Appendix_E_-_CSP.pdf

ATTACHMENT A - CONSTRUCTION SECURITY PLAN

CONSTRUCTION SECURITY PLAN

TABLE OF CONTENTS

Introduction A-1

Construction Security Plan A-2

INTRODUCTION

The Construction Security Plan (CSP) outlines the security protective measures that will be applied for the duration of the N2W project. The CSP applies to all personnel involved in the design and construction.

Information concerning security protective measures as well as related standard operating procedures applicable during the optional bid item for Operations and Maintenance (O&M) of the facility can be found in Attachment K - O&M Performance Work Statement.

Security threats and resulting responses are very dynamic by nature. As such, the CSP is a “living document” that will be reviewed and/or modified annually or as deemed necessary by the Government to meet operational requirements.

UNCLASSIFIED

National Geospatial-Intelligence Agency

Next NGA West (N2W)

CONSTRUCTION SECURITY PLAN (CSP)

Version 2.4

12 December 2017 (Revised: 12 December 2018)

A-2

PAGE INTENTIONALLY LEFT BLANK

A-3

REVISION INDEX

1. Standardized Revision Process: Any changes to this document must be routed through the N2W Assistant Program Manager-Security (AMP-S) and Accrediting Official (AO) for final approval. Revisions to this document shall be accomplished in accordance with procedures outlined in this section.

2. Authorized Person: Only the APM-S in agreement with the AO can make revisions to this document.

3. Revision Process:

3.1 Requirement for revision identified.

3.2 Revision change form utilized for all changes

3.3 Co-Approval required between APM-S and AO.

3.4 Revision Approved

3.5 Document Revised

3.6 Revision page updated

3.7 Document saved with new revision number

3.8 Updates will be indicated with an * at the beginning of the paragraph or section with italics.

VERSION # REVISION

DATE SECTION DESCRIPTION OF CHANGE

2.2 12/4/2017 21 Material Inspection Process

2.2 12/4/2017 4 Administrative

2.3 12/12/2017 17 Acoustic testing method approval changed to instrumental

2.4 06/15/2018 6,10 Administrative, added Long term

Construction Vehicle Access Requirements

2.4 06/15/2018 7,11 Delivery Access Requirements

A-4

2.4 09/27/2018 8 Removed requirement for ACS to inspect vehicles and personnel

2.4 10/01/2018 1 Added additional language regarding A/O requirement for use of CSTs

2.4 10/01/2018 2 Changed construction end time from 2023 to 2024

2.4 10/01/2018 3 Updated Construction Surveillance Technician Requirements

2.4 10/12/2018 13

13.2 Added ordering documents

and shipping labels to alias project name requirements

2.4 10/12/2018 13 13.3 Administrative change

2.4 10/15/2018 4 4.3.4 Added “failure to appear”

2.4 12/12/2018 4

4.2.1.5 and 4.2.1.6 Added the collection of race/ethnicity and gender to vetting information

A-5

TABLE OF CONTENTS

1. Purpose 6

2. Project Overview 7

3. N2W Security Personnel 7

4. Vetting of Contractor Personnel 9

5. Security Briefing 11

6. Badging Requirement 11

7. Vehicle Access 13

8. Reporting Requirements 15

9. Prohibited Items 15

10. Key Control 16

11. Meetings 17

12. Tool Storage 17

13. Document Control 17

14. Temporary Secured Area(s) Lockdown Procedures 18

15. Acoustic Testing 19

16. Protected Distribution System (PDS) 19

17. Emergency Situations 19

18. Special Security Instructions (SSI) 20

A-6

19. Construction Material Inspection 20

20. Accreditation Process 21

21. Summary 21

A-7

1. Purpose

1.1. The Construction Security Plan (CSP) governs the application of security to the Next NGA West (N2W) project planning, design and construction efforts in accordance with Intelligence Community Directive (ICD)/Intelligence Community Standard (ICS) 705. The CSP outlines the security protective measures that will be applied throughout the construction project. The CSP will meet all security requirements through a risk-based rationale to obtain the highest level of security at the lowest cost. The testing protocols will be timely, adequate, sustainable and cost effective. This process shall be maintained for the entire project life cycle.

