Facilities Physical Security, Safety, and Privacy Program
- Facilities Physical Security, Safety, and Privacy Program
- Site Security
- Building Security & Privacy
- Interior Security & Privacy
- Safety & Security Systems
- Protective Lighting
- Other Facility Requirements
Indiana University is committed to providing the greatest degree of safety for all members of the IU community, consistent with the university mission and environment, applicable legal and professional standards, generally accepted privacy norms, and available resources. This document provides overarching guidance regarding the protection of university facilities. The objective is to improve the safety of the university community and the security of university assets.
This program applies to all buildings and grounds that are owned or controlled - via leases or other contractual arrangements - by Indiana University, and whose operations are controlled by Indiana University (facilities).
Security, safety, and privacy guidance outlined in this document might also be covered in other university policies and standards. In such cases, the more stringent requirement(s) shall be followed.
All facilities projects must include specific design requirements for the safety of the university community, the security of university assets, and respecting generally accepted privacy norms. A project’s safety, security, and privacy requirements are gathered through a partnership of several university units including but not limited to building managers/coordinators/representatives, law enforcement, fire safety, facilities, parking operations, student housing, architects, and public safety. These units (hereafter collectively referred to as the facility security and privacy design team) must be involved at appropriate facility project stages (e.g., procurement, design, construction, renovation) to ensure appropriate risk-based safeguards are selected.
A sound risk assessment strategy must identify, understand, and prioritize risks associated with university facilities. The first step in the security and privacy design process should be to conduct a preliminary risk assessment. The resulting analysis will guide management decisions on which safeguards are needed to address (treat) identified risks. This risk assessment should be a natural part of the process as facilities are designed, renovated, or simply updated. The risk assessment process is iterative and can occur at any time during a facility’s life time.
The facility security and privacy design team has the responsibility of evaluating the cost and benefit of potential security and privacy safeguards used in each project, with the exception of “base bid” security and privacy standards (see Physical Security, Safety, and Privacy - Facilities Base Bid Standards). These base bid standards provide a basic level of protection for university facilities and serve as a foundation upon which other safeguards can be added. These foundational safeguards cannot be eliminated except under extreme circumstances, and then only in consultation with the University Chief Security Officer and University Director of Public Safety.
For more information, please see Physical Security, Safety, & Privacy - Facilities Risk Assessment.
Consultation and Coordination
The University Chief Security Officer, University Chief Privacy Officer, University Director of Public Safety, and the campus Chief of Police are available to consult on and coordinate facility security and privacy issues.
Perimeter Security and Barriers
- Perimeter security design should use natural barriers, fencing, landscaping, or other physical or psychological boundaries (e.g., signs, closed doors) to demonstrate a security presence.
- Vehicular traffic signs should clearly designate the separate entrances for delivery, visitor, and community member vehicles. Control points (e.g., guard house, crossing arms) should be provided where feasible.
- Walkways should channel pedestrians toward lobbies and entrances.
- Signs shall comply with the university standards for size, color and lettering. In some instances, university standards may prohibit informational signs.
- Private vehicles should not be permitted inside fenced areas or docks.
- Private vehicles should not be permitted under high occupancy areas (e.g., athletic stadiums, auditoriums) unless the vehicles are properly screened.
- Persons with a valid need to enter docks or facility areas in their private vehicle should first obtain clearance from the building manager/coordinator/representative.
- Pedestrians leaving parking lots should be channeled toward a limited number of entrances/exits.
- Emergency phones that are coupled with video surveillance should be strategically placed in the parking lots, with communications transmitted to IUPD dispatch.
- Lighting must be adequate to enhance pedestrian safety (see Protective Lighting section of this program for more information).
- Landscaping features should be carefully evaluated to ensure adequate driver visibility, unobstructed video surveillance coverage, and minimal concealment areas for evildoers.
- Private vehicles parked on university property shall display the designated parking authorization.
- Garage design should be “open” (i.e., visibility throughout the structure) to limit hiding places and give potential evildoers the feeling of being easily observed.
- The number of interior walls within the parking garage should be limited.
- Stairwells should be surrounded by glass to aid visibility.
- Elevator cabs should have a glass back to aid visibility.
