Exhibit K Secure Room.pdf
PDF 141 KB Posted
- Solicitation number
- DACW515260008800
About this file
This document is a security specification detailing minimum construction and operational standards for open storage areas (secure rooms) used to protect classified information.
The construction standards require permanent materials for walls, floors, and ceilings (plaster, gypsum wallboard, metal panels, hardboard, wood, or plywood) that extend from true floor to true ceiling. Access doors must be substantially constructed of wood or metal with non-removable hinge pins or interlocking hinges for out-swing doors, and equipped with GSA-approved combination locks meeting FF-L-2740 or secured from inside with deadbolt emergency egress hardware. Windows less than 18 feet above ground or easily accessible must have forced entry protection matching wall strength, unless located within a controlled compound with inoperable windows covered by an Intrusion Detection System (IDS). Utility openings must be smaller than 96 square inches; larger openings must be hardened per Military Handbook 1013/1A.
The IDS standards require detection systems to identify unauthorized penetration in areas with access to security containers or classified data storage, unless continually occupied. Motion detection sensors (ultrasonic or passive infrared) must protect such areas, with dual technology authorized when each transmits independently. Perimeter doors require balanced magnetic switches meeting UL Standard 634. All readily accessible windows must have IDS protection when forced entry protection is not provided. IDS installation, maintenance, and monitoring must be performed by U.S. citizens with trustworthiness determinations. Alarm response personnel must arrive within 30 minutes. Primary power must be commercial AC or DC with emergency backup providing minimum 8 hours of battery and/or generator power. Access control devices require electronic panels inside the secure area with shielded combination-setting mechanisms, managed by personnel cleared to the same level as the highest classified information stored. Records of identification badges, PINs, access levels, personnel removal, and entry logs must be maintained for at least 90 days.
View the file
Other files
Show all 21
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Open Storage Area (Secure Room) Requirements.
Minimum construc on standards for open storage areas
(1) Walls, Floor, and Roof. Walls, floor, and roof shall be of permanent construction materials; i.e., plaster, gypsum wallboard, metal panels, hardboard, wood, plywood, or other materials offering resistance to and evidence of unauthorized entry into the area. Walls shall be extended from the true floor to the true ceiling and attached with permanent construction materials, mesh, or 18 gauge expanded steel screen.
(2) Ceiling. The ceiling shall be constructed of plaster, gypsum, wallboard material, hardware or any other acceptable material.
(3) Doors. Access doors shall be substantially constructed of wood or metal.
For out-swing doors, hinge-side protection shall be provided by making hinge pins non-removable (e.g., spot welding) or by using hinges with interlocking leaves that prevent removal. Doors shall be equipped with a GSA-approved combination lock meeting FF- L-2740 (i.e.X10). Doors other than those secured with locks meeting FF-L-2740 shall be secured from the inside with deadbolt emergency egress hardware, a deadbolt, or a rigid wood or metal bar that extends across the width of the door.
(4) Windows
(a) Windows that are less than 18 feet above the ground measured from the bottom of the window, or are easily accessible by means of objects located directly beneath the windows, shall be constructed from or covered with materials that will provide protection from forced entry. The protection provided to the windows need be no stronger than the strength of the contiguous walls. Secure rooms which are located within a controlled compound or equivalent may eliminate the requirement for forced entry protection if the windows are made inoperable either by permanently sealing them or equipping them on the inside with a locking mechanism and they are covered by an IDS (either independently or by motion detection sensors within the area).
(b) Windows, which might reasonably afford visual observation of classified activities within the facility shall be made opaque or equipped with blinds, drapes, or other coverings.
(5) Utility Openings. Utility openings such as ducts and vents shall be smaller than man-passable (96 square inches). An opening larger than 96 square inches (and over 6 inches in its smallest dimension) that enters or passes through an open storage area shall be hardened in accordance with Military Handbook 1013/1A
Intrusion Detection System (IDS) Standards
IDS Purpose. An IDS shall detect an unauthorized penetration into the secured area. An IDS shall be installed when results of a documented risk assessment When used, all areas that reasonably afford access to the security container or areas where classified data is stored shall be protected by IDS unless continually occupied.
(1) PCU All PCUs shall be located inside the secure area and should be located near the entrance. Assigned personnel shall initiate all changes in access and secure status.
(2) Motion Detection Protection. Secure areas that reasonably afford access to the security container or area where classified data is stored shall be protected with motion detection sensors; e.g., ultrasonic and passive infrared. Use of dual technology is authorized when one technology transmits an alarm condition independently from the other technology. A failed detector shall cause an immediate and continuous alarm condition.
