Exhibit D Security Requirements FSL Level II.pdf

LESSOR: GOVERNMENT: SECURITY REQUIREMENTS (LEVEL II)

REV (08/29/2022)

SECURITY REQUIREMENTS - FACILITY SECURITY LEVEL II

THESE PARAGRAPHS CONTAIN ADDITIONAL SECURITY REQUIREMENTS, AND, UNLESS

INDICATED OTHERWISE, ARE TO BE PRICED AS PART OF THE BUILDING SPECIFIC AMORTIZED

CAPITAL (BSAC).

NOTE THAT ITEMS IDENTIFIED AS “SHELL *” REPRESENT A LESSOR’S OBLIGATIONS OR THE

GOVERNMENT’S RIGHTS AND ARE NOT NECESSARILY ITEMS TO BE CONSTRUCTED.

DEFINITIONS:

Definitions are the same as those used in the Lease unless re-defined in these Security Requirements.

CRITICAL AREAS - The areas that house systems that if damaged or compromised could have significant adverse consequences for the facility, operation of the facility, or mission of the agency or its occupants and visitors. These areas may also be referred to as “limited access areas,” “restricted areas,” or “exclusionary zones.” Critical areas do not necessarily have to be within Government-controlled space (e.g., generators, air handlers, electrical feeds which could be located outside Government-controlled space).

DESIGN-BASIS THREAT – The Design-Basis Threat (DBT) is the profile and estimate of the threats to a Government facility across a range of specific undesirable events, and serves as the basis for determining appropriate security standards. The Lessor’s technical consultant(s) shall work in conjunction with the Government, including the Federal Protective Service (FPS), to apply the DBT to the post-award risk assessment. The risk assessment identifies recommended countermeasures and security design features that achieve the minimum baseline level of protection for a particular facility. The baseline level of protection may be further customized to address facility-specific conditions. The Lessor is responsible for providing countermeasure provisions outlined in this FSL document, as well as for additional items identified during the post-award risk assessment. Any additional countermeasures identified during this assessment shall be priced as BSAC.

I. FACILITY ENTRANCES, LOBBY, COMMON AREAS, NON-PUBLIC, AND

UTILITY AREAS.

A. FACILITY ENTRANCES AND LOBBY

1. EMPLOYEE ACCESS CONTROL AT ENTRANCES (SHELL)

The Lessor shall provide key or Physical Access Control System (PACS) for the entrance to this building and to doors identified by the Government as employee entrance doors. All Government employees, under this lease, shall be allowed access to the leased space (including after-hours access).

B. SCREENING REQUIREMENTS

1. ACCOMODATION OF RETAIL/MIXED USE SPACE (SHELL)

The Lessor shall accommodate publicly accessible retail and mixed uses through such means as separating entryways.

C. COMMON AREAS, NON-PUBLIC, AND UTILITY AREAS.

1. PUBLIC RESTROOM ACCESS (SHELL)

The Government reserves the right to control access to public restrooms within Government controlled Space.

2. SECURING CRITICAL AREAS (SHELL)

The Lessor shall secure areas designated as Critical Areas to restrict access to authorized personnel only, and post signage accordingly:

a. At a minimum, the Lessor shall secure building common areas such as mechanical and janitorial areas, sprinkler rooms, electrical closets, telecommunications rooms, and janitor closets. Utility, mechanical, electrical, and telecom rooms shall be secured with high-security (UL437) locks.

Keyed locks, PACS card reader, or similar security measures shall strictly control access to Critical Areas. Additional controls for access to keys, PACS, and key codes shall be strictly maintained.

b. Roofs with HVAC systems and access to interior space from the roof shall also be secured with high-security (UL437) locks. Roof access shall be strictly controlled through keyed locks, PACS card reader, or similar measures. Fire and life safety egress shall be carefully reviewed when restricting roof access.

c. In addition, Lessor shall protect the ventilation equipment and system controls from unauthorized access.

3. VISITOR ACCESS CONTROL (SHELL)

Entrances are open to the public during business hours. After hours, visitor entrances are secured, and have a means to verify the identity of persons requesting access prior to allowing entry into the Premises.

4. PUBLIC SPACE RESTRICTIONS WITH PRIMARY VERTICAL LOAD MEMBERS

The Government reserves the right to remove this countermeasure requirement, post-award, based on building-specific conditions. For measurement purposes, standoff shall be considered building support space and not ABOA.

a. RESTRICT CONTACT FROM PUBLIC AREAS WITH PRIMARY VERTICAL LOAD MEMBERS: For partitions separating public space from federal space, the Lessor shall use construction materials which have inherent ductility, and which are able to respond to load reversals. Alternatively, the Lessor can use a minimum standoff of at least 100 mm (4 inches).

b. RESTRICT CONTACT FROM MAIL AREA WITH PRIMARY VERTICAL LOAD MEMBERS: In the partitions that separate public mail screening and receiving areas from federal tenants, the Lessor shall use construction materials which have inherent ductility, and which are able to respond to load reversals. Alternatively, the Lessor can use a minimum standoff of at least 150 mm (6 inches).

II. INTERIOR (GOVERNMENT SPACE)

A. IDENTITY VERIFICATION (SHELL)

The Government reserves the right to verify the identity of persons requesting access to the Government-controlled Space prior to allowing entry.

B. FORMAL KEY CONTROL PROGRAM (SHELL)

The Government reserves the right to implement a formal key control program. The Lessor shall have a means of allowing the electronic disabling of lost or stolen access media, if electronic media is used.

