B08 Attachment 0003 SPS_FINAL_v3.pdf

CUI

Product Manager Force Protection Services (PM FPS) 5900 Putnam Road Fort Belvoir, VA 22060-5420

DISTRIBUTION STATEMENT C: Distribution authorized to US government agencies and their contractors administrative and operational use 02 MAR 09. Other requests for this document shall be referred to: Joint Product Manager, Force Protection Systems product office, ATTN: SFAE-CBD-GN-F, Ft. Belvoir, VA 22060-5420.

INTEGRATED COMMERCIAL

INTRUSION DETECTION

SYSTEM-VI (ICIDS-VI)

SYSTEM

PERFORMANCE

SPECIFICATION

08 Dec 2021

Version 1

Intentionally Left Blank

PREPARED BY

Richard H. Goehring Date Assistant Product Manager/COR Product Manager, Force Protection Systems Integrated Commercial Intrusion Detection System

CONCURRENCE

Curtis Brooker Date

LTC

Product Manager, Force Protection Systems

Table of Contents

SCOPE

Scope

APPLICABLE DOCUMENTS

General

Order of Precedence

DEFINITIONS

GENERAL REQUIREMENTS

General

Systems of Systems

Central Monitoring Station (CMS) System

Local Control Station (LCS) System

Integrated Functional Requirements

Security Command Center System

Intrusion Detection System (IDS)

Physical Access Control System (PACS)

Close Circuit Television (CCTV) System

Communication System

Back-up Power System

Growth Capability

Hazardous Locations

Figure 1. ICIDS-VI Functional Architecture Central/Regional Monitoring Station

Figure 2. ICIDS-VI Functional Architecture Local Control Station (LCS) at Installation

System Configuration

System Installation

Performance Requirements (UFGS 28 10 05 para 2.2)

Reliability

Availability

Operational Availability

Maintainability

Fail Safe Capability

Preventive Maintenance

Line Supervision

Power Loss Detection

Controls and Designation

Interchangeability

SUBSYSTEM REQUIREMENTS

Performance Characteristics

Security Command Center (SCC) System

ICIDS Software (UFGS 28 10 05 para 2.6.1)

Alarm Call Up

System Timing

Programming

ICIDS Monitor Display Software

Graphical Map Software

Printers

Control and Display Integration

Enrollment Center Equipment and Software

Enrollment Center Equipment

Enrollment Center Software

Data Storage

Application Interface and Encryption

Intrusion Detection System (IDS) (UFGS 28 10 05 para 2.3)

IDS Components

Detection Sensitivity

Detection Alarm and Reporting Capacity

Probability of Detection

False Alarm Rate

Nuisance Alarm Rate

Premise Control Unit (PCU) (UFGS 28 10 05 para 2.3.6)

Overcurrent Protection Indication

Manual and Self-Test

Backup Battery Capacity Calculations

Backup Battery Monitoring and Detection

Detection Sensors

High Security Switch (HSS)

Passive Infra-Red Sensors (Interior and Exterior)

Microwave Sensors

Dual Technology Sensors

Fence Mounted Sensors

Duress Alarms

Physical Access Control System (PACS) (UFGS 28 10 05 para 2.4)

Functional Requirements

PACS Badging Requirements (UFGS 28 10 05 para 2.4.1)

PACS Programming

Error and Throughput Rates

Access Control Processing. .............................. Error! Bookmark not defined.

Access Control Unit (ACU) (UFGS 28 10 05 para 2.4.5)

Access Control Devices (UFGS 28 10 05 para 2.4.6)

Access Control Keypads

Access Control Cards

Personal Identity Verification Equipment

Portal Control Devices

Closed-Circuit Television (CCTV) System (UFGS 28 10 05 para 2.5)

Cameras

Video Analytics

Color Video Monitors

Ancillary Equipment

CCTV Enclosure

Camera Mounting Structures

Communication System (UFGS 28 10 01 para 2.7)

Link Supervision

Hardwire

Radio Frequency Link

Data Encryption

Network Switch

Video and ICIDS Transmission

Wire and Cable

Digital Data Interconnection Wiring

Above Ground and Direct Sensor Wiring

Local Area Network (LAN) Cabling

Cable Construction

Back-Up Power System

Uninterruptible Power Supply

Batteries

Surge Suppression Devices

Component Enclosures

Interior and Exterior Sensors

Interior Enclosures

Exterior Enclosures

Metal Thickness

Doors and Covers

Ventilation

Labels

Test Points

Equipment Rack

CYBERSECURITY

APPENDIX A – REFERENCES

APPENDIX B – DEFINITIONS

SCOPE

Scope. This System Performance Specification (SPS) provides requirements for Integrated Commercial Intrusion Detection System (ICIDS)-VI. It establishes performance, interface and test requirements for ICIDS-VI system and subsystems. The SPS lists general requirements and performance specifications contained in the Unified Facilities Guide Specifications (UFGS) Section 28 10 05 and National Fire Protection Association (NFPA) 731, Standard for the Installation of Premises Security Systems. When requirements for sub-systems and components not included in this document, refer to the current version of UFGS Section 28 10 05. Detailed interface, system specific configuration requirements will be published in the Configuration Management Plan. Detailed testing requirements will be published in the Test Plan.

APPLICABLE DOCUMENTS

General. Documents are shown in Appendix A. If a document is referenced without indicating any specific paragraphs as applicable, entire document applies.

