E155, E156, L155, or L156, Student Manual Site / City, State Month Year BUILDING DESIGN FOR HOMELAND SECURITY RESIDENT COURSE STUDENT MANUAL City, State Month Year Building Design for Homeland Security This page intentionally left blank Course Title: Building Design for Homeland Security Unit I (U): Introduction and Course Overview SM I-U-1 Unit I (U) COURSE TITLE Building Design for Homeland Security UNIT TITLE Introduction and Course Overview OBJECTIVES 1. Describe the goal, objectives, and agenda for the course 2. Describe and find material in the course reference manual and student activity handout SCOPE The following topics will be covered in this unit: 1. Welcome and Opening Remarks 2. Instructor Introductions 3. Administrative Information 4. Student Introductions 5. Course Overview 6. Course Materials 7. Activity: Continue familiarization with Appendix U Urban Case Study materials REFERENCES 1. FEMA 426, Reference Manual to Mitigate Potential Terrorist Attacks Against Buildings 2. FEMA 452, Risk Assessment - A How-To Guide to Mitigate Potential Terrorist Attacks Against Buildings 3. Case Study – Appendix U: Urban, HazardCorp Building Course Title: Building Design for Homeland Security Unit I (U): Introduction and Course Overview SM I-U-2 This page intentionally left blank Course Title: Building Design for Homeland Security Unit I (U): Introduction and Course Overview SM I-U-3 UNIT I (U) CASE STUDY ACTIVITY: CASE STUDY OVERVIEW HAZARDCORP BUILDING (HZC) (Urban Version) Requirements Turn to Appendix U, Case Study, and briefly peruse the document. Read the “familiarization” questions on the following worksheet and, as a group, complete the worksheet. Use only the Case Study data to answer worksheet questions. Information has been limited in an effort to focus the activity. Students should read the case study before attending a course offering, but if not, we recommend reading it as soon as possible on the first day of class. During the first day of class students realize that the general reading is a good start, but assessment requires a more in depth analysis of content and functional and spatial inter-relationships to complete the student activities. The answer to the first question is filled-in as an example. Question Answer Page Number in Case Study 1. What are the major transportation modes in the surrounding area? There is significant water access within 5-miles of the building and, because of the water, ground access is constrained by bridges, tunnels, and ferries. While two major airports are over 5 miles from the building, what is not shown are 8 heliports and two skyports within 5-miles of the building. A metropolitan subway also serves the business district and the nearest station is two blocks from the building. There is significant shipping serving the various ports carrying all types of materials for use in Hazard City and transshipment to other locations. In conjunction with the ports and the transshipment of goods, there is extensive railroad trackage, some as close as within 1- 1/2 miles of the building. The area around Hazard City is the No. 4 intermodal port in the Western Hemisphere. Intermodal means the ability to move freight from ship to train to truck and back again. While the HazardCorp Building is not located on a main thoroughfare, a random estimate of truck traffic within 1,000 feet of the building indicates 30 delivery U-2, U-3, U-14, U-29 Course Title: Building Design for Homeland Security Unit I (U): Introduction and Course Overview SM I-U-4 Question Answer Page Number in Case Study trucks (18-foot-long enclosed bodies) transit the area per hour and a similar number of smaller delivery vans between 0600 and 1800. These numbers reduce to about 10 delivery trucks and 10 delivery vans on average per hour between 1800 and 0600. More than 2,000 trucks loads of hazardous materials are transported each day within city limits. HazardCorp receives mail, packages, and equipment at the Loading Dock where a recently renovated (per DoD criteria) mailroom/shipping office inspects the items using x-ray and other equipment before distributing to tenants within the building. By agreement, HazardCorp Building accepts deliveries for specific tenants in other buildings in the immediate vicinity (within 2 city blocks) due to this mailroom capability. 2. What life safety/ emergency response assets are available, and what are their response times? U-9, U-18 - U-20, U-22 - U-24, U-28 Course Title: Building Design for Homeland Security Unit I (U): Introduction and Course Overview SM I-U-5 Question Answer Page Number in Case Study 3. What threats or hazards may affect HazardCorp Building? U-8, U-28 - U-30 4. What are the prevalent weather/wind conditions at HazardCorp Building? U-8, U-28 Course Title: Building Design for Homeland Security Unit I (U): Introduction and Course Overview SM I-U-6 Question Answer Page Number in Case Study 5. What are the components of HazardCorp Building’s critical utility infrastructure? U-10, U-20 - U-24 6. What are the components of HazardCorp’s critical building infrastructure? U-3, U-4, U-11, U-18 Course Title: Building Design for Homeland Security Unit I (U): Introduction and Course Overview SM I-U-7 Question Answer Page Number in Case Study 7. What personnel are key to the operation of HazardCorp Building? No specific page – think globally of who in Building Management does what for tenants in general. Course Title: Building Design for Homeland Security Unit I (U): Introduction and Course Overview SM I-U-8 This page intentionally left blank Course Title: Building Design for Homeland Security Unit II (U): Asset Value Assessment SM II-U-1 Unit II (U) COURSE TITLE Building Design for Homeland Security UNIT TITLE Asset Value Assessment OBJECTIVES 1. Identify the assets of a building or site that can be affected by a threat or hazard 2. Explain the components used to determine the value of an asset 3. Determine the critical assets of a building or site 4. Provide a numerical rating for the asset and justify the basis for the rating SCOPE The following topics will be covered in this unit: 1. The core functions and critical infrastructure listed on the threatvulnerability matrix 2. Various approaches to determine asset value – FEMA, Department of Defense, Department of Justice, and Veterans Affairs 3. A rating scale and how to use it to determine an asset value 4. Activity: For the assets identified in the Risk Matrix, use the information in the Appendix U Urban Case Study, review the asset value for each asset of interest, and provide rationale for the asset value rating given or as adjusted by assessment team. REFERENCES 1. FEMA 426, Reference Manual to Mitigate Potential Terrorist Attacks Against Buildings, pages 1-10 to 1-14 2. FEMA 452, Risk Assessment - A How-To Guide to Mitigate Potential Terrorist Attacks Against Buildings, pages 2-1 to 2-26 3. Case Study – Appendix U: Urban, HazardCorp Building Course Title: Building Design for Homeland Security Unit II (U): Asset Value Assessment SM II-U-2 UNIT II (U) CASE STUDY ACTIVITY: ASSET VALUE RATING (Urban Version) Asset Value Rating Considerations (Impact or Consequences if asset is lost or damaged) 1. Criticality to the overall organization, agency, company, or government entity goals .. Higher criticality means higher value o Number of users affected o Direct economic loss and cost to rebuild o Potential number of deaths from an attack 2. Criticality to the goals of the specific unit, location, branch, or office being assessed .. Higher criticality means higher value o Number of users affected o Direct economic loss and cost to rebuild o Potential number of deaths from an attack .. Example, the loss of the kitchen at a Veterans Affairs Hospital is important to that hospital, but the loss of that kitchen is not critical to the overall goals of the Department of Veterans Affairs. 3. Ease of replacement .. Harder to replace (measured in months to years) means higher value .. Easier to replace (measures in days) means lower value 4. Relative value of assets .. Just like in fire protection assessment, the higher the cost of the items individually and in aggregate, the higher the value .. For people performing functions, the number of critical personnel and the number of total personnel in the facility determine the relative rating; the higher the number of people the higher the value .. Critical personnel may be harder to replace due to the time needed for education, training, and experience to meet functional needs; similar to ease of replacement but with much longer timelines 5. What are the consequences of destruction, failure, or loss of function of the asset in terms of fatalities and/ or injuries, property losses, and economic impacts? (Similar to criticality above) .. Number of users affected .. Direct economic loss and cost to rebuild .. Potential number of deaths from an attack 6. What is the likelihood of cascading or subsequent consequences should the asset be destroyed or its function lost? .. Interdependency – will loss of the asset have an effect upon other assets in the same or different Critical Infrastructure Sectors Course Title: Building Design for Homeland Security Unit II (U): Asset Value Assessment SM II-U-3 UNIT II (U) CASE STUDY ACTIVITY: ASSET VALUE RATING (Urban Version) Asset value is the degree of debilitating impact that would be caused by the incapacity or destruction of a building’s assets. Page 1-13 of FEMA 426 provides an Asset Value Scale (Table 1-1) to quantify asset value, as well as definitions of the ratings. Table 1-2 on page 1-14 of FEMA 426 provides a format to summarize the value of the major categories of a building’s assets. FEMA 452, pages 2-17 to 2-19 provide additional information. Requirements Refer to the Appendix U Case Study to determine answers to the following questions: The first question is answered below as an example. Activity #1: Identifying Building Core Functions 1. What are HazardCorp (HZC) Building’s primary services or outputs associated with its providing office rental space? [Pages U-3, U-9 to U-10] Building Management provides security (access control and physical), coordination of emergency actions, operation and maintenance of emergency response / life safety systems, underground parking, loading dock security and coordination for supply trucks, vendors, and trash supporting the tenants. Inspection of mail, packages, and equipment using x-ray and other equipment before distributing to tenants within the building and to other agencies within 2 blocks is also a primary service. Utilities, along with emergency backups; and vertical transportation (elevators and stairs) needed for general and specific tenant support. 2. What critical functions / activities take place at HZC to support the goals of the building management and goals of the building tenants? [Pages U-18 to U-27] 3. Who are the building’s primary occupants and visitors? [Pages U-1, U-12] Course Title: Building Design for Homeland Security Unit II (U): Asset Value Assessment SM II-U-4 4. What inputs from external organizations are required for HZC’s success? [Pages U-18 to U-27] Activity #2: Identifying Building Assets and Quantifying Asset Values Use the following process to complete the following tables -- HZC Critical Functions Asset Value Ratings and HZC Critical Infrastructure Asset Value Ratings 1. Refer to Table 1-1 in FEMA 426 and the associated value descriptions for the ratings listed below • Very High (10) • High (8-9) • Medium High (7) • Medium (5-6) • Medium Low (4) • Low (2-3) • Very Low (1) 2. Consider the questions on page 1-11 in FEMA 426 as you rate HZC’s assets. 3. Refer to Table 1-2 in FEMA 426, Nominal Building Asset Value Assessment and use the descriptions of these asset categories as found in the Appendix U Case Study to focus the rating. Another approach is to use an asset value rating of 5 (mid-range) and do a pair-wise comparison to each asset category as the process continues, raising or lowering the rating from 5 as the team compares asset value inputs collected from the Appendix U Case Study. NOTE 1: The first rows in both tables are completed as examples. Nominal ratings are provided in all other asset categories. 1. Confirm the team’s Asset Value Rating for each category [agree, raise, or lower the indicated rating] 2. Provide Rationale for each rating [whether changed or unchanged] 3. Enter information on the following worksheets and on the Risk Matrix poster. NOTE 2: Consult Table 1-22, pages 1-46 to 1-92, in FEMA 426. Look at the content of the questions to understand the various infrastructure asset categories. For example, Utility Systems apply to all utilities outside the 3-foot drip line of the building (from the source to the building, but primarily on the site), while Mechanical, Plumbing, Gas, Electrical, Fire Alarm, Communications, and Information Technology Systems are inside the 3-foot drip line of the building. Course Title: Building Design for Homeland Security Unit II (U): Asset Value Assessment SM II-U-5 HZC Critical Functions Asset Value Ratings Asset Value Numeric Value Rationale 1. Administration Medium 5 While there may be some redundancy and staff skills that can be easily replaced, the Building Management administration keeps the building humming and loss of some or all administration staff would have moderate consequences or impair core processes and functions. Low to medium economic cost to replace, depending upon individual function. 2. Engineering / IT Technicians High 8 Due to the complexity of building operations, including computer systems for Supervisory Control and Data Acquisition, Electronic Security Systems (CCTV and access control), Energy Management and Control Systems, etc., the loss of this function in whole or in part can result in severe loss of primary services or major loss of core processes and functions for an extended period of time. Interim workarounds include manufacturer’s / technical service firms for each individual system. Moderately high economic cost to replace based upon skill sets sought. 2. Loading Dock / Warehouse Low 3 Course Title: Building Design for Homeland Security Unit II (U): Asset Value Assessment SM II-U-6 Asset Value Numeric Value Rationale 3. Data Center High 8 4. Communications High 8 5. Security Medium 5 Course Title: Building Design for Homeland Security Unit II (U): Asset Value Assessment SM II-U-7 Asset Value Numeric Value Rationale 6. Housekeeping Low 2 HZC Critical Infrastructure Asset Ratings Asset Value Numeric Value Rationale 1. Site Medium Low 4 Building owner has a large investment in the building and site. Loss of access to site by Building Management, but more so tenants, would have rippling economic impact. Because only parking and some fuel storage is underground, and site is relatively small, the building and its functions will have moderate to serious consequences and impairment of core functions and processes supporting the tenants. 2. Architectural Medium 6 Locations of functions within the building and their proximity to high risk areas, like the lobby, loading dock, and streets place a high value on where functions are placed in the building and how they can be protected. Architectural placement has serious consequences and impact upon core processes and functions over an extended period of time. Course Title: Building Design for Homeland Security Unit II (U): Asset Value Assessment SM II-U-8 Asset Value Numeric Value Rationale 3. Structural Systems High 8 4. Envelope Systems Medium High 7 5. Utility Systems Medium High 7 Course Title: Building Design for Homeland Security Unit II (U): Asset Value Assessment SM II-U-9 Asset Value Numeric Value Rationale 6. Mechanical Systems High 8 7. Plumbing and Gas Systems High 8 8. Electrical Systems High 8 Course Title: Building Design for Homeland Security Unit II (U): Asset Value Assessment SM II-U-10 Asset Value Numeric Value Rationale 9. Fire Alarm Systems Medium 6 10. IT / Communications Systems High 8 Course Title: Building Design for Homeland Security Unit III (U): Threat/Hazard Assessment SM III-U-1 Unit III (U) COURSE TITLE Building Design for Homeland Security UNIT TITLE Threat/Hazard Assessment OBJECTIVES 1. Identify the threats and hazards that may impact a building or site. 2. Define each threat and hazard using the FEMA 426 methodology. 3. Provide a numerical rating for the threat or hazard and justify the basis for the rating. 4. Define the Design Basis Threat, Levels of Protection, and Layers of Defense. SCOPE The following topics will be covered in this unit: 1. From what offices is threat and hazard information available? 2. The spectrum of event profiles for terrorism and technological hazards from FEMA 386-7. 3. The FEMA 426 approach to determine threat rating. 4. A rating scale and how to use it to determine a threat rating. 