III. SITES AND EXTERIOR OF THE BUILDING

A. SIGNAGE

1. POSTING OF SIGNAGE IDENTIFYING THE SPACE AS GOVERNMENTAL (SHELL)

The Lessor shall not post sign(s) or otherwise identify the facility and parking areas as a Government, or specific Government tenant, occupied facility, including during construction, without written Government approval.

2. POSTING OF REGULATORY SIGNAGE (SHELL)

The Government may post or request the Lessor to post regulatory, statutory, sensitive areas and site-specific signage.

B. LANDSCAPING AND ENTRANCES

1. LANDSCAPING REQUIREMENTS (SHELL)

Landscaping shall be neatly trimmed to minimize the opportunity for concealment of individuals, packages/containers, and parking areas. If Landscaping exists, the Lessor shall provide trees, hedges, berms, or any combination of these to create buffer zones to separate public areas and other functions.

Landscaping shall not obstruct the views of security guards and Video Surveillance System (VSS) cameras or interfere with lighting or Intrusion Detection System (IDS) equipment.

2. HAZMAT STORAGE (SHELL)

Where applicable, Lessor shall locate HAZMAT storage in a restricted area or storage container away from loading docks, entrances, and uncontrolled parking.

3. PLACEMENT OF RECEPTACLES, CONTAINERS, AND MAILBOXES (SHELL)

Trash receptacles, containers, mailboxes, FedEx-UPS boxes, vending machines, or other fixtures and/or features that could conceal packages, briefcases, or other portable containers shall be located away from building exterior and entry points.

C. PARKING

1. PUBLIC ACCESS TO GOVERNMENT PARKING AREAS (SHELL)

Lessor shall designate Government employee and visitor parking areas.

IV. SECURITY SYSTEMS

A. Security System Testing and Maintenance Criteria: The Lessor in consultation and coordination with a security provider, either internal or external, as determined by the Lease Contracting Officer, and the Government security representative shall implement a testing and preventive maintenance program for all security systems the Lessor has installed. Testing must be based on established, consistent, agency-specific protocols, to be determined at the time of design. All testing shall be documented. Operational performance testing shall be conducted annually and functional testing shall be conducted more frequently, as determined by the Government. Components which fail, either during testing or throughout the life of this lease shall be repaired or replaced by the Lessor within a reasonable timeframe as determined by the Government. Any critical component that becomes inoperable must be replaced or repaired by the Lessor within five business days. Critical components are those required to provide security (IDS, VSS, PACS, etc.) for a perimeter access point or critical area. "Replacement" may include implementing other temporary measures in instances where the replacement or repair is not achievable within the specified time frame (e.g. a temporary barrier to replace an inoperable pop-up vehicle barrier, etc.). Failure by the Lessor to provide sufficient replacement measures within the timeframe identified above may result in the Government providing guard service, the cost of which must be reimbursed by the Lessor.

B. VIDEO SURVEILLANCE SYSTEM

LESSOR PROVIDED DESIGN, INSTALLATION, AND MAINTENANCE

The lessor shall design, install, and maintain a Video Surveillance System (VSS) as described in this section.

The VSS system will support the entry control system (at personnel entrances and exits to the space), with time lapse video recording and digital image storage, that will allow Government employees to view and communicate remotely with visitors before allowing access to the Space. As determined by the Government the VSS system shall provide unobstructed coverage of designated pedestrian entrances and exits.

Technical review of the proposed system shall be coordinated with the Government security representative, at the direction of the Contracting Officer, prior to completion of the CD’s, as well as prior to installation. VSS system testing, and acceptance shall be conducted by the Government prior to occupancy. The VSS system shall comply with the Architectural Barriers Act, section F230.0. The Government will centrally monitor the VSS system. Government specifications are available from the Lease Contracting Officer. VSS system components which fail or require maintenance, or which fail during testing should be serviced in accordance with the Security System Maintenance Criteria listed above.

The Lessor shall comply with FAR 52.204-25: Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (Nov 2021). See https://www.acquisition.gov/far/part-

52#FAR_52_204_25.

C. INTRUSION DETECTION SYSTEM

The Lessor shall design, install, and maintain an Intrusion Detection System (IDS) as described in this section. The Government requires an IDS, which will cover perimeter entry and exit doors, and operable ground-floor windows. Basic Security-in-Depth IDS components include: magnetic door switch(s), alarm system keypad, passive infrared sensor(s) (PIR), an alarm panel (to designated monitoring center) and appropriate communication method i.e. telephone and/or Internet connection, glass-break detector, magnetic window switches or shock sensors. Technical review of the proposed system shall be coordinated with the Government security representative, at the direction of the Lease Contracting Officer, prior to completion of the CDs, and prior to installation. System testing and acceptance shall be conducted by the Government prior to occupancy.

Basic Security-in-Depth IDS shall be connected to and monitored at a central station operated by the Department of Homeland Security Mega Center. Emergency notification lists shall be coordinated with the monitoring station to include all applicable Government and lessor points of contact, including law enforcement (Federal Protective Service and facility security force). Monitoring shall be designed to facilitate a real-time detection of an incident, and to coordinate an active response to an incident. The Lessor must complete the Mega Center Alarm Requirements (MAR) application process specified by the Government to meet the monitoring requirements for a functional IDS. The Government creates an FPS monitoring account and works with the Lessor to complete the Mega Center Alarm Requirement (MAR) in conjunction with the installing security vendor. Components which fail or require maintenance, or which fail during testing shall be serviced in accordance with the Security System Maintenance Criteria listed above.

