ARN43787-ATP_3-39.32-001-WEB-2.pdf

CUI

ATP 3-39.32

CUI

Physical Security

MARCH 2022

INCORPORATING CHANGE 1, MAY 2025

Controlled by: United States Army Military Police School Controlled by: Fielded Force Integration Directorate, Doctrine Division CUI Category: Controlled Technical Information Limited Dissemination Control: Federal Control POC: usarmy.leonardwood.mscoe.mbx.mpdoc@mail.mil

DISTRIBUTION RESTRICTION: Distribution authorized to the DOD and DOD contractors only to protect technical or operational information from automatic dissemination under the International Exchange Program or by other means. This determination was made on 2 November 2021. Other requests must be referred to the Commandant, U.S. Army Military Police School, ATTN:

ATZT-CDC, 14000 MSCoE Loop, Suite 270, Fort Leonard Wood, MO 65473-8929.

DESTRUCTION NOTICE: Destroy by any method that will prevent disclosure of contents or reconstruction of the document in accordance with AR 380-5.

This publication supersedes ATP 3-39.32, dated 30 April 2014.

Headquarters, Department of the Army

This publication is available at the Army Publishing Directorate at https://armypubs.army.mil and the Central Army Registry site at https:// atiam.train.army.mil/catalog/dashboard.

https://armypubs.army.mil/ https://atiam.train.army.mil/catalog/dashboard https://armypubs.army.mil/news/rssinstructions.aspx

ATP 3-39.32, C1

Change 1 Army Techniques Publication No. 3-39.32

Headquarters Department of the Army

Washington, DC, 30 May 2025

Physical Security

1. This change corrects the term “gender” to “sex” as required by Executive Order 14168.

2. A plus character ( + ) marks new or changed material.

3. ATP 3-39.32, 30 May 2025, is changed as follows:

Change Version Pages Change Description ___________

Page F-1 Corrects “gender” to “sex” Page F-2 Corrects “gender” to “sex” (four times para F-6)

4. An updated Authentication Page has amended the prior authentication reflected in the rear of this publication.

DISTRIBUTION RESTRICTION: Distribution authorized to the DOD and DOD contractors only to protect technical or operational information from automatic dissemination under the International Exchange Program or by other means. This determination was made on 2 November 2021.

DESTRUCTION NOTICE: Destroy by any method that will prevent disclosure of contents or reconstruction of the document in accordance with AR 380-5.

This page is intentionally left blank.

*ATP 3-39.32

Controlled by: United States Army Military Police School Controlled by: Fielded Force Integration Directorate, Doctrine Division CUI Category: Controlled Technical Information Limited Dissemination Control: Federal Control POC:usarmy.leonardwood.mscoe.mbx.mpdoc@mail.mil i

DISTRIBUTION RESTRICTION: Distribution authorized to the DOD and DOD contractors only to protect technical or operational information from automatic dissemination under the International Exchange Program or by other means. This determination was made on 2 November 2021. Other requests must be referred to the Commandant, U.S. Army Military Police School, ATTN: ATZT-CDC, 14000 MSCoE Loop, Suite 270, Fort Leonard Wood, MO 65473- 8929.

DESTRUCTION NOTICE: Destroy by any method that will prevent disclosure of contents or reconstruction of the document in accordance with AR 380-5.

*This publication supersedes ATP 3-39.32, dated 30 April 2014.

ATP 3-39.32 (INCL C1)

CUI

Army Techniques Publication No. 3-39.32

Headquarters Department of the Army

Washington, D.C., 08 March 2022

(U) Physical Security

(U) Contents Page

(U) PREFACE ....................................................................................................... vii

(U) INTRODUCTION ................................................................................................x

Chapter 1 (U) PHYSICAL SECURITY CHALLENGES ...................................................... 1-1

(U) Physical Security Planning ........................................................................... 1-1

(U) Security Management System (Countermeasures) ..................................... 1-6

(U) Physical Security Survey .............................................................................. 1-7

(U) Physical Security Inspection ......................................................................... 1-8

(U) Physical Security Systems ........................................................................... 1-9

(U) Tactical-Environment Considerations ......................................................... 1-10

(U) Protection Measures For Contractors ........................................................ 1-11

08 March 2022

(U) Contents ii ATP 3-39.32 (INCL C1) 08 March 2022

CUI

Chapter 2 (U) SITE DESIGN APPROACH AND CONSIDERATIONS .............................. 2-1

(U) Initial Design Planning Considerations ......................................................... 2-1

(U) Perimeter Security ........................................................................................ 2-2

(U) Internal Security ............................................................................................ 2-6

Chapter 3 (U) PROTECTIVE BARRIERS ........................................................................... 3-1

(U) Barrier Emplacement Considerations ........................................................... 3-1

