Answer_8_-_DoD_Manual_5200.01_Volume_3.pdf

DoDM 5200.01-V3, February 24, 2012

APPENDIX TO ENCLOSURE 3Change 2, 03/19/2013 45

APPENDIX TO ENCLOSURE 3

PHYSICAL SECURITY STANDARDS

1. VAULT AND SECURE ROOM CONSTRUCTION STANDARDS

a. Vaults. Vaults shall be constructed to meet Reference (al) as follows:

(1) Class A (concrete poured-in-place).

(2) Class B (GSA-approved modular vault meeting Reference (ao) specifications).

(3) Class C (steel-lined vault) is NOT authorized for protection of classified information.

b. Open Storage Area (Secure Room). This section provides the minimum construction standards for open storage areas.

(1) Walls, Floor, and Roof. Walls, floor, and roof shall be of permanent construction materials; i.e., plaster, gypsum wallboard, metal panels, hardboard, wood, plywood, or other materials offering resistance to and evidence of unauthorized entry into the area. Walls shall be extended from the true floor to the true ceiling and attached with permanent construction materials, mesh, or 18 gauge expanded steel screen.

(2) Ceiling. The ceiling shall be constructed of plaster, gypsum, wallboard material, hardware or any other acceptable material.

(3) Doors. Access doors shall be substantially constructed of wood or metal. For out-swing doors, hinge-side protection shall be provided by making hinge pins non-removable (e.g., spot welding) or by using hinges with interlocking leaves that prevent removal. Doors shall be equipped with a GSA-approved combination lock meeting FF-L-2740. Doors other than those secured with locks meeting FF-L-2740 shall be secured from the inside with deadbolt emergency egress hardware, a deadbolt, or a rigid wood or metal bar that extends across the width of the door.

(4) Windows

(a) Windows that are less than 18 feet above the ground measured from the bottom of the window, or are easily accessible by means of objects located directly beneath the windows, shall be constructed from or covered with materials that will provide protection from forced entry. The protection provided to the windows need be no stronger than the strength of the contiguous walls. Secure rooms which are located within a controlled compound or equivalent may eliminate the requirement for forced entry protection if the windows are made inoperable either by permanently sealing them or equipping them on the inside with a locking mechanism and they are covered by an IDS (either independently or by motion detection sensors within the area).

APPENDIX TO ENCLOSURE 3Change 2, 03/19/2013 46

(b) Windows, which might reasonably afford visual observation of classified activities within the facility shall be made opaque or equipped with blinds, drapes, or other coverings.

(5) Utility Openings. Utility openings such as ducts and vents shall be smaller than man-passable (96 square inches). An opening larger than 96 square inches (and over 6 inches in its smallest dimension) that enters or passes through an open storage area shall be hardened in accordance with Military Handbook 1013/1A (Reference (au)).

2. IDS STANDARDS

a. IDS Purpose. An IDS shall detect an unauthorized penetration into the secured area. An IDS shall be installed when results of a documented risk assessment determine its use as a supplemental control is warranted, in accordance with Enclosure 3, sections 3 and 4 of this Volume, and use is approved by the activity head. When used, all areas that reasonably afford access to the security container or areas where classified data is stored shall be protected by IDS unless continually occupied. An IDS complements other physical security measures and consists of:

(1) Intrusion detection equipment (IDE).

(2) Security forces.

(3) Operating procedures.

b. System Functions

(1) IDS components operate as a system with four distinct phases:

(a) Detection.

(b) Communications.

(c) Assessment.

(d) Response.

(2) These elements are equally important, and none can be eliminated if an IDS is to provide an acceptable degree of protection.

(a) Detection. During the detection phase, a detector or sensor senses and reacts to the stimuli it is designed to detect. The sensor alarm condition is then transmitted over cabling located within the protected area to the premise control unit (PCU). The PCU may service many sensors. The PCU and the sensors it serves comprise a zone at the monitor station (i.e., an

APPENDIX TO ENCLOSURE 3Change 2, 03/19/2013 47 alarmed zone).

(b) Communications. The PCU receives signals from all sensors in a protected area and incorporates these signals into a communication scheme. An additional signal is added to the communication for supervision to prevent compromise of the communication scheme (i.e., tampering or injection of false information by an intruder). The supervised signal is sent by the PCU through the transmission link to the monitor station. Inside the monitor station either a dedicated panel or central processor monitors information from the PCU signals. When an alarm occurs, an annunciator generates an audible and visible alert to security personnel. Alarms result normally from intrusion, tampering, component failure, or system power failure.

(c) Assessment. The assessment period is the first phase that requires human interaction. When alarm conditions occur, the operator assesses the situation and dispatches the response force.

