The purpose of installing electronic security and safety systems is to enhance the physical measures employed to protect, deter and mitigate the effects of a serious incident and/or criminal activity.

No single system in isolation is completely effective, and it is only through their layered approach, physical barriers, manned guarding, effective management and clearly identified procedures and policies can their use be fully maximised to best effect.

Due to the variety and availability of internationally recognised standards it is left to the bank and its internal policies and practices to dictate the appropriate standards for such systems.

The every increasing availability of systems, equipment and changes / advancements in technology provides an extensive selection of products to choose from. The selection of the appropriate systems and equipment is dependant upon the security and business requirements of the bank.

The guidelines contained within this document are designed to provide a minimum requirement that must be met and included for all electronic security and safety system installations.

The use of a CCTV Surveillance and Recording system is an essential element in an effective security and safety screen. The systems main functions within the bank environment are as follows:

1. Visual deterrence

2. Proactive and preventative surveillance on suspicious activity

3. Identification of individuals

4. Visual evidence in criminal investigations

5. Visual confirmation in the event of an incident

6. Post event analysis

The installation and connection of a CCTV surveillance network should consider the integration with related systems such as the Access Control, Intruder, Building Management and Fire Alarm systems.

To ensure appropriate equipments, systems, services and their security are incorporated throughout the banks facility, the following are considered a minimum requirement for all locations:

1. All Installed equipment is to include a one (1) year warranty period as standard.

2. On expiration of the warranty period all equipment is to be serviced and maintained by a qualified, recognised and registered supplier and/or service provider. A minimum schedule should include two (2) visits per year.

CCTV Cameras:

1. CCTV camera types employed throughout the banks facilities are dependant upon their purpose and can be a mixture of both fixed and dome type.

2. Dependant upon the purpose and requirement of the camera the picture/image type can be:

a. Black and White

b. Colour

c. Combination (Day/Night)

3. To ensure the security of the connections and cabling of the cameras all exposed cabling is to be encased in steel tubes no less than 1.5mm thick.

4. Pinhole Camera - Minimum Requirements:

a. Resolution: 500 TVL

b. Lens: 1/3 inch

c. Fixed Iris Lens: 3.8mm

d. Back Light Compensation (BLC)

e. Illumination: 0.1 Lux

5. Fixed Camera - Minimum Specification:

f. Resolution: 500 TVL

g. Lens: 1/3 inch

h. Video Motion Detection (VMD) -through DVR

l. Auto Iris Lens

j. Back Light Compensation (BLC)

k. Illumination: 0.1 Lux

6. PTZ Camera - Minimum Specifications:

a. Resolution: 500 TVL

b. Lens: 1/4 inch

c. Optical (x22) and Digital (x10) Zoom

d. Auto and Manual Focus

e. Pan Range: 340 deg

f. Tilt Range: 90 deg

g. Pan-Tilt Speed: 300 deg / sec

h. Back Light Compensation (BLC)

i. Illumination: 0.1 Lux

7. External Cameras - Minimum Requirements:

a. Positioned to cover all access and entry points for a facility.

b. Provide effective picture quality at both day and night. This can be achieved by correct positioning, shielding from the sun, In-built LED lighting and/or external illumination.

c. Fully enclosed in a weatherproof and vandal resistant housings.

d. Positioned at a minimum height of 2.5m.

8. Internal Cameras - Minimum Requirements:

a. Provide effective picture quality at both day and night. This can be achieved by correct positioning, built in LED lighting and/or external illumination.

b. Positioned at a minimum height of 2.5m and not vulnerable to approach without surveillance.

CCTV Digital Recording System:

The central element of the CCTV surveillance system is the recording medium. To ensure effective management, recording and storage of surveillance material it is to be undertaken in a digital format.

The type of system installed is dependant upon the requirements and capability of the bank. Ultimately, this can be either a hardwire system or an IT based solution.

1. The recording equipment is to be secured (as well as its power supply) separately in an enclosed and lockable cabinet / container that is securely fixed.

