Atch__23_-_Technical_Spec_for_ICD705_version1.2_April_23_2012.pdf

OFFICE OF THE DIRECTOR OF NATIONAL INTELLIGENCE NATIONAL COUNTERINTELLIGENCE EXECUTIVE

WASHINGTON, DC 20505

April 23, 2012

MEMORANDUM FOR: Distribution

SUBJECT: Technical Specifications for Construction and Management of Sensitive Compartmented

Information Facilities, Version 1.2

REFERENCES: A. Memorandum, Same Subject dated May 5, 2011

B. ICD 705, Sensitive Compartmented Information Facilities

C. ICS 705-1, Physical and Technical Standards for Sensitive Compartmented

Information Facilities

D. ICS 705-2, Standards for the Accreditation and Reciprocal Use of Sensitive

Compartmented Information Facilities

This memorandum promulgates Version 1.2 of the Technical Specifications for Construction and

Management of Sensitive Compartmented Information Facilities to the Intelligence Community which shall replace Version 1.1, effective immediately.

The Technical Specifications was designed to be a living document that enables periodic updates to keep up with changing and emerging technology. Based upon input from the Intelligence Community and as a result of a cooperative effort by physical and technical experts from the IC elements and our industrial partners, this Version 1.2 of the Technical Specifications has been updated to meet the needs of the community and enhance the standards identified in ICS 705-1, Physical Security Standards for

Sensitive Compartmented Information Facilities.

Questions may be directed to Mr. Robert Maher, Senior Policy Officer for Physical and Technical Security at 932-0773 (secure) or 7301-227-8561(non-secure).

Francisco Montoya Jr.

Attachments:

ICD 705 -Technical Specifications Version 1.2

Summary of Changes

Summary of changes to Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities

Cover – Change date and version

Page 3 – Added note to warn users of classification when associating threat information and facility location.

Page 4 – Re-worded approval of CAs to designate the AO as the primary approval authority of Compartmented Areas within SCIFs.

Pages 8-9 – Changed “Type X Gypsum” to “wallboard” to remove the standard of fire resistant gypsum and permit use of other wallboard types.

Pages 8-9 – Changed references to wall design drawings to “suggested” wall types to enable variety of wall construction techniques to meet the security standards.

Page 9 – Added explanation to glue and screw plywood to ceiling and floor to clarify standard. Stud placement changed to 16 on center to match drawing and correct error.

Page 9 – Added statement for runners at ceiling and floor in Walls B and C to clarify and equal Type A Wall.

Page 9 – Added statement to finish wall and paint from true floor to true ceiling in Walls B and C to clarify and equal Type A Wall.

Pages 18 – 19 Replaced drawings to reflect “suggested” wall construction methods and remove references to “Type X gypsum wallboard”.

Page 34 – Removed 5 minute forced entry standard – as agreed by the PTSEWG, security in depth of Chief of Mission facilities and enhanced walls were sufficient physical protection.

Page 53 – Updated FIPS encryption standards and certification to remove a standard that could not be met by commercial alarm systems.

55, 56, 63, and Fixed Facility Checklist – Replaced Federal Information Processing Standards (FIPS) 140-2 with Advanced Encryption Standard (AES) to remove a standard that could not be met by commercial alarm systems.

Page 83 – Added statement previously found in DCID 6/9 which reinforced the ability to allow TSCM and TEMPEST test equipment into SCIFs without inspection or delay.

Page 112 TEMPEST Checklist – Removed references to “inspectable space” as requested by the TEMPEST Advisory Group (TAG).

Page 113 TEMPEST Checklist – Removed references to “Red-SCI” information.

Page 114 TEMPEST Checklist – Removed parenthetical reference to cell phones and Bluetooth.

Pages 120 to 128 - Replaced Compartmented Area Checklist to reflect IC standards.

Pages 154 to 156 – Replaced Co-Use and MOA Form to include “joint-use” statements.

UNCLASSIFIED

TECHNICAL SPECIFICATIONS FOR CONSTRUCTION

AND MANAGEMENT OF SENSITIVE

COMPARTMENTED INFORMATION FACILITIES

VERSION 1.2

IC Tech Spec‐for ICD/ICS 705

An Intelligence Community Technical Specification Prepared by the

Office of the National Counterintelligence Executive

April 23, 2012 i

Table of Contents

Chapter 1. Introduction

A. Purpose

B. Applicability

Chapter 2. Risk Management

A. Analytical Risk Management Process

B. Security in Depth (SID)

C. Compartmented Area (CA)

Chapter 3. Fixed Facility SCIF Construction

A. Personnel

B. Construction Security

C. Perimeter Wall Construction Criteria

D. Floor and Ceiling Construction Criteria

E. SCIF Door Criteria

F. SCIF Window Criteria

G. SCIF Perimeter Penetrations Criteria

H. Alarm Response Time Criteria for SCIFs within the U.S

I. Secure Working Areas (SWA)

J. Temporary Secure Working Area (TSWA)

Chapter 4. SCIFs Outside the U.S. and NOT Under Chief of Mission (COM) Authority

A. General

B. Establishing Construction Criteria Using Threat Ratings

C. Personnel

D. Construction Security Requirements

E. Procurement of Construction Materials

F. Secure Transportation for Construction Material

G. Secure Storage of Construction Material

H. Technical Security

I. Interim Accreditations ii

Chapter 5. SCIFs Outside the U.S. and Under Chief of Mission Authority

A. Applicability

B. General Guidelines

C. Threat Categories

D. Construction Requirements

E. Personnel

F. Construction Security Requirements

G. Procurement of Construction Materials

H. Secure Transportation for Construction Material

I. Secure Storage of Construction Material

J. Technical Security

K. Interim Accreditations

Chapter 6. Temporary, Airborne, and Shipboard SCIFs

A. Applicability

B. Ground-Based T-SCIFs

C. Permanent and Tactical SCIFS Aboard Aircraft

D. Permanent and Tactical SCIFs on Surface or Subsurface Vessels

Chapter 7. Intrusion Detection Systems (IDS)

