Architecture & Engineering Specifications

Transcription

1 Architecture & Engineering Specifications

2 Page 2 Legal Disclaimers Canada-Underwriters Laboratories (C-UL) Compliancy For C-UL Listed applications, the unit shall be installed in accordance with Part 1 of the Canadian Electrical Code. Documentation Disclaimer and Restrictions Information in this document is subject to change without notice and does not represent a commitment on the part of Brivo Inc. For the most up-to-date information, visit This document and the data herein shall not be duplicated, used or disclosed to others for procurement or manufacturing, except as authorized with the written permission of Brivo Inc. The information contained within this document or within the product itself is considered the exclusive property of Brivo Inc. All information in this document or within the hardware and software product themselves is protected by the copyright and/or other intellectual property laws of the United States. Product Support All support for this product is provided by the third-party dealer. Please contact the dealer who installed the product with questions and support requests.. The Brivo logo is a registered trademark of Brivo Inc. Brivo Inc Old Georgetown Road Suite 300 Bethesda, MD Phone: (301) Fax: (301) This Architectural and Engineering Specification document utilizes the Construction Specifications Institute (CSI) Project Resource Manual (PRM), including MasterFormat, SectionFormat and PageFormat. The purpose of this document is to specify the Architectural/Engineering and Bid criteria for a Web-based, IP (Internet Protocol) based Access Control Appliance using such technologies as the Internet, private corporate networks, or wireless cellular networks. This Architectural and Engineering Specification document specifies access control equipment and services. Equipment specifications include control panels, expansion chassis, I/O boards, door/reader control boards, and power supplies. Services include Web-based monitoring and control services to manage control panels. These products and services are manufactured and/or provided by Brivo Inc..

3 Page 3 SECTION ACCESS CONTROL PART 1 GENERAL 1.01 SUMMARY A. This section includes a description of Web-based access control devices, intrusion detection devices, security access devices, relay control, alarm monitoring controllers, credential creation, and credential holder database and management. B. Related Sections 1. Section Access Control Door Hardware 2. Section Access Control Interfaces 3. Section Access Control Identification Management Systems 4. Section Video Surveillance 5. Section Pathways for Communications 6. Section Structured Cabling 7. Section Access Control Communications Horizontal Cabling 8. Section Access Control Web Interface 1.02 DEFINITIONS A. ACS: Access Control Server B. RTOS: Real-Time Operating System C. SDC: Security Door Controller D. IEC: Independent Edge Controller E. AES: Advanced Encryption Standard F. LAN: Local Area Network G. WAN: Wide Area Network H. SSH: Secure Shell I. SSL: Secure Socket Layer J. SIA: Security Industry Association K. ISO: International Standards Organization L. HSPD-12: Homeland Security Presidential Directive # 12 M. FIPS 201: Federal Information Processing Standard 201, Personnel Information and Verification standard for Government Agencies N. CHUID: Card Holder Unique Identification O. USGIC: U.S. Government Issued Credential P. DNS: Domain Name System Q. DHCP: Dynamic Host Configuration Protocol R. IP: Internet Protocol S. UI: User Interface

4 Page 4 T. PoE: Power over Ethernet 1.03 REFERENCES A. Underwriters Laboratories, Inc. (UL) ( 1. UL294 Underwriters Laboratory Safety Standard 294 for Access Control System products QUALITY ASSURANCE A. Manufacturer shall be capable of providing field service representation during construction and approving application method WARRANTY A. Refer to conditions of the contract for project warranty provisions. B. The manufacturer shall warrant that the hardware product(s) are free from defect in materials and/or workmanship for a period of three (3) years for door controllers and two (2) years for Brivo s OnSite Server Appliance from the date of shipment PERFORMANCE A. The appliance shall conform to Energy Star Power and Performance standards B. Performance measurements shall be bench marked using Sandra Dhrystone MAINTENANCE A. The ACS manufacturer shall provide periodic software upgrades. When changes are made to the appliance software, those updates will be available to the customer via the software support agreement SUPPORT A. On-site support shall be provided by the local authorized installation company. B. Installing company shall provide evidence that it is an authorized dealer in good standing for the manufacturer of the Brivo OnSite Server system, and that it meets the manufacturer s technical certification requirements SYSTEM DESCRIPTION A. Application Functions 1. All access control data shall be managed and maintained through a Web-based interface to the ACS appliance. 2. All Access and System events shall include a time stamp when the event occurred, and shall be based on standard Greenwich Mean Time (GMT). 3. The system shall include the ability to make configuration changes necessary for ensuring data integrity and facility security. 4. The ACS shall provide a wide range of communications protocols to control field panels so that all commands and updates to the panels are verified and shall be retried if communication attempts fail. 5. The ACS shall be capable of automatically discovering the Security Door Controller (SDC) field panel configuration and setup all necessary parameters to establish proper communication. 6. The system shall provide firmware installation capabilities to all connected SDC panels. B. System Architecture