D. DURESS ALARM

The Lessor shall design, install, and maintain a duress alarm system. Technical review shall be coordinated with the Government security representative, at the direction of the Contracting Officer, prior to completion of the CDs, as well as prior to installation. System testing and acceptance shall be conducted by the Government prior to occupancy. This system shall comply with the Architectural Barriers Act, section F230.0.

The Lessor in consultation and coordination with the security provider and Government shall conduct security system performance testing annually. Testing must be based on established, consistent agency-specific protocols, documented and furnished to the Contracting Officer. Components which fail or require maintenance, or which fail during testing should be serviced in accordance with the Security System Maintenance Criteria listed above.

https://www.acquisition.gov/far/part https://www.acquisition.gov/far/part-52#FAR_52_204_25 https://www.acquisition.gov/far/part-52#FAR_52_204_25

E. SECURITY SYSTEMS DESIGN

The Lessor, in consultation and coordination with security providers (internal or external) and the agency designated security representative, shall ensure at the time of system design, system construction, and throughout the term of the Lease, that alarm and PACS panel, VSS components, controllers, and cabling shall be secured from unauthorized physical and logical access.

V. STRUCTURE

NOTE: FOR ADDITIONAL BLAST RESISTANT MEASURES REQUIRED IN NEW LEASE

CONSTRUCTION PROJECTS, REFER TO LEASE PARAGRAPH “SECURITY FOR NEW

CONSTRUCTION”.

A. WINDOWS

LOCK GROUND FLOOR WINDOWS

If a Government tenant occupies ground floor space in the Building, the Lessor shall provide a means to lock all operable, ground floor windows with secure latches. As part of BSAC, any operable, ground floor windows shall be monitored via IDS.

B. BUILDING SYSTEMS

1. EMERGENCY GENERATOR PROTECTION (T.I.)

If an emergency generator is required by the Government, the Lessor shall locate it, either pre-existing or installed as part of Tenant Improvements, in a secure area, protected from unauthorized access and vehicle ramming, if outdoors. The emergency generator and its fuel tank must be located at least 25 feet from loading docks, entrances, and parking areas. Alternatively, if the 25 foot distance cannot be achieved, Lessor shall protect utilities in accordance with the post-award DBT analysis through a combination of standoff, hardening, and venting methods.

2. SECURING AIR INTAKE GRILLES

Lessor shall secure all accessible air intake grills from tampering or removal. Whenever possible, locate outdoor air intakes at least 30 feet above grade, and preferably at roof level.

VI. OPERATIONS AND ADMINISTRATION

A. FACILITY SECURITY COMMITTEE (SHELL *)

The Lessor shall cooperate and work with the buildings Facility Security Committee (FSC) throughout the term of the Lease. The FSC is responsible for addressing facility-specific security issues and approving the implementation of security measures and practices. The FSC consists of representatives of all Federal tenants in the facility, the security organization, and the leasing department or agency.

B. ACCESS TO BUILDING INFORMATION (SHELL *)

Building Information—including mechanical, electrical, vertical transport, fire and life safety, security system plans and schematics, computer automation systems, and emergency operations procedures shall be strictly controlled. Such information shall be released to authorized personnel only, approved by the Government, by the development of an access list and controlled copy numbering. The Lease Contracting Officer may direct that the names and locations of -Government tenants not be disclosed in any publicly accessed document or record. If that is the case, the Government may request that such information not be posted in the building directory.

Lessor shall have emergency plans and associated documents readily available in the event of an emergency.

C. CONSTRUCTION SECURITY PLAN (SHELL)

The Lessor shall develop and implement a construction security plan. The plan should specify who is responsible for the security of the site during each phase of the project until final completion. The construction security plan shall describe in detail, how the Government’s information, assets, equipment, and personnel will be protected during the construction process. (This shall include background checks, restrictions on accessibility, and escorts for the construction personnel). The required security measures will vary with the risk presented during the project. The Lessor shall also submit a security plan for all post-occupancy construction and alterations projects in the leased Space, throughout the term of this Lease.

VII. CYBERSECURITY (SHELL *)

A. Lessors are prohibited from connecting any portion of their building and access control systems (BACS) to any federally-owned or operated IT network. BACS include systems providing fire and life safety control, physical access control, building power and energy control, electronic surveillance, and automated HVAC, elevator, or building monitoring and control services (including IP addressable devices, application servers, or network switches).

B. In the event of a cybersecurity incident related to BACS, the Lessor shall initially assess the cyber incident, identify the impacts and risks to the Building and its occupants, and follow their organization’s cyber and IT procedures and protocols related to containing and handling a cybersecurity incident. In addition, the Lessor shall immediately inform the Lease Contracting Officer’s (LCO’s) designated representative, i.e., the Lease Administration Manager (LAM), about cybersecurity incidents that impact a federal tenant’s safety, security, or proper functioning.

C. Lessors are encouraged to put into place the following cyber protection measures to safeguard facilities and occupants:

1. Engineer and install BACS to comply with the Department of Homeland Security Industrial Control Systems Computer Emergency Response Team (DHS ICS-CERT) cyber security guidance and recommendations (https://ics-cert.us-cert.gov/Recommended-Practices).

2. Refer to the National Institute of Standards and Technology Cyber Security Framework (NIST-

CSF) (https://www.nist.gov/cyberframework) and cybersecurity guidance in the DHS https://ics-cert.us-cert.gov/Recommended-Practices https://www.nist.gov/cyberframework

Commercial Facilities Sector-Specific Plan (https://www.dhs.gov/publication/nipp-ssp-commercial-facilities-2015) for best practices to manage cyber risks.