Order of Precedence. Unless otherwise noted herein or in the contract, in the event of a conflict between the text of this document and the references cited herein, the text of this document takes precedence. Nothing in this document, however, supersedes applicable laws and regulations unless a specific exemption has been obtained.

DEFINITIONS See Appendix B

GENERAL REQUIREMENTS

General. ICIDS-VI shall provide the capability to detect intrusion, control access to restricted areas, detect and deny unauthorized entries within specific areas, generate reports, produce photo identification badges, provide surveillance, and annunciate alarms. It shall be designed to provide operational flexibility, survivability, and reliable performance. ICIDS VI shall be modular, allowing for future incremental expansion or modification of inputs, outputs, and remote-control stations. It shall be compatible with fielded ICIDS systems. Integrated system capabilities shall include but not be limited to Command-and-Control System, Intrusion Detection, Physical Access Control, Intercommunications, Close Circuit Television (CCTV) and Redundant Power.

Systems of Systems. ICIDS VI is a System of Systems of complementary physical security capabilities fielded at Army installation provides regional command and control center for multiple Army/Joint installations.

Central Monitoring Station (CMS) System. Shall provide the continuous display and primary situational awareness data management of all connected Installations, facilities, zones, and partitions. The Central Monitoring Station Subsystem shall also interface with enterprise-level records management systems and provide interoperability with systems that support policing and incident management functions. CMS provides regional monitoring of Local Control Stations that may use disparate Intrusion Detection Systems (IDS) (Figure 1).

Local Control Station (LCS) System. Shall provide continuous display and command and control of a specific Installation and facility-based zones and partitions to include the ability to manage user access to a restricted area which is controlled by an intrusion system.

The Local Station Control System must provide the ability to interface with physical access control systems (PACS) and closed-circuit television (CCTV) systems that support the physical security function (Figure 2). Multiple LCS are monitored by specific CMS within a defined geographic region.

Integrated Functional Requirements.

Security Command Center System. Shall be UL certified Burglar Alarm Units, UL 1610, the Standard for Control Units and Accessories for Fire Alarm Systems, UL 864, or the Standard for Digital Alarm Communication System Units, UL 1635. The system shall be able to monitor multiple Installations or zones for the CMS and LCS respectively. The SCC includes alarm reporting and display subsystem. Software, hardware and devices to control, process, integrate, and annunciate ICIDS data that allow for operator monitoring and intervention. It includes the Local or Regional Station Control Console, SQL server(s), and media server(s). Additionally, Application Programming Interfaces (APIs) shall be required for unified content at the CMS and interoperability between the CMS and the hosted LMS using disparate physical security applications and devices.

Intrusion Detection System (IDS). The system shall be able to detect and report intrusion attempts and provide means to indicate a duress condition. It consists of sensors, premise control units (PCU) and software modules.

Physical Access Control System (PACS). PACS and its components shall be listed as approved on the FIPS 201 Approved Products List (APL). The PACS shall detect intrusion attempts, monitor and control personnel movement through normal access routes in and out of the facility and between protected areas within the facility. It consists of electronic devices, access control units (ACU), sensors and software modules. The PACS shall be capable of performing all required authentication methods outlined in FIPS 201 and shall perform the required level of authentication designated by the system owner at each door or layer of security in depth.

Close Circuit Television (CCTV) System. The system shall interface with ICIDS for control of camera call up to monitor, Pan-Tilt-Zoom (PTZ) control, Video recording based on alarm event triggers. Integration shall provide the means to associate ICIDS archived alarm events with recorded video at two separate locations. It consists of electronic devices required to provide visual assessment of ICIDS alarms and recording.

Communication System. The system shall provide redundant communications links from the Local Control Station and the Central Monitoring Station. It consists of elements required to ensure that pertinent data is transferred from point of origin to point where appropriate actions can be taken.

Back-up Power System. The system shall enable continuous operation of the entire ICIDS-VI and back-up systems to ensure continuous operation of certain components as determined by Army and/or pertinent regulations when primary power is interrupted.

Growth Capability. ICIDS-VI shall provide capability for modular ICIDS expansion with minimal equipment modification. ICIDS-VI shall be able to integrate products from multiple manufacturers and shall not be limited growth capability to products of a single manufacturer.

Hazardous Locations. When located in areas where fire or explosion hazards exist, ICIDS shall provide system components rated and installed according to Chapter 5 of NFPA 70.

Additionally, the system shall conform to DA PAM 385-64 Chapter 17 – HERO requirements – as applicable.

Figure 1. ICIDS-VI Functional Architecture Central/Regional Monitoring Station.

NOTES:

1. Diagram describes functional requirements and is not a design constraint.

2. INTERFACE – interoperability and encryption capabilities between installation system and central monitoring system.

Figure 2. ICIDS-VI Functional Architecture Local Control Station (LCS) at Installation.

NOTES:

1. Diagram describes functional requirements and is not a design constraint.

2. Quantities and types of components will vary with each installation.

System Configuration. ICIDS VI shall be set up as an Information System Secure Enclave. ICIDS VI Life Cycle operations, sustainment and maintenance support are provided by PM FPS. ICIDS VI fiber/network architecture/topology infrastructure shall be designed for CONUS-OCONUS installations by logical separation to maintain Information System secure enclave posture and gain necessary network and Cyber approvals from the U.S Army Network Enterprise Technology Command (NETCOM) and other DoD managed networks to integrate the ICIDS VI fiber/network architecture/topology infrastructure into each designated Army/Joint Bases CONUS-OCONUS Installation site facility by logical separation to maintain Information System enclave posture. ICIDS-VI enterprise network access to the DODIN will be available via the network Top-Level Architecture (TLA)/Joint Regional Security Stack (JRSS) managed by NETCOM and/or Joint Department of Defense entities (National Guard/US Army Corp of Engineers/ Joint Army-Air Force-Navy-Defense Information Systems Agency and any Non- Standard sites) to include computer network defense (CND) protection for ICIDS VI. The system shall provide a network architecture compliant with Joint Regional Security Stack (JRSS) Installation Area Network (ICAN) modernization guidance. The System shall use any feasible way to establish system enclave utilizing Installation Network infrastructure only for transport purposes. The System shall be designed to integrate with existing infrastructure and networks.

