G1-005 Guide to the Preparation of Physical Security Briefs

Physical Security Guide
Lead Agency Publication   G1-005

Issued: October 1992
Revised: January 2000

Preface

1. Words in italics are explained or defined as they relate to this document (See Appendix C).
2. There are many types of buildings required by an institution which may or may not contain the building attributes listed in this document. This document is not written to identify a particular building type and is not all encompassing. The safeguards listed identify the requirements for security normally provided for general purpose office buildings (GPOB). However, many other buildings such as laboratories, court houses and medical facilities will have these attributes plus many other safeguards, in order to provide security sufficient to counter the threats identified.
3. The organization of the Government Security Policy (GSP) is based on the hierarchy of security documentation. In that volume, the words "policy", "standards" and "technical documentation" have the following meaning:
1. The GSP outlines the federal government policy on security and is comprised of broad principles and requirements for the security of sensitive information and assets.
2. The GSP also outlines operational security standards which comprise general guidelines and specific requirements for implementation of Security Organization & Administration, Physical Security, Information Technology Security, Personnel Security, Security and Contracting Management and Security and Contingency Management.
3. Technical documentation is comprised of detailed statements of guidance to help institutions to interpret and implement the operational security standards. They are approved and issued by the lead agencies for their respective responsibility areas.
4. The term "system" denotes combining the physical, information technology and personnel security into an integrated system to optimally counter established threats. This system, along with the security organization and administration make up an institution's security program consistent with the GSP. Consequently, physical security, information technology security, personnel security and security organization/administration, when individually considered, are subsystems of the security program.
5. The technical documentation, issued by the Royal Canadian Mounted Police (RCMP) as the lead agency on physical security, uses the same meaning as indicated in the GSP security program model for the words "system" and "subsystem". In addition, the words "element" and "safeguard" are used as follows:
1. An element is any component of target hardening (protection, detection and response) or of defensible space (demarcation, observation, clustering, territoriality and utilization) used in the physical security subsystem.
2. A safeguard is any security measure or equipment which provides protection, detection, response, demarcation, observation, clustering, territoriality and utilization.

Table of Contents

• 1.  Introduction
  • 1.1  General
  • 1.2  Security System Design Process
  • 1.3  Coordination
  • 1.4  Level of Detail
• 2.  Leasing Existing Facilities - Security Site Brief
  • 2.1  General
  • 2.2  Management Summary
  • 2.3  Minimum and Enhanced Safeguards (see Appendix A)
• 3.  Leasing Existing Facilities - Security Design Brief (Fit-up)
  • 3.1  General
  • 3.2  Management Summary
  • 3.3  Minimum and Enhanced Safeguards (see Appendix A)
• 4.  Constructing Facilities - Security Site Brief
  • 4.1  General
  • 4.2  Management Summary
  • 4.3  Minimum and Enhanced Safeguards (see Appendix A)
• 5.  Constructing Facilities - Security Design Brief
  • 5.1  General
  • 5.2  Management Summary
  • 5.3  Minimum and Enhanced Safeguards (see Appendix A)

• Appendix a - minimum and enhanced safeguards
• Appendix b - basic building security attributes for custodians
• Appendix c - glossary

1.  Introduction

1.1  General

1.1.1  Purpose

This document provides guidance for the preparation of security site and design briefs as required in the physical security standards.

1.1.2  Scope

This document provides general security guidelines to federal government institutions for all accommodations. Whether leasing or constructing, an institution needs only to be concerned with Chapters 2 and 3, or 4 and 5, in conjunction with the safeguards addressed at Appendix A.

Appendix B gives a partial list of basic building security attributes that custodians are usually required to implement, service and maintain. Appendix C consists of a glossary where a variety of terms used in this document are defined.

1.1.3  Application

This guide is for the use of institutions in order to comply with the Physical Security Operational Standards of the GSP.

1.1.4  Responsibilities

The responsibilities of custodians are outlined in Appendix B.

Pursuant to the GSP, the RCMP is the lead agency responsible for providing physical security consulting services and advice to institutions, on request. The RCMP will provide physical security consulting services and advice on each of the building project delivery phases.

Following the GSP policy statement that Deputy heads are accountable for safeguarding sensitive information and assets under their control, the Physical Security Operational Standard requires that the Departmental Security Officer (DSO), or representative, be responsible for preparing, reviewing, inspecting and monitoring the accommodation projects. For these reasons the present document is proposing to the DSO, or representative, a security system design process integrated to the building project delivery methodology. By being involved in each stage of the delivery process, from planning to evaluation, the DSO or representative will progressively specify and meet the physical safeguarding requirements without adversely affecting facility management and operations.

1.2  Security System Design Process

1.2.1

A security system is generally not effective unless it is developed based on an understanding of the actual threats and risks it is designed to control. The development of a threat and risk assessment (TRA) for a new facility involves the following steps:

• Preparation - determining what to protect,
• Threat assessment - determining what to protect against,
• Risk assessment - determining if existing or proposed security measures are satisfactory, and
• Recommendations - identifying what should be done.

In Figure 1 the preparation and threat assessment steps establish what is at stake with the eventual compromise of sensitive information and assets to be housed within the accommodation. Risk assessment measures the performance of existing safeguards in the designed environment against the identified threats. Recommendations define the applicable safeguarding strategy for the accommodation. The assessment is therefore generic in nature in order to specify the actual safeguards according to the conditions progressively established as the accommodation project evolves.

Figure 1 - Facility TRA Process

1.2.2

A safeguarding strategy should be defined and used with the present guide to develop a security site brief (SSB). This document sets out the security criteria to evaluate proposed sites, whether site acquisition is achieved through leasing an existing facility or constructing a facility.

The institution or tenant should prepare a SSB for leasing existing facilities (see Chapter 2), because custodians generally seek existing space as a first option. If it is determined that existing space is not available or is not the first option, then another SSB for constructing facilities should be prepared (see Chapter 4).

Once selected through a build, buy or lease process, the site is subjected to a survey to determine site specific security-related problems. These problems might include neighbourhood vandalism, theft or violent crime. This information is considered along with the facility TRA and allows the safeguarding strategy to be adjusted as required, and adequate safeguards to be developed for the site.

In some cases, the location of accommodation will be pre-selected without using a feasibility analysis which has the benefit of a security site brief. In these cases, the site selection criteria normally established in the SSB should be determined, and a safeguarding strategy should be identified with the use of the facility TRA and included in the security design brief (SDB).

1.2.3

The institution prepares architectural programming documents which includes conceptual space relation diagrams as part of the acquisition process. The development of complete and effective physical security can only result from a complete understanding of the facility operation (architectural programming documents), and the safeguarding strategy evolving from the facility TRA and site specific problems. Once this understanding is complete, a SDB is developed.

At this point a cost estimate for the physical security safeguards must be established. A simple rule of thumb suggests that the electronic security package would cost between .5% and 1% of the total cost of a large project. Small projects should not be evaluated by this general guideline as the proportions vary radically with the security requirements. Therefore, it is wise to develop the cost using a more reliable method specifically related to the facility at hand.

1.2.4

The project manager ensures that both the SSB and SDB form part of the architectural programming documents. From this document, the designer develops concept drawings. The DSO or representative reviews these drawings and compares them against the SSB and the SDB and safeguarding strategy. At this stage, the drawings can be changed extensively if necessary. This process continues until the concept drawings are approved.

1.2.5

The designer then completes the working drawings and specifications, and subsequent tendering documents detailing the eventual completed designs and all security-related equipment installations (see Figure 2). Once again, the DSO or representative should continuously examine the drawings, tender documents and subsequent contractor bids for compliance to the safeguarding strategy.

Figure 2 – Security System Design Process within the project delivery system

1.2.6

The DSO or representative should also monitor unique security aspects in installing the security equipment, making sure each step is approved before going on to the next. This process may also involve the administration of the security contracts. The DSO or representative may be asked to advise the contracting agent if progress payments should be made to the contractor.

1.2.7

The next step involves the commissioning of the security equipment which includes inputting all data necessary for operation. Operator training, if required, is included in this process. A transition period could exist where temporary security measures (perhaps temporary security personnel) may be necessary. Once fully operational, and all deficiencies have been corrected, the final payment, including all holdbacks, should be recommended. Only at this point should final payments be made to the contractor.

Once operational, there should be periodic verification to ensure all aspects of the project are operating properly.

Once the project is completed, when information and asset sensitivity or operations change, or following a security incident, the facility TRA is reviewed and a new safeguarding strategy may be identified which would require adjusting existing safeguards.

1.3  Coordination

Often, persons involved in the planning of a facility have not considered security. As a result, instances arise where appropriate types or levels of safeguards for leasing existing facilities or constructing facilities have been substandard or non existent. In many instances, even when planning efforts are directed towards security, problems arise through a lack of coordination, or from a breakdown in communication between the project leader/manager and the DSO or representative.

Institutions should establish clear paths of communication, through internal policy, between the security office and the planning office within the institution and with the project manager, to ensure that all security safeguards within a facility are properly and efficiently planned and implemented.

1.4  Level of Detail

The content of security site and design briefs will vary, depending on whether the department is leasing existing facilities or constructing facilities. The level of detail normally provided in site and design briefs is general in nature, in order to provide maximum flexibility in the acquisition or design process. Specific technical details about security equipment are not discussed in this guide (e.g. types of door hardware or intrusion alarms).

2.  Leasing Existing Facilities - Security Site Brief

2.1  General

The institution is responsible for determining, by referring to the safeguarding strategy established from the facility TRA, if a listed measure is justified or warranted. The listing of a security measure does not imply necessity or recommendation of the measure. These listed options are to be applied as and when justified by the specific security requirements.

Physical security measures are listed in three groups in this guide. Appendix A lists two distinct groups - the minimum and enhanced safeguards recommended by the RCMP when leasing accommodation. The institution has the option of assuming the additional risk associated with not providing the recommended measures. Enhanced safeguards are special purpose physical security measures which may or may not be justified for the institution. Their applicability should be determined in light of the safeguarding strategy established from the facility TRA as well as of other departmental priorities and requirements. Once selected the security measures are of necessity sought in a leasing document, but they will often only be provided during the fit-up of the facility.

Appendix B lists the basic security measures that are usually provided by the custodians in any facility under their control. Selection from this listing of measures is subject to approval by custodians.

Identification of the security measures will ensure that the custodian is aware of any space, service and functional requirements, in order that the selected site can accommodate all physical security safeguards.

2.2  Management Summary

Due to the length of these documents, it is preferable to have a two- to three-page summary included as part of the brief. The summary should only highlight the specific design concepts related to each major attribute listed in the brief. The intent is to assist senior managers in quickly capturing the important design ideas necessary for safeguarding the facility.

2.3  Minimum and Enhanced Safeguards (see Appendix A)

Refer to Appendix A for minimum and enhanced safeguards for the sections listed below, using the same numbering sequence.

LEGEND:  ** Usually this section would be part of the Security Design Brief (SDB).