5. Activity: As a team identify threat rating of the four threats selected for this course (Cyber Attack, Armed Attack, Vehicle Bomb, CBR Attack) against each identified asset using the Case Study and provide the rationale for these threat ratings. REFERENCES 1. FEMA 426, Reference Manual to Mitigate Potential Terrorist Attacks Against Buildings, pages 1-14 to 1-24 2. FEMA 452, Risk Assessment: A How-To Guide to Mitigate Potential Terrorist Attacks Against Buildings, pages 1-1 to 1-30 3. Case Study – Appendix U: Urban, HazardCorp Building Course Title: Building Design for Homeland Security Unit III (U): Threat/Hazard Assessment SM III-U-2 UNIT III (U) CASE STUDY ACTIVITY: THREAT / HAZARD RATING (Urban Version) Threat/Hazard Rating Considerations (Likelihood of Attack or Occurrence) 1. Asset visibility to terrorists, proximity to technological hazards, or locality for natural hazard .. Higher visibility, closer proximity to technological hazards, or location within specific locality for natural hazards raise threat rating o Iconic structure is considered highest visibility .. Lower visibility, far from technological hazards, and not located where earthquake, wind, fire, or flood are known dangers would lower threat rating .. List from FEMA 386-2 as potential hazards o Avalanche o Coastal Erosion o Coastal Storm o Dam Failure o Drought o Earthquake o Expansive Soils o Extreme Heat o Flood o Hailstorm o Hurricane o Land Subsidence o Landslide o Severe Winter Storm / Ice Storms, Heavy Snows, Transportation restricted o Tornado o Tsunami o Volcano o Wildfire o Windstorm o Added: Extended loss of water, sewage, or electric utilities o Added: Extended loss of garbage or debris collection 2. Usefulness of assets with cash value, with direct application to attacker’s goals, or with publicity value .. Generally, higher the cash value, greater applicability to terrorist goals, and great publicity value, the higher the threat from criminals and terrorists and the higher the rating 3. Asset availability .. If available at one location only – high threat rating) .. If available everywhere – low threat rating 4. Number of local incidents in the past Course Title: Building Design for Homeland Security Unit III (U): Threat/Hazard Assessment SM III-U-3 .. The higher the number of incidents (all potential sources) the higher the threat rating 5. Number of incidents in the geographic area in the past .. The higher the number of incidents (all potential sources) the higher the threat rating 6. Potential for future incidents -- subjective view of likelihood that can be adjusted for the following: .. The higher the number of terrorist organizations operating with ability or desire to be in the vicinity the higher the threat rating .. The higher the number of potential technological hazards sites nearby the higher the threat rating .. The expected future occurrence of flood, wind, and seismic activity in the specific locality the higher the threat / hazard rating 7. Accessibility to asset (this is used as a threat input by many methodologies, but could be viewed as a vulnerability consideration as explained below) .. The fewer layers of defense in place, the higher the threat rating – This is based upon the terrorist assessment of the building as a future successful target .. DETER and DETECT measures as defined on page 1-9 of FEMA 426 are methods for reducing the threat .. DENY measures as defined on page 1-9 of FEMA 426 are methods of hardening the site and building and would be described better as mitigation of vulnerability 8. Effectiveness of law enforcement (including counter intelligence) .. Greater the effectiveness, the lower the threat rating – Detect 9. Cyber .. Does function or infrastructure have any components using electronics, software, or data (information technology) or communications o If yes, then threat is high due to the ease of identifying / pinging these systems o If no, then threat is low o Level of threat is relative to the value of information contained or the consequences of change that would draw the terrorist or hacker to want to enter the system .. Cyber experts go into much greater detail, but essentially are looking at a common vulnerability standard vice a threat rating Course Title: Building Design for Homeland Security Unit III (U): Threat/Hazard Assessment SM III-U-4 This page intentionally left blank Course Title: Building Design for Homeland Security Unit III (U): Threat/Hazard Assessment SM III-U-5 UNIT III (U) CASE STUDY ACTIVITY: THREAT / HAZARD RATING (Urban Version) After assets that need to be protected are determined, the next step is to identify the threats and hazards that could harm the building and its inhabitants. Hazards are categorized into two groups: natural and manmade. For the sake of this course, the four primary threats selected are Cyber Attack, Armed Attack, Vehicle Bomb, and CBR Attack. Requirements Refer to the Appendix U Case Study data and complete the following worksheets. Each assessment team will interpret the HZC threat information and should select and justify a threat/hazard rating number with rationale. • Any function with key IT systems should get high cyber threat values. • The threat of explosive blast should be looked upon either as directly targeted or as collateral damage. Before giving a consistently low rating, consider your answer to Activity # 1 below as it would have been applied to the Murrah Building in Oklahoma City in 1995. • A CBR attack or nearby HazMat spill could impact the entire facility, but to varying degrees by floors in a 50-story building if the agent is heavier or lighter than air. Thus, to illustrate threat assessment, two activities were selected for their different methodology. • Activity #1 uses the FEMA 452 Criteria that has its basis in the rating process developed by the US Marshals Service after the Murrah Building bombing in Oklahoma City. The US Marshals Service process was then used by GSA to begin assessing Federal buildings. This method tends to look at the building as a whole. • Activity #2 uses the FEMA 426 methodology of applying a threat rating using specific or generic tactics in a given threat scenario against a specific asset, such as critical functions or critical infrastructure. Thus, this method tends to look at the various components of the building so as to focus limited resources to achieve maximum risk reduction by taking care of the most critical assets. Final Action: Transfer answers from the Threat Rating tables below to the Risk Matrix poster after team agreement on team answer. Course Title: Building Design for Homeland Security Unit III (U): Threat/Hazard Assessment SM III-U-6 Activity #1: Determine the threat score for a 500-lb. vehicle bomb as applied to HZC Familiarize yourself with the process of determining the primary threats according to the FEMA 452 criteria (Table 1-4, page 1-21, FEMA 452 and provided on the next page (SM III-U-7) of this unit) by determining the threat score for a 500-lb. (TNT equivalent) vehicle bomb using the information on the next page and in the Appendix U Case Study. As shown in Table 1-5, page 1-22, FEMA 452, you can use this scoring methodology to determine your primary threats based upon the threats that achieve the highest scores. However note that the criteria actually intersperses Asset Value Rating, Threat Rating, and Vulnerability Rating as indicated below: • Access to Agent (Threat – capability of potential threat elements) • Knowledge/Expertise (Threat – capability of potential threat elements) • History of Threats/Actual Usage (Threat – rhetoric and actual use by potential threat elements) • Asset Visibility / Symbolic (Asset Value – but in eyes of potential threat elements as target) • Asset Accessibility (Vulnerability) • Site Population / Capacity (Asset Value or Threat (Targeting)) • Level of Defense (Vulnerability) FEMA 452 Table 1-5 Excerpt Scenario Access to Agent Knowledge/ Expertise History of Threats Against Buildings Asset Visibility / Symbolic Asset Accessibility Site Population / Capacity Level of Defense Score Improvised Explosive Device (Bomb) 500 lb. Vehicle Bomb Course Title: Building Design for Homeland Security Unit III (U): Threat/Hazard Assessment SM III-U-7 FEMA 452 Criteria, Table 1-4 Scenario Access to Agent Knowledge / Expertise History of Threats Against Buildings Asset Visibility / Symbolic Asset Accessibility Site Population / Capacity Level of Defense 9-10 Readily available Basic knowledge / open source Local incident Existence widely known / iconic Open access, unrestricted parking > 5,000 Little or no defense against threats. No security design was taken into consideration and no mitigation measures adopted. 6-8 Easily producible Bachelor or technical school / open scientific or technical literature Regional/ State Existence locally known / landmark Open access, restricted parking 1,001- 5,000 Minimal defense against threats. Minimal security design was taken into consideration and minimal mitigation measures adopted. 3-5 Difficult to produce or acquire Advanced training / rare scientific or declassified literature National Existence published / well known Controlled access, protected entry 251-1,000 Significant defense against threats. Significant security design was taken into consideration and substantial mitigation measures adopted. 1-2 Very difficult to produce or acquire Advanced degree or training / classified information International Existence not well known / no symbolic importance Remote location, secure perimeter, armed guards, tightly controlled access 1-250 Extensive defense against threats. Extensive security design was taken into consideration and extensive mitigation measures adopted. Course Title: Building Design for Homeland Security Unit III (U): Threat/Hazard Assessment SM III-U-8 Activity #2: Determine Threat Ratings for HazardCorp Building This is the FEMA 426 method for determining the “Threat Rating.” The rating scale is a scale of 1 to 10, with 1 being a very low probability of a terrorist attack and 10 a very high probability. Complete the Threat Rating tables below keeping the rationale for the team ratings across each threat in mind NOTE 1: In the previous student activity to determine Asset Value Rating, there was only one value of an asset – it did not change based upon threat or situation. The impact if the asset was damaged or lost is a view of its value. NOTE 2: In like manner, the Threat Rating will tend to be the same across all assets. Variances can occur across large buildings where all functions may not exist in all portions of the building or the targeting of the asset may be negligible – no history, no capability, no intent. Recommendation: For Cyber Attack against an asset that has no computer and no connection to the internet the Threat Rating should be based upon the asset having a computer internet connection. Then handle the lack of computer and/or lack of internet connection under the Vulnerability Rating. Then if the asset gets a future computer and/or future internet connection only the Vulnerability Rating need be adjusted. HZC Critical Functions Threat Ratings Function Cyber Attack Armed Attack Vehicle Bomb CBR Attack 1. Administration 2. Engineering / IT Technicians 3. Loading Dock / Warehouse 4. Data Center Course Title: Building Design for Homeland Security Unit III (U): Threat/Hazard Assessment SM III-U-9 Function Cyber Attack Armed Attack Vehicle Bomb CBR Attack 5. Communications 6. Security 7. Housekeeping Rationale Cyber Attack Functions Rationale Armed Attack Functions Course Title: Building Design for Homeland Security Unit III (U): Threat/Hazard Assessment SM III-U-10 Rationale Vehicle Bomb Functions Rationale CBR Attack Functions HZC Critical Infrastructure Threat Ratings Infrastructure Cyber Attack Armed Attack Vehicle Bomb CBR Attack 1. Site 2. Architectural 3. Structural Systems Course Title: Building Design for Homeland Security Unit III (U): Threat/Hazard Assessment SM III-U-11 Infrastructure Cyber Attack Armed Attack Vehicle Bomb CBR Attack 4. Envelope Systems 5. Utility Systems 6. Mechanical Systems 7. Plumbing and Gas Systems 8. Electrical Systems 9. Fire Alarm Systems 10. IT / Communications Systems Rationale Cyber Attack Infrastructure Course Title: Building Design for Homeland Security Unit III (U): Threat/Hazard Assessment SM III-U-12 Rationale Armed Attack Infrastructure Rationale Vehicle Bomb Infrastructure Rationale CBR Attack Infrastructure Course Title: Building Design for Homeland Security Unit IV (U): Vulnerability Assessment SM IV-U-1 Unit IV (U) COURSE TITLE Building Design for Homeland Security UNIT TITLE Vulnerability Assessment OBJECTIVES 1. Explain what constitutes a vulnerability 2. Identify vulnerabilities using the Building Vulnerability Assessment Checklist 3. Understand that an identified vulnerability may indicate that an asset is vulnerable to more than one threat or hazard and that mitigation measures may reduce vulnerability to one or more threats or hazards. 4. Provide a numerical rating for the vulnerability and justify the basis for the rating SCOPE The following topics will be covered in this unit: 1. A review of types of vulnerabilities, especially single-point vulnerabilities and tactics possible under threats/hazards for which there are no mitigation measures. 2. Various approaches and considerations to determine vulnerabilities – FEMA (primarily), with inputs from Departments of Defense, Justice, and Veterans Affairs. 3. A rating scale and how to use it to determine a vulnerability rating. 4. Activity: Make an initial identification of vulnerabilities present in the Case Study answering selected Vulnerability Assessment Checklist questions. Then, determine the vulnerability rating (including rationale) for each asset-threat/hazard pair of interest, using the four threats selected for this course (Cyber Attack, Armed Attack, Vehicle Bomb, CBR Attack) as applied against the identified assets of the HZC Building. Achieve team concurrence on answers. REFERENCES 1. FEMA 426, Reference Manual to Mitigate Potential Terrorist Attacks Against Buildings, pages 1-24 to 1-35 and pages 1-45 to 1- 93 2. FEMA 452, Risk Assessment: A How-To Guide to Mitigate Potential Terrorist Attacks Against Buildings, pages 3-1 to 3-20 3. Case Study – Appendix U: Urban, HazardCorp Building Course Title: Building Design for Homeland Security Unit IV (U): Vulnerability Assessment SM IV-U-2 UNIT IV (U) CASE STUDY ACTIVITY: VULNERABILITY RATINGS (Urban Version) Vulnerability Rating Considerations (susceptibility to damage resulting from that attack tactic being used against that asset or hazard occurring that affects that asset) 1. Effectiveness of threat tactic / hazard against asset .. The greater the predicted or modeled effectiveness the greater the vulnerability o Number of people injured or killed o Amount of building destroyed o Level of publicity expected to occur 2. Redundancy .. Back-up facility or equipment that offsets the loss of the asset o Partial back-up: 10 to 90% o One full back-up: 100% o Additional back-up depending upon workload: 125%, 150%, 200% .. The greater the redundancy the less the vulnerability; but too much redundancy can reduce reliability 3. Layers of Defense and depth of layers .. DENY measures as defined on page 1-9 of FEMA 426 are methods of hardening the site and building and would be described better as mitigation of vulnerability .. How far do the mitigation measures keep the threat away from the asset? o The more complete the Layers of Defense and the greater the depth (stand-off distance) of these layers the lower the vulnerability. 4. Cyber .. Can a terrorist or hacker get any access to the function or infrastructure that has components of electronics, software, data (information technology), or communications o If none of these components, the vulnerability is very low o If components are all stand alone, the vulnerability is also very low, but probably greater than one .. Example: electric typewriters give off varying radio frequencies during operation that allows specific key strokes to be identified and, therefore, recreated o If components use wireless, radio frequency, cell phones, land lines, or hardwired internet or communications connections then vulnerability is based upon DETECT (anti-virus or access attempts), DETER (access protocols, physical security), DENY (firewalls, encryption, shielding), or other measures .. Cyber experts have detailed and in-depth approaches to assessing vulnerability. A proposed industry standard is CVSS (Common Vulnerability Scoring System) which prioritizes vulnerabilities and indicates to system administrators the tasks they should expend available manpower upon. Course Title: Building Design for Homeland Security Unit IV (U): Vulnerability Assessment SM IV-U-3 UNIT IV (U) CASE STUDY ACTIVITY: VULNERABILITY RATING (Urban Version) Vulnerability is any weakness that can be exploited by an aggressor or, in a non-terrorist threat environment, make an asset susceptible to hazard damage. Vulnerabilities may include: • Critical functions or systems that lack redundancy and, if damaged, would result in immediate organization disruption or loss of capability (“Single-Point Vulnerability”) • Redundant systems feeding into a single critical node • Critical components of redundant systems collocated • Inadequate capacity or endurance in a post-attack environment Vulnerability rating requires identifying and rating the vulnerability of each asset-threat/hazard pair of interest. An in-depth vulnerability assessment of a building evaluates specific design and architectural features and identifies all vulnerabilities of the building functions and infrastructure systems. Vulnerability Rating Activities 1. Answer the following Building Vulnerability Checklist Questions and record relevant observations in the table regarding the HZC site and building information from the Appendix U Case Study. Determine if the observation indicates that any vulnerabilities exist. 