A. Specifications and Implementation Requirements

B. IDS Modes of Operation

C. Operations and Maintenance of IDS

D. Installation and Testing of IDS

Chapter 8. Access Control Systems (ACS)

A. SCIF Access Control

B. ACS Administration

C. ACS Physical Protection

D. ACS Recordkeeping

E. Using Closed Circuit Television (CCTV) to Supplement ACS

F. Non-Automated Access Control iii

Chapter 9. Acoustic Protection

A. Overview

B. Sound Group Ratings

C. Acoustic Testing

D. Construction Guidance for Acoustic Protection

E. Sound Transmission Mitigations

Chapter 10. Portable Electronic Devices (PEDs)

A. Approved Use of PEDs in a SCIF

B. Prohibitions

C. PED Risk Levels

D. Risk Mitigation

Chapter 11. Telecommunications Systems

A. Applicability

B. Unclassified Telephone Systems

C. Unclassified Information Systems

D. Using Closed Circuit Television (CCTV) to Monitor the SCIF Entry Point(s)

E. Unclassified Wireless Network Technology

F. Environmental Infrastructure Systems

G. Emergency Notification Systems

H. Systems Access

I. Unclassified Cable Control

J. References

Chapter 12. Management and Operations

A. Purpose

B. SCIF Repository

C. SCIF Management

D. SOPs

E. Changes in Security and Accreditation

F. General iv

G. Inspections

H. Control of Combinations

I. De-Accreditation Guidelines

J. Visitor Access

K. Maintenance

L. IDS and ACS Documentation Requirements

M. Emergency Plan

Chapter 13. Forms and Plans

Fixed Facility Checklist

TEMPEST Checklist

Compartmented Area Checklist

Shipboard Checklist

Aircraft/UAV Checklist

SCIF Co-Use Request and MOA

Construction Security Plan (CSP)

UNCLASSIFIED Chapter 1

Introduction

Chapter 1. Introduction

A. Purpose This Intelligence Community (IC) Technical Specification sets forth the physical and technical security specifications and best practices for meeting standards of Intelligence

Community Standard (ICS) 705-1 (Physical and Technical Standards for Sensitive

Compartmented Information Facilities). When the technical specifications herein are applied to new construction and renovations of Sensitive Compartmented Information Facilities

(SCIFs), they shall satisfy the standards outlined in ICS 705-1 to enable uniform and reciprocal use across all IC elements and to assure information sharing to the greatest extent possible. This document is the implementing specification for Intelligence Community

Directive (ICD) 705, Physical and Technical Security Standards for Sensitive

Compartmented Information Facilities (ICS-705-1) and Standards for Accreditation and

Reciprocal Use of Sensitive Compartmented Information Facilities (ICS-705-2) and supersedes Director of Central Intelligence Directive (DCID) 6/9.

The specifications contained herein will facilitate the protection of Sensitive Compartmented

Information (SCI) against compromising emanations, inadvertent observation and disclosure by unauthorized persons, and the detection of unauthorized entry.

B. Applicability IC Elements shall fully implement this standard within 180 days of its signature.

SCIFs that have been de-accredited but controlled at the SECRET level (IAW 32 Code of

Federal Regulations (CFR) parts 2001 and 2004) for less than one year may be reaccredited one time using the previous standard. The IC SCIF repository shall indicate that the accreditation was based upon the previous standards.

UNCLASSIFIED Chapter 2

Risk Management

Chapter 2. Risk Management

A. Analytical Risk Management Process

1. The Accrediting Official (AO) and the Site Security Manager (SSM) should evaluate each proposed SCIF for threats, vulnerabilities, and assets to determine the most efficient countermeasures required for physical and technical security. In some cases, based upon that risk assessment, it may be determined that it is more practical or efficient to mitigate a standard. In other cases, it may be determined that additional security measures should be employed due to a significant risk factor.

2. Security begins when the initial requirement for a SCIF is known. To ensure the integrity of the construction and final accreditation, security plans should be coordinated with the AO before construction plans are designed, materials ordered, or contracts let.

a) Security standards shall apply to all proposed SCI facilities and shall be coordinated with the AO for guidance and approval. Location of facility construction and or fabrication does not exclude a facility from security standards and or review and approval by the AO. SCI facilities include but are not limited to fixed facilities, mobile platforms, prefabricated structures, containers, modular applications or other new or emerging applications and technologies that may meet performance standards for use in SCI facility construction.

b) Mitigations are verifiable, non-standard methods that shall be approved by the

AO to effectively meet the physical/technical security protection level(s) of the standard. While most standards may be effectively mitigated via non-standard construction, additional security countermeasures and/or procedures, some standards are based upon tested and verified equipment (e.g., a combination lock meeting Federal Specification FF-L 2740A) chosen because of special attributes and could not be mitigated with non-tested equipment. The AO‟s approval is documented to confirm that the mitigation is at least equal to the physical/technical security level of the standard.

c) Exceeding a standard, even when based upon risk, requires that a waiver be processed and approved in accordance with ICD 705.

