the nature of public contact or other operations.

POSTING OF SIGNAGE IDENTIFYING THE SPACE AS GOVERNMENTAL.

The Lessor shall not post sign(s) or otherwise identify the facility and parking areas as a Government, or specific Government tenant, occupied facility, including during construction, without written Government approval.

POSTING OF REGULATORY SIGNAGE.

The Government may post or request the Lessor to post regulatory, statutory, sensitive areas and site-specific signage.

1.2 Landscaping:

Minimize areas of concealment in and around facilities. Establish a clear zone around barriers, fences, and restrict landscaping from obstructing views of the security force and Video Surveillance Systems (VSS) (i.e. CCTV) or interfering with lighting or Intrusion Detection System (IDS).

REQUIREMENTS.

Lessor shall maintain landscaping (trees, bushes, hedges, land contour, etc,) around the facility. Landscaping shall be neatly trimmed to minimize the opportunity for concealment of individuals and packages/containers. Landscaping shall not obstruct the views of security guards and CCTV cameras or interfere with lighting or IDS equipment.

CRIME PREVENTION THROUGH ENVIRONMENTAL DESIGN.

The Lessor shall separate from public access, restricted areas as designated by the

Government, through the application of Crime Prevention Through Environmental Design (CPTED) principles by using trees, hedges, berms, or a combination of these or similar features, and by fences, walls, gates, and other barriers, where feasible and acceptable to the Government.

1.3 Site Lighting:

Install exterior lighting at entrances, exits, parking lots, garages, and VSS locations. For prescriptive lighting requirements, please refer to the PBS-P100 Facilities Standards for the Public Buildings Service | WBDG - Whole Building Design Guide, Issued 2021.

1.4 Restricted Areas or Significant Areas/Assets:

Provide fences, walls, gates, or other barriers to prevent unauthorized access to restricted areas and monitor with VSS or security force patrols. Use High-Security Locks, access control, and IDS.

Access to government space should be managed by installing compliant Physical Access Control in compliance with OMB policies M-19-17 and M-05-24, NIST SP800-63-1, FIPS-201-3, NIST SP800-116 and all other applicable standards established by OMB, NIST and the OCIO Council.

1.5 Sensitive Areas:

Prohibit signs that identify sensitive areas, unless required by other standards/codes.

1.6 Pedestrian Access to Controlled Parking Areas:

Minimize areas of concealment in and around lobby, loading dock exterior and parking areas.

Monitor pedestrian access to parking areas utilizing security force and/or VSS. At a minimum, pedestrian barriers around parking areas should be designed to prevent casual access and increase the visibility of unauthorized access attempts.

1.7 Controlled Parking Areas:

No public underground/in-building parking.

1.8 Hazardous Materials (HAZMAT) Storage:

If there is HAZMAT storage, Lessor shall locate it in a restricted area or storage container away from loading docks, entrances, and uncontrolled parking. Comply with applicable regulations regarding storage and safety requirements. Depending on the nature of the HAZMAT, design measures to prevent access to, release of, or unauthorized removal of the HAZMAT from the site. Monitor storage area using IDS and/or VSS. Control access areas.

Valves and control mechanisms also must be protected from unauthorized access.

1.9 Receptacle and Container Placement.

Position trash containers, mailboxes, vending machines, or other fixtures and features that could conceal devices away from building entrances.

Position trash containers, mailboxes, donation/recycle containers, vending machines, etc., away from building exterior and entry points, or implement blast containment measures to mitigate an explosion.

2. Structure Security Criteria

2.1 Blast Resistance-Windows:

Use acceptable fragment retention film or preferred glazing systems to reduce the glass fragmentation hazard, if applicable. Historically, a daylight application of 7 mil retention/blast film has been considered the minimum recommendation for improving the performance of annealed glass windows. A combination of protected setback and window glazing or treatments may also be acceptable.

2.2 Burglary Resistance of Windows:

Lock and monitor via IDS all operable ground floor windows.

2.3 Walls and Non-Window Openings:

Protect non-window openings such as mechanical vents and exposed plenums to resist forcible entry.

2.4 Windows in Critical Areas:

Provide blinds, curtains, or other window treatments in critical areas that can be used to prevent visual observation into critical areas when temporary conditions warrant.

2.5 Protection of Air Intakes:

Provide emergency shutdown, Shelter-In-Place and evacuation procedures. Secure accessible air intake grilles from tampering or removal. Provide VSS or Security Patrols.

2.6 Isolated Ventilation Systems:

Provide separate isolated HVAC systems in lobbies, loading docks, mail rooms and other locations susceptible to CBR attack that are isolated from other building areas.