- Video surveillance should be strategically deployed and available at IUPD dispatch.
- Camera placement and angles should minimize image “wash out” during certain times of the day (e.g., sunrise and sunset).
- Emergency phones that are coupled with video surveillance should be strategically placed in parking garages, with communications transmitted to IUPD dispatch.
- Access into connected building(s) should be limited, well lit, with no place for concealment.
- Elevator, stairs and pedestrian bridges/tubes should discharge into a staffed or fully monitored area.
- Convex mirrors should be mounted outside the garage elevator to allow elevator passengers to view the area adjacent to the door openings.
- Private vehicles parked on university property shall display the designated parking authorization.
- Landscape techniques or aesthetically designed barriers (e.g., planters, bollards) should be installed to impede vehicular access to lobbies and other glassed areas.
- Driveways should be designed and constructed to minimize or prevent high speed vehicular approaches to lobbies and glassed areas.
- A separate vehicular entrance and area should be assigned to construction contractors. This area will house trailers, job offices and parking.
- When contractor staging areas will be required for extended periods of time, fencing should be provided and located so that it will not interfere with the university’s normal operations.
- Contractor employees shall be briefed on security and privacy responsibilities and shall have limited access to normal business or other defined areas.
- Contractors should be required to sign a letter of confidentiality in situations where research facilities are under construction and/or changes are being made to existing facilities.
- Contractors should have a badge control system when performing work on university property.
- Utilities (e.g. electrical substations, emergency power, telecommunications, water) shall be located in appropriately secured areas.
- Utility facilities should be located away from the property perimeter.
- Emergency generators should be provided for facilities with a large number of occupants or that house critical IT and/or telecommunications infrastructure.
- Fencing and secured doors must be provided for critical utilities and other areas that might be the target of vandalism, sabotage, or that present a safety hazard to unauthorized persons.
- Fencing and doors for high risk utilities should incorporate alarm sensors.
- Fencing for non-high risk utilities, at a minimum, should have frequent patrol coverage during non-operating hours and be secured with a high security padlock. Padlock keys should be strictly controlled and a list of key holders should be documented.
- Satellite stations and communication towers/supports should be located on roof-tops if possible, and provide no access to the public.
- If communication equipment cannot be placed on a secure roof-top, it should be installed with fences and alarms, video surveillance recording and automatic call-up to IUPD dispatch or monitoring location.
- Interior communication areas shall be controlled within a secure room and access controlled by a card access system. Concealment Areas
- Landscaping and other outside architectural/aesthetic features should minimize concealment areas near walkways, connecting links, buildings, and recreational areas.
- Landscape plantings around building perimeters shall be located a minimum of four feet from the building wall to prevent the concealment of people or objects.
- Exterior building and walkway lighting shall be provided where required for customer safety/security. Specific lighting requirements are outlined in the Protective Lighting section of this program.
- Fencing should be used in conjunction with supplemental measures (e.g., motion detection, video surveillance) to increase security benefit.
High Risk Facilities
- Fencing shall be required for the property perimeter. Seven foot chain link nine gauge or heavier wire galvanized with mesh openings not to exceed two inches.
- The bottom of the fence shall not exceed two inches of clearance from the ground. Fence must be stretched tight so that persons cannot enter by crawling under.
- Top guard shall consist of 3 or 4 strand barbed wire with outriggers installed at a 45 degree angle.
- Internal sensitive areas shall have a six foot chain link fence installed without barbed wire outrigger.
- If aesthetics prohibit use of chain link fencing and barbed wire outriggers, an alternative wall with top protection can be installed. In this case, chain link fencing can be used in areas that are not generally viewed by the public.
Medium Risk Facilities
- Fencing should be considered for remotely located medium risk facilities. Fence shall be six foot chain link without outrigger.
- If aesthetics prohibit the use of chain link fencing, a wall or other barrier can be installed that provides the same level of protection. Shrubs and small trees can be planted to hide fencing but should be carefully evaluated to ensure video surveillance coverage is not obstructed and concealment areas are minimized.
- Site and Landscape Standards | University Architect's Office
- Sign Standards | University Architect's Office
- Site Work Standards | University Architect's Office
Building Visitor/Occupant Access
- Students, faculty, and staff shall be issued a university identification (ID) card with photograph, name, and affiliation.