2. To ensure the integrity and continuous operation of the recording and surveillance equipment in the event of a power failure a separate battery back up supply is to be incorporated. The use of a UPS system is to have a minimum back up capability of 30 minutes.

3. The location of the recording equipment is essential in maintaining its integrity and in the prevention of tampering. The following options are available for its placement:

a. Security Control Room

b. Communication Room

c. Data Room

d. Cash / Operations Officer (if located within the secure Teller Area)

Monitors:

To ensure effective monitoring and viewing of the CCTV surveillance system a 17" screen is to be considered as a minimum for all identified locations.

The classification for main buildings includes all facilities not separately covered within these guidelines. They include the following types:

1. Head Office Buildings

2. Regional Buildings

3. Data / Computer Centres

4. Disaster Recovery Sites

5. Warehouses

To ensure an effective recording period is adopted for all main buildings a minimum storage period of 1 month is to be retained at 6 fps. If recordings for specific incidents and events are requested and/or required by the bank these can be transferred to separate hard disk drives and/or writeable discs as required.

In addition to the general requirements listed above the following standards are to be considered as minimum requirements for CCTV surveillance and recording systems in all main buildings:

CCTV Cameras - Surveillance Area:

1. External coverage of all entry and exit points

2. Internal coverage of customer reception areas and staff entrances

3. Internal coverage of entry and exit points

4. Floor access points that include stairwells and elevator lobbies

5. Restricted Areas that require internal surveillance include:

a. Data and Computer Rooms (including individual aisles)

b. Security Control Rooms

CCTV Digital Recording System:

The operation and storage of the system is to be located in the Security Control Room. For smaller buildings it can be located in a secure area and monitored from the reception and/or the security guard position.

The primary risks and threats facing the banks are against its branch network and cash holding facilities. The geographic diversity and storage of cash / valuables makes them an attractive target for criminal activities.

In combination with other related systems the CCTV surveillance capability plays an essential role in deterring, recording and monitoring the potential risks.

The requirements covered within these guidelines include male, female and combined branches. Where combined branches are concerned they are to have separate recording and monitoring systems and controlled independently of each other.

To ensure an effective recording period is adopted for all branches and cash holding areas a minimum storage period of 3 months is to be retained at 6 fps. If recordings for specific incidents and events are requested and/or required by the bank these can be transferred to separate hard disk drives and/or writeable discs as required. If specific recorded data is requested by SAMA a copy is to be retained by the bank for a period of 1 year.

In addition to the general requirements listed above the following standards are to be considered as minimum requirements for all branches and cash holding facilities:

1. Cash In Transit (CIT) Route - the bank is responsible for the continuous and uninterrupted CCTV recording of cash and valuables once it has arrived at the property until the time it has left the property. This is to include the following:

a. External arrival / departure point

b. The transit route through the branch or cash holding facility

c. Transfer point to bank staff

d. Cash Handling Area

e. Transfer to Storage Area

f. Storage Area (Vault / Safe / Safety Deposit Boxes)

g. ATM service room and access door

2. CIT Call Point - at the recognised access point for CIT operations a Call Point is to be fitted (bell / Video Speaker Phone) to alert the Cash Officer and/or Security Guard.

3. Branch - in addition to the above requirements the following areas are also to be covered by CCTV cameras:

a. Tellers - a camera is to be located behind the teller positions and cover a maximum of two (2) teller locations. The camera is to include facial features of the customers and the area around the teller. The coverage of VIP tellers is also to be covered.

b. Entry and Exit Points - all doors that exit the building are to be monitored internally. These include main, service entrances and emergency exits. Internal stairwells and access points to upper floors are also to be covered.

c. Customer Lines - a camera is to monitor the customer lines.

4. Monitors - the surveillance and monitoring of the installed cameras is to be undertaken by the Cash Officer and nominated representatives. Security guards are only to be provided surveillance of the external areas, public areas and the entry points to the building.

Monitors are to be positioned so that the images are not clearly visible to the customers.