The System components shall be interoperable, modular, scalable, and compatible that can be tailored to accommodate future hardware and software upgrades.

System Installation. ICIDS-VI installation shall meet Unified Facilities Criteria (UFC) 4-021-02, Electronic Security Systems with Change 1, 11 September 2019, Unified Facilities Guide Specifications (UFGS) Section 28 10 05 or current revision as specified by Army Regulation (AR) 190-13, Physical Security Program. Additionally, it shall meet applicable codes and standards within NFPA 731, and applicable regulations.

Performance Requirements. Integrate the installed and operating subsystems into the overall ICIDS system to detect intrusion, control access, provide CCTV surveillance, provide visual verification, and perform as an entity, as specified below. Provide electronic equipment that complies with 47 CFR 15, Radio Frequency devices, and are suitable for the environment where they will be installed.

Reliability. Mean Time Between Operational Mission Failure for the display subsystem shall be 4,100 hours or greater. Mean Time Between Failure (MTBF) for any single transmission line of 21,400 hours or greater. MTBF for PCU of 11,100 hours or greater.

MTBF for any sensor of 18,100 hours or greater.

Availability. Provide components rated for continuous operation. Provide solid-state electronic components mounted on printed circuit boards, conforming to UL 796. Provide boards that are plug-in, quick-disconnect type. Do not impede maintenance with densely packed circuitry. Provide power-dissipating components with safety margins of not less than 25 percent with respect to dissipation ratings, maximum voltages, and current-carrying capacity. Provide solid-state type or hermetically sealed electromechanical type light duty relays and similar switching devices.

Operational Availability. ICIDS-VI shall have system Operational Availability of 0.997 or greater. ICIDS VI shall have a Mean Time to Repair (MTTR) of 0.5 hours or less.

ICIDS VI shall have a Maximum Time to Repair of 1.0 hours or less.

Maintainability. Provide components that can be maintained using commercially available tools and equipment. Arrange and assemble components to be readily accessible to maintenance personnel without compromising system defeat resistance and with no degradation in tamper protection, structural integrity, EMI or RFI attenuation, or line supervision after maintenance when it is performed in accordance with manufacturer's instructions.

Fail Safe Capability. Provide fail-safe capability in critical elements of the ICIDS including, but not be limited to, the capability to monitor communication link integrity and to provide self-test. Provide fault annunciation when diminished functional capabilities are detected. Annunciate fail-safe alarms to clearly distinguish from other types of alarms.

Preventive Maintenance. System components shall require minimal preventive maintenance. Provisions shall allow preventive maintenance while system is operational.

Line Supervision. Provide the same geographic resolution for fault isolation at the systems level as provided for intrusion detection. Provide either a static or dynamic system with active mode for line supervision of communication links of the ICIDS-VI system.

The static system must represent "no-alarm" always by the same signal, which is different than the originally transmitted signal.

The dynamic system must represent "no-alarm" with a signal which continually changes with time.

Power Loss Detection. Detect AC and DC power loss and generate an alarm when a critical component of the system experiences temporary or permanent loss of power.

Annunciate the alarm in PCU and LCS to clearly identify the component experiencing power loss.

Controls and Designation. Provide controls and designations as specified in NEMA ICS 1, Industrial Control and Systems General Requirements.

Interchangeability. Use off-the-shelf components which are physically, electrically, and functionally interchangeable with equivalent components as complete items.

Equivalent, replacement components must not require new or other component modification.

Shall not use custom designed or one-of-a-kind items. Interchangeable components or modules must not require trial and error matching to meet integrated system requirements, system accuracy, or restore complete system functionality.

SUBSYSTEM REQUIREMENTS

Performance Characteristics. The ICIDS-VI performance characteristics shall conform to the UFGS 28 10 05 or current revision per Army Regulation (AR) 190-13 and all applicable regulations and standards as referenced in Para 2 of this document and in Appendix A. This document provides an overview.

Security Command Center (SCC) System. As a general overarching requirement to meet Secure Equipment Act of 2021 for all Electronic Security Systems components, SCC must integrate all subsystems and communications, and provide operator control interface to the ICIDS-VI system. Additionally, the CMS shall be able to operate with the different physical security applications and equipment used by hosted Installations. The components are as follows:

ICIDS Software Suite Monitoring Display Software Graphical Map Software Printers Control and Display Integration Enrollment Center Equipment and Software Data Storage Application Interface and Encryption Computer Aided Dispatch Systems

ICIDS Software. ICIDS software requirements shall be IAW be UFGS 28 10

05 para 2.6.1 and sub para as applicable. Other requirements listed conform to capabilities of fielded ICIDS systems.

Provide commercial off-the-shelf software that utilizes a single database for the subsystem integrations provided under a single operating environment. The system is to archive all events in a database stored either on a local hard drive or a networked database server. The software must support configuration and simultaneous monitoring of all subsystems.