Although there is latitude to revise the CSP criteria, revisions will not occur until approved by the N2W Assistant Program Manager – Security (APM-S) and the Accreditation Official (AO) in coordination with the United States Army Corps. Of Engineers (USACE). The CSP ensures the facility will be constructed so that it:

• Has integrity: is designed and constructed to prevent technical penetrations

• Is void of devices embedded into the building during construction

• Identifies and mitigates other vulnerabilities affecting the safety and security of personnel and resources

• Protects mission personnel, equipment, data, processes and other missions

1.2. In accordance with ICD/ICS 705 the CSP encompasses the following activities to provide requisite security measures required for SCIF accreditation:

• Identity Verification

• Periodic searches at N2W project site entry and exit points

• Signs at all entry points listing prohibited items

• Physical security barriers to deny unauthorized entry

A-8

• Vehicle and material inspections

1.3. In addition to the activities identified in 1.2, the AO has mandated the use of Construction Surveillance Technicians (CST) to monitor uncleared workers at the start of SCIF construction or the installation of major utilities, whichever comes first.

1.4. The CSP applies to all personnel involved in the design and construction of the N2W project.

1.5. The CSP is a “living document” that will be reviewed annually or as deemed necessary by the APM-S in coordination with the AO. Changes to the CSP may occur throughout the construction life cycle to meet unexpected operational requirements.

2. Project Overview

2.1. The N2W project involves the design and construction of a SCIF facility at the selected location in north St. Louis city. This includes facilities to support the NGA vision, strategy, and mission as well as Access Control Point(s) (ACP), parking garages/lots, Remote Inspection Facility (RIF) and Visitor Control Center (VCC). Construction of the N2W project is currently scheduled to begin in 2019 and end in 2024.

3. N2W Security Personnel

3.1. Accrediting Official (AO): The AO is a U.S. Government staffed position and is responsible for providing security oversight of all aspects of N2W SCIF construction. This includes reviewing and approving the design concept, the CSP, and final design(s) for SCIF construction. The AO will accredit the SCIF, prepare waiver requests, provide timely input of all required SCIF data to the Intelligence Community (IC) SCIF repository.

3.2. Assistant Program Manager – Security (APM-S): The APM-S is a U.S.

Government staffed position who will serve as the U.S. Government’s representative to ensure all security requirements (Physical, Technical, and AT/FP) are met. The APM-S is responsible for the oversight of all security requirements, security personnel, and coordinating all site specific security procedures on the

A-9

N2W construction site.

3.2. Deputy Assistant Program Manager – Security (DAPM-S): The DAPM-S is a U.S. Government staffed position and the APM-S designee that will assist the APM-S to ensure all security requirements are met. In the absence of the APM-S the DAPM-S is responsible for the oversight of all security requirements, security personnel, and coordinating all site specific security procedures on the N2W construction site.

3.3. Construction Site Security Manager (CSSM): The CSSM is a U.S.

Government staffed position who monitors and coordinates all security related activities at the N2W construction site. The CSSM reports directly to the APM-S.

3.4. NGA Police Officer(s) (NPO): NPO(s) are the U.S. Government staffed positions responsible for conducting police operations focused on detecting, deterring, responding to, and resolving security/criminal incidents on the N2W construction site. NPO(s) will coordinate these activities with the CSSM.

3.5. Construction Surveillance Technician(s) (CST): The U.S. Government will supply CST(s) trained in surveillance and the construction trade to deter technical penetrations and thwart implanted technical collection devices.

3.6. Access Control Specialist(s) (ACS): The U.S. Government will supply ACS(s) who are responsible for ensuring only authorized personnel are granted access to the construction site; issuance of construction site specific project badges, and vehicle passes.

3.7. Security Monitors (Escorts): The U.S. Government will supply escorts who are responsible for securing specific areas of the construction site. Specific areas and number of escorts will be determined based on the requirements of each aspect of the project.

3.8. Technical Surveillance Countermeasure (TSCM) Technician(s): The U.S.

Government will supply TSCM(s) responsible for conducting technical security operations at the N2W construction site. TSCM(s) are accountable to the TSCM Program Manager and will coordinate activities with the CSSM.

