RFI Attachment 2 FAA Order 1600.69D.pdf

Distribution: Electronic Initiated By: AXF-110

U.S. DEPARTMENT OF TRANSPORTATION

FEDERAL AVIATION ADMINISTRATION

ORDER

1600.69D

National Policy Effective date:

09/26/23

SUBJ: FAA Facility Security Management Program

This order prescribes the Federal Aviation Administration’s (FAA) Facility Security Management Program (FSMP). This directive establishes facility security policy, delegates authority, assigns responsibilities, and mandates security requirements at facilities for which the FAA is responsible for security oversight. Unless otherwise explicitly provided, this order establishes requirements for all FAA personnel, which includes FAA employees, FAA contractors, and non-employees as defined in FAA Order 1600.1, Personnel Security Program, regardless of their assigned duty location.

Kathryn B. Thomson Deputy Administrator

09/26/23 1600.69D

FOR OFFICIAL USE ONLY

(Public availability to be determined under 5 USC 552) ii

Table of Contents Chapter 1. General Information

1-1. Purpose of This Order

1-2. Audience

1-3. Where Can I Find This Order?

1-4. Cancellation

1-5. Related Publications and References

1-6. Definitions

1-7. Acronyms

1-8. Authority to Change This Order

1-9. Explanation of Policy Changes

1-10. Background

1-11. Scope of This Order

Chapter 2. Roles and Responsibilities

2-1. FAA Lines of Business (LOBs), Staff Offices (SOs), and Office of the Administrator, (AOA)

2-2. Associate Administrator for Security and Hazardous Materials Safety, ASH-1

2-3. Director, Office of Infrastructure Protection, AXF-1

2-4. Director, Office of National Security Programs and Incident Response, AXE-1

2-5. Director, Office of Investigations and Professional Responsibility, AXI-1

2-6. Office of the Chief Counsel (AGC)

2-7. Office of Government and Industry Affairs (AGI)

2-8. Office of International Affairs (API)

2-9. Chief Operating Officer, AJO-0

2-10. Director, Air Traffic Control Facilities & Engineering Services, AJW-2

2-11. Facility Manager (FM)

2-12. Office of Finance and Management (AFN), Acquisition and Business Services (ACQ), Aviation Property Management (APM)

2-13. Service Area/Regional Program and Project Managers of New Facility Construction, Existing Facility Modification, or New Leases

2-14. FAA Personnel

2-15. Owners of FAA Systems Installed at FAA Facilities

Chapter 3. Facility Security Management Program Overview

3-1. Purpose iii

3-2. Facility Categories

3-3. Assigning a Facility Security Level (FSL)