• A.1  LIFE SAFETY AND EMERGENCIES
• A.1.1  Life Safety
• A.1.2  Emergency Power
• A.1.3  Fire Water Capacity
• A.1.4  Response Time for Firefighters and Police

• A.2  SITE
• A.2.1  Easements Through Site
• A.2.2  Perimeter Control of Site
• A.2.3  Perimeter Distance from Building
• A.2.4  Telecom and Data Links Outside the Facility
• A.2.5  Illumination of Site
• A.2.6  Landscaping
• A.2.7  Site Overview
• A.2.8  Adjacent Occupants
• A.2.9  Staff and Visitor Parking
• A.2.10  Building Location
• A.2.11  Exterior Circulation - Roadways
• A.2.12  Topography of the Site

• A.3  BUILDING DESIGN
• A.3.1  Physical Security Design Philosophy
• A.3.2  Security Design Concepts
• A.3.3  Perimeter of Building
• A.3.4  Compartmentalization **
• A.3.5  Elevator Lobbies
• A.3.6  Circulation Routes **
• A.3.7  Circulation - Persons and Equipment
• A.3.8  Pedestrian Control Within a Building
• A.3.9  Internal Circulation - Corridors **
• A.3.10  Zoning Within a Building **
• A.3.11  Location of Exit Stairwells
• A.3.12  Floor Loading Capacity
• A.3.13  Windows

• A.4  BUILDING LAYOUT
• A.4.1  Common Spaces **
• A.4.2  Washrooms
• A.4.3  Utility Spaces
• A.4.4  Mailrooms
• A.4.5  Food Services
• A.4.6  Loading Docks
• A.4.7  Telecom and Data Links Within the Facility **
• A.4.8  Conference and Board Rooms **
• A.4.9  Day-care Centres
• A.4.10  Special Purpose Space **

• A.5  BUILDING - SPECIAL REQUIREMENTS
• A.5.1  Electronic Access Control **
• A.5.2  Electronic Intrusion Detection **
• A.5.3  Closed Circuit Television / Video Equipment **
• A.5.4  Security Control Centre **
• A.5.5  Secure Rooms **
• A.5.6  Vaults
• A.5.7  Sensitive Discussion Areas **
• A.5.8  Computer Rooms
• A.5.9  Telecom and Data Links Within the Facility **

• A.6  FACILITY MANAGEMENT
• A.6.1  Leasing Contract
• A.6.2  Control of Access to Premises Within a Building
• A.6.3  Maintenance Services
• A.6.4  Cleaning Services
• A.6.5  Garbage Removal
• A.6.6  Classified Waste Destruction **
• A.6.7  Signs in Building Interior **
• A.6.8  Locking Hardware and Key Control
• A.6.9  Renovation Work Outside Public-Access Hours

3.  Leasing Existing Facilities - Security Design Brief (Fit-up)

3.1  General

Security measures already documented in a site brief and implemented need not be repeated in the design brief. However, if no site brief has been submitted, it is up to the institution to determine, by reference to the safeguarding strategy established from the facility TRA and site specific deficiencies, if a listed measure is justified or warranted. The listing of a security measure does not imply necessity or recommendation of the measure. These listed options are to be applied as and when justified by the specific security requirements.

Physical security measures are listed in three groups in this guide. Appendix A lists two - the minimum and enhanced safeguards recommended by the RCMP when leasing accommodation. The institution has the option of assuming the additional risk associated with not providing the recommended measures. Enhanced safeguards are special purpose physical security measures which may or may not be justified for the institution. Their applicability should be determined in light of the safeguarding strategy established from the facility TRA as well as of other departmental priorities and requirements. Once selected the security measures are of necessity sought in a leasing document, but they will often only be provided during the fit-up of the facility.

Appendix B lists the basic security measures that are usually provided by the custodian in any facility under their control. Selection from this listing of measures is subject to approval by custodians.

Identification of the security measures will ensure that the custodian is aware of any space, service and functional requirements, in order that the selected site can accommodate all physical security safeguards.

3.2  Management Summary

Due to the length of these documents, it is preferable to have a two- to three-page summary included as part of the brief. The summary should only highlight the specific design concepts related to each major attribute listed in the brief. The intent is to assist senior managers in quickly capturing the important design ideas necessary for safeguarding the facility.

3.3  Minimum and Enhanced Safeguards (see Appendix A)

Refer to Appendix A for minimum and enhanced safeguards for the sections listed below, using the same numbering sequence.

LEGEND:  *** Usually this section would be part of the Security Design Brief (SDB). If a SSB has not been prepared, then this section forms part of the Security Design Brief (SDB).

• A.1  LIFE SAFETY AND EMERGENCIES
• A.1.1  Life Safety ***
• A.1.2  Emergency Power ***
• A.1.3  Fire Water Capacity ***
• A.1.4  Response Time for Firefighters and Police ***

• A.2  SITE
• A.2.1  Easements Through Site ***
• A.2.2  Perimeter Control of Site ***
• A.2.3  Perimeter Distance from Building ***
• A.2.4  Telecom and Data Links Outside the Facility ***
• A.2.5  Illumination of Site ***
• A.2.6  Landscaping ***
• A.2.7  Site Overview ***
• A.2.8  Adjacent Occupants ***
• A.2.9  Staff and Visitor Parking ***
• A.2.10  Building Location ***
• A.2.11  Exterior Circulation - Roadways ***
• A.2.12  Topography of the Site ***

• A.3  BUILDING DESIGN
• A.3.1  Physical Security Design Philosophy ***
• A.3.2  Security Design Concepts ***
• A.3.3  Perimeter of Building ***
• A.3.4  Compartmentalization
• A.3.5  Elevator Lobbies ***
• A.3.6  Circulation Routes
• A.3.7  Circulation - Persons and Equipment ***
• A.3.8  Pedestrian Control Within a Building ***
• A.3.9  Internal Circulation - Corridors
• A.3.10  Zoning Within a Building
• A.3.11  Location of Exit Stairwells ***
• A.3.12  Floor Loading Capacity ***
• A.3.13  Windows ***

• A.4  BUILDING LAYOUT
• A.4.1  Common Spaces
• A.4.2  Washrooms ***
• A.4.3  Utility Spaces ***
• A.4.4  Mailrooms ***
• A.4.5  Food Services ***
• A.4.6  Loading Docks ***
• A.4.7  Telecom and Data Links Within the Facility
• A.4.8  Conference and Board Rooms
• A.4.9  Day-care Centres ***
• A.4.10  Special Purpose Space

• A.5  BUILDING - SPECIAL REQUIREMENTS
• A.5.1  Electronic Access Control
• A.5.2  Electronic Intrusion Detection
• A.5.3  Closed Circuit Television / Video Equipment
• A.5.4  Security Control Centre
• A.5.5  Secure Rooms
• A.5.6  Vaults ***
• A.5.7  Sensitive Discussion Areas
• A.5.8  Computer Rooms ***
• A.5.9  Telecom and Data Links Within the Facility

• A.6  FACILITY MANAGEMENT
• A.6.1  Leasing Contract ***
• A.6.2  Control of Access to Premises Within a Building ***
• A.6.3  Maintenance Services ***
• A.6.4  Cleaning Services ***
• A.6.5  Garbage Removal ***
• A.6.6  Classified Waste Destruction
• A.6.7  Signs in Building Interior
• A.6.8  Locking Hardware and Key Control ***
• A.6.9  Renovation Work Outside Public-Access Hours ***

4.  Constructing Facilities - Security Site Brief

4.1  General

It is up to the institution to determine, by reference to the safeguarding strategy established from the facility TRA, if a listed measure is justified or warranted. The listing of a security measure does not imply necessity or recommendation of the measure. These listed options are to be applied as and when justified by the specific security requirements.

Physical security measures are listed in three groups in this guide. Appendix A lists two - the minimum and enhanced safeguards recommended by the RCMP when leasing accommodation. The institution has the option of assuming the additional risk associated with not providing the recommended measures. Enhanced safeguards are special purpose physical security measures which may or may not be justified for the institution. Their applicability should be determined in light of the safeguarding strategy established from the facility TRA as well as of other departmental priorities and requirements. Once selected the security measures are of necessity sought in a leasing document, but they will often only be provided during the fit-up of the facility.

Appendix B lists the basic security measures that are usually provided by the custodian in any facility under their control. Selection from this listing of measures is subject to approval by custodians.

Identification of the security measures will ensure that the custodian is aware of any space, service and functional requirements, in order that the selected site can accommodate all physical security safeguards.

4.2  Management Summary

Due to the length of these documents, it is preferable to have a two- to three-page summary included as part of the brief. The summary should only highlight the specific design concepts related to each major attribute listed in the brief. The intent is to assist senior managers in quickly capturing the important design ideas necessary for safeguarding the facility.

4.3  Minimum and Enhanced Safeguards (see Appendix A)

LEGEND:  **** Usually this section would be part of the Security Design Brief (SDB).

• A.1  LIFE SAFETY AND EMERGENCIES
• A.1.1  Life Safety ****
• A.1.2  Emergency Power ****
• A.1.3  Fire Water Capacity ****
• A.1.4  Response Time for Firefighters and Police

• A.2  SITE
• A.2.1  Easements Through Site
• A.2.2  Perimeter Control of Site
• A.2.3  Perimeter Distance from Building
• A.2.4  Telecom and Data Links Outside the Facility
• A.2.5  Illumination of Site ****
• A.2.6  Landscaping ****
• A.2.7  Site Overview
• A.2.8  Adjacent Occupants
• A.2.9  Staff and Visitor Parking ****
• A.2.10  Building Location
• A.2.11  Exterior Circulation - Roadways
• A.2.12  Topography of the Site

• A.3  BUILDING DESIGN
• A.3.1  Physical Security Design Philosophy ****
• A.3.2  Security Design Concepts ****
• A.3.3  Perimeter of Building ****
• A.3.4  Compartmentalization ****
• A.3.5  Elevator Lobbies ****
• A.3.6  Circulation Routes ****
• A.3.7  Circulation - Persons and Equipment ****
• A.3.8  Pedestrian Control Within a Building ****
• A.3.9  Internal Circulation - Corridors ****
• A.3.10  Zoning Within a Building ****
• A.3.11  Location of Exit Stairwells ****
• A.3.12  Floor Loading Capacity ****
• A.3.13  Windows ****

• A.4  BUILDING LAYOUT
• A.4.1  Common Spaces ****
• A.4.2  Washrooms ****
• A.4.3  Utility Spaces ****
• A.4.4  Mailrooms ****
• A.4.5  Food Services ****
• A.4.6  Loading Docks ****
• A.4.7  Telecom and Data Links Within the Facility ****
• A.4.8  Conference and Board Rooms ****
• A.4.9  Day-care Centres ****
• A.4.10  Special Purpose Space ****

• A.5  BUILDING - SPECIAL REQUIREMENTS
• A.5.1  Electronic Access Control ****
• A.5.2  Electronic Intrusion Detection ****
• A.5.3  Closed Circuit Television / Video Equipment ****
• A.5.4  Security Control Centre ****
• A.5.5  Secure Rooms ****
• A.5.6  Vaults ****
• A.5.7  Sensitive Discussion Areas ****
• A.5.8  Computer Rooms ****
• A.5.9  Telecom and Data Links Within the Facility ****

• A.6  FACILITY MANAGEMENT
• A.6.1  Leasing Contract ****
• A.6.2  Control of Access to Premises Within a Building ****
• A.6.3  Maintenance Services ****
• A.6.4  Cleaning Services ****
• A.6.5  Garbage Removal ****
• A.6.6  Classified Waste Destruction ****
• A.6.7  Signs in Building Interior ****
• A.6.8  Locking Hardware and Key Control ****
• A.6.9  Renovation Work Outside Public-Access Hours ****

5.  Constructing Facilities - Security Design Brief

5.1  General

Security measures already documented in a site brief and implemented need not be repeated in the design brief. However, if no site brief has been submitted, it is up to the institution to determine, by reference to the safeguarding strategy established from the facility TRA and site specific deficiencies, if a listed measure is justified or warranted. The listing of a security measure does not imply necessity or recommendation of the measure. These listed options are to be applied as and when justified by the specific security requirements.