2. Complete the tables for HZC Critical Functions Vulnerability Ratings and HZC Critical Infrastructure Vulnerability Ratings by filling in the initial vulnerability rating for the assetthreat/ hazard pairs. 3. Transfer the vulnerability ratings to the Risk Matrix poster after reaching team consensus on the answers. Building Vulnerability Checklist Questions Sectio n Vulnerability Question Guidance Observations 1.16 Does adjacent surface parking on site maintain a minimum stand-off distance? The specific stand-off distance needed is based upon the design basis threat bomb size and the building construction. For initial screening, consider using 25 meters (82 feet) as a minimum, with more distance needed for unreinforced masonry or wooden walls. Reference: GSA PBS-P100 On the east side of the plaza is a drop off zone where no parking is allowed and building stand-off is 80 feet. On the north and west sides of the building for the whole building block, parking is restricted to government vehicles only with designated parking spaces. Course Title: Building Design for Homeland Security Unit IV (U): Vulnerability Assessment SM IV-U-4 Sectio n Vulnerability Question Guidance Observations Double parking next to the government vehicles provides 15 feet of stand-off on the north side and 10 feet of stand-off on the west. Commercial parking is allowed on the south side in support of the Loading Dock and stand-off is 10 feet. With parking only providing stand-off of 10 to 80 feet, the design basis threat must be evaluated at these distances to determine hardening required to limit damage. 1.19 Do site landscaping and street furniture provide hiding places? Minimize concealment opportunities by keeping landscape plantings (hedges, shrubbery, and large plants with heavy ground cover) and street furniture (bus shelters, benches, trash receptacles, mailboxes, newspaper vending machines) away from the building to permit observation of intruders and prevent hiding of packages. If mail or express boxes are used, the size of the openings should be restricted to prohibit the insertion of packages. Reference: GSA PBS-P100 2.15 Are critical assets (people, activities, building systems and components) located close to any main entrance, vehicle circulation, parking, maintenance area, loading dock, or interior parking? Are the critical building Critical building components include: Emergency generator including fuel systems, day tank, fire sprinkler, and water supply; Normal fuel storage; Main switchgear; Telephone distribution and main switchgear; Fire pumps; Building control centers; Uninterruptible Power Supply (UPS) systems controlling critical functions; Main refrigeration and Course Title: Building Design for Homeland Security Unit IV (U): Vulnerability Assessment SM IV-U-5 Sectio n Vulnerability Question Guidance Observations systems and components hardened? ventilation systems if critical to building operation; Elevator machinery and controls; Shafts for stairs, elevators, and utilities; Critical distribution feeders for emergency power. Evacuation and rescue require emergency systems to remain operational during a disaster and they should be located away from attack locations. Primary and backup systems should be separated to reduce the risk of both being impacted by a single incident if collocated. Utility systems should be located at least 50 feet from loading docks, front entrances, and parking areas. One way to harden critical building systems and components is to enclose them within hardened walls, floors, and ceilings. Do not place them near high-risk areas where they can receive collateral damage. Reference: GSA PBS-P100 2.16 Are high-value or critical assets located as far into the interior of the building as possible and separated from the public areas of the building? Critical assets, such as people and activities, are more vulnerable to hazards when on an exterior building wall or adjacent to uncontrolled public areas inside the building. Reference: GSA PBS-P100 4.2 Are there less than 40 percent fenestration openings per structural bay? Is the window system design on the exterior façade balanced to mitigate the hazardous effects of flying glazing following an explosive event? (glazing, frames, anchorage to The performance of the glass will similarly depend on the materials. Glazing may be single pane or double pane, monolithic or laminated, annealed, heat strengthened or fully tempered. The percent fenestration is a balance between protection level, cost, the architectural look of the building within its surroundings, and building codes. One goal is to keep fenestration to below 40 percent of the building envelope vertical surface area, but the Course Title: Building Design for Homeland Security Unit IV (U): Vulnerability Assessment SM IV-U-6 Sectio n Vulnerability Question Guidance Observations supporting walls, etc.) process must balance differing requirements. A blast engineer may prefer no windows; an architect may favor window curtain walls; building codes require so much fenestration per square footage of floor area; fire codes require a prescribed window opening area if the window is a designated escape route; and the building owner has cost concerns. Ideally, an owner would want 100 percent of the glazed area to provide the design protection level against the postulated explosive threat (design basis threat – weapon size at the expected standoff distance). However, economics and geometry may allow 80 percent to 90 percent due to the statistical differences in the manufacturing process for glass or the angle of incidence of the blast wave upon upper story windows (4th floor and higher). Reference: GSA PBS-P100 Course Title: Building Design for Homeland Security Unit IV (U): Vulnerability Assessment SM IV-U-7 HZC Critical Functions Vulnerability Ratings Requirements Refer to the Appendix U Case Study and rate the vulnerability of the following assetthreat/ hazard pairs of interest. Transfer vulnerability ratings to the Risk Matrix and achieve team consensus on the answers. Function Cyber Attack Armed Attack Vehicle Bomb CBR Attack 1. Administration 2. Engineering / IT Technicians 3. Loading Dock / Warehouse 4. Data Center 5. Communications 6. Security 7. Housekeeping Course Title: Building Design for Homeland Security Unit IV (U): Vulnerability Assessment SM IV-U-8 HZC Critical Infrastructure Vulnerability Ratings Refer to the Appendix U Case Study and rate the vulnerability of the following assetthreat/ hazard pairs of interest. Transfer vulnerability ratings to the Risk Matrix and achieve team consensus on the answers. Infrastructure Cyber Attack Armed Attack Vehicle Bomb CBR Attack 1. Site 2. Architectural 3. Structural Systems 4. Envelope Systems 5. Utility Systems 6. Mechanical Systems 7. Plumbing and Gas Systems 8. Electrical Systems 9. Fire Alarm Systems 10. IT / Communications Systems Course Title: Building Design for Homeland Security Unit V (U): Risk Assessment/Risk Management SM V-U-1 Unit V (U) COURSE TITLE Building Design for Homeland Security UNIT TITLE Risk Assessment / Risk Management OBJECTIVES 1. Explain what constitutes risk. 2. Provide a numerical rating for risk and justify the basis for the rating. 3. Evaluate risk using the Risk (Threat-Vulnerability) Matrix to capture assessment information. 4. Identify top risks for asset-threat/hazard pairs of interest that should receive measures to mitigate vulnerabilities and reduce risk. SCOPE The following topics will be covered in this unit: 1. Definition of risk and the various components to determine a risk rating. 2. The FEMA 426 approach to determining risk. 3. A rating scale and how to use it to determine a risk rating. One or more specific examples will be used to focus students on the following activity. 4. The relationships between high risk, the need for mitigation measures, and the need to identify a Design Basis Threat and Level of Protection. 5. Activity: Determine the risk rating for the asset-threat/hazard pairs of interest. Identify the top three risk ratings for the Case Study. REFERENCES 1. FEMA 426, Reference Manual to Mitigate Potential Terrorist Attacks Against Buildings, pages 1-35 to 1-44 2. FEMA 452, Risk Assessment: A How-To Guide to Mitigate Potential Terrorist Attacks Against Buildings, pages 4-1 to 4-9 3. Case Study – Appendix U: Urban, HazardCorp Building Course Title: Building Design for Homeland Security Unit V (U): Risk Assessment/Risk Management SM V-U-2 This page intentionally left blank Course Title: Building Design for Homeland Security Unit V (U): Risk Assessment/Risk Management SM V-U-3 UNIT V (U) CASE STUDY ACTIVITY: RISK RATING (Urban Version) One approach to conducting a risk assessment is to assemble the results of the asset value assessment, the threat/hazard assessment, and the vulnerability assessment, and determine a numeric value of risk for each asset-threat/hazard pair of interest using the following formula: Risk = Asset Value Rating x Threat Rating x Vulnerability Rating Requirements 1. Use the following tables to summarize the HZC asset, threat, and vulnerability assessments conducted in the previous three unit activities. Then use the formula above to determine the risk rating for each asset-threat/hazard pair of interest identified under Critical Functions and under Critical Infrastructure. Transfer to the Risk Matrix and reach team consensus on answers. 2. Identify the highest risk ratings and use Figure 1-13 of FEMA 426 (page 1-44) to begin a determination of the risk management options available to reduce these risk ratings by reducing applicable individual ratings for asset value, threat/hazard, or vulnerability. Then identify the top three risk ratings and keep in mind as mitigation measures are discussed in future instruction units. HZC Critical Functions Risk Ratings Function Cyber Attack Armed Attack Vehicle Bomb CBR Attack 1. Administration Risk Rating Asset Value Threat Rating Vulnerability Rating 2. Engineering/IT Technicians Risk Rating Asset Value Threat Rating Vulnerability Rating Course Title: Building Design for Homeland Security Unit V (U): Risk Assessment/Risk Management SM V-U-4 Function Cyber Attack Armed Attack Vehicle Bomb CBR Attack 3. Loading Dock/ Warehouse Risk Rating Asset Value Threat Rating Vulnerability Rating 4. Data Center Risk Rating Asset Value Threat Rating Vulnerability Rating 5. Communications Risk Rating Asset Value Threat Rating Vulnerability Rating 6. Security Risk Rating Asset Value Threat Rating Vulnerability Rating 7. Housekeeping Risk Rating Asset Value Threat Rating Vulnerability Rating Course Title: Building Design for Homeland Security Unit V (U): Risk Assessment/Risk Management SM V-U-5 HZC Critical Infrastructure Risk Ratings Infrastructure Cyber Attack Armed Attack Vehicle Bomb CBR Attack 1. Site Risk Rating Asset Value Threat Rating Vulnerability Rating 2. Architectural Risk Rating Asset Value Threat Rating Vulnerability Rating 3. Structural Systems Risk Rating Asset Value Threat Rating Vulnerability Rating 4. Envelope Systems Risk Rating Asset Value Threat Rating Vulnerability Rating 5. Utility Systems Risk Rating Asset Value Threat Rating Vulnerability Rating Course Title: Building Design for Homeland Security Unit V (U): Risk Assessment/Risk Management SM V-U-6 Infrastructure Cyber Attack Armed Attack Vehicle Bomb CBR Attack 6. Mechanical Systems Risk Rating Asset Value Threat Rating Vulnerability Rating 7. Plumbing and Gas Systems Risk Rating Asset Value Threat Rating Vulnerability Rating 8. Electrical Systems Risk Rating Asset Value Threat Rating Vulnerability Rating 9. Fire Alarm Systems Risk Rating Asset Value Threat Rating Vulnerability Rating 10. IT/Communications Systems Risk Rating Asset Value Threat Rating Vulnerability Rating Course Title: Building Design for Homeland Security Unit VI (U): FEMA 452 Risk Assessment Database SM VI-U-1 Unit VI (U) COURSE TITLE Building Design for Homeland Security UNIT TITLE FEMA 452 Risk Assessment Database OBJECTIVES 1. Explain the database install process (Options 2 and 3). 2. Identify where to save photos, maps, drawings, plans, etc., to interface with the database. 3. Explain the information required for the database to function within each screen, how to move between screens, and switch between the assessor’s tool operating mode and the master database operating mode. 4. Explain the benefit and approaches to setting priorities on identified vulnerabilities. 5. Explain how to use the master database operating mode to produce standard reports and search the database for specific information. SCOPE The following topics will be covered in this unit: 1. The installation of the FEMA 452 Risk Assessment Database (Options 2 and 3). 2. Inputting data into the database and linking associated information, such as GIS images, Miscellaneous files, and Photos. 3. Navigation in the database to operate all functions. 4. Risk management capability using the database. 5. Activity: Students will follow the instruction unit. Option 1: Students install software prior to arriving at course with help of System Administrator as required and begin familiarization. This unit completes the familiarization. Option 2: In a demonstration / performance mode, follow the instruction unit, installing the databases, and navigating the databases following the instructor’s presentation. Option 3: Install the databases and navigate them outside the instruction unit at some time on Day 2 or later. Course Title: Building Design for Homeland Security Unit VI (U): FEMA 452 Risk Assessment Database SM VI-U-2 REFERENCES 1. FEMA 426, Reference Manual to Mitigate Potential Terrorist Attacks Against Buildings, Chapter 1 2. FEMA 452, Risk Assessment - A How-To Guide to Mitigate Potential Terrorist Attacks Against Buildings, pages 4-1 to 4-10 3. FEMA 452 Risk Assessment Database CD with Install Wizard (latest version) Course Title: Building Design for Homeland Security Unit VI (U): FEMA 452 Risk Assessment Database SM VI-U-3 UNIT VI (U) CASE STUDY ACTIVITY: FEMA 452 RISK ASSESSMENT DATABASE (Urban Version) To this point the assessment procedures have been done manually to understand the thought process. Once the process is understood, the need to be able to manage assessment information, especially from multiple assessments, becomes evident. This unit shows the features of the FEMA 452 Risk Assessment Database v3.0, 16 January 2007, (or the latest version) in a demonstration/performance instruction approach or a presentation approach with software installation being done before arriving at the course, sometime on Day 2, or later. Requirements Minimum hardware and software requirements: Pentium® 4 or equivalent Windows XP MS Access® 2002 256 MB of RAM recommended for all components Option 1: Students should have individual personal laptops that they have brought to the course. They have downloaded the database software either from the FEMA Risk Management Series web site or from a FEMA Floodmaps e-mail. They will work with their Systems Administrator as required to ensure the laptop meets the minimum hardware and software requirements listed above and that the software installation is successful. The students may begin familiarization with the software, but that will require some review of the User’s Guide. During the course, the instructor will use PowerPoint slides with database screen captures to illustrate the various features of the software. The database installation slides will be hidden as the laptops will already be loaded with the database and other files. Option 2: This option works best when the students are conversant in loading software on their laptop, have the necessary minimum requirements on their laptop, and have administrator rights for loading software. The instructor will provide a CD to each student as part of the course handouts, have the students download the database from the FEMA Risk Management Series web site, or have the students download the database from a FEMA Floodmaps e-mail. The CD or database ZIP file contains the install wizard programs to install the database on the laptop. It also contains other files to illustrate the user interface, input, and functions of the database. As the instructor presents the instruction unit, the student will follow on their laptop so that at the end of the instruction block the student has an initial familiarization of the database features, how to use the database as a risk assessment/risk management tool, and has it loaded on the laptop for their personal use in the future. Course Title: Building Design for Homeland Security Unit VI (U): FEMA 452 Risk Assessment Database SM VI-U-4 It the student does not have a laptop, they may look over the shoulder of someone who does have a laptop or just follow along the slide presentation which uses screen captures of the software throughout the processes demonstrated. Option 3: When few students have laptops, the laptop users do not have administrator rights, or laptop users have other restrictions on loading new software, the demonstration / performance approach becomes too time consuming and detracts from the learning experience of most of the students. In this case, presentation of the PowerPoint visuals without demonstration / performance is the approach to use. Then at an identified time on Day 2, those who want to load the software on their laptops can do so with the help of the instructors or load it later at their convenience. The instruction unit flows more smoothly in this situation. Course Title: Building Design for Homeland Security Unit VII (U): Explosive Blast SM VII–U-1 Unit VII (U) COURSE TITLE Building Design for Homeland Security UNIT TITLE Explosive Blast OBJECTIVES 1. Explain the basic physics involved during an explosive blast event, whether by terrorism or technological accident. 