3. The risk management process includes a critical evaluation of threats, vulnerability, and assets to determine the need and value of countermeasures. The process may include the following:

a) Threat Analysis. Assess the capabilities, intentions, and opportunity of an adversary to exploit or damage assets or information. Reference the threat information provided in the National Threat Identification and Prioritization

Assessment (NTIPA) produced by the National Counterintelligence Executive

(NCIX) for inside the U.S. and/or the Overseas Security Policy Board (OSPB), Security Environment Threat List (SETL) for outside the U.S. to determine technical threat to a location. When evaluating for TEMPEST, the Certified

TEMPEST Technical Authorities (CTTA) shall use the National Security Agency

Information Assurance (NSA IA) list as an additional resource for specific technical threat information. NOTE: These threat documents are classified.

Associating the threat level or other threat information with the SCIF location

(including country, city, etc.) will normally carry the same classification level identified in the threat document. Ensure that SCIF planning documents and discussions that identify threat with the country or SCIF location are protected accordingly. It is critical to identify other occupants of common and adjacent buildings. (However, do not attempt to collect information against U.S. persons in violation of Executive Order (EO) 12333.) In areas where there is a diplomatic presence of high and critical threat countries, additional countermeasures may be necessary.

b) Vulnerability Analysis. Assess the inherent susceptibility to attack of a procedure, facility, information system, equipment, or policy.

c) Probability Analysis. Assess the probability of an adverse action, incident, or attack occurring.

d) Consequence Analysis. Assess the consequences of such an action (expressed as a measure of loss, such as cost in dollars, resources, programmatic effect/mission impact, etc.).

B. Security in Depth (SID)

1. SID describes the factors that enhance the probability of detection before actual penetration to the SCIF occurs. The existence of a layer or layers of security that offer mitigations for risks may be accepted by the AO. An important factor in determining risk is whether layers of security already exist at the facility. If applied, these layers may, with AO approval, alter construction requirements and extend security alarm response time to the maximum of 15 minutes. Complete documentation of any/all SID measures in place will assist in making risk decisions necessary to render a final standards decision.

2. SID is mandatory for SCIFs located outside the U.S. due to increased threat.

3. The primary means to achieve SID are listed below and are acceptable. SID requires that at least one of the following mitigations is applied:

a) Military installations, embassy compounds, U.S. Government (USG) compounds, or contractor compounds with a dedicated response force of U.S.

persons.

b) Controlled buildings with separate building access controls, alarms, elevator controls, stairwell controls, etc., required to gain access to the buildings or elevators. These controls shall be fully coordinated with a formal agreement or managed by the entity that owns the SCIF.

c) Controlled office areas adjacent to or surrounding SCIFs that are protected by alarm equipment installed in accordance with manufacturer‟s instructions. These controls shall be fully coordinated with a formal agreement or managed by the entity that owns the SCIF.

d) Fenced compounds with access controlled vehicle gate and/or pedestrian gate.

e) The AO may develop additional strategies to mitigate risk and increase probability of detection of unauthorized entry.

C. Compartmented Area (CA)

1. Definition

A CA is an area, room, or a set of rooms within a SCIF that provides controlled separation between control systems, compartments, sub-compartments, or Controlled

Access Programs.

2. Requirements

a) The CA shall be approved by the AO with the concurrence of the CA Program

Manager or designee. The CA Checklist (Chapter 13) shall be used to request approval.

b) Any construction or security requirements above those listed herein require prior approval from the element head as described in ICS 705-2.

3. Access Control

a) Access control to the CA may be accomplished by visual recognition or mechanical/electronic access control devices.

b) Spin-dial combination locks shall not be installed on CA doors.

c) Independent alarm systems shall not be installed in a CA.

4. Visual Protection of CA Workstations

If compartmented information will be displayed on a computer terminal or group of terminals in an area where everyone is not accessed to the program, the following measures may be applied to reduce the ability of “shoulder surfing” or inadvertent viewing of compartmented information:

Position the computer screen away from doorway/cubicle opening.

Use a polarizing privacy screen.

Use partitions and/or signs.

Existing private offices or rooms may be used but may not be a mandatory requirement.

5. Closed Storage

When the storage, processing, and use of compartmented information, product, or deliverables is required, and all information shall be stored while not in use, then all of the following shall apply:

a) Access and visual controls identified above shall be the standard safeguard.

b) Compartmented information shall be physically stored in a General Services

Administration (GSA) approved safe.

6. Open Storage

In rare instances when open storage of information is required, the following apply:

a) If the parent SCIF is accredited for open storage, a private office with access control on the door is adequate physical security protection.

b) If the parent SCIF has been built and accredited for closed storage, then the

CA perimeter shall be constructed and accredited to open storage standards.

c) The CA AO may approve open or closed storage within the CA. Storage requirements shall be noted in both the CA Fixed Facility Checklist (FFC) and, if appropriate, in a Memorandum of Understanding (MOU).

7. Acoustic and Technical Security

a) All TEMPEST, administrative telephone, and technical surveillance countermeasure (TSCM) requirements for the parent SCIF shall apply to the CA and shall be reciprocally accepted.

b) When compartmented discussions are required, the following apply:

(1) Use existing rooms that have been accredited for SCI discussions.

(2) Use administrative procedures to restrict access to the room during conversations.