Physical security measures are listed in three groups in this guide. Appendix A lists two - the minimum and enhanced safeguards recommended by the RCMP when leasing accommodation. The institution has the option of assuming the additional risk associated with not providing the recommended measures. Enhanced safeguards are special purpose physical security measures which may or may not be justified for the institution. Their applicability should be determined in light of the safeguarding strategy established from the facility TRA as well as of other departmental priorities and requirements. Once selected the security measures are of necessity sought in a leasing document, but they will often only be provided during the fit-up of the facility.

Appendix B lists the basic security measures that are usually provided by the custodian in any facility under their control. Selection from this listing of measures is subject to approval by custodians.

Identification of the security measures will ensure that the custodian is aware of any space, service and functional requirements, in order that the selected site can accommodate all physical security safeguards.

5.2  Management Summary

Due to the length of these documents, it is preferable to have a two- to three-page summary included as part of the brief. The summary should only highlight the specific design concepts related to each major attribute listed in the brief. The intent is to assist senior managers in quickly capturing the important design ideas necessary for safeguarding the facility.

5.3  Minimum and Enhanced Safeguards (see Appendix A)

Refer to Appendix A for minimum and enhanced safeguards for the sections listed below, using the same numbering sequence.

LEGEND:  ***** Usually this section would be part of the Security Design Brief (SDB). If a SSB has not been prepared, then this section forms part of the Security Design Brief (SDB).

• A.1  LIFE SAFETY AND EMERGENCIES
• A.1.1  Life Safety
• A.1.2  Emergency Power
• A.1.3  Fire Water Capacity
• A.1.4  Response Time for Firefighters and Police *****

• A.2  SITE
• A.2.1  Easements Through Site *****
• A.2.2  Perimeter Control of Site *****
• A.2.3  Perimeter Distance from Building *****
• A.2.4  Telecom and Data Links Outside the Facility *****
• A.2.5  Illumination of Site
• A.2.6  Landscaping
• A.2.7  Site Overview *****
• A.2.8  Adjacent Occupants *****
• A.2.9  Staff and Visitor Parking
• A.2.10  Building Location *****
• A.2.11  Exterior Circulation - Roadways *****
• A.2.12  Topography of the Site *****

• A.3  BUILDING DESIGN
• A.3.1  Physical Security Design Philosophy
• A.3.2  Security Design Concepts
• A.3.3  Perimeter of Building
• A.3.4  Compartmentalization
• A.3.5  Elevator Lobbies
• A.3.6  Circulation Routes
• A.3.7  Circulation - Persons and Equipment
• A.3.8  Pedestrian Control Within a Building
• A.3.9  Internal Circulation - Corridors
• A.3.10  Zoning Within a Building
• A.3.11  Location of Exit Stairwells
• A.3.12  Floor Loading Capacity
• A.3.13  Windows

• A.4  BUILDING LAYOUT
• A.4.1  Common Spaces
• A.4.2  Washrooms
• A.4.3  Utility Spaces
• A.4.4  Mailrooms
• A.4.5  Food Services
• A.4.6  Loading Docks
• A.4.7  Telecom and Data Links Within the Facility
• A.4.8  Conference and Board Rooms
• A.4.9  Day-care Centres
• A.4.10  Special Purpose Space

• A.5  BUILDING - SPECIAL REQUIREMENTS
• A.5.1  Electronic Access Control
• A.5.2  Electronic Intrusion Detection
• A.5.3  Closed Circuit Television / Video Equipment
• A.5.4  Security Control Centre
• A.5.5  Secure Rooms
• A.5.6  Vaults
• A.5.7  Sensitive Discussion Areas
• A.5.8  Computer Rooms
• A.5.9  Telecom and Data Links Within the Facility

• A.6  FACILITY MANAGEMENT
• A.6.1  Leasing Contract *****
• A.6.2  Control of Access to Premises Within a Building
• A.6.3  Maintenance Services
• A.6.4  Cleaning Services
• A.6.5  Garbage Removal
• A.6.6  Classified Waste Destruction
• A.6.7  Signs in Building Interior
• A.6.8  Locking Hardware and Key Control
• A.6.9  Renovation Work Outside Public-Access Hours

Appendix A - minimum and enhanced safeguards

A.1  Life Safety and Emergencies

A.1.1  Life Safety

Minimum Safeguards

All new facilities must conform to applicable building codes regarding life safety, e.g., fire safety, exiting, alarms, smoke control, safe havens. All life safety concerns should take precedence over any security standards and recommendations. This responsibility for federally-owned facilities lies with Human Resources Development Canada, Fire Prevention, Fire Protection Engineering Services. Life safety is controlled by provincial authorities for facilities owned and operated by the private sector. Municipalities usually administer provincial codes.

There are a number of areas in the National Building Code (NBC) which have a security connotation. Particular attention should be given to the hardware requirements, especially Section 3.4.6.15(1) of the 1995 NBC.

All existing facilities are reviewed periodically for compliance. Barrier free issues that have an impact on security should be identified and resolved during the conceptual design stage. This review includes recommendations as to whether deficiencies can be corrected, or whether compensating features or operations can be added in lieu of conformity. Life safety equipment is inspected and tested at required intervals. Older facilities may be governed by codes that were in force at the time they were built or remodelled, and which were less stringent than those now in force. In these cases, a decision will be needed as to whether this provides sufficient safety under current conditions. Sprinklers are generally provided if required by the code applicable due to building type, design or materials, or to hazardous contents.

Examples of Enhanced Safeguards

• Sprinklers or other fire protection required to protect persons or other valuable assets.
• Regulations for high-rise buildings (e.g. stairwell doors to cross-over floors must be left unlocked) requires placement of a functional operation to a level not used as a cross-over floor.
• Panic alarms and/or video equipment in high risk areas.
• Providing fire refuge areas in high-rise buildings.

A.1.2  Emergency Power

Minimum Safeguards

Emergency power appropriate to the facility for basic building services - heating, partial elevator service, emergency lighting, etc., with at least 12 hours of fuel supply (72 hours at isolated locations). Provide emergency power or battery packs for emergency exit lighting, and for four hours operation of installed electronic intrusion detection.

Examples of Enhanced Safeguards

• Emergency power to selected tenant equipment.
• Uninterruptible power supply for security computer and other selected computer equipment.
• Emergency power for specific tenant operation.
• In urban areas, additional capacity to fuel tanks for emergency generators, to extend running time, e.g. from minimum of 12 hours to 72 hours.

A.1.3  Fire Water Capacity

Minimum Safeguards

Ensure that municipal water supply to site has sufficient volume and pressure for firefighting. Where municipal supply does not exist there should be a reservoir and fire pump or sufficient static head on site; sufficient capacity means appropriate to size and combustibility of building and contents (measured in minutes of full discharge rate). Provide a sufficient number of water pumps where water pressure is unreliable.

Examples of Enhanced Safeguards

• Yard hydrants on-site at locations convenient to fire-access lanes.
• Emergency generator to power fire booster pumps.

A.1.4  Response Time for Firefighters and Police

Minimum Safeguards

Firefighters response -The NBC requires that fire detection and response equipment be operational 24 hours a day. If the safeguarding strategy indicates response time is inadequate, compensatory steps that will be the most cost effective should be taken.

Police response - The basic level of security is determined from (a) the probability of a police response of sufficient short duration that the physical security measures can reasonably be expected to counter the threats, and (b) the inherent psychological deterrence of a facility that is locked during restricted and limited access hours.

Examples of Enhanced Safeguards

Firefighters

• Enhanced fire alarm to speed firefighters response, e.g. by direct link to fire hall or central alarm agency.
• Fire sprinkler or other extinguishing equipment, if not already provided.
• Two-stage fire alarm.
• Guard or commissionaire service either during restricted and limited access hours, or 24 hours.

Police

• Establish beforehand with the police what to do in the event of an emergency
• Measures to delay an intruder, e.g. multiple locked entry-ways to go through
• Electronic intrusion detection to notify building security or central alarm agency.
• ULC monitoring or commissionaire service either during limited access hours, or 24 hours.
• On-site accommodation for an effective response force (e.g. police detachment at an airport).

A.2  Site

A.2.1  Easements Through Site

Minimum Safeguards

Easements should not be permitted closer than 15 m from the building. Institutions are to be informed by the custodian of the possibility of intrusion on the site by an easement owner (e.g. utility crews sent to replace or repair overhead lines, or excavations to repair or replace underground utilities), without advance notice to the occupants. If an easement permits public access through the site, e.g. in an emergency, the institution must be informed and agree with the requirement prior to occupancy.

Examples of Enhanced Safeguards

• Fenced yard, locked, with utility crews gaining entry only by advanced notice.
• No easement areas within fenced yard.
• Utility personnel granted access to site only when accompanied by institution or building security personnel.
• Emergency access under control of institution or building security personnel once all safety factors have been considered.

A.2.2  Perimeter Control of Site

Minimum Safeguards

The site is to be signed with the name of the government institution clearly displayed.

During public access hours there is no restriction on access to the site or to the Public-Access Zone of the building.

During limited-access hours there is no restriction on access to the site but the building is locked. Signs provide clear directions, and define the public and restricted areas of the site.

Examples of Enhanced Safeguards

• No signs indicate the name of the institution.
• Fencing of portions of site with locked gate.
• Fencing of entire site with gate attended during public and restricted access hours.
• Fencing to be a specified distance from the facility.
• Monitoring by patrol or remote cameras during limited access hours.
• Fencing with gate attended during public and restricted access hours, and key device during limited access hours for automobiles and pedestrians.
• Motion detectors within the perimeter encircled by the fence.
• Fencing, single or double line, with intrusion alarm and/or motion detectors.
• Illumination of site.
• Low reflection fence, e.g. coated with dark, non-reflective material.

A.2.3  Perimeter Distance from Building

Minimum Safeguards

Except for easements, the facility may have to abut the property line, a street or the wall of an adjacent building on some sites.