3.9. Contractor Security Representative (CSR): The contractor will designate a

A-10 security coordinator to facilitate all security issues with the U.S. Government. The CSR must be on-site Monday-Friday, during normal business hours. The contractor may require subcontractors to designate individuals to assist in security matters, but all security issues related to subcontractors should be forwarded to the U.S. Government through the CSR.

4. Vetting of Contractor Personnel

4.1. Design and construction of the N2W Project shall be performed by U.S.

companies using U.S. citizens to reduce risk, but may be performed using U.S.

persons (an individual who has been lawfully admitted for permanent residence, as defined in Title 8 U.S. Code 1101(a) (20) or who is a protected individual as defined by Title 8 U.S. Code 1324b (a) (3)).

4.1.1. If non-U.S. Citizens are used the following mitigations shall be followed:

4.1.1.1. They will not perform work in any areas designated to be a classified work space or in areas sharing a wall with a designated classified work space.

4.1.1.2. They will not perform work inside any telecommunications, electrical, or mechanical rooms that are connected to or support classified work spaces.

4.1.1.3. They will not perform finish work (drywall, paint, trim, etc.).

4.2. Personnel requiring access to project information, materials, and/or the construction site are subject to vetting by the U.S. Government via checks through the National Crime Information Center (NCIC).

4.2.1. Personnel requiring access must supply the following biographical information to the USACE and APM-S at least thirty (30) days in advance of the desired date of access.

4.2.1.1. Full name and any aliases

4.2.1.2. Current address(es)

4.2.1.3. Social Security Number, A-11

4.2.1.4. Date and place (city, state/province, country) of birth

4.2.1.5. Race/Ethnicity (i.e. Hispanic, White, Black, Pacific Islander, Asian, Native American, Two or more races)

4.2.1.6. Gender (i.e. Male/Female)

4.2.1.7. Information pertaining to all citizenships held

4.2.1.8. Permanent Resident Card number, Employment Authorization Document number, or Employment VISA number.

4.2.1.9. Driver’s License Number, State Identification Number and state of issue or Passport

4.2.1.10. Inclusive dates of access required

4.2.1.11. Circumstances in which an individual’s identity cannot be verified using the information outlined above will require a fingerprint check via the Integrated Automated Fingerprint Identification System.

4.3. Personnel meeting any of the following criteria are prohibited from working on the site:

4.3.1. Association with terrorist groups

4.3.2. Association or citizenship with critical threat countries identified on the Security Environmental Threat List (SETL)

4.3.3. Convictions for Violent Crimes - defined in the FBI UCR Program as those offenses which involve force or threat of force. Violent crime is composed of four offenses: murder and non-negligent manslaughter, forcible rape, robbery, and aggravated assault.

4.3.4. Active misdemeanor warrant, failure to appear warrant within extradition parameters or any felony warrant

4.3.5. Conviction for any sexually based offense

A-12

4.3.6. Conviction or under investigation for espionage or espionage related activities.

4.3.7. The U.S. Government reserves the right to deny anyone access to the construction site and/or information/materials associated with this project.

4.4. All information obtained for the purpose of vetting personnel shall be protected in accordance with the Privacy Act of 1974.

4.5. Information obtained for vetting will be adjudicated by the APM-S, and/or designated appointees, who will have the final decision regarding access to the site and/or project materials and information. Reasonable requests to review information for accuracy will be met, but there is no appeal process for access decisions.

4.6. In accordance with the Privacy Act of 1974 information will not be shared outside of elements involved in the vetting process. The APM-S will not share the rationale for decisions prohibiting access to the construction site or project related information/materials.

4.7. Should approved contractor personnel have adverse contact with law enforcement following their initial provision of information for vetting, they must report the contact to the APM-S, or designee, immediately upon return to the work site for additional vetting.

5. Security Briefing

5.1. All personnel will receive a security briefing related to the protection of the construction site and project information/material from the APM-S, or designated appointee. Refresher training may be required annually.

5.2. Attendance is required for continued access to the construction site.

5.3. The briefing will last approximately one hour. At the conclusion of the briefing all personnel will be required to sign a U.S. Government provided NDA.

5.4. The security briefing may be supplemented or replaced by a written document, A-13 at the discretion of the APM-S.

5.5. Completion of the security briefing is a requirement for issuance of a construction site identification badge.

6. Badging Requirement

6.1. All approved personnel requiring access to the construction site will be provided with an access badge, will enter through the designated personnel gate, and are subject to search and inspection by designated U.S. Government personnel at any time.