UNCLASSIFIED Chapter 3

Fixed Facility SCIF Construction

Chapter 3. Fixed Facility SCIF Construction

Requirements outlined within this chapter apply to all fixed facility SCIFs. Additional information and requirements for facilities located outside the U.S., its possessions or territories, are found in Chapters 4 and 5. Additional information and requirements for temporary SCIFs are described in Chapter 6.

A. Personnel

Roles and responsibilities of key SCIF construction personnel are identified in ICS 705-1 and restated here for reference.

1. AO Responsibilities

a) Provide security oversight of all aspects of SCIF construction under their security purview.

b) Review and approve the design concept, Construction Security Plan (CSP), and final design for each construction project prior to the start of SCIF construction.

c) Depending on the magnitude of the project, shall determine if the Site Security

Manager (SSM) performs duties on a full-time, principal basis, or as an additional duty to on-site personnel.

d) Accredit SCIFs under their cognizance.

e) Prepare waiver requests for the IC element head or designee.

f) Provide the timely input of all required SCIF data to the IC SCIF repository.

g) Consider SID on USG or USG-sponsored contractor facilities to substitute for standards herein. (SID shall be documented in the CSP and the FFC.)

2. Site Security Managers (SSMs) Responsibilities

a) Ensure the requirements herein are implemented and advise the AO of compliance or variances.

b) In consultation with the AO, develop a CSP regarding implementation of the standards herein. (This document shall include actions required to document the project from start to finish.)

c) Conduct periodic security inspections for the duration of the project to ensure compliance with the CSP.

d) Document security violations or deviations from the CSP and notify the AO within 3 business days.

e) Ensure that procedures to control site access are implemented.

3. CTTA Responsibilities

a) Review SCIF construction or renovation plans to determine if TEMPEST countermeasures are required and recommend solutions. (To the maximum extent practicable, TEMPEST mitigation requirements shall be incorporated into the SCIF design.)

b) Provide the Cognizant Security Authority (CSA)AO with documented results of review with recommendations.

4. Construction Surveillance Technicians (CSTs) Responsibilities

Supplement site access controls, implement screening and inspection procedures, as well as monitor construction and personnel, when required by the AO

B. Construction Security

1. Prior to awarding a construction contract, a CSP for each project shall be developed by the SSM and approved by the AO.

2. Construction plans and all related documents shall be handled and protected in accordance with the CSP.

3. For SCIF renovation projects, barriers shall be installed to segregate construction workers from operational activities and provide protection against unauthorized access and visual observation. Specific guidance shall be contained in the CSP.

4. Periodic security inspections shall be conducted by the SSM or designee for the duration of the project to ensure compliance with construction design and security standards.

5. Construction and design of SCIFs should be performed by U.S. companies using U.S.

citizens to reduce risk, but may be performed by U.S. companies using U.S. persons (an individual who has been lawfully admitted for permanent residence as defined in 8

U.S.C. 1 101(a)(20) or who is a protected individual as defined by Title 8 U.S.C. 1 324b

(a)(3)). The AO shall ensure mitigations are implemented when using non-U.S. citizens.

These mitigations shall be documented in the CSP.

6. All site control measures used shall be documented in the CSP. Among the control measures that may be considered are the following:

Identity verification.

Random searches at site entry and exit points.

Signs at all entry points listing prohibited and restricted items (e.g., cameras, firearms, explosives, drugs, etc.).

Physical security barriers to deny unauthorized access.

Vehicle inspections.

C. Perimeter Wall Construction Criteria

1. General

a) SCIF perimeters include all walls that outline the SCIF confines, floors, ceilings, doors, windows and penetrations by ductwork, pipes, and conduit. This section describes recommended methods to meet the standards described within ICS 705-1 for SCIF perimeters.

b) Perimeter wall construction specifications vary by the type of SCIF, location, use of SID, and discussion requirements.

c) Closed storage areas that do not require discussion areas do not have any forced entry or acoustic requirements.

d) Open storage facilities without SID require additional protection against forced and surreptitious entry.

e) When an existing wall is constructed with substantial material (e.g., brick, concrete, cinderblock, etc.) equal to meet the perimeter wall construction standards, the existing wall may be utilized to satisfy the specification.

2. Closed Storage, Secure Working Area (SWA), Continuous Operation, or Open

Storage with SID - Use Wall A - Suggested Standard Acoustic Wall (see construction drawing for details).

a) Three layers of ⅝ inch-thick wallboard, one layer on the outside of the SCIF and two on the inside of the SCIF provide adequate rigidity and acoustic protection

(Sound Class 3).

b) Wallboard shall be attached to 3 ⅝ inch-wide metal studs or wooden 2 x 4 studs placed a maximum of 24 inches on center.

c) Continuous runners (same gauge as studs) for securing studs shall be anchored to the true floor and true ceiling structures.

d) The interior two layers of wallboard shall be mounted so that the seams do not align (i.e., stagger joints).

e) Acoustic fill shall be placed between the studs in a manner which prevents slippage.

f) The top and bottom of each wall shall be sealed with an acoustic sealant where it meets the slab.

g) Wall penetrations shall be treated and sealed with acoustic material.

h) Entire wall assembly shall be finished and painted from true floor to true ceiling.