3-4. Establishing Security Countermeasures

3-5. Facility Security Assessments

3-6. Risk Assessment, Management, and Acceptance

3-7. Security Design for New Construction, Renovation, and/or Leased Spaces

3-8. Facility Security Information

Chapter 4. Facility Security Countermeasures

4-1. Purpose

4-2. Using the Baseline LOP Templates

4-3. Unique Facilities

4-4. Temporary, Mobile, and Modular Assets or Facilities

4-5. SSE Security System Verification and Approval

Section 1. Site Security Countermeasures

4-1-1. Countermeasure Matrix

4-1-2. Identification as a Federal Facility

4-1-3. Landscaping

4-1-4. Pedestrian Access to Site

4-1-5. Vehicle Access Points

4-1-6. Site Lighting

4-1-7. Restricted Areas and Significant Areas and Assets

4-1-8. Signage – Sensitive Areas

4-1-9. Control of Parking

4-1-10. Authorized Parking

4-1-11. Vehicle Access to Controlled Parking

4-1-12. Vehicle Barriers

4-1-13. Vehicle Screening

4-1-14. Pedestrian Access to Controlled Parking Areas

4-1-15. Hazardous Materials (HAZMAT) Storage

4-1-16. Receptacle and Container Placement

Section 2. Structure Security Countermeasures

4-2-1. Countermeasure Matrix

4-2-2. Blast Resistance – Windows iv

4-2-3. Blast Resistance – Façade and Structure

4-2-4. Blast Resistance – Progressive Collapse

4-2-5. Blast Resistance – Under-Building Parking

4-2-6. Burglary Resistance of Windows

4-2-7. Walls and Non-window Openings

4-2-8. Windows in Critical Areas – Ballistic Protection

4-2-9. Protection of Air Intakes

4-2-10. Isolated Ventilation Systems

4-2-11. Heating, Ventilating, and Air Conditioning (HVAC) Control

4-2-12. CBR Detection Technology

4-2-13. Biological Filtration – General Building

4-2-14. Biological Filtration – Lobbies and Mailrooms

4-2-15. Chemical Filtration

4-2-16. Security of Ventilation Equipment and Controls

4-2-17. Location of Utilities and Feeders

4-2-18. Separation of Emergency and Normal Power Distribution

4-2-19. Emergency Generator Protection

4-2-20. Protection of Water Supply

Section 3. Facility Entrance Countermeasures

4-3-1. Countermeasure Matrix

4-3-2. Badge Identification System

4-3-3. Regulatory Signage

4-3-4. Employee Access Control

4-3-5. Visitor Access Control

4-3-6. Occupant Screening

4-3-7. Visitor Screening

4-3-8. Ballistic Protection at Screening Locations

4-3-9. Lobby Queuing

4-3-10. After-Hours Access Control

4-3-11. Limit Building Entry Points

4-3-12. Entrance Co-Location

4-3-13. Perimeter Doors and Door Locks

4-3-14. Control of Keys and Access Media v

4-3-15. Employee Convenience Doors

4-3-16. Emergency Exit Doors

4-3-17. Delayed Egress

Section 4. Interior Security Countermeasures

4-4-1. Countermeasure Matrix

4-4-2. Space Planning

4-4-3. Access to Non-public Areas

4-4-4. Security of Critical Areas

4-4-5. Building Systems and Roof Access

4-4-6. Publicly Accessible Restrooms

4-4-7. Publicly Accessible Retail and Mixed-use Space

4-4-8. Blast Resistance – Interior Public Spaces

4-4-9. Blast Resistance – Mail Screening and Receiving Location

4-4-10. Interior Windows

Section 5. Security Systems Countermeasures

4-5-1. Countermeasure Matrix

4-5-2. Video Surveillance System (VSS) Coverage

4-5-3. VSS Monitoring and Recording

4-5-4. Security Control Center

4-5-5. VSS Surveillance Advisory

4-5-6. Intrusion Detection System (IDS) Coverage

4-5-7. IDS Monitoring

4-5-8. Duress Alarms or Assistance Stations

4-5-9. Security System Integrity

4-5-10. Security Communications

4-5-11. Building Communication System

4-5-12. Emergency Power for Security Systems

4-5-13. Security System Testing

4-5-14. Security System Maintenance

Section 6. Security Operations and Administration Countermeasures

4-6-1. Countermeasure Matrix

4-6-2. Facility Security Committee (FSC)

4-6-3. Facility Security Committee (FSC) Chairperson vi

4-6-4. Security Operations Management

4-6-5. Security Force Fixed Post – Exterior

4-6-6. Security Force Fixed Post – Screening Checkpoint

4-6-7. Security Force Patrols

4-6-8. Security Force Response

4-6-9. Facility Security Plan (FSP)

4-6-10. Occupant Emergency Plan (OEP)

4-6-11. Availability of Emergency Plans and Documentation

4-6-12. Protection of Construction Information

4-6-13. Security during Construction and Renovation

4-6-14. Mail/Package Handling and Other Deliveries

4-6-15. Security Awareness Training

Section 7. Facility Cybersecurity Countermeasures

4-7-1. Countermeasure Matrix

4-7-2. Identify and Define Building Access and Control Systems (BACS) Devices and Networks

4-7-3. Segment BACS from Business Networks; Control Access to Devices and Networks. . 50

4-7-4. Establish and Maintain BACS Configuration Management

4-7-5. Maintain BACS Infrastructure

4-7-6. Ensure the Integrity and Availability of BACS Operational Data

4-7-7. Identify and Manage Access Points for Network Communications, Removable Media, Messaging Services, and Internet Access for BACS

4-7-8. Establish Processes for Incident Response for BACS

Chapter 5. Contract Security Officers

5-1. Purpose

5-2. CSO Functions and Staffing

5-3. Selecting a CSO Provider

5-4. CSO Standards

5-5. Contract Security Services Oversight

5-6. CSO Operations

Appendix A. Related Publications and References .................................................................... A-1

Appendix B. Construction Standards for Open Storage Secure Areas ....................................... B-1

B-1. Open Storage Secure Area. ............................................................................................. B-1

B-2. General Construction Requirements. .............................................................................. B-1 vii

B-3. Emergency Notification Systems Criteria. ..................................................................... B-4

B-4. Intrusion Detection Systems (IDS) Criteria. ................................................................... B-4

B-5. Physical Access Control System (PACS) Criteria. ......................................................... B-6

B-6. Acoustical Security. ........................................................................................................ B-7

Appendix C. Security Requirements for Flight Standards District Offices (FSDO) .................. C-1

C-1. Purpose. ........................................................................................................................... C-1

C-2. Adjusted Security Countermeasures. .............................................................................. C-1

C-3. Blast Resistance – Windows. .......................................................................................... C-1

C-4. Security of Critical Areas. ............................................................................................... C-1

C-5. VSS Coverage. ................................................................................................................ C-1

C-6. Duress Alarms or Assistance Stations. ........................................................................... C-1

Appendix D. Security Requirements for Child Care Centers (CCC) ......................................... D-1

D-1. Purpose. .......................................................................................................................... D-1

D-2. Security Countermeasures. ............................................................................................. D-1

D-3. Perimeter Doors and Door Locks. .................................................................................. D-1

D-4. Security of Critical Areas. .............................................................................................. D-1

D-5. VSS Monitoring and Recording. .................................................................................... D-1

Appendix E. Security Requirements for the MMAC and WJHTC ............................................. E-1

E-1. Purpose. ............................................................................................................................ E-1

E-2. Comprehensive Assessments. .......................................................................................... E-1

E-3. Adjusted Security Countermeasures ................................................................................ E-1

E-4. Pedestrian Access to Site ................................................................................................. E-1

E-5. Site Lighting. .................................................................................................................... E-1

E-6. Vehicle Access to Controlled Parking ............................................................................. E-2

E-7. Blast Resistance – Façade and Structure .......................................................................... E-2

