SOW_705_CTS_Access_Control_CCTV_Upgrade_(Revision_25_June_14).pdf

STATEMENT OF WORK

705 CTS ACCESS CONTROL AND CLOSED CIRCUIT TELEVISION (CCTV)

SYSTEMS

Revision: 25 June 2014

1. Background/Scope.

The purpose of this procurement is to upgrade and maintain the 705 th

Combat Training

Squadron’s access control and Closed-Circuit Television (CCTV) systems which were originally installed in 2001. There are three (3) separate tasks for this effort: 1) remove and dispose of the existing access control and CCTV equipment; 2) install new hardware and software for both systems; and 3) establish a maintenance agreement that will cover all of the newly installed hardware and software for the access control system and CCTV. The period of performance for the maintenance agreement will begin concurrently with the installation of the access control and

CCTV systems, and it will be for a base year plus four option years.

To the maximum extent possible, contractors shall use existing components of the old access control and CCTV systems to control costs to include but not limited to: existing wiring, door sensors, door magnets, push bars, and connection panels. However, keypads, monitoring systems (as described below), and cameras shall be replaced.

2. Requirements. The below tasks are not listed in order and may need to be accomplished concurrently or in a different order than listed.

2.1. Task 1: Remove and dispose of all of the existing access control and CCTV equipment not used in the newly installed system. Items include, but may not be limited to, the following:

2.1.1. Remove a maximum of 63 access control door sensors, a maximum of 63 keypads, and a maximum of 14 CCTV cameras. This task may also include some other individual items associated with either of the systems that will not be needed and/or functional with the new system(s). The actual number of sensors, keypads, CCTV cameras, and other system components to be removed will depend on the contractor’s proposed use of existing equipment in the new system. Please note that not all equipment to be removed is shown in

Attachment 3 and Attachment 4.

2.1.2. The contractor will verify the existing wiring is compatible to support the new equipment. If the existing wiring is not compatible, it will be removed and new wiring installed.

In cases where new items will be installed, the contractor will install wiring, as needed, to support the newly positioned equipment. If new wiring is required it shall be installed in the same discrete manner as the existing wiring and in accordance with all building codes.

2.1.3. The contractor shall repair walls and/or surfaces where old equipment was removed and no new items were installed. Repair will be accomplished by placing blank metallic switch plates (without holes) over the affected surfaces where possible. Where metallic switch plates are not appropriate, repair of existing surfaces will be done with materials appropriate for the surface and in such a manner that repair and surface materials appear to be the same. Replacement and repair of any affected ceiling tiles is not required.

2.2. Task 2: Install complete working Battlespace and SCIF systems described below.

Battlespace and SCIF Systems are independent of one another. Use only American manufactured/owned hardware and software, IAW DoD Manual 5200.01, Volume 3, Appendix to Enclosure 3, paragraph 3, dated February 24, 2012 (Attachment 1), needed for the new access control and CCTV systems, to include familiarization training, which includes, but may not be limited to:

2.2.1. Provide all parts, labor, and supplies necessary to install complete working

Battlespace Access Control and CCTV System, which may include, but is not necessarily limited to:

BATTLESPACE

EQUIPMENT

LOCATION QUANTITY

Magnetic door sensor for access control

Various doors throughout the st & 2 nd floors

34 (estimated)

Scramble keypad for access control

Various doors throughout the st & 2 nd floors

38 (estimated)

CCTV Monitoring/Control

Systems

Room 155 (security managers office) & Front Entry Security

Desk

Badge printer for access control system

Room 155 1

Printer ribbon for badge printer

Room 155 3

Proximity cards for access control (reusable)

Room 155 300

Removable, self-adhesive overlays for prox. cards

Room 155 400

Request to Exit PIR Main Battlespace doors 5

“Buzzer” or doorbell-type access controls to facilitate lock release for entry

Front Entry Security Desk 1

“Lock Out” interface; access control keypad tied into

“Classified Meeting” light nd

Floor Conference Room

(Rm 250), Auditorium (Rm

104), AV Room (Rm 106

High resolution color cameras w/tilt, rotate, zoom capabilities for CCTV with a minimum of 270 degrees of view

Exterior of facility at main doors (existing position) and rear of facility (existing position near loading dock)

