Business Case Access Control - Final

IT Governance Business Case Perimeter Access Control Standardization

Project Introduction Project: Access Control Standardization Major Objective:

• To replace the existing access control system with a more robust, integrated and centralized solution

Desired Business Value: • Increased safety for occupants and assets • Increased operational efficiency • Modernized security system • Improved integration of card access control system • Increased data security and reliability Stakeholders: • General Services • Technology Solutions • City of Durham Employees • City of Durham Residents

Current State •

The City currently uses Paxton Access Control at all facilities with the exception of Water Management which uses Millennium.

•

The current setup features at least fifteen access control servers throughout the City at facilities that act completely independent from each other.

•

Repairs to the existing system have increased significantly as card access to certain doors and gates is often broken.

Current Pain Points • Existing system is outdated with no scalability and is unable to upgrade to the constantly changing security industry.

• Existing system is not centralized, and therefore does not have added security, flexibility, expanded accessibility, and built-in backup capabilities.

• Existing system is not flexible enough to handle special security events.

• No ability to run real-time reports and metrics to help management quickly make informed business decisions.

Current Pain Points (continued) • Existing system is proprietary.

• Existing card reader and badge technology is easily susceptible to cloning with an inexpensive $10 replicator.

• When employees are terminated, and especially at will, the badge will still have access at all other servers allowing an opportunity for disgruntled employees to still gain access.

• Inadequate access control systems has continually lead to security issues at Fleet Management, Solid Waste, and PWOC due to unsecured gates from access control issues.

• Not all doors wire back to a central IT closet and currently most locations have the door controllers unsecured in the drop ceiling above the door.

Future State

Upgrade to an enterprise-level, highly scalable access control solution that will increase safety, provide state of the art capability for access management, and will allow General Services to more efficiently manage, maintain, and track entry.

Future State Benefits Integration & functionality • Standardized security system citywide including electronic access control.

• Partitioning and Facility Consolidation.

• Ensures that future work is efficient and coordinated with the city's security operation and technology infrastructure.

• All doors wired back to a centralized IT Closet.

• Increased flexibility and user convenience for operator.

Increased Card Reader and Badge Technology • Badges cannot be easily cloned.

• Non-proprietary door controllers.

• Increased level of Data Privacy.

API • Integrating existing systems or a unique third party application into a new access control solution is easy with open API. Open Architecture Solution • Future extensive migrations not needed, not proprietary.

IT Architecture Slide

S2 ENTERPRISE – PARTITIONED

Mercury Controller Mercury Controller Card Readers

Card Readers

Browser

Mercury Controller

Mercury Controller Card Readers

Card Readers

Browser S2 Enterprise Controller Mercury Controller Card Readers

WAN/LAN

Access Control Solution Roadmap Phase 1 – FY 20

Phase 2 – FY 21 Remaining City locations

• City Hall • Fleet • Solid Waste Admin/Transfer • PWOC • General Services

• • • • • • • • •

City Hall and high risk locations

• New Morgan St. Parking Deck (Completed in FY19)

Fire Parks and Recreation Water Management Transportation Radio Communication Community Development NIS Sign and Signal Shop PD (Already installed Card Readers. Only door controllers are needed)

Solution Options & Analysis

11

1. Proceed with the replacement of access control locations at existing facilities listed in phase 1.

12

Description

Pros

Cons

Proceed with the replacement of access control locations at existing facilities for Phase 1 & 2.

• • • • •

Increased overall safety for occupants and assets Increased integration and functional capabilities Upgraded card reader and badge technologies One centralized control server Increased reliability

•

There will be some slight disruption with deployment of new card access replacement Occupants will have to get a new picture for the ID badge from HR

•

13

COST ESTIMATES Description

FUNDING

Year 1 Costs (Hours)

Run Costs (Hours)/ KTLO

Departmental Funding Amount:

$0

Labor $ (Hours) Internal TS:

32 hours

0 hours

0 hours

0 hours

32 hours

24 hours

Internal Project Management:

96 hours

0 hours

Project Run Cost (External)

$0

General Services Department:

75 hours

0 hours

*Total Project Funding Requested for Year 1 (Phase 1)

$245,000

$0 (0 hours)

*Total Project Funding Requested for Year 2 (Phase 2)

$300,000

$0 (0 hours)

$0 (0 hours)

All recurring costs from this project will be included in the existing operational budget of G.S.

$135,000 (0 hours)

$0 (0 hours)

Hardware:

$360,000

$0

Software:

$50,000

$0

$0

$0

Business Analysis TS Services

External:

Business Analysis

Professional Services

$0 (0 hours)

Non-Labor $

Other:

Funding Requested (Y/N):

Total Project One Time Costs – Both Phases

Y

$545,000

Risk: Is S2 Access Control currently in production elsewhere?

Risk Mitigation Plan: Complete due diligence with other municipalities and organizations on performance of S2.

References Checked for Vendor: Reference Checks Municipality Mecklenburg County

Contact Person

Satisfied with product?

Chad W. Harris, CPP Security Director Asset and Facility Management

Yes

ED MILLER I SECURITY MANAGER

Yes

Dante' G. Patterson Lincoln County Government Chief Information Officer

Yes

Durham County

Lincoln County Government Lincolnton, NC

15

Summary & Recommendation

16

Options 1. New Access System 2. Existing System

Single server, enterprise-level solution?

Access Control Operations – Desired Business Value Analysis Criteria Open hardware Real Time Data Scalable to suit Software and integration Analytics & fast changing Familiarity? platform?

Reporting? industry?

Cost

$$$ $$

17

Recommendation Option 1: Proceed with the procurement and implementation of a new enterprise level Access Control System.

18

Our Ask

We are asking to approve the Business Case for a new Enterprise Access Control System

Project Planning

Implementation Overview

Project Timeline

• March 2019: Gain Approval from Steering Committee​ Soft launch at Morgan-Rigsbee Parking Garage • April 2019 (Two Months) Implement outfit • June 2019 Develop project manual and bid documents • July 2019 FY20 funding • August 2019 Begin implementation of new Card Access Control for Phase 1 • November 2019 Complete Phase 1 of Card Access Control replacement • July 2020 FY21 funding • August 2020 Begin implementation of new Card Access Control for Phase 2 • November 2020 Complete Phase 2 of Card Access Control replacement

21

xxx 2018

22