2.2.1 Attachment F Facility Access Directive_FD 121-3.pdf

For Official Use Only

Federal Emergency Management Agency (FEMA) Directives System Directive Number: FD 121-3

Revision Number: 01 Issue Date: 12/29/2015

FACILITY ACCESS

I. Purpose This directive establishes policies and procedures for requesting and managing physical access to Federal Emergency Management Agency (FEMA) facilities. The provisions of this Directive are not intended to bar disaster survivors from accessing FEMA facilities, such as Disaster Recovery Centers, in order to register for disaster assistance.”

II. Scope The provisions of this directive apply to anyone entering or exiting a FEMA-controlled facility or area.

This directive is not applicable to classified areas which are covered under other DHS and FEMA directives, manuals, and instructions.

III. Supersession This directive updates and replaces FEMA Directive 121-3, dated January 28, 2011.

IV. Authority A. 18 U.S.C. § 930, “Possession of firearms and dangerous weapons in Federal facilities.”

B. 42 U.S.C. § 5197a, “Security Regulations.”

C. 6 C.F.R. Part 37, “Real ID Driver’s Licenses and Identification Cards.”

D. 41 C.F.R. Part 102-74, Subpart C, “Conduct on Federal Property.”

E. 44 C.F.R. Part 15, “Conduct at the Mt. Weather Emergency Assistance Center and at the National Emergency Training Center.”

F. 40 U.S.C. 1315, "Law Enforcement Authority of Secretary of Homeland Security for Protection of Public Property", G. DHS Delegation 120002, "Delegation to Designated Officers and Agents on

Behalf of Mount Weather Police Department”, dated June 26, 2006.

H. DHS Management Directive 11005, “Suspending Access to DHS Facilities, Sensitive Information, and IT Systems.

I. Homeland Security Presidential Directive (HSPD-12), “Policy for a Common Identification Standard for Federal Employees and Contractors,” August 27, 2004.

J. The Federal Information Processing Standard Publication (FIPS) 201-2, “Personal Identity Verification (PIV) of Federal Employees and Contractors,” March 2006.

K. Office of Management and Budget Memorandum 11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD-12) Policy for a Common Identification Standard for Federal Employees and Contractors,” February 3, 2011.

L. Office of Management and Budget Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005.

M. Architectural Barriers Act of 2004.

N. Americans with Disabilities Act, of 1990.

O. Post Katrina Emergency Management Reform Act of 2006.

P. Rehabilitation Act of 1973.

Q. Robert T. Stafford Disaster Relief and Emergency Assistance Act, as amended, and Related Authorities as of April 2013.

R. FEMA and National Council on Independent Living Memorandum of Agreement, Dated July 29, 2010.

S. National Disability Rights Network, 11 March 2011.

V. References None

VI. Definitions A. Access Badge: A badge that authorizes either escorted or unescorted access to FEMA controlled facilities. This could be a temporary badge, such as a FEMA Visitor Badge or Facility Access Card (FAC), or a permanent badge, such as a PIV, CAC, or PIV-I card.

B. Approved FEMA Escort: A FEMA employee, detailee, or contractor who has been issued a PIV card/credential and has the authority to escort visitors within FEMA space. Foreign Nationals cannot serve as FEMA escorts.

C. Approved FEMA Access Sponsor: A FEMA employee, detailee, or a contractor with a PIV card/credential, and who verifies the need for a guest or visitor to enter FEMA space. Foreign Nationals cannot serve as FEMA access sponsors.

D. Common Access Card (CAC): A Department of Defense (DoD) credential that meets the requirements of HSPD-12 and FIPS 201-2.

E. Dangerous Weapon: A weapon, device, instrument, material, or substance, animate or inanimate, that is used for, or is readily capable of, causing death or serious bodily injury, except that such term does not include a pocket knife with a blade of less than 2 1/2 inches in length.

F. Disaster Facility: Any temporary, FEMA-controlled facility established to support one or more declared disasters or emergencies (e.g., Joint Field Office, Interim Operating Facility, etc.).

G. Escorted Access: A limited form of facility access, which requires an individual to be accompanied by an Approved FEMA Escort while inside FEMA-controlled facilities and spaces. This access also requires sponsorship by an Approved FEMA Access Sponsor before entering FEMA facilities and spaces.