3. Open Storage without SID -- Use Wall B - Suggested Wall for Expanded Metal or

Wall C - Suggested Wall for Plywood.

a) Three layers of ⅝ inch-thick wallboard, one layer on the outside of the SCIF and two on the inside of the SCIF provide adequate rigidity and acoustic protection

(Sound Class 3).

b) Metal studs shall be 3 ⅝ inch-wide, 16 gauge metal, mounted a maximum of 16 inches on center.

c) Wooden studs will be 2 x 4 studs mounted a maximum of 16 inches on center.

d) Continuous runners (same gauge as studs) for securing studs shall be anchored to the true floor and true ceiling structures.

e) Wall B - Suggested Wall for Expanded Metal (see drawing for Wall B-Suggested

Construction for Expanded Metal).

(1) Three-quarter inch mesh, # 9 (10 gauge) expanded metal shall be affixed to the interior side of all SCIF perimeter wall studs.

(2) Expanded metal shall be spot-welded to the studs every six inches along the length of each vertical stud and at the ceiling and floor.

(3) Hardened screws with one inch washers or hardened clips may be used in lieu of welding to fasten metal to the studs. Screws shall be applied every six inches along the length of each vertical stud and at the ceiling and floor.

(4) Fastening method shall be noted in the FFC.

(5) Entire wall assembly shall be finished and painted from true floor to true ceiling.

f) Wall C - Suggested Wall for Plywood (see drawing for Wall C-Suggested

Construction for Plywood).

(1) Two layers of ⅝ inch-thick wallboard, one layer on the outside of the SCIF and one on the inside of the SCIF. A plywood layer shall substitute one layer of wallboard on the inside wall as compared to the standard acoustic wall.

(2) Wallboard shall be attached to 3 ⅝ inch-wide metal studs or wooden 2 x 4 studs placed a maximum of 16 inches on center.

(3) Continuous runners (same gauge as studs) for securing studs shall be anchored to the true floor and true ceiling structures.

(4) One layer of ⅝ inch-thick plywood shall be attached vertically, directly to the wall studs.

(5) The plywood shall be continuously glued and screwed to the studs every 12 inches along the length of each stud and at the ceiling and floor .

(6) Entire wall assembly shall be finished and painted from true floor to true ceiling.

4. Radio Frequency (RF) Protection for Perimeter Walls

a) RF protection shall be installed at the direction of the CTTA when a SCIF utilizes electronic processing and does not provide adequate RF attenuation at the inspectable space boundary. It is recommended for all applications where RF interference from the outside of the SCIF is a concern inside the SCIF.

b) Installation of RF protection should be done using either the drawings or Best

Practices Guidelines for Architectural Radio Frequency Shielding, prepared by the

Technical Requirements Steering Committee under the Center for Security

Evaluation. This document is available through the Center for Security Evaluation, Office of the Director of National Intelligence (ONCIX/CSE).

5. Vault Construction Criteria

GSA-approved modular vaults meeting Federal Specification AA-V-2737 or one of the following construction methods may be used:

a) Reinforced Concrete Construction

(1) Walls, floor, and ceiling will be a minimum thickness of eight inches of reinforced concrete.

(2) The concrete mixture will have a comprehensive strength rating of at least

2,500 pounds per square inch (psi).

(3) Reinforcing will be accomplished with steel reinforcing rods, a minimum of

⅝ inches in diameter, positioned centralized in the concrete pour and spaced horizontally and vertically six inches on center; rods will be tied or welded at the intersections.

(4) The reinforcing is to be anchored into the ceiling and floor to a minimum depth of one-half the thickness of the adjoining member.

b) Steel-Lined Construction Where Unique Structural Circumstances Do Not Permit

Construction of a Concrete Vault

(1) Construction will use ¼ inch-thick steel alloy-type plates having characteristics of high-yield and high-tensile strength.

(2) The steel plates are to be continuously welded to load-bearing steel members of a thickness equal to that of the plates.

(3) If the load-bearing steel members are being placed in a continuous floor and ceiling of reinforced concrete, they must be firmly affixed to a depth of one-half the thickness of the floor and ceiling.

(4) If floor and/or ceiling construction is less than six inches of reinforced concrete, a steel liner is to be constructed the same as the walls to form the floor and ceiling of the vault. Seams where the steel plates meet horizontally and vertically are to be continuously welded together.

All vaults shall be equipped with a GSA-approved Class 5 vault door.

D. Floor and Ceiling Construction Criteria

1. Floors and ceilings shall be constructed to meet the same standards for force protection and acoustic protection as walls.

2. All floor and ceiling penetrations shall be kept to a minimum.

E. SCIF Door Criteria

1. There shall be only one primary SCIF entrance where visitor control is conducted.

a) Primary entrance doors shall be equipped with the following:

(1) A GSA-approved pedestrian door deadbolt meeting Federal Specification FF-

L- 2890.

(2) A combination lock meeting Federal Specification FF-L 2740A.

(3) An approved access-control device (see Chapter 8).

(4) May be equipped with a high security keyway for use in the event of an access control system failure.

b) With AO approval, additional entrance doors may be designated for use by SCIF residents provided that the doors are equipped with an approved access control system and are secured with an approved dead bolt or lock when the SCIF is not occupied. The dead-bolt shall not be accessible from the exterior.

2. When practical, entrance doors should incorporate a vestibule to preclude visual observation and enhance acoustic protection.

3. All perimeter SCIF doors shall be equipped with an automatic, non-hold door-closer which shall be installed internal to the SCIF, if possible.

4. Emergency exit doors shall:

Be secured with deadlocking panic hardware on the inside.

Have no exterior hardware.

Be alarmed 24/7.

Provide a local audible annunciation when opened.

