SOW - Security.docx

Statement of Work

Background

USDA, ARS, Geneva is looking into establishing a facility to do research on hemp. In order to do this, we need to upgrade our location security to meet the 1004.13 security requirements as laid out by the New York Medical Marijuana Program Regulations.

Scope of Work

The contractor shall sperate there quote in the following areas.

1. Security Cameras and installation

1. Door Alarm/Entry/Motion sensors and installation

1. Duress/Panic/Holdup alarm and installation

Detailed Technical Requirements

§ 1004.13 Security requirements for manufacturing and dispensing facilities.

(a) All facilities operated by a registered organization, including any manufacturing facility and dispensing facility, shall have a security system to prevent and detect diversion, theft or loss of marihuana and/or medical marihuana products, utilizing commercial grade equipment, which shall, at a minimum, include:

(1) a perimeter alarm;

Tamper switches on all IT cabinets that are linked in any way to the security system.

All wiring is installed with special resistors to alert the system when a brake in the wire has occurred.

1. Door alarm sensors added to the greenhouse 3 doors.

?. USP Best Price Magnetic Contact, 3/8" Short Press Fit, 3/4" Gap

0. West door needs 1

0. East door needs 2

1. Bosch keypad added to greenhouse 3

1. D1255 placed by East door

1. Programmed with only East and West door to Greenhouse 3 and motion sensors.

1. Keypad/card reader X2 ?. HID multiCLASS SE RPK40 - RF proximity reader / SMART card reader - SIA 26

0. East door

0. West door

1. Door unlock mechanism x2 (unsure on type)

0. East door

0. West door

(2) motion detectors;

1. Minimum of 2 added to greenhouse 3

0. How we reduce false alarms due to plant movement and movement outside of greenhouse 3

(3) video cameras in all areas that may contain marihuana and at all points of entry and exit, which shall be appropriate for the normal lighting conditions of the area under surveillance. The manufacturing facility or dispensing facility shall direct cameras at all approved safes, approved vaults, dispensing areas, marihuana sales areas and any other area where marihuana is being produced, harvested, manufactured, stored, handled, or dispensed. At entry and exit points, the manufacturing facility or dispensing facility shall angle cameras so as to allow for the capture of clear and certain identification of any person entering or exiting the facility;

1. Building 4974A

0. 2 in the greenhouse corridor.

0. First North facing

0. Second South facing

0. 3, 360 cameras in greenhouse 3

0. Outside. 1, 360 camera on the southwest corner

0. Outside

1. Building 4939

1. 3, 360 cameras

0. First in Nancy’s room

0. Second in the cool room

0. Third in the freezer room (-10F)

1. Outside Between 4974A and 4939

2. A high-resolution camera on the southwest corner of Paul’s headhouse building 4974A facing west looking at 4939

2. A high-resolution camera on southeast corner of building 4939 facing east looking at Paul’s headhouse.

2. One 360 camera on the outside southeast corner of Joanne’s office.

Currently have 12 cameras that are comprised of TVP-3101 and TVD-3105 that go to truVision NVR 21. to avoid annual fees. These need to be able to be incorporated with the new camera system.

(4) twenty-four hour recordings from all video cameras, which the manufacturing facility or dispensing facility shall make available for immediate viewing by the department or the department’s authorized representative upon request and shall be retained for at least 90 days.

The registered organization shall provide the department with an unaltered copy of such recording upon request. If a registered organization is aware of a pending criminal, civil or administrative investigation or legal proceeding for which a recording may contain relevant information, the registered organization shall retain an unaltered copy of the recording until the investigation or proceeding is closed or the entity conducting the investigation or proceeding notifies the registered organization that it is not necessary to retain the recording;

Upgrade DVR that can acclimate the current camera infrastructure and future upgrades. Along with the new camera upgrades, there will be a new building added 45,000 sqft to the area that is scheduled for installation in the next 5 years. Additional network switches may be needed.

(5) a duress alarm, which for purposes of this section means a silent security alarm system signal generated by the entry of a designated code into an arming station in order to signal that the alarm user is being forced to turn off the system;

A duress alarm will be programmed into the existing keypads and Bosch panel to notify that the alarm user is being forced to turn off the alarm system.

(6) a panic alarm, which for purposes of this section, means an audible security alarm system signal generated by the manual activation of a device intended to signal a life threatening or emergency situation requiring a law enforcement response;

Four (4) duress push buttons added alongside fire alarms.

(7) a holdup alarm, which for purposes of this section, means a silent alarm signal generated by the manual activation of a device intended to signal a robbery in progress;

Four duress buttons throughout your facility. The wires will be connected to the Lenel access control board and will communicate to Milestones - Rule Event Engine which we can program “if duress button is pressed, then email police and other people.” For the logic this is the silent alarm.

Since the duress buttons are integrated with the access control then you could lock down the doors if you wanted to as well, but yes silent alert is no problem.

(8) an automatic voice dialer, which for purposes of this section, means any electrical, electronic, mechanical, or other device capable of being programmed to send a prerecorded voice message, when activated, over a telephone line, radio or other communication system, to a law enforcement, public safety or emergency services agency requesting dispatch;

It will be provided by the Bosch system, alarm company, and programmed accordingly by the contractor.

(9) a failure notification system that provides an audible, text or visual notification of any failure in the surveillance system. The failure notification system shall provide an alert to the manufacturing facility or dispensing facility within five minutes of the failure, either by telephone, email, or text message;

It will be provided by the Bosch system, alarm company, and programmed accordingly by the contractor.

(10) the ability to immediately produce a clear color still photo that is a minimum of 9600 dpi from any camera image (live or recorded);

ARS, Geneva, will provide a printer capable of producing this image.

