19AU9026Q0008_Attachment J_1_1a.pdf

DEPARTMENT OF STATE

BUREAU OF DIPLOMATIC SECURITY

SECURITY CLASSIFICATION GUIDE

FOR

DESIGN AND CONSTRUCTION

OF

OVERSEAS FACILITIES

JULY 2018

A SUPPLEMENT TO THE DEPARTMENT OF STATE (DOS) CLASSIFICATION GUIDE

RESPONSIBLE OFFICIAL:

TODD J. BROWN

DEPUTY ASSISTANT SECRETARY

FOR COUNTERMEASURES

Reproduction and Distribution: Authority is granted to reproduce all or part of this guide for official use by individuals or groups involved in architectural design, engineering, management, construction or subcontracting of new construction, rehabilitation efforts, equipment installations, and day-to-day operations at overseas Department of State (DoS) facilities. Any other release of this document must be approved by the Bureau of Diplomatic Security. The posting of this guide on the internet is prohibited. See also Administration of this Guide, Paragraph C.2 for further dissemination restrictions.

TABLE OF CONTENTS

I. PURPOSE

II. GOALS

III. BENCHMARKS

A. AUTHORITIES

B. RELATED STANDARDS

C. ADMINISTRATION OF THIS GUIDE

IV. SPECIFIC GUIDELINES

A. APPLICABILITY

B. EXPLANATION OF FORMAT

C. CLASSIFICATION TABLES

SPACES

TABLE IV-1 RESTRICTED CAA – EXCLUDING: SHIELDED ENVIRONMENTS/RED POWER SYSTEMS,

TELECOMMUNICATIONS & TECHNICAL SECURITY

TABLE IV-2 CORE CAA – EXCLUDING: SHIELDED ENVIRONMENTS/RED POWER SYSTEMS,

TELECOMMUNICATIONS & TECHNICAL SECURITY

TABLE IV-3 PCC – EXCLUDING: SHIELDED ENVIRONMENTS/RED POWER SYSTEMS, EMERGENCY

POWER SYSTEMS, TELECOMMUNICATIONS &

TECHNICAL SECURITY SYSTEMS

TABLE IV-4 SHIELDED ENVIRONMENTS/RED POWER SYSTEMS – APPLICABLE IN RESTRICTED CAA, CORE

CAA, AND PCC – EXCLUDING: EMERGENCY POWER SYSTEMS, TELECOMMUNICATIONS

TABLE IV-5 PCC DEDICATED EMERGENCY POWER SYSTEMS

TABLE IV-6 BLAST RESISTANCE

TABLE IV-7 PHYSICAL SECURITY

TABLE IV-8 TECHNICAL SECURITY – INCLUDING BUT NOT LIMITED TO CCTV, INTRUSION DETECTION

SYSTEMS (IDS), ELECTRONIC DOOR CONTROLS, IPMS, ETC

TABLE IV-9 TELECOMMUNICATIONS – INCLUDES U-LAN, C-LAN, BAS, AND TELEPHONE…31

TABLE IV-10 SENSITIVE COMPARTMENTED INFORMATION FACILITIES……………………………..34

APPENDICES

A. ACRONYMS

B. DEFINITIONS

C. HANDLING INSTRUCTIONS FOR CLASSIFIED, SBU, AND UNCLASSIFIED MATERIAL

D. FREQUENTLY ASKED QUESTIONS

NOTE: This document supersedes the Security Classification Guide for Design and Construction of Overseas Facilities dated May 2003. There is no intent to classify, upgrade, downgrade, or declassify work dated prior to the date of this revision or for projects already underway. However, all new work generated from this date forward (including work derived from archival records) shall comply with this guide.

Reproduction and Distribution: Authority is granted to reproduce all or part of this guide for official use by individuals or groups involved in architectural design, engineering, management, construction or subcontracting of new construction, rehabilitation efforts, equipment installations, and day-to-day operations at overseas DoS facilities. Any other release of this document must be approved by the Bureau of Diplomatic Security. The posting of this guide on the internet is prohibited.

See also Administration of this Guide, Paragraph C.2 for further dissemination restrictions.

I. PURPOSE

This guide establishes uniform procedures for categorization of sensitive and classified information relating to the architecture, engineering, interiors, construction, and rehabilitation of any U.S. government facility overseas which falls under Chief of Mission authority. It is to be used to determine the sensitivity of material and the protection of that material. This supplement shall be used as a standalone document and its use is independent of, and exclusive from, the DoS Classification Guide. It shall be used for all design and construction projects and day-to-day facility operations within existing facilities. This guide shall be used by all United States government and contractor personnel, including consultants (both retained and prospective), involved with the Department's overseas facilities.

Determination of sensitive and classified levels follows these precepts:

Sensitive material is categorized as:

Sensitive But Unclassified (SBU) and indicates material which should be protected from unauthorized disclosure but does not pose a national security risk.

Classified material is categorized at three levels indicating the magnitude of potential harm to United States national security, were it to be disclosed to unauthorized individuals:

Confidential (C) could cause damage to the United States;

Secret (S) could cause serious damage to the United States; or Top Secret (TS) could cause exceptionally grave damage to the United States.

II. GOALS

A. General Goals:

1. Prevent the unauthorized disclosure of sensitive and classified information.

2. Keep as much information unclassified as practical.

3. Avoid the over- and under-classification of material.

B. Specific Goals:

Spaces

1. Functional Areas:

Protect the configuration of those functional areas in site-specific Core and Restricted Controlled Access Area (CAA) spaces, as well as the location of weapons safe(s)/vault(s).

Encourage the use of generic terminology to the maximum extent feasible.

Protect the graphic depictions of floor plans for foreign affairs offices and representational housing overseas.

2. Post Communications Center (PCC):

Protect the site-specific layout, to include partitions, equipment, building support systems (i.e.

mechanical/electrical), telecommunications, and furniture of spaces within the PCC (excluding vault walls, if applicable).