Allow the networked PC servers and workstation configurations connected via TCP/IP network utilizing DoD approved secure protocols. Administrative tasks including configuration, monitoring, schedules, report generation and graphic display are provided from any PC server and workstation on the network. All system programming data must be instantly accessible to every PC Workstation connected to the network and limited only by USER PRIVILEGES. The system is to utilize a non-proprietary SQL-based, ODBC-compliant database, managed by Sybase Adaptive Server Anywhere, Microsoft SQL Server, or Oracle.

Utilize a preemptive multi-tasking operating system, such as the latest Microsoft

Windows environment, that is multitasking without any internal and external interference.

Provide capabilities to define visual exclusion areas.

Provide de-warping software for panoramic cameras as applicable.

Alarm Call Up. Support responses to alarms entering the system with each alarm capable of initiating one or more of the actions listed in UFGS 28 10 05 para 2.6.1.1.

System Timing. Shall be able to report five simultaneous alarms transmitted, processed, and annunciated within three seconds when the alarm occurs.

Programming. Provide the capability of, but not limited to, the following programming and functionality listed in UFGS 28 10 05 para 2.6.1.2.

ICIDS Monitor Display Software. All monitor display software requirements shall be IAW be UFGS 28 10 05 para 2.6.2 and sub paragraphs as applicable.

Graphical Map Software. All ICIDS graphical map software requirements shall be IAW be UFGS 28 10 05 para 2.6.2 and sub paragraphs as applicable.

Printers. All ICIDS printer requirements shall be IAW be UFGS 28 10 05 para

2.6.2 and sub paragraphs as applicable.

Control and Display Integration. Integrate human engineer SCC controls so the entire SCC can be operated by a single or multiple operators. Integrate switching and monitoring components of the assessment subsystem with the SCC so that SCC operator(s) can effectively monitor, assess alarms, and control the ICIDS. Method of system integration must be as a single console. Provide chassis, and modules required for console SCC configuration.

Enrollment Center Equipment and Software.

Enrollment Center Equipment. All ICIDS-VI enrollment center equipment requirements shall be IAW be UFGS 28 10 05 para 2.6.6 and sub paragraphs as applicable.

Provide enrollment stations to enroll personnel into, and dis-enroll personnel from, the system database. The enrollment equipment is to only be accessible to authorized entry control enrollment personnel.

Enrollment Center Software. All ICIDS enrollment center equipment requirements shall be IAW be UFGS 28 10 05 para 2.6.6.3.

Data Storage. The system shall use an operating system that satisfies the requirements of Information Assurance, have sufficient storage capacity and processing speed to meet system storage requirements.

System shall continuously and automatically store configuration, operator actions, maintenance periods and alarm data with corresponding date and time into nonvolatile storage.

Operator shall have no control of data storage.

Shall be at a minimum configured as hot swappable RAID 5 with redundant power supplies on all application and storage servers.

Provisions shall allow for one month storage of archive data for an installation with 1,280 remote areas before being downloaded to permanent storage.

System shall generate status display message before capacity of data storage is reached:

(1) Message shall be generated when data storage is at 75% of capacity in time to replace the storage media or backup stored data before overwriting occurs without disrupting operator functions.

(2) User shall have ability to select an alert, so message is not lost until data storage is reduced or replaced.

Application Interface and Encryption. The CMS shall be able to interface with the LMS that use disparate physical security applications while using secure enclave transport systems.

Intrusion Detection System (IDS). The IDS primary function is to detect intrusion into secured areas. The IDS shall utilize a single database for all IDS programming data that seamlessly integrates with the ICIDS system under a single operating environment.

The IDS events must be viewable as separate or as a combined list of all ICIDS events. Control the IDS alarm monitoring through software control from the ICIDS system. IDS shall be consistent with the requirements in UL 1076. Additionally, IDS in Sensitive Compartmentalized Information Facilities (SCIFs) and Special Access Programs (SAPs) shall comply with UL 2050 Extent 3 standards for installation.

Provide both supervised and non-supervised alarm point monitoring.

Secure or access alarm points both manually and automatically by time of day, day of week or by operator command.

IDS Components.

Premise Control Units (PCU) Detection Sensors Tamper Switches Duress Switches (as required by zone)

Detection Sensitivity. The sensitivity shall allow for the following:

Locating intrusions within 100 meters or 300 feet zones along a line or perimeter to one side of the facility building.

Locating intrusions at individually protected assets or at an individual portal.

Locating intrusions within the coverage on a single volumetric sensor.

Locating failures or tampering at individual sensors.

Detection Alarm and Reporting Capacity.

Collect, communicate, and display up to a minimum of 256 sensor zone alarms and to enable control of two card reader or card reader with integral keypad for arming and disarming secure and access inside of the protected area with a delayed alarm and outside of the protected area with instant alarm.

Identify individual sensors in alarm if the sensor zone is a multiple alarm source combination. Annunciate a single alarm within 2 seconds maximum, after sensor transducer or other detection device activation except that alarms transmitted by radio frequency signaling must communicate in less than 3 seconds.

Arm/Disarm keypads shall have LED display with capability to display alarm status and event history and identify alarms by device, input, zone, and partition, etc.

Probability of Detection. The ICIDS-VI system shall have the following probability of detection goals by asset risk level:

Risk I: 0.90 (T), 0.95 (O).

Risk Level II: 0.95 (T), 0.99 (O); and Risk Level III; 0.95 (T), 0.99 (O).

