Exhibit C VA Security Requirements (FSL Level II)

EXHIBIT “C”

VA SECURITY REQUIREMENTS -

FACILITY SECURITY LEVEL II

THESE PARAGRAPHS CONTAIN ADDITIONAL SECURITY REQUIREMENTS, AND,

UNLESS INDICATED OTHERWISE, ARE TO BE PRICED AS PART OF THE

RENTAL RATE (SHELL) OR THE TENANT IMPROVEMENTS (TI). MAINTENANCE

COSTS ARE TO BE INCLUDED IN THE OPERATING RENT.

NOTE THAT ITEMS IDENTIFIED AS “SHELL” REPRESENT A LESSOR’S

OBLIGATIONS OR THE GOVERNMENT’S RIGHTS AND ARE NOT NECESSARILY

ITEMS TO BE CONSTRUCTED.
--------------------------------------------------------------------------------------------------------------------DEFINITIONS: Definitions are the same as those used in the Lease unless re-defined in these Security Requirements.
CRITICAL AREAS - The areas that house systems that if damaged or compromised could have significant adverse consequences for the facility, operation of the facility, or mission of the agency or its occupants and visitors. These areas may also be referred to as “limited access areas,” “restricted areas,” or “exclusionary zones.” Critical areas do not necessarily have to be within Government-controlled space (e.g., generators, air handlers, electrical feeds which could be located outside Government-controlled space). SENSITIVE AREAS – Sensitive areas include patient records and data, or any area that houses medical, mental, or other items or services that require patient privacy. Also included are police areas, pharmacy, medication rooms and OI&T spaces. Sensitive areas are primarily housed within Government controlled space. DESIGN-BASIS THREAT – The Design-Basis Threat (DBT) is the profile and estimate of the threats to a Government facility across a range of specific undesirable events, and serves as the basis for determining appropriate security standards. The Lessor’s technical consultant(s) shall work in conjunction with the Department of Veterans Affairs (VA) to apply the DBT to the post-award risk assessment. The risk assessment identifies recommended countermeasures and security design features that achieve the minimum baseline level of protection (LOP) for a particular facility. The baseline level of protection may be further customized to address facility-specific conditions. The Lessor is responsible for providing countermeasure provisions outlined in this FSL document,

SECURITY REQUIREMENTS (FSL II)

REV (10/31/24)

EXHIBIT “C”

as well as for additional items identified during the post-award risk assessment. Any additional countermeasures identified during this assessment shall be priced as TI.