5 Page 5 1. The access control system shall consist of a centralized Access Control Server (ACS), scalable in configuration and capable of spanning geographically from a single facility to multiple facilities; enabling managed access control to remotely connected facilities worldwide. a. The ACS shall reside at any one facility within the security infrastructure, as determined by the solution design. 2. The ACS shall maintain all configuration data for the entire system and shall function in a secure distributed architecture, sending configuration changes to, and receiving event activity from: Security Door Controllers (SDC), door edge devices, or I/O modules through secure encrypted channels. 3. The ACS appliance itself shall be secure, offering only the network services necessary to perform its functions and capabilities. a. Ethernet network protocols shall be limited to the following inbound ports: 1) HTTP port 80 2) HTTPS port 443 3) SSL ports & b. Outbound ports shall be limited to the following network ports: 1) NTP port 123 2) SSH port The ACS shall be a rack-mountable server class computer, running a Linux RTOS and shall perform as a standalone access control appliance utilizing an embedded Web server and software interface designed for access control applications up to 1000 readers. a. All administrative data management shall be performed using an Internet Browser connection to the ACS appliance across a secure 128-bit SSL channel. 5. Encryption & Authentication a. Communications between Security Door Controller (SDC) panels and the ACS appliance shall be encrypted using 128-bit SSL encryption. b. The ACS shall include the capability to use FIPS validated embedded encryption modules for all network communications. c. The ACS appliance shall validate the identity of any SDC panel attempting to communicate with it through the exchange of X.509 digital certificates. 6. Encrypted Data Storage a. Live database shall be encrypted utilizing AES-256 encryption standards. b. Back- up files shall be compressed and encrypted. c. The system shall include the capability to utilize back-up facilities from authorized Internet hosting services and shall use SSH encryption for transmission of encrypted back-up file. 7. Network Communications a. The ACS shall utilize Ethernet communications as its primary communications medium and shall conform to IEEE industry standards for typical computer based network connectivity. 1) Ethernet connections shall use industry standard 8P8C modular connectors and shall conform to TIA/EIA-568-B wiring standards. b. The ACS appliance shall include support for the following minimum network configuration settings: 1) DHCP 2) Static IP Address

6 Page 6 i) Internet Protocol version 4 (IPv4) 3) Network Mask 4) Gateway Address 5) Primary DNS 6) Secondary DNS c. The ACS shall support static route configuration as required. Configuration entries shall include, but not be limited to, the following settings: 1) Destination IP Address 2) Gateway 3) Network Mask 8. Security Door Controller (SDC) a. SDCs shall represent multiple door controller devices including, but not limited to: 1) Multi-Door Controller Hub i) SDCs multi-door controller hubs shall be fully expandable from a minimum of 1 reader up to 30 readers. ii) SDCs shall include a UL-listed chassis and power supply designed to accommodate a variety of expansion options. iii) SDCs shall include the ability to maintain a minimum of 25,000 cardholders. 2) Independent Edge Controller (IEC). i) Each IEC shall have the ability to maintain a minimum of 25,000 card holders and a minimum of 5,000 off-line events. ii) IECs shall include Power-over-Ethernet (PoE) capabilities, with the ability to supply at least 700mA of auxiliary power for external lock and/or REX devices. iii) IEC PoE shall conform to the IEEE 802.3af standard. b. The ACS shall provide a seamless programming environment and shall fully integrate IECs and SDCs as integral components of the system. c. Communications options shall include: 1) 10/100Mbs Ethernet. 2) CAN Bus - Use CAT5 (or higher) UTP cable up to 1,500 feet. C. Accounts 1. ACS shall permit authorized operators the ability to create sub level accounts, dividing database configuration and system operation between multiple, manageable access control entities. a. Accounts beneath the System Account shall be limited to a single hierarchal level. b. All sub-accounts shall have a sibling relationship with other sub-accounts. 1) Sub-account administrators shall not have the ability to edit or view administrators from other accounts. c. The System Account shall be the parent of all sub-accounts. d. The System account shall represent the system owner and shall permit complete control of the entire system and all connected and configured devices.

7 Page 7 e. Sub-accounts shall have a limited view of the system, and shall include a completely separate set of users, device configuration, and other access control configuration criteria. f. All sub-account data shall be completely separate and isolated from other sub-accounts. 2. System shall include the default capacity for 8 accounts with options to increase capacity up to 128 accounts. 3. Authorized account administrators shall have the ability to edit other administrators within the same account. 4. Authorized system administrators shall have the ability to view and edit all account administrators from all sub-accounts maintained within a single ACS appliance. D. Schedules and Holidays 1. The ACS shall provide the ability to define custom schedules for the purpose of managing facility access and operating auxiliary devices with the following options: a. Create and edit a schedule. The ACS shall permit up to 32 time periods per day. b. Associate a schedule with groups, floors, doors, and/or devices. c. Terminate a schedule s association with one or more groups, floors, doors or devices. d. Delete a schedule. e. Create and edit a Holiday. f. Edit a Holiday s start and end date. g. Delete a Holiday. h. Support for one time repeating schedule exceptions, one time or up to 16 times E. Doors and Devices 1. Doors: a. Each account may have one or more doors associated with it. b. Administrators shall be allowed permission to manage doors, including permission to create the door, edit its name, and manage its security settings. 2. Devices: a. Bulk Device Management via Device Profiles 1) The ACS shall permit authorized administrators the ability to assign profiles such as schedules and permissions to doors, inputs, and credentials. b. A device may have logical or physical inputs and outputs. c. A logical input may be a schedule input to a timer. d. A physical input is any physical input point on a SDC board. e. An account can have one or more devices associated with it. f. Administrators shall be allowed permission to manage devices, including permission to create the device, edit its name, and manage its security settings. F. Elevators and Floors 1. Authorized administrators shall have permission to manage elevators and floors including, but not limited to: a. Creating the elevator or floor. b. Editing its name.