High resolution color cameras Various locations inside & outside of building (see attachment 3, First Floor)

Weather-proof housings for externally mounted CCTV cameras

Various locations outside of building

DVR Front Entry Security Desk 1

Power supplies to support

CCTV connectivity between front security desk, SCIF, Sidebay

To be determined by vendor & government POCs IAW AFI

3 (estimated)

2.2.1.1 The Access Control/CCTV System shall include two

monitoring/control systems with one located at the Front Entry Security Desk and the other in the Security Manager’s Office. The monitoring/control systems must include all hardware and software necessary to perform the functions of fully operational access control and CCTV systems. The monitoring/control systems must allow for set-up and control of proximity card readers which includes but is not limited to: granting and revoking access of patrons through the use of proximity cards, performing lockouts, lock release, and overall system control. The monitoring/control systems must have the ability to visually monitor and record all footage from all facility cameras (with the exception of the two SCIF Cameras, see para 2.2.2). The monitoring system must also have the capability to control the visual direction of all tilt, rotate, zoom cameras. The CCTV and access control systems must not share the same viewing monitors.

2.2.1.2 Proximity cards must be compatible with self-adhesive overlays. The overlays and proximity cards should be provided as part of the access control system in the quantities listed above. The access control system will also provide the capability to print at minimum the listed quantity of overlays.

2.2.1.3 Request to Exit PIR (REX/PIR): Install Request to Exit (REX) Passive

Infrared (PIR) sensors, as well as outbound badge readers at the 5 doors to the Battlespace doors (see

Attachment 3, First Floor). The five outbound badge readers will be for card presentation only; outbound

PIN usage is prohibited due to emergency egress fire safety standards.

2.2.1.4. “Buzzer” or doorbell-type access controls to facilitate lock release for entry: The buzzer shall be located at the front entry security desk and shall allow the on-duty attendant to release the sensor at the front entry doors and grant personnel entry to the facility without having to utilize a facility badge.

2.2.1.5 “Lockout” interface; access control keypad tied into “Classified

Meeting” light: The lockout interface devices for use in the auditorium, audio-visual room, and the second floor conference room will disable the badge readers from routine use while the

“Classified” briefing light is activated, thus preventing personnel from entering the areas while classified sessions are being conducted. A master code or by-pass function needs to be enacted to allow security personnel to override the lockout should a user forget to turn off the

“Classified” briefing light before departing the area. The lockout feature for the auditorium shall control the main auditorium doors as well as the rear auditorium storage room door. The lockout feature for the second floor conference room shall control the entry doors as well as the interior door leading to the CC Office.

2.2.2. Provide all parts, labor, and supplies necessary to install a complete working

SCIF Access Control and CCTV System, which may include, but is not necessarily limited to:

SCIF EQUIPMENT LOCATION QUANTITY

SCIF Monitoring System SCIF 1

CAC-enabled keypads/badge readers

Both SCIFs 5

Doorbell Both SCIFs 2

High Resolution Color

Cameras

Both SCIFs 2

Secure or shielded wiring for doorbells and CCTV connectivity

Both SCIFs TBD by offeror

2.2.2.1 The SCIF components listed above (para 2.2.2) must meet the technical specifications outlined in Intelligence Community Directive 705 (ICD 705), dated May

26, 2010 (Attachment 2). After award but no later than 20 days prior to installment of equipment, the contractor shall submit a detailed listing (make, model, serial number, etc.) of specific equipment for use in the SCIF. Verification of compliance/compatibility with SCIF operating procedures and ICD 705 and certification must be initiated before installation can proceed. The amount of wiring required to install the doorbells and CCTV is unknown and should be determined by the offeror. NOTE: No foreign parts or equipment or software owned by a foreign entity may be used or installed.

2.2.3.1 The SCIF monitoring/control system must be located in the same room as the SCIF panel (see Attachment 3, First Floor). The monitoring/control system must include all hardware and software necessary to perform the functions necessary for a fully operational access control and CCTV systems. The monitoring/control system must allow for set-up and control of CAC-enable access readers which includes granting and revoking access of patrons through the use of DoD Issued CAC cards, performing lockouts, lock release, and overall system control. The monitoring/control system must have the ability to visually monitor the two SCIF cameras from the SCIF panel location. The CCTV and access control systems must not share the same viewing monitors. The monitoring/control system must also include the ability to monitor the “new SCIF Camera” from inside the SCIF access door with a CAC-enabled reader nearest its location (see Attachment 3, First Floor).