False Alarm Rate. The false alarm rate for each interior IDS zone must not exceed one false alarm per 30-day period. The false alarm rate for each exterior IDS zone must not exceed one false alarm per 24-hour period.

Nuisance Alarm Rate. The nuisance alarm rate for each interior IDS zone must not exceed three nuisance alarms per 30-day period. The nuisance alarm rate for each exterior IDS zone must not exceed three nuisance alarms per 24-hour period.

Premise Control Unit (PCU). Install the PCU command processor in a tamper resistant enclosure that is specified in paragraph "Component Enclosure". Package the following with the PCU:

Power transformer Battery(s) Network connection cable and/or appropriate communication medium Keypad(s) Keypad connection cable(s) Additional components as required for full functionality

Overcurrent Protection Indication. When overcurrent more than it is rated for is detected by the PCU, the communication bus(es) and keypad(s) shall shut down and an overcurrent notification LED lit to indicate the situation.

Manual and Self-Test. All testing from any alphanumeric keypad include testing for: standby battery, alarm bell or siren, and communication to the Security Command Center (SCC) of the Installation and the Central Monitoring Station. Shall include provisions for an automatic, daily, weekly, 30 days, or up to 60-day communication link test from the PCU installation site to the SCC. Include a provision for displaying the internal system power and wiring conditions.

Backup Battery Capacity Calculations. Backup battery capacity shall exceed sensor(s) operation, communications supervision, and alarm annunciation power requirements for proposed equipment plus 25 percent spare capacity. Backup time HRS= Battery capacity (amps/hr.) x Input Voltage/ Total load in Watts.

Backup Battery Monitoring and Detection. PCU shall monitor backup battery power for low battery condition or loss of backup battery power. Monitoring shall be continuous regardless of if primary power is present or not. The system shall generate an alarm whenever low battery condition or loss of backup battery power is detected. Annunciate the alarm at the LCS and the CMS, to clearly identify the PCU experiencing the condition.

Multi-state Alarm Inputs. PCUs shall accept multi-state alarm inputs and/or addressable alarm sensors to reduce the number of home run signal cables, alarm inputs required, and simplifies programming.

Expandability. The PCU shall provide modular solution which will allow for present zone security requirements while also having the capability for adding sensors and status points. PCU shall allow for array configuration should the zone requirements exceed the capacity of the PCU.

Detection Sensors.

Sensors are to detect facility perimeter or protected zone penetrations by unauthorized personnel or intruders and transmit an alarm signal to the alarm annunciation system upon change detection. Accomplish this with a probability of detection (PD) of 0.9 with a 95 percent confidence level and conforming to UL 639 where applicable.

Required sensor power is 12 VDC unless otherwise specified.

Shall provide line supervision for all sensors with an end-of-line resistor at the sensor or within a tampered junction box with conduit from the junction box to the sensor.

Shall provide sensors and components rated for operation in the installed environment. The sensors must transmit an alarm signal to the alarm annunciation system upon change detection. Provide all sensors with a tamper switch and elements housed in a tamper-alarmed enclosure in accordance with paragraph "Component Enclosure" in UFGS 28 10 05.

High Security Switch (HSS). Shall conform to UL 639. Shall conform to additional requirements by zone type as required by all applicable regulations.

Passive Infra-Red Sensors (Interior and Exterior). Shall conform to UL 639.

Shall conform to additional requirements by zone type as required all applicable regulations.

Microwave Sensors. Shall conform to UL 639. Shall conform to additional requirements by zone type as required by all applicable regulations.

Dual Technology Sensors. Shall conform to UL 639. Shall conform to additional requirements by zone type as required by all applicable regulations.

Fence Mounted Sensors. Sensors are fiber optic or strain-sensitive cable sensors as indicated which initiate an alarm when an intruder attempts to scale, cut through, lift the fabric of, or lean climbing devices on to the entire length of a standard chain link fence or physical barrier. Shall provide sensors that are either tamper alarmed or self-protecting. House exterior components in rugged, corrosion-resistant enclosures, as specified in paragraph “Component Enclosures” in UFGS 28 10 05.

Duress Alarms. Shall comply with ANSI/SIA CP-01, Control Panel

Standard – Features for False Alarm Reduction, Para 4.2.4. Shall conform to NFPA 731.20 and other additional requirements by zone type as required by all applicable regulations.

Physical Access Control System (PACS).

Functional Requirements. The following are some functional requirements of the PACS. A complete and detailed list is in UFGS Para 20 28 10 05. PACS and its components shall be listed as approved on the FIPS 201 Approved Products List (APL). Additionally requirements dictated by zone type shall be governed by pertinent Army Regulations.

The PACS card credentials are required to be Common Access Cards (CAC), and CAC cards are being provided by the Government. Interface system with and provide alarm and other status to the overall ICIDS.

System is to grant or deny access or exit based upon (as applicable):

(1) Keypad identification data

(2) CAC or PIV card identification data

(3) Biometric reader identification data

(4) Smart card identification data

(5) Identification technologies combination

(6) Input through the access control devices compared to data stored within the system Decision to grant or deny access or exit is to be based upon authorization for such data to be input at a specific location for the current time period. Access decisions for high security areas are to be based upon two identification technology combinations: card and keypad or card and biometric.

Shall provide ACS that supports the configuration and simultaneous monitoring of multiple access control devices when TCP/IP communication interfaces are used between the ICIDS system and the Primary Access Control Unit (ACU). The events of the ACS are to be viewable as separate or as a combined list of all ICIDS events. Provide overall control of the ACS, alarm monitoring, and photo identification through software control of the ICIDS system.