8 Page 8 c. Managing its settings. G. Credentials: Credential Database and Cards 1. Credential Database a. The ACS shall support multiple credentials per user. b. The ACS software interface shall maintain a database of all credentials associated with the account or sub-account, and the user to whom each is assigned. c. Operations to be performed by the interface shall include, but not be limited to: 1) Validate that card numbers are unique, numeric, and value is appropriate for the credential in use. 2) Support the creation of PIN credentials that are unique, 4 to 8 digits long, and either randomly generated by the system or selected by the user. 3) Automatically send updated credential information to the appropriate access control panels with no other user intervention. 4) Provide up to 64 customized fields per account for data storage pertaining to individual credential holders (users) registered in the system. d. The ACS shall fully support U.S. Government Issued Credentials (USGIC) including: HSPD-12/FIPS-201 PIV, TWIC, NG CAC, and FRAC. 1) The system shall provide the capability to register the FASC-N, photo, and printed information from the USGIC to the ACS platform. 2) The ACS shall immediately disable cardholder s access authorization upon detection of revoked or invalid certificate status. e. The ACS Certificate Manager shall support Caching Status Proxy providing the additional capability of re-validating imported cardholder certificates on a periodic basis and suspending revoked badges automatically within the ACS. f. The ACS shall support Black-List checking to determine if a credential such as a certificate or FASC-N is valid. g. The ACS shall support Online Certificate Status Protocol (OCSP), providing dynamic validation of the USGIC during pre and post credential registration. 2. Cards a. May be assigned, revoked, or deleted. b. Authorized operators shall have the capability to see all cards associated with an account. c. Sub-account administrators shall be capable of viewing only those cards assigned to users affiliated with their account d. Sub-account administrators shall have the ability to view currently unassigned cards. e. The ACS software interface shall provide the capability to display the card format in addition to the name of the user to whom the card is currently assigned. f. Cards shall be listed in numeric order. g. Deleted cards may be reinstated if necessary. h. The ACS shall provide the capability to add cards using a local card reader.

9 Page 9 i. The ACS shall provide the ability to support custom Wiegand Binary, BCD encoded, and 5-bit BCD+parity encoding. j. The ACS shall provide the ability to support an unlimited number of standard and custom formats. H. ID Badging 1. The ACS shall provide the necessary capabilities to allow authorized operators the ability to create fully customizable badge templates. 2. The ACS shall provide all necessary functionality to display images and print badges directly from the operator s screen. 3. The system shall include, but not be limited to, the following badge elements and associated properties: a. Static Text Objects: Text, Color, Background Color, Text Size, Position, Dimensions, Font, Multiline, Scale to Fit, Alignment, Vertical Placement and Orientation. b. Photo Objects: Position, Dimensions, Background Color, and Aspect Ratio c. Static Image Objects: Filename, Position, Dimensions, Background Color and Aspect Ratio. d. Boxes: Background Color, Position, Alignment, and Dimensions e. Barcodes: Encoding, Custom Field, Position, Dimensions, and Orientation. f. Standard ACS Field Objects: Color, Background Color, Text Size and Position I. Threat Levels 1. The ACS shall permit the definition of an unlimited number of Threat Levels. a. Threat levels shall affect system wide operational functionality relative to the association to other system objects. b. A threat level range can be defined so that it controls: 1) Group permissions i) Each threat level shall permit association to group permission, thereby invoking an alternate set of permissions under different threat levels. 2) Administrator roles i) Each threat level shall permit the association to an administration role, thereby changing roles of system operators under different threat levels. 3) Schedules i) Each threat level shall permit the association to a system schedule and shall change schedules based on current threat level. 4) Devices shall follow threat level settings as part of logical input processing. 5) Two-factor credentials i) Threat levels shall include the capability to associate multi-factor authentication mechanisms, increasing or decreasing the security requirements for authorized access. 2. Threat levels shall allow association of any defined element listed above, and shall change the result based on the threat level selected. a. The system shall include an option for selected access groups to be exempt from threat level policies.

10 Page 10 J. Antipassback 1. Across panels a. The system shall provide antipassback capabilities across all field panels contained within the ACS. b. Antipassback status shall not be limited to a single field panel 2. Multi-zone a. The ACS shall permit authorized operators the ability to assign multiple doors to an antipassback area. b. The ACS shall permit authorized operators the ability to create multiple antipassback areas. 3. Nested a. The ACS shall include the ability to nest antipassback areas within other antipassback areas. K. 1. Guard Tour a. The system shall provide a flexible way to specify where and when a guard in at their designated tour stop or area while performing rounds b. The system shall generate a notification when a tour is missed, overdue or completed. L. Mustering 1. The ACS shall support multi-zone muster stations. 2. Mustering capabilities shall be based on threat level control, and shall have the ability to provide alternate configurations for each threat level. M. Graphic maps 1. Reference Section Web-based Management Interface for specifications. N. The ACS shall support external reporting engines via ODBC connectivity. O. Video Integration 1. The ACS shall restrict access to both live and archive playback by specific permissions to authorized administrators only. 2. The system shall provide basic capabilities to tag video clips based on ACS events. 3. The ACS shall provide authorized administrators the ability to retrieve a video segment related to a specific event. 4. The ACS shall use the time stamp of the event and camera identifier to query the DVR for event clips. a. The DVR shall return the requested video stream for the time and camera indicated b. The ACS shall play the retrieved video in a popup window. c. Video images shall be streamed directly from the DVR to the browser popup window. 5. Time synchronization between the ACS and the DVR shall utilize NTP protocol, and shall be used to maintain data integrity between the separate systems. 6. DVRs shall communicate with the ACS using Ethernet communications. P. System Administrators 1. Full Role-based Administrative Security Module a. The ACS shall permit unlimited user defined Administrative roles b. The ACS shall provide a minimum of 30 capabilities per role.

