J2n FSL 2 CI Baseline Requirements Job Aid.pdf

Victoria M Wilpitz Text Box

FOR OFFICIAL USE ONLY

Victoria M Wilpitz

PUBLIC AVAILABILITY TO BE DETERMINED UNDER 5 USC 552

AXF

Job Aid

U. S. DEPARTMENT OF TRANSPORTATION

FEDERAL AVIATION ADMINISTRATION

Security and Hazardous Materials Safety Office of Infrastructure Protection - AXF

AXF-2023-JA-05

SUBJ: FSL-2 Critical Infrastructure Facility Baseline Requirements Job Aid

Date: October 3, 2023

FAA Baseline Physical Security Requirements for Facility Security Level (FSL)-2 Critical Infrastructure (CI) Facility

This job aid is intended to provide those involved in the early phases of new leases, new construction, and tech refresh, a high level overview of physical security requirements stipulated in FAA Order 1600.69D. This job aid does not replace FAA Order 1600.69D. FAA Order 1600.69D and technical guidance memos contain additional requirements, clarifying information, and details which must be utilized to ensure all security requirements are met for the facility.

A Facility Security Level (FSL) is the starting point for determining the specific security countermeasures that will apply to a particular FAA facility. Because the FAA employs a significant number of similar facilities that accomplish identical missions in various locations, they have been pre-assigned FSLs.

The below physical security countermeasures are the security planning starting point for existing facilities undergoing tech refresh, major structural modifications or for new construction. Evaluation of local threats may result in adjustments to the Baseline LOP to either mitigate an increased risk or, when threats are lower than initially evaluated, reduce or eliminate a countermeasure. When this occurs, the Baseline LOP is adjusted to become the Necessary LOP for that specific facility. These changes are documented as Based on Evaluation (BOE) measures. This document contains some procedural requirements that should be identified during the construction phase but it does not include administrative requirements. The SSE should refer to FAA Order 1600.69D to ensure those requirements are identified and discussed with the facility manager (FM).

Site Security Criteria Identification as a Federal Facility

• Post US Property signs (FAA owned, direct leased, or GSA-leased Facilities).

Landscaping

• Minimize areas of concealment in and around facilities.

• Establish a 20-foot clear zone outside the fence.

• Establish a 20-foot buffer zone inside the fence.

• Trim vegetation so it does not interfere with visibility or systems (e.g. VSS, security lighting).

Pedestrian Access to Site

• Install fence to channel pedestrians to authorized entrances.

Fence Requirements:

o Perimeter fencing consists of a 7-foot, 9 gauge woven aluminum coated steel or galvanized steel wire fabric with mesh openings not larger than 2 inch per side.

o A 1-foot high outward facing top guard consisting of 3 strands of galvanized barbed wire set at an outward of angle of 45 degrees for a total of 8 feet above grade.

o Construction of FAA security fences and gates will comply with Federal Supply Service, Federal Specification RR-F-191K, Fencing, Wire, and Post Metal (and Gates, Chain-Link Fence Fabric, and Accessories)(General Specification), Federal Specification Sheets RR-F-191-1E through 4E and American Society for Testing and Materials (ASTM) F567-07, Standard Practice for Installation of Chain-Link Fence.

Victoria M Wilpitz Text Box

FOR OFFICIAL USE ONLY

Victoria M Wilpitz

Vehicle Access Points

• Limit the number of vehicle access points.

• Monitor access points with VSS (procedural).

Site Lighting

• Entrances and exits.

• Parking lots and garages.

Security lighting must provide average illumination levels (based on a 4:1 average to minimum illuminant ratio) for the following areas:

Parking Area Not less than 0.8 foot candles (FC) Parking Garages Not less than 1 FC Building Entrances Not less than 5 FC General Exterior Facility Lighting Not less than 0.5 FC

Restricted Areas and Significant Areas and Assets

• Prevent unauthorized entry (e.g. FAA Standard lock, PACS).

• Secure exterior critical cables hung less than 12 feet from the ground.

• Secure exterior ladders that access critical equipment, roofs or facility access points.

Signage – Sensitive Areas

• Post restricted area signs.