5. Hinge pins that are accessible from outside of the SCIF door shall be modified to prevent removal of the door, e.g., welded, set screws, etc.

6. SCIF doors and frame assemblies shall meet acoustic requirements as described in

Chapter 9 unless declared a non-discussion area.

7. All perimeter doors shall be alarmed in accordance with Chapter 7.

8. Perimeter doors shall comply with applicable building, safety, and accessibility codes and requirements.

9. Perimeter doors shall meet TEMPEST requirements when applicable.

10. Wood doors shall be 1 ¾ inch-thick solid wood core (wood stave).

11. Steel doors shall meet following specifications:

1 ¾ inch-thick face steel equal to 18 gauge.

Hinges reinforced to 7 gauge.

Door closure reinforced to 12 gauge.

Lock area predrilled and/or reinforced to 10 gauge.

12. A vault door shall not be used to control day access to a facility. To mitigate both security and safety concerns, a vestibule with an access control device may be constructed.

13. Roll-up Door Specifications

a) A roll-up door cannot be treated for acoustics and shall only be located in an area of the SCIF that is designated as a non-discussion area.

b) Roll-up doors shall be 18 gauge steel or greater and shall be secured inside the

SCIF using dead-bolts on both the right and left side of the door.

14. Double Door Specifications

a) One of the doors shall be secured at the top and bottom with deadbolts.

b) An astragal strip shall be attached to one door (could be either the secured or the movable door depending on the inward/outward swing of door assembly) to prevent observation of the SCIF through the cracks between the doors.

c) Each door shall have an independent high-security switch.

F. SCIF Window Criteria

1. Every effort should be made to minimize or eliminate windows in the SCIF, especially on the ground floor.

2. Windows shall be non-opening.

3. Windows shall be protected by security alarms in accordance with Chapter 7 when they are within 18 feet of the ground or an accessible platform.

4. Windows shall provide visual and acoustic protection.

5. Windows shall be treated to provide RF protection when recommended by the CTTA.

6. All windows less than 18 feet above the ground or from the nearest platform affording access to the window (measured from the bottom of the window), shall be protected against forced entry and meet the standard for the perimeter.

G. SCIF Perimeter Penetrations Criteria

1. All penetrations of perimeter walls shall be kept to a minimum.

2. Metallic penetrations may require TEMPEST countermeasures, to include dielectric breaks or grounding, when recommended by the CTTA.

3. Utilities servicing areas other than the SCIF shall not transit the SCIF unless mitigated with AO approval.

4. Utilities should enter the SCIF at a single point.

5. All utility (power and signal) distribution on the interior of a perimeter wall treated for acoustics or RF shall be surface mounted, contained in a raceway, or an additional wall shall be constructed using furring strips as stand-off from the existing wall assembly.

If the construction of an additional wall is used, gypsum board may be ⅜ inch-thick and need only go to the false ceiling.

6. Installation of additional conduit penetration for future utility expansion is permissible provided the expansion conduit is filled with acoustic fill and capped (end of pipe cover).

7. Vents and Ducts

a) All vents and ducts shall be protected to meet the acoustic requirements of the

SCIF. (See Figure 4, Typical Air (Z) Duct Penetration, for example.)

b) Walls surrounding duct penetrations shall be finished to eliminate any opening between the duct and the wall.

c) All vents or duct openings that penetrate the perimeter walls of a SCIF and exceed

96 square inches shall be protected with permanently affixed bars or grills.

(1) If one dimension of the penetration measures less than six inches, bars or grills are not required.

(2) When metal sound baffles or wave forms are permanently installed and set no farther apart than six inches in one dimension, then bars or grills are not required.

(3) If bars are used, they shall be a minimum of ½ inch diameter steel, welded vertically and horizontally six inches on center; a deviation of ½ inch in vertical and/or horizontal spacing is permissible.

(4) If grills are used, they shall be of ¾ inch-mesh, #9 (10 gauge), case-hardened, expanded metal.

(5) If bars or grill are required, an access port shall be installed inside the secure perimeter of the SCIF to allow visual inspection of the bars or grill. If the area outside the SCIF is controlled (SECRET or equivalent proprietary space), the inspection port may be installed outside the perimeter of the SCIF and be secured with an AO-approved high-security lock. This shall be noted in the FFC.

H. Alarm Response Time Criteria for SCIFs within the U.S.

Response times for Intrusion Detection Systems (IDS) shall meet 32 CFR Parts 2001 and

2004.

a) Closed Storage response time of 15 minutes.

b) Open Storage response time within 15 minutes of the alarm annunciation if the area is covered by SID or a five minute alarm response time if it is not.

I. Secure Working Areas (SWA)

SWAs are accredited facilities used for discussing, handling, and/or processing SCI, but where SCI will not be stored.

1. The SWA shall be controlled at all times by SCI-indoctrinated individuals or secured with a GSA-approved combination lock.

2. The SCIF shall be alarmed in accordance with Chapter 7 with an initial alarm response time of 15 minutes.

3. Access control shall be in accordance with Chapter 8.

4. Perimeter construction shall comply with section 3.C. above.

5. All SCI used in an SWA shall be removed and stored in GSA-approved security containers within a SCIF, a vault, or be destroyed when the SWA is unoccupied.

J. Temporary Secure Working Area (TSWA)

TSWAs are accredited facilities where handling, discussing, and/or processing of SCI is limited to less than 40-hours per month and the accreditation is limited to 12 months or less. Extension requests require a plan to accredit as a SCIF or SWA. Storage of SCI is not permitted within a TSWA.