11 Page 11 1) The ACS shall include up to 4 permission levels per capability. 2. Administrators of the System Account have full access to the system. a. Sub-account administrators shall have access restricted to their respective accounts. b. The ACS shall maintain the following minimum data elements for all administrator accounts: 1) First Name 2) Last Name 3) Administrator ID 4) Password 3. The ACS shall validate all administrators access to the application and shall track all changes made to the database. a. The ACS shall generate and display a non-editable, printable journal of all administrative actions performed on the account for the purpose of maintaining an unalterable audit trail. 4. Administrators shall have the ability to manage control panel-related data. a. Control panel-related data shall be available once optionally selected on an administrator s configuration page and saved after editing. b. Manageable abilities shall include: 1) Assigning names to panels. 2) Link panel to control boards and elevators. 3) Define and manage control panels for the account. 4) Define and manage control boards. 5) Add doors to an account and associate them with control panels. 6) Enable/disable the Door Ajar feature, and control the Door Ajar Threshold. 7) Define and edit an Invalid PIN threshold and define an associated shutdown period. 8) Define and edit a Pass-through Period. 9) Manage Request-to-Exit motion sensors. 10) Enable and disable Alarm Shunts and define Alarm Shunt Delay time. 11) Delete doors from an account. 12) Add devices to an account and associate them with control panels. 13) Define each device as a Switch Input Device, Schedule Controlled Device, Valid Credential Input Device, or Event Triggered Device. 14) Manage a device s output behavior. 15) Determine if and how a device should be tracked in the Activity Report. 16) Delete devices from an account. 17) Add elevators and associate them with control panels. 18) Associate each elevator with one or more floors. 19) Associate each elevator with a card reader. 20) Delete elevators. 21) Add floors to an account. 22) Define and edit an Unlock Schedule for each floor. 23) Delete floors.

12 Page 12 Q. Users and Groups 1. Manages users who have access to the resources associated with an account, and assign those users to groups that define access privileges, such as the following privileges: a. Define a user group b. Edit access privileges for a group of users c. Delete a user group d. Create a new user e. Assign a unique 4- to 8-digit PIN to a user f. Change a user s PIN g. Delete a user s PIN h. Assign a unique card number to a user i. Change user s card number j. Revoke a user s card number k. Define a user s Start Date l. Define a user s Termination Date m. Change a user s Termination Date n. Delete a user s Termination Date o. Assign a user to one or more groups p. Remove a user from one or more groups q. Delete a user R. Notifications 1. Dispatches notifications to select administrators when one of the following predetermined events occur: a. Door Ajar/Door Ajar Cleared b. Door Forced Open c. Too Many Invalid PINs d. Door Locked by Timer e. Door Unlocked by Timer f. Failed Access by Unknown Person g. Failed Access by Known Person h. Failed Access by a user within a group i. Successful access by a user within a group j. Successful access by a specific user k. Device Engaged/Disengaged l. Control Panel/Control Board Unit Opened/Closed m. AC Power Loss/Restoration and Battery Status n. Account administrators shall have the ability to manage notifications according to functionality listed below: 1) Create and edit notification rules specifying which administrator should receive notification of which system events 2) Associate a schedule with each notification rule 3) Specify the language to be used in notification s 4) Delete notification rules S. Advanced Programming Logic 1. The ACS should include tools needed for building customized and complex IO solutions such as: a. Keypad Command devices that allow definable numeric sequences (1-999) to trigger Relay Outputs, Schedules and Threat Levels.

13 Page 13 b. Toggle, Activate, Deactivate and Wait Timer output behaviors c. Schedule Controls T. Reports 1. The ACS shall include an Activity Report tool that tracks all attempts to access the sites associated with an account, including both successful and failed attempts, with the following options: a. Display the Activity Report unfiltered, so that all activities are listed b. Display the Activity Report filtered by user, so that only those actions performed by a specific user are displayed c. Display the Activity Report filtered by site, so that only those actions performed at a specific site are listed d. Display the Activity Report filtered by door or device, so that only those actions performed on a specific door or device are listed e. Allow administrators to search the Activity Report for exception events, user events, control panel events and device events, searching by absolute date or relative days f. Allow administrators to search the Activity Report for events related to a specific door or device g. Allow administrators to search the Activity Report for actions performed by a specific user on a specific door. h. Allow users to run predefined commonly run reports i. Reporting Feature should have established data so they do not require user input. j. Scheduled Reports should allow either predefined or new reports to be run on a define schedule. U. Licensing 1. The ACS manufacturer shall offer flexible licensing of software capabilities. V. XML Interface 1. The ACS shall provide API support for XML-RPC integration with 3 rd party products providing capabilities such as: a. Automatically adding cards and user photos from external sources. b. Supporting HSPD 12-compliant solutions for Personal Identification Verification (PIV) and Certificate management. c. Time and Attendance systems. d. Parking control systems. e. Human Resource Systems. PART 2 PRODUCTS 2.01 MANUFACTURER A. Brivo Inc Old Georgetown Road, Suite 300, Bethesda, MD a. Telephone: (301) b. Fax: (301) c. Website: PRODUCT SUBSTITUTIONS A. No substitutions permitted.