(11) a date and time stamp embedded on all recordings. The date and time shall be synchronized and set correctly and shall not significantly obscure the picture.

Programmed accordingly by the contactor.

(12) the ability to remain operational during a power outage.

Backup generator connections and battery backup for security system, alarm system, and lighting will be installed by ARS, Geneva

(b) A registered organization shall ensure that any manufacturing facility and dispensing facility maintains all security system equipment and recordings in a secure location so as to prevent theft, loss, destruction or alterations.

1. Security cabinets have tamper switches.

1. DVR, Security camera IP Switch in network shelter.

(c) In addition to the requirements listed in subdivision (a) of this section, each manufacturing facility and dispensing facility shall have a back-up alarm system approved by the department that shall detect unauthorized entry during times when no employees are present at the facility and that shall be provided by a company supplying commercial grade equipment, which shall not be the same company supplying the primary security system.

The contractor will program the camera system Milestone to act as a backup for the Lenel security

(d) A registered organization shall limit access to any surveillance areas solely to persons that are essential to surveillance operations, law enforcement agencies, security system service employees, the department or the department’s authorized representative, and others when approved by the department. A registered organization shall make available to the department or the department’s authorized representative, upon request, a current list of authorized employees and service employees who have access to any surveillance room. A manufacturing facility and dispensing facility shall keep all on-site surveillance rooms locked and shall not use such rooms for any other function.

Only Security related equipment is allowed to be in the security network shelter, and contractor shall provide this shelter.

(e) A registered organization shall keep illuminated the outside perimeter of any manufacturing facility and dispensing facility that is operated under the registered organization’s license.

Additional outside illimitation lights will need to be added around to 4974A and will be provided by ARS, Geneva.

(f) All video recordings shall allow for the exporting of still images in an industry standard image format (including .jpeg, .bmp, and .gif). Exported video shall have the ability to be archived in a proprietary format that ensures authentication of the video and guarantees that no alteration of the recorded image has taken place. Exported video shall also have the ability to be saved in an industry standard file format that can be played on a standard computer operating system. A registered organization shall erase all recordings prior to disposal or sale of the facility.

It will be a function of the supplied DVR.

(g) A registered organization shall keep all security equipment in full operating order and shall test such equipment no less than monthly at each manufacturing facility and dispensing facility that is operated under the registered organization’s registration. Records of security tests must be maintained for five years and made available to the department upon request.

Monthly security equipment checks will be done by ARS, Geneva personnel.

(h) The manufacturing facility of the registered organization must be securely locked and protected from unauthorized entry at all times.

New Locks to building 4974A Greenhouse need to be installed with limit key distribution access.

(i) All marihuana that is not part of a finished product must be stored in a secure area or location within the registered organization accessible only to the minimum number of employees essential for efficient operation.

Not Applicable

(j) All medical marihuana products, approved or ready for testing, must be stored in a department approved safe or vault in such a manner as to prevent diversion, theft or loss.

Not Applicable

(k) All approved safes, vaults or any other approved equipment or areas used for the manufacturing or storage of marihuana and approved medical marihuana products must be securely locked or protected from entry, except for the actual time required to remove or replace marihuana or approved medical marihuana products.

Not Applicable

(l) Keys shall not be left in the locks or stored or placed in a location accessible to individuals who are not authorized access to marihuana or manufactured medical marihuana products.

Better

(m) Security measures, such as combination numbers, passwords or biometric security systems, shall not be accessible to individuals other than those specifically authorized to access marihuana or manufactured medical marihuana products.

Restricted access enforced by the Lenel access control and programmed by ARS, Geneva.

(n) Prior to transporting any approved medical marihuana product, a registered organization shall complete a shipping manifest using a form determined by the department.

ARS, Geneva, PGRU will create a shipping manifest form.

(1) A copy of the shipping manifest must be transmitted to the dispensing facility that will receive the products and to the department at least two business days prior to transport.

ARS, Geneva, PGRU will create a shipping manifest form.

(2) The registered organization shall maintain all shipping manifests and make them available to the department for inspection upon request, for a period of 5 years.

ARS, Geneva, PGRU will create a shipping manifest form.

(o) A registered organization shall only transport approved medical marihuana products from a manufacturing facility to dispensing facilities.

ARS, Geneva, PGRU will create a shipping manifest form.

(1) the approved medical marihuana products must be transported in a locked, safe and secure storage compartment that is part of the vehicle transporting the marihuana; and

Not Applicable

(2) in a storage compartment that is not visible from outside the vehicle.

Not Applicable

(p) An employee of a registered organization, when transporting approved medical marihuana products, shall travel directly from the registered organization’s manufacturing facility to the dispensing facility and shall not make any unnecessary stops in between.

Not Applicable

(q) A registered organization shall ensure that all approved medical marihuana product delivery times are randomized.

Not Applicable

(r) A registered organization shall staff all transport vehicles with a minimum of two employees.

At least one transport team member shall remain with the vehicle at all times that the vehicle contains approved medical marihuana products.

Not Applicable

(s) A transport team member shall have access to a secure form of communication with employees at the registered organization’s manufacturing facility at all times that the vehicle contains approved medical marihuana products.

Not Applicable

(t) A transport team member shall possess a copy of the shipping manifest at all times when transporting or delivering approved medical marihuana products and shall produce it to the commissioner, the commissioner’s authorized representative or law enforcement official upon request.

ARS, Geneva, PGRU will create a shipping manifest form.

DELIVERY LOCATIONS:

USDA, ARS, Plant Genetic Resources Unit (PGRU) & Grape Genetics Research Unit (GGRU) 630 W. North Street Building 4974A Collier Drive Geneva, NY 14456-0462