Examples of Enhanced Safeguards

• Allow sufficient distance from the site perimeter to the building wall to prevent unauthorized access on foot from neighbouring facilities, without being observed.
• Crossing from an adjacent roof should be observable, and difficult without bridging tools (e.g. for an adjacent roof of similar height and a gap of less than 4 m, provide a smooth high fence at roof edge.)
• Distance and possible grade change or other obstacles sufficient to delay an intruder for a specified time.
• Distance and terrain sufficient to deter technical intrusion, e.g. electronic or acoustic.
• Not permitting vehicles to come within three metres of the building face.
• Distance sufficient to provide fencing with all necessary security features.
• Allow sufficient distance from building face to install fence lines or exterior intrusion detection equipment.

A.2.4  Telecom and Data Links Outside the Facility

Minimum Safeguards

Refer to the GSP, Information Technology Security Standards, and the Technical Security Standards for Information Technology (TSSIT) - RCMP-Aug. 1997.

Examples of Enhanced Safeguards

• All cabling underground through site.
• Cabling underground beyond site.
• Locking of access points to underground vaults containing sensitive cabling.
• Redundant second service on opposite side of site from normal main service, to a different telephone "central office" from normal service.
• Laser communication links.
• Alternative communication links using encrypted microwave along safeguarded paths.
• Government-approved encryption (Consultation with the COMSEC authority required)

A.2.5  Illumination of Site

Minimum Safeguards

Provide general illumination of the entire perimeter of the building, driveways, and parking lots, to a target level of 25 lux (20 lux minimum). (A lux is a metric measurement of light equal to the illumination on the surface of all points one metre from a uniform light source. One lux equals approximately one-tenth of a foot-candle). Lighting sources may be street lighting, yard lighting or building-mounted lighting, or combinations of all three. Maximum contrast of darkest to brightest illumination is a ratio of one to ten. (i.e. if darkest is 25 lux, then highest level should not exceed 250 lux).

Where the building abuts the property line, with private property on the other side, that private property should not be illuminated if its owner so requests.

Examples of Enhanced Safeguards

• Solar-activated light sources to compensate for summer and winter hours, especially if video equipment is used.
• Security lighting, in order to obtain increased light intensity or a specialized colour spectrum, or both, for identification or for closed-circuit video equipment applications.
• Illumination of the additional portions of the site to 25 lux.
• Illumination at the site fence line.
• Low reflection fence, e.g. coated with dark, non-reflective material.
• Lighting at staff entrances and exits used after hours to a minimum of 50 lux, but not more than 200 lux.
• Wall-mounted light fixtures (3 m - 4 m high) shining on light wall surfaces, so that a person moving on the site would cast a large, long shadow.
• Tamper-resistant lighting fixtures.
• Security lighting positioned to prevent deep shadows from the building or vegetation, so an intruder could be noticed.
• When using video cameras, providing a minimum of 50 lux reflected light. Consult a lighting engineer when using colour video cameras for correct light sources and their appropriate colour rendition index.
• If colour rendition is a requirement, ensure the correct type of lighting is used.

A.2.6  Landscaping

Minimum Safeguards

Provide a clear space of six metres around the building and on both sides of paths between building(s) and parking areas, sidewalk and public transportation stops. Avoid bushes or branches that enable a person to hide. The zone between 400 mm and 1,500 mm above grade should be clear of all visual obstructions. If snow is piled on the site or if grass and shrubs are allowed to grow wild, ensure there is no visual impediment, that response forces are not delayed, and that access cannot be gained into or on top of the building.

Examples of Enhanced Safeguards

• Landscaping to be restricted to low ground cover, or deciduous trees with high branches, giving clear view of site at eye level, for a person standing, seated in a car or van, or viewing on video equipment, i.e. from 300 mm up to 2,000 mm.
• Fence fabric to resist ice build-up affecting perimeter alarm equipment.
• Landscaping features to prevent vehicle access to a facility. Berms or changes in elevation, such as retaining walls, to direct the flow of people and vehicles past observation points, or to establish the perimeter of a site.
• Psychological barriers such as elevation, material or colour changes, concrete curbs, etc.
• Securing objects such as paving bricks, stones, rocks, benches, tables, etc. to ensure they cannot be used as projectiles.

A.2.7  Site Overview

Minimum Safeguards

Building facades and the site should be observable from the roadway by local police and passers-by, unless deemed undesirable when considering the safeguarding strategy.

Examples of Enhanced Safeguards

• Site where surrounding buildings or terrain does not permit overview of building(s), or depending on the plan for security at a given site, overview for guard patrols may be required.
• For the restricted zones, selecting only upper floors in a building where surrounding buildings or terrain do not permit looking down at, or straight into, those floors.
• Site selected where overview exists from several directions, and neighbours can report abnormal events.

A.2.8  Adjacent Occupants

Minimum Safeguards

In single or multi-tenant buildings, access to an institution's space should be controlled.

Examples of Enhanced Safeguards

• Leasing document to provide for extra security measures to be installed at custodian's expense if specified tenants (justified by the safeguarding strategy) are located in the facility.
• Prior to site selection, right of way access and parking which could influence access to the site are to be evaluated.
• Prior to site selection, the prospective government tenant should list neighbouring activities and groups that would be unacceptable.
• Leasing documents to ensure a single tenant occupancy of the building or floor.

A.2.9  Staff and Visitor Parking

Minimum Safeguards

During limited access hours, parking locations designated by signs should indicate visitor and staff parking areas. Elevators to and from indoor parking should not give direct access to office floors. Instead, elevators should open to the main lobby, in view of the reception or guard station, or if there is no attended station, into an open traffic zone in the lobby. During limited access hours, staff access to indoor parking should be only by key, or by guard control.

Proper placement of the staff parking facility may have a significant bearing on the amount of use of emergency exit doors; for example, if they conveniently open onto the parking lot one can anticipate frequent use. The more often the emergency exit door is used, the less security personnel will rely on monitoring equipment, with response becoming progressively less reliable. When an exit door is used it is very difficult to prevent someone from entering the facility while another is exiting. The entrant may or may not be an employee of your facility. Also, if personnel can find logical reasons for circumventing physical security safeguards the less respect they will have for restrictions imposed to make physical security function.

Visitor parking should allow visitors easy orientation to the main entrance. Because of potential obstruction problems, space should not be provided directly on the main circulation route for parking, pulling over, stopping or as a drop-off point, at main or side entrances.

Examples of Enhanced Safeguards

• Card-reader access for designated staff parking.
• Indoor parking with attended control station.
• Outdoor parking with attended control station.
• Fenced outdoor storage area for parking of government-owned vehicles.
• Open-mesh fencing coated with dark, non-reflective material.
• Video monitoring of parking areas by unattended videotape recording or security personnel.
• Increased lighting requirements for personnel security.
• Electronic access control or parking attendant.
• Fence around the perimeter of surface parking lots.
• Direct view of parking areas from a control point.

A.2.10  Building Location

Minimum Safeguards

The building will not be located in a manner which will produce undue natural or man-made hazards.

Examples of Enhanced Safeguards

• Building location for easy access by an emergency response force in all weather conditions.
• Natural surveillance by automobiles or pedestrians.
• Visually shield the facility with a solid fence.
• Locate the facility on a corner to provide two emergency access routes for essential services, such as the local police.
• Locate the building on the site such that security for building services can be assured.
• Communication lines (telephone, data, etc.), power lines, energy supply lines (oil, gas), water and sewage pipes to be physically protected.

A.2.11  Exterior Circulation - Roadways

Minimum Safeguards

Visitors should be able to easily determine where to go and how to get there. Clear definition of entry will reduce confusion thereby enhancing legitimate access. Where access is not apparent, signs will direct the public. Signs will reduce the number of times employees will be distracted by giving directions to a visitor. Rather than redirecting visitors to the main entrance, employees often send visitors through the facility to the proper entry point to receive the requisite badges, etc. Proper identification of the requirements will lessen the number of incidents of this nature.

Examples of Enhanced Safeguards

• Driveways and vehicle routing encircling the facility to enhance natural surveillance of the building.
• Vehicle circulation routes not easily accessed from the emergency exits, as someone could easily slip out of the facility and drop something into an accomplice's vehicle.

A.2.12  Topography of the Site

Minimum Safeguards

Security measures which compensate for site specific deficiencies are to be provided in this section.

Examples of Enhanced Safeguards

• If surveillance of the site is necessary, do not locate the facility in lowlands or areas where fog is common.
• Do not locate facilities on flood plains.
• Utilize gullies or valleys as a barrier to control access onto the site.

A.3  Building Design

A.3.1  Physical Security Design Philosophy

The general physical security design standard advocated by the GSP is developed from the physical security elements of protection, detection, response, demarcation, observation, clustering, territoriality and utilization. Therefore, the environment for the facility functions should be identified and stated. If physical security is to be very stringent to compensate for vulnerabilities, a statement to that effect should start the design section. The general philosophy of the government is to favour compartmentalization. Specifics that are unique to the way that compartmentalization is to be achieved are addressed in this chapter.

Progressively restrictive zones are to be used in the development of physical security ranging from Public-Access Zones to Security Zones (and exceptionally to High-Security Zones). For example, in this section it could be stated that the proposed facility will have "X" number of functional groups. Functional groups that process "A" commodity will generally be allocated to Restricted Zones, and those groups which store certain assets generally fall into Operation Zones, etc.

Unique considerations to take into account in all restricted zone planning should be identified. One such requirement is to have access to, and emergency egress routes from, a more restrictive zone through a less restrictive zone. It is preferable to use architectural design to achieve the objectives, rather than having to install security equipment to solve a security problem created by poor design. One example is locating common service areas in centralized locations, with circulation to them through Operations Zones, to avoid having employees travelling through other restricted areas.

A.3.2  Security Design Concepts

Physical security should be designed using an interactive method, incorporating the elements of protection, detection, response, demarcation, observation, clustering, territoriality and utilization. The concept of defensible space should be applied where opportunistic and accidental threats are expected to materialize. This implies the use of five strategies: demarcation, observation, clustering, territoriality and utilization. Oscar Newman's book, Defensible Space, provides a detailed look at these strategies.

Where premeditated threats are likely, the Target Hardening principles integrating protection , detection and response should be used. Protection can include both physical and psychological barriers, using a variety of materials in different combinations. Detection can include both electromechanical and manual safeguards. Responses are usually manual but they can be automatic. Other accepted methods of protecting assets include: dividing the target, such as creating several registries; exposing the target, such as placing a safe in the front window of a retail outlet, and relying on passers-by as a deterrent; hiding the target, such as positioning a safe behind a picture in a room; combining information assets to create such a volume of material that the specific target cannot be located; and placing a target behind many barriers and forcing an adversary to penetrate each one using different methods.

By combining the concepts of target hardening and defensible space, strategies for crime prevention through environmental design are developed. This idea allows security designers to create an environment where employees are naturally integrated and used to support the security program. In addition, crimes are prevented by application of direct controls.