2. Explain building damage and personnel injuries resulting from the blast effects upon a building. 3. Perform an initial prediction of blast loading and effects based upon incident pressure. SCOPE The following topics will be covered in this unit: 1. Time-pressure regions of a blast event and how these change with distance from the blast. 2. Difference between incident pressure and reflected pressure. 3. Differences between peak pressure and peak impulse and how these differences affect building components. 4. Building damage and personnel injuries generated by blast wave effects. 5. Levels of protection used by the Department of Defense and the General Services Administration / Interagency Security Committee. 6. The nominal range-to-effect chart [minimum stand-off in feet versus weapon yield in pounds of TNT-equivalent] for an identified level of damage or injury. 7. The benefits of stand-off distance. 8. Approaches to predicting blast loads and effects, including one using incident pressure. REFERENCES 1. FEMA 426, Reference Manual to Mitigate Potential Terrorist Attacks Against Buildings, Chapter 4 2. Case Study – Appendix U: Urban, HazardCorp Building Course Title: Building Design for Homeland Security Unit VII (U): Explosive Blast SM VII-U-2 This page intentionally left blank Course Title: Building Design for Homeland Security Unit VII (U): Explosive Blast SM VII-U-3 UNIT VII (U) CASE STUDY ACTIVITY: STAND-OFF DISTANCE AND THE EFFECTS OF EXPLOSIVE BLAST (Urban Version) The requirements in this unit’s activity are intended to provide a check on learning about explosive blast. Requirements 1. In the empty cells in the table below, identify whether the adjacent description defines incident pressure or reflected pressure. Definition Type of Pressure Characterized by an almost instantaneous rise from atmospheric pressure to peak overpressure. When blast wave impinges on a structure that is not parallel to the direction of the blast wave’s travel, the pressure wave is reflected and reinforced. 2. Refer to Figure 4-5 in FEMA 426 (page 4-11) to answer the following questions regarding the explosives environment: • What is the minimum stand-off distance from explosion of a 100-pound (TNT equiv.) bomb to have a level of confidence that severe wounds from glass (without fragment retention film) will not occur? • What damage would be sustained at 400 foot stand-off from a 5,000-pound (TNT equiv.) explosion? 3. Refer to Figure 4-10 and Table 4-3 in FEMA 426 (pages 4-17 and 4-19, respectively) to answer the following questions regarding the explosives environment. • What is the minimum stand-off required to limit the incident pressure to under 0.5 psi for a 100-pound (TNT equiv.) bomb? • What incident pressure would be expected at 500 feet from a 500-pound (TNT equiv.) bomb and what is the approximate damage that can be expected? Course Title: Building Design for Homeland Security Unit VII (U): Explosive Blast SM VII-U-4 4. Refer to Figure 4-5 (page 4-11) in FEMA 426 to answer the following questions. • For the Design Basis Threats of the Appendix U Case Study being used in this course offering, determine the standoff distance for the damage or injury indicated: o ________ pounds TNT-equivalent .. Glass – Severe Wounds – ______ feet .. Potentially Lethal Injuries – ______ feet .. Threshold, Concrete Columns Fail – ______ feet o ________ pounds TNT-equivalent .. Glass – Severe Wounds – ______ feet .. Potentially Lethal Injuries – ______ feet .. Threshold, Concrete Columns Fail – ______ feet Course Title: Building Design for Homeland Security Unit VIII (U): Chemical, Biological, and Radiological (CBR) Measures SM VIII-U-1 Unit VIII (U) COURSE TITLE Building Design for Homeland Security UNIT TITLE Chemical, Biological, and Radiological (CBR) Measures OBJECTIVES 1. Explain the five possible protective actions for a building and its occupants. 2. Compare filtration system efficacy relative to the particles present in CBR agents. 3. Explain the key issues with CBR detection. 4. Identify the indications of CBR contamination. SCOPE The following topics will be covered in this unit: 1. The five possible protective actions for a building and its occupants: evacuation; sheltering in place; personal protective equipment; air filtration and pressurization; and exhausting and purging. 2. Air filtration and cleaning principles and its application. 3. CBR detection technology currently available. 4. Indications of CBR contamination that do not use technology. REFERENCES 1. FEMA 426, Reference Manual to Mitigate Potential Terrorist Attacks Against Buildings, Chapter 5 2. FEMA 426, Appendix C, Chemical, Biological, and Radiological Glossary 3. Case Study – Appendix U: Urban, HazardCorp Building Course Title: Building Design for Homeland Security Unit VIII (U): Chemical, Biological, and Radiological (CBR) Measures SM VIII-U-2 This page intentionally left blank Course Title: Building Design for Homeland Security Unit VIII (U): Chemical, Biological, and Radiological (CBR) Measures SM VIII-U-3 UNIT VIII (U) CASE STUDY ACTIVITY: CHEMICAL, BIOLOGICAL, AND RADIOLOGICAL (CBR) MEASURES (Urban Version) The requirements in this unit’s activity are intended to provide a check on learning about the nature of chemical, biological, and radiological agents and associated mitigation measures. Requirements 1. Identify the prevalent CBR threat(s) that exist and/or are identified as the Design Basis Threat in the Appendix U Case Study. Design Basis Threat Chemical: Biological: Radiological: Other: Course Title: Building Design for Homeland Security Unit VIII (U): Chemical, Biological, and Radiological (CBR) Measures SM VIII-U-4 Refer to Table 5-1 on page 5-12 of FEMA 426 and answer the following questions: 2. What size filtration unit (MERV) is required to filter out 80 percent of Legionella and dust particles (1 to 3 microns) inside the HazardCorp Building? 3. What range of MERV is required to remove 85 percent of smoke particles greater than 0.3 micron in size? 4. What mitigation measures can be used in HVAC systems to destroy bacteria and viruses? Course Title: Building Design for Homeland Security Unit IX (U): Site and Layout Design Guidance SM IX-U-1 Unit IX (U) COURSE TITLE Building Design for Homeland Security UNIT TITLE Site and Layout Design Guidance OBJECTIVES 1. Identify site planning concerns that can create, reduce, or eliminate vulnerabilities and understand the concept of “Layers of Defense.” 2. Recognize protective issues for suburban site planning. 3. Compare the pros and cons of barrier mitigation measures that increase stand-off or promote the need for hardening of buildings at risks. 4. Understand the need for keeping up with the growing demand for security design. 5. Understand the benefits that can be derived from appropriate security design. 6. Understand the benefits of adopting a creative process to face current design challenges. 7. Understand the benefits of including aesthetic elements compatible with security and architecture characteristics of building and surrounding environment. 8. Apply these concepts to an existing site or building and identify mitigation measures needed to reduce vulnerabilities. SCOPE The following topics will be covered in this unit: 1. Land use considerations both outside and inside the property line. 2. Site planning issues, including site design, layout and form, vehicular and pedestrian circulation, and landscape and urban design. 3. Creating stand-off distance using perimeter controls, non-exclusive zones, and exclusive zones along with the design concepts and technology to consider. 4. Design considerations and mitigation measures for building security. 5. Activity: Select mitigation measures that reduce vulnerability and associated risk from the site and layout perspective for the highest risk pairs (asset - threat/hazard) identified in Unit V (U). Course Title: Building Design for Homeland Security Unit IX (U): Site and Layout Design Guidance SM IX-U-2 REFERENCES 1. FEMA 426, Reference Manual to Mitigate Potential Terrorist Attacks Against Buildings, Chapter 2; Checklist at end of Chapter 1 2. FEMA 430, Primer for Incorporating Building Security Components in Architectural Design (when available) 3. FEMA 452, Risk Assessment: A How-To Guide to Mitigate Potential Terrorist Attacks Against Buildings, pages 5-1 to 5-16 4. Case Study – Appendix U: Urban, HazardCorp Building Course Title: Building Design for Homeland Security Unit IX (U): Site and Layout Design Guidance SM IX-U-3 UNIT IX (U) CASE STUDY ACTIVITY: SITE AND LAYOUT DESIGN GUIDANCE (Urban Version) In this student activity, the emphasis is identifying vulnerabilities in the site and layout design. The Building Vulnerability Assessment Checklist in FEMA 426 (Table 1-22, pages 1-46 to 1-93) provides a tool for vulnerability assessment of proposed and existing sites and buildings. Requirements Assign sections of the checklist questions below to the assessment team members. Refer to the Appendix U Case Study to determine answers to the questions. Then review results as a team to identify vulnerabilities and possible mitigation measures. Activity # 1: Complete the selected vulnerability checklist questions in the following Vulnerability Questions table. Note: There are 38 questions to complete below (14 in Section 1, 4 in Section 2, and 20 in Section 5), so it is recommended that the team split up the questions among themselves taking 5-7 questions each and review the Appendix U Case Study for answers. Apportion the available time for gathering the answers and then provide each other the answers while performing the activities below. Activity # 2: Upon completion of the questions refer back to the vulnerability ratings determined in the Unit IV (U) Student Activity. Based on this more detailed analysis, decide if any vulnerability rating needs adjustment. Adjust the Risk Matrix poster accordingly for vulnerability rating and risk rating. Activity # 3: Select mitigation measures to reduce vulnerability and associated risk from the site and layout perspective. Concentrate on the three highest risk ratings on the Risk Matrix poster as adjusted by Activity # 2. Use the Site and Layout Design Mitigation Measures table found at the end of this unit (page SM IX-U-20) to capture this information. Activity # 4: Consider the mitigation measures of Activity #3 to be installed, estimate the new vulnerability ratings as if these measures were in place, and calculate the new risk ratings. Capture your information in the Site and Layout Design Mitigation Measures table. Course Title: Building Design for Homeland Security Unit IX (U): Site and Layout Design Guidance SM IX-U-4 Section Vulnerability Question Guidance Observations 1 Site 1.1 What major structures surround the facility (site or building(s))? What critical infrastructure, government, military, or recreation facilities are in the local area that impact transportation, utilities, and collateral damage (attack at this facility impacting the other major structures or attack on the major structures impacting this facility)? Critical infrastructure to consider includes: Telecommunications infrastructure Facilities for broadcast TV, cable TV; cellular networks; newspaper offices, production, and distribution; radio stations; satellite base stations; telephone trunking and switching stations, including critical cable routes and major rights-of-way Electric power systems Power plants, especially nuclear facilities; transmission and distribution system components; fuel distribution, delivery, and storage Gas and oil facilities Hazardous material facilities, oil/gas pipelines, and storage facilities Banking and finance institutions Financial institutions (banks, credit unions) and the business district; note schedule business/financial district may follow; armored car services Transportation networks Airports: carriers, flight paths, and airport layout; location of air traffic control towers, runways, passenger terminals, and parking areas Bus Stations Pipelines: oil; gas Trains/Subways: rails and lines, railheads/rail yards, interchanges, tunnels, and cargo/passenger terminals; note hazardous material transported Traffic: interstate highways/roads/tunnels/ bridges carrying large volumes; points of congestion; note time of day and day of week Trucking: hazardous materials cargo loading/unloading facilities; truck terminals, weigh stations and rest areas Waterways: dams; levees; berths The HazardCorp Building is located in the downtown business district of a major urban city. There are several commercial iconic properties, several government offices, and various high-density attractions within a 5-mile radius of the building. In the immediate vicinity of HazardCorp Building are two residential condominiums, four office buildings, and a hotel. There are additional office buildings, hotels, and parking structures within easy walking distance. As with many major cities, there is significant water access to various locations within 5-mile radius of the building and the river is within 0.05 miles of the building. Because of the water, ground access is constrained by bridges, tunnels, and ferries. While two major airports are over 5 miles from the building, what is not shown are 8 heliports and two skyports inside the 5-mile radius. A metropolitan subway also serves the business district and the nearest station is two blocks from the building. There is significant shipping serving the various ports carrying all types of materials for use in Hazard City and transshipment to other locations. In conjunction with the ports and the transshipment of goods, there is extensive railroad trackage, some as close as within 1-1/2 miles of the building. The Course Title: Building Design for Homeland Security Unit IX (U): Site and Layout Design Guidance SM IX-U-5 Section Vulnerability Question Guidance Observations and ports for cruise ships, ferries, roll-on/roll-off cargo vessels, and container ships; international (foreign) flagged vessels (and cargo) Water supply systems Pipelines and process/treatment facilities, dams for water collection; wastewater treatment Government services Federal/state/local government offices – post offices, law enforcement stations, fire/rescue, town/city hall, local mayor’s/governor’s residences, judicial offices and courts, military installations (include type-Active, Reserves, National Guard) Emergency services Backup facilities, communications centers, Emergency Operations Centers (EOCs), fire/Emergency Medical Service (EMS) facilities, Emergency Medical Centers (EMCs), law enforcement facilities The following are not critical infrastructure, but have collateral damage potential to consider: Agricultural facilities: chemical distribution, storage, and application sites; crop spraying services; farms and ranches; food processing, storage, and distribution facilities Commercial/manufacturing/industrial facilities: apartment buildings; business/corporate centers; chemical plants (especially those with Section 302 Extremely Hazardous Substances); factories; fuel production, distribution, and storage facilities; hotels and convention centers; industrial plants; raw material production, distribution, and storage facilities; research facilities and laboratories; shipping, warehousing, transfer, and logistical centers Events and attractions: festivals and celebrations; open-air markets; area around Hazard City is the No. 4 intermodal port in the Western Hemisphere. Intermodal means the ability to move freight from train to truck and back again. An intermodal port ties together ship, rail, and truck freight transfers. There are extensive tank farms east and west of HazardCorp Building on the other side of the river in the respective directions. There is also a high concentration of