Beltway Bureaucrats Further Confuse Procurement Process

August 31, 2006 SSI Staff

By now, you’ve probably heard of the Homeland Security Presidential Directive 12 (HSPD-12) and the Federal Information Processing Standard Publication 201 (FIPS 201). In a nutshell, HSPD-12 mandates the establishment of a standard for identification of federal government employees and contractors. It requires the use of a common ID credential for both logical (computer network databases) and physical (facilities) access control. This policy is intended to enhance security, increase efficiency, reduce identity fraud and protect personal privacy.

The most significant challenges in our industry will be the need for federally compliant card readers and physical access control panels that meet the technical and interoperability standard for the new “smart” identity cards. This is where FIPS 201 comes into play. Historically, logical (the IT folks) and physical (our realm) access control functions have been managed by completely separate personnel. As a result, the equipment, system architecture and identity requirements were specific to each. HSPD-12 requires both groups to comply with FIPS 201 objectives starting in October.

So, what is the problem? For starters, our industry will have to manufacture a new generation of electronic physical security access control panels because the FIPS 201 data requirements are sophisticated beyond the capabilities and needs for typical physical access control systems. FIPS 201 card credentials do not include the most commonly used technology deployed today — 125kHz proximity (known as Wiegand protocol or RFID). FIPS 201 does not take into consideration interoperability with fire alarm systems, life-safety building codes or UL listings.

Here’s the kicker: Manufacturers do not want to build new equipment before all requirements of this directive are known! Unfortunately, full implementation of HSPD-12 is stifled by uncertainty. As you read this, GSA continues to work on “approved products list” testing procedure requirements.

And there is more to this story! An installing security contractor can sell and service federal agencies under GSA Schedule 84, which is devoted to electronic physical security (access, CCTV, intrusion etc). Once you master the ropes, it can be smooth sailing. Well, get ready to fill out more paperwork and encounter more hoops and logjams!

GSA has now indicated that all HSPD-12/FIPS 201 physical access control equipment (our new stuff) will be under Schedule 70! This schedule is mostly for IT computer equipment, software and services. You’ll either have to submit two different proposals to two different government GSA entities with separate rules and regulations, thus complicating the procurement process big time, or become a subcontractor under an IT integrator.

Since most of our security systems include access, fire, intrusion and CCTV, how in the world will you be able to “integrate” these systems if you have to break out the FIPS 201-compliant physical access control from the rest of your proposal? How will you guarantee complete system functionality and services?

So what does all this mean? The HSPD-12 regulation does not provide for a streamlined procurement or installation process for either the IT or physical security contractor. I believe it means if you are not a giant defense contractor like Lockheed, Northrop, General Dynamics, etc. that has all the resources to all of the GSA schedules and “can do it all from A to Z,” you’ll end up being a subcontractor working under their umbrella.

I’m all for setting standards, but adding impractical bureaucratic layers that increase costs, delay procurement and complicate the installation process is unnecessary. It’s harmful to small businesses and costly to taxpayers. The question I have is: How can this situation be rectified?

If you enjoyed this article and want to receive more valuable industry content like this, click here to sign up for our FREE digital newsletters!