Attachment_8_Div_28_Security_Requirement_Excerpt.docx

Attachment 8

HC102817R0078

Div 28 Security Requirement Excerpt from DISA CSI 360-95-3 Facilities Engineering Standards

28 01 00 OPERATION AND MAINTENANCE OF ELECTRONIC SAFETY AND SECURITY

Electronic security systems (see sections 28 10 00 and 28 20 00) shall be operated, controlled, and monitored locally to the protected site only. Datacenter local security networks shall not be remotely operated & monitored, controlled, or otherwise accessed by commercial sources (for example, remote desktop access of a security system from a security system service provider’s place of business for alarm monitoring, database manipulation, troubleshooting, or similar), except where the datacenter is not located on an installation that has the capability to provide security support services.

Monitoring of specific alarm contacts (main door breach, duress alarm, et cetera) by host installation security forces are acceptable. After-hours and duress alarm remote monitoring of intrusion detection for strictly administrative facilities by the Federal Protective Service (FPS) is acceptable.

Operation and maintenance of security systems protecting Sensitive Compartmented Information Facilities (SCIFs) shall comply with the requirements of the current version of the IC Tech Spec for ICD/ICS 705. This shall include requirements to comply with management in accordance with UL2050.

IC Tech Spec ICD-ICS 705

Operations of all electronic security-related systems are restricted by the systems’ security accreditation(s) and security technical implementation guidance (STIGs) as described in section 01 35 53. The security system service provider and site security management office shall obtain and manage the accreditation for the security system(s) in use at each site.

28 01 10 Operation and Maintenance of Electronic Access Control and Intrusion Detection At each datacenter location, there shall be one (1) single security system service provider (subcontractors and service partners to the primary service provider are acceptable). In the case of internal physical security divisions within the facility (e.g., SCIFs or other areas potentially under the control of outside entities), the separated internal security systems for these areas shall be installed and maintained by the single site security systems provider. These systems shall be separated physically and logically from the main building system(s) as required by all applicable regulations, but shall be compatible with other building systems in the event the area(s) revert to a lower security level or additional surrounding areas are added to the higher security level, in order to alleviate rework and reduce installation and operation costs to the Government.

Attachment 4, continued

Lifecycle replacement of access control and intrusion detection equipment shall upgrade individual components and systems according to the critical power distribution schema discussed in section 28 01 30.

The security system service provider shall provide semi-annual preventative maintenance services for the security system to include assembly/disassembly of door controls and equipment, maintenance and routine inspection of access control and intrusion detection hardware, and review of site access control software setup and database(s) to ensure proper and efficient operation of all system components. Firmware releases to all system hardware released by the manufacturer shall be installed within a month of firmware release date (not necessarily coinciding with other scheduled maintenance services). Databases shall be backed up and stored in a secure offsite location at least quarterly, and shall be cleaned and optimized semi-annually by the security system service provider.

Preventative maintenance shall include a “Premium Software Support” agreement with the ACS software manufacturer. The security system service provider must be an authorized representative of the ACS software and must be fully trained and certified to operate and maintain that system. This “Premium Software Support” agreement shall include software patches and installation of such within one month of release (not necessarily coinciding with other scheduled maintenance services).

Emergency maintenance services shall include all troubleshooting and repair using Government-owned inventory as well as all items covered in preventative maintenance services. Emergency services shall be available to the Government 24 hours per day, 7 days per week, with a 2-hour response time by Contractor personnel (report to site or as directed by site representative).

28 01 10.51 Maintenance and Administration of Electronic Access Control and Intrusion Detection Administration of intrusion detection shall not be conducted by offsite commercial providers at datacenter facilities or facilities with SCIFs. Administration of intrusion detection for strictly administrative facilities by the Federal Protective Service (FPS) is acceptable.

Monitoring of intrusion and duress alarms from other Governmental security offices (for example, host installation security forces) for purposes of alarm response is acceptable.

Any other administration of security systems by a third party is specifically disallowed.

28 01 10.71 Revisions and Upgrades of Electronic Access Control and Intrusion Detection All modifications to security system IT equipment (including but not limited to system firmware updates, operating system patches, and upgrades to security system component software packages) must be coordinated through an approved information

Attachment 4, continued assurance process described in the system security accreditation (see section 01 35 53).

28 01 20 Operation and Maintenance of Electronic Surveillance All guidelines, standards, and directives noted in 28 01 10 apply to electronic surveillance systems. As described in section 28 10 00 these systems are to be fully integrated with the access control and intrusion detection systems.

Lifecycle replacement of CCTV equipment shall upgrade individual components and systems according to the critical power distribution schema discussed in section 28 01 30.