- Faculty and staff are requested to continuously display their ID card while on university property.
- Photographs used for identification may not be used for other purposes without notice to the individual.
- Where appropriate, ID cards should include access control technology features (e.g., magnetic stripe, proximity, smart card). Specific technology requirements are dependent on the type of access control systems deployed in facilities accessed by the card holder.
- Employee ID cards should be recovered when the employee separates from the university.
- The number of building entrances should be minimized, consistent with the size and building layout, functional requirements and applicable codes.
- All entrances should be covered by video surveillance.
- All primary entrance doors should be controlled by an access control system.
- A single “off-hours” entrance (with a security presence if possible) is desirable.
- All exterior doors shall have electric locks.
- All exterior doors shall have door contact alarm sensors.
- Emergency exits should have a local audible alarm in addition to the remotely monitored contact alarm.
- Access control systems should be considered as the first method of choice to control entry. However, when those systems are not in place, locks with removable core cylinders to permit periodic changing of the locking mechanism should be used.
- The doors, jambs, hinges and locks must be designed to resist forced entry (e.g., spreading of door frames, accessing panic hardware, shimming bolts and latches).
- Lock cylinders must be a minimum 7 pin tumbler type.
- Large showroom type plate glass and operable windows on the ground floor should be avoided. However, if these types of windows are used and the building is located in a designated high risk area, special consideration should be given to the use of laminated glass, wire glass or polycarbonate glazing, and locking and alarm devices.
- All exterior windows adjacent to areas where a concentration of people can be present (e.g., lobbies, conference rooms, cafeterias, passageways) shall be provided with shatter resistant glazing. Exterior windows within a protected area (e.g., an interior courtyard) are exempt from the above requirement.
- Fire safety personnel should be consulted prior to the installation and use of intrusion resistant glazing.
- When required, main entrances should have a space for a receptionist or security person during normal operating hours and a security officer at night.
- The lobby area should be a single self-sufficient building entrance. Public telephones and restrooms should be provided in the lobby area such that entry into interior space is not required.
- Video surveillance should be strategically deployed and available at IUPD dispatch.
- An emergency phone should be provided and monitored at IUPD dispatch.
- A remote control should be installed at the reception desk to lock and unlock the exterior lobby doors in emergency situations (e.g., threats of violence).
- Duress button(s) should be installed at the reception desk and those alarms should be sent to IUPD dispatch.
- Upon duress button activation, all doors providing entry to the building interior spaces from the lobby shall lock automatically and video surveillance images will be “called up” at IUPD dispatch.
- The lobby and desk configuration should be designed such that the receptionist has maximum observation from a seated position. Security monitoring equipment shall be installed in the desk.
- Fall protection systems shall be installed to protect workers and others having access to the roof.
- Ladders and/or stairs from the ground to the roof shall be secured with locking device or covering with strict key control applied.
- All dock areas should be provided with means to control access into the building as well as areas beyond the immediate dock location.
- Controlled access to segregated (protected) space from areas such as freight elevators should be considered.
- When not staffed, video surveillance should be provided for remote dock access control and observation.
- Dock design and use should be physically separate from all other functional areas.
- Exterior dock areas should be fenced and/or contain motion detectors coupled with video surveillance transmitted to IUPD dispatch.
Other Building Access Points
- Other less obvious points of building entry (e.g., grills, grating, manhole covers, utility tunnels, mechanical wall and roof penetrations) should be designed to impede and or prevent entry into the facility.
- The facility’s facade should not allow a person to climb up unaided.
- Door and Window Standards | University Architect's Office
- Interior space will be divided into three categories: public areas, interior areas, and controlled areas requiring special security and privacy measures.
- These areas should be separated from one another within the building with a limited number of controlled passage points between the areas.
- Corridors, stairwells, and other accessible areas should be arranged to avoid concealment.
- Restroom placement shall be optimized to reduce the carrying of sounds to adjacent areas.
- Restroom doors shall be placed such that when opened, a passerby would view sinks or open areas rather than urinals or stalls.
- A lockable room suitable for lactation and self-administered personal health procedures (e.g., perform finger pricks to measure blood levels, administer insulin shots, take medication, perform physical therapy stretches) should be provided. A small utility-type sink and an easily accessible electrical outlet should also be provided.