6.2. The CSR shall create an access roster, alphabetically arranged by individual company containing each employees full name, badge number, badge expiration date, and provide the list to the APM-S and USACE. The roster shall be updated weekly by the CSR.

6.3. The access badge will be prominently displayed for ease of identification at all times on the construction site.

6.4. The access badge is the property of the U.S. Government and will be returned to the APM-S when an individual no longer requires or is removed from access.

6.5. Lost or stolen badges will be reported immediately to the CSSM.

6.6. Visitor Access; Notification must be made to the CSSM or designee at least two (2) business days in advance of any visitor to the site who is not on the access roster. Visitors to the construction site will be issued temporary visitor badges.

These badges will be returned to security personnel prior to departure from the construction site.

6.6.1 Exceptions to this requirement may be approved by the CSSM.

6.6.2. Visitor requests shall include the visitors name, date of birth, place of birth, and citizenship(s). All information obtained for the purpose of vetting personnel shall be protected in accordance with the Privacy Act of 1974.

6.6.3. Visitors will be required to furnish government issued identification in

A-14 exchange for a visitor badge. The identification will be returned at the end of the visit when the badge is returned.

6.7. At the conclusion of the construction phase, all badges shall be returned to the APM-S or designee.

7. Vehicle Access

7.1. All vehicles and equipment requiring access must enter through the designated construction vehicle gate and are subject to search and inspection by designated U.S. Government personnel at any time.

7.2. Personal vehicles can be parked in designated areas on the N2W construction site or off-site. Personnel bringing approved vehicles onto the construction site must possess a valid construction site badge and an approved vehicle pass.

7.3. Long-Term Construction Vehicles

7.3.1 The CSR shall compile a list of all contractor vehicles requiring regular access to the construction site for more than 30 days. The list shall provide vehicle description (make and model), company information, license tag information, contact information, and a brief justification for the need to access or park inside the construction site, as opposed to using other designated parking areas.

7.4. Vehicle Passes

7.4.1. Personnel bringing approved vehicles onto the construction site must possess a valid construction site badge and an approved vehicle pass.

7.4.2 Each vehicle entering the construction site requiring long-term access must be on the regular access vehicle list submitted by the CSR. The vehicle must display a valid vehicle pass in the lower left windshield area.

7.4.3. Long-term vehicle passes will be printed in color scheme approved by the APM-S to designate which company the vehicle is associated with and will include an expiration date.

7.4.4. Visitor vehicle passes will be printed in a color scheme approved by the

A-15

APM-S and are only issued with the approval of the CSSM.

7.4.5. All vehicle passes are to be stored out of sight when not on the construction site.

7.4.6. Vehicle passes must be surrendered to the CSR and/or CSSM or APM- S upon the expiration date.

7.4.7. Lost or stolen passes will be reported immediately to the CSR and CSSM.

7.4.8. Vehicles requiring access for approved deliveries will be issued a Temporary Vehicle Pass.

7.4.8.1. Delivery personnel may be required to surrender their Driver’s License in exchange for the pass.

7.4.8.2. Passes shall be returned upon exiting the construction site and the Driver’s License will be returned.

7.4.9. Random inspections will be conducted as deemed necessary by the CSSM.

7.5 Delivery Vehicles

7.5.1. A 24 hour advanced notice from the CSR or designee is required for all deliveries.

7.5.1.1. Notice will consist of vehicle(s) license plate information, driver’s name(s), and material/cargo information.

7.5.1.2. Exceptions to this requirement may be approved by the CSSM on a case-by-case basis.

7.5.1.3. Failure to provide advanced notice of a delivery may result in denial of access to the N2W construction site.

7.6. Delivery vehicles are subject to inspection at any time.

7.6.1. Discovery of prohibited items in a delivery vehicle or possessed by the

A-16 driver will result in the denial of access to the N2W construction site.

7.7. The U.S. Government is not responsible for costs associated with a denial of entry.

8. Reporting Requirements

8.1. All personnel are required to bring all security incidents, concerns, or suspected violations to the attention of the CSSM immediately.

8.2. Any requests for project information by the media or entities outside the project shall be referred immediately to USACE and the APM-S, or designated appointee.