14 Page SYSTEM COMPONENTS A. Access Control Server (ACS) 1. Brivo OnSite Server a. 19 Rack-mount (1U) b. System requires no additional user-installed software. c. System software requires no maintenance after initial installation. B. Security Door Controllers (SDC) 1. Brivo ACS5000-A/ACS5008-A Door Control Panels a. Expandable modular design. b. Individually fused interface boards, locks, and REX devices. c. Door tamper switch. d. Power loss detection and automatic battery backup. 2. HID EdgeReader /EdgePlus a. Built-in 802.3af Power over Ethernet (PoE) 1) EdgeReader - 600mA available for external field devices 2) EdgePlus - 700mA available for external field devices b. Compatible reader protocols include all Wiegand or HID formats up to 128 bits and iclass RS Wireless Locksets a. The HSMS shall have the capability to integrate with wireless locksets from two manufacturers. 1) IP locksets i. Salto Sallis 2) Wiegand locksets i. Schlage IR AD Brivo IP Door Controller (Brivo ACS-IPDC-A) a. Built-in 802.3af Power over Ethernet(PoE) 1) 750mA available for external field devices b. Compatible reader protocols include all Wiegand or HID formats up to 128 bits and iclass RS-232 c. Authentication and encryption of X.509 Digital Certificates and 128-bit SSL; FIPS C. Ancillary Components 1. Card Readers Wiegand Interface a. HID b. XceedID c. Farpoint D. USGIC Registration and Certificate Management 1. HID pivclass a. Credential Registration 1) FASC-N 2) Photo 3) CHUID b. Caching Status Proxy c. Online Certificate Status Protocol (OCSP) d. Black-List Checking Support

15 Page BRIVO ONSITE SERVER APPLIANCE A. Capacities: 1. Support for up to 500,002 credential holders per appliance 2. Supports up to 1,000 readers 3. Inputs: a. Maximum 30,000 using the Brivo ACS5000 and expansion boards 4. Outputs: a. Up to 30,000 auxiliary outputs using the Brivo ACS5000 and expansion boards 5. Event buffering: a. 10,000,000 events in a circular queue 6. User-definable fields: a. 64 per account 7. Credentials: a. Up to 500,002 active card holders b. Up to 5 cards per card holder 8. Elevator control: a. 118 floors B. Hardware 1. Brivo Server Class Chassis, 1U. a. 4GB Memory (2x2GB), 1066MHz Dual Ranked UDIMM b. X3430 Xeon Processor, 2.4GHz, 8M Cache, Turbo or greater c. 160GB 7.2k RPM Serial ATA Hard Drive or greater d. On-Board Dual Gigabit Network Adapter 1) Integrated 8P8C modular connector 2) TIA/EIA-568 wiring standard e. DVD-ROM f. NEMA 5-15P to C13 wall plug, 10 feet C. FIPS Validated Encryption 1. Optionally utilizes FIPS validated embedded encryption modules for all communications. D. Software/Firmware 1. Brivo OnSite Server, proprietary software designed and developed by Brivo Inc. 2. Browser-based access control Platform a. Open standards based client b. No dedicated client workstations or licenses required c. Lowest TCO 3. Flexible licensing of software capabilities by feature and capacity. 4. Browser-based software upgrades. 5. Support for automated backups to a network drive. E. Dashboard 1. Dynamic system activity log with corresponding time-stamp and device name. 2. View system activity based on account permissions. 3. Display filtering of device status. 4. Configuration of output control for system devices including: a. Pulse b. Latch

16 Page 16 c. Unlatch d. Toggle e. Follow 5. Display Activity and Status Lists. 6. Device Status and Hardware Status list. 7. Momentarily unlock doors. 8. Live Status displays physical status of a door as open or closed, also reports end of line supervision. 9. Threat Level icon enabling authorized administrators to engage and disengage a system-wide lockdown capability. F. Graphic maps 1. Unlimited nested maps. 2. Navigate between maps via hot links. 3. Bit map files imported: a. GIF b. PNG c. JPG 4. Icons representing devices. 5. Real-time status updates via color coded icons. 6. Zone alarm linking between nested maps. 7. Ability to control devices from map. G. Video Integration 1. Support Commercially available NVR/DVR Solutions H. ID Badging 1. Fully customizable badge designer and support for badge printing from the user screen. 2. Support for a wide variety of USB cameras. I. Host communications: 1. TCP/IP Protocol a. DHCP b. Static IP J. Threat Levels 1. Threat level control: a. Group permissions b. Admin roles c. Schedules d. Devices e. Two-factor credentials f. Card Required Schedule K. Antipassback 1. Global - across all connected panels 2. Multi-zone 3. Nested L. Mustering 1. Multi-zone muster stations 2. Threat Level Control M. Full Role-based Administrative Security Module

17 Page Unlimited user defined Administrative roles capabilities per role permission levels per capability. N. Bulk Device Management via Device Profiles 1. Assign profiles such as schedules and permissions to doors, inputs, and credentials. O. Encrypted Data Storage 1. Live database is encrypted via AES Back- up files are compressed and encrypted. 3. Back-up to Brivo Services a. SSH encryption for transmission of encrypted back-up file. P. Supports full range of HSPD-12/FIPS-201 required card formats. Q. Live schedule Activation 1. Activate a schedule directly from the Dashboard. R. Toggle Schedule 1. On / Off 2. Pause / Follow 3. Latch / Unlatch behavior (Ratchet Relay) 4. Wait Timer behavior (Activate at end of timer) S. ODBC connectivity 2.05 BRIVO ACS5000-A/ACS5008-A CONTROL PANEL A. Compliance: 1. UL294 Underwriters Laboratory Safety Standard 294 for Access Control System products. B. Capacities 1. Supports up to 14 expansion boards for up to 30 readers per panel. 2. Support for up to 25,000 credential holders per panel. 3. Elevator control: a. 118 floors 4. Inputs: 4 a. Maximum 120 using Brivo ACS5000-IO expansion modules. b. Optional 4-state, dual end-of-line supervision. 5. Outputs: 4 a. Form C (SPST) b. Maximum 118 outputs using Brivo ACS5000-IO expansion modules 6. Communications: a. Ethernet connection using port 443 outbound 7. Authentication and encryption: a. X.509 Digital Certificates and 128-bit SSL 8. Event history: a. 6,000 events (FIFO) offline from host 9. Expansion Boards: a. Maximum 14 per Brivo ACS5000-A/ACS5008-A 10. Power consumption: a. 500mA peak with all relays engaged (board only) 11. Communication bus wiring:

18 Page 18 a. CAN Bus - Use CAT5 (or higher) UTP cable up to 1,500 feet 12. Temperature and humidity range: a. Operating Temp: 32 to 125 F, (0 to 49 C) Humidity: Max 85% noncondensing 13. Control chassis dimensions: a. Brivo ACS5000-A: 15 h x 15 w x 3.75 d b. Brivo ACS5008-A: 23.5 h x 15 w x 3.75 d 14. Enclosure: a. NEMA type 1 b. Tamper switch c. Key locks d. Knockouts 15. Compliance: a. Listed 33HR b. Access Control UL294 ULC Listed c. CE Certified C. Expansion Modules 1. Brivo ACS5000-DB Brivo ACS5000 Door expansion board a. 2 - Wiegand reader ports b. 4 - Inputs points 1) Optional 4 state supervision c. 4 - Output relays 1) Form C (SPST) d. Power consumption 1) 90mA idle / 400mA peak with all relays engaged e. Communication bus wiring 1) CAN Bus - Use CAT5 (or higher) cable up to 1,500 feet f. Temperature and humidity range 1) Operating Temp: 32 to 125 F (0 to 49 C) 2) Humidity: Max 85% non-condensing g. Compliance 1) UL294/ULC Listed 2) CE Certified h. Dimensions 1) 3.5 h x 11.5 w 2. Brivo ACS5000-IO Brivo ACS5000 Input/output expansion board a. 8 - Inputs points 1) Optional 4 state supervision b. 8 - Output relays 1) Form C (SPST) relays c. Power consumption 1) 90mA idle / 400mA peak with all relays engaged d. Communication bus wiring 1) CAN bus - Use CAT5 (or higher) cable up to 1,500 feet e. Temperature and humidity range 1) Operating Temp: 32 to 125 F, (0 to 49 C) 2) Humidity: Max 85% non-condensing f. Compliance

19 Page 19 1) UL294/ULC Listed 2) CE Certified g. Dimensions 1) 3.5 h x 11.5 w 3. Brivo ACS5000-EXP Small Expansion Enclosure a. 2 Expansion Board Capacity b. Enclosure Dimensions: 1) 15 h x 15 w x 3.75 d 4. ACS5008-EXP Large Expansion Enclosure a. 4 Expansion Board Capacity b. Enclosure Dimensions: 1) 23.5 h x 15 w x 3.75 d 2.06 HID EDGE DEVICE A. EdgeReader ERW400 / EdgePlus E Mounting: Single-gang style electrical box 2. Dimensions: 3.3 W x 4.8 H x 2.3 D (83.8 mm W x mm H x 57.9 mm D) 3. Weight: 14.7 oz. (.400 kg) 4. Style: UL94 polycarbonate enclosure protects components from damage and all connections are fully identified by silk-screened nomenclature. 5. Card Data Formats: Supports any card data format up to 128 bits 6. 44,000 cardholder memory 7. 5,000 buffered events Hardware: 32-bit RISC CPU, 100 MHz processor 8. Memory: a. 8 MB onboard Flash memory b. 32 MB SDRAM c. 256K SRAM 9. Visual Indicators: Two LEDs indicate power/network activity and device I/O activity. 10. Power Supply Requirements: 1A maximum a. Recommended: Power is supplied using the Power over Ethernet technology available with PoE (802.3af) enabled network devices. Alternate: Supervised linear power supply with battery backup, input surge protection, and AC Fail and battery low contact outputs. Relays can be configured to supply power as follows: 1) Available Power: The EdgeReader is capable of supplying a total of 600 ma to field devices. Unpowered, relay contacts are rated for 30 2 A 2) Use of a Listed Access Control / Burglary power-limited power supply is required for all listed installations. 11. The EdgeReader is intended for use in indoor environments that comply with the following specifications: a. Operating Temperature: 32 to 122 F (0 to 50 C) b. Operating Humidity: 5% to 95% relative, non-condensing 12. Communication Ports: a. Ethernet 10 or 100 Mbps b. RS-232 port for Modem or connectivity to other systems 13. Certifications:

20 Page BRIVO ACS-IPDC a. UL 294 Listed Component b. CSA 205 for Canada c. FCC Class A Verification (FCC and Industry Canada Certification for Reader only) d. ICES-003 Class A Canada e. EU 1) (CE Marking), Australia 2) (C-Tick Mark), New Zealand A. Brivo ACS-IPDC Door Controller 1. Mounting: Single-gang style electrical box 2. Dimensions: 3.3 W x 4.8 H x 1.5 D (83.8 mm W x mm H x 36.3 mm D) 3. Compliance: UL 294 Listed Component, CSA 205 for Canada (Pending), FCC Class A Verification (Pending), ICES-003 Class A Canada (Pending), EU (CE Marking) (Pending), Australia (C-Tick Mark, New Zealand (Pending) 4. Card format: Supports any card data format up to 128bit 5. 25,000 cardholder memory 6. 6,000 event history (FIFO) offline from host 7. Power Supply Requirements: A a. Recommended: Power is supplied using the Power over the Ethernet technology available with PoE (802.3af) enabled network devices. Alternate: Supervised 12 VDC linear power supply with battery backup, input surge protection, and AC Fail and battery low contact outputs. Relays can be configured to supply power as follow: 1) Available Power: The IPDC is capable of supplying a total of 700mA to field devices. Unpowered, relay contacts are rated for 30 2 A 2) Use of a Listed Access Control / Burglary power-limited power supply is required for all listed installations. 8. The Brivo ACS-IPDC is intended for use in indoor environment that comply with the following specifications: a. Operating Temperature: 32 to 125 F (0 to 50 C) b. Operating Humidity: 5% to 95% relative, noncondensing 9. Communication Ports: a. Ethernet 10/100 Mbps b. USB to Ethernet 2.08 HARDWARE SUPPORT A. Salto Sallis Wireless Locksets with IP Router 1. The Salto node communicates the following data in series with the Brivo ACS5000 panel to the HSMS: a. Open with card b. Open with metallic key c. Open with PPD (Portable Programming Device) d. Open from Host e. Start office mode with card f. End office mode with card g. Intrusion alarm

21 Page 21 h. Door left open alarm i. End of intrusion alarm j. Start office mode ordered by host k. End office mode ordered by host l. End of tamper alarm m. Communication with lock has been lost n. Communication with lock has been reestablished o. Card rejected p. Card out of time q. Card rejected offline 2. Any combination of up to 30 card readers and Salto locks may be used per Brivo ACS5000-A, Brivo ACS5008-A, Brivo ACS5000-S or Brivo ACS5008-S panel router may be used per Brivo ACS5000 panel mentioned in A.2 4. Up to 16 locks per node B. Schlage IR AD The Schlage controller communicates via wiegand transmission to the Brivo ACS5000 panels 2. Any combination of up to 30 card reader and Schlage locks may be used per Brivo ACS5000-A, Brivo ACS5008-A, Brivo ACS5000-S or Brivo ACS5008-S panel 3. Up to 2 locks per controller or panel interface module PART 3 EXECUTION 3.01 MANUFACTURER S INSTRUCTIONS A. Compliance: 1. Comply with manufacturer s written data, including product technical bulletins, product catalog installation instructions and product carton installation instructions EXAMINATION A. Site Verification of Conditions: 1. Verify that substrate conditions, which have either been previously installed under other sections, or that existing site conditions are acceptable for product installation in accordance with manufacturer s instructions. 2. Verify that building doors, frames, walls, wire runs, related items, and conditions are ready to receive work of this Section PROTECTION A. Other Trades: 1. Protect installed work of other trades PREPARATION A. Manufacturer Forms: 1. Obtain and complete project planning forms from manufacturer of surveillance system; customize forms to be project specific. B. Final Setup: 1. Review, adjust, and prepare final documents to establish system software setup. C. Record Setup Data:

22 Page Electrical Preparation: a. Coordinate with trade where applicable. 2. Elevators: a. Coordinate with trade where applicable. 3. Information Services: a. Coordinate with trade where applicable. 4. Fire Alarm: a. Coordinate with trade where applicable INSTALLATION A. Installation: 1. The installer shall show evidence of factory certification from the HACS manufacturer 2. The installer shall install all system components and appurtenances in accordance with the manufacturer s specifications, referenced practices, guidelines, and applicable codes. Furnish all necessary interconnections, services, and adjustments required for a complete and operable system as specified. Control signal, communications, and data transmission line grounding shall be installed as necessary to preclude ground loops, noise, and surges from adversely affecting system operation. B. Wiring: 1. All wiring is to be installed in dedicated conduit throughout. Cable shall not be pulled into conduits or placed in raceways, compartments, outlet boxes, junction boxes, or similar fittings with other building wiring. 2. All low voltage wiring outside the control console, cabinets, boxes, and similar enclosures, shall be plenum rated where required by code. 3. All wiring conductors connected to terminal strips shall be individually numbered and each cable or wiring group being extended from a panel or cabinet to a building mounted device shall be identified with the name and number of the particular device as identified and shown on building drawings. 4. All exposed wiring inside and outside the control console, cabinets, boxes, and similar enclosures, shall be dressed down neatly and secured with wiring cleats or wire ties. C. Containers: 1. All exposed metallic flexible conduit and armored cable shall be dressed down neatly and secured with low profile, metal fasteners. 2. All cabinets, boxes, and similar enclosures containing security system components and/or cabling, which may easily be accessible to employees or to the public, shall be provided with a lock. Boxes above ceiling level in occupied areas of the building shall not be considered to be accessible. 3. All junction boxes and small device enclosures below ceiling level, and easily accessible to employees or the public, shall be covered with a suitable cover plate and secured with tamper proof screws. 4. End-of-Line resistors shall be installed at the field device location and not at the controller panel location. D. Drawings and Diagrams: 1. System devices identified on building drawings are intended to generally indicate areas where such devices are to be located. Installers shall be responsible for