E-8. Visitor Access Control. .................................................................................................... E-2

E-9. Video Surveillance System (VSS) Coverage. .................................................................. E-2

E-10. Security Force Fixed Post – Exterior. ............................................................................ E-2

E-11. Security of Critical Areas ............................................................................................... E-3

Appendix F. Security Requirements for Air Route Surveillance RADAR Joint Surveillance System (ARSR-JSS) Facilities with COMSEC and Common ARSR (CARSR) Facilities......... F-1

F-1. Purpose ............................................................................................................................. F-1

F-2. Adjusted Security Countermeasures ................................................................................ F-1 viii

F-3. Restricted Areas and Significant Areas and Assets .......................................................... F-1

F.4. Vehicle Access Points ....................................................................................................... F-2

F-5. Burglary Resistance of Windows ..................................................................................... F-2

F-6. Employee Access Control ................................................................................................ F-2

F-7. Visitor Access Control ..................................................................................................... F-2

F-8. Perimeter Doors and Door Locks ..................................................................................... F-2

F-9. VSS Coverage .................................................................................................................. F-2

F-10. Intrusion Detection System (IDS) Coverage .................................................................. F-2

F-11. IDS Monitoring .............................................................................................................. F-3

F-12. Security Operations Management .................................................................................. F-3

F-13. Facility Security Plan (FSP) ........................................................................................... F-3

Appendix G. Security Requirements for Sponsor-Owned or Sponsor-Leased Federal Contract Towers (FCT).............................................................................................................................. G-1

G-1. Purpose ........................................................................................................................... G-1

G-2. Adjusted Security Countermeasures ............................................................................... G-1

G-3. Identification of a Federal Facility ................................................................................. G-1

G-4. Pedestrian Access to Site ................................................................................................ G-1

G-5. Regulatory Signage ......................................................................................................... G-1

G-6. Employee Access Control. .............................................................................................. G-1

G-7. Visitor Access Controls .................................................................................................. G-1

G-8. Facility Security Plan (FSP) ........................................................................................... G-1

G-9. Occupant Emergency Plan (OEP) .................................................................................. G-2

G-10. Availability of Emergency Plans and Documentation .................................................. G-2

G-11. Protection of Construction Information ........................................................................ G-2

Appendix H. Security Requirements for Mobile Asset Deployment Centers (MADC) ............. H-1

H-1. Purpose ........................................................................................................................... H-1

H-2. Adjusted Security Countermeasures ............................................................................... H-1

H-3. Video Surveillance System (VSS) Coverage ................................................................. H-1

H-4. Facility Security Plan (FSP) ........................................................................................... H-1

Appendix I. Definitions ................................................................................................................ I-1

Appendix J. Frequently Used Acronyms ..................................................................................... J-1 ix

List of Tables Table Page 3-1. Typical Facility Security Level Assignments 9 4-1. Non-Standard FAA Facilities 14 4-1-1. Facility Site Security Countermeasures 16 4-1-2. FAA Security Illumination 18 4-2-1. Structure Security Countermeasures 21 4-3-1. Facility Entrance Security Countermeasures 25 4-3-2. FAA Signage Available from FAA Depot 28 4-4-1. Interior Security Countermeasures 38 4-5-1. Security Systems Countermeasures 40 4-6-1. Security Operations and Administration Countermeasures 44 4-6-2. Security Checkpoint Functions and Equipment 45 4-6-3. Sample FSP Contents 45 4-6-4. Initial and Annual Local Security Awareness Briefing Topics 49 4-7-1. Cybersecurity Countermeasures 50 5-1. Initial and Recurring CSO Training Requirements 54 5-2. CSO Uniforms and Equipment 56 5-3. CSO Medical Standards 57 5-4. Cutoff Levels for Drug Tests 57 5-5. CSO On-site Records 59 C-1. Adjusted Security Countermeasures for FSDOs C-1 D-1. Security Countermeasures for CCCs D-1 E-1. Adjusted Security Countermeasures for MMAC and JHTC E-1 F-1. Adjusted Security Countermeasures for ARSR-JSS/CARSR Facilities F-1 G-1. Adjusted Security Countermeasures for Sponsor-Owned/Leased FCTs G-1 H-1. Adjusted Security Countermeasures for MADCs H-1

Chapter 1. General Information

1-1. Purpose of This Order. This order defines the Facility Security Management Program (FSMP) in accordance with FAA Order 1600.6E, Facility Security Policy. The FSMP establishes security requirements at facilities for which the FAA is responsible for security oversight, as described in chapters 3 and 4 of this order.

1-2. Audience. Unless otherwise explicitly provided, this order establishes requirements for all FAA personnel (as defined in Appendix I), regardless of their assigned duty location.

1-3. Where Can I Find This Order? This order can be found on the FAA internal Orders & Notices website: https://employees.faa.gov/tools_resources/orders_notices/.

1-4. Cancellation. This order cancels FAA Order 1600.69C, Facility Security Management Program (FSMP), dated August 22, 2016, and any Office of Infrastructure Protection (AXF) Technical Guidance Memorandums that precede the published date of this order.

1-5. Related Publications and References. Some related publications and references are listed in Appendix A of this order.

1-6. Definitions. Definitions are listed in Appendix I.