(U) Vehicle Barriers ............................................................................................ 3-3

(U) Earth-Filled Barriers ...................................................................................... 3-6

(U) Fences .......................................................................................................... 3-8

(U) Interior Barriers ........................................................................................... 3-12

(U) Inspection and Maintenance ...................................................................... 3-15

Chapter 4 (U) SECURITY LIGHTING ................................................................................. 4-1

(U) Principles ...................................................................................................... 4-1

(U) Planning Considerations .............................................................................. 4-3

(U) Lighting Unit Types (Luminaires) .................................................................. 4-9

(U) Maintenance ............................................................................................... 4-14

(U) Power Sources ........................................................................................... 4-14

(U) Closed Circuit Television and Camera Lighting Considerations ................ 4-15

Chapter 5 (U) ELECTRONIC SECURITY SYSTEM ........................................................... 5-1

(U) Characteristics .............................................................................................. 5-1

(U) Access Control Systems............................................................................... 5-2

(U) Intrusion Detection Systems ......................................................................... 5-4

(U) Closed Circuit Television Systems ............................................................. 5-10

(U) Data Transmission Media ........................................................................... 5-14

(U) Security Control Center .............................................................................. 5-15

Chapter 6 (U) ACCESS CONTROL POINTS ..................................................................... 6-1

(U) Policy and Technical Guidance .................................................................... 6-1

(U) Classifications, Functions, and Zones .......................................................... 6-2

(U) Inspection Procedures .................................................................................. 6-5

Chapter 7 (U) KEY CONTROL AND LOCKING SYSTEMS SECURITY ........................... 7-1

(U) Key Control Officer ....................................................................................... 7-1

(U) Key-and-Lock Custodian .............................................................................. 7-1

(U) Key Register Use .......................................................................................... 7-4

(U) Locking Device Types .................................................................................. 7-4

(U) Installation and Maintenance ...................................................................... 7-11

Chapter 8 (U) SECURITY FORCES ................................................................................... 8-1

(U) Authority and Jurisdiction ............................................................................. 8-1

(U) Security Force Types .................................................................................... 8-2

(U) Military Working Dogs ................................................................................... 8-4

(U) Organization and Employment ..................................................................... 8-5

(U) Plans and Orders .......................................................................................... 8-6

(U) Training Requirements ................................................................................. 8-6

08 March 2022 ATP 3-39.32 (INCL C1) iii

CUI

(U) Personnel Requirements .............................................................................. 8-7 Chapter 9 (U) PHYSICAL SECURITY FOR IN-TRANSIT FORCES .................................. 9-1

(U) Risk Management for Deploying Forces ...................................................... 9-1

(U) Operations Security ...................................................................................... 9-4

(U) Unit Movement Roles and Responsibilities .................................................. 9-5

(U) In-Port Cargo ................................................................................................ 9-6

(U) Rail Cargo ..................................................................................................... 9-9

(U) Air Movements ............................................................................................ 9-11

Chapter 10 (U) RESOURCE MANAGEMENT .................................................................... 10-1

(U) Requirements ............................................................................................. 10-1

(U) Funding Sources ........................................................................................ 10-5

(U) Unfunded Requirements ............................................................................ 10-6

(U) Security Officer Resource Responsibilities ................................................ 10-6

Appendix A (CUI) SAMPLE PHYSICAL SECURITY PLAN.................................................. A-1

Appendix B (U) SAMPLE PHYSICAL SECURITY CHECKLIST .......................................... B-1 Appendix C (U) BOMB THREATS ......................................................................................... C-1 Appendix D (U) KEY CONTROL REGISTER AND INVENTORY FORM ............................. D-1 Appendix E (U) SAMPLE KEY CONTROL AND LOCK SECURITY CHECKLIST .............. E-1 Appendix F (U) SAMPLE BARRACKS PHYSICAL SECURITY PLAN ............................... F-1

(U) GLOSSARY .................................................................................... Glossary-1

(U) REFERENCES ............................................................................ References-1

(U) INDEX .................................................................................................... Index-1

(U) Figures Figure 3-1. (U) Layered security approach ............................................................................. 3-2 Figure 3-2. (U) Jersey barrier ................................................................................................. 3-5 Figure 3-3. (U) Jersey barriers connected with a cable and anchor system .......................... 3-5 Figure 3-4. (U) Active vehicle barriers .................................................................................... 3-6 Figure 3-5. (U) Sandbags employed for blast protection ....................................................... 3-7 Figure 3-6. (U) Container-style barriers .................................................................................. 3-8 Figure 3-7. (U) Soil-backed barrier ......................................................................................... 3-8 Figure 3-8. (U) Single top guard ........................................................................................... 3-10 Figure 3-9. (U) Double top guard.......................................................................................... 3-11 Figure 3-10. (U) Double top guard enhanced with barbed tape ........................................... 3-11 Figure 4-1. (U) Poles and mounts .......................................................................................... 4-9 Figure 4-2. (U) Isolated, semi-isolated, and nonisolated perimeters .................................... 4-13 Figure 5-1. (U) Common infrared-sensor beam patterns ....................................................... 5-5 iv ATP 3-39.32 (INCL C1) 08 March 2022