The security system service provider shall provide semi-annual preventative maintenance services for the CCTV system to include setup and organization of hardware and cabling, cleaning of all camera equipment, checking of all multiplexer and DVR ports and cables, checking and testing of all batteries, and alignment/tweaking of cameras for proper aperture, aim, and resolution. Preventative maintenance shall include thorough cleaning, adjustments, services, and recommendations for support of interior and exterior camera equipment.

28 01 30 Critical Power Distribution for Electronic Security Systems DISA security requires an extremely high level of availability of equipment and systems, similar to that provided for raised floor IT equipment. Security equipment shall be powered by a centralized, redundant, UPS-backed, dedicated power distribution system. Where possible, power shall be installed or retrofitted to a single, secure power distribution panel to ensure that all equipment is continuously available during contingency events. Stand-alone batteries shall not be used to power or to provide emergency power for security system equipment or devices in facilities with facility-wide UPS capabilities.

Existing equipment and power distribution for that specific equipment is intended to be used until failure using the current communications and power technologies in place (generally coaxial and 24VDC). A complete list of individual systems and components that are not powered redundantly or from technical power circuits shall be created and maintained by the site security service provider for prioritization of power distribution upgrades planned by ES521.

All new security devices shall be network systems communicating on CAT6 copper and powered by PoE (Power Over Ethernet). This will reduce the cost of future system installations by eliminating installation of UPS circuits to each device location. An example of the desired dedicated power system for security systems is shown.

Traditional devices will utilize standard, 120V power on an existing dedicated 100A panel supported by two UPS busses and a static switch. New small devices such as motion sensors and cameras, where available, will be run using PoE. Using a PoE

Attachment 4, continued infrastructure enables centralized power management capabilities for these mission critical network devices.

A PoE switch system shall be collocated with security system centralized server equipment. Each PoE switch shall have a minimum of 24 ports for system expansion. The PoE system shall be expandable for addition of future equipment or replacement of non-IP system components with PoE equipment in the future.

The dedicated technical power scheme shown exceeds the requirements of DoD 5200.1 Volume 3, 2.d.(7).(a) for emergency power in facilities with a facility-wide UPS. In other facilities, meet the guidance of that reference (8 hours of battery and/or generator power, with automatic charging circuits for any batteries).

28 10 00 ELECTRONIC ACCESS CONTROL AND INTRUSION DETECTION

DISA sites are access-controlled and monitored to provide physical operational and mission security for customer programs and equipment. Changes in operational requirements, on-going and changing security concerns and regulations, DISA transformation initiatives, and aging systems all require that DISA continue to invest in maintaining modern, operational, secure systems at its facilities.

Legacy security system equipment has been based on independent, stand-alone systems. Future and replacement systems shall take advantage of the maturation of security system technologies and provide a single, multi-purpose, integrated security system at each site. These systems shall be able to be electronically connected to other ‘local/area/regional’ systems such as the host installation security police, for remote monitoring and armed response. Integrated security systems provide multi-purpose solutions that accentuate employee safety, ensure accountability, allow personnel to be located and accounted for under emergency situations, as well as providing superior security solutions needed to protect the assets at DISA sites.

Integrated security systems are provided and maintained by Facilities Engineering (ES521) to provide multi-purpose solutions at DISA sites. Local site security teams are the primary users and benefactors of these systems, but their other alternative uses shall not be constrained. For example, provision of an “evacuation” emergency code that prints a roster of all employees currently located in the facility for use in accountability at a muster point, post-evacuation, provides a solid benefit to the organization. ES521 may require security system service providers to access data, build tools, and otherwise modify the programming of the multi-purpose, integrated security systems through centralized maintenance and support contracts.

Under no circumstance shall the security system be tied to the BAS, CMMS, or other facility management control system.

The three systems that shall be integrated in future security systems are the Access Control System (ACS), Intrusion Detection System (IDS), and Closed Circuit Television (CCTV) system. All portions of section 28 20 00 (electronic surveillance) shall meet guidance in this section.

Attachment 4, continued

Specific security-related references apply to this section:

• DoD 5200.1-R, Information Security Program

• DoD 5200.8-R, Physical Security Program

• UFC 4-022-01 Security Engineering: Entry Control Facilities / Access Control Points

• UFC 4-010-01 DoD Minimum Antiterrorism Standards for Buildings

• FIPS 201-1 Personal Identity Verification (PIV) of Federal Employees and Contractors

• IC Tech Spec for ICD/ICS 705, Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities

Security system components shall be powered on generator-supported circuits. Redundant power for components (including but not limited to the Card Access Controllers (CACs) and controlled access points (door strikes, PIRs, card/biometric readers), CCTV controllers, cameras, recording devices, automated key repositories and server/terminal computer equipment) is required per the schema discussed in section 28 01 30.