1-7. Acronyms. Frequently used acronyms are listed in Appendix J.

1-8. Authority to Change This Order. The Associate Administrator for Security and Hazardous Materials Safety, ASH-1, may issue changes to this order as necessary to ensure that its provisions remain current with applicable Interagency Security Committee (ISC) standards and policies, as well as other applicable national and departmental facility security policies.

1-9. Explanation of Policy Changes. This policy is a complete revision of the prior order. It has been updated as follows to reflect changes to national and department-level policies and organizational changes within the FAA:

a. Implements the FAA’s Facility Security Risk Management Process (RMP) pursuant to the 2021 edition of “The Risk Management Process: An Interagency Security Committee Standard” or any successor document.

b. Eliminates security accreditation and replaces it with risk mitigation or risk acceptance by the Line of Business (LOB) and Staff Offices (SO) for facilities they control.

c. Implements facility security scoring methodology to allow FAA leadership to make informed decisions about risk associated with facilities they control.

https://employees.faa.gov/tools_resources/orders_notices/

d. Updates facility security levels (FSLs) and associated security countermeasures that mitigate security risks for FAA-staffed facilities.

1-10. Background. Executive Order 12977, Interagency Security Committee, established the ISC and charged that committee with the authority to develop and evaluate standards for federal facilities. These published ISC standards are used to identify and implement security requirements for FAA-staffed facilities. This order provides the mechanism for assessment, implementation, and oversight of those ISC standards for FAA facilities. Additionally, Presidential Policy Directive (PPD) 21, Critical Infrastructure Security and Resilience, states that “All Federal department and agency heads are responsible for the identification, prioritization, assessment, remediation, and security of their respective internal critical infrastructure (CI) that support primary mission essential functions.” This order is consistent with that directive and, using the ISC risk management criteria, establishes the level of protection (LOP) needed to mitigate known and evaluated risks for each CI facility (see paragraph 3-2).

1-11. Scope of This Order. This order applies to all staffed facilities for which the FAA is responsible for security oversight. This order also applies to all personnel permanently or temporarily assigned to work in or on FAA-owned or leased properties or properties utilized by the FAA that are owned, leased, security-controlled, or staffed by the General Services Administration (GSA) or others (e.g., other agencies, public or private entities) in the United States and its territories unless otherwise provided. Unstaffed Common Air Route Surveillance RADAR (CARSR) and Air Route Surveillance RADAR/Joint Surveillance Systems (ARSR- 4/JSS) fall under the scope of this order. All other unstaffed facilities do not fall under the scope of this order and are managed by the Unstaffed Infrastructure Sustainment (UIS) Program, AJW-

24. However, many of the general security principles outlined in this order can be applied to unstaffed facilities, and ASH can assist AJW-24 in determining security requirements and conducting security assessments as requested. FAA overseas facilities follow U.S. Department of State (DOS) security directives and procedures. Domestic Servicing Security Elements (SSEs) may provide support on physical security issues at FAA organizations overseas, provided the overseas facility submits to ASH-1, in writing, a description of the support being sought and all relevant documentation to support the request. In all cases, requests must have ASH-1 approval and must be coordinated with the DOS, Bureau of Diplomatic Security. Any conflicting guidance contained in this order and any other applicable DOT/FAA order or directive must be referred to the Director, Office of Infrastructure Protection, AXF-1, through the ASH SSE. AXF- 1, in coordination with the Office of the Chief Counsel (AGC), will resolve any conflicting guidance. Questions regarding what agency and office is responsible for the security of a particular facility or FAA office should be referred to AXF.

Chapter 2. Roles and Responsibilities

2-1. FAA Lines of Business (LOBs), Staff Offices (SOs), and Office of the Administrator

(AOA).

a. The Administrator is the final authority for carrying out all functions, powers, and duties of the Agency relating to the acquisition and maintenance of property, services, and equipment of the Agency; and the promulgation of regulations, orders, advisory circulars, bulletins, and other official publications of the Agency, except as otherwise provided by applicable law.

b. The Administrator, Deputy Administrator; Chief Operating Officer of the Air Traffic Organization; Chief Counsel; Associate and Assistant Administrators; Senior Vice Presidents and Vice Presidents; Service Area Directors; Regional Administrators; the Directors of the Mike Monroney Aeronautical Center (MMAC) and William J. Hughes Technical Center (WJHTC);

Office Directors; and managers at all levels must ensure that the contents of this order are effectively communicated, adhered to, and implemented within their organization(s).

c. Managers and their staff having responsibility for conceptual development and planning for programs, projects, operations, systems, and facility construction; modification; or leasing must coordinate with their assigned SSE to ensure the implementation of this order.

2-2. Associate Administrator for Security and Hazardous Materials Safety, ASH-1.

a. Exercises overall responsibility and authority for the implementation of the FSMP on behalf of the Administrator;

b. Ensures that policies, procedures, and standards for the FSMP are planned, developed, and implemented throughout the agency;

c. Coordinates with and supports the LOBs/SOs and other organizations as necessary to protect FAA facilities;

d. Through scheduled and unscheduled assessments, monitors the FSMP on behalf of the Administrator to ensure that each LOB/SO develops and implements comprehensive security policies and procedures for its facilities;

e. Ensures that appropriate resources are obtained and budgets planned as needed for the execution and management of the FSMP; and

f. Coordinates with affected LOBs and SOs and issues changes to this order as necessary to meet changing security requirements.