police in the area due to multiple jurisdictions having authority. A fire station is within 1/4 mile of the building and seven hospitals are within 3 miles. Course Title: Building Design for Homeland Security Unit IX (U): Site and Layout Design Guidance SM IX-U-6 Section Vulnerability Question Guidance Observations parades; rallies, demonstrations, and marches; religious services; scenic tours; theme parks Health care system components: family planning clinics; health department offices; hospitals; radiological material and medical waste transportation, storage, and disposal; research facilities and laboratories, walk-in clinics Political or symbolically significant sites: embassies, consulates, landmarks, monuments, political party and special interest groups offices, religious sites Public/private institutions: academic institutions, cultural centers, libraries, museums, research facilities and laboratories, schools Recreation facilities: auditoriums, casinos, concert halls and pavilions, parks, restaurants and clubs (frequented by potential target populations), sports arenas, stadiums, theaters, malls, and special interest group facilities; note congestion dates and times for shopping centers. References: FEMA 386-7, FEMA SLG 101, DOJ NCJ181200 1.2 Does the terrain place the building in a depression or low area? Depressions or low areas can trap heavy vapors, inhibit natural decontamination by prevailing winds, and reduce the effectiveness of in-place sheltering. Reference: USAF Installation Force Protection Guide 1.3 In dense, urban areas, does curb lane parking allow uncontrolled vehicles to park unacceptably close to a Where distance from the building to the nearest curb provides insufficient setback, restrict parking in the curb lane. For typical city streets, this may require negotiating to close the curb lane. Setback is common Course Title: Building Design for Homeland Security Unit IX (U): Site and Layout Design Guidance SM IX-U-7 Section Vulnerability Question Guidance Observations building in public rights-of-way? terminology for the distance between a building and its associated roadway or parking. It is analogous to stand-off between a vehicle bomb and the building. The benefit per foot of increased stand-off between a potential vehicle bomb and a building is very high when close to a building and decreases rapidly as the distance increases. Note that the July 1, 1994, Americans with Disabilities Act Standards for Accessible Design states that required handicapped parking shall be located on the shortest accessible route of travel from adjacent parking to an accessible entrance. Reference: GSA PBS-P100 1.4 Is a perimeter fence or other types of barrier controls in place? The intent is to channel pedestrian traffic onto a site with multiple buildings through known access control points. For a single building, the intent is to have a single visitor entrance. Reference: GSA PBS-P100 1.5 What are the site access points to the site or building? The goal is to have at least two access points – one for passenger vehicles and one for delivery trucks due to the different procedures needed for each. Having two access points also helps if one of the access points becomes unusable, then traffic can be routed through the other access point. Reference: USAF Installation Force Protection Guide 1.7 Is there vehicle and pedestrian access control at the perimeter of the site? Vehicle and pedestrian access control and inspection should occur as far from facilities as possible (preferably at the site perimeter) with the ability to regulate the flow of people and vehicles one at a time. Course Title: Building Design for Homeland Security Unit IX (U): Site and Layout Design Guidance SM IX-U-8 Section Vulnerability Question Guidance Observations Control on-site parking with identification checks, security personnel, and access control systems. Reference: FEMA 386-7 1.8 Is there space for inspection at the curb line or outside the protected perimeter? What is the minimum distance from the inspection location to the building? Design features for the vehicular inspection point include: vehicle arrest devices that prevent vehicles from leaving the vehicular inspection area and prevent tailgating. If screening space cannot be provided, consider other design features such as: hardening and alternative location for vehicle search/ inspection. Reference: GSA PBS-P100 1.10 What are the existing types of vehicle antiram devices for the site or building? Are these devices at the property boundary or at the building? Passive barriers include bollards, walls, hardened fences (steel cable interlaced), trenches, ponds/basins, concrete planters, street furniture, plantings, trees, sculptures, and fountains. Active barriers include pop-up bollards, swing arm gates, and rotating plates and drums, etc. Reference: GSA PBS-P100 1.13 Does site circulation prevent high-speed approaches by vehicles? The intent is to use site circulation to minimize vehicle speeds and eliminate direct approaches to structures. Reference: GSA PBS-P100 1.14 Are there offsetting Single or double 90-degree turns effectively reduce vehicle Course Title: Building Design for Homeland Security Unit IX (U): Site and Layout Design Guidance SM IX-U-9 Section Vulnerability Question Guidance Observations vehicle entrances from the direction of a vehicle’s approach to force a reduction of speed? approach speed. Reference: GSA PBS-P100 1.15 Is there a minimum setback distance between the building and parked vehicles? Adjacent public parking should be directed to more distant or betterprotected areas, segregated from employee parking and away from the building. Some publications use the term setback in lieu of the term stand-off. Reference: GSA PBS-P100 1.18 Are garage or service area entrances for employee-permitted vehicles protected by suitable anti-ram devices? Coordinate this protection with other anti-ram devices, such as on the perimeter or property boundary to avoid duplication of arresting capability. Control internal building parking, underground parking garages, and access to service areas and loading docks in this manner with proper access control, or eliminate the parking altogether. The anti-ram device must be capable of arresting a vehicle of the designated threat size at the speed attainable at the location. Reference: GSA PBS-P100 1.20 Is the site lighting adequate from a security perspective in roadway access and parking areas? Security protection can be successfully addressed through adequate lighting. The type and design of lighting, including illumination levels, is critical. Illuminating Engineering Society of North America (IESNA) guidelines can be used. The site lighting should be coordinated with the CCTV system. Course Title: Building Design for Homeland Security Unit IX (U): Site and Layout Design Guidance SM IX-U-10 Section Vulnerability Question Guidance Observations Reference: GSA PBS-P100 1.21 Are line-of-sight perspectives from outside the secured boundary to the building and on the property along pedestrian and vehicle routes integrated with landscaping and green space? The goal is to prevent the observation of critical assets by persons outside the secure boundary of the site. For individual buildings in an urban environment, this could mean appropriate window treatments or no windows for portions of the building. Once on the site, the concern is to ensure observation by a general workforce aware of any pedestrians or vehicles outside normal circulation routes or attempting to approach the building unobserved. Reference: USAF Installation Force Protection Guide 1.23 Are all existing fire hydrants on the site accessible? Just as vehicle access points to the site must be able to transit emergency vehicles, so too must the emergency vehicles have access to the buildings and, in the case of fire trucks, the fire hydrants. Thus, security considerations must accommodate emergency response requirements. Reference: GSA PBS-P100 2 Architectural 2.1 Does the site and architectural design incorporate strategies from a Crime Prevention Through Environmental Design (CPTED) perspective? The focus of CPTED is on creating defensible space by employing: 1. Natural access controls: - Design streets, sidewalks, and building entrances to clearly indicate public routes and direct people away from private/restricted areas - Discourage access to private areas with structural elements and Course Title: Building Design for Homeland Security Unit IX (U): Site and Layout Design Guidance SM IX-U-11 Section Vulnerability Question Guidance Observations limit access (no cut-through streets) - Loading zones should be separate from public parking 2. Natural surveillance: - Design that maximizes visibility of people, parking areas, and building entrances: doors and windows that look out on to streets and parking areas - Shrubbery under 2 feet in height for visibility - Lower branches of existing trees kept at least 10 feet off the ground - Pedestrian-friendly sidewalks and streets to control pedestrian and vehicle circulation - Adequate nighttime lighting, especially at exterior doorways 3. Territorial reinforcement: - Design that defines property lines - Design that distinguishes private/restricted spaces from public spaces using separation, landscape plantings; pavement designs (pathway and roadway placement); gateway treatments at lobbies, corridors, and door placement; walls, barriers, signage, lighting, and “CPTED" fences - “Traffic-calming” devices for vehicle speed control 4. Target hardening: - Prohibit entry or access: window locks, dead bolts for doors, interior door hinges - Access control (building and employee/visitor parking) and intrusion detection systems 5. Closed circuit television cameras: - Prevent crime and influence positive behavior, while enhancing the intended uses of space. In other words, design that eliminates or reduces criminal behavior and at the same time encourages people to "keep an eye out" for each other. References: GSA PBS-P100 and FEMA 386-7 Course Title: Building Design for Homeland Security Unit IX (U): Site and Layout Design Guidance SM IX-U-12 Section Vulnerability Question Guidance Observations 2.2 Is it a mixed-tenant building? Separate high-risk tenants from low-risk tenants and from publicly accessible areas. Mixed uses may be accommodated through such means as separating entryways, controlling access, and hardening shared partitions, as well as through special security operational countermeasures. Reference: GSA PBS-P100 2.3 Are pedestrian paths planned to concentrate activity to aid in detection? Site planning and landscape design can provide natural surveillance by concentrating pedestrian activity, limiting entrances/exits, and eliminating concealment opportunities. Also, prevent pedestrian access to parking areas other than via established entrances. Reference: GSA PBS-P100 2.4 Are there trash receptacles and mailboxes in close proximity to the building that can be used to hide explosive devices? The size of the trash receptacles and mailbox openings should be restricted to prohibit insertion of packages. Street furniture, such as newspaper vending machines, should be kept sufficient distance (10 meters or 33 feet) from the building, or brought inside to a secure area. References: USAF Installation Force Protection Guide and DoD UCF 4-010-01 Course Title: Building Design for Homeland Security Unit IX (U): Site and Layout Design Guidance SM IX-U-13 Section Vulnerability Question Guidance Observations 5 Utility Systems 5.1 What is the source of domestic water? (utility, municipal, wells, lake, river, storage tank) Is there a secure alternate drinking water supply? Domestic water is critical for continued building operation. Although bottled water can satisfy requirements for drinking water and minimal sanitation, domestic water meets many other needs – flushing toilets, building heating and cooling system operation, cooling of emergency generators, humidification, etc. Reference: FEMA 386-7 5.2 Are there multiple entry points for the water supply? If the building or site has only one source of water entering at one location, the entry point should be secure. Reference: GSA PBS-P100 5.3 Is the incoming water supply in a secure location? Ensure that only authorized personnel have access to the water supply and its components. Reference: FEMA 386-7 5.4 Does the building or site have storage capacity for domestic water? How many gallons of Operational facilities will require reliance on adequate domestic water supply. Storage capacity can meet short-term needs and use water trucks to replenish for extended outages. Course Title: Building Design for Homeland Security Unit IX (U): Site and Layout Design Guidance SM IX-U-14 Section Vulnerability Question Guidance Observations storage capacity are available and how long will it allow operations to continue? Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities 5.5 What is the source of water for the fire suppression system? (local utility company lines, storage tanks with utility company backup, lake, or river) Are there alternate water supplies for fire suppression? The fire suppression system water may be supplied from the domestic water or it may have a separate source, separate storage, or nonpotable alternate sources. For a site with multiple buildings, the concern is that the supply should be adequate to fight the worst case situation according to the fire codes. Recent major construction may change that requirement. Reference: FEMA 386-7 5.6 Is the fire suppression system adequate, codecompliant, and protected (secure location)? Standpipes, water supply control valves, and other system components should be secure or supervised. Reference: FEMA 386-7 5.7 Do the sprinkler/standpipe interior controls (risers) have fire- and blastresistant separation? The incoming fire protection water line should be encased, buried, or located 50 feet from high-risk areas. The interior mains should be looped and sectionalized. Reference: GSA PBS-P100 Course Title: Building Design for Homeland Security Unit IX (U): Site and Layout Design Guidance SM IX-U-15 Section Vulnerability Question Guidance Observations Are the sprinkler and standpipe connections adequate and redundant? Are there fire hydrant and water supply connections near the sprinkler/standpipe connections? 5.8 Are there redundant fire water pumps (e.g., one electric, one diesel)? Are the pumps located apart from each other? Collocating fire water pumps puts them at risk for a single incident to disable the fire suppression system. References: GSA PBS-P100 and FEMA 386-7 5.9 Are sewer systems accessible? Are they protected or secured? Sanitary and stormwater sewers should be protected from unauthorized access. The main concerns are backup or flooding into the building, causing a health risk, shorting out electrical equipment, and loss of building use. Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities 5.10 What fuel supplies do the building rely upon for critical operation? Typically, natural gas, propane, or fuel oil is required for continued operation. Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities Course Title: Building Design for Homeland Security Unit IX (U): Site and Layout Design Guidance SM IX-U-16 Section Vulnerability Question Guidance Observations 5.11 How much fuel is stored on the site or at the building and how long can this quantity support critical operations? How is it stored? How is it secured? Fuel storage protection is essential for continued operation. Main fuel storage should be located away from loading docks, entrances, and parking. Access should be restricted and protected (e.g., locks on caps and seals). References: GSA PBS-P100 and Physical Security Assessment for the Department of Veterans Affairs Facilities 5.14 What is the normal source of electrical service for the site or building? Utilities are the general source unless co-generation or a private energy provider is available. Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities 5.15 Is there a redundant electrical service source? Can the site or buildings be fed from more than one utility substation? The utility may have only one source of power from a single substation. There may be only single feeders from the main substation. Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities 5.16 How many service entry points does the site or building have for electricity? Electrical supply at one location creates a vulnerable situation unless an alternate source is available. Course Title: Building Design for Homeland Security Unit IX (U): Site and Layout Design Guidance SM IX-U-17 Section Vulnerability Question Guidance Observations Ensure disconnecting requirements according to NFPA 70 (National Fire Protection Association, National Electric Code) are met for multiple service entrances. Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities 5.17 Is the incoming electric service to the building secure? Typically, the service entrance is a locked room, inaccessible to the public. Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities 5.18 What provisions for emergency power exist? What systems receive emergency power and have capacity requirements been tested? Is the emergency power collocated with the commercial electric service? Is there an exterior connection for emergency power? Besides installed generators to supply emergency power, portable generators or rental generators available under emergency contract can be quickly connected to a building with an exterior quick disconnect already installed. Testing under actual loading and operational conditions ensures the critical systems requiring emergency power receive it with a high assurance of reliability. Reference: GSA PBS-P100 5.19 By what means do the main telephone and data communications interface the site or building? Typically communication ducts or other conduits are available. Overhead service is more identifiable and vulnerable. Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities Course Title: Building Design for Homeland Security Unit IX (U): Site and Layout Design Guidance SM IX-U-18 Section Vulnerability Question Guidance Observations 5.20 Are there multiple or redundant locations for the telephone and communications service? Secure locations of communications wiring entry to the site or building are required. Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities 5.21 Does the fire alarm system require communication with external sources? By what method is the alarm signal sent to the responding agency: telephone, radio, etc.? Is there an intermediary alarm monitoring center? Typically, the local fire department responds to an alarm that sounds at the station or is transmitted over phone lines by an auto dialer. An intermediary control center for fire, security, and/or building system alarms may receive the initial notification at an on-site or off-site location. This center may then determine the necessary response and inform the responding agency. Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities Course Title: Building Design for Homeland Security Unit IX (U): Site and Layout Design Guidance SM IX-U-19 Section Vulnerability Question Guidance Observations 5.22 Are utility lifelines aboveground, underground, or direct buried? Utility lifelines (water, power, communications, etc.) can be protected by concealing, burying, or encasing. References: GSA PBS-P100 and FEMA 386-7 Course Title: Building Design for Homeland Security Unit IX (U): Site and Layout Design Guidance SM IX-U-20 Site and Layout Design Mitigation Measures (Urban Version) Asset-Threat/Hazard Pair Current Risk Rating Suggested Mitigation Measures Revised Risk Rating Course Title: Building Design for Homeland Security Unit X (U): Building Design Guidance SM X-U-1 Unit X (U) COURSE TITLE Building Design for Homeland Security UNIT TITLE Building Design Guidance OBJECTIVES 1. Explain architectural considerations to mitigate impacts from blast effects and transmission of chemical, biological, and radiological agents from exterior and interior incidents. 2. Identify key elements of building structural and non-structural systems for mitigation of blast effects. 3. Compare and contrast the benefit of building envelope, mechanical system, electrical system, fire protection system, and communication system mitigation measures, including synergies and conflicts. 4. Apply these concepts to an existing building or building conceptual design and identify mitigation measures needed to reduce vulnerabilities. SCOPE The following topics will be covered in this unit: 1. Architectural considerations, including building configuration, space design, and special situations. 2. Building structural and nonstructural considerations with emphasis on progressive collapse, loads and stresses, and good engineering practices. 3. Design issues for the building envelope, including wall design, window design, door design, and roof system design with approaches to define levels of protection. 4. Mechanical system design issues, including interfacing with operational procedures, emergency plans, and training. 5. Other building systems design considerations for electrical, fire protection, communications, electronic security, entry control, and physical security that mitigate the effects of a threat or hazard. 6. Activity: Select mitigation measures that reduce vulnerability and associated risk from the building perspective for the highest risk pairs (asset - threat/hazard) identified in Unit V (U). Course Title: Building Design for Homeland Security Unit X (U): Building Design Guidance SM X-U-2 REFERENCES 1. FEMA 426, Reference Manual to Mitigate Potential Terrorist Attacks Against Buildings, pages 3-1 to 3-46 and 3-48 to 3-52; Checklist at end of Chapter 1 2. FEMA 427, Primer for Design of Commercial Buildings to Mitigate Terrorist Attacks (when available) 3. FEMA 430, Primer for Incorporating Building Security Components in Architectural Design (when available) 4. FEMA 452, Risk Assessment: A How-To Guide to Mitigate Potential Terrorist Attacks Against Buildings, pages 5-1 to 5-16 5. FEMA 453, Design Guidance for Shelters and Safe Rooms (when available) 6. Case Study – Appendix U: Urban, HazardCorp Building Course Title: Building Design for Homeland Security Unit X (U): Building Design Guidance SM X-U-3 UNIT X (U) CASE STUDY ACTIVITY: BUILDING DESIGN GUIDANCE (Urban Version) In this student activity, the emphasis is identifying vulnerabilities in the building design. The Building Vulnerability Assessment Checklist in FEMA 426 (Table 1-22, pages 1-46 to 1-93) provides a tool for vulnerability assessment of proposed and existing buildings. Requirements Assign sections of the checklist to assessment team members. Refer to the Appendix U Case Study to determine answers to the questions. Then review results as a team to identify vulnerabilities and possible mitigation measures. Activity # 1: Complete the selected vulnerability checklist questions in the following Vulnerability Questions table. Note: There are 44 questions to complete below (12 in Section 2, 6 in Section 3, 1 in Section 4, 6 in Section 6, 3 in Section 7, 4 in Section 8, 4 in Section 9, 5 in Section 10, 2 in Section 11, and 1 in Section 13), so it is recommended that the team split up the questions among themselves taking 5-7 questions each and review the Appendix U Case Study for answers. Apportion the available time for gathering the answers and then provide each other the answers while performing the activities below. Activity # 2: Upon completion of the questions refer back to the vulnerability ratings determined in the Unit IV (U) Student Activity. Based on this more detailed analysis, decide if any vulnerability rating needs adjustment. Adjust the Risk Matrix poster accordingly for any changes in vulnerability rating and risk rating. Activity # 3: Select mitigation measures to reduce vulnerability and associated risk from the site and layout perspective. Concentrate on the three highest risk ratings on the Risk Matrix poster as adjusted by Activity # 2. Use the Building Design Mitigation Measures table found at the end of this unit (page SM X-U-20) to capture this information. Activity # 4: Consider the mitigation measures of Activity #3 to be installed, estimate the new vulnerability ratings as if these measures were in place, and calculate the new risk ratings. Capture your information in the Building Design Mitigation Measures table. Course Title: Building Design for Homeland Security Unit X (U): Building Design Guidance SM X-U-4 Section Vulnerability Question Guidance Observations 2 Architectural 2.5 Do entrances avoid significant queuing? If queuing will occur within the building footprint, the area should be enclosed in blastresistant construction. If queuing is expected outside the building, a rain cover should be provided. For manpower and equipment requirements collocate or combine staff and visitor entrances. Reference: GSA PBS-P100 The HazardCorp Building has a spacious lobby that avoids queuing outside the building Currently there is no queuing inside the building, except for the occasional elevator wait. 2.6 Does security screening cover all public and private areas? Are public and private activities separated? Are public toilets, service spaces, or access to stairs or elevators located in any nonsecure areas, including the queuing area before screening at the public entrance? Retail activities should be prohibited in non-secured areas. However, the Public Building Cooperative Use Act of 1976 encourages retail and mixed uses to create open and inviting buildings. Consider separating entryways, controlling access, hardening shared partitions, and special security operational countermeasures. References: GSA PBS-P100 and FEMA 386-7 2.7 Is access control provided through main entrance points for employees and visitors? (lobby receptionist, sign-in, staff escorts, issue of visitor badges, checking forms of personal identification, electronic access control systems) Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities Course Title: Building Design for Homeland Security Unit X (U): Building Design Guidance SM X-U-5 Section Vulnerability Question Guidance Observations 2.8 Is access to private and public space or restricted area space clearly defined through the design of the space, signage, use of electronic security devices, etc.? Finishes and signage should be designed for visual simplicity. Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities 2.9 Is access to elevators distinguished as to those that are designated only for employees and visitors? Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities 2.10 Do public and employee entrances include space for possible future installation of access control and screening equipment? These include walk-through metal detectors and x-ray devices, identification check, electronic access card, search stations, and turnstiles. Reference: GSA PBS-P100 2.11 Do foyers have reinforced concrete walls and offset interior and exterior doors from each other? Consider for exterior entrances to the building or to access critical areas within the building if explosive blast hazard must be mitigated. Reference: U.S. Army TM 5-853 Course Title: Building Design for Homeland Security Unit X (U): Building Design Guidance SM X-U-6 Section Vulnerability Question Guidance Observations 2.13 Do circulation routes have unobstructed views of people approaching controlled access points? This applies to building entrances and to critical areas within the building. References: USAF Installation Force Protection Guide and DoD UFC 4-010-01 2.17 Is high visitor activity away from critical assets? High-risk activities should also be separated from low-risk activities. Also, visitor activities should be separated from daily activities. Reference: USAF Installation Force Protection Guide 2.19 Are loading docks and receiving and shipping areas separated in any direction from utility rooms, utility mains, and service entrances, including electrical, telephone/data, fire detection/alarm systems, fire suppression water mains, cooling and heating mains, etc.? Loading docks should be designed to keep vehicles from driving into or parking under the building. If loading docks are in close proximity to critical equipment, consider hardening the equipment and service against explosive blast. Consider a 50-foot separation distance in all directions. Reference: GSA PBS-P100 Course Title: Building Design for Homeland Security Unit X (U): Building Design Guidance SM X-U-7 Section Vulnerability Question Guidance Observations 2.20 Are mailrooms located away from building main entrances, areas containing critical services, utilities, distribution systems, and important assets? Is the mailroom located near the loading dock? The mailroom should be located at the perimeter of the building with an outside wall or window designed for pressure relief. By separating the mailroom and the loading dock, the collateral damage of an incident at one has less impact upon the other. However, this may be the preferred mailroom location. Off-site screening stations or a separate delivery processing building on site may be costeffective, particularly if several buildings may share one mailroom. A separate delivery processing building reduces risk and simplifies protection measures. Reference: GSA PBS-P100 2.23 Are stairwells required for emergency egress located as remotely as possible from high-risk areas where blast events might occur? Are stairways maintained with positive pressure or are there other smoke control systems? Consider designing stairs so that they discharge into other than lobbies, parking, or loading docks. Maintaining positive pressure from a clean source of air (may require special filtering) aids in egress by keeping smoke, heat, toxic fumes, etc., out of the stairway. Pressurize exit stairways in accordance with the National Model Building Code. References: GSA PBS-P100 and CDC/NIOSH Pub 2002-139 Course Title: Building Design for Homeland Security Unit X (U): Building Design Guidance SM X-U-8 Section Vulnerability Question Guidance Observations 2.26 Are emergency systems located away from highrisk areas? The intent is to keep the emergency systems out of harm’s way, such that one incident takes out all capability – both the regular systems and their backups. Reference: FEMA 386-7 3 Structural Systems 3.1 What type of construction? The type of construction provides an indication of the robustness to abnormal loading and load reversals. A reinforced concrete moment-resisting frame provides greater ductility and redundancy than a flat-slab or flat-plate construction. The ductility of steel frame with metal deck depends on the connection details and pretensioned or post-tensioned construction provides little capacity for abnormal loading patterns and load reversals. The resistance of load-bearing wall structures varies to a great extent, depending on whether the walls are reinforced or unreinforced. A rapid screening process developed by FEMA for assessing structural hazard identifies the following types of construction with a structural score ranging from 1.0 to 8.5. The higher the score indicates a greater capacity to sustain load reversals. Wood buildings of all types - 4.5 to 8.5 Steel moment-resisting frames - 3.5 to 4.5 Braced steel frames - 2.5 to 3.0 Light metal buildings - 5.5 to 6.5 Steel frames with cast-in-place concrete shear walls - 3.5 to 4.5 Steel moment-resisting-frame construction uses steel columns and beams. The office floor slab is an electrified composite 3-inch metal deck with 2-1/2- inch normalweight concrete fill spanning between the steel beams. The underground parking floor slabs are substantial cast-in-place reinforced concrete with reinforced concrete columns that align with steel columns on the first floor and have additional columns to handle the vehicle loading. The lateral load resisting system (for wind loads only) consists of four perimeter moment frames, with a column spacing of approximately 15 feet , one at each exterior wall, augmented by two-story belt trusses between the 4th and 6th floors and the 22nd and 24th floors. There are additional trusses at the north and south elevations below the 4th floor. An interior cross braced core extends from the foundations to the 6th floor. The horizontal shear is transferred into the core at the 4th and 6th floors. The 4th floor diaphragm consists of a 14- inch thick reinforced concrete Course Title: Building Design for Homeland Security Unit X (U): Building Design Guidance SM X-U-9 Section Vulnerability Question Guidance Observations What type of concrete and reinforcing steel? What type of steel? What type of foundation? Steel frames with unreinforced masonry infill walls - 1.5 to 3.0 Concrete moment-resisting frames - 2.0 to 4.0 Concrete shear wall buildings - 3.0 to 4.0 Concrete frame with unreinforced masonry infill walls - 1.5 to 3.0 Tilt-up buildings - 2.0 to 3.5 Precast concrete frame buildings - 1.5 to 2.5 Reinforced masonry -3.0 to 4.0 Unreinforced masonry - 1.0 to 2.5 References: FEMA 154 and Physical Security Assessment for the Department of Veterans Affairs Facilities slab with embedded T-sections. The 6th floor is an 8-inch thick reinforced concrete slab. Type of concrete, reinforcing steel, and steel would have to be further investigated. Concrete is probably 4,000 psi, steel is probably 60 KSI, and the rebar is at a minimum #4 (1/2-inch diameter if not larger. The building foundations are reinforced concrete caissons. The caissons are needed due to the proximity to the water. 