- Generally, controlled space (e.g., research labs, computer facilities, telecommunications closets, areas housing sensitive information) should be located above the ground floor level and away from exterior walls.
- Access to controlled space shall be allowed only from interior space.
- Access into or through controlled space must not be required for non-privileged visitors/occupants to gain access to exits, emergency exits, or other tenant occupied space.
Walls and Partitions
- Public, interior, and controlled spaces should be separated by slab-to-slab partitions (i.e., solid walls that extend from the floor to the underside of the floor of the next level).
- If the area above a suspended ceiling is used as a common air return, appropriate modifications should be made to walls, HVAC system, or security systems to prevent an individual from using this area to gain access to other interior or controlled spaces.
- In shared occupancy buildings, non-university space and university space should be separated by slab-to-slab partitions.
- Restroom walls should provide adequate sound proofing.
- Lactation/personal health room walls should provide adequate sound proofing.
- Interior doors do not normally require special features or provisions for locking unless specified.
- Doors leading to university interior space in shared occupancy buildings should be considered an exterior door and designed accordingly.
- In multi-tenant, multi-story facilities, stairwell doors present a potential security problem. These doors must be continuously operable from the work area side (local fire regulations permitting) to allow egress. Ingress must be controlled to permit authorized access and prevent entrapment. If local codes prevent these doors from being secured, the floor plan should be altered to provide security to university space.
- A fail-safe (fail in the unlocked mode) card reader controlled door re-entry should be provided to prevent unauthorized entry from the stairwell into the work area. The system should be integrated into the facility controlled access system and shall automatically release upon activation of any automatic or manual fire detection device, power failure (unless supported by battery backup), or manual key operation at the security monitoring station.
- If card reader controlled door re-entry on the stairwell is unacceptable, an alternate arrangement is to provide locks on all stairwell doors except the doors leading to the first floor (lobby level) and selected floors in accordance with Life Safety code requirements.
- All stairwell doors shall be equipped with sensors to transmit alarms to the IUPD dispatch; additionally, doors without locks shall be equipped with a local audible alarm.
- Appropriate signs shall be placed within the stairwells.
- Doors leading to roofs shall be secured to the extent permitted by local code.
- Doors to controlled access areas should be designed to resist intrusion, accommodate controlled access controls (hardware and alarm sensors) and be monitored at IUPD dispatch.
- Doors on building equipment and utility rooms, electric closets, telephone rooms, and other types of telecommunication closets shall be provided with a 7 pin tumbler lock(s) having a removable core. Keys to these locks shall be controlled by a key control officer.
- For safety reasons, door hardware on all exterior and secured interior doors shall permit exit by means of a simple knob, handle or panic bar.
- Doors which are equipped with controlled access hardware and/or alarms shall have the controlled access door junction box and terminal cabinets located on the secure side of the door.
- Doors on single restrooms and lactation/personal health rooms shall be equipped with a user-operated deadbolt that displays an exterior “occupied” message.
- Doors to restrooms should be hands-free or push exit. Without this safeguard, paper towels should be provided for hygienic exit.
- Windows in restrooms, dressing rooms, locker rooms, and other areas where privacy is desired should be frosted or otherwise rendered opaque.
Other Public Areas
- Public area design must prevent concealment of unauthorized personnel and/or objects.
- Ceilings in lobbies, restrooms and similar public areas should be made inaccessible. Securely fastened or locked access panels shall be installed where necessary to service equipment.
- Restrooms located in public areas and elevator lobbies in shared occupancy buildings should be locked and have ceilings that satisfy the building’s functional security separation.
Special Storage Requirements
- Building vaults or metal safes may be required to protect cash or negotiable documents or other sensitive documents or materials.
- Vault construction must be made of reinforced concrete or masonry and be resistant to fire damage.
- Steel vault doors are available with various fire related classifications. Vaults must be constructed in accordance with requirements for Underwriter’s Laboratories, Inc. IUPD should be consulted prior to building vaults or room safes.
- Lockable steel filling cabinets may be required for storage of sensitive information.
- All elevators must have emergency communication and emergency lighting.