CUI

Figure 5-2. (U) Typical nonsymmetrical beam pattern ........................................................... 5-7 Figure 5-3. (U) Typical monostatic microwave sensor detection pattern ............................... 5-7 Figure 5-4. (U) Typical ported coax cable detection pattern .................................................. 5-8 Figure 5-5. (U) Typical detection patterns for a passive infrared motion detector ............... 5-10 Figure 5-6. (U) CCTV system configuration ......................................................................... 5-11 Figure 6-1. (U) Serpentine pattern road alignment................................................................. 6-4 Figure 6-2. (U) Visitor/DOD personnel ECF/ACP–functional relationships ............................ 6-8 Figure 7-1. (U) Cylindrical lockset .......................................................................................... 7-5 Figure 7-2. (U) Tubular dead bolt ........................................................................................... 7-6 Figure 7-3. (U) Single- and double-cylinder dead bolt ........................................................... 7-6 Figure 7-4. (U) Mortise lock .................................................................................................... 7-7 Figure 7-5. (U) Drop bolt lock ................................................................................................. 7-7 Figure 7-6. (U) Rim cylinder lock ............................................................................................ 7-8 Figure 7-7. (U) Mechanical, push-button combination lock .................................................... 7-8 Figure 7-8. (U) Low-security padlocks .................................................................................... 7-9 Figure 7-9. (U) High-security padlock ..................................................................................... 7-9 Figure 7-10. (U) Internal locking device ............................................................................... 7-10 Figure 7-11. (U) Lock core and cylinder ............................................................................... 7-10 Figure 7-12. (U) Combination locks ...................................................................................... 7-11 Figure 9-1. (U) Risk management process ............................................................................ 9-2 Figure 9-2. (U) Notional aerial port of embarkation .............................................................. 9-12 Figure C-1. (U) Sample bomb threat data card ..................................................................... C-4 Figure D-1. (U) Sample DA Form 5513 ................................................................................. D-1

(U) Tables Table 3-1. (U) Protective barrier functions and examples ...................................................... 3-3 Table 3-2. (U) Selected permanent facility barrier materials ................................................ 3-13 Table 3-3. (U) Selected expedient facility barrier materials ................................................. 3-14 Table 4-1. (U) Lux and foot-candle values ............................................................................. 4-4 Table 4-2. (U) Lamp chromaticity and color rendition ............................................................ 4-7 Table 4-3. (U) Efficacies of basic lamp families ..................................................................... 4-8 Table 4-4. (U) Warm-up and restrike times for lamp families ................................................. 4-9 Table 4-5. (U) Luminaire use and light coverage ................................................................. 4-10 Table 6-1. (U) ACP use classifications ................................................................................... 6-2 Table 6-2. (U) Separation distance for barriers to reduce speed on a straight path .............. 6-4 Table 8-1. (U) Fence effects on MWD teams ......................................................................... 8-5 Table 9-1. (U) Risk assessment matrix .................................................................................. 9-3

08 March 2022 ATP 3-39.32 (INCL C1) v

CUI

Table B-1. (U) Sample physical security checklist .................................................................B-1 Table E-1. (U) Sample key control and lock security checklist ..............................................E-1

08 March 2022 ATP 3-39.32 (INCL C1) vii

CUI

(U) Preface

(U) ATP 3-39.32 provides doctrinal guidance for personnel responsible for planning and executing physical security programs. It is the basic reference for training security personnel, and it is intended to be used in conjunction with the AR 190 series (AR 190-5, AR 190-6, AR 190-8, AR 190-9, AR 190-11, AR 190-12, AR 190-13, AR 190-14, AR 190-17, AR 190-24, AR 190-30, AR 190-45, AR 190-47, AR 190-48, AR 190-51, AR 190-53, AR 190-54, AR 190-55, AR 190-56, AR 190-58, and AR 190-59), security engineering unified facilities criteria publications, Department of Defense (DOD) directives, and other Department of the Army publications.

Prevention and protection are the two primary concerns of physical security. Prevention and protection serve the security interests of people, equipment, and property. This publication establishes physical security as a supporting component of the protection warfighting function and describes defensive measures that enable protection tasks (operations security, antiterrorism, area security, survivability, and information protection).

(U) The principal audience for ATP 3-39.32 is commanders and staff elements at all echelons and military police personnel tasked with planning, directing, and implementing physical security measures. Educators will use this manual for training throughout the Army.