2-3. Director, Office of Infrastructure Protection, AXF-1.

a. Executes centralized governance over the FSMP across the agency on behalf of ASH-1;

b. Ensures that security measures are identified that support facility security risk mitigation;

c. Issues policy updates and clarification affecting the implementation of this order in coordination with ASH-1, AGC, and interested LOBs/SOs as appropriate;

d. Ensures that facility security assessments are planned and conducted as required and that identified security risks are reported to facility managers and the LOBs/SOs owning or operating the facility;

e. Evaluates and grants or denies requests to either add or remove countermeasures that adjust the baseline level of protection (LOP) criteria at specific facilities;

f. Partners with the Facility Security Team (FST) (formerly known as the Facility Security Risk Management (FSRM) program, managed by the Air Traffic Organization (ATO)) consistent with FAA Order 1600.6E, to support program requirements for investment decisions;

g. Oversees and develops program-related training in conjunction with the Director, ASH Office of Business and Mission Services, AXM-1;

h. Resolves conflicts, in coordination with AGC, between this order and other published national, departmental, or agency policy;

i. Evaluates changes to a facility’s security level and corresponding security measures;

j. Administers the agency’s International Visitor Program in coordination with the Office of International Affairs (API); and

k. Provides onsite security awareness briefings/training as resources allow.

2-4. Director, Office of National Security Programs and Incident Response, AXE-1. AXI-1 coordinates with federal law enforcement and intelligence agencies on national security matters and advises AXF-1 of any nexus to facility security operations.

2-5. Director, Office of Investigations and Professional Responsibility, AXI-1. AXI-1 notifies AXF-1 of any insider threat activities, or information developed during agency checks conducted in support of foreign visit requests, that raises threat concerns for facility security operations.

2-6. Office of the Chief Counsel (AGC).

a. Reviews all real property transactions that meet the requirements of the Acquisition Management System (AMS) Real Estate Policy 3.14.5 to ensure compliance with applicable law, policy, and the terms of this order;

b. Interprets applicable law and policy and advises agency decision-makers regarding compliance with applicable law and policy including the terms of this order; and

c. Coordinates with AXF-1 to resolve conflicts between this order and other published national, departmental, or agency policy.

2-7. Office of Government and Industry Affairs (AGI). AGI provides guidance on visits by congressional and high-profile government officials.

2-8. Office of International Affairs (API). API coordinates all visits by foreign nationals to FAA facilities and ensures completion of the visit requests through the International Visitors Program (IVP).

2-9. Chief Operating Officer, Air Traffic Organization, AJO-0.

a. Determines the criticality of ATO facilities in accordance with National Airspace System (NAS) operational requirements and provides that information to ASH;

b. Oversees the FST and provides resources necessary to acquire and implement required physical security countermeasures for facilities that fall under the responsibility of the FST Program; and

c. Identifies and assigns resources as needed for the implementation of and compliance with the requirements of this order.

2-10. Director, Air Traffic Control Facilities & Engineering Services, AJW-2.

a. Manages and implements the FST Program on behalf of ATO; and

b. Identifies and investigates technology changes that may improve or enhance facility security or result in cost savings without diminishing facility security.

2-11. Facility Manager (FM). The FM is the highest-ranking resident manager (or as otherwise identified by the owning LOB or SO) in an FAA-owned or leased facility. When there is no resident manager, it will be the manager(s) having responsibility for facility operations and/or maintenance. The FM implements the FSMP at their assigned facility as described throughout this order. Most importantly, FMs will:

a. To the extent possible, mitigates security vulnerabilities identified during facility security assessments or other evaluations;

b. Requests resources outside the scope of the FST Program as necessary to fully implement the provisions of this order;

c. Where applicable, reports inoperable, malfunctioning or deteriorating security fixtures, equipment, or systems to the Corrective Maintenance Contractor (CMC);

d. Reports on the status of open security findings after a security assessment is conducted at the facility or when requested by the SSE;

e. Includes the appropriate SSE, throughout the entire process, in facility security planning and implementing facility security policies or procedures; and

f. Conducts periodic security meetings with essential staff, as needed.

2-12. Office of Finance and Management (AFN), Acquisition and Business Services (ACQ), Aviation Property Management (APM).

a. Notifies the SSE of all new lease agreements, modifications to lease agreements, and required site surveys as early as possible so that security requirements are included in construction planning and lease transactions; and

b. Includes the SSE as a member, throughout the entire process, of any planning or design group for new facilities, major renovations or modifications to existing facilities, and FAA leases.

2-13. Service Area/Regional Program and Project Managers of New Facility Construction, Existing Facility Modification, or New Leases. Program and Project Managers must coordinate with the SSE during all phases of facility planning and design and lease negotiations to ensure that facilities meet the standards and requirements of this order prior to FAA acceptance, lease, or occupancy.

