Force 5
Meeting Requirements of Homeland Security's Power "Bill"

When we think of the United States Department of Homeland Security, we don’t usually think of our power bill. But our society is dependent on energy in multiple ways. It’s not surprising then, that Homeland Security has identified the energy sector as one of sixteen critical infrastructures that must be protected and has implemented Critical Infrastructure Protection (CIP) regulations to ensure utilities take the needed precautions. Force 5 delivers compliance-focused enterprise software solutions to support regulations compliance, risk mitigation, audit-readiness, and ease of use.

Compliance with security (CIP) and safety (OSHA) regulations requires today’s utilities to vet and log the escort, visitors, and temporary/permanent workers as they move through designated “critical” areas. Processes and controls must be in place to validate the need for access, validate training required for access, track and monitor the individual’s physical identity using biometrics, and log the required visit information. The typical utility leverages error-prone paper log books to document thousands of visits which provide no validation and create numerous problems for the utilities compliance, security and safety departments. However, according to James Evelyn, General Manager–Security and Compliance of Force 5, “by not complying with these regulations, power utilities face potential large scale outages on the grid, life safety issues and stifffines.” Force 5 saw the opportunity to increase support of their customers by developing software that would capture the data, integrate with other systems, and provide real time monitoring and tracking.

Founded in 2000 in Miami, FL, the Force 5 team’s background is in information security, compliance, messaging, and integration products. Force 5 worked with utility subject matter experts to develop propriety products to provide an end-to-end solution. Their suite of solutions captures and maintains data about any visitor or “worker”–whether an internal employee or a contingent worker through a vendor. Force 5 solutions track and validate the entry policies while monitoring a worker or visitor from their initial entry to their exit of the critical area.

Individuals, objects (keys) and visit data are captured, managed and tracked. Notifications and alerts are sent to ensure compliance evidence and forensics.

The core tool is “Gatekeeper”-built specifically to meet safety and security regulatory audit requirements by combining log and identity management with physical security controls to mitigate risk and meet compliance requirements. Access to physical security perimeters is logged with Gatekeeper touch-screen kiosks and biometrics to expedite the logging required of escorts, workers and visitors in and out. Gatekeeper's Mobile Units are modular containers (roll on/ roll off) shipped in for temporary or long-term assignments to provide positive entry/exit control.

Force 5’s Compliance Management Network (CMN) operates as a vendor management tool ensuring that vendors and their personnel meet and maintain access requirements for customers’ facilities and/or sites. CMN pairs an online, self-service portal with Compliance Concierge Service Representatives provided by Force 5 to manage and vet contractors by verifying the vendor’s personnel information such as background checks, certifications and training.

CARE—or Compliance, Alerts, Reporting, and Education–is a solution that addresses personnel access to cyber and physical assets based on training and certification policies.

Force 5’s Key Management solution allows organizations to securely manage their physical keys.

Mobile Muster Kiosks from Force 5 increase situational awareness providing near real-time rosters of plant visitors in case of an emergency. The Muster Kiosk along with the Gatekeeper software automatically synchronizes all the active visitors who have logged into a facility.

Together, their integrated turnkey approach supports strong proactive data management, real time assessment, and historical tracking to meet audit and regulatory requirements. Per Evelyn, “We approach the implementation of our software from a user’s perspective not a programmer’s view.”