(U) Commanders, staffs, and subordinates ensure that their decisions and actions comply with applicable United States, international, and in some cases and host-nation laws and regulations. Commanders at all levels ensure that their Soldiers operate in accordance with the law of war and the rules of engagement. (See FM 6-27.)

(U) ATP 3-39.32 uses joint terms where applicable. Selected joint and Army terms and definitions appear in both the glossary and the text. Terms for which ATP 3-39.32 is the proponent publication (the authority) are italicized in the text and are marked with an asterisk (*) in the glossary. Terms and definitions for which ATP 3-39.32 is the proponent publication are boldfaced in the text. Terms are italicized for other definitions shown in the text, and the number of the proponent publication follows the definition.

(U) ATP 3-39.32 applies to Active Army, Army National Guard/Army National Guard of the United States and United States Army Reserve unless otherwise stated.

(U) The proponent of ATP 3-39.32 is the United States Army Military Police School. The preparing agency is the United States Army Maneuver Support Center of Excellence (MSCoE), Fielded Force Integration Directorate, Doctrine Division. Send comments and recommendations on DA Form 2028 (Recommended Changes to Publications and Blank Forms) to Commander, MSCoE, ATTN: ATZT-FFD, 14000 MSCoE Loop, Suite 270, Fort Leonard Wood, MO 65473-8929; e-mail the DA Form 2028 to usarmy.leonardwood.mscoe.mbx.cdidcodddmpdoc@mail.mil; or submit an electronic DA Form 2028.

08 March 2022 ATP 3-39.32 (INCL C1) x

CUI

(U) Introduction

(U) Physical security is that part of security concerned with physical measures designed to safeguard personnel;

to prevent unauthorized access to equipment, installations, material, and documents; and to safeguard them against espionage, sabotage, damage, and theft. (JP 3-0). The security of property, equipment, facilities, and personnel is the responsibility of each military and civilian leader throughout DOD. Commanders protect personnel, information, and critical resources in all locations and situations against a broad spectrum of threats by developing and implementing effective physical security programs, policies, and procedures.

(U) The physical security program is the interrelationship of various components that complement each other to produce a comprehensive approach to security matters. These components include—at a minimum—the physical security plan, physical security inspections and surveys, participation in force protection working groups, and a continuing assessment of the installation physical security posture. The physical security program resides with the installation provost marshal or director of emergency services, who coordinates and implements the physical security functions as described in AR 190-13.

(U) Physical security measures and procedures support and enable many tasks that comprise the Army protection warfighting function (see ADP 3-37 for additional information). For example, physical security measures on antiterrorism identify physical vulnerabilities to terrorist attacks on bases, personnel, and materiel. Physical security measures include taking actions to reduce or eliminate those vulnerabilities. Survivability operations and engineering support may be required to emplace compensatory measures for identified vulnerabilities. The physical security system builds on the premise that baseline security and the preparedness posture are based on the local threat, site-specific vulnerabilities, identified critical assets, and available resources.

(U) While the basic principles of physical security are enduring, security technology, components, and analytical tools continue to evolve and improve. Today, commanders have a full array of sophisticated electronic security systems (ESSs); sensitive chemical, biological, radiological, and nuclear sensors; explosive detection devices;

and forward-looking infrared radar systems to employ. These systems provide multilayered, 360-degree, real-time capability to detect, assess, alert, and act against air and ground threats at fixed sites. The goal of the security system for an installation, area, facility, or asset is to employ in-depth security to preclude or reduce the potential for sabotage, theft, trespass, terrorism, espionage, or other criminal activity. In remote locations, commanders of expeditionary forces protect combat power by establishing a system of complementary, overlapping security measures to control access to critical resources and personnel. ESSs and other physical security measures (physical barriers, clear zones, lighting, access and key control, security badges, and defensive positions) should work together to enhance the unit protective posture.

(U) Recent improvements in analytical tools (such as the U.S. Army Security Management System [Countermeasures]) have enhanced physical security surveys and inspection processes. This system enables commanders to quickly detect vulnerabilities that may be exploited by terrorists and criminals and to develop options that eliminate or mitigate those vulnerabilities.

(U) The physical security policy, established by the AR 190 series, encompasses those functions that safeguard personnel, installations, and critical resources. The Office of the Provost Marshal General, the proponent for physical security establishes policy and regulations about physical security operations.

(U) Introduction xi ATP 3-39.32 (INCL C1) 08 March 2022

CUI

(U) ATP 3-39.32 is organized into 10 chapters and six appendixes. The appendixes provide additional details on selected physical security topics. A brief description of each chapter and appendix follows:

Chapter 1. Describes how the physical security program supports the principles of the protection warfighting function through the coordinated efforts of policies, plans, and procedures specifically designed to achieve a strong protection posture. Chapter 1 also describes how planning committees (such as a protection working group) play an integral part in the planning process. The chapter introduces the SMS (CM) as the primary planning tool for physical security surveys and inspections.