H. Facility Access Card (FAC): An access card issued to an individual who requires recurring access to a specific FEMA facility for no longer than 6 months, but who does not require or qualify for a PIV card/credential. (e.g. Local Hire).

I. FEMA Facility: Any building or other structure, or part thereof, owned, leased, or controlled by or on behalf of FEMA, including disaster response sites where FEMA equipment or employees are regularly present for official purposes.

J. FEMA Personnel: FEMA employees, (irrespective of hiring status), detailees, and contractors. Applies to all locations to include disaster facilities.

K. Foreign National: An individual who is not a citizen of the United States.

L. Guest: An individual who is sponsored for physical access to FEMA facilities and has a valid CAC, PIV card/credential, or PIV-I card/credential. Examples of guests include, but are not limited to, other government agency personnel who have a valid CAC, PIV card/credential, and representatives from state and local government who have a valid PIV-I card/credential.

M. Office Suite: A secure enclosed space consisting of offices and/or workstations as determined by Physical Security.

N. Personal Identity Verification (PIV) Card/Credential: A PIV card/credential is an approved United States Federal Executive Branch (FEB) smart card issued under HSPD-12 that contains the necessary data for the cardholder to be granted access to Federal facilities and information systems. It assures appropriate levels of security for all applicable federal applications, as well as multi-factor authentication, digital signature, and encryption capabilities (DoD Common Access Cards are PIV card/credentials).

O. Personal Identity Verification Interoperable (PIV-I) Credential: An identity card/credential that meets the PIV technical specifications to work with Federal PIV card/credential infrastructure elements such as card readers, and is issued in a manner that allows Federal Government agencies to trust the card/credential and identity of the holder. Providers of authorized PIV-I must be approved by the

General Services Administration (GSA) as an approved provider. There is no background investigation required to be issued a PIV-I (Example: PIV-I cards are issued by state and local governments as a First Responder Access Card

(FRAC )).

P. Regional Security Officer: A specific OCSO qualified employee assigned to a Regional Office who serves as the Region’s principal liaison with the Office of the Chief Security Officer (OCSO) and who is responsible for the implementation of security policies and procedures, and security programs at all assigned facilities in that Region.

Q. Security Officer: A representative of the Chief Security Officer who is responsible for the implementation of security policies and procedures at FEMA facilities, this applies to other than Disaster Facilities.

R. Screening: Verification of an individual’s eligibility and authorization to enter a FEMA facility (e.g., identification check, National Crime Information Center (NCIC) criminal history check) and physical body/baggage scanning (e.g., magnetometer (“metal detector”), X-ray scans).

S. Unescorted Access: The authorization for a guest to operate without an escort within a FEMA-controlled facility.

T. Visitor: An individual sponsored for physical access to a FEMA facility who does not have an approved CAC, PIV card/credential, or PIV-I card/credential, and requires an escort while in a FEMA facility.

U. Visitor Badge: A one-day badge assigned to visitors.

VII. Responsibilities A. The Chief Security Officer (CSO):

1. Establishes, implements, enforces, and maintains this directive and the policies and procedures herein.

2. Implements access control procedures, provides security guards, and operates and maintains Physical Access Control Systems (PACS).

3. Oversees issuance of FEMA access badges.

B. The Chief of Physical Security is responsible to ensure that access control procedures, security guards and PACS are properly positioned, maintained and utilized throughout FEMA.

C. Security Officers execute the responsibilities of the Chief of Physical Security at FEMA sites and facilities.

D. Police Officers and/or Security Guards enforce facility access in accordance with this directive, and per 40 U.S.C. 1315, "Law Enforcement Authority of Secretary of Homeland Security for Protection of Public Property".

E. The Regional Security Officer Implements access procedures and makes risk based decisions for access based on the threat level for OCSO assigned facilities as delegated by the Chief of Physical Security.

F. Approved FEMA access sponsors verify the need for a visitor or guest to access a FEMA-controlled space and ensure their visitor or guest adheres to all FEMA, DHS, and Federal policies while in FEMA space.

G. All FEMA employees, detailees, and contractors must adhere to the requirements of this directive. This applies to all locations to include disaster facilities.