- In shared occupancy buildings, elevators traveling from non-university space directly to interior or controlled spaces must be equipped with access control systems or other safeguards to prohibit unauthorized entry.
- Door and Window Standards | University Architect's Office
- Elevator Standards | University Architect's Office
Cable Runs – Multi-tenant Facilities
- Data and communication cables passing through non-university space shall be continuously installed in conduit. Fittings should be spot welded when warranted.
- All cable termination points, terminal blocks, and junction boxes shall be located within managed space. Junction boxes located in non-university space shall be capable of being locked.
- All university facilities must have security and life safety monitoring and control systems. These systems will terminate at a designated, continuously monitored, control point (e.g., IUPD dispatch, security control center, commercial monitoring facility).
- A computer-based access control system shall be used for facility access.
- The system shall control access at select interior and exterior doors utilizing card readers (e.g., magnetic stripe, proximity), door strikes, and communication links.
- The system shall have readers that are hard wired back to a control panel. Standalone (i.e., card readers that require a PDA or laptop at the reader’s physical location to change programming) or wireless readers should be avoided unless absolutely necessary.
- The system shall provide a record of card usage to include time, date, card number, and the name of person to whom it is assigned.
- Alarm sensors and buttons (e.g., motion sensors, sound detectors, glass break sensors, duress buttons) must be resistant to surreptitious bypass. Door contact switches should be recessed wherever possible. Surface mounted contact switches should have protective covers.
- Intrusion and fire alarms for controlled areas should incorporate an uninterruptible power supply (generator or battery backup) to support a minimum of continuous eight hour operation.
- Exposed equipment (e.g., control boxes, external bells, junction boxes for alarm systems) must be secured with high quality locks or have contact sensors that alarm if opened.
- Alarm systems should be fully multiplexed in large installations where economically justified.
- Alarm sensors shall individually register an alarm (video as well if system is so integrated) at IUPD dispatch.
- All fire alarm systems must adhere to current fire codes.
- Fire extinguishers shall be placed per current fire codes.
- Emergency key lock boxes (i.e., rapid entry systems) shall be provided as directed by local fire authorities.
- Emergency key lock box keys must be provided to local fire authorities as required.
- Emergency key lock boxes shall be armed with contact alarms that are tied into the campus alarm system and configured to automatically notify IUPD dispatch upon use.
- Video surveillance shall be used strategically to improve the safety and security of the facility.
- Video surveillance systems shall permit monitoring of multiple cameras from one or more remote locations.
- Splitters or other technologies that enable multiple cameras views on a single monitor are preferred.
- Video surveillance shall be integrated with other security systems (e.g., alarms, emergency phones) and processes to bolster safety and security.
- Pan, tilt, and zoom (PTZ) functions shall be used only when fixed cameras cannot reasonably achieve the same objective when used, and PTZ controls shall be located within easy reach of all the monitors.
- All administrative cameras should be tied to campus or university system.
- Cameras should have infra-red capability when used in low light applications.
- Access to surveillance data is restricted as outlined in PS-02 Policy: Video and Electronic Surveillance - https://protect.iu.edu/publicsafety/policies/PS02
- Digital signage should be placed in strategic locations to enable the delivery of campus alerts and safety notifications.
- Digital signage must have the ability to display campus alerts and safety notifications through integration with the university-wide digital signage system.
- Automatic External Defibrillators (AEDs) shall be placed strategically throughout the facility.
- AEDs should be armed with contact alarms that are tied into the campus alarm system and configured to automatically notify IUPD dispatch upon use.
- Emergency phones shall be placed strategically throughout the facility.
- All life safety equipment and accessories must be U.L. approved.
- Security systems shall be installed with distributed wiring schemes that use local telecommunication closets/rooms as distribution points. Distributed wiring will provide expansion capability, future networking capability, ease of maintenance and full implementation of the security system.
- System wiring and cabling needs for safety and security purposes should be an element of facility design.
- At a minimum, the communications link and interface between the sensors, output devices and computer should include conduit, multi-conductor twisted shielded cable and terminal cabinets.
- Wiring closets/rooms containing infrastructure for security systems must be physically secure.
- The design of the communications infrastructure shall permit ready installation and interconnection of cameras, sensors and other input/output devices.
