11.2 CSI MasterFormat, Owner Standards & AIA MasterSpec

Drawings show where. Specifications state what, how well, how it will be installed, and how it will be proven. PSP items on documentation expect you to know where security language lives in a building project, how CSI MasterFormat organizes that language, how owner standards and AIA MasterSpec get reused, and how a sloppy “or equal” clause can erase the detection you thought you bought.

The project manual is the bound (or electronic) book of written requirements issued with the drawings. Division 01 General Requirements covers submittal procedures, substitutions, quality, and closeout for the whole job. Security still needs its own sections so estimators and plan reviewers can find access control without hunting through “electrical miscellaneous.” If the access control specification is hiding in a leftover Division 26 special-systems paragraph from an office standard written in 1998, bidders will miss doors, and the electrical contractor will assume card readers are just another low-voltage lighting control.

CSI MasterFormat as a filing system

CSI MasterFormat is the Construction Specifications Institute’s numbering system for organizing construction information. It is a table of contents for the project manual, used across architecture, engineering, and contracting in North America. It does not certify a camera. It tells every bidder which tab holds access control versus concrete versus HVAC.

For electronic protection, the common home is Division 28 — Electronic Safety and Security. Access control systems (ACS), video surveillance systems (VSS), and intrusion detection systems (IDS) are specified here so that estimators, plan reviewers, and superintendents can find them. Related Division 28 language typically covers common work results for electronic safety and security (pathways unique to security, labeling, owner training), access control, video surveillance, and electronic intrusion detection. Fire detection and alarm may also appear in Division 28 on contemporary MasterFormat projects, which is exactly why the security specifier must coordinate—not copy—life-safety language with the fire protection engineer.

You do not need to memorize every six-digit MasterFormat number for the exam. You do need to recognize that a complete ACS/VSS/IDS package is a Division 28 problem, and that burying it under another division is a coordination failure waiting to become a missing door on bid day.

Sister divisions the security package cannot ignore

Electronic security is not a self-contained island. Four other divisions show up on almost every complete project.

Cross-references in Part 1 of the Division 28 section should name these related sections. The practical split at a door is a classic exam trap: the lock function and frame prep usually live in Division 08; the reader, request-to-exit, door position switch, and controller live in Division 28; 120-volt to the lock power supply lives in Division 26; and the network drop lives in Division 27. If Division 08 specifies a mechanical key override and Division 28 specifies a lock with no cylinder, the door will be built twice: once in the hardware schedule and once in the change-order log.

Site devices follow the same logic. A crash-rated sliding gate is a Division 32 product with structural foundations that may need an engineer. The credential reader, vehicle-detection loop, and intercom are Division 28. The motor’s branch circuit is Division 26. Writing “gate by security” in one place and nothing in the other three is how a project buys a beautiful fence with no way to open it.

Owner equipment standards

Many campuses, retailers, hospitals, and industrial owners already decided the approved video-management platform, the approved access control platform, the approved credential, and the approved camera families. Owner equipment standards—sometimes published as an approved-vendor list plus campus security design guidelines—are not optional flavor text. They constrain product selection, spare-parts stocking, operator training, and cyber patching. The designer’s job is to apply those standards to this site’s coverage and portal list, and to document justified deviations (a specialized license-plate camera at the gate, an explosion-rated housing at a tank farm) rather than silently introducing a fourth video platform that the operations center cannot staff.

Standards also prevent the opposite failure: a designer who writes a closed proprietary specification with no performance criteria, then claims the owner’s list “forced” a sole source. If the owner standard names a platform, still write detection range, pixel density, door-to-controller distance, failover, and retention so that the named platform is being asked to do a job, not merely to occupy a rack. Public owners may also have procurement rules that require competition even when a campus standard exists; the professional response is a performance specification plus a short list of equals that already sit on the owner’s network, not a shrug.

