Site Security Standards and Strategy

Site Security Standards and Strategy I. Background and Overview A. The City s Program Standards and Procedures (PSP) are intended to be used in conjunction with the data contained in related standards and procedures. They are not intended to be used as stand alone documents. It is the responsibility of the Designer to become familiar with all the PSP documents and comply with the criteria set forth as a whole. B. The primary objective of the Willow Lake Water Pollution Control Facility (WLWPCF) is to effectively treat wastewater and to discharge the treated water back to the environment. Improvement projects at WLWPCF will be designed with a security component consistent with this objective. C. Critical Assets: Critical Assets are defined as the key elements required for the WLWPCF to achieve its primary objective. Some of the Critical Assets to be secured are identified below: 1. Customers and employees 2. Pumps in the Raw Sewage Pump Station 3. Disinfection capability 4. Chemical tanks and associated buildings 5. Process Support Facility (PSF) 6. Distributed Control System (DCS) 7. Bar Screens 8. UNOX Facility 9. Primary and Secondary Digesters Site Security Standards and Strategy Page 1 of 10 January 3, 2005

10. Electrical Switchgear. D. Vulnerabilities: Vulnerabilities are defined as existing conditions or practices which make the facility vulnerable to attack. Current identified vulnerabilities to be considered in the security design process are listed below: 1. Unfamiliarity and non-compliance of employees with security requirements, policies, and procedures. 2. Potential of extremist acts. 3. Surreptitious entry of facility area or buildings. 4. Temporary on-site storage of explosive ordinances by local police. II. General Requirements A. Facility Needs: Some of the identified facility needs which must be met to successfully address site security requirements are listed below: 1. Site security strategy must coordinate security decisions for new and existing facilities. 2. On-site Contactors must lock up their compounds. 3. Berm screening view of the plant from the east is recommended. 4. Vehicular gates to be rolling type with proximity card reader and camera. 5. One layer of access control will be provided starting at the entrance and another layer of access control will be provided at the entrance to all internal access roads. 6. Entire plant site to be enclosed by a perimeter fence. 7. Access to all pump stations to be controlled. 8. Remote wet weather treatment facilities (PEFTF) will require motion detection for the interior when facility is unmanned. Site Security Standards and Strategy Page 2 of 10 January 3, 2005

9. Exterior entry doors on all facilities to be equipped with proximity card readers. B. Preliminary Design Decisions: Preliminary design decisions which will meet the goals and needs for site security and which should be further evaluated in the final design stages are listed below: 1. Perimeter Fencing: a. Full line fence, six feet high with three-strand barb wire, around entire compound. b. No detection or cameras required on exterior fencing unless requested by City s Project Manager (PM). c. Maintain approximately 50 feet clear zone around site perimeter fence. 2. Security Gates: A total of five vehicular gates are anticipated. The gate locations and their recommended features are described below. Reference attached schematic drawing S-001 for gate locations and attached drawing for proposed double gate configuration. Vehicular security gates will have proximity card readers, with the exception of Gate #5 at the rear entry. Some should have cameras on stanchions with intercoms a. Gate #1: Existing single gate with proximity card reader, camera and intercom. To be closed at all times. b. Gate #2: Security gate on existing access road off Windsor Island Road immediately west of entrance to demonstration wetlands double gate with proximity card reader, camera, and intercom to be open during plant working hours only. c. Gate #3: Staff parking entrance double gate with proximity card reader, camera, and intercom. To be closed at all times. d. Gate #4: Maintenance and delivery area double gate with proximity card reader, camera, and intercom. To be closed at all times. Site Security Standards and Strategy Page 3 of 10 January 3, 2005

e. Gate #5: Existing gate at back entry to site, padlocked at all times. f. Three existing pedestrian gates in perimeter fence are to remain. 3. Exterior Access Door. a. Exterior doors with ingress hardware, other than exterior electrical or mechanical rooms, will be equipped with proximity card readers. 4. Security Site Lighting. C. Critical Facilities. a. Provide area lighting at all access gates. b. Provide directional lighting for buildings and parking area. c. Provide directional and way finding lighting for site. d. Lighting on perimeter site fencing is not recommended due to light pollution. Security recommendations for each of the highest priority critical facilities are listed below. A common recommendation is the need to integrate the access control system with the plants Distributed Control System (DCS). Intrusion detection is not recommended for facilities on the WLWPCF property as staff is not trained nor available to respond to alarms. Specific recommendations include: 1. Main switchgear: a. Should be shielded from line of sight from perimeter. b. Switchgear eventually will be placed inside a building. c. Record of entry provided by proximity card readers on all exterior doors. 2. Raw sewage pump station: a. Proximity card access control on exterior doors. Site Security Standards and Strategy Page 4 of 10 January 3, 2005