Protect site-specific details describing the transition of building support and telecommunications systems into a treated environment (if applicable).

Protect tests, inspection and operational procedures, and results.

3. Shielded Environments (Acoustic and Electro-magnetic radiation):

Whenever Shielded Environments (SEs) are required, protect the design, location, and capabilities of its technical components (electrical, telecommunications, mechanical, structural, and acoustic), tests methods, vulnerabilities, and recovery procedures.

Protect site-specific details describing the transition of building support and telecommunications systems into a treated environment.

Systems

4. Emergency Power Systems:

Protect the detailed design, capabilities, and vulnerabilities of emergency power systems dedicated to PCCs.

5. Blast Resistance:

Protect critical aspects of the criteria used to develop specific blast resistant designs.

Protect the specific vulnerabilities of existing facilities or proposed designs.

6. Physical Security:

Protect existing vulnerabilities that are not readily visible to the general public.

7. Technical Security:

Protect details of any U.S. government-directed modifications to Commercial off-the-shelf (COTS) equipment and systems.

Protect the site-specific details of critical elements of the Technical Security Systems protecting CAAs.

8. Telecommunications (to include C-LAN, U-LAN, internet, telephone, fire alarm, public address, cable television, and building automation systems):

Protect site-specific design for telecommunications systems designed to carry classified data or voice signals.

Protect all site-specific telecommunications systems that enter shielded environments.

III. BENCHMARKS

A. Authorities:

1. Authorizing Official:

Assistant Secretary (AS) for Diplomatic Security (DS) U.S. Department of State Washington, D.C. 20520

2. Office of Primary Responsibility:

Deputy Assistant Secretary (DAS) for Countermeasures (DS/C)

Bureau of Diplomatic Security U. S. Department of State

Rosslyn, VA 22209 571-345-3835

3. Executive Order (E.O.) 12829, Subject: National Industrial Security Program, dated January 6, 1993 as amended [establishes the protection of information classified pursuant to E.O 12356 dated April 2, 1982, "National Security Information," or its successor, and the Atomic Energy Act of 1954, as amended].

4. E.O. 13526, Subject: Classified National Security Information, dated December 29, 2009 [establishes a uniform system for classifying, safeguarding, and declassifying national security information].

5. 32 Code of Federal Regulations (CFR) Parts 2001 and 2003, Subject: Classified National Security Information; Final Rule, dated June 28, 2010 and July 9, 2012, respectively [provides implementation guidance concerning the requirements set forth in E.O. 13526 which is applicable to U.S. government agencies].

6. 32 Code of Federal Regulations (CFR) part 2004, Subject: National Industrial Security Program Directive No. 1; Final Rule, dated April 10, 2006 [provides for implementation and oversight by the Information Security Oversight Office (ISOO) of E.O. 12829].

7. E.O. 12968, Subject: Access to Classified Information, dated August 2, 1995 [establishes a uniform Federal personnel security program for employees who have access to classified information].

8. DoS 1 FAM (Foreign Affairs Manual) 262.1, Subject: DAS for Countermeasures (DS/C): [discusses DS/C functions, responsibilities, and authority, for the management, formulation, and representation on matters regarding security policy and program plans for physical and technical security countermeasures for the Department].

9. DoS 12 FAM 355b and 360, Subject: Transit Security [discusses the required handling of materials bound for CAAs and the Construction Security Certification Program which is used to notify Congress that the Department's projects are embedded with adequate security measures].

10. DoS 12 FAM 530, Subject: Information Security [establishes a uniform system for classifying, declassifying, and safeguarding national security information under control of Foreign Affairs Agencies, which includes the Department of State].

11. DoS Notice 2001_03_014, Subject: Guidelines for Public Information Dissemination on the Internet, dated March 6, 2001.

12. DoS 12 FAM 540, Subject: Sensitive But Unclassified [provides guidelines for SBU information handling, processing, transmission, and/or storage and destruction].

B. Related Standards

1. DoS 12 Foreign Affairs Handbook (FAH)-5, Subject: Physical Security Handbook.

2. DoS 12 FAH-6, classified SECRET, Subject: Overseas Security Policy Board (OSPB) Security Standards and Policy Handbook [establishes a uniform system for safeguarding national security information under control of Foreign Affairs Agencies at Diplomatic Missions abroad].

3. Presidential Decision Directive (PDD) 63, Subject: Critical Infrastructure Protection dated May 22, 1998 [establishes national effort to secure the U.S. interconnected infrastructure such as telecommunications, banking, finance, energy, transportation, and essential government services].

4. Department of Defense (DoD) 5220.22-M, Subject: National Industrial Security Program Operating Manual (NISPOM), dated February 28, 2006 [establishes requirements, restrictions, and other safeguards necessary to prevent unauthorized, and control authorized, disclosure of classified information released by U.S. government Executive Branch Departments and Agencies to their contractors].

C. Administration Of This Guide

1. Reproduction and distribution: see notice on cover and table of contents.

2. The posting of this guide on the internet is prohibited. Transmission to specified individuals via the internet is permitted on a need to know basis.

3. Categorization, review, and changes: the contents of this guide and the determination of what information is categorized (on a Department-wide basis) as classified are the responsibility of DS/C. For project-specific issues, see Appendix C. This guide will be reviewed every five years by DoS for continued applicability and will be rewritten as necessary to ensure all changes have been incorporated in the base document. Revisions to this guide shall clearly differentiate new language from old. Comments regarding the administration of this guide should be directed, through your facility security officer, to:

Deputy Assistant Secretary and

Assistant Director for Countermeasures Bureau of Diplomatic Security

U.S. Department of State

571-345-3835

Comments should thoroughly describe the issue and suggestions for remedy are readily appreciated.