2.7 HVAC Control:

Develop written procedures for the emergency shutoff of exhaust and air handling systems. Install an emergency shut-off and exhaust system for air handlers. Control movement of elevators and close applicable doors and dampers to seal building.

2.8 Biological Filtration- General Building:

Use a Minimum Efficiency Reporting Value (MERV) 10 particulate filter on all exterior air handling units (AHUs).

2.9 Biological Filtration- Lobbies and Mailroom:

Use a Minimum Efficiency Reporting Value (MERV) 13 particulate filter on all air handling units (AHUs) in mailrooms and lobbies.

2.10 Security of Ventilation Equipment and Controls:

Protect the system controls from unauthorized access. Access to government space should be managed by installing compliant Physical Access Control in compliance with OMB policies M-19-17 and M-05-24, NIST SP800-63, NIST SP800-116, FIPS-201-2, and all other applicable standards established by OMB, NIST and the OCIO Council.

To ensure HVAC system operation cannot be disrupted by someone physically accessing the controls, HVAC equipment should be located in a secure area with access limited to security and engineering staff.

2.11 Emergency Generator Protection:

If an emergency generator is used, If an emergency generator is used, secure against unauthorized access, and locate the emergency generator and fuel tank at least 25 feet away from loading docks, entrances, parking, or implement standoff, hardening and venting methods to protect utilities at these locations.

2.12 Protection of Water Supply:

Secure handles, control mechanisms, and service connections at on-site publicly-accessible locations with locks or other anti-tamper devices.

3. Facility Entrance Security Criteria Lowest Occupied Floor

3.1 Guard Station:

Guard desk area should have a counter big enough to accommodate CCTV monitoring equipment, computer with printer, and separate badge equipment to process visitors. Visitor entrance (on lowest occupied floor) will require space for an x-ray machine and a magnetometer to screen visitors and their property (bags/ packages) or employees not in possession of their government identification.

3.2 Badge Identification System:

Require agency photo ID that is always worn and visible when in government-controlled space. A badge control policy must be in place in compliance with Personal Identity Verification (PIV) of Federal Employees and Contractors FIPS 201-3 that specifies inventory requirements, lost badge, and revocation procedures.

3.3 Regulatory Signage:

Post necessary regulatory, statutory, and/or site-specific signage. Examples of appropriate signage include, but are not limited to: Prohibiting the unauthorized possession of firearms and dangerous weapons; Consent to search; Local building rules and regulations regarding prohibited items; and VSS surveillance advisory.

3.4 Employee Access Control:

Provide a means to secure employee entrance doors and to verify the identity of persons requesting access prior to allowing entry in the facility by physical or electronic means. The Government shall have a designated main entrance.

The Lessor shall provide key or electronic access control for the entrance to this building. All Government employees, under this lease, shall be allowed access to the leased space (including after-hours access). Access to government space should be managed by installing compliant Physical Access Control in compliance with OMB policies M-19-17 and M-05-24, NIST SP800-63, FIPS-201-2, NIST SP800-116 and all other applicable standards.

3.5 Visitor Screening/Access Control:

The Government reserves the right to verify the identity of persons requesting access to the USACE space prior to allowing entry. Entrances are open to the public during business hours. After hours, visitor entrances are secured, and have a means to verify the identity of persons requesting access prior to all Require visitors to non-public areas be sponsored by a tenant and either approved for unescorted access or escorted at all times.

3.6 Elevator Access

Elevators should be modified with key card readers to only allow USACE employees to access USACE occupied floors. All stairwell doors to USACE occupied floors will also require electronic keycard readers. If elevators cannot be modified as stated above, we will then have electronic keycard readers installed on all hallway doors outside the elevators going into USACE occupied floors.

3.7 Occupant Screening

Use X-ray and metal detector to screen all occupants and their property that do not possess an acceptable ID for access to the facility. Establish a list of prohibited items, including potential weapons (List of Prohibited Items from Federal Facilities will meet this requirement).

3.8 Visitor Screening

Screen all visitors and their property using X-ray and metal detector. Establish a list of prohibited items, including potential weapons. (List of Prohibited Items from Federal Facilities will meet this requirement).

3.9 After Hours Access Control:

Require all employees, contractors, and visitors to sign in/out electronically or on a building register after-hours.

Access to government space should be managed by installing compliant Physical Access Control in compliance with OMB policies M-19-17 and M-05-24, NIST SP800-63, FIPS-201-2, NIST SP800-116 and all other applicable standards established by OMB, NIST and the OCIO Council.