b. Door position switches on all hatches and points of entry. 3. Hypochlorite/Chemical Storage: a. Monitor and detect low chemical levels in the event an adversary perforates a tank. b. Provide spill containment. c. Install proximity cards to all building exterior doors. Alarm liquid level to DCS to indicate leakage. d. Secure existing windows. 4. Bar screens: a. Provide proximity card access control to all exterior doors. b. Provide secure hardened enclosure around exterior bar screen controls. 5. Process Support Facilities: a. Provide interior surveillance camera in lobby. b. Provide proximity card access to building interior control rooms and laboratory. c. Proximity card access to all exterior ingress doors. d. Panic button at reception area. e. Provide monitoring in the control room. f. Provide badging station. 6. PEFTF (remote facility): Although this facility is not located on the WLWPCF site, PEFTF will be an extension of the WLWPCF security program and is an example of a facility that would have intrusion detection such as microwave. All exterior doors will have proximity card readers. Site Security Standards and Strategy Page 5 of 10 January 3, 2005

D. Process Training/Procedures/Protocol: 1. It is recognized that equally important to recommended security hardware upgrades, the WLWPCF needs to establish, communicate, and enforce security policy and procedures. Security awareness training will be a key element for both City and non-city personnel. In particular, it will be critical to review and update, if required, the security procedures for Contractors accessing the site. These procedures must be clear and consistently enforced to be effective. 2. Initial security policy will include: a. Proximity cards for internal use. b. Proximity cards for Contractor use. c. Communication and security awareness training. d. Modification of existing proximity cards to accommodate staff identification and access of WLWPCF by other City staff. e. Policy for after-hours shifts. f. Bio-gro and other vehicles to gain entry after hours by use of proximity cards at the gate. III. Site Security Strategy A. A Site Security Strategy for the WLWPCF will be used to direct the selection of security measures that apply to both existing facilities as well as future facilities at WLWPCF. In addition it is not anticipated that WLWPCF will be connected to the City-wide security network (the City of Salem has adopted the Lenell Access Control System). However, it is expected that any security hardware and software will be selected with an eye to future compatibility with the City security system. Unlike water treatment plants, currently there is not a federal regulatory program mandating security upgrades for wastewater treatment plants. However, in implementing a security strategy as outlined herein, WLWPCF is well positioned to address future potential mandates. Site Security Standards and Strategy Page 6 of 10 January 3, 2005

B. Threat Assumptions: The Site Security Strategy recognizes that the highest probability threat is presumed to be vandalism, theft, or actions by a disgruntled employee. While domestic terrorism is always a potential, it is not prudent to try to protect the facility from too extreme an adversary. While disruption to the wastewater treatment capacity could be environmentally, financially or politically problematic, it would probably not lead to a loss of life. Although the WLWPCF is an important facility, it is not as critical as a water treatment plant. The focus will be to minimize the targets of opportunity for an adversary. C. Critical Facilities: A Site Security Strategy will focus attention on potential single points of system failure. These elements should be identified and ranked in relation to their importance to the overall WLWPCF mission to effectively treat wastewater and to discharge the treated water back to the environment. Currently, in order of criticality, system elements such as staff, main switchgear, raw sewage pump station, effluent disinfection and the bar screens have been identified. In the future, additional system components will be brought online and their criticality should be ranked in comparison with existing critical systems. Protection of the public and WLWPCF staff will be the highest priority. Some systems, such as the proposed PEFTF system, may be ranked as critical elements, even if they are located offsite. D. Deterrence, Detection, Delay, and Response: With both the design basis threat and the critical facilities identified, security measures are selected. Security measures are typically selected to provide deterrence, detection, delay and/or response. For the WLWPCF, the emphasis is on deterrence and response. 1. Deterrence: a. One goal of the security strategy, is to provide sufficient security measures to deflect a determined adversary to another location. Fencing the entire plant perimeter has been selected as an appropriate deterrent measure. The fence would be a minimum of six feet high with three strands of barb wire. In addition to providing delay, if the fence is breached it will typically provide detection due to a bent or cut fencing material. Vehicle access past this perimeter fence will be through a double gate which will open Site Security Standards and Strategy Page 7 of 10 January 3, 2005