IV. SPECIFIC GUIDELINES:

A. Applicability

The tables included on the following pages shall be applied to all forms of information and information sharing (hardcopy, electronic, audio, video, digital, telephonic, and photographic) used to develop criteria, designs, and construct or renovate the subject facilities. These may include, but are not be limited to:

As-Built documents

Bids

Bills of Material (BOMs)

Budget Documents

Calculations

Construction Documents

Construction Security Plans (CSPs)

Contracts

Cost Estimates (e.g. CWE)

Designs

DoS Standards

Egress Plans

Facsimiles

Generic Designs

Inspection Reports

Maintenance Plans, Manuals, and Studies

OBO Design Standards

Operating Manuals

Planning Papers and Reports (e.g. LROBP)

Plans

Photography

Programming Documents

Proposals

Repair Manuals

Requests for Information (RFI’s in ProjNET)

Requests for Proposals

Review Comments (e.g. ProjNET)

Shop Drawings

Signage Plans, Schedules, and Room Keys

Specifications

Standardized designs (e.g. SED)

Statements of Work (SOWs)

Studies

Submittals

Submittal Registers

Survey Reports

Tests Procedures and Test Results

Explanation of Format

This table is an example of the format used in the classification tables on subsequent pages. It provides an explanation of terms and codes used to categorize information. The elements are listed in the chronological order usually encountered on design and construction projects. Classification and de-classification codes are explained on the next page.

[SUBJECT]

(explanation of basic elements included)

Classification/ Sensitivity Level

Remarks

Non Site-Specific

Generic Criteria Definition: Systemic standards and requirements which are applicable to a group of projects, programs, or sites.

Design Standards:

Definition: Unless stipulated by contract as a binding requirement, a standard is non-binding direction on how requirements could be met. This standard is usually articulated, for example, in documents like the Building Code of the Bureau of Overseas Buildings Operations. Note: Design Standards differ from this Classification Guide in that the requirements of this Guide are binding.

Research Tests and Results:

Definition: Information gathered during Research and Development for establishing new standards, certifiable assemblies, etc.

Site-Specific See Appendix for definition of "Site-Specific"

Design Requirements

Criteria:

Definition: Mandatory project requirements including capabilities and quantified requirements.

Design Guidelines:

Definition: Non-binding concepts or illustrative solutions used to describe the intent of a requirement.

Proposed or Existing features:

Definition: Data usually included in surveys, planning documents, and statements of work used to describe existing conditions or determine project requirements. May include discussion of existing vulnerabilities.

Design

Design:

Definition: All direct and indirect architectural, interiors, and engineering work undertaken to prepare documents to be used by fabricators, constructors, vendors, and installers.

Operations

Operations and Repair Manuals:

Definition: Generic or custom documents (including electronic media versions), which are used to ensure the continued use of that feature. (Includes routine procedures, emergency procedures, troubleshooting, etc.).

Results of tests and inspections:

Definition: Any findings from tests, inspections, surveys, post-failure diagnoses, etc.

* Classification/Sensitivity Codes:

U Unclassified SBU Sensitive but Unclassified SBU/NOFORN Sensitive but Unclassified - No Foreign Dissemination C Confidential S Secret S/NF Secret-No Foreign Dissemination TS Top Secret 3.3(b)X Exemption Code – 3.3(b), of E.O. 13526 [The authority for exemption from automatic declassification where paragraph X represents the reason for exemption, a subparagraph number in section 3.3(b).]

** Classification:

E.O. 13526 dated December 29, 2009 provides specific guidance on procedures related to classification management. Section 1.4 of that order provides a listing of classification categories for specific types of information. This document is the classification authority to be cited by persons within Department of State without original classification authority, and all contractors, and should be cited as the reason(s) for classification. DoS has determined that one or more of these reasons for classification apply to the subjects listed in Tables IV-1 through IV-10 of this guide.

Section 1.4 CLASSIFICATION CATEGORIES (E.O. 13526)

Information shall not be considered for classification unless it concerns:

(a) military plans, weapons systems, or operations;

(b) foreign government information;

(c) intelligence activities (including covert action), intelligence sources or methods, or cryptology;

(d) foreign relations or foreign activities of the United States, including confidential sources;

(e) scientific, technological, or economic matters relating to the national security;

(f) United States government programs for safeguarding nuclear materials or facilities;

(g) vulnerabilities or capabilities of systems, installations, infrastructures, projects, plans, or protection services relating to the national security; or

(h) the development, production or use of weapons of mass destruction.

*** Declassification:

E.O. 13526, dated December 29, 2009, provides specific guidance on procedures related to classification management. Section 3.3(b) of that order prohibits a classification authority from exempting material for more than 25 years from declassification, at the time of original classification, other than information that meets the criteria listed in paragraphs 1-9. This may only be done at a time less than five years before the date of automatic declassification (i.e. after the 20th anniversary of the original classification). The office of Information Programs and Services (A/GIS/IPS) is responsible for the Department’s systematic declassification review program.

Unless otherwise noted, all information that is identified for classification listed in Tables IV-I through IV-10 should be classified for 25 years from the date of origin.

Section 3.3b EXEMPTION CODES (E.O. 13526)

An agency head may exempt from automatic declassification under paragraph (a) of this section specific information, the release of which should clearly and demonstrably be expected to:

(1) reveal the identity of a confidential human source, a human intelligence source, a relationship with an intelligence or security service of a foreign government or international organization, or a nonhuman intelligence source; or impair the effectiveness of an intelligence method currently in use, available for use, or under development;

(2) reveal information that would assist in the development, production, or use of weapons of mass destruction;

(3) reveal information that would impair U.S. cryptologic systems or activities;

(4) reveal information that would impair the application of state-of-the-art technology within a U.S. weapon system;

(5) reveal formally named or numbered U.S. military war plans that remain in effect, or reveal operational or tactical elements of prior plans that are contained in such active plans;

(6) reveal information, including foreign government information, that would cause serious harm to relations between the United States and a foreign government, or to ongoing diplomatic activities of the United States;

(7) reveal information that would impair the current ability of United States Government officials to protect the President, Vice President, and other protectees for whom protection services, in the interest of national security, are authorized;

(8) reveal information that would seriously impair current national security emergency preparedness plans or reveal current vulnerabilities of systems, installations, or infrastructure relating to the national security; or

(9) violate a statute, treaty, or international agreement that does not permit the automatic or unilateral declassification of information at 25 years.