(3) Protection of Perimeter Doors. When an IDS is installed, each perimeter door shall be protected by a balanced magnetic switch that meets UL Standard 634.
(4) Windows. All readily accessible windows (within 18 feet of ground level) shall be protected by an IDS, either independently or by the motion detection sensors within the space, whenever a secure room is located within a controlled compound or equivalent and forced entry protection of the windows is not provided.
IDS Installation, Maintenance, Monitoring and Response
(1) IDS Installation and Maintenance Personnel. Alarm installation and maintenance shall be accomplished by U.S. citizens who have been subjected to a trustworthiness determination.
(2) Monitor Station Staffing. The monitor station shall be supervised continuously by U.S. citizens who have been subjected to a trustworthiness determination.
(3) Response. An IDS meeting the requirements with the personnel responding to the alarm arriving within 30 minutes of the alarm annunciation by U.S. citizens who have been subjected to a trustworthiness determination.
(4) Power Supplies. Primary power for all IDE shall be commercial alternating or direct current (AC or DC) power. In the event of commercial power failure at the protected area or monitor station, the equipment shall change power sources without causing an alarm indication.
(a) Emergency Power. Emergency power shall consist of a protected independent backup power source that provides a minimum of 8 hours operating power battery and/or generator power. When batteries are used for emergency power, they shall be maintained at full charge by automatic charging circuits. The manufacturer’s periodic maintenance schedule shall be followed and results documented.
(b) Power Source and Failure Indication. An illuminated indication shall exist at the PCU of the power source in use (AC or DC). Equipment at the monitor station shall indicate a failure in power source, a change in power source, and the location of the failure or change.
(5) Component Tamper Protection. IDE components located inside or outside the secure area shall be evaluated for a tamper protection requirement. If access to a junction box or controller will enable an unauthorized modification, tamper protection shall be provided.
(6) False and/or Nuisance Alarm. Any alarm signal transmitted in the absence of detected intrusion that is not identified as a nuisance alarm is a false alarm. A nuisance alarm is the activation of an alarm sensor by some influence for which the sensor was designed but which is not related to an intrusion attempt. All alarms shall be investigated and the results documented.
Access Controls
Protection shall be established and maintained for all devices or equipment that constitutes the entry control system. The level of protection may vary depending upon the type of device or equipment being protected.
Access control devices shall be installed in the following manner:
(1) The electronic control panel containing the mechanism for setting the combination shall be located inside the area. The control panel shall require only a minimal degree of physical security designed to preclude unauthorized access to the mechanism.
(2) The control panel shall be installed, or have a shielding device mounted, so that an unauthorized person in the immediate vicinity cannot observe the setting or changing of the combination.
(3) An individual cleared at the same level as the highest classified information controlled within the area shall select and set the combination.
(4) Electrical components, including wiring, or mechanical links (cables, rods, and so on) shall be accessible only from inside the area, or, if they traverse an uncontrolled area, they shall be secured within conduit to preclude surreptitious manipulation of components.
(5) Location where authorization data and personal identification or verification data is input, stored, or recorded shall be protected.
(6) Card readers, keypads, communication or interface devices located outside the entrance to a controlled area shall have tamper resistant enclosures and be securely fastened to the wall or other permanent structure. Control panels located within a controlled area shall require only a minimal degree of physical security protection sufficient to preclude unauthorized access to the mechanism.
(7) Keypad devices shall be designed or installed in such a manner that an unauthorized person in the immediate vicinity cannot observe the selection of input numbers.
(8) Systems that use transmission lines to carry access authorizations, personal identification data, or verification data between devices or equipment located outside the controlled area shall have line supervision.
(9) Electric strikes used in access control systems shall be heavy duty, industrial grade.
(10) Access to records and information concerning encoded identification data and PINs shall be restricted. Access to identification or authorizing data, operating system software or any identifying data associated with the entry control system shall be limited to the fewest number of personnel as possible. Such data or software shall be kept secure when unattended.
(11) Records shall be maintained reflecting active assignment of identification badge and/or card, PIN, level of access, and similar system-related records. Records concerning personnel removed from the system shall be retained for at least 90 days.
Records of entries shall be retained for at least 90 days or until investigations of system violations and incidents have been resolved and recorded.
Reference: DoDM 5200.01-V3
File details come from the government source that posted it. Updated .