Shall provide both supervised and non-supervised alarm point monitoring.

PACS Badging Requirements.

a. Shall include fully integrated badging capabilities, including image capture, image editing, badge design, and badge printing. Allow for each cardholder to be assigned to both a badge design formatted for badge printing and a dossier design formatted for standard paper printing.

b. Shall provide for interfacing with external badge programs, in which stored photo images are displayed in a cardholder information window, but other badge features are supported by the external program. Include one or more networked PC workstations with the photo imaging components at which all the required image capture equipment has been installed.

c. Shall provide a minimum 100 blank visitor card stock that is listed on the FICAM

APL, https://www.idmanagement.gov/approved-products-list-piv/.

PACS Programming. Software shall be capable of, but not limited to, the following programming requirements as stated in UFGS 28 10 05 para 2.4.2.

Error and Throughput Rates. Rates must be portal to portal performance averages obtained when processing individuals one at a time. Shall have a minimum of throughput of six authorized entries per minute.

Enrollment Equipment. Shall provide enrollment equipment as required in paragraph Enrollment Center Equipment of UFGS 28 10 05 para 2.6.6.

Access Control Unit (ACU). Shall be micro-processor based ACU with all access and input and output decisions to be made by the individual ACU(s). Provide modular solution which will allow for present security requirements and the capability to expand.

Configure all field ACU panels to intercommunicate via RS-422/485 or RS-232 hardwired, TCP/IP or fiber-optic communication. Equip all field ACU(s) with a tamper contact. ACUs shall accept multi-state alarm inputs and/or addressable alarm sensors to reduce the number of home run signal cables, alarm inputs required, and simplifies programming. Shall conform to

UL 294.

Access Control Devices. The card, card reader, and panels shall meet encryption requirements that are specified in paragraph Data Encryption. Devices are to be tamper alarmed, tamper and vandal resistant, and solid state, containing no electronics which could compromise the access control subsystem should the subsystem be attacked. ACU shall monitor backup battery power for low battery condition or loss of backup battery power.

Monitoring shall be continuous regardless of primary power is present or not. The system shall generate an alarm whenever low battery condition or loss of backup battery power is detected.

annunciate the alarm at the LCS and the CMS, to clearly identify the ACU experiencing the condition. Shall conform to UL 294.

Access Control Keypads. Entry control keypads shall use unique alphanumeric and other symbol combinations as an identifier. Keypads shall contain an integral alphanumeric and special symbols keyboard with symbols arranged in ascending ASCII code ordinal sequence or random scrambled order. Communications protocol is to be compatible with the local processor.

Keypad Display. Keypads are to include an LED or other type of visual indicator display and provide visual (T) Visual and Audible (O) status indications for power ON and OFF and whether user passage requests have been accepted or rejected.

Keypad Response Time. The keypad is to respond to passage requests by generating a signal to the local processor.

Keypad Power. The keypad must not dissipate more than 5 watts.

Keypad Mounting Method. Provide keypads suitable for variable weatherproof mounting as required.

Keypad Duress Codes. Provide a means for users to indicate a duress situation by entering a special code into the keypad.

Card Readers with Integral Keypad. Equip contact and contactless card readers with integral keypads as specified in UFGS 28 10 05 paragraph “Keypads”.

Access Control Cards. Shall provide cards with the capability of modification and lamination during enrollment process without readability reduction for use as a picture and identification badge. Cards shall contain binary coded data arranged in a scrambled pattern as a unique identification code stored on or within the card and of the type readable by the subsystem card readers. Shall be listed as approved and consistent with the PACS manufacturer's approved solution.

Personal Identity Verification Equipment. Entry control personnel identity verification equipment shall use a unique personal characteristic or unique personal physiological measurement to establish the identity of authorized, enrolled personnel. The PACS shall designed based on the FICAM 13.02 Topology – end-to-end systems which integrate the first two components (PACS Infrastructure; Validation System) into a “PACS Validation

Infrastructure,” which is then integrated with the third component category (PIV Reader).

Portal Control Devices. Portal Control Devices shall be designed in accordance with NFPA 101, Means of Egress. If ICIDS is to be integrated with the Fire Alarm System provide appropriate signage in accordance with NFPA 101. Door hardware shall be UL 1034 Burglary-Resistant Electric Locking Mechanisms. Provide FF-L-2890 locking hardware where required.

Closed-Circuit Television (CCTV) System. System components shall conform to the Open Network Video Interface Forum (ONVIF) specification. Shall be compatible with UL listed CCTV components to provide visual assessment of ICIDS alarms automatically upon alarm or upon operator selection. Otherwise, the subsystem is to continuously display the coverage area. Display alphanumeric camera location ID on all monitors. CCTV will comply with FAR Clause 52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.

Cameras. All Camera and camera component requirements shall be IAW UFGS 28 10 05 para 2.5.1 and sub paragraphs.

Video Analytics. Video Analytics requirements shall be IAW UFGS 28 10 05 para 2.5.3 and sub paragraphs.

Color Video Monitors. Color video requirements shall be IAW UFGS 28 10 05 para2.5.4 and sub paragraphs.

Ancillary Equipment. All ancillary CCTV equipment requirements shall be IAW UFGS 28 10 05 para 2.5.5 and sub paragraphs as applicable. Shall conform to UL 1678, Standard for Safety for Household, Commercial, and Institutional-Use Carts, Stands and Entertainment Centers for Use with Audio and/or Video Equipment.