2-14. FAA Personnel.

a. Comply with the requirements of this order;

b. Report security incidents upon discovery to their manager (contractors will report to the Alternate Technical Representative (ATR), Contracting Officer’s Representative (COR), or Contracting Officer (CO)) or the next available manager in their chain of command. Managers must notify the responsible FM or SSE as stipulated in paragraph 4-6-9;

c. Report non-functional security equipment to their manager (contractors will report to the ATR, COR, or CO) or the next available manager in their chain of command. Supervisors must notify the responsible FM or SSE; and

d. Wear U.S. Government-issued ID Media in accordance with this order and FAA Order 1600.78, Personal Identity Verification (PIV) and Other Identification (ID) Cards;

2-15. Owners of FAA Systems Installed at FAA Facilities. The FAA system owners of systems installed, in full or in part, at FAA facilities must coordinate with ASH to ensure their systems receive the FSMP countermeasures to satisfy FAA Order 1370.121, FAA Information Security and Privacy Policy, requirements for which ASH is the common control provider.

Chapter 3. Facility Security Management Program Overview

3-1. Purpose. This chapter provides requirements for planning and implementing the FSMP and the RMP. It details how security countermeasures are developed and assessed and how the FAA mitigates, accepts, or otherwise manages the risks of undesirable events.

3-2. Facility Categories. FAA facilities are grouped into three categories for the purpose of the FSMP: Critical Infrastructure (CI), Administrative, and unstaffed facilities.

a. Critical Infrastructure (CI). Consistent with PPD 21, which makes all federal department and agency heads responsible for the identification, prioritization, assessment, remediation, and security of their respective internal critical infrastructure that supports primary mission essential functions, FAA CI includes those air traffic facilities that provide air navigation services, which enable the operation of the National Airspace System (NAS) or house air navigation service capabilities that contribute to national defense, homeland security, law enforcement, and national response efforts to protect the nation from threats involving the air domain. Those facilities are Air Traffic Control Centers (ARTCCs), Terminal Radar Approach Control Facilities (TRACONs), Airport Traffic Control Towers (ATCTs), Combined ATCT/TRACONs, Center Radar Approach Controls (CERAPs), Air Traffic Control System Command Center (ATCSCC), Common Air Route Surveillance Radars (CARSRs), and Air Route Surveillance Radar (ARSR)/Joint Surveillance Systems (JSSs). Refer to Table 3-1.

b. Administrative Facilities. These facilities, although not designated CI, serve an important support function for the FAA’s CI. FAA administrative facilities include airport certification and compliance, aviation regulatory and safety oversight and certification, as well as those facilities that house workspace for FAA personnel who provide organizational and administrative support to the FAA.

c. Unstaffed Facilities. An unstaffed facility is defined as a facility where no FAA employees or contractors are permanently assigned but may make onsite visits. With some exceptions (see para 1-11), the Unstaffed Infrastructure Sustainment (UIS) Program, AJW-24, is the office of primary responsibility for these facilities. ASH can provide security assessments and assistance with security requirements as requested by AJW-24 and FMs or in response to a history of security incidents or an unusual security situation.

3-3. Assigning a Facility Security Level (FSL). An FSL is the starting point for determining the specific security requirements and countermeasures that will apply to a particular FAA facility.

Because the FAA employs a significant number of single-tenant facilities (FAA-owned and operated), similar facilities that accomplish identical missions in various locations, they have been pre-assigned FSLs by AXF through consultation with the owning organization and are based on the ISC criteria for assigning FSLs, which includes mission criticality, symbolism, population, size, and threats to tenant agencies. For FAA CI, mission criticality factors also include air traffic count level, Core 30 airport support, and resiliency/impact to the NAS. FSLs for multi-tenant facilities are based on ISC criteria and will be made in consultation with the facility tenants, the owning or leasing department or agency, and AXF. These FSLs are summarized in this paragraph for planning purposes; however, the FSL determination matrix, associated worksheets, and supporting documentation for each FAA-staffed facility is maintained in the Facility Security Reporting System (FSRS). Where conflicts exist, the FSLs are contained in FSRS control.

a. Agency Designated FSLs. FAA facilities are typically assigned FSLs as indicated below:

Table 3-1. Typical Facility Security Level Assignments FSL Facility Types FSL 4 • Mike Monroney Aeronautical Center (MMAC)*

• William J. Hughes Technical Center (WJHTC)*

• National Enterprise Management Center (NEMC)

FSL 3 • Air Traffic Control System Command Center (ATCSCC)

• Air Route Traffic Control Centers (ARTCCs)

• Center Radar Approach Control (CERAP)

• Airport Traffic Control Tower (ATCT), Terminal Radar Approach Control Facility (TRACON), and combined ATCT/TRACON operating at air traffic count levels 10 – 12

• Administrative facilities as documented within FSRS (normally large facilities such as Regional

Offices) FSL 2 • TRACONs and combined ATCTs/TRACONs operating at air traffic count levels less than 10

• ATCTs operating at air traffic count levels 7 – 9

• CARSR and ARSR/JSS staffed and unstaffed facilities with or without COMSEC

• RADAR Approach Control

• Mobile Asset Deployment Centers (MADC)

• Administrative facilities as documented within FSRS (normally facilities with medium populations such as FSDOs and AFSS) FSL 1 • ATCTs operating at air traffic count levels 1 – 6 (includes FAA-owned FCTs)

• Administrative facilities as documented with FSRS (normally facilities with small populations, such as Airport District Offices [ADOs], Manufacturing Inspection District Office [MIDOs]/Certificate Management Sections [CMSs], International Field Offices [IFOs], System Support Centers [SSCs], Field Maintenance Programs [FMPs], and System Support Units [SSUs])