2.2.2.2 The SCIF cameras must be able to show positive ID of personnel trying to gain access to the SCIF. The “new SCIF camera” shall not be installed in the wall designated by a red line (see Attachment 3, First Floor). If installed as a hanging camera, it must not freely move, swing, or sway in any manner.

2.2.2.3 A doorbell type notification shall be installed at both SCIF locations to notify personnel inside that someone is at the entry. When the Doorbell located nearest the “new

SCIF camera” is pressed it shall be audible inside both locations. When the Doorbell nearest the

SCIF Panel is pressed it shall only be audible inside that location.

2.2.3. Access control (the quantities listed above are fairly accurate; however, minor deviations (up or down) may be needed to facilitate system control, facility security, or elimination of unneeded items).

2.2.4. Familiarization training on the operating systems will include, but may not be limited to: viewing and controlling the cameras; issuing, adding, deleting, and printing badges;

controlling area accesses for badges; lock-out/down procedures for areas/doors; operating and review of the DVR; and viewing/printing CCTV and badge reports. Training shall be completed in a time frame which allows continuous access to facilities and seamless transition from the old system to the new.

2.3. Task 3: Establish an annual maintenance agreement that will begin concurrently with the system installation of the new access control and CCTV systems. The agreement will be for five (5) years (base year plus four (4) option years) and pricing will be established on the base contract. The periods of performance on the base contract for the base year and options are

“TBD”, shall begin at the time of contract award. The following are the specific requirements of the maintenance agreement.

2.3.1. Contractor shall provide technical support with a capable and qualified technician within 4 hours of notification, Monday – Friday, 0800-1600 hours, for emergency repair and/or replacement of failed or malfunctioning equipment.

2.3.2. Contractor shall provide emergency, after-hours support (1600-0800 hours, weekends and holidays) with a capable and qualified technician within 24 hours of notification.

2.3.3. Contractor shall provide loaner or replacement equipment within 24 hours of malfunction or failure, regardless of the reason for malfunction or failure, if timely repairs cannot be completed.

2.3.4. Contractor shall provide preventive maintenance, testing, and cleaning of installed equipment, twice each calendar year, consisting of:

2.3.4.1. Access control system checked; readers cleaned/adjusted;

worn/unreadable keypads replaced; lock down/lock release for doors verified; functional check of all door hardware/components; software updates if/as required; badge printer function checked, cleaned.

2.3.4.2. CCTV power supply function checked; camera functionality checked;

cameras and housing units/hardware cleaned; camera image quality verified; camera positioning maintained; video recorders checked and functioning; software updates, if/as required; other associated CCTV functions/connectivity.

2.3.4.3. Quick entry access control buttons for the main facility doors as well as the vehicle gate at the rear of the facility.

2.3.4.4. Contractor shall ensure systems having a UL certification are maintained IAW certification requirements.

3. Schedule.

3.1. The contractor shall attempt to perform work during normal business hours (0730-1630 hrs) Monday – Friday.

3.2. If the contractor determines that it must work beyond normal business hours or weekends at no additional cost to the government, the contractor will contact the POCs in paragraph 5.0 to arrange for access to the facility and appropriate escorts.

3.3. Depending on the 705 CTS exercise schedule and availability of the parts for the access control and CCTV systems, all installation/uninstallation work and training shall be completed within 90 days of award of contract.

3.3.1. The 705 CTS has a robust exercise schedule, and time where the facility can be shut down to perform the work is limited.

3.3.2. Upon contract award, the contractor shall contact the POCs in paragraph 5.0 to discuss scheduling for the work to be completed. The contractor shall provide an estimated date as to when all components for the access control and CCTV systems will be received so the 705

CTS POCs can review the exercise schedule to find a period where the work on the access control and CCTV systems can be performed.

3.3.3. The following is a desired timeline to complete work in the various areas of the facility:

3.3.3.1. SCIF installations: one (1) day for each location; total two (2) days maximum.

3.3.3.2. Remainder of facility: one (1) calendar week.

3.3.3.3. The contractor shall include in their written Technical Response a detailed approach to satisfying the installation schedule and will provide detailed justification if the above requested installation criteria cannot be met. Minimum down time of the system due to the switch over is desired.