All building entry points must be controlled and/or monitored via VSS, IDS (where applicable) and compliant Physical Access Control System based on OMB policies M-19-17 and M-05-24. Reducing the number of building entry points, particularly under periods of heightened security alerts, reduces vulnerability and security costs associated with monitoring and controlling access.

3.10 Perimeter Doors & Door Locks:

Secure perimeter doors with non-removable hinges and high-security mechanical or electronic locks. Access to government space should be managed by installing compliant Physical Access Control in compliance with OMB policies M-19-17 and M-05- 24, NIST SP800-63, FIPS-201-2, NIST SP800-116 and all other applicable standards established by OMB, NIST and the OCIO Council.

3.11 Employee Convenience Doors:

Employee convenience doors are discouraged. Provide electronic access control for employee entry doors without a security force post (including after-hours access) in conjunction with VSS coverage.

3.12 Emergency Exit Doors:

Secure emergency exit doors using an automatic door closer and exit hardware that are compliant with applicable life safety codes and standards. Monitor all emergency exits via visual, electronic, or audible means. Emergency exit door hardware at all levels should have audible annunciators to provide notification of door use. Electronic locks on perimeter doors must be fail-secure, and electronic locks on interior doors must be fail-safe, if such measures do not conflict with applicable fire and safety codes.

4. Interior Security Criteria

4.1 Space Planning:

Locate critical systems and areas at least 25 feet away from loading docks, entrances, mailrooms, personnel and package screening locations, and uncontrolled parking, or implement standoff, hardening and venting methods to protect critical areas.

Critical systems and equipment may include security and life-safety systems, power distribution, communications and data, and other mission-critical equipment.

4.2 Space Planning:

Use signage to designate non-public areas and establish procedures to prevent unauthorized access.

Use signage, stanchions, counters, furniture, knee walls, etc., to establish physical boundaries to control access to non-public areas.

4.3 Security of Critical Areas:

Lock doors to critical areas and establish procedures to limit access into critical areas to authorized personnel only. Install electronic access control and IDS to control and monitor access into critical areas.

4.4 Building Systems and Roof Access:

Secure utility, mechanical, electrical, and telecom rooms, and access to interior space from the roof with high-security locks.

Access to government space should be managed by installing Physical Access

Control Systems in compliance with OMB policies M-19-17 and M-05-24, NIST SP800-63, FIPS-201-2, NIST SP800-116 and all other applicable standards established by OMB, NIST and the OCIO Council.

4.5 Publicly Accessible Restrooms:

Control access to public restrooms.

4.6 Publicly Accessible Retail and Mixed Use Space:

Accommodate publicly accessible retail and mixed uses through such means as separating entryways.

5. Security Systems Criteria

5.1 VSS Coverage:

Provide VSS coverage of screening checkpoints, personnel and vehicle entrances, exits, loading docks, and lobbies.

The lessor shall, with Government approval, obtain a bid to design, install and maintain a Closed Circuit Television (CCTV) system as described in this section. The CCTV system will support the entry control system (at entrances and exits to the space), with time lapse video recording, that will allow Government employees to view and communicate remotely with visitors before allowing access to the Space. As determined by the Government the CCTV system shall provide unobstructed coverage of designated pedestrian entrances and exits. Technical review of the proposed system shall be coordinated with the Government security representative, at the direction of the Contracting Officer, prior to installation.

CCTV system testing and acceptance shall be conducted by the Government prior to occupancy. The Government will centrally monitor the CCTV system.

Government specifications will be available from the Lease Contracting Officer.

CCTV system components which fail or require maintenance or which fail during testing should be serviced in accordance with the Security System Maintenance Criteria listed below.

Security System Maintenance Criteria: The Lessor, in consultation and coordination with a security provider, either internal or external, as determined by the Lease Contracting Officer, and the Government security representative, shall implement a preventive maintenance program for all security systems the Lessor has installed. Any critical component that becomes inoperable must be replaced or repaired by the Lessor within 5 business days.

When VSS is utilized, post signage at the entrance of the location.

5.2 Intrusion Detection System (IDS) Coverage:

Provide IDS on perimeter entry and exit doors and operable ground-floor windows.