1. When a TSWA is in use at the SCI level, access shall be limited to SCI- indoctrinated persons.

2. The AO may require an alarm system.

3. No special construction is required.

4. When the TSWA is approved for SCI discussions, sound attenuation specifications of

Chapter 9 shall be met.

5. The AO may require a TSCM evaluation if the facility has not been continuously controlled at the SECRET level.

6. When the TSWA is not in use at the SCI level, the following shall apply:

a) The TSWA shall be secured with a high-security, AO-approved key or combination lock.

b) Access shall be limited to personnel possessing a minimum U.S. SECRET clearance.

Figure 1

Wall A – Suggested Standard Acoustic Wall Construction

Controlled Area Uncontrolled Area

1. Depending on height true floor to true ceiling and weight, metal studs shall be in the range of 20 Gauge to 16 gauge.

Bottom of Deck

Sealant all around Duct Openings or Pipe/Conduit Penetrations

**5/8” gypsum wallboard

3 ½ “ sound attenuation material, fastened in such a way as to prevent it from sliding down and leaving void at the top.

Acoustical Ceiling with metal angle moldings and steel support grid systems

Fire - Safe or non - shrink grout in all voids above track.

Wall Finish as scheduled with finish continuous above any false ceiling

5/8” gypsum wallboard – sound group 4 requires additional layer of 5/8” wallboard

Wall Base and Scheduled flooring

Continuous track (Top &Bottom) w/ anchors at 32 ” o.c . maximum – Bed in continuous beads of acoustical sealant

2 CTTA recommended countermeasures (foil backed wallboard or R-foil ) shall be installed

IAW Best Practice Guidelines For Architectural Radio Frequency Shielding.

3. Any electrical or communications outlets required on perimeter walls shall be surface mounted.

Figure 2. Wall B - Suggested Construction for Expanded Metal

Fire saf e or non - shrink grout in all voids above track

5/8" Gypsum Wall Board (GWB) on 5/8”

16 gauge metal stud framing at 16” o.c.

Acoustical ceiling with metal

Angle moldings & support grid system

Wall Finish as scheduled –

Ensure finish is continuous above any

Acoustical (“false”) ceiling

¾” #9 10 gauge expanded metal spot

Welded every 6” or screwed with

Washers or fastener system to vertical

Every 6” to 16 gauge studs and to

Deck and floor track

16 gauge continuous track (Top &

Bottom) w/anchors at 32” o.c.

(maximum) – Bed in 2 continuous

Beads of acoustic sealant

Wall Base as scheduled

Floor Finish as scheduled

Notes:

1 This detail is intended for 'new construction' -- AO must approve any variations in expanded metal use

2 CTTA recommended countermeasures (foil backed wallboard or R-foil ) shall be installed IAW Best Practice Guidelines for Architectural Radio Frequency Shielding.

3. Any electrical or communications outlets required on perimeter walls shall be surface mounted.

Controlled Area Uncontrolled Area

16 gauge metal stud framing at 16” o.c.

Acoustic material – material shall be

Fastened in such a way as to prevent

It from sliding down and leaving a

Void at the top.

Figure 3 Wall C – Suggested Construction for Plywood

Fire saf e or non - shrink grout in all voids above track

16 gauge metal stud framing at 16” o.c.

Acoustical ceiling with metal

Angle moldings & support grid system

Wall Finish as scheduled –

Ensure finish is continuous above any

Acoustical (“false”) ceiling

5/8” plywood affixed 8 ft vertical

And 4 ft horizontal to 16 gauge studs, And Deck and floor track

With glue and screwed with steel #10

Self-tapping screws every 12 inches

16 gauge continuous track (Top &

Bottom) w/anchors at 32” o.c.

(maximum) – Bed in 2 continuous

Beads of acoustic sealant

Wall Base as scheduled

Floor Finish as scheduled

Notes:

1 This detail is intended for 'new construction' -- AO must approve any variations in expanded metal use

2 CTTA recommended countermeasures (foil backed wallboard or R-foil ) shall be installed IAW Best Practice Guidelines for Architectural Radio Frequency Shielding.

3. Any electrical or communications outlets required on perimeter walls shall be surface mounted.

Controlled Area Uncontrolled Area

16 gauge metal stud framing at 16” o.c.

Acoustic material – material shall be

Fastened in such a way as to prevent

It from sliding down and leaving a

Void at the top.

Figure 4

Typical Perimeter Air (Z) Duct Penetration

Acoustically rated partition (Plan view)

Acoustically lined, thru-wall sheet metal transfer duct

Man-bar at partition if duct opening size exceeds 96 SI

Rev. 04-05

3x x

Access hatch (In bottom of duct)

SECURE SIDE

SECURE SIDE

3x min.

UNCLASSIFIED Chapter 4

SCIFs Outside the U.S. and NOT Under COM

Chapter 4. SCIFs Outside the U.S. and NOT Under Chief of Mission (COM)

Authority

A. General

1. Requirements outlined here apply only to SCIFs located outside of the U.S., its territories and possessions, that are not under COM authority.

2. The application and effective use of SID may allow AOs to deviate from this guidance at Category II and III facilities.

B. Establishing Construction Criteria Using Threat Ratings

1. The Department of State‟s (DoS) Security Environment Threat List (SETL) shall be used in the selection of appropriate construction criteria based on technical threat rating.