3.4. The work to be accomplished includes classified areas; therefore, two weeks prior to the start of the physical work to upgrade the access control and CCTV systems in the facility, the contractor shall contact the POCs in paragraph 5.0 to coordinate access to the facility as well as to arrange escorts within the classified areas.

3.5 The following is a desired priority of installation and addresses additional requirements involved to complete the access control system. All items should be addressed in the Technical

Response.

3.5.1. Priority 1: SCIF Access Control/CCTV System. If installation timelines must deviate from those listed (see paragraph 3.3.3.1), the existing SCIF access control systems must remain fully operational during the installation of the new system. Downtime of these components should be as limited as possible and should not extend outside of the normal work hours outlined in paragraph 3.1. Installation should allow continuous access to facilities and provide a seamless transition from the old system to the new.

3.5.2. Priority 2: Battlespace Access Control/CCTV System internal sensors, readers, other controls, etc., installed and operational via the new software system. Incremental installation of these components in order to verify operation of the system will be acceptable, however, the contractor will make every effort to adhere to and/or justify shortfalls of suggested timelines in paragraph 3.3.3.2. Installation should allow continuous access to facilities and provide a seamless transition from the old system to the new.

3.5.3. Priority 3: The Battlespace and exterior facility doors/CCTV system which, once installed will make the new system fully functional, allowing the old access control system to be disabled. Incremental installation of these components in order to verify operation of the system will be acceptable. Downtime of these components should be as limited as possible and should not extend outside of the normal work hours outlined in paragraph 3.1. Installation should allow continuous access to facilities and provide a seamless transition from the old system to the new.

3.5.3.1. The contractor will coordinate with the POCs listed in paragraph 5.0 at least 48 hours ahead of time to ensure required guards may be organized.

4. Location of Work.

4.1. Work will be performed at:

th

Combat Training Squadron

Building 942

4500 Aberdeen Dr SE

Kirtland AFB, NM 87117

5. Points of Contact:

5.1. Primary POC for overall project and work in Battlespace and non-SCIF Areas:

TBD.

5.2. Alternate POC for overall project and work in SCIFs

TBD.

DoDM 5200.01-V3, February 24, 2012

APPENDIX TO ENCLOSURE 3Change 2, 03/19/2013 49 device or procedure that verifies authorized use. In the secure mode, any unauthorized entry into the space shall cause an alarm to be transmitted to the monitor station.

(3) Motion Detection Protection. Secure areas that reasonably afford access to the security container or area where classified data is stored shall be protected with motion detection sensors; e.g., ultrasonic and passive infrared. Use of dual technology is authorized when one technology transmits an alarm condition independently from the other technology. A failed detector shall cause an immediate and continuous alarm condition.

(4) Protection of Perimeter Doors. When an IDS is installed, each perimeter door shall be protected by a balanced magnetic switch that meets UL Standard 634 (Reference (av)).

(5) Windows. All readily accessible windows (within 18 feet of ground level) shall be protected by an IDS, either independently or by the motion detection sensors within the space, whenever a secure room is located within a controlled compound or equivalent and forced entry protection of the windows is not provided (also see subparagraph 1.b.(4) of this Appendix).

(6) IDS Requirements for Continuous Operations Facilities. A continuous operation facility may not require an IDS. This type of secure area should be equipped with an alerting system if the occupants cannot observe all potential entrances into the room. Duress devices may also be required.

(7) False and/or Nuisance Alarm. Any alarm signal transmitted in the absence of detected intrusion that is not identified as a nuisance alarm is a false alarm. A nuisance alarm is the activation of an alarm sensor by some influence for which the sensor was designed but which is not related to an intrusion attempt. All alarms shall be investigated and the results documented. The maintenance program for the IDS shall ensure that incidents of false and/or nuisance alarms shall not exceed 1 in a period of 30 days per zone.

f. Installation, Maintenance and Monitoring

(1) IDS Installation and Maintenance Personnel. Alarm installation and maintenance shall be accomplished by U.S. citizens who have been subjected to a trustworthiness determination according to Reference (l).