No more than sixteen (16) images are to be displayed on the monitor at any one time.

In addition to, and for the same reasons, the risk and threats facing the branches and cash holding areas, the ATMs are also a potential target for criminal activities.

To ensure an effective recording period is adopted for all ATMs a minimum storage period of 3 months is to be retained at 6 fps. If recordings for specific incidents and events are requested and/or required by the bank these can be transferred to separate hard disk drives and/or writeable discs as required.

Whilst the ATMs located in the branches are supported by their security system, all ATMs are to incorporate the following minimum requirements:

CCTV Cameras - Surveillance Area:

1. External Camera - to monitor the activity in front of the ATM and include the immediate area around the customer / vehicle.

2. Internal Camera - to clearly monitor the facial features of the customer.

CCTV Digital Recording Equipment:

1. Branch ATMs - are to be connected to the branch recording system.

2. Off Site ATMs - are to have a separate recording unit or server based system.

Sufficient ventilation and cooling is to be available to the installed equipment to ensure effective and continuous operation.

In addition to the minimum requirements listed above for the CCTV surveillance and recording system the bank could implement a Central Monitoring System (CMS) which is considered preferable by SAMA.

The adoption of a CMS will provide a remote monitoring and (possible) recording capability that will enhance the banks ability to respond to incidents and effectively mitigate the potential losses and damage as a result of a serious event that would affect its staff, assets, business and customers.

SAMA is currently reviewing this option for kingdom wide implementation with the following considerations:

1. Bank Controlled CMS

2. Police Controlled CMS

3. Privately Controlled CMS

An Access Control System is designed to provide a centralised control, management and recording of personnel throughout the banks facilities.

To ensure effective security of the banks facilities; Its critical assets, and the prevention of unauthorised access a dedicated system is to be employed.

Electronic Access Control Systems include the following types:

1. Proximity Cards

2. Biometric

3. Digital Keypads

Access Control utilising mechanical locks and keys are Included within Section 4 'Physical Security and Safety Systems'.

To ensure the integrity and continuous operation of the Readers in the event of a power failure a separate battery back up supply is to be incorporated within the reader / controller. The internal battery is to have a minimum back up capability of 30 minutes.

Access control systems that utilise controllers are to have a maximum of eight (8) doors controlled from a single unit.

The central database for maintaining the record of authorised personnel and the access log is to have a separate automatic / simultaneous back up capability.

To ensure effective security, control and recording of specific locations and Restricted Areas, all banks are to implement one (1) of the above systems, mechanical alternatives or a combination of them and retain a log of events for a period of 6 months.

ID Cards:

All staff, contractors and visitors are to be issued and clearly display an ID Card that identifies them whilst in the banks facility.

The cards may be incorporated within the Access Control system technology described above or be independently produced.

All banks are to ensure an effective system is adopted for the process of requesting, issuing and managing of the ID Cards.

An Intruder Alarm System incorporates a number of different sensors to detect and alarm in the event of unauthorised access or presence.

All alarms are to be controlled through a panel and have both local and remote capability. Remote capability may include one (1) or a combination of the following options:

1. External and separate Building / Branch / Security Control Room

2. Regional Building

3. Centralised Monitoring Station (CMS)

The remote location must have a 24 hour monitoring capability to ensure an effective response.

The bank is responsible for the preparation and implementation of effective response procedures in the event of receiving an alarm from any one of the identified systems.

The Intruder Alarm panel can either be a separate system or be combined with the Fire Alarm System.

The panel is to be located in a secure location and situated within a Restricted Area. Remote keypads for arming / disarming are to be located close to the exit of the area to be alarmed and not in a public area of the building or branch.

To ensure the integrity and continuous operation of the Intruder Alarm panel and its sensors / detectors in the event of a power failure a separate battery back up supply is to be incorporated. The use of a UPS system is to have a minimum back up capability of 48 hours.