3. Encourage vendors of BACS to secure these devices and software through the following:

a. Develop and institute a proper Configuration Management Plan for the BACS devices and applications, so that the system can be supported.

b. Safeguard sensitive data and/or login credentials through the use of strong encryption on devices and applications. This means using NIST- approved encryption algorithms, secure protocols (i.e., Transport Layer Security (TLS) 1.1, TLS 1.2, TLS 1.3) and Federal Information Processing Standard (FIPS) 140-2 validated modules.

c. Disable unnecessary services in order to protect the system from unnecessary access and a potential exposure point by a malicious attacker. Examples include File Transfer Protocol- FTP (a protocol used for transferring files to a remote location) and Telnet (allowing a user to issue commands remotely). Additionally, use of protocols that transmit data in the clear (such as default ZigBee) should be avoided, in favor of protocols that are encrypted.

d. Close unnecessary open ports to secure against unprivileged access.

e. Monitor and free web applications and supporting servers of common vulnerabilities in web applications, such as those identified by the (Open Web Application Security Project (OWASP) Top 10 Project (https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project).

f. Enforce Least Privilege, where proper permissions are enforced on a device or application so that a malicious attacker cannot gain access to all data. Enforcing Least Privilege will only allow users to access data they are allowed to see. Additional information can be found at https://www.beyondtrust.com/blog/what-is-least-privilege/.

g. Protect against Insufficient User Access Auditing, where device or application does not have a mechanism to log/track activity by user. Enforce changing of factory default Username and Password to prevent unauthorized entry into the BACS system.

h. Use updated antivirus software subscription at all times. Kaspersky-branded products or services, prohibited from use by the Federal Government, are not to be utilized.

i. Conduct antivirus and spyware scans on a regular basis. Patching for workstations and server Operating System (OS), as well as vulnerability patching should follow standard industry best practices for software development life cycle (SDLC).

j. Discontinue the use of end of life (EOL) systems and use only applications/systems that are supported by the manufacturer.

k. Operating Systems must be supported by the vendor for security updates (e.g., do not use Windows Server 2003).

l. Proposed standard installation, operation, maintenance, updates, and/or patching of software shall not alter the configuration settings from the approved United States Government Configuration Baseline (USGCB) or tenant agency guidance (if applicable).

https://www.dhs.gov/publication/nipp-ssp https://www.beyondtrust.com/blog/what-is-least-privilege

m. Disallow the use of commercially-provided circuits to manage building systems and install building systems on a protected network, safeguarded by the enterprise firewalls in place.

Workstations or servers running building monitor and control systems are not connected and visible on the public internet.

n. Systems should have proper system configuration hardening and align with Center for

Internet Security (CIS) benchmarks or other industry recognized benchmarks. Additional information can be found at https://www.cisecurity.org/cis-benchmarks/.

https://www.cisecurity.org/cis-benchmarks

Security Requirements (Facility Security Level II) Fire Alarm and Fire

Suppression, and Nurse Call System

SECTION SECURITY REQUIREMENTS (FACILITY SECURITY LEVEL II) FIRE ALARM AND

FIRE SUPPRESSION, AND NURSE CALL SYSTEM

TABLE OF CONTENTS

PART 1 - GENERAL 1

PART 2 - SITE CONSIDERATIONS 3

PART

3 - ACCESS & SECURITY FOR COMMON AREAS, NON-PUBLIC, AND UTILITY AREAS

PART 4 - BUILDING ENTRANCES & EXITS (GOVERNMENT SPACES) 5

PART 5 - FUNCTIONAL AREAS 7

PART 6 - EXISTING BUILDING ENVELOPE, STRUCTURE, AND UTILITIES & BUILDING

SERVICES 8

PART 7 - SECURITY SYSTEMS 9

PART 8 - CENTRALLY MONITORED FIRE ALARM AND FIRE SUPPRESSION SYSTEM 16

PART 9 - NURSE CALL SYSTEM 17

PART 1 - GENERAL

THESE PARAGRAPHS CONTAIN ADDITIONAL SECURITY REQUIREMENTS WHICH ARE TO BE

PRICED AS PART OF EITHER SHELL OR TENANT IMPROVEMENT ALLOWANCE. WHERE

THERE IS A CONFLICT BETWEEN A SPECIFIC REQUIREMENT AND A MORE GENERAL

REQUIREMENT, THE SPECIFIC REQUIREMENT SHALL APPLY.

1.01 Definitions

A. CRITICAL AREAS - The areas that house systems that if damaged or compromised could have significant adverse consequences for the facility, operation of the facility, or mission of the agency or its occupants and visitors. These areas may also be referred to as

"limited access areas," "restricted areas," or "exclusionary zones."

Critical areas do not necessarily have to be within Government-controlled space (e.g., generators, air handlers, electrical feeds which could be located outside Government-controlled space).

B. SENSITIVE AREAS - Sensitive areas include but are not limited to controlled access corridors, sensitive documents areas, telecommunications rooms, staff work areas, and medication rooms.

Sensitive areas are primarily housed within Government-controlled space.

1.02 OPERATIONS AND ADMINISTRATION

A. LESSOR TO WORK WITH VA FOR SECURITY (SHELL)

1. The lessor shall cooperate and work with the Northern Indiana Health

Care System throughout the term of the lease. Common groups of VA

Employees from the facility that will be engaged with the security of the clinic include but are not limited to the VA Police Department particularly the Physical Security Officer and the Security Control

Center, the Clinic Nurse Manager and staff, the Environment of Care (EOC)

Committee, and the Contracting Officer Representative.