(2) Monitor Station Staffing. The monitor station shall be supervised continuously by U.S. citizens who have been subjected to a trustworthiness determination according to Reference (l).

3. ACCESS CONTROLS

a. The perimeter entrance to a secure facility (i.e., vault or secure room) shall be under control at all times during working hours to prevent entry by unauthorized personnel. This may be achieved by visual control or through use of an automated entry control system (AECS) that complies with the requirements of subparagraph 3.a.(2) of this section. Uncleared persons are to

Attachment 1, DoDM 5200.01-V3, Feb 24, 2012 Page 1 of 4

APPENDIX TO ENCLOSURE 3Change 2, 03/19/2013 50 be escorted within the facility by a cleared person who is familiar with the security procedures of the facility. Personnel entering or leaving an area shall be required to secure the entrance or exit point. Authorized personnel who permit another individual to enter the area are responsible for confirming their need to know and access.

(1) Visual control may be accomplished by methods such as designated employees, guards, or continuously monitored closed circuit television.

(2) An AECS may be used if it meets the criteria stated in subparagraphs 3.a.(2)(a) and 3.a.(2)(b). The AECS shall identify an individual and authenticate the person’s authority to enter the area through the use of an identification (ID) badge or card.

(a) The ID badge or key card shall use embedded sensors, integrated circuits, magnetic stripes, or other means of encoding data that identifies the facility and the individual to whom the card is issued.

(b) Biometrics verification identifies the individual requesting access by some unique personal characteristic and may be required for access to sensitive information. The Biometrics Identity Management Agency can provide further information regarding biometric technologies and capabilities. Personal characteristics that can be used for identity verification include:

1. Fingerprints.

2. Hand geometry.

3. Handwriting.

4. Iris scans.

5. Voice.

6. Facial recognition.

(3) In conjunction with subparagraph 3.a.(2)(a) of this section, a personal identification number (PIN) may be required. The PIN shall be separately entered into the system by each individual using a keypad device and shall consist of four or more digits, randomly selected, with no known or logical association with the individual. The PIN shall be changed when it is believed to have been compromised or subjected to compromise.

(4) Authentication of the individual’s authorization to enter the area shall be accomplished within the system by inputs from the ID badge and/or card, the personal identity verification device, or the keypad with an electronic database of individuals authorized to enter the area. A procedure shall be established for removing the individual’s authorization to enter the area upon reassignment, transfer, or termination, or when the individual’s access is suspended, revoked, or downgraded to a level lower than the required access level.

Attachment 1, DoDM 5200.01-V3, Feb 24, 2012 Page 2 of 4

APPENDIX TO ENCLOSURE 3Change 2, 03/19/2013 51

(5) Protection shall be established and maintained for all devices or equipment that constitutes the entry control system. The level of protection may vary depending upon the type of device or equipment being protected.

(a) Location where authorization data and personal identification or verification data is input, stored, or recorded shall be protected.

(b) Card readers, keypads, communication or interface devices located outside the entrance to a controlled area shall have tamper resistant enclosures and be securely fastened to the wall or other permanent structure. Control panels located within a controlled area shall require only a minimal degree of physical security protection sufficient to preclude unauthorized access to the mechanism.

(c) Keypad devices shall be designed or installed in such a manner that an unauthorized person in the immediate vicinity cannot observe the selection of input numbers.

(d) Systems that use transmission lines to carry access authorizations, personal identification data, or verification data between devices or equipment located outside the controlled area shall have line supervision.

(e) Electric strikes used in access control systems shall be heavy duty, industrial grade.

(6) Access to records and information concerning encoded identification data and PINs shall be restricted. Access to identification or authorizing data, operating system software or any identifying data associated with the entry control system shall be limited to the fewest number of personnel as possible. Such data or software shall be kept secure when unattended.

(7) Records shall be maintained reflecting active assignment of identification badge and/or card, PIN, level of access, and similar system-related records. Records concerning personnel removed from the system shall be retained for at least 90 days. Records of entries shall be retained for at least 90 days or until investigations of system violations and incidents have been resolved and recorded. Such records shall be destroyed when no longer required in accordance with Reference (u) and DoD Component implementing directives and records schedules.

b. The Heads of DoD Components may approve the use of standardized AECS that meet the following criteria:

(1) For a Level 1 key card system, i.e., a key card bearing a magnetic stripe, the AECS shall provide a .95 probability of granting access to an authorized user providing the proper identifying information within three attempts. In addition, the system shall ensure an unauthorized user is granted access with less than 0.05 probability after three attempts to gain entry.