A.3.3  Perimeter of Building

Minimum Safeguards

Total building secured at grade level by locked doors, using heavy duty commercial hardware (locks, hinges, etc.). All windows either fixed or locked with heavy duty commercial hardware at all levels. Roof access door or roof hatch locked with heavy duty commercial hardware. Air intake sufficiently remote from air exhaust.

Examples of Enhanced Safeguards

• Grade level doors and windows alarmed for opening or breakage.
• Security patrol.
• Video monitoring with single or multiple cameras, either videotaped, monitored by security personnel, or both.
• All glass windows within three metres of grade fitted with bars, with vandal-resistant glazing or set in frames with a maximum width of 15 mm to prevent a person from passing through.
• The institution requiring entry security controls should be located in a single tenant facility, or in a facility where other government departments present require the same level of security at entry.
• Institutions requiring entry security controls may not be suited for a multi-tenant building that has private tenants who may not want entry controls.
• If the threat warrants, all windows visible from off-site to be fitted with bullet-resistant glazing.
• Locate and screen air intakes to inhibit placement of smoke, tear gas or other offensive substances.

A.3.4  Compartmentalization

It is important to suitably control the movement of visitors and non-staff within a facility. Staff movement should also be controlled.

Compartmentalization of single or multiple areas is crucial to the control of staff and visitor movement, and is necessary if control points are to be effective. Control points could be a receptionist or a locked door. Each directorate, branch or section should be capable of being compartmentalized either horizontally or vertically. Vertical compartmentalization of spaces requires controls of the vertical circulation routes (stairways, elevators etc.) and may create some life safety problems not inherent in horizontal compartmentalization. The architectural programming documents would specify the relationships of each compartment.

A.3.5  Elevator Lobbies

Minimum Safeguards

In all buildings, elevators (including freight elevators from public parking and loading dock areas) should open in a Public-Access or Reception Zone, e.g. ground floor elevator lobby.

However, uncontrolled opening of an elevator into the elevator lobby (i.e. a Public-Access or Reception Zone) on an institution's floor is permitted, if access to the floor is continuously monitored by the institution, or if the floor is secure at all times.

On multi-tenant floors, all of the following should be accessed from the elevator lobby by the public without leaving the Public-Access Zone:

• means of egress
• public toilets, and
• the Reception Zone of institutions.

On floors having only a single institution, access to toilets and exit stairs may or may not be from the Public-Access Zone. The security site brief should specify that access to washrooms may or may not be from an Operations Zone.

Examples of Enhanced Safeguards

• Elevator lobbies connecting stairs and toilets on all floors are in the Public-Access Zone.
• During restricted or limited access hours, operation of elevators is controlled by the entry control desk.
• Elevators do not open on any or all institution floors, unless persons who use the elevator have been granted access by the entry control desk, or have a key, card or other access device.

A.3.6  Circulation Routes

Minimum Safeguards

Circulation routes from Public-Access to Operations Zones should pass through a Reception Zone under the institution's control. Within the institution's Operations Zones there should be no circulation routes for public access, even in an emergency. All stairs required as a means of egress for Public-Access Zones should be located in the Public-Access Zones. All exit doors forming part of a means of egress from restricted zones to Public-Access Zones should be equipped with automatic closers and secured on the stairwell or corridor side, except on cross-over floors in a high-rise building. Signs on these doors from restricted zones should indicate one-way movement only. Access signs direct public to and from premises through public access routes, or directly to outside (i.e. not through restricted zones or other tenants' premises).

Examples of Enhanced Safeguards

• Signs clearly define limits to which public access is permitted.
• Local alarms on doors that are to be used only in emergencies. Use signs on such doors.
• Electronic access controls on doors between Operations, Public-Access or Reception Zones.
• Short distance stairs (i.e. circulation stairs) running between intra-directorate floors, with controlled means of entering or exiting these floors.

A.3.7  Circulation - Persons and Equipment

Minimum Safeguards

Security measures which compensate for site specific deficiencies are to be provided in this section, unless already documented in a site brief and implemented. Often, the architectural designer can develop an innovative plan which meets all of your considerations.

Where warranted by the safeguarding strategy developed from the facility TRA, specify electronic access control equipment to regulate circulation. The specification for the equipment should identify the performance requirements totally.

Often, the architectural designer can develop an innovative plan which meets all of your considerations.

Examples of Enhanced Safeguards

• Establish reception points at interface points between functional groups or restricted zones.
• Stairs for circulation separate from a means of egress.
• Electronic access control.
• Separation of high value assets circulation from normal supply items.

A.3.8  Pedestrian Control Within a Building

Minimum Safeguards

Provide sufficient space within the Reception Zone, or sufficient overflow space in Public-Access Zones, to accommodate visitors waiting for service, without disrupting normal activity on the premises or in the remainder of the facility. Vertical access routes to the rest of the building from the Public-Access Zone should be by elevator or via short distance stairs. Stairs forming part of a means of egress should not be used to enter the tenant space. At the perimeter of the institution's space, or at the boundary where a facility would be closed because of a demonstration, there should be the potential to erect a physical or psychological barrier as a means of access control.

Examples of Enhanced Safeguards

• Physical separations in place, creating secure boundaries between areas where the public is permitted and the restricted zones where the public is not permitted. Separation adequate to prevent attempted occupation or demonstration.

A.3.9  Internal Circulation - Corridors

Minimum Safeguards

Security is influenced by the internal circulation of the facility. Emergency exit routes that circumvent restricted zones at a time of crisis can be a vulnerability. Some definitive circulation is established at this point, therefore, clearly indicating to the architect which specific functions should be removed from the main circulation routes.

Examples of Enhanced Safeguards

• Specific functions which cannot be located on a cross-over floor.
• A corridor between the mandatory fire exits on cross-over floors.
• Specific functions which are not allowed to abut the fire exit or public corridors.

A.3.10  Zoning Within a Building

Minimum Safeguards

Every facility should have a Reception Zone accessed directly from the Public-Access Zone, where visitors, if necessary, wait for service or wait for permission to proceed to a restricted zone. At the boundary between the Public-Access and the Reception Zone, and between the Reception Zone and restricted zones, the wall - including the perimeter wall and any internal ceiling - should not permit access over the wall by simply lifting the ceiling, i.e. ceiling on public side to be fixed or wall to extend to structure above.

Every facility should be compartmentalized in a manner which develops progressively restrictive zones. The use of physical barriers to separate Security and High-Security Zones is not necessary, provided access is manually or electro mechanically controlled and continuously monitored.

Examples of Enhanced Safeguards

• Specific zones physically separated by a wall with a lockable door.
• High-Security Zones, located where traffic between less restrictive restricted zones does not pass.
• All perimeter physical barriers around Security and High-Security Zones extend to underside of structure above.
• Operations Zone separated from the Reception Zone by a wall with lockable door.
• Security and High-Security Zones to be alarmed, (GSP mandatory requirement).

A.3.11  Location of Exit Stairwells

Minimum Safeguards

Exit stairwells which form part of a means of egress will comply with the National Building Code requirements. These stairwells should not allow uncontrolled access to Operations, Security or High-Security Zones.

Examples of Enhanced Safeguards

• The stairs are not to be used for pedestrian circulation between floors.
• Control lobbies, security personnel or employees are to be located at doors to exit stairs.
• To avoid circumventing any security equipment, exit doors leading from the stairwell should not be located next to external rest or parking areas.
• Ensure exterior doors leading from the stairwell can be easily observed, preferably by guards or employees.
• Stairs and toilets connecting elevator lobbies on all floors are in the Public-access Zone.

A.3.12  Floor Loading Capacity

Minimum Safeguards

Entire floor areas need not have sufficient loading capacity to accommodate concentrations of security containers. However, within each Operations Zone, on each floor, the floor loading capacity should support a minimum of two approved security containers near each structural column, or in another specified area of the Operations Zone.

Examples of Enhanced Safeguards

• Reinforced structure within the area of the facility designated for secure storage.
• A future requirement that a minimum of one secure room and/or vault be built within the institution's area, providing one-hour fire-retardant material and/or force attack protection, from the floor to the underside of the structure above.

A.3.13  Windows

Minimum Safeguards

As per architectural requirements.

Examples of Enhanced Safeguards

• Planning data relative to windows must be detailed. Specific requirements such as areas that should not have windows for security reasons, for example, sensitive discussion areas where top secret conversations regularly occur.
• No windows within 3 m of grade bordering on Security or High-Security Zones.
• Special glazing such as bullet-resistant or vandal-resistant identified for specific areas.
• Acoustical windows for conference rooms.
• No windows permitted for special functional areas.
• Special curtains to contain projectiles from explosions.
• Apply protective coatings to glass, or use plastic laminates to replace glass.

A.4  Building Layout

A.4.1  Common Spaces

Minimum Safeguards

All common functions within the building, especially on the ground/first floor should be located in centralized areas. These areas should be part of an Operations Zone and could include, for example, lunch/coffee rooms, washrooms and general photocopy rooms. Common areas for visitors such as washrooms, interview rooms and orientation spaces should be located in the Reception Zone. The intent is to reduce pedestrian movement into more restricted zones, and to eliminate reasons for persons not working in the restricted zones to enter legitimately.

Examples of Enhanced Safeguards

• Locate employee service areas within a restricted zone where access is not granted to visitors to the institution.
• Interview rooms with direct access from Reception Zone under control of personnel from the Operations Zone.
• Photocopy rooms are located in and for the exclusive use of Security and High-Security Zone personnel.

A.4.2  Washrooms

Minimum Safeguards

Access to washrooms is provided directly from a Public-Access or Reception Zone. To minimize damage or their use for other than their intended purpose, locate the washrooms where there is unobtrusive visual observation of the entry by a receptionist or guard.

Examples of Enhanced Safeguards

• Separate staff and public washrooms.
• Vandal-resistant light fixtures and wall surfaces in public washrooms.
• No closets, utility spaces or access hatches inside washrooms.
• Access control to washroom facilities.
• In locations where staff use same washrooms as members of the public, wing walls of toilet stalls extend close to floor and ceiling to prevent attack or observation.

A.4.3  Utility Spaces

Minimum Safeguards

Use standard building locks on electrical, mechanical and telephone rooms.

Examples of Enhanced Safeguards

• Security locks on electrical, mechanical and telephone rooms.
• Intrusion alarms in electrical, mechanical and telephone rooms.
• Security screw fastening of access doors to ceilings and mechanical shafts.
• Wiring related to secure circuits in conduit (not in open cable trays).
• Door closers with automatic locking.

A.4.4  Mailrooms

Minimum Safeguards

All mailrooms should be managed as an Operations Zone. Internal mail delivery should provide proper protection to the mail if left outside the mailroom (i.e. on a delivery cart).

Examples of Enhanced Safeguards

• Manage as a Security zone
• Provide an intrusion alarm and/or access control equipment in the mailroom.
• Install a fluoroscope to x-ray the mail upon entry into the facility.
• Special room for incoming mail delivery, keyed off the master. The same would apply for parcel delivery. Routes to these spaces from the exterior is either directly to the outside, or under visual control of an attended guard station whenever delivery is permitted.
• Provide blow-out panels.