(d) Response. The response phase begins as soon as the operator assesses an alarm condition. A response force shall immediately respond to all alarms. The response phase shall also determine the precise nature of the alarm and take all measures necessary to safeguard the secure area.

c. Acceptability of Equipment: All IDE must be Underwriters Laboratories (UL)-listed (or equivalent) and approved by the DoD Component. Government installed, maintained, or furnished systems are acceptable.

d. Transmission and Annunciation

(1) Transmission Line Security. When the transmission line leaves the facility and traverses an uncontrolled area, Class I or Class II line supervision shall be used.

(a) Class I. Class I security is achieved through the use of Data Encryption Standard or an algorithm based on the cipher feedback or cipher block chaining mode of encryption.

Certification by the National Institutes of Standards and Technology or another independent testing laboratory is required.

(b) Class II. Class II line supervision refers to systems in which the transmission is based on pseudo-random generated tones or digital encoding using an interrogation and response scheme throughout the entire communication, or UL Class AA line supervision. The signal shall not repeat itself within a minimum 6-month period. Class II security shall be impervious to compromise using resistance, voltage, current, or signal substitution techniques.

(2) Internal Cabling. The cabling between the sensors and the PCU shall be dedicated to IDE and shall comply with national and local code standards.

(3) Entry and/or Access Control Systems. If an entry and/or access control system is integrated into an IDS, reports from the automated entry and/or access control system shall be subordinate in priority to reports from intrusion alarms.

APPENDIX TO ENCLOSURE 3Change 2, 03/19/2013 48

(4) Maintenance Mode. When the alarm zone is placed in the maintenance mode, this condition shall be signaled automatically to the monitor station. The signal shall appear as an alarm or maintenance message at the monitor station and the IDS shall not be securable while in the maintenance mode. The alarm or message shall be continually visible at the monitor station throughout the period of maintenance. A standard operating procedure shall be established to address appropriate actions when maintenance access is indicated at the panel. All maintenance periods shall be archived in the system. A self-test feature shall be limited to one second per occurrence.

(5) Annunciation of Shunting or Masking Condition. Shunting or masking of any internal zone or sensor shall be appropriately logged or recorded in archive. A shunted or masked internal zone or sensor shall be displayed as such at the monitor station throughout the period the condition exists whenever there is a survey of zones or sensors.

(6) Indications of Alarm Status. Indications of alarm status shall be revealed at the monitoring station and optionally within the confines of the secure area.

(7) Power Supplies. Primary power for all IDE shall be commercial alternating or direct current (AC or DC) power. In the event of commercial power failure at the protected area or monitor station, the equipment shall change power sources without causing an alarm indication.

(a) Emergency Power. Emergency power shall consist of a protected independent backup power source that provides a minimum of 8 hours operating power battery and/or generator power. When batteries are used for emergency power, they shall be maintained at full charge by automatic charging circuits. The manufacturer’s periodic maintenance schedule shall be followed and results documented.

(b) Power Source and Failure Indication. An illuminated indication shall exist at the PCU of the power source in use (AC or DC). Equipment at the monitor station shall indicate a failure in power source, a change in power source, and the location of the failure or change.

(8) Component Tamper Protection. IDE components located inside or outside the secure area shall be evaluated for a tamper protection requirement. If access to a junction box or controller will enable an unauthorized modification, tamper protection shall be provided.

e. System Requirements

(1) Independent Equipment. When many alarmed areas are protected by one monitor station, secure room zones shall be clearly distinguishable from the other zones to facilitate a priority response. All sensors shall be installed within the protected area.

(2) Access and/or Secure Switch and PCU. No capability shall exist to allow changing the access status of the IDS from a location outside the protected area. All PCUs shall be located inside the secure area and should be located near the entrance. Assigned personnel shall initiate all changes in access and secure status. Operations of the PCU may be restricted by use of a

APPENDIX TO ENCLOSURE 3Change 2, 03/19/2013 49 device or procedure that verifies authorized use. In the secure mode, any unauthorized entry into the space shall cause an alarm to be transmitted to the monitor station.

(3) Motion Detection Protection. Secure areas that reasonably afford access to the security container or area where classified data is stored shall be protected with motion detection sensors; e.g., ultrasonic and passive infrared. Use of dual technology is authorized when one technology transmits an alarm condition independently from the other technology. A failed detector shall cause an immediate and continuous alarm condition.

(4) Protection of Perimeter Doors. When an IDS is installed, each perimeter door shall be protected by a balanced magnetic switch that meets UL Standard 634 (Reference (av)).