(2) For a Level 2 key card and PIN system, i.e., a key card bearing a magnetic stripe

Attachment 1, DoDM 5200.01-V3, Feb 24, 2012 Page 3 of 4

APPENDIX TO ENCLOSURE 3Change 2, 03/19/2013 52 used in conjunction with a PIN, the AECS shall provide a 0.97 probability of granting access to an authorized user providing the proper identifying information within three attempts. In addition, the system must ensure an unauthorized user is granted access with less than 0.010 probability after three attempts to gain entry have been made.

(3) For a Level 3 key card, i.e., a key card bearing a magnetic stripe used in conjunction with a PIN and biometrics identifier system, the AECS shall provide a 0.97 probability of granting access to an authorized user providing the proper identifying information within three attempts. In addition, the system shall ensure an unauthorized user is granted access with less than 0.005 probability after three attempts to gain entry have been made.

c. Electrical, mechanical, or electromechanical access control devices meeting the criteria stated below, may be used to control access to secure areas during duty hours if the entrance is under visual control. These devices are also acceptable to control access to compartmented areas within a secure area. Access control devices shall be installed in the following manner:

(1) The electronic control panel containing the mechanism for setting the combination shall be located inside the area. The control panel shall require only a minimal degree of physical security designed to preclude unauthorized access to the mechanism.

(2) The control panel shall be installed, or have a shielding device mounted, so that an unauthorized person in the immediate vicinity cannot observe the setting or changing of the combination.

(3) An individual cleared at the same level as the highest classified information controlled within the area shall select and set the combination.

(4) Electrical components, including wiring, or mechanical links (cables, rods, and so

on) shall be accessible only from inside the area, or, if they traverse an uncontrolled area, they shall be secured within conduit to preclude surreptitious manipulation of components.

Attachment 1, DoDM 5200.01-V3, Feb 24, 2012 Page 4 of 4

INTELLIGENCE COMMUNITY DIRECTIVE

NUMBER 705

SENSITIVE COMPARTMENTED INFORMATION FACILITIES

(EFFECTNE: 26 MAY ZOI~)

ICD 705

A. AUTHORITY : The National Security Act of 1947, as amended; Executive Order 12333, as amended; Executive Order 13526 ; and other applicable provisions of law .

B. PURPOSE

1 . This Directive establishes that all Intelligence Community (IC) Sensitive Compartmented Information Facilities (SCIF) shall comply with uniform IC physical and technical security requirements (hereinafter "uniform security requirements") . This Directive is designed to ensure the protection of Sensitive Compartmented Information (SCI) and foster efficient, consistent, and reciprocal use of SCIFs in the IC . This Directive applies to all facilities accredited by IC elements where SCI is processed, stored, used, or discussed .

2. This. Directive rescinds Director of Central Intelligence Directive (DCID) 6/9, Physical Security Standards for Sensitive Compartmented Information Facilities, including the Manual for Physical Security Standards for Sensitive Compartmented Information Facilities, and all DCID 6/9 Annexes . This Directive also rescinds IC Policy Memorandum (ICPM) 2005-700-1, Intelligence Community Update to Director of Central Intelligence (DCID) 6/9, Physical Security Standards for Sensitive Compartmented Information Facilities (SCIFs) ; ICPM 2006- 700-7, Intelligence Community Modifications to DCID 6/9, "Physical Security Standards for Sensitive Compartmented Information Facilities (SCIFs) " ; and ICPM 2007-700-2, Intelligence Community Modifications to Annex C of Director of Central Intelligence Directive 6/9, "Physical Security Standards for Sensitive Compartmented Information Facilities (SCIFs) . "

C. APPLICABILITY: This Directive applies to the IC, as defined by the National Security Act of 1947, as amended ; and such other elements of any other department or agency as may be designated by the President, or designated jointly by the Director of National Intelligence and the head of the department or agency concerned, as an element of the IC .