2. As necessary and if applicable to the lease the Northern Indiana Health

Care System Physical Security Officer will establish or update existing memorandums of agreement for security with the Lessor’s Security Alarm monitoring company for notifications and the Local police

B. TEMPORARY SECURITY UPGRADE DUE TO IMMEDIATE THREAT

The Government reserves the right, at its own expense and with its own personnel, to temporarily heighten security in the building under lease during heightened security conditions due to emergency situations such as terrorist attacks, natural disaster, and civil unrest.

C. ACCESS TO BUILDING INFORMATION (SHELL)

1. Building Information-including mechanical, Electrical, vertical transport, fire and life safety, security system plans and schematics, computer automation systems, and emergency operations procedures-shall be strictly controlled. Such information shall be released to authorized personnel only, approved by the Government, by the development of an access list and controlled copy numbering. The Contracting Officer may direct that the names and locations of Government tenants not be disclosed in any public accessed document or record. If that is the case, the

Government may request that such information not be posted in the building directory.

2. Lessor shall have emergency plans and associated documents readily available in the event of an emergency.

1.03 IDENTITY VERIFICATION OF PERSONNEL (SHELL)

A. The Government reserves the right to verify identities of personnel with routine access to Government space. The Lessor shall comply with the agency personal identity verification procedures below that implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24, and Federal

Information Processing Standards Publication (FIPS PUB) Number 201, as amended

B. The Lessor shall insert this paragraph in all subcontracts when the subcontractor is required to have physical access to a federally controlled facility or access to a federal information system.

C. Lessor compliance with subparagraphs 1 through 4 below will suffice to meet the Lessor’s requirements under HSPD- 12, OMB M-05-24, and

FIPS PUB Number 201.

1. The Government reserves the right to conduct background checks on

Lessor personnel and contractors with routine access to Government leased space.

2. Upon request, the Lessor shall submit completed fingerprint charts and background investigation forms for each employee of the Lessor, as well as employees of the Lessor's contractors or subcontractors, who will provide building operating services requiring routine access to the Government’s leased space for a period greater than 6 months. The Government may also require this information for the Lessor's employees, contractors, or subcontractors who will be engaged to perform alterations or emergency repairs in the Government’s space.

3. The Lessor must provide Form FD-258, Fingerprint Chart (available from the Government Printing Office at http://bookstore.gpo.gov), and Standard

Form 85P, Questionnaire for Public Trust Positions, completed by each person and returned to the contracting officer (or the contracting officer's designated representative) within 30 days from receipt of the forms. Based on the information furnished, the Government will conduct background investigations of the employees. The contracting officer will advise the Lessor in writing if an employee fails the investigation, and, effective immediately, the employee will no longer be allowed to work or be assigned to work in the Government’s space.

4. Throughout the life of the lease, the Lessor shall provide the same data for any new employees, contractors, or subcontractors who will be assigned to the Government’s space. In the event the Lessor's contractor or subcontractor is subsequently replaced; the new contractor or subcontractor is not required to submit another set of these forms for employees who were cleared through this process while employed by the former contractor or subcontractor. The Lessor shall resubmit Form FD-258 and Standard Form 85P for every employee covered by this paragraph on a 5-year basis.

1.04 PHYSICAL SECURITY DESIGN REQUIREMENTS FOR TENANT IMPROVEMENTS

The lessor’s design team shall follow the ISC Security Standards for

Leased Space, Level II.

A. VA Provided Conceptual Drawings and Schedules may show requirements for Security Door Openings, Security Door Hardware, and Electronic

Security Systems (ESS) to include Physical Access Control Systems

(PACS), Intrusion Detection System (IDS), Video Assessment and

Surveillance Systems (VASS) historically known as Closed Circuit

Television (CCTV)

B. VA Technical Information Library (TIL) http://www.cfm.va.gov/TIL/

1. PG 18-1 Master Construction Specifications Division 28 Electronic

Safety and Security http://www.cfm.va.gov/TIL/spec.asp#28

C. VA Handbook 0730/04, Appendix B, Security and Law Enforcement, Physical Security Requirements and Options. Search for the document at: http://www.va.gov/vapubs/

PART 2 - SITE CONSIDERATIONS

2.01 SIGNAGE

A. POSTING OF SIGNAGE IDENTIFYING THE SPACE AS GOVERNMENTAL (TENANT

IMPROVEMENT ALLOWANCE)

The Lessor shall post signage as required elsewhere in the lease document.

B. POSTING OF REGULATORY REQUIREMENTS (TENANT IMPROVEMENT ALLOWANCE)

The Government may post or request the Lessor to post regulatory, statutory, sensitive areas and site-specific signage.

http://www.cfm.va.gov/TIL/ http://www.cfm.va.gov/TIL/spec.asp#28 http://www.va.gov/vapubs/

2.02 LANDSCAPING

A. LANDSCAPING REQUIREMENTS (SHELL)

a. Lessor shall maintain landscaping (trees, bushes, hedges, land contour, etc.,) around the facility.

b. Landscaping shall be neatly trimmed in order to minimize the opportunity for concealment of individuals and packages/containers. Landscaping shall not obstruct the views of security guards and CCTV cameras, or interfere with lighting or IDS equipment.

B. CRIME PREVENTION THROUGH ENVIRONMENTAL DESIGN (SHELL)

The Lessor shall separate from public access, restricted areas as designated by the Government, through the application of Crime Prevention

Through Environmental Design (CPTED) principles by using trees, hedges, berms, or a combination of these or similar features, and by fences, walls, gates and other barriers, where feasible and acceptable to the

Government.