Cyber and identity standards belong in the same conversation. If the owner requires encrypted credentials, certificate-based device authentication, or a specific identity feed from HR, those requirements are specification content. They will not appear on a floor-plan symbol.

AIA MasterSpec as a commercial library

AIA MasterSpec is a commercially maintained library of specification sections used by many architectural firms. Treat it as a starting manuscript, not a building code and not an exam-sponsor publication. Teams edit MasterSpec sections—including Division 28 language—to match the project, the owner standard, and the engineer’s requirements. Using the library can improve consistency of submittal language, warranty clauses, and execution requirements. Leaving the stock paragraphs untouched can specify laboratory-grade testing no bidder can price, or omit the outdoor IDS you actually need.

On the exam, if a stem says the architect “pulled the security section from MasterSpec,” the correct instinct is: useful skeleton, still must be edited for this threat, this owner, and this coordination with Divisions 08, 26, 27, and 32. MasterSpec does not know your pixel-density target at the cash office. You do.

How a spec section is structured: General, Products, Execution

CSI SectionFormat organizes each specification section into three parts. This structure is more testable than any brand name.

Part 1 — General states the scope (“provide a complete access control system including software, controllers, readers, credentials, and locking interfaces at the doors listed on the drawings”), related sections, reference standards (UL listings, adopted fire or life-safety standards where they apply, manufacturer installation instructions), submittals, quality assurance, delivery and storage, warranty, and owner instruction. Submittals typically include shop drawings, product data sheets, battery or load calculations, programming worksheets, spare-parts lists, and closeout manuals. Quality-assurance language is where you require manufacturer-certified technicians—not in a hallway conversation after the low bid wins.

Part 2 — Products is the performance and materials heart. Name acceptable manufacturers if the owner requires them, but lead with measurable criteria: detection range at a stated mounting height, nuisance-alarm qualifications, pixel density at a defined target, PoE class, operating temperature, enclosure rating, credential encryption, failover time, retention days, and listing numbers. Accessories, software licenses, and spare parts belong here so they appear on the bid form instead of as a week-nine surprise.

Part 3 — Execution tells the installer how to put it in and prove it: mounting heights, wiring practices, labeling, coordination with door hardware, interface to fire alarm for maglock release, programming conventions, testing, training hours, and extra materials turned over. Execution is also where commissioning and acceptance testing are invoked so later implementation work has a contract hook. “Install in a neat and workmanlike manner” without a walk-test requirement is not execution language; it is a slogan.

The “or equal” trap

Procurement pressure and public-bid statutes often require language that permits substitutions or “or equal” products. That is legitimate competition. The trap is an “or equal” clause attached to a brand name without the performance engine in Part 2. A substitute that is “equal” because it is also a dome camera can destroy identification at the cash office, replace a dual-technology IDS sensor with a pet-immune PIR that cannot see the loading dock, or swap a four-hour battery pack for a fifteen-minute wall wart.

Defend performance, not tribal brand loyalty. Write the criteria (range, listing, temperature, analytics license, supervised loop, encrypted card, streaming profile, failover). Require substitution requests before bid or during a defined window, with marked-up data sheets that map every specified criterion. Give the designer and owner the right to reject a substitute that fails a listed requirement. “Or equal” should mean equal function and endurance, not equal price and glossy brochure.

A second trap is the reverse: a closed proprietary specification that names one manufacturer for every screw, then uses “no substitutions” where the procurement rules required competition. That invites bid protests and does not make the system more secure. The professional path is owner-standard platforms where they exist, plus performance criteria that any approved equal must meet.

Use the diagram as a coordination checklist, not as a claim that Division 28 owns the door, the transformer, or the fence. If a specification section copied from MasterSpec never names those sister divisions, bidders will assume “by others” means “by nobody.” Before the package goes out, read Part 1 related-sections, Part 2 performance criteria, and Part 3 tests as one argument: this is the system, this is how well it must perform, and this is how we will know it was not gutted by a substitution.