Attachment 2, ICD 705, 26 May, 2010 Page 1 of 3

D. POLICY

1 . All SCI must be processed, stored, used, or discussed in an accredited SCIF .

2 . All SCIFs shall comply with uniform security requirements . The Deputy Director of National Intelligence for Policy, Plans, and Requirements (DDNUPPR) shall issue an IC Standards) establishing these requirements no later than 90 days after the effective date of this Directive . The IC Standards) shall include, but is not limited to, risk mitigation factors, and specific categories and uses of SCIFs .

3 . All SCIFs shall be accredited prior to being used for the processing, storage, use, or discussion of SCI. IC elements may continue to operate SCIFs accredited as of the effective date of this Directive in accordance with physical and technical security requirements applicable at the time of the most recent accreditation or re-accreditation of a given SCIF . IC elements shall ensure that upon re-accreditation a given SCIF is compliant with the current uniform security requirements, unless the IC element head grants a waiver in accordance with section D .5 of this Directive. The DDNUPPR shall issue an 1C Standard(s) on SCIF accreditation, re-accreditation, and de-accreditation no later than 90 days after the effective date of this Directive .

4. The IC element head may accredit, re-accredit, and de-accredit SCIFs . This authority may be delegated by the IC element head to a single named official, who shall serve as the Accrediting Official . In accordance with mission need, the Accrediting Official may further delegate decision authority for the accreditation, re-accreditation, and de-accreditation of specific SCIFs while retaining overall responsibility for all such decisions .

5. The IC element head may grant a waiver of the uniform security requirements for a given SCIF, pursuant to a documented mission need . The IC element head may grant a waiver for exceptional circumstances where there is a documented mission need to exceed the uniform security requirements . The IC element head may, in exceptional circumstances, exempt SCIFs from reciprocal use by IC elements, as described in section D .7 of this Directive . The authorities established in this section may be delegated by the IC element head to a single named senior official, who could be the Cognizant Security Authority, and may not be further delegated . In no case may this official be the same person as the Accrediting Official identified pursuant to section D.4 of this Directive .

6. When the Accrediting Official believes that a waiver of the uniform security requirements for a given SCIF is warranted, he or she shall submit a written request for waiver to the IC element head, or the official to whom this role has been delegated per section D .S . The waiver request shall include a detailed statement of the mission need and the specific deviations from the uniform security requirements . All approved waivers shall be reported to the DDNUPPR immediately, but no later than 30 days after the IC element head's decision .

7. All SCIFs shall be constructed, operated, and maintained for reciprocal use by IC elements. SCIFs accredited without a waiver of the uniform security requirements shall be available for reciprocal use . When requesting a waiver of the uniform security requirements for a given SCIF, in accordance with section D .6 of this Directive, the Accrediting Official shall include in the request a recommendation on reciprocal use of the SCIF . The DDNUPPR shall

ICD 705

Attachment 2, ICD 705, 26 May, 2010 Page 2 of 3 issue an IC Standards) on the reciprocal use of SCIFs . The IC Standards) shall include, but is not limited to, provisions for exemptions based on mission need .

8 . For SCIFs that fall under Chief of Mission authority, IC elements shall comply with Overseas Security Policy Board (OSPB) standards, as defined in Department of State Foreign Affairs Handbook 12 FAH-6. IC elements shall submit all requests for waivers to OSPB standards to the Bureau of Diplomatic Security, Department of State, for approval . Waivers to OSPB standards must be received and approved prior to the commencement of any construction, renovation, or operations in the SCIF . IC elements shall conduct any activities subject to this section consistent with IC Directive 707, Center for Security Evaluation .

9 . The DDNUPPR shall manage an inventory of information on all SCIFs subject to this Directive, the scope, form, and format of which shall be established in consultation with IC elements. IC elements are responsible for providing to the DDNUPPR current information on all SCIFs, as soon as possible but no later than 180 days after the effective date of this Directive, and no later than 30 days thereafter in the case of updated or new information .

E. EFFECTIVE DATE: This Directive becomes effective on the date of signature .

Director of National Intelligence

Date

ICD 705Attachment 2, ICD 705, 26 May, 2010 Page 3 of 3

Attachment 3, First Floor Page 1of 1

Attachment 4, Second Floor Page 1 of 1