Chapter 2. Lays the foundation for initial security design planning considerations that are required for new construction, renovation, and temporary structures. The chapter discusses perimeter and internal security systems.

Chapter 3. Describes emplacement considerations of barriers and fencing (to form the perimeter of controlled areas) and passive and active vehicle barriers (to impede, channel, or stop vehicle traffic).

Chapter 4. Provides the principles of security lighting and technical information for the minimum levels of illumination and lighting uniformity required for various applications.

Chapter 5. Describes the five major components of ESSs and provides technical data concerning electronic interior and exterior sensors and alarm systems.

Chapter 6. Discusses the policies, technical guidance, and procedures used at Army access control points (ACPs). The chapter describes the four ACP zones and the procedures for vehicle inspection and hand-carried item examination.

Chapter 7. Describes the duties and responsibilities of the key custodian, describes procedures for key and lock control, and provides technical information on the various types of locking devices.

Chapter 8. Highlights the authority and jurisdiction of security forces, describes various types of security forces, and discusses the development of comprehensive security plans and orders.

Chapter 9. Describes risk management for deploying forces and security procedures for in-port cargo and rail cargo protection.

Chapter 10. Lays out the foundation for documenting physical security resource requirements, conducting program and budget reviews, prioritizing requirements, and identifying funding sources.

Appendix A. Provides a sample physical security plan.

Appendix B. Provides a guide for physical security personnel in developing checklists tailored to meet specific needs.

Appendix C. Offers a sample bomb threat data card and provides guidelines for bomb threat planning, evacuation drills, and search considerations.

Appendix D. Shows a sample DA Form 5513 (Key Control Register and Inventory).

Appendix E. Provides a sample key control and lock checklist per AR 190-11 and AR 190-51.

Appendix F. Provides the requirements for a barracks physical security plan and requirements per AR

190-13.

08 March 2022 ATP 3-39.32 (INCL C1) 1-1

CUI

Chapter 1

(U) Physical Security Challenges

(U) U.S. military forces face a significant threat from adversaries and aggressors employing a variety of tactics. Attacks are often complex and executed on multiple avenues of approach, using a combination of weapons and tactics. Commanders are increasingly challenged to protect personnel, installations, critical assets, information, and military operations against threats. The security challenge is influenced by the geographic location, size, type, jurisdiction, available assets, and mission of the facility, installation, or unit. A major contributing factor to the vulnerability of Army installations is the relatively fixed nature of operations. Adversaries can observe operational patterns and determine existing defensive measures. Such vulnerabilities can be reduced by developing proper standoff distances, installing early-detection sensors and countersurveillance devices, aggressively patrolling, and implementing random antiterrorism measures.

(U) PHYSICAL SECURITY PLANNING

1-1. (U) The approach to developing protective measures for assets is based on a systematic process that results in an integrated protective system. All Army assets do not require the same degree of protection.

Physical security planning for installations and facilities is primarily a staff function that should include antiterrorism, intelligence, operations, security, logistics, engineers, budget personnel, and the facility user.

Physical security planning may be a function of the protection working group or may occur as part of a specific physical security council. Normally, the designated provost marshal, director of emergency services, or physical security officer (PSO) makes recommendations to the commander about which installation activities require special physical security considerations based on mission-essential or -critical status and vulnerability to hostile threats. The provost marshal or PSO is usually the focal point for the development of the installation physical security plan. Commanders of host or tenant activities are responsible for security planning within their activities. Tenant commanders provide their list(s) of mission-essential vulnerable areas (MEVAs) to the senior commander for inclusion in the host MEVA master list, which is verified annually.

The MEVA list is prioritized to aid the decision-making process for the allocation of resources and deployment of forces in the event of an increased security posture (see AR 190-13).

(U) PHYSICAL SECURITY OFFICER

1-2. (U) A PSO is appointed at all command levels to coordinate and synchronize physical security efforts throughout the installation. The PSO reports through channels to the commander or deputy commander on all matters related to physical security (see AR 190-13). The provost marshal or director of emergency services may serve as the PSO staff member of the division or corps protection cell.

1-3. (U) The PSO coordinates installation physical security activities and supports tenant unit commanders with security requirements or enhancements that are beyond unit means. The installation PSO may be responsible for some of the following activities:

Assessing installation physical security needs by conducting physical security surveys and physical security inspections.

Using the Security Management System (Countermeasures) (SMS [CM]).

Chapter 1

1-2 ATP 3-39.32 (INCL C1) 08 March 2022

CUI

Recommending physical security and antiterrorism design considerations in the preparation of installation engineer construction projects for new construction, renovation, modification, or lease acquisition.