C. Classification Tables

Table IV-1

Subject Classification/ Sensitivity Level

Remarks

Restricted CAA – Excluding:

Shielded Environments/Red Power Systems, Telecommunications & Technical Security

Non Site-Specific

1. Generic Criteria U UNCLASSIFIED for all generic criteria excluding Noise Isolation Class (NIC) acoustic requirements when not designating a specific suite (i.e. all Regional Security Officers (RSOs) offices).

S SECRET when a specific NIC acoustic rating for the perimeter of the CAA is required.

2. Design Standards U

Site-Specific See Appendix for definition of 'Site-Specific'

Design Requirements

3. Criteria U UNCLASSIFIED for all criteria excluding acoustic requirements.

C CONFIDENTIAL when a specific sound transmission class (STC) acoustic rating for the perimeter of the CAA or CAA suites is required.

CONFIDENTIAL when infrared (IR) performance criteria is specified for CAA windows.

S SECRET when a specific NIC acoustic rating for the perimeter of the CAA or CAA suites is required.

Sensitivity Level

Remarks

4. Design Standards (generic and standardized graphics and details)

U UNCLASSIFIED for all design guidelines, graphics and details unless a specific acoustical rating, radio frequency (RF), or infrared (IR) protection is noted. If specific acoustical rating is noted the classification will be in accordance with the Criteria classification listed above. (See also Table IV-4 for Shielded Environments).

Design

6. Floor plans, infrastructure plans

U UNCLASSIFIED when all plans depicting structural walls only (general construction).

U UNCLASSIFIED for all floor plans, internal configurations, furniture plans, infrastructure plans, building utilities, etc.

7. Identification of office spaces U UNCLASSIFIED when signage or labels identifies the space using generic terms (e.g.

office, reception area, corridor, restroom, mechanical spaces).

SBU SENSITIVE BUT UNCLASSIFIED when signage or labels identifies office occupants listed in the unclassified space program (e.g. Executive Suite, Pol/Econ, RSO, etc.).

UNCLASSIFIED – After accreditation and building occupancy.

S/NF SECRET/NOFORN when signage or labels identifies the area as a Treated Environment or a Tenant not listed in the unclassified space program.

Operations

8. Operations and Repair Manuals

U UNCLASSIFIED when not associated with a specific area of the building.

U UNCLASSIFIED when associated with a specific CAA space (e.g. CAA Fire Alarm Repair Manual, etc.). (Manuals for classified systems are to be considered classified to the level of the associated system).

Sensitivity Level

Remarks

9. Results of tests and inspections

U UNCLASSIFIED when all test and inspection results are identified, with no vulnerabilities.

S/NF SECRET/NOFORN when vulnerabilities are identified that could affect the security of classified information.

Table IV-2

Sensitivity Level

Remarks

CORE CAA – Excluding:

Shielded Environments/Red Power Systems,

1. Generic Criteria U UNCLASSIFIED for all generic criteria excluding NIC acoustic requirements when not designating a specific suite (e.g. all RSO offices).

S SECRET when a specific NIC acoustic rating for the perimeter of the CAA is required.

2. Design Standards U UNCLASSIFIED

Site-Specific See Appendix for definition of 'Site-Specific'

Design Requirements

3. Criteria U UNCLASSIFIED for all criteria excluding acoustic requirements.

C

CONFIDENTIAL when a specific STC acoustic rating for the perimeter of the CAA or CAA suite is required.

CONFIDENTIAL when infrared (IR) performance criteria is specified for CAA windows.

S SECRET when a specific NIC acoustic rating for the perimeter of the CAA or CAA suite is required.

4. Design Guidelines (generic and standardized graphics and details)

U UNCLASSIFIED for all design guidelines, graphics, and details unless a specific acoustical rating, radio frequency (RF), or infrared (IR) protection is noted. If specific acoustical rating is noted, the classification will be in accordance with the criteria classification listed above.

Design

Table IV-2

Sensitivity Level

Remarks

5. Floor plans, infrastructure plans

U UNCLASSIFIED when all plans depicting structural walls only (general construction).

C CONFIDENTIAL for all floor plans, internal configurations, furniture plans, utilities, infrastructure plans, etc.

6. Identification of office spaces U UNCLASSIFIED when signage or labels identifies the space using generic terms (e.g.

office, reception area, corridor, restroom, mechanical spaces, etc.).

C CONFIDENTIAL when signage or labels identifies office occupants listed in the unclassified space program (e.g. Defense Attaché Office, LEGATT, Executive Suite, Pol/Econ, RSO, etc.).

UNCLASSIFIED after accreditation and building occupancy.

S/NF SECRET/NOFORN when signage or labels identifies the area as a Treated Environment or a Tenant not listed in the unclassified space program.

Operations

7. Operations and Repair Manuals

U UNCLASSIFIED when not associated with a specific area of the building.

U UNCLASSIFIED when associated with a specific CAA space (e.g. CAA Fire Alarm Repair Manual, etc.). Manuals for classified systems are to be considered classified to the level of the associated system.

8. Results of tests and inspections

U UNCLASSIFIED when all test and inspection results are identified, with no vulnerabilities.

S/NF SECRET/NOFORN When vulnerabilities are

Table IV-3

Sensitivity Level

Remarks

PCC – Excluding: Shielded Environments/Red Power Systems, Emergency Power Systems,

1. Generic Criteria SBU SENSITIVE BUT UNCLASSIFIED when all generic criteria excluding acoustic, isolation, and adjacency requirements as well as any countermeasures.