C. HAZMAT STORAGE (SHELL)

If there is HAZMAT storage on site, lessor shall locate it in a restricted area or storage container away from loading docks, entrances, and uncontrolled parking. The VA doesn’t anticipate having any hazmat items stored on site. Biohazard trash will be stored in soiled utility rooms.

D. PLACEMENT OF RECEPTACLES, CONTAINERS AND MAILBOXES (SHELL)

Letter boxes and receptacles for trash and smoking paraphernalia shall not be located within 5 feet (1.5 m) of load-bearing elements. Those within

25 feet (7.6 m) of the building shall be designed to prevent depositing of explosive charges or to contain explosions with a W0 charge weight

(defined in the Physical Security Design Standards Data Definitions)

2.03 Standoff Distances for new buildings (TENANT IMPROVEMENT ALLOWANCE)

A. No vehicle shall be parked closer than 20 feet to any side of a life-safety protected VA facility, regardless of the building height.

2.04 Perimeter Fences (TENANT IMPROVEMENT ALLOWANCE)

Not Used

2.05 Parking (SHELL)

A. Location: On newly built facilities, vehicles shall not be parked or permitted to travel closer than 20 feet to any ISC Security Standard

Level 2 VA facility. Existing facilities: Where surface parking must remain within the 20 feet standoff distance, All glazing within 20 feet (both interior and exterior) shall be laminated glass or fitted with attached anti-fragmentation film that will met a blast load standard of 4psi/28psi-msec..

B. Patient and Visitors: Parking and access for patients, visitors, and the persons transporting them to and from the VA facility shall be as convenient as possible to the main entrance, subject to the requirements of the standoff distances. Parking and facility access shall comply with accessibility requirements for persons with disabilities.

C. Parking areas shall be monitored by CCTV.

2.06 Site Lighting (SHELL)

Provide minimum maintained illumination levels for pedestrian pathways, bicycle and vehicle routes, parking structures, parking lots, wayfinding, signage, pedestrian entrances, and building services which will provide safety and security for personnel, buildings, and site.

PART 3 - ACCESS & SECURITY FOR COMMON AREAS, NON-PUBLIC, AND UTILITY AREAS

3.01 EMPLOYEE ACCESS CONTROL AT ENTRANCES (SHELL)

In multi-tenant occupancies, that have a common entrance, lobby, and corridors, all Government employees shall have access to the entrance to the building (including after-hours access).

3.02 RESTROOM ACCESS (SHELL)

The Government reserves the right to control access to restrooms located within the Government leased space.

3.03 SECURING CRITICAL UTILITY AREAS (SHELL)

A. Keyed locks, Keycards, or similar security measures shall strictly control access to mechanical, electrical closets, plumbing chases and rooms, sprinkler rooms, telecommunications rooms, and other utility areas. Controls for access to keys, keycards, and key codes shall be strictly maintained.

B. The Lessor shall develop and maintain accurate utility diagrams and labeling to include but not limited to HVAC diagrams, HVAC system labeling within mechanical areas and on individual units, electrical diagrams, electrical panel and breaker labeling, labeling at electrical and data outlets, plumbing diagrams, and labeling of plumbing valves.

C. Roofs with HVAC systems shall also be secured. Fencing or other barriers may be required to restrict access from adjacent roofs based on a Government Building Security Assessment. Roof access shall be strictly controlled through keyed locks, keycards, or similar measures. Fire and life safety egress shall be carefully reviewed when restricting roof access.

PART 4 - BUILDING ENTRANCES & EXITS (GOVERNMENT SPACES)

4.01 LIFE SAFETY CONSIDERATIONS

Means of egress shall not be obstructed by installation of security devices such as guard stations, screening equipment, or other security devices. Delayed egress and alarmed exits shall comply with applicable codes and regulations.

4.02 INTRUSION DETECTION SYSTEM (IDS) (TENANT IMPROVEMENT ALLOWANCE)

All building entrances shall be monitored by IDS

4.03 EMPLOYEE ACCESS CONTROL AT ENTRANCES (TENANT IMPROVEMENT ALLOWANCE)

The Lessor shall provide key and electronic access control for all entrances to Government Spaces under this Lease. All Government employees shall have access to the entrance to the building (including after-hours access). Entrances to Government only areas included with the lease not shared with other tenants shall be keyed to match the Northern Indiana

Health Care System BEST Grand Master Key System and be controlled by

Physical Access Control System (PACS) that utilizes only the VA Furnished

PIV Badge for authentication.

4.04 VISTOR ACCESS CONTROL TO GOVERNMENT SPACES (SHELL)

Main entrances are open to the public during business hours. After hours, visitor entrances are secured, and have a means to verify the identity of persons requesting access prior to allowing entry into the Space.

4.05 ENTRANCES (SHELL)

A. Public entrances: The primary public entrance is to the main lobby of the ISC Security Standard Level 2 protected facility. Other public entrances shall be kept to a minimum.

B. Staff entrances: Staff entrances shall be located independently of main entrance lobbies and be convenient to staff parking. Provide staff entrances with access control, visual monitoring devices, and intrusion detection system.

4.06 Structural

Building entrances shall be constructed to fail in a way that minimizes hazard to persons inside.

4.07 DOORS AND HARDWARE (TENANT IMPROVEMENT ALLOWANCE)

A. Exterior doors shall be in size, operation, and other characteristics in compliance with applicable regulatory requirements.

Where doors are lockable, they shall comply with emergency egress requirements.