A.4.5  Food Services

Minimum Safeguards

Food services should be located on a lower floor or on the ground floor. All storage areas containing food should be lockable. Access to the food preparation area should be controlled so patrons cannot enter this area. There should be a physical separation between the food services and government-occupied space.

Examples of Enhanced Safeguards

• Provide a hold-up intrusion alarm.
• Provide a money chest to secure cash receipts.
• Separate access to food services.
• Separate public/employee and VIP dining rooms.

A.4.6  Loading Docks

Minimum Safeguards

Shipping and receiving areas may be located within the same loading dock area. Ensure that the overhead doors are properly secured with padlocks or cane bolts accessed only from the inside. Doors should be heavy duty sectional or vertical lift doors, with a steel skin on both the inside and outside of the door. Secure storage areas within the loading dock area.

Examples of Enhanced Safeguards

• Provide an enclosed truck bay.
• Provide an interlock which prevents the exterior door to the truck bay from opening at the same time as the door from the truck bay to the loading dock is open.
• Physically separate the shipping and receiving areas.

A.4.7  Telecom and Data Links Within the Facility

Minimum Safeguards

Refer to the GSP - Information Technology Security Standard and the Technical Security Standard for Information Technology (TSSIT) - RCMP - Aug. 1997.

Examples of Enhanced Safeguards

• The need to implement protective measures within the facility should be justified by the safeguarding strategy. Requirements such as emergency power for an intercom or internal telephone must be identified. If the threat is present, the need for routing of conduit to carry communications within the facility should be identified.
• Emergency power for on-site intercom or telephone.
• All data lines located in Public-Access or Reception Zones to be encased in conduit which is visible in its entire length.
• All telecom lines between High-Security Zones pass through Security or Operations Zones in conduit which is visible through its entire length.
• Locate remote data terminals in an area controlled by the institution.
• Use electronic encryption techniques.
• Separate data and communication links with specialized grounding networks.

A.4.8  Conference and Board Rooms

Minimum Safeguards

In the context of this document, conference and board rooms are intended for the use of the institution and visitors with a legitimate reason for being there. These rooms should therefore be located in an Operations Zone as a minimum. The rooms should be constructed of physical walls to the suspended or false ceiling. The room should have one door which is lockable using commercial grade hardware.

Examples of Enhanced Safeguards

• Provide additional sound attenuation if sensitive or classified information is discussed.
• Ensure public address equipment is not installed in the room.
• Ensure windows are not part of the perimeter walls of this room.
• Do not locate this room adjacent to a Reception Zone or to a main circulation route in an Operations Zone.

A.4.9  Day-care Centres

Minimum Safeguards

Day-care centres present a special problem. Two issues must be addressed. First, how the day-care centre affects the security of the facility, and second, the safeguards necessary to protect the day-care centre.

Day-care centres should have their own entrance with no requirement to enter the departmental space. Anyone entering the government building from the day-care centre should pass through building security. It is paramount that a day-care centre be safe for children and meet all the necessary building codes.

Examples of Enhanced Safeguards

• Locate the day-care centre away from the facility or completely off the site.
• Provide only one entry point into the day-care centre which can be easily controlled.

A.4.10  Special Purpose Space

This document concerns itself with building attributes generally associated with general purpose office buildings (GPOB). Many spaces which will be unique to an institution's facility are not outlined in this document. The onus is on the institution to ensure that minimum and any enhanced safeguards for these spaces are part of this security brief. These spaces might include medical facilities, laboratories, classrooms, workshops and theatres.

A.5  Building - Special Requirements

A.5.1  Electronic Access Control

Minimum Safeguards

The safeguarding strategy will determine the need for electronic access control measures and the necessary technical sophistication of the equipment. Generally, mechanical access control equipment is considered to be more of a physical deterrent than electronic access control equipment. The security value of mechanical safeguards lies in their ability to physically control access. Electronic access control safeguards provide accurate records (auditing) of visitor and employee movements throughout a facility. This security measure can be combined with electronic intrusion detection and closed circuit television to create a convenient, reliable and accurate component of the detection element in a physical security subsystem.

If an electronic access control system is to be installed, refer to RCMP standards EACDI-P (1995) and EACCI-P (1997) for the minimum requirements.

Examples of Enhanced Safeguards

• Electronic access control.
• Anti-passback features which record entry and exit.
• Positive identification through biometric or other identifiers unique to the individual.
• Personal Identification Numbers (PINs).
• Special functions such as auditing of access by individuals, use of a special portal or date/time restrictions.
• Fail secure equipment.

A.5.2  Electronic Intrusion Detection

Minimum Safeguards

The safeguarding strategy will determine the need for electronic intrusion detection measures and the necessary technical sophistication of the equipment. Generally, electronic intrusion detection equipment, when properly installed and serviced, accurately monitors for unauthorized access to a facility. This security measure can be combined with electronic access control and closed circuit television to create a convenient, reliable and accurate component of the detection element in a physical security subsystem.

If an electronic intrusion detection system is to be installed, refer to RCMP standards EIDDI-P(1995) and EIDCI-P (1997) for the minimum requirements.

Examples of Enhanced Safeguards

• Perimeter detection of the facility.
• Perimeter detection of the site.
• Volumetric motion detection of a facility.
• Computer controlled reporting/annunciating.
• Perimeter detection of special function groups.
• Line supervision

A.5.3  Closed Circuit Television / Video Equipment

Minimum Safeguards

The safeguarding strategy will determine the need for closed circuit television/video equipment and the necessary technical sophistication of the equipment. Generally, closed circuit television/video equipment, when properly installed and serviced, can accurately be used to assess valid and nuisance alarms, and provide random surveillance of a problem location. It cannot assess a false alarm. This security measure can be combined with electronic access control and electronic intrusion detection to create a convenient, reliable and accurate component of the detection element in a physical security subsystem.

Examples of Enhanced Safeguards

• Low light, infra red or colour cameras.
• Pan, zoom and tilt controls.
• Computer controlled pan, zoom and tilt control.
• Video recording.
• Video motion detection.
• Video capture.

A.5.4  Security Control Centre

Minimum Safeguards

The safeguarding strategy will determine the need for a security control centre and the necessary technical sophistication of the equipment. Generally, a security control centre is used as a base of operations for assessing the validity of electronic detection equipment alarms and initiating the response element in a physical security subsystem.

Examples of Enhanced Safeguards

• Locate a security control centre in a well-protected part of the facility having no windows.
• Access to this room is controlled.
• Separate security equipment room.
• Separate washroom facility attached to the security control centre.
• Electronic access control on entry to establish audit trail.
• Extra air conditioning to handle the heat from the electronic equipment.
• Variable light level controls.

A.5.5  Secure Rooms

Minimum Safeguards

Secure rooms A, B, C and D are work spaces which are approved for the open shelf storage of classified and designated information and assets. This storage method precludes the need to use a large number of security containers, which is usually more expensive and inconvenient than the single room requirement.

Examples of Enhanced Safeguards

• Electronic intrusion detection for Secure Room D.
• Fire resistance ratings.
• Locating the Secure Room within a Security Zone or a High-Security Zone.
• Operating and managing a Secure Room as a Security or High-Security Zone.

A.5.6  Vaults

Minimum Safeguards

The safeguarding strategy will determine the need for a vault and the necessary technical sophistication of the safeguards. Generally, a vault is used to store large quantities of classified and designated information and valuables not requiring regular processing.

Traditional vaults usually need special structural requirements to be designed into the building. Often, modular vaults are used because they are lighter in weight and therefore, require less structural reinforcement than the traditional vault. Another advantage of the modular vault over that of an in-situ vault is its potential to move with the institution. Vaults should be located in areas where access is controlled, with no circulation routes. Expert advice should be sought from the lead agency as to specific construction details when considering this type of room.

Examples of Enhanced Safeguards

• Suitable construction would use heavy-duty commercial door assemblies with appropriate locks and hinges. Walls would be of traditional materials used in fit-up construction (i.e. gypsum board and plywood).
• Traditional vault door assemblies with combination lock and appropriate hinges.
• Located away from any exterior walls.
• Special air supply and exhaust, directly from and to the outside, with air ducts, heat exchangers and fans located entirely within Operations or restricted zones.
• Continuous walls extend from structural floor to underside of structural floor above.
• Walls are of masonry or concrete.

A.5.7  Sensitive Discussion Areas

Minimum Safeguards

The safeguarding strategy will determine the need for a sensitive discussion area (SDA) and the necessary technical sophistication of the safeguards.

Sensitive discussion areas use specialized construction, are expensive to construct, and should be used very sparingly. Expert advice should be sought from the lead agency as to specific construction details when considering this type of room. They should be managed similarly to other areas that process and handle classified or highly sensitive designated information.

Examples of Enhanced Safeguards

• Specify as a speech private sensitive discussion area
• Specify as a speech secure sensitive discussion area
• Specify as a speech and counter technical secure sensitive discussion area.
• Electronic shielding

A.5.8  Computer Rooms

Minimum Safeguards

Refer to the GSP - Information Technology Security Standard.

Computer rooms require security advice for existing facilities from the Security Evaluation and Inspection Team (SEIT) of the RCMP as directed by the GSP. Minimum standards are identified in the publication Technical Security Standard for Information Technology -Aug. 1997 (TSSIT), published by the RCMP's Technical Security Branch.

Examples of Enhanced Safeguards

• UPS equipment.
• Access control.
• Access logs.
• Two person access rule.
• Operated and managed as a Security or High-Security Zone.

A.5.9  Telecom and Data Links Within the Facility

Minimum Safeguards

Refer to the GSP - Information Technology Security Standard and the RCMP Technical Security Standard for Information Technology (TSSIT) - Aug. 1997.

The need to implement protective measures within the facility such as emergency power for the intercom or internal telephone and the routing of conduit to carry communications should be determined by the safeguarding strategy.

Examples of Enhanced Safeguards

• Emergency power for on-site intercom or telephone.
• All data lines outside of Operations Zones or other restricted zones are only in conduit which is visible in its entire length.
• All telecom lines between High-Security Zones pass only through Security or Operations Zones and are in conduit which is visible through its entire length.
• Locate data gathering panels in an area controlled by the institution.
• Use electronic encryption techniques.
• Separate data and communication links with proper grounding networks.

A.6  Facility Management

A.6.1  Leasing Contract

Minimum Safeguards

The standard lease for build-to-lease facilities should allow the tenant to install electronic intrusion detection and access control equipment as necessary, to develop physical security for the facility. The tenant should also be allowed to add locks to doors, to re-key their leased areas and to restrict owner access to the facility to specific hours or by appointment.