VIII. Procedures A. Access Procedures

1. Per the requirements of HSPD-12 and OMB M-11-11, FEMA facilities will utilize the PIV credential as the common means of authentication for access to FEMA facilities.

2. All individuals entering FEMA facilities must be properly identified and in possession of a recognized and accepted identity credential or access badge before being granted access to FEMA facilities.

3. While inside FEMA facilities, individuals must at all times conspicuously display their identity credential or access badge between their neck and waist.

4. Individuals must wear their CAC, PIV card/credential, or PIV-I card/credential in an electromagnetically shielded carrier.

5. Individuals must secure their FEMA identity credential or access badge from view upon exiting the facility.

6. Individuals must return their FEMA identity credential or access badge and building pass when access is no longer required or authorized (Examples include suspension or termination of employment, resignation, or conclusion of a visit).

7. Individuals must surrender their identity credential or access badge to authorized FEMA security personnel, including but not limited to uniformed police officers, uniformed security guards, non-uniformed FEMA Security Officers, and Regional Security Officers upon request (e.g. Expired badge).

8. Request for additional or alternative access control measures (e.g., card readers, locks, etc.) must be approved by OCSO prior to implementation.

9. Program Offices with access control measures are responsible to designate a list of personnel allowed access to their program areas. Such lists must be provided to OCSO Identity Credential Access Management (ICAM) and Physical Security Branch for entry into Access Control Systems.

10. To enhance the safety of all FEMA employees, detailees, contractors, visitors, and guests, as well as the security of sensitive information in FEMA’s possession, all points of ingress and egress to a building, floor, and office suite equipped with physical access control devices (e.g., card readers) are required to be kept closed and secured at all times.

a. This includes, but is not limited to, main lobby doors, rear doors, truck docks, fire exits, individual office suite doors within FEMA facilities, and other points of access.

b. This includes program offices with alternate access control measures.

c. This includes unauthorized access such as, following someone else into a controlled area without swiping a PIV/I Card first, “piggy backing”.

d. The Administrator may waive the requirement to close and secure doors under this section, on a case-by-case basis, upon the written request of the affected program office. The Administrator may delegate, in writing, the authority to waive the requirement to close and secure doors under this section to the Deputy Administrator or the Chief of Staff. Upon granting a waiver under this section, the Administrator shall provide a copy of the signed waiver to the Chief Security Officer. Program offices requesting a waiver under this section shall submit their requests to the Administrator, and such requests must be signed and dated and include:

1) Specific identification of the doors for which the waiver is requested;

2) Justification for waiving the requirement to close and secure the specified doors;

3) The period of time for which the waiver is requested; and

4) A statement that the requestor understands that waiving the requirement to close and secure the specified doors increases risk to the security of the personnel and sensitive information behind the specified doors and that the requestor asks the Administrator to accept that increased risk.

11. FEMA employees, detailees, and contractors shall notify OCSO through the Facility Security Officer as soon as an access control problem and a violation is discovered. Failure to comply with this requirement constitutes a security violation and may result in disciplinary action.

B. Visitors and Guests

1. All visitors and guests will undergo screening to determine if they meet eligibility requirements for access into FEMA space.

2. All visitors and guests must be sponsored by an Approved FEMA Sponsor before they are granted access to a FEMA facility.

3. All visitors must be escorted by an Approved FEMA Escort while inside

FEMA-controlled space.

4. Visitors issued a FAC must be escorted unless a specific determination has been jointly made by OCSO, Personnel Security, and OCSO Access Management to authorize unescorted access for the individual.

5. Although PIV-I holders may be enrolled into the access control system for access as a guest, they must be escorted unless a specific determination has been jointly made by OCSO Personnel Security, and OCSO Access Management to authorize unescorted access for the individual.

6. Large group visits must be prearranged with the applicable FEMA Facility Security Officer, or responsible Regional Security Officer at least two days prior to the planned visit. The Facility Security Officer or responsible Regional Security Officer has the authority to waive the two day advance notice for good cause. Forgetfulness or ignorance of this requirement does not constitute good cause.