(5) Windows. All readily accessible windows (within 18 feet of ground level) shall be protected by an IDS, either independently or by the motion detection sensors within the space, whenever a secure room is located within a controlled compound or equivalent and forced entry protection of the windows is not provided (also see subparagraph 1.b.(4) of this Appendix).

(6) IDS Requirements for Continuous Operations Facilities. A continuous operation facility may not require an IDS. This type of secure area should be equipped with an alerting system if the occupants cannot observe all potential entrances into the room. Duress devices may also be required.

(7) False and/or Nuisance Alarm. Any alarm signal transmitted in the absence of detected intrusion that is not identified as a nuisance alarm is a false alarm. A nuisance alarm is the activation of an alarm sensor by some influence for which the sensor was designed but which is not related to an intrusion attempt. All alarms shall be investigated and the results documented. The maintenance program for the IDS shall ensure that incidents of false and/or nuisance alarms shall not exceed 1 in a period of 30 days per zone.

f. Installation, Maintenance and Monitoring

(1) IDS Installation and Maintenance Personnel. Alarm installation and maintenance shall be accomplished by U.S. citizens who have been subjected to a trustworthiness determination according to Reference (l).

(2) Monitor Station Staffing. The monitor station shall be supervised continuously by U.S. citizens who have been subjected to a trustworthiness determination according to Reference (l).

3. ACCESS CONTROLS

a. The perimeter entrance to a secure facility (i.e., vault or secure room) shall be under control at all times during working hours to prevent entry by unauthorized personnel. This may be achieved by visual control or through use of an automated entry control system (AECS) that complies with the requirements of subparagraph 3.a.(2) of this section. Uncleared persons are to

APPENDIX TO ENCLOSURE 3Change 2, 03/19/2013 50 be escorted within the facility by a cleared person who is familiar with the security procedures of the facility. Personnel entering or leaving an area shall be required to secure the entrance or exit point. Authorized personnel who permit another individual to enter the area are responsible for confirming their need to know and access.

(1) Visual control may be accomplished by methods such as designated employees, guards, or continuously monitored closed circuit television.

(2) An AECS may be used if it meets the criteria stated in subparagraphs 3.a.(2)(a) and 3.a.(2)(b). The AECS shall identify an individual and authenticate the person’s authority to enter the area through the use of an identification (ID) badge or card.

(a) The ID badge or key card shall use embedded sensors, integrated circuits, magnetic stripes, or other means of encoding data that identifies the facility and the individual to whom the card is issued.

(b) Biometrics verification identifies the individual requesting access by some unique personal characteristic and may be required for access to sensitive information. The Biometrics Identity Management Agency can provide further information regarding biometric technologies and capabilities. Personal characteristics that can be used for identity verification include:

1. Fingerprints.

2. Hand geometry.

3. Handwriting.

4. Iris scans.

5. Voice.

6. Facial recognition.

(3) In conjunction with subparagraph 3.a.(2)(a) of this section, a personal identification number (PIN) may be required. The PIN shall be separately entered into the system by each individual using a keypad device and shall consist of four or more digits, randomly selected, with no known or logical association with the individual. The PIN shall be changed when it is believed to have been compromised or subjected to compromise.

(4) Authentication of the individual’s authorization to enter the area shall be accomplished within the system by inputs from the ID badge and/or card, the personal identity verification device, or the keypad with an electronic database of individuals authorized to enter the area. A procedure shall be established for removing the individual’s authorization to enter the area upon reassignment, transfer, or termination, or when the individual’s access is suspended, revoked, or downgraded to a level lower than the required access level.

APPENDIX TO ENCLOSURE 3Change 2, 03/19/2013 51

(5) Protection shall be established and maintained for all devices or equipment that constitutes the entry control system. The level of protection may vary depending upon the type of device or equipment being protected.

(a) Location where authorization data and personal identification or verification data is input, stored, or recorded shall be protected.

(b) Card readers, keypads, communication or interface devices located outside the entrance to a controlled area shall have tamper resistant enclosures and be securely fastened to the wall or other permanent structure. Control panels located within a controlled area shall require only a minimal degree of physical security protection sufficient to preclude unauthorized access to the mechanism.

(c) Keypad devices shall be designed or installed in such a manner that an unauthorized person in the immediate vicinity cannot observe the selection of input numbers.

(d) Systems that use transmission lines to carry access authorizations, personal identification data, or verification data between devices or equipment located outside the controlled area shall have line supervision.

(e) Electric strikes used in access control systems shall be heavy duty, industrial grade.

(6) Access to records and information concerning encoded identification data and PINs shall be restricted. Access to identification or authorizing data, operating system software or any identifying data associated with the entry control system shall be limited to the fewest number of personnel as possible. Such data or software shall be kept secure when unattended.