Serving as the single installation or activity physical security equipment point of contact for units under the control, and within the area of responsibility, of the installation, garrison, or command activity.

Ensuring coordination of equipment requirements with users, engineers, and logistics and communications personnel.

Providing technical support to the organization responsible for threat assessments.

Monitoring the resource management of the installation or USACE (United States Army Corps of

Engineers) civil works physical security programs and planning and programing the resources necessary for physical security projects in the program budget cycle in coordination, with the comptroller or USACE civil works business line managers.

Submitting physical security resource requirements to comply with Army physical security policy direction.

Coordinating physical security with operations security and antiterrorism officers.

Coordinating with engineers during the planning, design, and construction of all projects to identify physical security requirements (including supporting communications) and to ensure that the requirements are incorporated into the projects at the inception of the project planning;

ensuring that all access control point projects are designed in accordance with the Army access control points (ACP) standard and reviewed by the Center of Standardization (COS) for Access Control Points and the USACE Protective Design Center.

Reviewing planning documents and construction plans and specifications for construction projects at all stages of development and document concurrence or nonconcurrence.

Providing an advisor to engineer planning and design charrettes.

Reviewing all waivers and exceptions required by paragraph 2–3 of AR 190-13 and revising as required. A brief statement affirming currency of all command waivers and exceptions will be certified current (by principal official) (date), and a copy will be sent to HQDA (DAPM-MPO- PS), 2800 Army Pentagon, Washington, D.C. 20310-2800.

Executing and overseeing installation access control, including vetting visitor personnel and carrying out denial and waiver process decisions in accordance with chapter 8 of AR 190-13.

Overseeing the training and execution of access control operations by security forces.

1-4. (U) The training requirements for the PSO encompass a wide range of knowledge and skills. Formal training in conventional physical security, antiterrorism, and police intelligence and advanced law enforcement is available at the United States Army Military Police School, Fort Leonard Wood, MO. In addition to security and law enforcement skills, the PSO should be knowledgeable in threat assessment and risk analysis. The results of these processes are the basis for planning physical security programs.

1-5. (U) The PSO or physical security inspector conducts risk analysis for assets of assigned units and activities, maintaining the particular categories of Army assets described in AR 190-51 and other assets designated as mission-essential by AR 190-13. Risk analysis is also conducted for the unit assets and activities before occupying new or renovated facilities. The PSO normally performs risk analysis for assets to be located in new facilities during the planning stage of the new construction or renovation so that security measures can be incorporated at project inception.

1-6. (U) Understanding the basic principles of security engineering is important for the PSO. It ensures that security needs are addressed during the initial planning and design of facilities, ACPs, and controlled areas where there is a need for physical security systems. The security series of the unified facilities criteria manuals provide detailed information on security requirements for new construction and renovation projects.

Security engineering unified facilities criteria are discussed throughout this manual.

(U) Physical Security Challenges

08 March 2022 ATP 3-39.32 (INCL C1) 1-3

CUI

(U) PROCESS

1-7. (U) The physical security plan addresses mobilization, war, and contingency operations. The plan is tied to the force protection condition and random access control measures and should include provisions for increasing the physical security measures and procedures during periods of increased threat from terrorist or criminal elements or natural emergencies (see AR 190-13). Physical security planning should include initial security measures and consideration of security measures that are appropriate for longer timelines, even though such measures may not be implemented for months or years.

Note. (U) Appendix A contains a sample physical security plan format.

1-8. (U) Physical security planning includes coordinating physical security with operations security, law enforcement, information security, personnel security, communications security, automated information security, continuity of operations programs, counterintelligence, and antiterrorism programs to provide an integrated and coherent effort (see DOD 5200.08-R).

1-9. (U) Planning security measures may entail the consideration of more stringent requirements, such as those associated with explosive safety, legal or political considerations, historic preservation, and environmental concerns. Regulatory requirements for security must be coordinated with other agencies that may specify different levels of protection or impose specific restrictions.

(U) DEVELOPMENT

1-10. (U) When developing the physical security plan, close coordination and liaison are required between the PSO; antiterrorism officer; military commander; adjacent installations and units; federal, state, and local agencies; and appropriate host-nation agencies. (See appendix B for reachback capabilities.)

1-11. (U) The goal of the physical security plan is to provide protection for personnel, facilities, and equipment. The physical security plan is a living document that is designed to allow for increases in protection to facilitate changes in force protection conditions. The plan must include the provisions of AR 190-13, including contingency planning, access and exit controls, road closure procedures, and restriction of movement in specific areas designated by the commander. At a minimum, the plan should include special and general guard orders; protective barriers; and lighting, locking, and intrusion detection systems (IDSs).