C CONFIDENTIAL when a specific STC acoustic rating for PCC construction is required.

S SECRET for all isolation and adjacency requirements, or any countermeasures.

S SECRET when a specific NIC acoustic rating for PCC construction is required.

S SECRET when specifications, models, etc. of prime mission equipment is specified.

2. Design Standards SBU SENSITIVE BUT UNCLASSIFIED for all generic criteria excluding acoustic, isolation, adjacency requirements as well as any countermeasures.

C CONFIDENTIAL when a specific STC acoustic rating for PCC construction is required.

S SECRET for all isolation and adjacency requirements, or any countermeasures.

Sensitivity Level

Remarks

S SECRET when a specific NIC acoustic rating for PCC construction is required.

S SECRET when specifications, models, etc. of prime mission equipment is specified.

Site-Specific See Appendix for definition of 'Site-Specific'

Design Requirements

3. Criteria C CONFIDENTIAL for all site specific criteria.

(This is classified, because it is NOT generic.)

C CONFIDENTIAL when a specific STC acoustic rating for PCC construction is required.

S/NF SECRET/NOFORN for all isolation and adjacency requirements, or any countermeasures.

S/NF SECRET/NOFORN when a specific NIC acoustic rating for PCC construction is required.

S/NF SECRET/NOFORN when specifications, models, etc. of prime mission equipment is specified.

4. Design Standards (generic and standardized graphics and details)

U UNCLASSIFIED for all design guidelines, graphics, and details unless a specific acoustical rating or radio frequency (RF) is noted. If specific acoustical rating is noted, the classification will be in accordance with the criteria classification listed above.

Design

5. Floor plans, infrastructure plans

U UNCLASSIFIED for all plans depicting structural walls only (general construction).

C CONFIDENTIAL for all floor plans, internal configurations, furniture plans, infrastructure plans, etc.

Sensitivity Level

Remarks

6. Identification of office spaces

U UNCLASSIFIED when signage or labels identify the space using generic terms (e.g. office, reception area, corridor, restroom, mechanical spaces, etc.). NOTE: Location(s) of safe haven/area(s) is Unclassified.

C CONFIDENTIAL when signage or labels identify office occupants listed in the unclassified space program (e.g. PCC).

UNCLASSIFIED after accreditation and building occupancy.

S SECRET when signage or labels identifies the area as a Sensitive Compartmented Information Facility (SCIF), Shielded Environment, or a Tenant not listed in the unclassified space program.

7. Penetrations through the PCC six-sided perimeter

U UNCLASSIFIED when location of penetration is noted (e.g. the two inch penetration above the vault door).

C CONFIDENTIAL when purpose of penetration is identified (e.g. the two inch penetration above the vault door used for the telephone system).

Operations

8. Operations and Repair Manuals

U UNCLASSIFIED when not associated with a specific area of the building.

U UNCLASSIFIED when associated with PCC specific area (e.g. PCC Fire Alarm Repair Manual, PCC Air Handler Manual, etc.).

Manuals for classified systems are to be considered classified to the level of the associated system.

9. Results of tests and inspections

U UNCLASSIFIED for all test and inspection results not specifically linked to the PCC.

Sensitivity Level

Remarks

SBU SENSITIVE BUT UNCLASSIFIED for all test and inspection results linked to equipment external to the PCC, but dedicated to the PCC (e.g. HVAC, generator). Refer to 12 FAH-6 H- 600 for specifics and limitations.

S/NF SECRET/NOFORN when associated with the PCC (e.g. PCC HVAC Inspection Report).

S/NF SECRET/NOFORN when vulnerabilities are

Table IV-4

Sensitivity Level

Remarks

Shielded Environments/Red Power Systems – Applicable in Restricted CAA, Core CAA, and PCC – Excluding:

Emergency Power Systems, Telecommunications & Technical Security

Shielded Environments include but are not limited to CSE, RFSE, SE, MTCR, and BCR.

Isolated Power Systems (IPS) include but are not limited to isolation transformers, motor generator sets, power line filters, wave guides, etc.

Non Site-Specific

1. Generic Criteria C CONFIDENTIAL when listed as a generic requirement at all locations (e.g. all unclassified – local area network (U-LAN) computer systems shall ___).

2. Design Standards C CONFIDENTIAL when listed as a generic requirement at all locations (e.g. all U-LAN computer systems shall ___).

3. Test Procedures and Results C CONFIDENTIAL when commercially available procedures for Shielded Environments or IPS results are indicated.

C CONFIDENTIAL for U.S. government-designed test procedures and results.

Site-Specific See Appendix for definition of 'Site-Specific'

Design Requirements

4. Criteria C CONFIDENTIAL when the absence or presence of a Shielded Environment is noted.

C CONFIDENTIAL when the absence or presence of an IPS is noted.

Sensitivity Level

Remarks

5. Design Standards (generic and standardized graphics and details)

S SECRET when Shielded Environments or IPS specifications, model numbers, capabilities, specific locations, connections, internal configurations, etc. are noted.

6. Proposed or existing features

S SECRET when Shielded Environments or IPS specifications, model numbers, capabilities, specific locations, connections, internal configurations, etc. are noted.

Design

7. Floor plans, infrastructure plans

S SECRET when Shielded Environments or IPS specifications, model numbers, capabilities, specific locations, connections, internal configurations, etc. are noted.

8. Identification of office spaces/systems

S SECRET when the absence or presence of a Shielded Environment is noted.

S SECRET when the absence or presence of an IPS is noted.

Operations

9. Operations and Repair Manuals

C CONFIDENTIAL when the manual identifies the presence of a Shielded Environment or IPS (e.g.

PCC Shielded Enclosure Maintenance Manual).

S SECRET when the manual identifies the presence of a specific type, capabilities, model, etc. of the Shielded Environment or IPS (e.g.

PCC Lindgren Series X Shielded Enclosure specifications).