Camera Housing. Camera housings shall meet IP66/67/or 68 rating.

Camera Mounting Structures. Camera mounting requirements shall be IAW UFGS 28 10 05 para 2.5.6 and sub paragraphs as applicable. Shall conform to UL 1678.

Communication System (UFGS 28 10 01 para 2.7).

a. Communications are to link together subsystems of the ICIDS and be in accordance with Section 27 10 00 Building Telecommunications Cabling System of UFGS 28 10 05.

Interfaces between subsystems cannot be accomplished by use of an electro-mechanical relay assembly. Communications links shall be supervised. Shall provide common communications interface devices throughout the ICIDS. Provide dry contact sensor to control unit interface that is normally OPEN or normally CLOSED, except as specified otherwise.

b. Use digital, asynchronous, or multiplexed data control unit for central alarm reporting and display processor interface. Group individual data bits into word format and transmit as coded messages. Implement interface with network switches which function as a communications controller, perform data acquisition and distribution, buffering message handling, error checking, and signal regeneration as required to maintain communications.

c. Provide totally automatic status changes communication, commands, field-initiated interrupts, and any other communications required for proper system operation. Do not require system communication operator initiation or response. System communication is to return to normal after any partial or total network interruption including power loss or transient upset.

Automatically annunciate communication failures to the operator with communication link identification that has experienced a partial or total failure.

Link Supervision. Link supervision requirements shall be IAW UFGS 28 10 05 para 2.5.5 and sub para as applicable.

Hardwire. Hardwire shall be IAW UFGS 28 10 05 para 2.7.2 and sub paragraphs as applicable.

Radio Frequency Link. Radio frequency link shall be IAW UFGS 28 10 05 para 2.7.3 and sub para as applicable.

Data Encryption. Shall incorporate current NIST FIPS encryption standards.

System and applicable subcomponents shall comply with the current NIST FIPS encryption standard throughout the warranty period. Reference Technical Specification ICD/ICS 705 for detailed encryption requirements for SCIF and SAP facilities.

Network Switch. The small form-factor pluggable (SFP) is to provide full-duplex 1000/100/10-Mbps connectivity between switches over single mode (SM) infrastructures.

Provide mounting accessories for a typical field distribution box, cabinet, or rack. Rack requirements as specified in paragraph Equipment Rack of the UFGS 28 10 05.

Network Time Server. Shall provide Network Time Server (NTS) to all ICIDS local, central, regional monitoring stations or local station with integrated IDS, ACS, and/ or CCTV. To keep the system in time with each other.

Video and ICIDS Transmission. Transmission shall be IAW UFGS 28 10 05 para 2.7.6 and sub paragraphs as applicable.

Wire and Cable. Transmission shall be IAW UFGS 28 10 05 para 2.7.7 and sub paragraphs as applicable.

Digital Data Interconnection Wiring. Digital data interconnection wiring shall be IAW UFGS 28 10 05 para 2.7.8 and sub paragraphs as applicable.

Above Ground and Direct Sensor Wiring. Shall be IAW UFGS 28 10 05 para

2.7.9 and 2.7.10 respectively.

Local Area Network (LAN) Cabling. Cabling shall be in accordance with TIA- 568-C.2, Category 6. Shall be IAW DoD IT Infrastructure Policy, cabling shall comply with CNSSAM TEMPEST 1-13 Red/Black Installation guidance Tab 1.

Cable Construction. Provide all cable components that will withstand the environment in which the cable is installed for a minimum of 20 years.

Back-Up Power System. Requirements as dictated by UFGS 28 10 05 Para 2.11, NFPA 731-20, ICS 705, UL 2050, and other applicable regulations governing the security of the specific zone or asset requiring protection.

Intrusion alarms shall not to be generated because of power switching; however, it shall provide a power switching indication and on-line source at the alarm monitor.

The system shall automatically switch back to the primary source upon primary power restoration. Detect and report failure of an on-line battery as a fault condition. Power products must be in accordance with UFGS 26 20 00 Interior Distribution System.

Shall provide backup power to the primary power by backup batteries in each element or subsystem and/or uninterruptible power supply (UPS). If the facility is supported by a back-up generator, provide UPS adequate to support the transition from primary power loss to power provided by the generator.

Shall automatically provide power to the premises security system instantaneously whenever the primary power supply fails to provide the minimum voltage required for operation.

Shall provide power for continuous operation of the security system, whenever primary power fails, for duration as specified for each zone type and component.

Uninterruptible Power Supply. Shall be IAW UFGS 28 10 05 para 12.11.1 and sub para as applicable.

Batteries. Shall be IAW UFGS 28 10 05 para 12.11.2 and sub paragraphs as applicable.

Surge Suppression Devices. Shall comply with requirements in UFGS 33 82 00 Telecommunication Outside Plant (OSP). Provide appropriate surge suppression devices.

Devices shall be properly sized and installed as prescribed by the equipment manufacturer. The head end equipment rack shall utilize IU rack mounted shielded Ethernet, Power Over Ethernet (POE), and/or optional POE extender circuits surge protection unit that utilize field replaceable modules that do not require removal and disassembly of the unit to replace a surge protector.

Component Enclosures. Alarm enclosures with a tamper switch(es). Refer to paragraph "Tamper Switch" of the UFGS 28 10 05. Enclosures is to be formed and assembled to be sturdy and rigid and for components listed in UFGS 28 10 05 para 2.13.