9. Prohibited Items

9.1. There are certain items that are prohibited from introduction to the construction site. The following list will be provided to USACE and the CSR for distribution, and will be posted at the entry control point:

9.1.1. Firearms, weapons, and ammunition. Exceptions will be made for tool items, such as multi-tools with small blades. Powder actuated tools requiring the use of shells (such as .22 cartridges) or other charges must be submitted to the CSR who will forward the information to USACE and the CSSM for approval.

9.1.2. Explosives or incendiary devices, except as noted above.

9.1.3. Equipment capable of recording images; unless approved by the CSSM.

9.1.3.1. Photography on the site will only be conducted upon coordination and approval by the CSSM. All images are subject to review by the U.S. Government.

9.1.3.2. Cell phones with cameras will be permitted on the construction site;

however, personal photography is strictly prohibited.

9.1.3.3. Persons found using cameras or other image devices may be permanently removed from the construction site.

A-17

9.1.4. Personal or contractor owned laptops, tablets and removable memory devices are prohibited from being connected to any U.S. Government owned or provided systems or networks.

9.1.4.1. Computers required for construction purposes, will be permitted for use on the site upon approval and marking by the CSSM.

9.1.4.2. The CSSM will maintain an Approved Electronics Device List.

9.1.4.3. U.S. Government or contractor furnished laptops and tablets used for controlling, diagnosing or programing N2W building maintenance systems, networks or controllers will remain secured on site in the security office.

9.1.5. Illegal substances

9.1.6. Alcohol beverages

9.2 Individuals found in possession of prohibited items may be required to remove the item from site, the individual may be removed from site, and/or could be subject to disciplinary or legal action based on the nature of the item.

9.2.1. Possession of items in violation of local or federal law will necessitate the involvement of local law enforcement authorities.

9.2.2. Prohibited and Restricted Items lists are subject to review and change, with additional items added later. USACE and CSR will be advised of any changes made to these lists.

10. Key Control

10.1. Keys to the construction site will be maintained by the CSSM, or designated U.S. Government appointees.

10.2. Keys are not to be removed from the construction site.

10.3. Unauthorized removal of keys, loss, theft, or any other issue that leaves keys unaccounted for shall be reported to the CSSM immediately.

A-18

10.4. The CSSM will make the final determination related to mitigations and/or rekeying of locks.

11. Meetings

11.1. The APM-S will coordinate weekly, or as required, meetings that shall be attended by USACE, CSR and designated security representatives to assist identifying security issues and process updates.

12. Tool Storage

12.1. Contractors should be encouraged to store tools on site to eliminate the need to reintroduce and inspect these items daily.

12.2. Contractors are responsible for the securing/protection of the tools left on site.

12.3. The U.S. Government will not be responsible for lost or stolen tools on the work site.

12.4. Spaces designated for tool storage may be inspected by the U.S. Government security representatives.

13. Document Control

13.1. N2W project documents, materials, diagrams, drawings and plans are property of the U.S. Government and are considered sensitive but unclassified.

13.2. An alias project name will be utilized on project diagrams, drawings, plans, material/equipment ordering documents and shipping labels. Sensitive Compartmented Information (SCI) work/processing areas shall not be identified on diagrams drawings and plans.

13.3. Specific Electronic Security System (ESS) equipment or capabilities shall not be identified on building diagrams, drawings, and plans. ESS infrastructure such as power, conduit, and cable trays may be depicted on diagrams, drawings, and plans.

A-19

13.4. N2W project information (documentation, photographs, drawings, plans, and/or diagrams, etc.), electronic or hardcopy, shall not be used in marketing or advertising unless approved by the U.S. Government via the National Geospatial- Intelligence Agency (NGA) Public Release process.

13.5. Electronic N2W project information shall be stored and accessed by U.S.

Government personnel and contractors via the USACE virtual collaborative program workspace. All personnel will follow guidelines set forth by USACE to access the information.

13.6. Contractors are responsible for maintaining document control records for hardcopy N2W project information.

13.6.1. The contractor will identify document control personnel who will maintain records detailing accountability for all copies of provided documents. At a minimum the records must contain the names of all personnel provided the documents, document control number (if provided) and a detailed description of the documents provided.