Sensitivity Level

Remarks

10. Results of tests and inspections

C CONFIDENTIAL when the test or inspection identifies the presence of a Shielded Environment or IPS (e.g. the PCC shielded enclosure was tested for isolation).

S SECRET when the test or inspection identifies a specific type, capabilities, model, vulnerability, etc. of the Shielded Environment or IPS (e.g. the Red Power System isolation was X ohms).

S SECRET when the vulnerabilities are identified that could affect the security of classified information.

Table IV-5

Sensitivity Level

Remarks

PCC DEDICATED

EMERGENCY POWER

SYSTEMS

1. Generic Criteria U UNCLASSIFIED for PCC general emergency power requirements (e.g. total loading, Forced- Entry/Ballistic Resistant (FE/BR) protection, air flow, fuel tank, etc.).

2. Design Standards C CONFIDENTIAL for PCC specific emergency power requirements (e.g. specific system loads, point-to-point connections, etc.).

Site-Specific

Design Requirements

3. Criteria C CONFIDENTIAL for portion of emergency system exclusively dedicated to the PCC.

4. Design Standards C CONFIDENTIAL for portion of emergency system exclusively dedicated to the PCC (e.g.

load factors and specific performance requirements).

5. Proposed or Existing emergency power systems (including discussion of vulnerabilities)

C CONFIDENTIAL for portion of emergency system exclusively dedicated to the PCC.

S SECRET when vulnerabilities are identified for portion of emergency system exclusively dedicated to the PCC.

Design

6. Location and/or capacity (i.e.

rating) of units. Location of remote controls. Load shedding or similar prioritization strategy details.

U UNCLASSIFED when only the location of the PCC generator room is identified.

U UNCLASSIFIED for overall system capacity and ratings.

Table IV-5

Sensitivity Level

Remarks

C CONFIDENTIAL for remote controls, load shedding, wiring connections, point-to-point diagrams, etc. for all systems serviced by the PCC dedicated generator.

7. Services and infrastructure supporting the emergency power systems

U UNCLASSIFIED for services and infrastructure originating outside the PCC generator room in support of the PCC generator room (e.g. fire suppression system, technical security system (TSS), HVAC, fuel lines, telephone, and lighting).

8. Location of equipment within the generator room

SBU SENSITIVE BUT UNCLASSIFIED for location of PCC dedicated emergency power system components and conduit infrastructure (e.g.

generator, automatic transfer switch, conduit routing between system components, etc.).

9. Facilities/offices and infrastructure supported by the generator

C CONFIDENTIAL for all systems serviced by the PCC dedicated generator.

Operations

10. Operations and Maintenance Manuals and parts lists

U UNCLASSIFIED for the emergency power system services provided by the PCC dedicated generator.

11. Results of acceptance tests and maintenance inspections

U UNCLASSIFIED for the emergency power system services provided by the PCC dedicated generator

S SECRET when vulnerabilities are identified that could affect the security of classified information.

Table IV-6

Sensitivity Level

Remarks

BLAST RESISTANCE

1. Generic Criteria SBU/REL FVEY

SBU/REL FVEY when a design basis threat (DBT) is quantified in terms of charge size and distance.

SBU SENSITIVE BUT UNCLASSIFIED when a DBT is expressed as a combination of pressure, impulse, and/or duration.

2. Design Guidelines SBU/REL FVEY

SBU/REL FVEY when a DBT is quantified in terms of charge size and distance.

SBU SENSITIVE BUT UNCLASSIFIED when a DBT is expressed as a combination of pressure, impulse, and/or duration.

3. Research Tests and Results U

Site-Specific

Design Requirements

4. Criteria

SBU/REL FVEY

SBU/REL FVEY when the DBT is quantified in

SBU SENSITIVE BUT UNCLASSIFIED when the DBT is expressed as a combination of pressure, impulse, and/or duration.

5. Design Standards

SBU SENSITIVE BUT UNCLASSIFIED when the DBT is expressed as a combination of pressure, impulse, and/or duration.

6. Proposed or Existing blast resistant features (including vulnerability analyses and feasibility studies)

Table IV-6

Sensitivity Level

CONFIDENTIAL when vulnerabilities are quantified by any measurement (charge or pressure/impulse).

SBU SENSITIVE BUT UNCLASSIFIED when DBT is expressed as a combination of pressure, impulse, and/or duration.

Design

7. Documentation related to materials and assemblies of blast resistant construction or features.

SBU/REL FVEY when charge weights and distances are identified (e.g. calculations).

CONFIDENTIAL when vulnerabilities are quantified by any measurement (charge or pressure/impulse).

SBU SENSITIVE BUT UNCLASSIFIED when design information is expressed as a combination of pressure, impulse, and/or duration.

Table IV-7

Sensitivity Level

Remarks

PHYSICAL SECURITY

Non Site-Specific

1. Generic Criteria U

2. Design Standards U

3. Research Tests and Results U

Site-Specific

Design Requirements

4. Criteria U

5. Design Standards U

6. Proposed or Existing physical security features

C CONFIDENTIAL when vulnerabilities not visible to the general public are described (e.g. when documented in surveys or statements of work).

Design

7. Documentation indicating location, materials, and assemblies of physical security features

U

Operations

8. Operations and Repair Manuals

U

9. Results of surveys and inspections.

C CONFIDENTIAL when vulnerabilities not visible to the general public are described (e.g. when documented in surveys or inspection reports).

Table IV-8

Sensitivity Level

Remarks

TECHNICAL SECURITY Including but not limited to Closed Circuit Television (CCTV), Intrusion Detection Systems (IDS), access control systems, other technical countermeasures, etc.

1. Generic Criteria

U

CONFIDENTIAL for U.S. government-specific features of modified commercial off-the-shelf (COTS) IDS equipment protecting the CAA.