The following sensors / alarms are to be fitted in the locations identified:

Hold Up / Panic Buttons:

These are designed to be activated if the operator / user is being attacked or threatened. The buttons are to be fitted in the following locations:

1. Teller Positions

2. Cash Officer

3. Cash Handling Area

4. Branch / Operations Manager

5. Vault / Safety Deposit Room

6. Security Guard (Branch)

7. Reception Desk (Main Buildings)

8. ATMs

The buttons can be of double operation and suitably protected and positioned against false activation.

Passive Infra Red (PIR) Sensors:

PIR sensors are designed to detect movement in a given area under their surveillance. Sensors are to be a minimum of dual technology and Include enhanced features to minimise false alarms. The sensors are to be fitted in the following locations:

1. Access points to the Teller Area

2. Access route and door to the Vault / Safe / Safety Deposit Room

3. Emergency Exit doors (Ground Floor)

4. Data / Computer Room

5. Disaster Recover (DR) Sites

6. ATM Cabinet

7. ATM Service Room

The PIR sensor is to have a visual LED self test capability to demonstrate when movement is detected. This is to be active when in the armed or disarmed mode.

Seismic / Vibration Sensors:

Seismic sensors are used to detect vibrations from all types of attacks through solid structures. The primary purpose of the sensors is to protect and prevent access to the vault, cash holding areas and ATMs.

All sensors are to be flush mounted within the floor (where applicable), wall and ceilings and be suitably protected using a protective cover to prevent damage and as a trip hazard.

Locations to be fitted with seismic sensors are as follows:

1. Vaults - to cover all 4 walls, ceilings and floor (where there is a basement)

2. ATMs - to be fitted inside the body / cabinet of the unit

Additional sensors are to be fitted to walls and ceilings adjoining other commercial or private properties.

Magnetic Door Contacts:

Restricted Areas identified above that do not have Electronic Access Control Systems are to incorporate Magnetic Door Contacts and linked to the Intruder Alarm Panel. Additional locations include all ground floor Emergency Exit doors.

Magnetic Door Contacts are to be fitted to the internal side of the door and located at the top open corner. Dependant upon the construction material and design of the door alternative contacts / switches may be used.

All doors with Magnetic Contacts are to have effective heavy duty door closures fitted.

Glass Break Detectors:

Glass Break Detectors are to incorporate dual technology that is capable of analyzing both flex (impact) and audio (shattering) frequencies.

Prior to the fitting of the sensors the glazed areas are to be checked for their type (sheet / tempered / laminated) to ensure their effectiveness.

If the glazed panels have film fitted, are of tempered or laminate type there is no requirement for the detectors.

Where sheet glass is used it is to be supported by the detectors.

The installation of a dedicated, integrated and effective fire detection, alarm and suppression system is critical for the safety of the banks staff, assets, business and customers.

The installation of smoke detectors is to be included in all rooms, stairwells, corridors, lift shafts, and public areas of a banks facility.

Fixed temperature thermal detectors are to be fitted to all kitchen and tea room facilities. Special attention is to be given to the fitting of thermal detectors within ATMs.

To ensure effective identification and response to a potential alarm activation a maximum of 20 detectors are to be registered in each zone if the system is not of the addressable type.

Manual Call Points are to be installed next to emergency exits, escape routes and located close to the fire extinguisher and hose reel points. The distance between Manual Call Points should not exceed 30m.

On the activation of an alarm an audible ringing is to be heard throughout the entire facility. An audible bell and visual strobe is to be visible from outside the facility.

The internal bells are to be rated at 108 dB and external bells at 120 dB.

The strobe is to remain active until the system has been reset.

Both the strobe and bells must be tamper resistant.

All cabling is to be fire rated and not run alongside power cables.

All banks are to ensure the fire alarm panel has both local and remote capability. Remote capability may include one (1) or a combination of the following options:

1. External and separate Building / Branch / Security Control Room

2. Regional Building

3. Centralised Monitoring Station (CMS)

The remote location must have a 24 hour monitoring capability to ensure an effective response.