FSL 1A • Airport Sponsor-Owned Federal Contract Towers (FCTs)

* MMAC and WJHTC are considered FSL 4 campuses; however, facilities located within each campus carry their own FSLs and are assessed accordingly.

b. Changing an FSL. A change to the evaluated FSL criteria (see paragraph 3-3) may affect the FSL of a particular facility. For FAA single-tenant facilities, changes in FSL are initiated by the SSE, endorsed by the FM, and approved by AXF-1. For multi-tenant facilities, changes in FSL are initiated by the Facility Security Committee (FSC) and endorsed by AXF. An FSL change also affects the determination of the baseline Level of Protection (LOP) (see paragraph 3- 4a). Therefore, the consequences of security investment will be considered and changes to an FSL should be limited to those situations where adjustments to the existing baseline LOP countermeasures would not mitigate the updated facility risk or result in an unnecessary security investment.

3-4. Establishing Security Countermeasures. Once a facility’s FSL is determined, AXF then evaluates the specific likelihood (threat) of an ISC-identified undesirable event (UE) occurring at that facility type and the consequences to the mission and/or the NAS that could result from that event. A UE is an incident (e.g., arson, active shooter, theft, workplace violence) directed toward a federal facility that adversely impacts the operation of the facility, the mission of the agency, or personnel. The ISC’s Design Basis Threat (DBT) document is used in a threat evaluation as there is no agency-specific threat assessment published that exceeds the DBT. If agency-specific assessments become available, or local threat information differs from the DBT and evaluated threat, the LOP can be adjusted to reflect the changed threat. Respective countermeasures that are identified in the ISC RMP, along with any additional FAA-identified countermeasures, are then evaluated to determine the degree they reduce facility vulnerabilities and UE risk levels that were identified by the threat and consequence evaluations.

a. Baseline LOP. Those countermeasures that best mitigate the standard UE risk become the baseline LOP criteria. Baseline LOP templates become the security planning starting point for the facility’s type and security level.

b. Necessary LOP. As an SSE conducts a facility security assessment (see paragraph 3-5), evaluation of local threats may result in adjustments to the baseline LOP to either mitigate an increased risk or, when threats are lower than initially evaluated, reduce or eliminate a countermeasure. When this occurs, the baseline LOP is adjusted to become the “necessary” LOP for that specific facility. These changes are documented by the SSE in FSRS as Based on Evaluation (BOE) measures. BOEs are initiated by the SSE, endorsed by the FM, and approved by AXF-1. If no adjustments are necessary, the baseline LOP is incorporated as the necessary LOP. The continued need for a BOE will be validated by the SSE during each subsequent assessment.

3-5. Facility Security Assessments. There are three types of facility security assessments:

comprehensive, supplemental, and remote security evaluations (RSE). FMs are required to comply with assessment activities.

a. Comprehensive Facility Security Assessments. A comprehensive assessment consists of an on-site examination of the facility and its operations and an evaluation of local threats. The assessment will identify the facility’s current LOP by evaluating any deviations between those security countermeasures in effect at a facility and the necessary LOP. It results in a final determination of facility risk levels, documents the facility’s existing security countermeasures, and makes recommendations to reduce risks where applicable.

(1) Normally, comprehensive assessments are scheduled every 12 months for FSL 4 and 3 facilities, every 24 months for FSL 2 facilities to include all (staffed and unstaffed) CARSR and ARSR/JSS, and every 36-48 months (as scheduled in FSRS) for FSL 1 and FSL 1A facilities. Where separate facilities are considered co-located, they will be assessed simultaneously at the frequency of the highest FSL. Actual schedules are maintained in FSRS.

Comprehensive assessments are not normally conducted for unstaffed facilities, excluding CARSR and ARSR/JSS, unless requested by an LOB/SO because of an unusual security situation.

(2) Prior to the beginning and at the conclusion of a comprehensive assessment, the SSE will brief the FM and facility personnel selected by the FM. During the in-brief the SSE will explain assessment activities, review any unresolved issues from previous assessments, and request any facility documentation required by this order. During the exit-brief the SSE will review the resulting facility risks, discuss any additional mitigation efforts necessary to reduce specific vulnerabilities, and offer assistance with implementing that mitigation.

b. Supplemental Facility Security Assessments. Supplemental assessments are narrower in scope than the comprehensive assessment. They may be scheduled because of frequent or ongoing security issues at a facility, major construction activities, to verify closure of open findings, or as deemed necessary by the SSE. There is no established frequency for supplemental assessments.

c. Remote Security Evaluations (RSEs). RSEs comprise a virtual assessment of the more critical components of a facility’s necessary LOP. SSEs will contact FMs via email, provide a list of targeted security countermeasures, and schedule a time to discuss the countermeasures via telephone or video conversation. RSEs are used to augment comprehensive and supplemental assessments.

d. Assessment Reports. An assessment report will be generated for each type of assessment and will normally be provided to the FM within 45 days of the assessment. The report will summarize assessment activities and provide a table of “findings” and “recommendations” that identify deviations from the necessary LOP. FMs are responsible for taking corrective action to address any “findings” and eliminating deviations from the necessary LOP to the maximum extent possible within the scope of the FM’s authority. “Recommendations” are beyond the scope of the FM to correct and are either planned for future implementation through the FST program or will be considered during major renovations, new or renewed leases, or new construction. The fewer deviations that exist, the lower the facility’s security risk level.