2. Design Standards U

3. Research Tests and Results U

Site-Specific

4. Criteria

C CONFIDENTIAL for U.S. government-specific features of modified COTS IDS equipment protecting the CAA.

5. Design Standards U

6. Proposed or Existing technical security features features of modified COTS equipment.

C CONFIDENTIAL when specific components are not readily visible to the general public and are protecting the CAA.

S SECRET when system is protecting Core CAA.

Design

7. General Power U

C CONFIDENTIAL for power supply and back-up systems exclusively serving Core CAA.

8. Conduit runs including cabling where system or device

Sensitivity Level

Remarks types (e.g. detection, deterrent, monitoring) are not indicated

C CONFIDENTIAL for PCC and Shielded Environments. (See Table IV-3 'PCC' and Table IV-4 ‘Shielded Environments/Red Power Systems')

9. Detection, Deterrent, and Monitoring Devices

U

C CONFIDENTIAL when location within CAA is not visible to visitors and model is identified or for

U.S. government-specific features of modified COTS equipment.

S SECRET when model and location in Core CAA are identified.

10. Wiring Diagrams indicating point-to-point routing to the terminations of individual conductors (differentiates cabling plans)

C CONFIDENTIAL for CAA.

S SECRET for Core CAA.

11. Control Panels

Operations

12. As-builts SBU SBU for chancery/consulate compounds.

C CONFIDENTIAL for CAA.

S SECRET for Core CAA.

13. Operations and Repair Manuals

U UNCLASSIFIED when data is commercially available in the public domain.

SBU SBU for COTS IDS systems unique to the CAA.

Sensitivity Level

CONFIDENTIAL for U.S. government-designed IDS equipment or U.S. government-specific features of COTS IDS systems protecting the

CAA.

14. Results of surveys and inspections

S SECRET for description or vulnerabilities of systems located in the CAA.

S SECRET for description or vulnerabilities of IDS systems protecting the Core CAA.

Table IV-9

Sensitivity Level

Remarks

TELECOMMUNICATIONS –

Includes Unclassified-Local Area Network ( U-LAN), Classified-Local Area Network (C-LAN), Building Automation System (BAS), and Telephone

1. Generic Criteria S SECRET for U.S. government-specific features of modified COTS equipment that will process/store classified information.

S SECRET when countermeasures requirements are included.

2. Design Standards S SECRET for U.S. government specific features of modified COTS equipment that will process/store classified information.

S SECRET when countermeasures requirements are included.

Site-Specific

3. Design - Telephones

3.1 Demarcation point between

host country and post and/or between post service point and main telephone frame room in chancery/consulate

U

3.2 Equipment and Distribution

systems (e.g. conduit trays, outlet locations, configurations, and distribution of station sets)

U UNCLASSIFIED for equipment or distribution details in Restricted CAA.

C CONFIDENTIAL for equipment or distribution details for Treated Environments (TEs) in Restricted CAA.

details in Core CAA areas.

Sensitivity Level

3.3 Documentation of telephone

cable routes and terminal assignments

C CONFIDENTIAL for documentation detailing

S SECRET for documentation detailing TEs in

S SECRET for documentation detailing Core CAA.

3.4 Details of specific design

techniques used to protect any element of the telephone system from technical threat or attack

S SECRET when specific design techniques are identified as protecting the telephone system from technical threat, attack, or exploitation.

3.5 Location of emergency

telephones

S SECRET when located in Core CAA.

3.6 Acceptance test results and

deficiency lists

S SECRET when the test results and deficiency lists identify system vulnerabilities.

S SECRET when tests identify specific countermeasures.

S SECRET when vulnerabilities are identified.

4. Design – C-LAN or Other Classified Computer System

4.1 Plans, details, specifications, and identification of specific models or equipment related to C-LAN

S SECRET for all plans, details, specifications, and identification of specific models or equipment related to C-LAN infrastructure and equipment.

4.2 Distribution conduits and

terminal boxes

SBU SENSITIVE BUT UNCLASSIFIED when not identified as C-LAN.

S SECRET when identified as C-LAN infrastructure.

Sensitivity Level

Remarks

4.3 Acceptance test results and

deficiency lists

C CONFIDENTIAL for test results that detail system specifications or that identifies specific models or equipment.

S SECRET when tests identify specific

S SECRET when vulnerabilities are identified.

5. Design – U-LAN, BAS SBU SENSITIVE BUT UNCLASSIFIED for equipment or distribution details in Restricted CAA.

details for TEs in Restricted CAA.

S SECRET for equipment or distribution details in Core CAA.

6. Telephone emergency service restoration plans, diagrams, repairs, parts lists, etc.

U UNCLASSIFIED when related to Restricted

CAA.

S SECRET when related to TEs in Restricted CAA.

S SECRET when related to Core CAA.

7. C-LAN emergency service restoration plans, diagrams, repairs, parts lists, etc.

S SECRET when related to Restricted CAA.

S SECRET when related to TEs in Restricted CAA.

S SECRET when related to Core CAA.

8. Telephone Lists U UNCLASSIFIED for abbreviated phone listings showing key personnel and organizations or alphabetical listings.

C CONFIDENTIAL for telephone directories that contain complete phone and organizational listings.

Table IV-10

Sensitivity Level

Remarks

SENSITIVE

COMPARTMENTED

INFORMATION FACILITIES

(SCIFs)

For SCIFs located within Chief of Mission facilities abroad.

1. Generic Criteria U UNCLASSIFIED knowing the existence of one or more SCIFs within a building.

C CONFIDENTIAL Director of National Intelligence (DNI) standards, either by description or by graphics, to the design of a specific SCIF construction or renovation project.

2. Design Requirements C CONFIDENTIAL for specific location of a SCIF within a building (as identified by room number, organization, assigned personnel, or any other identifying information).

C CONFIDENTIAL for internal layout/office configuration of a SCIF.

C CONFIDENTIAL for identification of furnishings for a SCIF.

