Physical Security Office The Pennsylvania State University Facility Coordinators Meeting Summer 2017

Physical Security Office Vision To enhance all aspects of campus security in support of a pleasantly safe and secure campus environment consistent with Finance & Business' key initiative "Creating a Safer and More Secure University." Mission To provide professional security (and fire alarm protection) services to The Pennsylvania State University community consistent with the University's mission, culture, and resources in order to facilitate a safe and secure campus environment.

Physical Security Office Scope of Services Provide In-House Subject Matter Expertise for Physical Security Security advisors to University (customers, design professionals, etc.) Direct, Manage, and Administer Physical security for the University Security Alarms (duress, hold-up, Intrusion) Fire Alarm (Life Safety system engineering) Surveillance (server/IP based ) Keys and key coring Electronic Access Control (CCure) University-wide Security Assessments via Security Assessment Team Security technology management ( EOC, Police Communications Ctr., Electronics Shop) Custodian of Policies AD65, Policy AD68 and Procedure SY2001 Prioritize and direct the expenditure of Capital Plan security funding Design/Specifications and Standards for security technology Chair and sit on various Strategic Security Committees

Physical Security Staff Physical Security Office Physical Security Staff Primary Office contact 814-867-3051, PhysicalSecurity@psu.edu Scotty Eble, EE Chief Physical Security Officer 814-863-2329, see2@psu.edu Eric Bauman Security Systems Administrator 814-865-7186, egb117@psu.edu Marty Mantz, Security Specialist CWC 814-8674432, msm33@psu.edu Denny Hackenberg, Security IT Specialist / Interim System Administrator 814-863-9615, drh241@psu.edu Larry Murray Security Network Administrator 814-865-0730, lam373@psu.edu Keith Runkle Security IT Specialist 814-863-1977, kar83@psu.edu Josh Troxell University Access Manager 814-863-4695, djt171@psu.edu Hiring in progress University Access Specialist 814-???-????, ????@psu.edu

Access Management at Penn State Facility Coordinators’ Meeting 2pm - 3oSep17 – OPP 105A&B

What is the Current Requirement or Application ? What Facility Coordinators need to know

Relevance for FCs: Applies to all facilities & campus locations (except Hershey & Penn Tech) Applies to all exterior doors One central electronic access system (C-CURE) – centrally administered, locally managed All new construction or renovation All surveillance systems Exceptions or questions go to Physical Security Where are we now? POLICY AD65 Baseline technical specifications & requirements for electronic access, surveillance & building perimeter control (update in progress)

Establishes Access Coordinators Relevance for FCs: Establishes Access Coordinators Must use common access procedures (SY2001) Electronic scheduling preferred method of access management; keys are secondary Establishes key accountability and audit requirements Where are we now? POLICY AD68 University Access Policy Establishes access procedures (SY2001) IN PRACTICE: FCs must approve all Access Coordinators!

Access Coordinator Requirements: Key Database Key Ordering & Storage Requirements Use of Request Forms (FAARs) All Keys All Permanent clearances (>120 days) Mandatory Self-Audits Quarterly, Annual, Change of AC Record Retention Requirements Applies to all Access Control Devices (ACDs; i.e. ‘punch code doors’) Where are we now? PROCEDURE SY2001

What are the Current Challenges / Opportunities for Improvement ? What Facility Coordinators need to know

Over 600 Approved Access Coordinators ~20,000 new keys / year Over 600 Approved Access Coordinators No central key management database No access control link between users/spaces and/or spaces/access management processes Shared Buildings Few resources (training, processes, forms, etc.) Processing delays / work flow issues Technology issues (‘user friendly’, shared partitioning) Lack of ‘Auditability’ Poor tie-in to other PSU systems Administratively intensive …Lack of ACCOUNTABILITY! Current Challenges AS IDENTIFIED BY: University Audit OPP PAT (Program / Process Assessment Team) User Feedback

Current / Future Improvement Efforts ? What Facility Coordinators need to know

Work towards 100% Perimeter Access Control of occupied buildings Police Services Cores (keys) Electronic Control Emergency Exit Only Door Exit Only Door Controlled (scheduled) Door Accessible Door Video surveillance recording Building keys accessible to OPP personnel through a card-swipe sign- out key box How do we improve? KEY BOX PROJECTS (sometimes referred to as ‘AD65 Projects”) OPP Project Manager: Chris Hampton Already underway…

Access Management Considerations Key Processes Electronic Access (ACDs) Assess need for… “Master” Access Coordinator (Role) Consolidating Work Unit Keys Consolidating / Changing key ordering Central Key database and/or templates Processes to minimize ordering keys where card access exists Process to link users to spaces Ensure accountability of keys Potentially limit ‘Key’ Access Coordinators Assess need for … “Master” Access Coordinator (Role) Access Coordinator need Monitoring vs. Administration Training needs Building Lock/Unlock schedules Work Unit Partitioning C-CURE 9000 conversion New technologies (cards, readers, etc.) Potentially Increase “ACD” Access Coordinators

“We manage the people who manage access” Functions / Resources: HOW DO WE IMPROVE? “We manage the people who manage access” Functions / Resources: Customer Service for Access Coordinators Training Templates / Job Aids Communication Policy Review, Recommendations, & Changes Process review, audit and improvement Linking ACs to the technical capabilities Coordinating ‘shared’ and ‘universal’ access needs We don’t control Access! UNIVERSITY ACCESS MANAGEMENT GROUP Josh Troxell University Access Manager University Access Specialists Two (2) positions pending

Central communication (Done!) HOW DO WE IMPROVE? Central communication (Done!) PhysicalSecurity@mymail.psu.edu PLEASE NOTE CHANGE! 867-3051 Assessment meetings with ACs What is working? What do you need? How can we help you meet policy requirements? Training Resources Job aids / training (online) Communication & Feedback Consider Access Coordinators’ Council / Meetings Improve existing policies / processes Assist with technology assessment needs UNIVERSITY ACCESS MANAGEMENT GROUP Initial Work Tasks

Questions & Discussion ?