Authorized Parking

• Post signage keep visitor parking furthest from the facility.

Vehicle Access to Controlled Parking

• Use vehicle gates to limit access to authorized vehicles.

Pedestrian Access to Controlled Parking Areas

• Provide barriers to restrict pedestrian access to authorized entry points.

Hazardous Materials Storage

• Store HAZMAT in a restricted area away from loading docks, entrances, and uncontrolled parking.

Receptacle and Container Placement

• Place receptacles away from building entrances or other vulnerable locations.

Structure Security Criteria Blast Resistance – Façade and Structure

• Controlled Perimeter.

Burglary Resistance of Windows

• Locked ground floor and/or readily accessible windows (within 16-feet of ground).

Walls and Non-window Openings

• Secure openings 96 square inches or greater.

Victoria M Wilpitz

FOR OFFICIAL USE ONLY

Protection of Air Intakes

• Secure accessible air intake grilles from tampering or removal.

Security of Ventilation Equipment and Controls

• Protect systems from unauthorized access.

Emergency Generator Protection

• Access controlled and limited to duty essential.

• Located within a controlled perimeter.

• Fuel tanks secured from unauthorized access.

Facility Entrance Security Criteria Regulatory Signage

• No weapons signs posted at all gates and building entry points.

• Notice of inspection signs posted at all public gates and entry points.

• VSS warning signs where VSS is in use.

• X-Ray warning signs where x-ray machines are in use.

• Restricted area signs posted at interior entrances into critical areas.

• Closed area signs posted at interior entrances to closed areas.

Employee Access Control

• Utilize PACS to control access to employee entrance doors.

o PIV card readers on exterior doors.

o PIV card readers on vehicle gates.

o PIV card readers on doors protecting critical operations areas (applies to Tier-1 facilities).

Limit Building Entry Points

• Keep the number of access doors to a minimum to support operations.

Perimeter Doors and Door Locks

• Limit number of perimeter doors used to access a facility.

• Door construction standard.

o Perimeter doors will be made of solid, close, or tight grained wood, steel or employ sheet metal/metal clad 14-gauge (.0747 inches) or thicker.

o Have tempered or American National Standards Institute rated burglary resistant glass used or an equivalent film or laminate applied (glass embedded with wire mesh may also be used).

o Door frames must be substantial and consistent with door construction.

• BHMA Grade 1 Hardware.

• Install interior mounted hinges or modify to prevent removal on exterior doors.

• Equip perimeter doors and critical operational area doors with latch guards or astragals.

• Equip all doors with FAA standard locking system.

• Install request-to-exit device for egress.

Emergency Exit Doors

• Use compliant life-safety emergency exit hardware.

• Monitor emergency exits with visual, electronic, or audible alarms (procedural).

Interior Security Criteria Security of Critical Areas

• Limit access into critical areas.

• Install FAA standard locks on critical area doors.

• Use PACS to control access to critical operations area (applies to Tier-1 facilities).

• Use PACS to control access to room doors.

• Use VSS to monitor entry into critical operations areas (applies to Tier-1facilities).

• Additional countermeasures for information systems (where identified).

Building Systems and Roof Access

• Limit access into utility, mechanical, electrical, and telecom rooms.

• Install FAA standard locks on utility, mechanical, electrical, and telecom room doors.

• Access ladders secured from unintended use.

Publicly Accessible Retail and Mixed-use Space

• Accommodate through such means as separating entryways.

Security Systems Criteria VSS Coverage

• Alarm Assessment o Exterior alarmed perimeter doors.

o Alarmed windows.

o Interior critical operations areas (applies to Tier-1 facilities).

• Access Screening o Entry Control Video – Main visitor doors.

o Gate Control Video.

o Peephole.

VSS Monitoring and Recording

• Record on digital medium.

VSS Surveillance Advisory

• Regulatory signage – where VSS is in use.

Intrusion Detection System (IDS) Coverage

• Perimeter doors.

• Operable ground floor windows.

• Open storage secure areas (where installed).

Intrusion Detection System (IDS) Monitoring

• Local annunciations.

FOR OFFICIAL USE ONLY

Victoria M Wilpitz