during the public hours and be closed at all other times. This double gate will be located on the plant side of the turn-off to the NRS wetlands viewing area and will be equipped with proximity card readers and an intercom and camera to facilitate remote operation of the gate. b. A defense in depth strategy with regards to interior vehicle gates has been adopted. There will be a primary security gate on the primary access road close to Windsor Island Road and gates on other internal site access roads. All gates will have proximity card readers and those with potential public access will be equipped with intercoms and cameras. c. Site security lighting will be limited to exterior of buildings as well as the parking areas. Security lighting will be provided for the gated entry locations with the intent of making visitors visible to the camera. In addition to security lighting, directional and way-finding lighting will also be provided and will consist of roadway lighting and bollard lighting. Lighting on the perimeter site fencing also provides a suitable deterrent, however, WLWPCF is concerned with light pollution affecting the neighboring properties and will therefore not consider its use. 2. Detection: a. A conscious decision has been made to not equip buildings with glass break detection or microwave intrusion detection or add numerous cameras to the plant perimeter. Without staff trained and available to observe cameras and monitor building occupancy or intrusion, an extensive detection system is not warranted. Cameras are recommended to monitor the highest risk locations such as the public entry lobby area and both the staff and public parking lots of the new PSF. Imagery from the camera will be recorded and monitored in the operations room of the PSF. It is expected that intercom buzzers associated with the entry gates will be directed to on call operators who will report to the operations room to view monitors and provide entry to visitors, vendors, and Contractors without access cards. b. The PSF, which will house the administration building, laboratory, and the maintenance/warehouse building, is a critical asset with the DCS system located in the administration area and with the bulk of Site Security Standards and Strategy Page 8 of 10 January 3, 2005

3. Delay: employees working in the building. The current plans for the building include operable windows for south facing office windows. Appropriate security measures must be included which will identify if a window is left open when staff goes home in the evening. Alternately, procedural rules could be established for an evening check to make sure the windows are closed. A third option is to incorporate hardware which effectively prevents the windows from opening wide enough to become a security risk. c. Some detection is recommended for specific process failures such as hypochlorite leaks. These devices will alarm to the DCS. Likewise, it is recommended that detection be evaluated for remote facilities, such as PEFTF. Such facilities should be evaluated on a case-by-case basis, taking into consideration the criticality of the asset, locations, and design of facility. a. A decision has been made to require proximity card readers on all exterior doors of most structures, which will control access and provide a record of entry. Exceptions will be allowed for doors designated as exit only, in which case hardware will not allow entry from the exterior, or in the case of storage areas with exterior entries which will have key entry. In the event these doors are left open or forced open, these doors will report and alarm to an Access Control Station (ACS) which is connected to the DCS. The ACS will make a record of all entries and also authorize entry to holders of specific cards. b. Where appropriate, emphasis may be placed on limiting construction activities to maintain site security. Segregation of Contractors from plant activities may be accomplished with proximity card gate entry, security watchmen and/or security fencing as necessary, depending upon the nature and duration of the construction activity. Separate pedestrian gates may be required for Contractor access to the site. 4. Response: a. City staff will not be used for any type of response in a security incursion. Staff is not available, or trained, to be dedicated to continuously monitoring security cameras and alarms. Staff will Site Security Standards and Strategy Page 9 of 10 January 3, 2005

report to the operations room to check the monitor and allow entry through gates when required, and may respond to door open alarms in the case that a door equipped with an electric strike is either propped open or forced open. b. All other responses will be left to the appropriate authorities. Given the approximate six minute response time by local police, external response is expected to be sufficient. An effective response will also include well thought out contingency and notifications plans. This may involve spare or redundant equipment in critical applications. Training is expected to be a major element in the development of a site security plan. IV. Attachments A. S-001 - Site Security Strategy Schematic Drawing. B. SK.EY.106 - Double Gate Concept Design Sketch END OF SECTION Site Security Standards and Strategy Page 10 of 10 January 3, 2005