- All IP-based (i.e., reside on the data network) safety and security systems shall have all network traffic logically isolated on a virtual network (e.g., VLAN or MPLS VPN) dedicated for building management systems.
- All IP-based safety and security systems shall be assigned private IP addresses (i.e., RFC 1918).
- All security systems will link, as appropriate, to IUPD dispatch.
- All new systems shall be compatible with existing systems or existing systems shall be replaced with the new system.
- Two independent systems performing the same function should not be used.
- Section 16721: Fire Alarm and Detection Systems | University Architect's Office
- PS-02 Policy: Video and Electronic Surveillance | Public Safety & Institutional Assurance
- Digital Signage | Public Affairs and Government Relations
- Lighting design should discourage unauthorized entry onto or into university facilities.
- Lighting design should assist in detection and prevention of theft, vandalism, and other prohibited acts.
- Light should enable accurate detection of intruders who approach or try to gain entry to university facilities.
- The appropriate lighting types should be selected based on safety, security, and architectural design requirements. Available lighting types include:
- continuous – the most common protective lighting system; contains a series of fixed lights arranged to continuously flood a given area.
- controlled – best used when to illuminate a specific area such as a fence line or perimeter; can be adjusted so adjoining properties and neighbors are not affected or annoyed.
- area – used to illuminate open areas, including material storage areas, streets, and parking lots; can also effectively light aisles, passageways, and recessed/shadowed areas.
- surface – used to illuminate the surfaces of important structures and buildings.
- standby – similar to continuous lighting; supplemental lighting activated automatically or manually when suspicious activity is detected.
- portable – manually operated system including movable floodlights and search lights.
- emergency – this system can duplicate any or all of the previously mentioned types; usually limited to periods of power failure or other emergencies that make normal lighting systems inoperable; usually requires the use of permanent or mobile power generators.
- Metal halide, high-pressure sodium or mercury vapor lamps should be used. Lamp wattage should be selected to provide the established foot-candle values.
- Fixtures should be selected that have a light cut-off design, so as to produce maximum effectiveness.
- Where necessary, fixtures should be vandal proof.
- Location and height of poles should be selected to provide effective security lighting while aligning with the architectural design of the area.
- As much as possible, lighting shall provide an even distribution of light with no shadows.
- In medium and high risk areas, the first branches on trees should be a minimum ten feet from the ground.
- In medium and high risk areas, bushes and shrubbery should not exceed three to four feet in height.
- Emergency lighting shall be provided when power outages occur.
- Emergency lighting shall have a minimum four hour battery backup to facilitate emergency egress of the facility.
- Selected security/safety lighting shall remain on when normal day to day lighting is shut off. Minimum illumination is needed to detect unauthorized persons and for the safety of those who need to take shelter or evacuate in an emergency situation.
- Selected internal lighting should be connected to the facility’s emergency generator if one exists.
- Section 16500: Lighting Systems | University Architect's Office
Campus IUPD Dispatch
- Adequate space should be provided for assigned personnel and equipment.
- A fully integrated console should be available and designed to optimize the operator’s ability to receive and evaluate security information, and initiate appropriate response actions for safety and security systems (e.g., access control, video surveillance, life safety, emergency notifications, alarms).
- The IUPD dispatch/security control center should also have emergency backup power, convenient toilet facilities, appropriate lighting that avoids glare on video displays, sound absorbing materials to reduce noise, and all power should be derived from a source of standby electrical power.
Emergency Operations Center
- Each campus should have a primary and alternate location designated as the Emergency Operations Center (EOC).
- EOCs shall contain communications and monitoring equipment to enable management to make informed decisions during emergencies.
- Specific requirements shall be established by Indiana University Emergency Management and Continuity, in consultation with other university units.
- Written emergency response procedures and checklist shall be in place and followed.
- IUPD, fire safety, facility operations, building managers/coordinators/representatives, and other designated groups should periodically test all equipment and procedures.
- Windows in treatment areas must be rendered opaque.
- A separate locking system shall be used for the storage of controlled substances.
- Environmental Health and Safety shall be consulted for specific requirements related to biosafety labs.
- IUPD and safety patrol tours should be conducted regularly.
- Tables and desks should include a lower privacy panel.