23 Page 23 determining final location of these devices in accordance with Owner s requirements. 2. Riser diagrams are schematic and do not show every conduit, wire box, fitting, or other accessories. Provide such materials as necessary for a complete and functioning installation. Install in accordance with referenced codes and these specifications. Use weatherproof equipment or covers where installed in areas exposed to weather POST-INSTALLATION A. Software configuration changes capable without future manufacturer service 3.07 FIELD QUALITY CONTROL A. Written Reports: 1. Contractor must note any variants at the site and notify owner s representative within three business days of anything that might affect the delivery date of the system or any trades associated with the functioning of the system. B. Manufacturer s Field Services: 1. When applicable, contractor is to coordinate a specific number of visits with the manufacturer s engineering support team for the system design, insulation, commissioning, final testing, or training TESTING & VERIFICATION A. Perform tests recommended and required by manufacturer to verify required performance of Brivo Inc. products. B. The Installer is required to place entire system into full and proper operation as designed and specified. C. Verify that all hardware components are properly installed, connected, communicating, and operating correctly. D. Verify that all system software is installed, configured, and complies with specified functional requirements COMPLETION & CLEANUP A. Upon completion and verification of performance of installation, remove surplus materials, excess materials, rubbish, tools, and equipment. B. The Installer shall perform final acceptance testing in the presence of Owner s representative, executing a point by point inspection against a documented test plan that demonstrates compliance with system requirements as designed and specified: 1. Submit documented test plan to Owner at least (14) days in advance of acceptance test, inspection, and check-off. 2. Conduct final acceptance tests in presence of owner s representative, verifying that each device point and sequence is operating correctly and properly reporting back to control panel and control center. 3. Acceptance by owner is contingent on successful completion of check-off; if check-off is not completed due to additional work required, re-schedule and perform complete check-off until complete in one pass, unless portions of system can be verified as not adversely affected by additional work.

24 Page The system shall not be considered accepted until all acceptance test items have been successfully checked-off. Beneficial use of part or all of the system shall not be considered as acceptance. C. The Installer shall provide system operations, administration, and maintenance training by factory trained personnel qualified to instruct in the following areas: 1. Owner will designate personnel to be trained. 2. Provide printed training materials for each trainee including product manuals, course outline, workbook or student guides, and written examinations for certification. 3. Provide hands-on training with operational equipment. SECTION END

25 Page 25 PART 1 GENERAL 1.01 SUMMARY SECTION ACCESS CONTROL WEB-BASED MANAGEMENT INTERFACE A. This section provides the specifications necessary for managing the entire Access Control System (ACS) over a Web-based Interface. B. The interface shall be intuitive, and shall follow industry standards for providing cross-platform compatibility with multiple Internet browser technologies such as: Internet Explorer, Chrome, Safari, Firefox, Opera, etc., and shall not require a separate native application for any system configuration DEFINITIONS A. ACS Access Control Server B. X.509 ITU-T standard for a Public Key Infrastructure for Single Sign-On and Privilege Management Infrastructure. C. ITU-T International Telecommunication Union, Telecommunications Standards Sector. D. SSL Secure Socket Layer E. SDC Security Door Controller 1.03 SYSTEM DESCRIPTION A. The ACS Web-based Interface shall provide authorized operators the ability to manage the access control system over secured connections using a standard Web browser. B. Encryption & Authentication: 1. All sessions between the browser and the ACS appliance shall be encrypted using 128-bit Secure Sockets Layer (SSL) encryption. C. Browser requirements shall include, but not be limited to: 1. The use of cookies must be enabled to preserve session information and allow the interface to function properly 2. JavaScript to validate form data, control navigation, and display images 3. The use of pop-up windows for functional elements 1.04 WEB-BASED ARCHITECTURE A. The ACS Web-based Interface shall follow a structured layout allowing access to all major system categories. 1. The main display shall consist of a home page that shall allow the user log-in access using a pre-determined user name and password. 2. Access to all major categories of the system shall be through the use of a horizontal navigation bar. 3. The navigation bar shall be accessible from all category and sub-category views. 4. Upon log-in, the user shall be redirected to a dashboard view, which shall provide dynamic activity lists and device status logs displaying the most recent events in reverse chronological order..

26 Page DASHBOARD 5. All page views shall also include: A. A Threat Level icon which shall indicate the current Threat Level state of the system, and shall permit authorized operators the ability to modify threat levels, and to manually invoke a particular threat level based on current security requirements. B. An icon which shall link the user to help supported topics. C. An icon which shall permit the user to logout of the system in a secure manner. A. The Dashboard shall provide a dynamic system activity log that automatically refreshes periodically with the most recent events along with the corresponding timestamp and device name. B. All operators shall have the ability to view all system activity entries displayed on the Dashboard based on their account permissions. C. Operators shall have the option to select a display filter from a dropdown list in order to choose which device status is displayed. D. The system shall provide a device configuration page allowing authorized operators the ability to configure control for system devices output behavior including: 1. Momentary Activation 2. Latch 3. Unlatch E. Activity and Status Lists 1. Activity Lists shall display information relating to ongoing access control activity and shall include, but not limited to, the following information: a. The date and time at which the event occurred. 1) The ACS client connection shall follow the workstation settings for time zone and make the appropriate adjustments to correctly display the date and time. b. The type of system activity event. 1) Standard device-related events shall be shown in black, including such occurrences as doors unlocked by schedule. 2) User access events. i) The interface shall provide user name hyperlinks for navigation to the corresponding user detail page. 3) Alarms and alert events shall be displayed in red. c. The device from which the event occurred. 1) The system shall provide a device name hyperlink for navigation to the corresponding device details view. d. The name of the logical device. 1) The system shall provide a logical name hyperlink to the corresponding device details page. e. The current output behavior status of the logical device. f. Controllable devices such as doors and outputs shall include buttons to control the state of the device. 2. The Dashboard shall also include a Device Status list and a Hardware Status list.