Examples of Enhanced Safeguards

• Leasing provisions to allow use of video cameras, providing a minimum of 50 lux reflected light. Consultation with a lighting engineer when using colour video cameras for correct light sources and the appropriate colour rendition index.
• Installation of special security features such as vandal or bullet-resistant glazing, acoustical doors and windows and vandal-resistant light fixtures.
• In a leasing agreement with the landlord, specify that maintenance and cleaning be performed by institution-controlled staff.
• Leasing provisions allow installation of security locks on utility closets and mechanical rooms.
• List neighbouring activities or groups that would be unacceptable.

A.6.2  Control of Access to Premises Within a Building

Minimum Safeguards

In single-tenant buildings, the tenant department is responsible for providing any required guard services. Tenant-occupied facilities include a Reception Zone within the institution's premises capable of being attended. Personnel who control the Reception Zone are provided by the institution.

All entry points to the tenant facility should have locking capabilities using a high quality locking device. During restricted access and limited access hours, entry to the building is through a locked door. Entry to the institution's facility is through a locked door. Keys should only be issued to authorized personnel.

Examples of Enhanced Safeguards

• Manned entry control station during limited access hours or manned 24 hours.
• Security personnel to screen all employees and visitors before entering the restricted zones of the facility.
• At the main floor lobby, all elevators open within view of the control station.
• Key control of elevator during restricted and secure access hours.
• Provide electronic devices (card access or keypad) with electric strikes or electromagnetic devices to control access.

A.6.3  Maintenance Services

Minimum Safeguards

Use custodian's regular maintenance staff in Reception and restricted zones. All maintenance staff should meet the minimum personnel screening requirements.

Examples of Enhanced Safeguards

• In restricted areas, maintenance staff should be monitored and controlled by institution or security staff.
• Where required in the institution's security brief, maintenance staff will meet a specified level of personnel screening above minimum, (reliability status or security clearance) and be identified and admitted to restricted zones by the institution's personnel or security control staff.
• All routine maintenance should be during public access hours.
• Provide an escort for all non-government maintenance personnel.
• In restricted zones, maintenance staff should be monitored and controlled by institution or security staff.

A.6.4  Cleaning Services

Minimum Safeguards

After hours cleaning of premises by cleaning crews under contract. All cleaning personnel required to meet the minimum personnel security screening requirements prior to start of work. Current list of employees on cleaning crews, with photograph of each, may be posted at security control station. If persons arrive to work for the cleaning contractor, and they are not on the contractor's list given to the security personnel, or if their photograph is missing, then they should not be permitted to enter the premises until a photograph has been taken, and identification has been established.

Examples of Enhanced Safeguards

• Photographs of former staff, with information on how to contact them in case of a security problem, are retained on file.
• Daytime cleaning of premises, including shipping and receiving areas, under monitoring and control of tenant staff.
• Restricted access hours cleaning of a restricted area under the full time monitoring and control of occupant staff.
• Cleaning contractors or staff who clean restricted zones should have a specified level of personnel security screening above minimum (reliability status or security clearance).

A.6.5  Garbage Removal

Minimum Safeguards

Caretaking staff remove discarded material to garbage bins in garbage holding area for removal. Garbage bins are accessible from street, alley or other public area. Waste paper being held for recycling is kept in an area not accessible to the public.

Examples of Enhanced Safeguards

• Garbage holding area is within secure fence or wall, and access from public zone is through locked gate or attended control station.
• Routes for incoming deliveries, and garbage areas where refuse is stored for removal are separated, so that a person leaving with an asset cannot deposit it as waste, for later removal by an accomplice.
• Garbage storage and removal area under visual monitoring, or video monitoring to an attended guard station, with capability for prompt response.

A.6.6  Classified Waste Destruction

Minimum Safeguards

Store Confidential, Secret and Protected A and B designated information and assets awaiting destruction in an Operations Zone, either on or off-site, in approved containers or secure rooms. Store Top Secret and Protected C designated information and assets awaiting destruction in a Security Zone, either on or off-site, in approved containers or secure rooms. Destruction of classified and designated information and assets shall be done with approved equipment.

Examples of Enhanced Safeguards

• Store all classified and designated information and assets awaiting destruction in a secure room or vault.
• Special purpose rooms containing equipment for high capacity shredding of classified and designated information.
• On-site incineration equipment.

A.6.7  Signs in Building Interior

Minimum Safeguards

At least one prominent sign in the public building lobby that directs visitors to government Reception Zones. In leased space, the lease provides for government control over signs at the building entry and within the institution's facility. All signs to be in place prior to initial move-in. If this is not practicable, any missing signs can be substituted by effective temporary signs. All signs should meet the requirements of the Federal Identity Program, where applicable.

Examples of Enhanced Safeguards

• Signs at entry from Reception to Operations Zone clearly indicate that unauthorized persons are not permitted in the posted area, in order to establish legally that trespass has occurred when an unauthorized person enters a restricted zone.
• Remove signs that identify areas sensitive to disruption, e.g. mechanical rooms, electrical rooms, data terminal rooms, etc.
• Signs in Public-Access and Reception Zones do not indicate location of restricted zones.
• Signs in Public-Access and Reception Zones do not indicate names of managers and staff who risk becoming individual targets of protest, hostage-taking or other disturbance, whether at work or at home.

A.6.8  Locking Hardware and Key Control

Minimum Safeguards

Provide a complete keying set-up suitable for the institution. Grand master keys should not be used unless authorized by the institution. All changes to the keying and/or locks, giving access to the building, or spaces within the building, should only be authorized by the occupant. he institution should be advised of any changes to locks or keying, made by the custodian, that could affect the security operation of the institution. Perimeter doors should be keyed separately with no "mastering". Direct codes should not be displayed on hardware, cylinders or keys. Commercial grade hardware should be used.

Examples of Enhanced Safeguards

• Within the keying set-up, only change keys should be used to restricted areas, i.e. not part of any master key set-up.
• Loss of a key should require re-keying of the area affected by the lost key.
• If landlord requires a key for emergency purposes, that key should be kept in an approved sealed enclosure or container. The enclosure or container should be inspected at regular intervals to ensure the seal is intact.
• Include provisions to inhibit copying of keys - e.g., no direct codes on keys, exclusive keyways, high security cylinders, marking keys "DO NOT DUPLICATE", etc.

A.6.9  Renovation Work Outside Public-Access Hours

Minimum Safeguards

During limited access hours, giving contractor personnel access to a facility should be done through prior arrangement.

Examples of Enhanced Safeguards

• Renovation area is enclosed with temporary walls to limit contractor's access to restricted zones in the building.
• Renovation area is under direct monitoring and control of a security guard during occupancy by the contractor's staff.
• If persons arrive to work for the contractor, and they are not on the contractor's list given to the security guard, or if their photograph is missing, then they should not be permitted to enter the premises until a photograph has been taken, and identification has been established.
• All contractor personnel must meet a specified level of personnel security screening above minimum (reliability status or security clearance).
• During public and limited access hours, an appropriate number of authorized personnel provided by the custodian are to be present to control and monitor contractor personnel.

Appendix B - basic building security attributes for custodians

Pursuant to Appendix B, Chapter 1.1 of the GSP, the custodians are responsible for, but not limited to, the following aspects of physical security for facilities they administer unless otherwise arranged with tenants:

• Providing and funding safeguards considered necessary by the custodian to protect facilities, based on a threat and risk assessment (TRA) conducted by or for the custodian;
• Providing and funding for specific sites, subject to a threat and risk assessment, guard services to protect facilities at a level the custodian considers necessary;
• Arranging for additional safeguards, where required and funded by tenants;
• Consulting the RCMP, or supporting the tenant's request for such consultation, in situations where doubt exists about the safeguards required;
• Advising tenants of proposed changes to facilities that could affect security and consulting with tenants about proposed changes to facility safeguards; and
• Advising tenants of changes of occupancy or use in multiple occupancy buildings that could affect security.

The following exemplifies basic building attributes that custodians are usually required to implement, service and maintain. This list, which follows the numbering sequence of the common minimum and enhanced safeguards, is not all inclusive but is intended to illustrate the nature of basic building security attributes. Similarly, the measures listed do not necessarily apply equally to all buildings across the country given regional variances in the quality and quantity of space available but is intended to serve as a reference only.

B.1  Life Safety and Emergencies

B.1.1  Life Safety - Basic Building Security

The facility conforms to applicable building codes regarding life safety, for example, fire safety, barrier free design, exiting, fire alarms and smoke control. Human Resources Development Canada, Fire Prevention, Fire Protection Engineering Services are responsible for federal facilities. Life safety is controlled by provincial authorities for facilities owned and operated by the private sector. Municipalities usually administer provincial codes. All existing facilities are reviewed periodically for compliance. This review includes recommendations as to whether deficiencies can be corrected, or whether compensating features or operations can be added in lieu of conformity. Life safety equipment is to be inspected and tested at required intervals.

Some older facilities may be governed by the codes that were in force at the time the facility was built or remodelled and which were less stringent than those now in force. In these cases, the authority having jurisdiction will make a decision as to whether this provides sufficient life safety under current conditions. Sprinklers are only provided if required by code due to building type, design or materials, or to hazardous contents.

B.1.2  Emergency Power - Basic Building Security

Provide emergency power to the facility for basic building services, including heating, partial elevator service, emergency lighting, etc., with at least 12 hours of fuel supply (72 hours at isolated locations). Emergency power is not provided for continued tenant operations. Where no central source of emergency power is available, battery packs should be provided for emergency exit lighting, and for four hours duration of electronic intrusion detection, if present.

B.1.3  Fire Water Capacity - Basic Building Security

Ensure that the municipal water supply to the site has sufficient volume and pressure for firefighting. Where municipal supply does not exist there should be a reservoir and fire pump or a sufficient static head on site (sufficient capacity appropriate to size and combustibility of building and contents measured in minutes of full discharge rate). Booster pumps for fire water should be provided where water pressure is unreliable.

B.1.4  Response Time For Firefighters and Police - Basic Building Security

Fire detection and response equipment is to be as required by the NBC. If the response time exceeds the delay times, compensatory steps that will be the most cost effective should be taken. The basic level of security is based on a police response, and the inherent psychological deterrence of a facility that is locked during restricted and limited access hours.

B.2  Site

B.2.1  Easements Through Site - Basic Building Security

Easements should not be permitted closer than 15 m from the building. When easements are more than 15 m from building, the tenant(s) should be informed in advance of the possibility of intrusion on the site by utility crews to replace or repair overhead lines, or excavations to repair or replace underground utilities. If easement permits public access through the site, for example, in emergency, then the tenant(s) should be informed and agree to the requirement.

B.2.2  Perimeter Control of Site - Basic Building Security

• There is no restriction on access to the site or to the Public-Access Zone of the building during public access hours.
• The building is locked during limited access hours and there is no control on access to the site. Provide signs giving clear directions and identifying the restricted areas of the site.

B.2.3  Perimeter, Distance from Building - Basic Building Security

There are no requirements regarding perimeter distance from the building. The facility may abut the property line. At the property line, a street or another Public-Access Zone, a wall of an adjacent building or an access strip may occur.