1-12. (U) A vulnerability assessment is conducted to determine protection measures and develop physical security plans. This assessment is a systematic approach to identify vulnerabilities of mission-essential assets, facilities, resources, and personnel. A MEVA is a facility or activity that, by virtue of its function, is designated by the commander as vital to mission accomplishment. A MEVA may include information, equipment, property, and facilities (barracks, hospitals, motor pools, arms rooms, communication towers). A facility or area should be designated as a MEVA if it is essential to mission accomplishment and vulnerable to a threat that is intent on destroying, damaging, seizing, or tampering with property or equipment.

1-13. (U) A MEVA is normally recommended by the provost marshal, director of emergency services, or PSO and approved by the commander. Once approved, a MEVA is designated in writing and included in the installation physical security plan. A vulnerability assessment is conducted to prioritize and rank each MEVA for resource allocation.

Note. (U) AR 190-13 provides a list of activities to be considered for designation as a MEVA.

(U) VULNERABILITY ASSESSMENT

1-14. (U) Vulnerability assessments which are part of an overall risk management process, include— Conducting a mission analysis to determine the assets, facilities, and personnel that need protection.

Analyzing threat tactics.

1-4 ATP 3-39.32 (INCL C1) 08 March 2022

CUI

Determining asset vulnerabilities to threats.

Conducting a risk analysis of critical-asset vulnerabilities to determine the level of risk.

Analyzing courses of action to mitigate or resolve vulnerabilities.

Applying resources to mitigate or resolve vulnerabilities.

1-15. (U) Risk analysis is conducted when— A unit, organization, or activity is activated.

A new facility or area is occupied.

There is no record of a prior vulnerability assessment.

Significant changes or modifications to the unit, organization, or facilities have occurred since the last assessment (construction, renovation, or the loss of a security system) and may impact the security posture.

Significant changes are made to the security force.

The commander determines that greater frequency is required.

A similar facility has been attacked or damaged by a threat.

1-16. (U) Vulnerability assessments should be formally reviewed annually by the commander. The results of the annual review or update should be documented and forwarded through command channels to the appropriate higher headquarters for review.

1-17. (U) The commander may use the protection working group to conduct vulnerability assessments (see ADP 3-37). Physical security surveys and inspections conducted in the previous 12-month period should be used during the assessment.

1-18. (U) The following format is used to document the results of a vulnerability assessment. The documentation should include, at a minimum, the following information:

The primary mission of the unit or organization.

The commander’s intent, including how the unit or organization mission supports the mission of the next-higher headquarters.

A description of the mission of each subordinate unit or organization.

Critical-asset information, which should include—

A description of what assets are critical to the unit or organization mission and an explanation of why.

A description of the risk level for each critical asset (see DA Pam 190-51).

A description of the levels of protection required for the applicable threat according to

UFC 4-020-01.

A description of the impact on the mission if a critical asset is lost or not available. Critical assets should be rank-ordered from most to least important.

A site description of surrounding areas, along with maps and photographs, if available.

A review of functional schematics and engineering drawings for critical assets, equipment, and structures; of any relevant information should be included.

Detailed threat and threat capability information, which should include— A description of the spectrum of viable threats to the mission, facilities, assets, and personnel.

A description of the capabilities of each threat and an explanation of how those capabilities apply to each critical asset. At a minimum, use the Army annual threat assessment and the local threat statement.

08 March 2022 ATP 3-39.32 (INCL C1) 1-5

CUI

Identification of each potential threat to each critical asset. Specific threats that should be used apply to each asset, as identified by the annual threat assessment or local threat statements, should be addressed. Likely threat objectives; threat tactics; capabilities; and tools, explosives, and weapons that the threat could use in the execution of its attack should be specifically stated (see DA Pam 190-51 and UFC 4-020-01).

A description of what threats were considered and eliminated and an explanation of why. At a minimum, insider and outsider adversaries, insider and outsider collusion, airborne attack, and natural or man-made disasters that compromise asset security and may make a critical asset vulnerable should be considered. (See AR 25-2 for more information.)

A facility and asset tour, including a tour of the MEVA or the critical-asset and surrounding areas, to become knowledgeable about the site configuration, the terrain, storage structures, security systems, security forces, and technical operational activities at the asset. The logical avenues of approach, areas providing concealment, fields of fire into the asset, standoff distances, and likely points of attack should be noted. During the tour, the team should identify specific vulnerabilities from external and internal threats by— Observing day and night operations.

Interviewing personnel.

Demonstrating security equipment and procedures.

Noting how the security systems, including security forces and backup forces are used.

Asking “what-if” questions with reference to the possibility of covert or overt acts by insiders.

Concentrating on means to bypass, subvert, overwhelm, or interrupt elements in the security systems.