To ensure the Integrity and continuous operation of the Fire Panel, detectors and suppression systems in the event of a power failure a separate battery back up supply is to be incorporated. The internal battery is to have a minimum back up capability (under normal load) of 48 hours and then maintain the activation of the alarm for a further 5 minutes.

The bank is responsible for the preparation and implementation of effective response procedures in the event of receiving an alarm from the panel.

The Fire Alarm panel can be implemented as a separate system or combined along with the Intruder Alarm System. It is to be located in a secure room and remote annunciator panels near personnel operating on a 24 hour shift.

All installed equipment is to Include a one (1) year warranty period as standard.

On expiration of the warranty period all equipment is to be serviced and maintained by a qualified, recognised and registered supplier and/or service provider. A minimum schedule should include two (2) visits per year.

To ensure the effectiveness and capability of the system, regular internal tests are to be conducted. These tests are to be conducted on a monthly basis and the results recorded.

Evacuation procedures and floor plans identifying exit routes are to be prepared and positioned throughout the facility for maximum exposure.

All Emergency Exit doors are to be fitted with mechanical push bars / levers to facilitate a quick and easy access and open outwards in the direction of escape (Section 4).

To facilitate the safe evacuation process from a building once a fire alarm has activated the recruitment and training of Floor Wardens / Fire Marshalls is to be done from with the banks' staff.

Careful selection of individuals and their deputies will ensure all relevant areas are considered and included.

Internal and external lighting can enhance the security and safety requirements of the bank and assist the surveillance capabilities of the security guards and CCTV surveillance system.

Application, placement and types of lighting are to be carefully considered as part of the overall requirements.

All CCTV camera locations that do not have built in illumination are to be supported by external lighting.

All identified Restricted Areas are to maintain constant illumination.

All branches are to maintain constant lighting throughout the ground floor.

External lighting is to be available for all entry and exit points of a building including emergency exit doors.

Emergency lighting incorporating an internal battery back up capability is to be available in the event of a power failure and automatically activate.

Emergency lighting is to be fitted in the following locations:

1. Emergency Exit Routes

2. Emergency Exit Doors

3. Fire Extinguisher and Hose Reel Locations

4. Manual Fire Alarm Points

5. Restricted Areas

Emergency lighting must be capable of operating for minimum of 3 hours and fitted no less than 2m from ground level.

Emergency Exit signs that are not self illuminating and to be covered by the back up system.

Whilst the main power for the banks facilities will be supplied from the electrical grid there may be occasions where a disruption or power failure is experienced.

As identified above, all the main security and safety systems are to incorporate an emergency battery / UPS back up system that will provide sufficient power for a minimum of 30 minutes. This is designed to provide sufficient time to secure the premises until normal power is resumed.

In critical facilities the use of emergency generators is to be used. The following locations are to incorporate generators:

1. Head Office Buildings

2. Regional Head Office Buildings

3. Data / Computer Buildings

4. Cash Centres / Main Cash Holding Facilities

Dependant upon business and bank requirements, additional buildings / facilities may be identified for generator back up.

Once systems have been installed it is essential they are properly serviced and maintained by qualified, approved and experienced service providers.

The adoption of a comprehensive service and preventive maintenance contract will mitigate the possibility of system failure in the event of an incident and prolong the life of the equipment.

A minimum schedule of three (3) visits is to be conducted for all locations. Locations include main buildings, branches, data and cash centres, ATMs and warehouses.

To ensure the security of information contained on hard drives, internal memory and recordable mediums an effective disposal procedure is to be adopted.

Equipment identified for proper disposal are as follows:

1. ATMs

2. Point of Sale Hardware

3. PCs and Laptops

4. Fax Machines

5. CCTV Recording Hardware

6. Servers and Back Up Units

7. CDs and DVDs

Disposal is to take the form of electronic (erasing), or physical (destruction), or a combination of both to ensure the data is permanently removed.

Clear procedures are to be in place for the disposal of the above equipment/items and coordination between the Security and Safety Manager and the Information Security department is to identify the responsibilities dependant upon the internal processes of the bank.