Interior and Exterior Sensors. Shall be IAW UFGS 29 10 05 para 2.13.1 and

2.13.2 respectively.

Interior Enclosures. Enclosures to house equipment in an interior environment must meet the requirements of NEMA 12.

Exterior Enclosures. Enclosures to house equipment in an outdoor environment or corrosive environments must meet the requirements of NEMA 250 Type 4X.

Metal Thickness. Shall be IAW UFGS 28 10 05 para 2.13.7.

Doors and Covers. Shall be IAW UFGS 28 10 05 para 2.13.8.

Ventilation. Ventilation openings in enclosures and cabinets must conform to requirements of UL 1610.

Labels. Label boxes containing connections that they contain ICIDS connections and indicate that the box is part of the ICIDS system.

Test Points. Provide readily visible and accessible with minimum disassembly of equipment to test points, controls, and other adjustments inside enclosures. Test points and other maintenance controls must be readily accessible to operator personnel.

Equipment Rack. Provide standard 483 mm 19-inch electronic rack cabinets conforming to UL 50, Safety Enclosures for Electrical Equipment, Non-Environmental Considerations, for the ICIDS system at the SCC and remote control and monitoring sites.

Equipment rack must be in accordance with UFGS 27 10 00 Building Telecommunications Cabling System. All other requirements listed in UFGS 28 10 05 para 2.14 as applicable.

CYBERSECURITY.

The System shall implement the National Institute of Standards and Technologies Special Publication (NIST SP) security controls prescribed in DoD Instruction (DoDI) 8510.01 Risk Management Framework for DoD IT, which are reflective of an overall security categorization as defined in Committee on National Security Systems Instruction (CNSSI) 1253, and AR 25-2, (IA) and display a privacy act statement at appropriate user interfaces.

The System shall implement system security measures sufficient to attain and maintain Authorization to Operate (ATO) IAW Risk Management Framework (RMF) for DoD Information Technology per the DoDI 8510.01, AR 25-2, pamphlets that fall under AR-2 and the Network Enterprise Technology Command (NETCOM) RMF: Assess and Authorize TIP dated 2 June 2016(latest updated Policy, regulation and Instructions apply).

The System shall use secure encrypted communications over the network of at least AES- 256 (latest updated Policy, regulation, Instructions, DoD required configuration apply).

The System shall encrypt data at rest IAW with DoD Policy Memorandum, " Encryption of Sensitive Unclassified Data at Rest on Mobile Computing Devices and Removable Storage Media," dated July 7, 2007, DoDD 8100.2, "Use of Commercial Wireless Devices, Services, and Technologies in the Department of Defense (DoD) Global Information Grid (GIG)," dated April 14, 2004, as supplemented by ASD Nll/DoD CIO memorandum, same subject, dated June 2, 2006, DoD Policy Memorandum, "Protection of Sensitive DoD Data at Rest on Portable Computing Devices," dated April 18, 2006.

The System shall ensure data concurrency of all System components among physical installations with secure network connectivity and be able to store encrypted data and eliminate duplicate information.

The System shall provide the capability to automatically install security patches IAW an approved DoD Patch Management Policies process utilizing Information Assurance Vulnerability Management (IAVM).

The System shall provide Host Based Security System (HBSS), per JTF-GNO CTO 07-

12. 3.5.9

The system shall provide the capability that to use PKI certificates (CAC logon) on workstations, servers, and tools for managing, renewing, and revoking certificates and related services and support IAW DoD Policy for Public Key Infrastructure (PKI) and Public Key (PK) Enabling.

The System shall remain current with the latest Department of the Army and DoD security standards.

The System shall provide a secure operating environment IAW Defense Information System Agency (DISA) guidelines and standards. The System shall provide WSUS capabilities across all ICIDS-VI, if integrated with other ICIDS platforms provide same capability all cross the board. The System shall provide capabilities for ongoing Monitoring, monitoring/updating Information System & Environment Changes, performing Corrective Actions, updating Security Controls as needed, conducting periodic Security Control Assessments, conducting Remediation Actions, accomplishing Security Status Reporting and ensuring Risk Determination and Acceptance. The system shall be configured and maintained IAW Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIG). The system shall utilize highest approved FIPS algorithm in place to encrypt all devices to include System logs. The system shall be configured to use Secure File Transfer protocol. The system shall be configured and implement secure network implementation in accordance with DODI 8531.01 to include but not limited to support Vulnerability assessments and analysis (network discovery, network and host vulnerability scanning, penetration testing). The system shall implement Internal Network scanning and Monitoring/ update tools. The system shall implement threat, vulnerability and attack notification, and take corrective action to mitigate potential vulnerabilities to the system and DODIN (Department of Defense Information Networks) as part of Comprehensive Vulnerability Management consisted with repeatable Vulnerability Management Process. The system shall be configured and implemented IAW NIST SP800-53 Revision 5 Security and

Privacy Controls for Information Systems and Organizations, SP 800-53B Control Baseline for information Systems and Organizations, SP 800-53A Assessing Security and Privacy Controls in Information Systems and Organizations, SP 800-53 Rev4 Assessing Security and Privacy Controls in Federal Information Systems and Organization, DoDI 8500.01, Cybersecurity, – DoDI 8510.01, Risk Management Framework (RMF) for DOD Information Technology (IT), – DoDI O-8530.2, “Support to Computer Network Defense (CND)”, – DoDI 8551.01, Ports, Protocols, and Services (PPSM).

The system shall be configured…