All security system conductors (power and communications, to include fiber optics, coaxial, CAT 5/6, 24v, and 120v) shall be protected in continuous conduit runs. Installation of power and communications conductors to support security system requirements shall be conducted by the security system service provider.

28 13 00 ACCESS CONTROL

The ACS (Access Control System) is the core application in the integrated security system. Its database driven design and function allow cross referencing of other system inputs to be conducted by an operator of this single system.

ACS systems and components used to secure SCIFs shall meet all requirements of the current version of the IC Tech Spec for ICD/ICS 705.

The ACS shall allow both global and local anti-passback features to be turned on and off by a system administrator. Global anti-passback shall require an ACS event to query the central ACS headend and database to permit access. Local anti-passback shall require an ACS event to query a cached version local to the ACS device or its controller, without querying the central system. Local anti-passback shall be able to be enacted on a device-by-device basis.

ACS delays in granting access to a user (read card, query system, deactivate locking devices) shall not exceed 0.5 seconds in any anti-passback configuration.

28 13 13 Access Control Global Applications Security software systems are to be local to the protected site only. There are no centralized or enterprise-wide connected security software systems. Individual site security management remains delegated to the individual site security managers.

28 13 19 Access Control Systems Infrastructure

Attachment 4, continued

Integrated security systems shall operate on a dedicated, private data (IP) network that connects select workstations, and thin or thick client terminals to the head-end system(s) for full access to ACS, IDS, and CCTV system components.

Security network information must not be passed onto the DISA or other LAN (security systems communicate only on the private network), to include passing through LAN network equipment used for other systems. Depending on IT security solutions available, this may limit or prohibit the use of computer workstations as client terminals for the security system.

The ACS server(s) shall be physically located in the datacenter with other facility security server hardware. The rack for the security system shall be locked at all times. Access to the security system shall be primarily conducted through dedicated client terminals on the private IP security network, located in the security office (and other locations determined by the site security management team).

Where ACS server(s) do not have redundant power supplies, ATS equipment shall be built into the security system rack to provide redundant power to the equipment.

28 13 19.10 Access Control Systems Head-End Equipment A fully-redundant head-end system (minimum of two physical systems to keep the security systems operational in case of hardware failure) to monitor and control the integrated security system is required. A system configured with a single control computer running the network represents a single point of failure (SPOF) that yields an unacceptable level of risk to the security system. All future systems shall be configured with physically separated primary and secondary control computers, with mirrored databases. Either system should be able to be removed from the network without loss of control of the access control system. The use of a single RAIDed head-end server may be considered fully redundant in certain circumstances.

28 13 19.20 Access Control Systems Operations Terminal Equipment Selected operations terminals (whether thick or thin client, or accessed over the dedicated private IP network on DISA computer workstations) shall have the ability to operate and maintain the entire integrated security system.

The primary operations terminal shall consist of (at a minimum) the workstation, a monitor, a badge printer/encoder, a signature capture pad, a mag card reader, and a proximity card reader with keypad. This operations terminal shall be the primary location to manage the integrated security system, to edit and operate the ACS software, and to create employee badges. The station shall have full capabilities to troubleshoot individual proximity cards.

A backup/remote operations terminal workstation shall consist of a workstation and monitor only. This system shall be fully capable of operating and troubleshooting the security system. The system shall be mirrored such that the Attachment 4, continued loss of the primary terminal will not prevent operation of the security system or cause loss of the security system database(s).

28 13 19.30 Access Control Systems Imaging & Badging Equipment The security system shall have the capability to capture, process, and apply images to personalized, site-specific security badges for use as identification and for access control. Each system shall have a 5 megapixel (minimum) camera and tripod for capturing cardholder images. The camera shall be provided with a simple imaging software tool (either from the camera manufacturer or outside vendor) to crop and correct color on captured images (Photoshop Elements 3 or similar). Imaging software shall be installed onto the primary operations terminal.

Badge printing equipment shall support all FIPS 201-1 [FIPS 201-2, Aug 2013] requirements and provide the ability to encode proximity cards, print in full CYMK color, and install a protective overcoating to printed cards.

28 13 26 Access Control Remote Devices Access control card readers must meet the requirements of FIPS 201-1 [FIPS 201-2, Aug 2013].