(7) Records shall be maintained reflecting active assignment of identification badge and/or card, PIN, level of access, and similar system-related records. Records concerning personnel removed from the system shall be retained for at least 90 days. Records of entries shall be retained for at least 90 days or until investigations of system violations and incidents have been resolved and recorded. Such records shall be destroyed when no longer required in accordance with Reference (u) and DoD Component implementing directives and records schedules.

b. The Heads of DoD Components may approve the use of standardized AECS that meet the following criteria:

(1) For a Level 1 key card system, i.e., a key card bearing a magnetic stripe, the AECS shall provide a .95 probability of granting access to an authorized user providing the proper identifying information within three attempts. In addition, the system shall ensure an unauthorized user is granted access with less than 0.05 probability after three attempts to gain entry.

(2) For a Level 2 key card and PIN system, i.e., a key card bearing a magnetic stripe

APPENDIX TO ENCLOSURE 3Change 2, 03/19/2013 52 used in conjunction with a PIN, the AECS shall provide a 0.97 probability of granting access to an authorized user providing the proper identifying information within three attempts. In addition, the system must ensure an unauthorized user is granted access with less than 0.010 probability after three attempts to gain entry have been made.

(3) For a Level 3 key card, i.e., a key card bearing a magnetic stripe used in conjunction with a PIN and biometrics identifier system, the AECS shall provide a 0.97 probability of granting access to an authorized user providing the proper identifying information within three attempts. In addition, the system shall ensure an unauthorized user is granted access with less than 0.005 probability after three attempts to gain entry have been made.

c. Electrical, mechanical, or electromechanical access control devices meeting the criteria stated below, may be used to control access to secure areas during duty hours if the entrance is under visual control. These devices are also acceptable to control access to compartmented areas within a secure area. Access control devices shall be installed in the following manner:

(1) The electronic control panel containing the mechanism for setting the combination shall be located inside the area. The control panel shall require only a minimal degree of physical security designed to preclude unauthorized access to the mechanism.

(2) The control panel shall be installed, or have a shielding device mounted, so that an unauthorized person in the immediate vicinity cannot observe the setting or changing of the combination.

(3) An individual cleared at the same level as the highest classified information controlled within the area shall select and set the combination.

(4) Electrical components, including wiring, or mechanical links (cables, rods, and so

on) shall be accessible only from inside the area, or, if they traverse an uncontrolled area, they shall be secured within conduit to preclude surreptitious manipulation of components.

ENCLOSURE 4Change 2, 03/19/2013 53

ENCLOSURE 4

TRANSMISSION AND TRANSPORTATION

1. TRANSMISSION AND TRANSPORTATION PROCEDURES. Heads of the DoD Components shall establish procedures for transmitting and transporting classified information that maximizes the accessibility of classified information to individuals who are eligible for access thereto and minimizes the risk of compromise while permitting the use of the most cost-effective means. Persons transmitting or transporting classified information are responsible for ensuring that the intended recipient(s) are authorized access, have a need to know, and have the capability to store classified information in accordance with the requirements of this Manual.

a. COMSEC information shall be transmitted and transported according to NSA/CSS Policy Manual 3-16 (Reference (aw)).

b. NATO classified information, including NATO Restricted, shall be transmitted according to the requirements of Reference (ac).

2. DISSEMINATION OUTSIDE THE DEPARTMENT OF DEFENSE

a. Classified information originating in another DoD Component or in a department or agency other than the Department of Defense may be disseminated to other DoD Components, to other U.S. departments or agencies, or to a U.S. entity without the consent of the originating Component, department, or agency, as long as:

(1) The criteria for access in section 3 of Enclosure 2 of this Volume are met.

(2) The classified information is NOT marked as requiring prior authorization for dissemination to another department or agency. The marking “ORCON” may be used to identify information requiring prior authorization for dissemination to another department or agency.

(3) The document was created ON or AFTER June 27, 2010, the effective date of Reference (f) (however, also see paragraph 2.b of this section).

b. Documents created BEFORE June 27, 2010 may not be disseminated outside of the Department of Defense without the originator’s consent. Additionally, documents created on or after June 27, 2010, whose classification is derived from documents created prior to that date, and where the date before June 27, 2010 of the classified source(s) is readily apparent from the source list, shall not be disseminated outside of the Department of Defense without the originator’s consent.

c. Classified information originating in, or provided to or by, the Department of Defense may be disseminated to a foreign government or an international organization of governments, or any element thereof, in accordance with References (d), (f) and (z). See section 6 of this