7. Visitors must return their FEMA access badge and/or building pass at the conclusion of a visit.

C. News Media:

Members of the news media must be escorted at all times while inside FEMA-controlled space. The Office of External Affairs will be responsible for providing or coordinating necessary escorts. All recordings captured during the visit, including video, audio, and photographs, are subject to review by a Physical Security Specialist.

D. Court Papers:

1. Law enforcement officers, court officials, or other individuals visiting FEMA for the purpose of serving court papers shall be required to remain at the front desk or other applicable point of entry to the FEMA facility in question.

2. The police officer or security guard shall immediately notify FEMA’s Office of Chief Counsel of the individual’s arrival and intent to serve court papers.

3. FEMA’s Office of Chief Counsel will immediately send a representative to the front desk or other applicable point of entry to handle service of the court papers, as appropriate.

E. Deliveries:

Any material delivery to a FEMA facility will be made at the designated receiving location unless an alternate receiving location is authorized by the on-site security officer or responsible Regional Security Officer.

F. Modifications:

1. Facility access requirements may change with little or no notice based on changes to the prevailing threat level.

2. Facilities without an electronic PACS may use other physical access control measures upon written approval of the CSO.

3. At Regional Offices and disaster facilities, certain standard access controls may be modified for a limited time by the Regional Security Officers or security officers when necessary to support or accommodate compelling operational disaster requirements. Such modifications, with justification, require notice to and concurrence of the CSO.

4. Individual facilities may, with the concurrence with the Office of the Chief Security Officer may implement a Facility Access SOP that allows for special measures for access to that facility with submission and approval by the CSO.

G. Foreign Nationals:

1. Visit requests for foreign nationals must be coordinated with FEMA

International Affairs (FEMA-International@fema.dhs.gov). FEMA International Affairs will in turn coordinate the foreign national visit with FEMA OCSO (FEMA-OCSO-ForeignTVC@fema.dhs.gov). Foreign National visit requests must be pre-approved by FEMA OCSO prior to access to any FEMA facility.

2. Due to the approval process, visitor requests for foreign nationals are submitted as soon as possible upon notification of an upcoming visit or no later than 25 business days prior to the visit. FEMA International Affairs Division.

3. Foreign national visitors will be escorted at all times while inside any FEMA facility.

H. Weapons Policy:

1. Law enforcement officers having law enforcement jurisdiction within

FEMA-controlled space and acting within the official exercise of that law enforcement jurisdiction may retain possession of their government-issued firearms within FEMA facilities.

2. For all FEMA facilities other than the Mount Weather Emergency Operations Center (MWEOC) and the National Emergency Training Center (NETC), and CDP upon proper display and verification of law enforcement credentials, and the approval from the OCSO Physical

Security Branch or their authorized security representative, law enforcement officers may enter FEMA facilities with, and retain custody of, their government-issued firearms and other government-issued weapons while on official business.

3. Under 44 C.F.R. § 15.15, no person entering or while at the MWEOC or the NETC may carry or possess firearms, other dangerous or deadly weapons, explosives, or items intended to be used or that could reasonably be used to fabricate an explosive or incendiary device, either openly or concealed, except:

a. For official purposes, if the FEMA Administrator, the MWEOC

Executive Director (for cases involving MWEOC), the Administrator for the United States Fire Administration (for cases involving NETC), or their respective designee, approves; and

b. In accordance with FEMA policy governing the possession of firearms.

4. For all FEMA facilities other than the Mount Weather Emergency

Operations Center (MWEOC) and the National Emergency Training Center (NETC), upon proper display and verification of law enforcement credentials, and the approval from the OCSO Physical Security Branch or their authorized security representative, law enforcement officers may enter FEMA facilities with, and retain custody of, their government-issued firearms and other government-issued weapons while on official business.

5. No personal firearms or other dangerous weapons are allowed in any FEMA facility or space, and FEMA employees, detailees, and contractors shall not carry personal firearms or other dangerous weapons while on duty.

IX. No Private Right This directive is intended only to improve the internal management of FEMA and is not intended to, and does not, create any right to administrative or judicial review, or any other right or benefit, substantive or procedural, enforceable by a party against the United States, its agencies or instrumentalities, its officers or employees, or any other person.

X. Forms Prescribed FEMA Form 121-3-1-3, Facility Access Request.

XI. Responsible Office Office of the Chief Security Officer