3.3 Are the steel frame connections moment connections? Is the column spacing minimized so that reasonably sized members will resist the design loads and increase the redundancy of the system? What are the floor-tofloor heights? A practical upper level for column spacing is generally 30 feet. Unless there is an overriding architectural requirement, a practical limit for floor-to-floor heights is generally less than or equal to 16 feet. Reference: GSA PBS-P100 3.5 Will the structure suffer an unacceptable level of damage resulting from the postulated threat (blast loading or weapon impact)? The extent of damage to the structure and exterior wall systems from the bomb threat may be related to a protection level. The following is for new buildings: Level of Protection Below Antiterrorism Standards - Severe damage. Frame collapse/massive destruction. Little left standing. Doors and windows fail and result in lethal hazards. Majority of personnel Course Title: Building Design for Homeland Security Unit X (U): Building Design Guidance SM X-U-10 Section Vulnerability Question Guidance Observations suffer fatalities. Very Low Level Protection - Heavy damage. Onset of structural collapse. Major deformation of primary and secondary structural members, but progressive collapse is unlikely. Collapse of nonstructural elements. Glazing will break and is likely to be propelled into the building, resulting in serious glazing fragment injuries, but fragments will be reduced. Doors may be propelled into rooms, presenting serious hazards. Majority of personnel suffer serious injuries. There are likely to be a limited number (10 percent to 25 percent) of fatalities. Low Level of Protection - Moderate damage, unrepairable. Major deformation of nonstructural elements and secondary structural members and minor deformation of primary structural members, but progressive collapse is unlikely. Glazing will break, but fall within 1 meter of the wall or otherwise not present a significant fragment hazard. Doors may fail, but they will rebound out of their frames, presenting minimal hazards. Majority of personnel suffer significant injuries. There may be a few (<10 percent) fatalities. Medium Level Protection - Minor damage, repairable. Minor deformations of non-structural elements and secondary structural members and no permanent deformation in primary structural members. Glazing will break, but will remain in the window frame. Doors will stay in frames, but will not be reusable. Some minor Course Title: Building Design for Homeland Security Unit X (U): Building Design Guidance SM X-U-11 Section Vulnerability Question Guidance Observations injuries, but fatalities are unlikely. High Level Protection - Minimal damage, repairable. No permanent deformation of primary and secondary structural members or non-structural elements. Glazing will not break. Doors will be reusable. Only superficial injuries are likely. Reference: DoD UFC 4-0101-01 3.8 Are there transfer girders supported by columns within unscreened public spaces or at the exterior of the building? Transfer girders allow discontinuities in columns between the roof and foundation. This design has inherent difficulty in transferring load to redundant paths upon loss of a column or the girder. Transfer beams and girders that, if lost, may cause progressive collapse are highly discouraged. Reference: GSA PBS-P100 3.10 Will the loading dock design limit damage to adjacent areas and vent explosive force to the exterior of the building? Design the floor of the loading dock for blast resistance if the area below is occupied or contains critical utilities. Reference: GSA PBS-P100 3.11 Are mailrooms, where packages are received and opened for inspection, and unscreened retail spaces designed to mitigate the effects of a blast on primary vertical or lateral bracing Where mailrooms and unscreened retail spaces are located in occupied areas or adjacent to critical utilities, walls, ceilings, and floors, they should be blast- and fragmentresistant. Methods to facilitate the venting of explosive forces and gases from the interior spaces to the Course Title: Building Design for Homeland Security Unit X (U): Building Design Guidance SM X-U-12 Section Vulnerability Question Guidance Observations members? outside of the structure may include blow-out panels and window system designs that provide protection from blast pressure applied to the outside, but that readily fail and vent if exposed to blast pressure on the inside. Reference: GSA PBS-P100 4 Building Envelope 4.1 What is the designed or estimated protection level of the exterior walls against the postulated explosive threat? The performance of the façade varies to a great extent on the materials. Different construction includes brick or stone with block backup, steel stud walls, precast panels, curtain wall with glass, stone or metal panel elements. Shear walls that are essential to the lateral and vertical load bearing system and that also function as exterior walls should be considered primary structures and should resist the actual blast loads predicted from the threats specified. Where exterior walls are not designed for the full design loads, special consideration should be given to construction types that reduce the potential for injury. Reference: GSA PBS-P100 6 Mechanical Systems (HVAC and CBR) 6.1 Where are the air intakes and exhaust louvers for the building? (low, high, or midpoint of the building structure) Are the intakes and exhausts accessible to the public? Air intakes should be located on the roof or as high as possible. Otherwise secure within CPTEDcompliant fencing or enclosure. The fencing or enclosure should have a sloped roof to prevent throwing anything into the enclosure near the intakes. Reference: GSA PBS-P100 states that air intakes should be on the fourth floor or higher and, on Course Title: Building Design for Homeland Security Unit X (U): Building Design Guidance SM X-U-13 Section Vulnerability Question Guidance Observations buildings with three floors or less, they should be on the roof or as high as practical. Locating intakes high on a wall is preferred over a roof location. Reference: DoD UFC 4-010-01 states that, for all new inhabited buildings covered by FEMA 426, all air intakes should be located at least 3 meters (10 feet) above the ground. Reference: CDC/NIOSH Pub 2002-139 states: “An extension height of 12 feet (3.7 m) will place the intake out of reach of individuals without some assistance. Also, the entrance to the intake should be covered with a sloped metal mesh to reduce the threat of objects being tossed into the intake. A minimum slope of 45° is generally adequate. Extension height should be increased where existing platforms or building features (i.e., loading docks, retaining walls) might provide access to the outdoor air intakes.” Reference: LBNL Pub 51959: Exhausts are also a concern during an outdoor release, especially if exhaust fans are not in continuous operation, due to wind effects and chimney effects (air movement due to differential temperature). 6.3 Are there multiple air intake locations? Single air intakes may feed several air handling units. Indicate if the air intakes are localized or separated. Installing low-leakage dampers is one way to provide the system separation when necessary. Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities Course Title: Building Design for Homeland Security Unit X (U): Building Design Guidance SM X-U-14 Section Vulnerability Question Guidance Observations 6.4 What are the types of air filtration? Include the efficiency and number of filter modules for each of the main air handling systems. Is there any collective protection for chemical, biological, and radiological contamination designed into the building? MERV – Minimum Efficiency Reporting Value HEPA – High Efficiency Particulate Air Activated charcoal for gases Ultraviolet C for biologicals Consider mix of approaches for optimum protection and cost effectiveness. Reference: CDC/NIOSH Pub 2002-139 6.5 Is there space for larger filter assemblies on critical air handling systems? Air handling units serving critical functions during continued operation may be retrofitted to provide enhanced protection during emergencies. However, upgraded filtration may have negative effects upon the overall air handling system operation, such as increased pressure drop. Reference: CDC/NIOSH Pub 2002-139 6.8 How are air handling systems zoned? What areas and functions do each of the primary air handling systems serve? Understanding the critical areas of the building that must continue functioning focuses security and hazard mitigation measures. Applying HVAC zones that isolate lobbies, mailrooms, loading docks, and other entry and storage areas from the rest of the building HVAC zones and maintaining negative pressure within these areas will contain CBR releases. Identify common return systems that service more than one zone, effectively making a large single zone. Conversely, emergency egress routes should receive positive pressurization to ensure Course Title: Building Design for Homeland Security Unit X (U): Building Design Guidance SM X-U-15 Section Vulnerability Question Guidance Observations contamination does not hinder egress. Consider filtering of the pressurization air. References: CDC/NIOSH Pub 2002-139 and LBNL Pub 51959 6.14 Where are the building automation control centers and cabinets located? Are they in secure areas? How is the control wiring routed? Access to any component of the building automation and control system could compromise the functioning of the system, increasing vulnerability to a hazard or precluding their proper operation during a hazard incident. The HVAC and exhaust system controls should be in a secure area that allows rapid shutdown or other activation based upon location and type of attack. References: FEMA 386-7, DOC CIAO Vulnerability Assessment Framework 1.1, and LBNL Pub 51959 7 Plumbing and Gas Systems 7.1 What is the method of water distribution? Central shaft locations for piping are more vulnerable than multiple riser locations. Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities 7.3 Is there redundancy to the main piping distribution? Looping of piping and use of section valves provide redundancies in the event sections of the system are damaged. Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities 7.4 What is the method of Single source of hot water with Course Title: Building Design for Homeland Security Unit X (U): Building Design Guidance SM X-U-16 Section Vulnerability Question Guidance Observations heating domestic water? What fuel(s) is used? one fuel source is more vulnerable than multiple sources and multiple fuel types. Domestic hot water availability is an operational concern for many building occupancies. Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities 8 Electrical Systems 8.1 Are there any transformers or switchgears located outside the building or accessible from the building exterior? Are they vulnerable to public access? Are they secured? Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities 8.3 How are the electrical rooms secured and where are they located relative to other higherrisk areas, starting with the main electrical distribution room at the service entrance? Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities 8.4 Are critical electrical Collocation concerns include Course Title: Building Design for Homeland Security Unit X (U): Building Design Guidance SM X-U-17 Section Vulnerability Question Guidance Observations systems collocated with other building systems? Are critical electrical systems located in areas outside of secured electrical areas? Is security system wiring located separately from electrical and other service systems? rooms, ceilings, raceways, conduits, panels, and risers. Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities 8.6 Does emergency backup power exist for all areas within the building or for critical areas only? How is the emergency power distributed? Is the emergency power system independent from the normal electrical service, particularly in critical areas? There should be no single critical node that allows both the normal electrical service and the emergency backup power to be affected by a single incident. Automatic transfer switches and interconnecting switchgear are the initial concerns. Emergency and normal electrical equipment should be installed separately, at different locations, and as far apart as possible. Reference: GSA PBS-P100 9 Fire Alarm Systems 9.1 Is the building fire alarm system centralized or localized? How are alarms made known, both locally and centrally? Are critical documents and control systems located in a secure yet accessible location? Fire alarm systems must first warn building occupants to evacuate for life safety. Then they must inform the responding agency to dispatch fire equipment and personnel. Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities 9.2 Where are the fire alarm Reference: Physical Security Course Title: Building Design for Homeland Security Unit X (U): Building Design Guidance SM X-U-18 Section Vulnerability Question Guidance Observations panels located? Do they allow access to unauthorized personnel? Assessment for the Department of Veterans Affairs Facilities 9.3 Is the fire alarm system standalone or integrated with other functions such as security and environmental or building management systems? What is the interface? Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities 9.5 Is there redundant offpremises fire alarm reporting? Fire alarms can ring at a fire station, at an intermediary alarm monitoring center, or autodial someone else. See Items 5.21 and 10.5 of the checklist. 10 Communications and IT Systems 10.1 Where is the main telephone distribution room and where is it in relation to higher-risk areas? Is the main telephone distribution room secure? One can expect to find voice, data, signal, and alarm systems to be routed through the main telephone distribution room. Reference: FEMA 386-7 10.2 Does the telephone Many telephone systems are now Course Title: Building Design for Homeland Security Unit X (U): Building Design Guidance SM X-U-19 Section Vulnerability Question Guidance Observations system have an uninterruptible power supply (UPS)? What is its type, power rating, operational duration under load, and location? (battery, on-line, filtered) computerized and need a UPS to ensure reliability during power fluctuations. The UPS is also needed to await any emergency power coming on line or allow orderly shutdown. Reference: DOC CIAO Vulnerability Assessment Framework 1.1 10.5 Are there redundant communications systems available? Critical areas should be supplied with multiple or redundant means of communications. Power outage phones can provide redundancy as they connect directly to the local commercial telephone switch off site and not through the building telephone switch in the main telephone distribution room. A base radio communication system with antenna can be installed in stairwells, and portable sets distributed to floors. References: GSA PBS-P100 and FEMA 386-7 10.15 Is there a mass notification system that reaches all building occupants? (public address, pager, cell phone, computer override, etc.) Will one or more of these systems be operational under hazard conditions? (UPS, emergency power) Depending upon building size, a mass notification system will provide warning and alert information, along with actions to take before and after an incident if there is redundancy and power. Reference: DoD UFC 4-010-01 10.16 Do control centers and Reference: GSA PBS-P100 Course Title: Building Design for Homeland Security Unit X (U): Building Design Guidance SM X-U-20 Section Vulnerability Question Guidance Observations their designated alternate locations have equivalent or reduced capability for voice, data, mass notification, etc.? (emergency operations, security, fire alarms, building automation) Do the alternate locations also have access to backup systems, including emergency power? 11 Equipment Operations and Maintenance 11.7 Are backup power systems periodically tested under load? Loading should be at or above maximum connected load to ensure available capacity and automatic sensors should be tested at least once per year. Periodically (once a year as a minimum) check the duration of capacity of backup systems by running them for the expected emergency duration or estimating operational duration through fuel consumption, water consumption, or voltage loss. Reference: FEMA 386-7 11.8 Is stairway and exit sign lighting operational? The maintenance program for stairway and exit sign lighting (all egress lighting) should ensure functioning under normal and emergency power conditions. Expect building codes to be updated as emergency egress lighting is moved from upper walls and over doorways to floor Course Title: Building Design for Homeland Security Unit X (U): Building Design Guidance SM X-U-21 Section Vulnerability Question Guidance Observations level as heat and smoke drive occupants to crawl along the floor to get out of the building. Signs and lights mounted high have limited or no benefit when obscured. Reference: FEMA 386-7 13 Security Master Plan 13.1 Does a written security plan exist for this site or building? When was the initial security plan written and last revised? Who is responsible for preparing and reviewing the security plan? The development and implementation of a security master plan provides a roadmap that outlines the strategic direction and vision, operational, managerial, and technological mission, goals, and objectives of the organization’s security program. Reference: DOC CIAO Vulnerability Assessment Framework 1.1 Course Title: Building Design for Homeland Security Unit X (U): Building Design Guidance SM X-U-22 Building Design Mitigation Measures (Urban Version) Asset- Threat/Hazard Pair Current Risk Rating Suggested Mitigation Measures Revised Risk Rating Course Title: Building Design for Homeland Security Unit XI (U): Electronic Security Systems SM XI-U-1 Unit XI (U) COURSE TITLE Building Design for Homeland Security UNIT TITLE Electronic Security Systems OBJECTIVES 1. Explain the basic concepts of electronic security system components, their capabilities, and their interaction with other systems. 