The legacy access control devices in use in DISA datacenters are generally Hirsch CR22L HID proximity readers and Hirsch ScrambleProx readers, or similar (not FIPS 201-1 compliant) [FIPS 201-2, Aug 2013] . Replacement systems must be capable of reading PIV application data for authentication.

In the event of complete power loss to the facility, protected doors shall fail to ‘not secure.’ They may be secured by physical key locks to prevent a loss of security integrity.

28 16 00 INTRUSION DETECTION

The IDS (Intrusion Detection System) shall be physically and logically integrated into the ACS.

IDS systems and components used to secure SCIFs shall meet all requirements of the current version of the IC Tech Spec for ICD/ICS 705.

28 16 13 Intrusion Detection Control, GUI, and Logic Systems Intrusion detection GUIs shall report and identify the physical location of all alarms in graphical (map) format.

28 16 16 Intrusion Detection Systems Infrastructure IDS systems shall be physically and logically integrated into the ACS.

28 20 00 ELECTRONIC SURVEILLANCE

Electronic surveillance at DISA facilities shall be integrated with electronic access control and intrusion detection as detailed in section 28 10 00 above. All designs, implementations, expansions, and retrofits of existing systems shall take the integrated security system concept Attachment 4, continued into account. All electronic surveillance systems shall be specifically designed and installed to integrate into future security systems as described in section 28 10 00.

28 23 00 Video Surveillance Video surveillance systems at DISA facilities are referred to as CCTV (closed circuit television) systems. Site security management has wide latitude in deciding how and where to place surveillance devices to manage their facilities. Extensive and redundant coverage, along with protection for the camera systems, is strongly encouraged.

28 23 13 Video Surveillance Control and Management Systems CCTV systems shall be physically and logically integrated into the ACS.

All terminals connected to the integrated security network shall be able to view video from any camera. The remote IP viewing solution provided may be either server-based or run on individual terminals. The solution must be capable of switching between cameras, viewing multiple camera inputs simultaneously, viewing live images, and viewing saved images. The solution must provide at least 10fps playback in both live and recorded images to remote terminals. The solution must provide for PTZ control at the primary and backup operations terminals and at all remote terminals.

28 23 19 Digital Video Recorders and Analog Recording Devices CCTV systems shall be sized for continuous recording for no less than thirty (30) days at 10fps, 640x480 resolution, using MPEG-4 encoding before being recorded over. All recording devices shall be digital video recorders (DVRs) able to send data over the security network. The DVRs and other network-attached equipment must be STIG compliant IAW section 01 35 53.

Video servers and multiplexers shall be physically located in the datacenter with other facility security server hardware. The rack for the security system shall be locked at all times. Access to the security system shall be primarily conducted through dedicated client terminals on the private IP security network, located in the security office (and other locations determined by the site security management team).

Where DVRs do not have redundant power supplies, ATS equipment shall be built into the security system rack to provide redundant power to the equipment.

The sizing and number of DVRs shall be consistent with the number of cameras at the facility. DVR systems shall be fully scalable through the addition of modules in the event of additional camera recording requirements.

28 23 23 Video Surveillance Systems Infrastructure Future CCTV systems will operate over the dedicated IP security network described in section 28 13 19.

Attachment 4, continued

The majority of legacy CCTV equipment is operated over coax cable with servers, multiplexers, VCRs, and DVRs physically located in a central security office. This infrastructure is significantly less efficient, redundant, and secure than the future system model required by these standards.

Future infrastructure shall be run from a central server location in the datacenter with thin or thick client terminals providing access to the security system components, with data and power transmitted over the same CAT6 copper between remote devices and servers, and over fiber between terminals and servers.

28 23 26 Video Surveillance Remote Positioning Equipment Joystick-style remote control devices shall be installed at all client terminals as well as at the video server for control over PTZ cameras at the facility. Keyboard interfaces for this equipment are not acceptable.

28 23 29 Video Surveillance Remote Devices and Sensors Both fixed and point-tilt-zoom (PTZ) camera systems shall be used. Definition of which systems to use in which locations is the responsibility of the site security management team. Existing equipment is intended to be used until failure using the current communications technologies in place (generally coaxial). All new CCTV camera systems will be network systems communicating on CAT6 copper and powered by PoE (Power Over Ethernet) (see section 28 01 30).

All cameras shall be color, and must be infrared (IR)/low-light compatible. All external cameras shall have sealed, environmental enclosures with automatic heaters and sun shrouds. Internal cameras shall be installed in sealed dome enclosures to resist tampering.

Motion- or alarm-based recording, conducted frequently in the past because of analog manual tape recording operations, is not authorized for these systems. All cameras shall record continuously as discussed in section 28 23 19 above.

(END)