3-6. Risk Assessment, Management, and Acceptance.

a. Risk Assessment Methodology. The FAA uses a risk assessment tool (RAT) within FSRS to evaluate facility risks. The RAT allows the assessor to compare those countermeasures implemented by the facility against the necessary LOP. Each countermeasure is weighted, within FSRS, and generates a vulnerability score for the associated UE. This vulnerability assessment combined with established threat and consequence determinations (see paragraph 3-3) yields a risk determination of the UE and facility.

b. Risk Management. FMs are required to monitor and correct any deviations from the necessary LOP that are within the scope of the FM’s authority. Once corrective action is complete on a recommendation or finding, FMs will notify their SSE to validate and “close” the item within the FSRS database. Recommendations/findings will be noted as closed when the SSE verifies that the required actions have been satisfactorily implemented. Normally, this is done through a supplemental assessment, but it may be accomplished by reviewing documentation (including photographs) provided by the FM. Closing these findings and recommendations further mitigates identified risks. SSEs will review and update the status of open findings at assigned facilities at least semi-annually.

c. Risk Acceptance. Baseline LOPs and their corresponding necessary LOPs, when fully implemented, mitigate facility security risks to an FAA-acceptable level. Deviations, in the form of open “findings” or “recommendations,” may increase a facility’s risk above the established baseline LOP threshold. As such, semi-annual reports are provided through ASH-1 to the heads of the facility-owning LOBs/SOs (ATO-1, AVS-1, APL-1, ANG-1, and ARP-1) that provide current facility security risk assessments of their facilities. These risk assessment reports document the existing deviations from the necessary LOP that affect the facility risk, indicate why the necessary LOP could not be achieved, and provide an explanation of the strategies in place to eliminate or mitigate the deviations and thereby achieve the risk level associated with the necessary LOP. This reporting facilitates either specific action on the part of the owning LOB/SO, consistent with or in addition to the stated strategy, or, in the absence of that, risk acceptance. As deviations across the spectrum of FAA facilities are constantly in flux, AXF maintains current risk and deviation data that can be made available between reporting timelines as requested.

3-7. Security Design for New Construction, Renovation, and/or Leased Spaces. For each new effort, the sponsoring LOB(s) and the logistics organizations, including Real Estate Contracting Officers (RECOs) and Aviation Property Manager (APM), will provide a point of contact (POC) to interface with the SSE throughout the entire process. As necessary, ASH will provide updates to relevant acquisition management system clauses and lease agreement templates. For ATCTs, see also FAA Order 6480.4, ATCT Siting Process, and Order JO 7110.315, Mobile ATCT Siting Criteria (see also paragraph 4-3). The SSE will partner with the project manager and other POCs to determine the required FSL and establish the baseline LOP.

The FSL and LOP will be included in the site design review and become the planning document for the facility security design of these facilities. Where baseline LOP criteria cannot be met, the project documentation must include the associated rationale. The SSE will attend site surveys and conduct site design reviews, contractor acceptance inspections/joint acceptance inspections, and other meetings as necessary. An assessment, based on the site design review, will be conducted once the construction is complete.

a. Lease Renewals. In the case of lease renewals, the SSE will provide the RECO and APM with a risk assessment and any necessary mitigation strategies. Any associated facility security risks that cannot be mitigated or accepted by the occupying LOB will be addressed with the lessor during lease renewal negotiations and may inform a decision to terminate the lease and seek a different facility.

b. Guidelines for Selecting Leased Space. In buildings housing multiple external organizations, avoid separating FAA offices throughout the building. Access to FAA-controlled space will be restricted as identified in chapter 4 of this order. Attempt to obtain leased space with entities having similar security needs. Where possible, do not locate FAA personnel in buildings housing high-risk departments or agencies, i.e., other tenants whose mission and interaction with certain segments of the public are adversarial in nature. Examples of high-risk tenants include criminal and bankruptcy courts and law enforcement agencies (e.g., FBI, ATF, DEA) that routinely attract the attention of dangerous groups.

c. Renovations. When renovations to an existing facility are planned, the previous security assessment must be reviewed to determine if any existing deviations from the necessary LOP can be eliminated with the renovation planned. Mitigating any existing security risks must be included in the facility design to the extent possible.

3-8. Facility Security Information. ASH maintains the Facility Security Reporting System (FSRS) database that stores data related to the FSMP.

Chapter 4. Facility Security Countermeasures

4-1. Purpose. This chapter establishes baseline Level of Protection (LOP) countermeasure templates for staffed facilities based on their facility security level (FSL) and the evaluation of the threats and consequences of undesirable events (UE) as related to the facility’s critical infrastructure (CI) or administrative functions. This chapter also describes the implementation considerations for each countermeasure or FAA-prescribed security measure that is associated with that countermeasure. Funding for identified countermeasures has a variety of sources.

Security system requirements are typically funded through the Facility Risk Management Program administered by ATO/AJW. Security requirements associated with new construction should be included in project funding. Other requirements are provided for through FAA/LOB Operations Accounts.