A characterization of security systems, processes, policies, and procedures, which should be included— Description of the plans, policies, standard operating procedures (SOPs), physical protection, access control, and multielement protection measures that are in place to protect target locations from the threat spectrum. Characterization should be specific to all protection that is in place, relative to MEVAs and critical assets.

A description of the layers of protection, including the condition of security components.

A description of the general condition of security components (vehicle barriers, entry gates, fences, access controls, locks, area lighting, alarms, communications equipment, and protective equipment).

1-19. (U) Other critical information that should be reported during the vulnerability assessment includes— Security force status: A description of the composition of security forces, including authorized and required strengths since the last review.

Potential targets: Targets are based on the mission, commander’s intent, and the criticality assessment as identified in AR 525-13.

Scenario development: A detailed description of the plausible threat scenarios that were developed for each potential target. Scenario development should use a two-party adversary (red team) and defender (blue team) gaming approach. Each team independently develops a plan for attack and defense. After the planning is complete, the red and blue teams conduct a tabletop exercise to react to attacks and work out defense specifics of the protected facility. A neutral party observes and provides guidance on how to develop the defensive plan based on the red team attack concept. Each team identifies asset vulnerabilities; selects credible courses of action that an adversary might use; and conveys responses by the security system to deter, detect, defend, and defeat an adversary.

Exercise results: A description of the results of the test exercises for each identified threat. For example, if an insider threat has been identified as a risk to the asset, an exercise is conducted to determine its viability. A recapitulation of security system probabilities, delay times for structures

1-6 ATP 3-39.32 (INCL C1) 08 March 2022

CUI

and barriers, adversary target task times, security force response times, and security force neutralization times is provided. It should be determined if— The response force reacts within the appropriate time limits.

In-place security systems mitigate the potential threat to an acceptable level.

Additional measures are required to mitigate the potential threat to an acceptable level.

Conclusions, vulnerabilities, and recommendations: A statement of the conclusions and recommendations that were developed during the assessment. Conclusions should express results that follow the vulnerability assessment. Recommendations should support conclusions and be designed to reduce the likelihood of success for identified vulnerabilities.

Commander’s formal decision on conclusions and recommendations: A formal commander’s decision on the assessment team conclusions and recommendations. Each of the following should be addressed:

Conclusions/vulnerabilities.

Recommendations.

Commander’s concurrence/nonconcurrence (with comment).

Corrective actions taken or planned or the commander’s acceptance of risk.

Vulnerability assessment: The application of a classification to each vulnerability. The documentation should be forwarded through command channels to the Army command. Each commander in the chain of command should review and endorse the vulnerability assessment documentation to ensure that appropriate corrective actions are initiated or accomplished.

1-20. (U) Within 30 days of the visit, a summary narrative report and an annotated briefing should be delivered to the installation commander. Follow-on assistance for the commander may be applicable for improvement options, cost estimates, and generic sources of materials and equipment.

(U) SECURITY MANAGEMENT SYSTEM (COUNTERMEASURES)

1-21. (U) SMS (CM) is a web-based physical security program risk analysis, inspection, and survey software tool used by physical security inspectors to ensure that security measures for Army assets are in compliance with regulatory requirements. It provides the Army with a single, standardized, interoperable, and integrated web-based platform for conducting the physical security program-required risk analysis, inspections, and surveys. The software automates the compliance assessment of the DOD and Army physical security asset protection requirements; standardizes the method of conducting physical security inspections and surveys, measures unit and command compliance, consolidates unmet requirements information for validation by designated authorities, and provides input into the executive decision-making processes. The SMS (CM) enables trends analysis of data, the printing of reports, and the export of data while generating the DA Form 2806-1 (Physical Security Inspection Report) and the DA Form 7278 (Risk Level Worksheet) for each inspected asset or resource. Key features include the—

Identification of assets and their value.

Calculation of vulnerabilities.

Evaluation of risk based on applicable threats.

Facilitation of the analysis of improvements to security posture.

Determination of compliance with rules.

1-22. (U) SMS (CM) is used to schedule, conduct, and record physical security surveys and inspections;

submit timely information to higher headquarters; justify program requirements; and create risk mitigation action plans. Additional information about the SMS (CM) can be found at http://smshelp.countermeasures.com/.

08 March 2022 ATP 3-39.32 (INCL C1) 1-7

CUI

(U) PHYSICAL SECURITY SURVEY

1-23. (U) A physical security survey is a formal, recorded assessment of the installation physical security program. The physical security survey provides the commander with an assessment of the overall security posture in view of the threat and the mission and with information about the strengths and weaknesses of installation physical security.

1-24. (U) Physical security surveys are encouraged, but not required, for standalone facilities if a physical security inspection provides the commander with the information necessary to determine the physical security posture of the…