C CONFIDENTIAL for the identification of any alternative countermeasures used to meet DNI standards in place of specified

S SECRET for the facility type (e.g. open storage, closed storage, continuous operations, etc.) for which a specific SCIF is accredited.

Table IV-10

Sensitivity Level

Remarks

3. Proposed or existing features C CONFIDENTIAL for specific references to the presence or absence of an acoustic or radio frequency (RF) shielded environment (parent room), Shielded Enclosure (SE), Certified Shielded Enclosure (CSE), Acoustic Conference Room (ACR), etc., within a SCIF.

SECRET for the specific reference to the presence or absence of the above at Critical Technical Threat Posts or High Vulnerability Buildings.

S SECRET for the identification of any physical, technical, or procedural vulnerabilities of a SCIF.

4. Operations C CONFIDENTIAL for the identification of any Sensitive Compartmented Information (SCI) accredited information technology (IT) systems, including the identity of the controlling organization or agency installed in a specific

SCIF.

C CONFIDENTIAL for the identification of any Sensitive Compartmented Information (SCI) telephone system or video teleconferencing system installed in a specific SCIF.

S SECRET for all system specifications/capabilities, telephone components, and/or IT configurations.

S SECRET for the identification of specific technical security systems installed in a SCIF, the system specifications, and the associated infrastructure.

S SECRET for the compartments (SI/TK/G/HCS, etc.), for which a specific SCIF is accredited.

APPENDIX A - Acronyms

AIS – Automated Information System ASTM – American Society for Testing & Materials BAS – Building Automation System BCR – Built-in Conference Room BOM – Bill of Materials BR – Ballistic Resistant C – Confidential CAA – Controlled Access Area CAD – Computer Aided Design CADD – Computer Aided Drafting and Design (now synonymous with CAD) CATV – Cable television CCTV – Closed-circuit television CD – Compact Disk C-LAN – Classified Local Area Network CMPD – Compound CMR – Chief of Mission Residence CO – Contracting Officer COB – Consulate Office Building CON – Construction COR – Contracting Officer’s Representative COTS – Commercial off-the-shelf CSE – Certified Shielded Enclosure CSMS – Comprehensive Security Monitoring System DAS – Deputy Assistant Secretary DCMR – Deputy Chief of Mission Residence DECL – Declassify DES – Data Encryption Standard DoD – Department of Defense DoS – Department of State DSS – Diplomatic Security Service FCL – Facility Security Clearance FIPS – Federal Information Processing Standards FE – Forced Entry FSN – Foreign Service National GFE – Government Furnished Equipment GFI – Government Furnished Information HVAC – Heating, Ventilating, and Air Conditioning IDS – Intrusion Detection System IOB – Interim Office Building IPS – Isolated Power System LAA – Limited Access Area MSG – Marine Security Guard MSGQ – Marine Security Guard Quarters MTCR – Modular Treated Conference Room NIC – Noise Interference Coefficient

NISP – National Industrial Security Program NISPOM – National Industrial Security Program Operating Manual NOB – New Office Building NOFORN – No Foreign Dissemination OBO – Overseas Buildings Operations OBC – Office Building Chancery OBX – Office Building Annex OPR – Office of Primary Responsibility PAC – Public Access Control PBX – Private Branch Exchange PC – Personal Computer PCC – Post Communications Center PDS – Protected Distribution System PR – Parent Room REL FYEY – Releasable To Five Eyes RF – Radio Frequency RFSE – Radio Frequency Shielded Enclosure RMS – Roof Maintenance Shed S – Secret SBU – Sensitive But Unclassified SCC – Security Control Center/Console SCIF – Sensitive Compartmented Information Facility SE – Shielded Enclosure/Environment SIC – Security Interface Cabinet SMSe – Security Management System enterprise STE – Secure Terminal Equipment STU –Secure Telephone Unit (obsolete term) TE – Treated Environment TS – Top Secret TSCM – Technical Surveillance Countermeasures U – Unclassified U-LAN – Unclassified Local Area Network UPS – Un-interruptible Power Supply/Source USG – U.S. government

APPENDIX B - Definitions The following definitions are to be used in conjunction with this guide:

Assembly - a combining of parts/materials to achieve a stated purpose (e.g. wall type).

Automated Information System - an assembly of computer hardware, software, or firmware configured to collect, create, communicate, compute, disseminate, process, store, or control data or information (source: E.O. 12958).

Building - a singular structure.

Capability - the design limits of a product, system, assembly, or material.

Compound - see 'Facility' Controlled Access Area - specifically designated areas within a building where classified information may be handled, stored, discussed, or processed. CAAs contain two categories of spaces; core and restricted.

Core - one of two categories of space (the other being Restricted) within a Controlled Access Area. It requires among the highest levels of protection and requires more stringent access control than the Restricted Area of the CAA. This area usually includes the PCC and other functional activities.

(Note: This guide's use of the term 'core' differs from the industry standard that identifies the core of a building as the area containing elevators, fire stairs, restrooms, mechanical shafts, and other similar elements. These elements are usually consolidated and located in the center of mid-rise and high-rise buildings.)

Core Suite - a space in the Core comprised of an organized group of offices and individuals.

Defined - interpreted or elaborated.

Described - narrative or graphic depiction.

Delineated - graphic depiction.

Facility - a property comprising an assembly of one or more buildings.

Functional Area - office or suite of offices.

Generic Design - non-project specific depictions of spaces, adjacencies, or configurations prepared to illustrate requirements or guidelines.

Graphic - image.

Quantified - numerically defined.

Physical Security - an assembly or assemblies (using building materials and/or site features) that is designed to resist unauthorized or forced-entry and attack (by using hand tools, firearms, or other similar weapons). Designed to complement technical security.

Parent Room - a room that houses a SE and is separated by walls/partitions from other similar parts of the structure or building.

Post - a recognized mission that conducts the primary foreign affairs of the U.S. in the host country.