2. Describe the electronic security system concepts and practices that warrant special attention to enhance public safety. 3. Use the assessment process to identify electronic security system requirements that can mitigate vulnerabilities. 4. Justify selection of electronic security systems to mitigate vulnerabilities. SCOPE The following topics will be covered in this unit: 1. Perimeter layout and zoning of sensors. 2. Intrusion detection systems and sensor technologies. 3. Entry-control systems and electronic entry control technologies. 4. Closed circuit television and data-transmission media. 5. Control centers and building management systems. 6. Definitions of the degree of security and control. REFERENCES 1. FEMA 426, Reference Manual to Mitigate Potential Terrorist Attacks Against Buildings, o Pages 3-46 to 3-50 o Appendix D o Security Systems and Security Master Plan sections of Checklist at the end of Chapter 1, pages 1-81 and 1-92 2. Case Study – Appendix U: Urban, HazardCorp Building Course Title: Building Design for Homeland Security Unit XI (U): Electronic Security Systems SM XI-U-2 This page intentionally left blank Course Title: Building Design for Homeland Security Unit XI (U): Electronic Security Systems SM XI-U-3 UNIT XI (U) CASE STUDY ACTIVITY: ELECTRONIC SECURITY SYSTEMS (Urban Version) In this unit, the emphasis will be upon the various components and technology available for use in electronic security systems. The Building Vulnerability Assessment Checklist (Table 1-22, pages 1-81 to 1-89 of FEMA 426) can be used as a screening tool for preliminary building design vulnerability assessment or for assessment of an existing building and site. Requirements Refer to the Appendix U Case Study to determine answers to the following questions. Then review results to identify vulnerabilities and possible mitigation measures. Activity # 1: Complete the selected vulnerability checklist questions in the following Vulnerability Questions table. Activity # 2: Upon completion of the questions refer back to the vulnerability ratings determined in the Unit IV (C) Student Activity. Based on this more detailed analysis, decide if any vulnerability rating needs adjustment. Adjust the Risk Matrix poster accordingly for any changes in vulnerability rating. Activity # 3: Select mitigation measures to reduce vulnerability and associated risk from the site, layout, and building perspectives. Concentrate on the three highest risk ratings on the Risk Matrix poster as adjusted by Activity # 2. Use the Electronic Security System Mitigation Measures table found at the end of this unit (page SM XI-U-8) to capture this information. Activity # 4: Consider the mitigation measures of Activity #3 to be installed, estimate the new vulnerability ratings as if these measures were in place, and calculate the new risk ratings. Capture your information in the Electronic Security System Mitigation Measures table. Section Vulnerability Question Guidance Observations 12 Security Systems Perimeter Systems 12.1 Are black/white or color CCTV (closed circuit television) cameras used? Are they monitored and recorded 24 hours/7 days a week? By whom? Security technology is frequently considered to complement or supplement security personnel forces and to provide a wider area of coverage. Typically, these physical security elements provide the first line of defense in deterring, detecting, and responding to threats and reducing vulnerabilities. They must be viewed as an integral component of the overall security There is a mixture of black/white and color CCTV used. All entries to the building, especially the Loading Dock, are covered by color CCTV systems. The cameras are color, pan, tilt, and zoom. The elevator lobbies on underground parking levels both under the building and under the plaza are also on color cameras with pan, tilt, and zoom. Course Title: Building Design for Homeland Security Unit XI (U): Electronic Security Systems SM XI-U-4 Section Vulnerability Question Guidance Observations Are they analog or digital by design? What is the number of fixed, wireless, and pan-tilt-zoom cameras used? Who are the manufacturers of the CCTV cameras? What is the age of the CCTV cameras in use? program. Their design, engineering, installation, operation, and management must be able to meet daily security challenges from a cost-effective and efficiency perspective. During and after an incident, the system, or its backups, should be functional per the planned design. Consider color CCTV cameras to view and record activity at the perimeter of the building, particularly at primary entrances and exits. A mix of monochrome cameras should be considered for areas that lack adequate illumination for color cameras. Reference: GSA PBS P-100 Underground parking has fixed black and white CCTV cameras except at the vehicle entrances and exits where the cameras are color, pan, tilt, and zoom to aid in identifying people who do not pay or cause damage to the drop arms or automated equipment. There are black and white cameras covering stairwell doors on underground parking levels. One person in Building Security Office monitors cameras and alarms on a 24/7 basis. DVR (Digital Video Recording) is used to record all perimeter color cameras. Requires further investigation to determine analog or digital design of cameras, only know that DVR for recording is digital. It is estimated that the perimeter fixed B/W cameras are deployed as follows: 24 on UG parking under building, 12 on UG parking under plaza, and 6 on UG parking stairwell doors. Total estimated perimeter B&W cameras are 42. No wireless cameras were identified during assessment. It is estimated that the perimeter color cameras with pan-tilt-zoom are deployed as follows: 4 on first floor pedestrian entries, 2 on loading dock, 4 on vehicle entries to UG parking with one per each lane, and UG parking elevator lobbies – 3 under building and 4 under plaza. Total estimated perimeter Color cameras are 17. The manufacturers and age of the CCTV cameras require further investigation. 12.2 Are the cameras programmed to respond automatically to The efficiency of monitoring multiple screens decreases as the number of screens increases. Tying the alarm system or motion sensors to a CCTV Course Title: Building Design for Homeland Security Unit XI (U): Electronic Security Systems SM XI-U-5 Section Vulnerability Question Guidance Observations perimeter building alarm events? Do they have builtin video motion capabilities? camera and a monitoring screen improves the man-machine interface by drawing attention to a specific screen and its associated camera. Adjustment may be required after installation due to initial false alarms, usually caused by wind or small animals. Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities 12.4 Are panic/duress alarm buttons or sensors used, where are they located, and are they hardwired or portable? Call buttons should be provided at key public contact areas and as needed in offices of managers and directors, in garages and parking lots, and other high-risk locations by assessment. Reference: GSA PBS P-100 12.5 Are intercom call boxes used in parking areas or along the building perimeter? See Item 12.4. 12.7 Who monitors the CCTV system? Reference: DOC CIAO Vulnerability Assessment Framework 1.1 Course Title: Building Design for Homeland Security Unit XI (U): Electronic Security Systems SM XI-U-6 Section Vulnerability Question Guidance Observations 12.8 What is the quality of video images both during the day and hours of darkness? Are infrared camera illuminators used? Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities 12.9 Are the perimeter cameras supported by an uninterruptible power supply, battery, or building emergency power? Reference: Physical Security Assessment for the Department of Veterans Affairs Facilities Interior Systems 12.12 Are black/white or color CCTV (closed circuit television) cameras used? Are they monitored and recorded 24 hours/7 days a week? By whom? Are they analog or digital by design? What is the number of fixed, wireless and pan-tilt-zoom cameras used? Who are the manufacturers of the CCTV cameras? Security technology is frequently considered to compliment or supplement security personnel forces and to provide a wider area of coverage. Typically, these physical security elements provide the first line of defense in deterring, detecting, and responding to threats and reducing vulnerabilities. They must be viewed are an integral component of the overall security program. Their design, engineering, installation, operation, and management must be able to meet daily security challenges from a cost effective and efficiency perspective. During and after an incident, the system, or its backups, should be functional per the planned design. Consider color CCTV cameras to view and record activity at the perimeter of the building, particularly at primary entrances Course Title: Building Design for Homeland Security Unit XI (U): Electronic Security Systems SM XI-U-7 Section Vulnerability Question Guidance Observations What is the age of the CCTV cameras in use? and exits. A mix of monochrome cameras should be considered for areas that lack adequate illumination for color cameras. Reference: GSA PBS P-100 See Item 12.1. --Reference: Physical Security Assessment for Department of Veterans Affairs Facilities 12.13 Are the cameras programmed to respond automatically to perimeter building alarm events? Do they have builtin video motion capabilities? The efficiency of monitoring multiple screens decreases as the number of screens increases. Tying the alarm system or motion sensors to a CCTV camera and a monitoring screen improves the man-machine interface by drawing attention to a specific screen and its associated camera. Reference: Physical Security Assessment for Department of Veterans Affairs Facilities 12.24 Are panic/duress alarm buttons or sensors used? Where are they located? Are they hardwired or portable? Call buttons should be provided at key public contact areas and as needed in offices of managers and directors, in garages and parking lots, and other areas high risk locations by assessment. Reference: GSA PBS P-100 Course Title: Building Design for Homeland Security Unit XI (U): Electronic Security Systems SM XI-U-8 Electronic Security System Mitigation Measures (Urban Version) Asset-Threat/Hazard Pair Current Risk Rating Suggested Mitigation Measure Revised Risk Rating Course Title: Building Design for Homeland Security Unit XII (U): Case Study SM XII-U-1 Unit XII (U) COURSE TITLE Building Design for Homeland Security UNIT TITLE Case Study OBJECTIVES 1. Explain building security design issues to a building owner for consideration prior to a renovation or new construction 2. Explain the identification process to arrive at the high-risk assetthreat/ hazard pairs of interest 3. Justify the recommended mitigation measures, explaining the benefits in reducing the risk for the high-risk situations of interest SCOPE The following topics will be covered in this unit: 1. Activity: Preparation and presentation of the highest risks identified by the groups, the vulnerabilities identified for these risks, and recommended mitigation measures to reduce vulnerability and risk. a. The top three risks will be prioritized as well as the top three recommended mitigation measures with rationale and justification. b. Include any consideration for changes to the Risk Matrix from knowledge gained in Units IX (U), X (U), and XI (U). REFERENCES 1. FEMA 426, Reference Manual to Mitigate Potential Terrorist Attacks Against Buildings a. Pages 2-51 to 2-58 b. Pages 3-50 to 3-52 c. Chapter 5 d. Appendix D 2. FEMA 452, Risk Assessment: A How-To Guide to Mitigate Potential Terrorist Attacks Against Buildings, pages 5-1 to 5-18 3. Case Study – Appendix U: Urban, HazardCorp Building Course Title: Building Design for Homeland Security Unit XII (U): Case Study SM XII-U-2 This page intentionally left blank Course Title: Building Design for Homeland Security Unit XII (U): Case Study SM XII-U-3 UNIT XII (U) CASE STUDY ACTIVITY: PREPARATION AND PRESENTATION OF GROUP RESULTS (Urban Version) In this activity, students work with their teams to finalize their assessments, decide on high priority risk concerns, determine appropriate mitigation measures, and present findings to the class. The student presenter(s) will decide on the number of asset-threat/hazard pairs to present and the mitigation measures to apply. Of great importance is the rationale for the selection of these high risk asset-threat/hazard pairs and the rationale for the recommended mitigation measures. No Cost / Low Cost recommended mitigation measures are always welcome as procedural changes can derive significant benefit. In light of limited resources that building owners / decision makers have to work with, the presenter(s) will identify the top three asset-threat/hazard pairs that their assessment identified and the top three mitigation measures that they would recommend to have funded using those limited resources. Requirements Activity #1: Based on findings from the previous activities and understanding of course content, complete the Assessment Team Briefing Summary table below. One entry is provided as an example, but you may or may not use it based upon your team’s Risk Matrix. Identify the top three risks and the top three mitigation measures based upon your Risk Matrix and enter the information in the summary table. Activity #2: Select one or two presenters from the assessment team to brief the team’s conclusions and recommendations with rationale and justifications. The presentation should be 5-7 minutes in length. Ensure points above are covered. Risk #1: Function(s) / Infrastructure: ______________________________ Risk Ratings: ______________________________ Risk #2: Function(s) / Infrastructure: ______________________________ Risk Ratings: ______________________________ Course Title: Building Design for Homeland Security Unit XII (U): Case Study SM XII-U-4 Risk #3: Function(s) / Infrastructure: ______________________________ Risk Ratings: ______________________________ Assessment Team Briefing Summary Prioritized Asset- Threat/Hazard Pair Requirements to Mitigate Rationale Priority #: ____________ Envelope Systems / Vehicle Bomb Maintain available stand-off Priority #: ____________ 1. Retain reserved government vehicle parking Priority #: ____________ 2. Add energy-rated bollards on north, west, and south curbs nearest building Priority #: ____________ 3. Add energy-rated planters / street furniture to plaza along sidewalk property line Design basis threats include car bomb and truck bomb, with truck bomb more difficult to mitigate • Apply known standards, such as GSA Level IV or DoD Standards / Recommendations • Note that known standards are based upon a design basis threat that may or may not equate to design basis threat selected for the assessment Achieving and maintaining stand-off is the first consideration for protecting a building against vehicle bombs. Course Title: Building Design for Homeland Security Unit XII (U): Case Study SM XII-U-5 Prioritized Asset- Threat/Hazard Pair Requirements to Mitigate Rationale Course Title: Building Design for Homeland Security Unit XII (U): Case Study SM XII-U-6 Prioritized Asset- Threat/Hazard Pair Requirements to Mitigate Rationale Course Title: Building Design for Homeland Security Unit XIII (U): Course Wrap-Up SM XIII-U-1 Unit XIII (U) COURSE TITLE Building Design For Homeland Security UNIT TITLE Course Wrap-Up OBJECTIVES 1. Reflect upon the reasons for attending the course provided during Unit 1 (U) Introductions and Overview and the conduct of course. a. Expectations met? b. Likes and dislikes? c. Value? 2. Provide written feedback to the Course Director and Instructors through course evaluation forms and verbal comments related to the course specifically or building design for Homeland Security in general. This feedback is critical to improving the course. SCOPE The following topics will be covered in this unit: 1. Discussion of general issues and concerns. 2. Course evaluations – forms and verbal comments. 3. Distribution of course certificates. REFERENCES No references are required for this unit. Course Title: Building Design for Homeland Security Unit XIII (U): Course Wrap-Up SM XIII-U-2 This page intentionally left blank