B. Removable hinge pins on door exteriors must be retained with set pins or spot welded, preventing their removal.

C. Glass for entrance and egress doors shall be laminated.

D. Entrance doors shall be capable of being remotely locked and unlocked from the reception desk in the main lobby, the Northern

Indiana Health Care System security control center (SCC), and other designated position.

E. Staff entrance doors shall prevent unauthorized access and will be equipped with PACS system for access.

F. Means of egress doors that do not also function as entrances shall be provided with delayed action and alarmed emergency egress hardware.

4.08 COVERED DROP-OFF (EXISTING FACILITIES) (TENANT IMPROVEMENT ALLOWANCE)

Protect columns with anti-ram barriers such as bollards and from explosive devices by installation of architectural or structural finishes that prevent detonation within 6 inches (152 mm).

4.09 VESTIBULES (EXISTING FACILITIES) (TENANT IMPROVEMENT ALLOWANCE)

1. Screening Vestibules: The screening vestibule shall have sufficient space and be provided with power, telecommunications, and data connections for installation of future access control and screening equipment that may be used should the need arise.

2. Where space permits, provide an entrance vestibule of sufficient size to accommodate several people with mobility aids. Configure access from the drop-off to the lobby through the screening vestibule to prevent circumvention of screening process. Arrange path of travel to prevent vehicular access beyond the standoff distance to the building perimeter.

4.10 GLAZING (TENANT IMPROVEMENT ALLOWANCE)

All glazing (both interior and exterior) in the lobby area shall be laminated glass or fitted with attached anti-fragmentation film.

4.11 ACCESS WITHIN THE FACILITY (EXISTING FACILITIES) (TENANT IMPROVEMENT

ALLOWANCE)

In multi-tenant, multi-story occupancies modify existing elevator call buttons to require access control to register calls when elevators open directly into restricted areas. Alternatively, construct secure vestibules at elevator lobbies on floors with restricted access.

4.12 SECURITY DEVICES (TENANT IMPROVEMENT ALLOWANCE)

VASS cameras shall be provided to monitor activities in the vestibules and lobbies and shall be located to provide views of approaching pedestrian and vehicular traffic, IT closets, patient hallways, drop-off areas, building entrances, departing pedestrian and vehicular traffic. Provide cameras at locations with alarmed exits, loading docks, and other areas subject to pilferage. Install door status monitors at doors intended to be used only for emergency egress.

PART 5 - FUNCTIONAL AREAS

This section discusses the specific spatial functional areas, their relationships, and adjacencies based on physical security requirements.

These functional areas require enhanced protection when included in a mission-critical or life-safety protected buildings. The requirements in this section are in addition to requirements stated elsewhere in this and other documents.

5.01 IT Communications Room (TENANT IMPROVEMENT ALLOWANCE)

A. Adjacencies

The main computer room shall not be located in a high risk area and shall be located not closer than 50 feet (15 m) in any direction to main entrance lobbies, loading docks, and mailrooms, critical utilities, and in no case directly above or below such spaces.

B. Wall Construction

1. Surrounding walls and partitions shall be fire resistive construction and extend from slab to slab (or structure).

2. Exterior walls of brick and masonry construction are acceptable.

Exterior walls which are composed of wood frame and siding require an interior backing of steel security screen mesh or sheet partition.

C. Entrances shall be controlled and monitored. IDS with audible and remote alarms. Doors shall have PACS with both PIV and Pin Pad authentication. Lockset shall be mortise type with storeroom function and deadbolt. Corridor access shall be monitored by VASS. Inside the rooms is monitored by the VA.

D. Power: Provide UPS for one hour of operation.

5.02 Medication Room (TENANT IMPROVEMENT ALLOWANCE)

A. Wall Construction

1. Surrounding walls and partitions shall be fire resistive construction and extend from slab to slab (or structure).

2. Exterior walls of brick and masonry construction are acceptable.

Exterior walls which are composed of wood frame and siding require an interior backing of steel security screen mesh or sheet partition.

B. Entrances shall be controlled and monitored. IDS with audible and remote alarms. Doors shall have PACS with both PIV and Pin Pad authentication. Corridor access shall be monitored by VASS.

5.03 RECEPTION COUNTER (TENANT IMPROVEMENT ALLOWANCE)

A. In design, consider security of sensitive information and staff at reception counters.

B. Reception shall be monitored by VASS

5.04 Staff Shared Work Areas (TENANT IMPROVEMENT ALLOWANCE)

Staff shared work areas shall have access control by PACS to include from each exam room to shared work areas.

5.05 CONTROLLED ACCESS CORRIDORS (TENANT IMPROVEMENT ALLOWANCE)

Controlled access corridors shall be monitored by VASS and access controlled by PACS

Coordinate security requirements with life safety egress requirements.

PART 6 - EXISTING BUILDING ENVELOPE, STRUCTURE, AND UTILITIES & BUILDING

SERVICES

It is assumed that this project is a renovation of an existing facility.

If it is new construction reference the VA PSDM for Life Safety Protected

Facilities for more extensive requirements in the building envelope and structural system.

6.01 EXISTING NON-LOAD BEARING EXTERIOR WALLS –

Based on the above assumption no requirements for existing facilities.

6.02 EXISTING FENESTRATION (TENANT IMPROVEMENT ALLOWANCE)

A. All new exterior glazing is to use laminated glass. For insulated glazing units (IGUs) the laminated glass is required only for the inner lite.

B. For upgrades in which the façade is not replaced, a mechanically anchored or wet glazed attached 7-mil thick anti-shatter film may be used to satisfy the requirements of this section.