B.2.5  Illumination of Site - Basic Building Security

Provide general illumination of the entire perimeter of the building, driveways, and parking lots, to a target level of 25 lux (20 lux minimum). Lighting sources may be street lighting, yard lighting or building mounted lighting. Maximum contrast of darkest to brightest illumination is a ratio of one to ten, for example, if darkest is 25 lux, then highest should be no more than 250 lux. Lighting that is added to meet these requirements should require a minimum of maintenance and be energy efficient. Where the building abuts the property line, with private property on the other side, that private property should not be illuminated if its owner so requests.

B.2.6  Landscaping - Basic Building Security

Provide a clear space of six metres around the building, and around paths between the building(s) and parking areas, sidewalk(s) and public transportation stops. Avoid bushes or branches that a person could hide behind. Landscape features should not obstruct vision in the zone between 400 mm and 1,500 mm above grade.

B.2.8  Adjacent Occupants - Basic Building Security

In single tenant and multi-tenant Crown-owned buildings, the custodian building manager will inform tenants and prospective tenants of the nature of public traffic expected and activity of occupants of the adjacent space and buildings. This advice is provided on request to the tenant.

B.2.9  Staff and Visitor Parking - Basic Building Security

• Use signs to indicate visitor and staff parking areas.
• Elevators to or from parking should not give direct access to office floors. Elevators should open to the main lobby in view of a receptionist or security personnel or into a Public-Access Zone.
• All indoor parking is locked during limited access hours. Staff access to indoor parking should be controlled by security personnel or key.

B.3  Building Design

B.3.3  Perimeter of Building - Basic Building Security

The total building should be secured at grade level by locked doors, using heavy duty commercial hardware (locks, hinges, etc.). (See also LOCKING HARDWARE AND KEY CONTROL). All windows should be either fixed or locked with heavy duty commercial hardware at all levels. Roof access door(s) or roof hatch(es) should be locked with heavy duty commercial hardware. Air intake should be sufficiently remote from air exhaust that smoke being removed from the building cannot be entrained at the intake. Air intakes should be located and screened to inhibit placement of sources of smoke, tear gas or other sources of offensive substances, or entrainment of those substances or of vehicle exhaust. (See also CONTROL OF ACCESS TO PREMISES WITHIN A BUILDING).

B.3.5  Elevator Lobbies - Basic Building Security

When necessary, elevators from public parking should open only into Public-Access Zones in the main lobby, under monitoring of security personnel.

B.3.6  Circulation Routes - Basic Building Security

Circulation routes from Public-Access to Operations Zones should not pass through any space outside the tenant's control. Within the tenant's space there should be no circulation routes to which the public have access, even in an emergency. All required fire stairs from Public-Access Zones should be located in the Public-Access Zone. All doors from restricted zones to Public-Access Zones should be equipped with automatic closers and locked on the public corridor side and on the public stairwell side. Signs on these locked doors from restricted zones should indicate one-way movement only. Access signs should direct the public to and from premises through public access routes, or directly to the outside (i.e. not through other tenants' premises). (See also WASHROOMS)

B.3.9  Internal Circulation - Corridors - Basic Building Security

• On multi-tenant floors, access to elevator lobbies, exit stairs, emergency routes to exit stairs, crossover corridors at crossover floors, public washrooms, and entry to the Reception Zone of tenants should only be from the Public-Access Zone.
• On floors having only a single government tenant, access to washrooms and exit stairs may or may not be from the Public-Access Zone, unless the tenant specifies in the security site brief that access to washrooms may only be, or may not be, from an Operations Zone.

B.3.10  Zoning Within a Building - Basic Building Security

Every facility layout has a Reception Zone accessed directly from the Public-Access Zone, where visitors, if necessary, wait for service or wait for permission to proceed to a more restricted area. At the boundary between Public-Access Zones and restricted zones, and at the Public-Access side of the Reception Zone, the wall and ceiling should not permit access over the wall by simply lifting ceiling tiles. The ceiling on the public side is to be fixed or the wall to extend to the underside of the structure above. For the definition of Public-Access, Reception, Operations, Security and High-Security Zones, refer to Chapter B.1 of the GSP.

B.3.12  Floor Loading Capacity - Basic Building Security

The entire floor area need not have sufficient loading capacity to accommodate security containers. However, within each Operations Zone, on each floor, the floor loading capacity will support at least two fire resistant containers near each structural column or in another specified area of the Operations Zone. Floor loading may be required for at least one restricted room to be constructed within an area suitable for a restricted zone, using one hour fire-retardant construction from the floor to underside of the structure above.

B.4  Building Layout

B.4.2  Washrooms - Basic Building Security

Access to washrooms should be provided directly from a Public-Access or Reception Zone, past unobtrusive visual screening, for example, a receptionist or security personnel within view of washroom doors, or a corridor leading only to the washrooms. (See also - INTERNAL CIRCULATION - CORRIDORS)

B.4.3  Utility Spaces - Basic Building Security

Use standard building locks on utility closets and mechanical rooms and standard screw fastening latches on access doors to duct shafts and ceiling spaces. (See also LOCKING HARDWARE AND KEY CONTROL)

B.4.7  Telecom and Data Links Within the Facility - Basic Building Security

Communications within the site should not be unduly vulnerable to accidental disruption.

B.6  Facility Management

B.6.1  Leasing Contracts - Basic Building Security

The custodian building manager is responsible for reporting immediately to the Government tenant any deficiencies that affect the security of a facility. This might include damaged or malfunctioning locks, damaged doors and windows, etc.

B.6.2  Control of Access to Premises Within a Building - Basic Building Security

• In multi-tenant buildings, security personnel are provided and staffed by the custodian to monitor, but not screen, access to the building and common areas, when necessary, from a landlord's perspective.
• In single tenant buildings, the tenant department is responsible for providing security personnel.
• Tenant-occupied facilities should include a Reception Zone within the institution's premises, capable of being staffed at all times. Personnel who control the Reception Zone should be provided by the institution.
• All entry points to the facility should be capable of being locked with a high quality locking device. During limited access hours, entry to the building should be through a locked door. Entry to the institution's facility should be through a locked door.
• Entry into a facility, by a tenant, to gain access to their space, should be by pre-arrangement with the custodian, or by a key supplied to the tenant. Entry to the institution facility should be by a locked door. Keys should only be issued to authorized personnel.
• During all hours, elevators should stop at all floors or be pre-programmed to stop at specific floors, for example, express elevators and the main lobby. Exceptions are elevators to the parking garage, which only stop at the various parking levels, and the main lobby within view of security personnel or a Public-Access Zone.

B.6.3  Maintenance Services - Basic Building Security

The landlord's normal maintenance staff should be used in Reception and Operations Zones. The custodian, as the contracting authority through negotiation with the tenant, shall conduct all appropriate security checks and clearances as prescribed in the GSP. In Security and High-Security Zones, maintenance staff should be monitored and controlled by security personnel or the tenant.

B.6.4  Cleaning Services - Basic Building Security

Cleaning of premises by cleaning crews during limited access hours should be under contract to the custodian. The custodian, as the contracting authority for construction and building services shall, subject to negotiation with the tenant, conduct all appropriate personnel screen-ing and security inspections as required of the contracting authority in the GSP. A current list of employees on cleaning crews, with photograph of each, should be given to security personnel.

B.6.5  Garbage Removal - Basic Building Security

Care taking staff should remove discarded material to garbage bins in the garbage holding area, for removal. Garbage bins should be accessible from the street, alley or Public-Access Zone. Waste paper being held for recycling should be kept in an area not accessible to the public.

B.6.7  Signs in Building Interior for Leased Facility - Basic Building Security

At least one prominent sign in the public building lobby should direct visitors to government Reception Zones. In leased space, the lease should provide for custodian control over signs at the building entry and within the tenant facility leading to government tenants. All signs should be in place prior to initial move-in. If this is not practicable, then any missing signs should be substituted by effective temporary signs.

B.6.8  Locking Hardware and Key Control - Basic Building Security

The lease should state that the keying and/or locks to custodian-leased space will be changed by the custodian to a set-up exclusively for the use of the government tenant. (See also PERIMETER OF BUILDING, UTILITY SPACES, and CONTROL OF ACCESS TO PREMISES WITHIN A BUILDING.)

B.6.9  Renovation Work Outside Public-Access Hours - Basic Building Security

On custodian-initiated projects during limited access hours, whenever contractor personnel are present, an appropriate number of security personnel provided by the custodian should be present, to control entry to the building and to monitor activities of contractor personnel. A list of contractor's employees, with photographs, should be posted with the security personnel, who maintains a record of attendance.

Appendix C - glossary

Arrange (custodian role statement in Appendix B)

The custodian will contact the appropriate service agencies when requested, on behalf of the tenant, to ensure that the required work is carried out.

Related project delivery costs and fees will be paid by the tenant unless, for reasons of administrative convenience, the custodian chooses to pay them.

The role statement for custodians refers to recovering the costs of enhanced security measures "arranged" by the custodian. Where appropriate, accommodation should encourage the tenant department to deal directly with the service agency. Otherwise, the custodian will arrange the necessary services, with the service agency recovering the costs from the tenant department.

Basic Building Security Attributes

Security safeguards provided by the custodian to protect a building but not the assets contained in the building. Basic building security attributes provide a base or starting point for other security requirements (i.e. minimum and enhanced safeguards) to be added to protect the specific assets held by the institution. See Appendix A for a partial list of examples of basic building security attributes.

Constructing Facilities

Facilities built by the crown and facilities built for the crown by private sector landlords.

Enhanced Safeguards

Security requirements above minimum that should be implemented to achieve the safeguarding strategy.

Facility TRA

In relation to the building project delivery, a threat and risk assessment process evaluating the assets within a facility, the threats against them and the performance of safeguards against these threats in order to define the optimal safeguarding strategy under the circumstances. The defined strategy is used to specify the actual safeguards as the building project delivery progresses.

Leasing Existing Facilities

Existing facilities owned by the Crown and facilities leased or purchased by the Crown from private sector landlords. These facilities may need to be renovated to meet the requirements of thegovernment tenant.

Minimum Safeguards

The minimum security measures necessary to meet the requirements of the GSP as recommended by the RCMP as the lead agency for physical security.

Monitor vs Screen Access (custodian role in Appendix B)

Monitor access - provides a surveillance and security response to disturbances at the perimeter and common areas of a facility.

Screen access - provides an identification and checking service on behalf of the tenant (for example, examining IDs, having persons sign-in upon entering the facility, etc.).

Physical Security

The subsystem of the security program which physically denies unauthorized access to assets. A physical security subsystem is comprised of protection, detection, response, demarcation, observation, clustering, territoriality and utilization elements.

Secure Rooms

A totally enclosed space having features of physical security which protect assets stored within it against specific threats.

Security Design Brief (SDB)

A document which describes the physical protection philosophy and concepts as well as physical safeguards for a facility.

Security Site Brief (SSB)

A document which describes the physical security attributes sought in a site when relocating the facility.

Tenant

An organization which occupies facilities in accordance with a lease or occupancy agreement.

Visitors

People who are not employed in a facility occupied by the tenant.