13.6.2. The contractor’s document control personnel shall verify all documents are returned to their control when no longer needed.

13.6.3. All documents will be stored in a manner rendering them inaccessible to unauthorized personnel. The documents will be returned to the U.S. Government upon conclusion of the project or when no longer needed.

14. Temporary Secured Area(s) Lockdown Procedures

14.1. Lockdown is the process of gradually increasing the level of security at certain areas of the construction site to accommodate the initiation of work on data and communication systems that will be part of the finished facility. Lockdown is needed to prepare the facility for joint use and beneficial occupancy.

14.2. The lockdown stage involves securing, monitoring and certifying as a Secret collateral area or T-SCIF. The following requirements will be followed during this stage;

14.2.1. The APM-S in coordination with the AO will ensure the area is certified as

A-20 a Secret collateral area or T-SCIF prior to the installation of IT equipment. The area will be protected with an approved intrusion detection system monitored by on site security personnel. NPOs will respond to alarm activations.

14.2.2. Entry into this area is limited to personnel with the appropriate clearance level (confidential, secret, top secret) and or personnel escorted by Security Monitors

14.2.3. If non-cleared workers need to access to the lockdown area(s) they will be escorted at all times by security monitors. A lockdown visitor log will be filled out by the security monitor and maintained by the CSSM.

14.3. The CSSM will maintain a list of personal electronic devices (PED) prohibited in lockdown areas.

15. Acoustic Testing

15.1. Audio tests shall be conducted to verify sound group standards outlined in ICD/ICS 705 are achieved.

15.2. The AO has approved the use of instrumental acoustic testing to verify sound group standards are met.

15.3. Sound attenuation problems exposed during acoustic testing will be fixed and further testing will be conducted.

15.4. If issues still exist, mitigations will be coordinated with the AO and the

APM-S.

16. Protected Distribution System (PDS)

16.1. In accordance with CNSSI 7003 the APM-S, in coordination with the AO may authorize the installation of a PDS to facilitate the implementation IT Network testing and or phased occupation of the Main Office Building.

17. Emergency Situations

17.1. An incident may occur which will require an emergency response by NPOs

A-21 and/or local first responders (i.e. police, fire, EMS). During an emergency the CSSM or senior NPO will serve as the on-site authority for security decisions.

17.2. In the event of a fire the St. Louis Fire Department will be immediately notified via 911. Fire equipment and other emergency personnel will be allowed immediate, unimpeded, access to the fire site.

17.3. In the event of an injury requiring an emergency medical response, the St.

Louis Fire Department will be immediately notified via 911. Local first responders will be allowed immediate, unimpeded, access to the location of the person needing emergency medical treatment.

17.4. In the event of a bomb threat the CSSM will be notified. The CSSM will make the decision to stop work and/or evacuate the site. If evacuation is required all workers will be allowed to rapidly exit the work site.

17.5. In the event of an emergency the CSSM, APM-S, USACE, and CSR will be notified immediately.

17.6. CSSM will coordinate the development of an emergency action plan for the construction site with USACE.

18. Special Security Instructions (SSI)

18.1. SSIs will be developed and issued for security/police position(s) and/or post(s) on the N2W construction site.

18.2. SSIs will include call sign, post limits, roles and responsibilities, communications, required equipment, diagrams and security forms.

18.3. The objective of the SSIs is to provide detailed instructions and guidelines pertaining to the various areas of responsibility.

19. Construction Material Inspection

19.1. All materials are subject to inspection using various means by the U.S.

Government.

A-22

19.2. A Secure Staging Area (SSA) will be identified by the contractor and will be utilized when the Government requires a detailed inspection of construction material and equipment upon entering the site.

19.3. Some materials may require secure storage on site at the discretion of the

CSSM.

20. Accreditation Phase

20.1. SCIF or T-SCIF accreditation will be conducted in accordance with NGA NGA Physical Security Program.

21. Summary

21.1. The requirements in this CSP represent the minimum acceptable standards for the execution of the N2W project.

21.2. It is expected the N2W Program Management Office, USACE, and contractors will work together to overcome obstacles without compromising security, standards, or good business practices.

21.3. Security precautions are not intended to impede the progress of N2W construction. Any conflicting statements should be brought immediately to the attention of the APM-S and/or AO.

A-23