6.03 EXTERIOR DOORS (TENANT IMPROVEMENT ALLOWANCE)

A. All doors shall be designed using debris mitigating materials such as laminated glass and heavy gauge metal (14-gauge minimum), shall open towards the detonation, and the heavy-duty frames and anchorages shall be capable of resisting the collected blast loads. Frame rotations shall be limited to L/30.

B. Public entrance doors may be horizontal sliding doors (power operated only.

6.04 Structural (TENANT IMPROVEMENT ALLOWANCE)

Existing Facility – Column Protection: Protect columns in spaces the public can access prior to screening from explosive devices by installation of architectural or structural finishes that prevent detonation within 6 inches (152 mm).

6.05 UTILITIES & BUILDING SERVICES

A. UNINTERUPTABLE POWER SUPPLY (UPS) TO CRITICAL SYSTEMS (TENANT

IMPROVEMENT ALLOWANCE)

Lessor shall provide UPS for all alarm systems, CCTV monitoring devices, fire detection systems, entry control devices, emergency lighting, and IT

Communication Room equipment for a period of one hour. It is not anticipated that emergency power generation will be required for the clinic. If during lessor’s design code requirements dictate the need for emergency power in addition to UPS those requirements shall be incorporated into the lessor’s build out construction documents.

PART 7 - SECURITY SYSTEMS

A. Electronic Security Systems (ESS) listed below shall be integrated as required by PSDM Chapter 10 and integrate with existing Northern

Indiana Health Care System systems as described below and on the conceptual drawings. The ESS includes the Physical Access Control

System (PACS); Intrusion Detection System (IDS); Video Assessment and

Surveillance Systems (VASS) (aka CCTV); Duress, Security Phones, and

Intercom System (DSPI), commonly referred to as intercommunications system; and the Detection and Screening System (DSS).

B. The Security Control Center (SCC) for Northern Indiana Health Care

System and its CBOCs is at the Northern Indiana Health Care System located in Marion, IN. CBOC Manager’s Office, CBOC reception desks, IT communications rooms, and other locations as determined may serve roles and functions with the security of the clinic.

C. ESS Security System Maintenance Criteria: The Lessor, in consultation and coordination with a security provider, either internal or external, as determined by the Lease Contracting Officer, and the Government security representative, shall implement a preventive maintenance program for all security systems the Lessor has installed. Any component that becomes inoperable must be replaced or repaired by the Lessor within 5 business days. Components are those required to provide security (IDS, VASS/CCTV, PACS, Intercom System, etc). Replacement' may include implementing other temporary measures agreeable to the Government’s security representative in instances where the replacement or repair is not achievable within the specified time frame. Failure by the Lessor to provide sufficient replacement measures within the timeframe identified above may result in the

Government's providing guard service or other security measures, the cost of which must be reimbursed by the Lessor.

D. IMPORTANT NOTE: Northern Indiana Health Care System provided and installed network switches cannot be in place until the lease owner has the IT closet built, secured for access by only VA, and continuous climate controls are installed. This will require coordination to ensure the clinic is ready to be open and integrated with the proper security protocols.

7.02 PHYSICAL ACCESS CONTROL SYSTEM (PACS) (TENANT IMPROVEMENT ALLOWANCE)

A. The Lessor shall design, install, integrate with existing Northern

Indiana Health Care System via the network and maintain a Physical

Access Control System (PACS) as described in this section.

B. General: The PACS consists of all equipment and information required to verify, identity, and grant or deny access to individuals in accordance with HSPD-12. Equipment ranges from card readers and locks to the servers and databases required for identity verification and all components and communication in between.

C. The cards to be programmed are typically provided by the VA and are Version 8 PIV cards. The Northern Indiana Health Care

System utilizes a HID Global system to manage card readers and components for access control. Lessor shall install HID Global physical access control system and integrate with existing HID Global

Software at the Northern Indiana Health Care System Security Control

Center (SCC) via VA Network connected to VA Provided Network Switches.

The VA must be able to program card reader system on site and remotely from the Security Control Center. Landlord will provide and install all software and licenses required for this integration (HID Global, Lenel OnGuard and Microsoft Visual Studio. VA will provide laptop or desktop computer for the installation of the card reader program. The contractor will bring the software to facility on a laptop. Programs will be transferred to VA computer through a secure thumb drive provided by VA OI&T. Landlord will work with VA IT department and

Police service to install all software required on the VA System. HID

Global and Lenel OnGuard and HID Global software will be installed on

VA laptop. Lessor will provide the VA 100 additional cards that can be programmed to the system for use when employees lose their PIV badge or while waiting for new cards.

D. Credentialing and Enrollment Interface: The Northern Indiana Health

Care System has an existing enrollment station and PIV badge issuance process that this system shall work with. The existing enrollment station will allow the PIV badge holder to be programmed for facility level access permission.

• All lessor employees and contractors requiring unescorted access to the government space shall be required to enroll in the system at the Northern Indiana Health Care System.

Enrollment requires individual to go to either Marion or Fort

Wayne VA Medical Center for fingerprinting and ID check.

Individuals seeking credentialing will also require a background check. The individual will also have to return to the medical center to get photo taken and to receive issued card.

E. PACS on designated doors shall be provided, installed, integrated with existing Northern Indiana Health Care System existing card reader management system via the network, tested, certified, and maintained by the Lessor (see conceptual plan and door schedule for requirements). The PACS shall provide physical access control by regulating access through doors, surge and tamper protection, credential readers (for VA furnished PIV card) (note some locations also require PIN authentication), remote monitoring of field-installed devices by the Government via the VA network.