The lessor shall, with Government approval, obtain a bid to design, install and maintain an Intrusion Detection System (IDS) as described in this section. The Government requires an IDS, which will cover perimeter entry and exit doors, and operable ground-floor windows. Basic Security-in-Depth IDS components include:

magnetic door switch(s), alarm system keypad, passive infrared sensor(s) (PIR), an alarm panel (to designated monitoring center) and appropriate communication method i.e. telephone and/or Internet connection, glass-break detector, magnetic window switches or shock sensors. Technical review of the proposed system shall be coordinated with the Government security representative, at the direction of the Lease Contracting Officer, prior to installation. System testing and acceptance shall be conducted by the Government prior to occupancy. Basic Security-in-Depth IDS shall be connected to and monitored at a central station operated by the Department of Homeland Security Megacenter. Emergency notification lists shall be coordinated with the monitoring station to include all applicable Government and lessor points of contact. Monitoring shall be designed to facilitate a real-time detection of an incident, and to coordinate an active response to an incident.

Security System Maintenance Criteria: The Lessor, in consultation and coordination with a security provider, either internal or external, as determined by the Lease Contracting Officer, and the Government security representative, shall implement a preventive maintenance program for all security systems the Lessor has installed.

Any critical component that becomes inoperable must be replaced or repaired by the Lessor within 5 business days. Critical components are those required to provide security (IDS, CCTV, access control, etc.) for a perimeter access point or critical area. "Replacement" may include implementing other temporary measures in instances where the replacement or repair is not achievable within the specified time frame (e.g. a temporary barrier to replace an inoperable pop-up vehicle barrier, etc.). Failure by the Lessor to provide sufficient replacement measures within the timeframe identified above may result in the Government’s providing guard service, the cost of which must be reimbursed by the Lessor.

When IDS is utilized, post signage at the entrance of the location.

5.3 Intrusion Detection System (IDS) Monitoring:

Monitor at a central station with notification to law enforcement, security responders or designated tenant POC.

5.4 Duress Alarms or Assistance Stations:

Provide duress buttons or call buttons at security force posts and sensitive public contact areas. Implement duress procedures for emergency situations. Security System Maintenance Criteria: The Lessor in consultation and coordination with a security provider, either internal or external, as determined by the Lease Contracting Officer, and the Government security representative shall implement a preventive maintenance program for all security systems they have installed. Any critical component that becomes inoperable must be replaced or repaired within 5 business days. Critical components are those required to provide security (IDS, CCTV, access control, etc.) for a perimeter access point or critical area. "Replacement" may include implementing other temporary measures in instances where the replacement or repair is not achievable within the specified time frame (e.g. a temporary barrier to replace an inoperable pop-up vehicle barrier, etc.).

Failure by the Lessor to provide sufficient replacement measures within the timeframe identified above may result in the Government’s providing guard service, the cost of which must be reimbursed by the Lessor.

5.5 Security System Integrity:

Secure alarm and physical access control panels, VSS components, controllers, and cabling against unauthorized access.

5.6 Emergency Power for Security Systems:

Provide uninterruptible emergency power to essential electronic security systems for a minimum of four hours. It is recommended that VSS operate for four hours minimum in standby mode. This includes all components - cameras, switches, amplifiers, monitors, recorders, etc. – that obtain, view, and record motion video.

More than four hours of back up may be required for certain facilities based on mission, such as when the facility is required to maintain 24-hour operations. Testing of security system emergency power should be conducted annually and recorded.

5.7 Security System Maintenance:

Implement a maintenance program for all security systems. Any critical component that becomes inoperable must be replaced or repaired within five business days.

*Critical components are those required to provide security (IDS, VSS, access control, etc.) for a perimeter access point or critical area.

5.8 Building Communication System:

Provide a communication system for security and emergency announcements.

6. Security Operations and Administration

6.1 Security Force Fixed Post-Screening Checkpoints:

Post armed security force at all screening checkpoints.

6.2 Security Force Patrols:

Establish four times each day exterior roving armed security force patrols during normal business hours. Note: Additional Random Measures will be implemented during Increased FPCONs.

6.3 Security Force Response:

Develop plans for on-site security force response to alarms and incidents.

6.4 Protection of Construction Information:

Limit access to construction documents to those persons with an established need-to-know.

6.5 Security During Construction and Renovation:

Development and implement a Construction Security Plan.

6.6 Mail/Package Handling and Other Deliveries:

Inspect all mail/packages and deliveries visually prior to distribution throughout the facility. Screen all mail and packages using X-ray at a loading dock if present or at an existing screening location if there is no loading dock. Physically inspect items that cannot be passed through screening equipment.

For mailroom security measures and mitigation of design events, reference GSA’s Guidelines for Mailroom Construction and Renovation and the U.S. Postal Inspection Service’s Mail Center Security Guide Publication 166. For mailroom security measures and mitigation of design events, reference GSA’s Guidelines for Mailroom Construction and Renovation and the U.S. Postal Inspection Service’s Mail Center Security Guide Publication 166.