2. If the SETL does not have threat information for the city of construction, the SETL threat rating for the closest city within a given country shall apply. When only the capital is noted, it will represent the threat for all SCIF construction within that country.

3. Based on technical threat ratings, building construction has been divided into the following three categories for construction purposes:

Category I - Critical or High Technical Threat, High Vulnerability Buildings

Category II - High Technical Threat, Low Vulnerability Buildings

Category III - Low and Medium Technical Threat

4. Facilities in Category I Areas

a) Open Storage Facilities

(1) Open storage is to be avoided in Category I areas. The head of the IC element shall certify mission essential need and approve on case-by-case basis.

When approved, open storage should only be allowed when the host facility is manned 24-hours-per-day by a cleared U.S. presence or the SCIF is continuously occupied by U.S. SCI-indoctrinated personnel.

(2) SCI shall be contained within approved vaults or Class M or greater modular vaults.

(3) The SCIF shall be alarmed in accordance with Chapter 7.

(4) Access control shall be in accordance with Chapter 8.

(5) An alert system and/or duress alarm is recommended.

(6) Initial alarm response time shall be five minutes.

b) Closed Storage Facilities

(1) The SCIF perimeter shall provide five minutes of forced-entry protection.

(Refer to Wall B or Wall C construction methods.)

(2) The SCIF shall be alarmed in accordance with Chapter 7.

(3) Access control system shall be in accordance with Chapter 8.

(4) SCI shall be stored in GSA-approved containers or in an area that meets vault construction standards.

(5) Initial alarm response time shall be within 15 minutes.

c) Continuous Operation Facilities

(1) An alert system and duress alarm is required.

(2) The capability shall exist for storage of all SCI in GSA-approved security containers or vault.

(3) The emergency plan shall be tested semi-annually.

(4) Perimeter walls shall comply with enhanced wall construction methods in accordance Wall B or C standards.

(5) The SCIF shall be alarmed in accordance with Chapter 7.

(6) Access control shall be in accordance with Chapter 8.

(7) Initial response time shall be five minutes.

d) SWAs

Construction and use of SWAs is not authorized for facilities in Category I areas because of the significant risk to SCI.

e) TSWAs

Construction and use of TSWAs is not authorized for facilities in Category I areas because of the significant risk to SCI.

5. Facilities in Category II and III Areas

a) Open Storage Facilities

(1) Open storage is to be avoided in Category II areas. The head of the IC element shall certify mission essential need and approve on case-by-case basis.

When approved, open storage should only be allowed when the host facility is manned 24-hours-per-day by a cleared U.S. presence or the SCIF is continuously occupied by U.S. SCI-indoctrinated personnel.

(2) In Category III areas, open storage should only be allowed when the host facility is manned 24-hours-per-day by a cleared U.S. presence or the SCIF is continuously occupied by U.S. SCI-indoctrinated personnel.

(3) The SCIF perimeter shall provide five minutes of forced-entry protection.

(Refer to Wall B or Wall C construction methods.)

(4) The SCIF shall be alarmed in accordance with Chapter 7.

(5) Access control shall be in accordance with Chapter 8.

(6) An alert system and/or duress alarm is recommended.

(7) Initial alarm response time shall be five minutes.

b) Closed Storage Facilities

(1) The SCIF perimeter shall provide five minutes of forced-entry protection.

(Refer to Wall B or Wall C construction methods.)

(2) The SCIF must be alarmed in accordance with Chapter 7.

(3) Access control system shall be in accordance with Chapter 8.

(4) SCI shall be stored in GSA-approved containers.

(5) Initial alarm response time shall be within 15 minutes.

c) Continuous Operation Facilities

(1) Wall A - Standard wall construction shall be utilized.

(2) The SCIF shall be alarmed in accordance with Chapter 7.

(3) Access control shall be in accordance with Chapter 8.

(4) Initial response time shall be five minutes.

(5) An alert system and/or duress alarm is recommended.

(6) The capability shall exist for storage of all SCI in GSA-approved security containers.

(7) The emergency plan shall be tested semi-annually.

d) SWAs

(1) Perimeter walls shall comply with standard Wall A construction.

(2) The SCIF shall be alarmed in accordance with Chapter 7.

(3) Access control shall be in accordance with Chapter 8.

(4) Initial alarm response time shall be within 15 minutes.

(5) The SWA shall be controlled at all times by SCI-indoctrinated individuals or secured with a GSA-approved combination lock.

(6) An alert system and/or duress alarm is recommended.

(7) All SCI used in an SWA shall be removed and stored in GSA-approved security containers within a SCIF or be destroyed.

(8) The emergency plan shall be tested semi-annually.

e) TSWAs

(1) No special construction is required.

(2) The AO may require an alarm system.

(3) When the TSWA is approved for SCI discussions, sound attenuation specifications of Chapter 9 shall be met.

(4) When a TSWA is in use at the SCI level, access shall be limited to SCI-indoctrinated persons.

(5) The AO may require a TSCM evaluation if the facility has not been continuously controlled at the SECRET level.

(6) When a TSWA is not in use at the SCI level, the following shall apply:

(a) The TSWA shall be secured with a high security, AO-approved key or combination lock.

(b) Access shall be limited to personnel possessing a U.S. SECRET clearance.

C. Personnel

1. SSM Responsibilities

a) Ensures the security integrity of the construction site (hereafter referred to as the

“site”).

b) Develops and implements a CSP.

c) Ensures that the SSM shall have 24-hour unrestricted access to the site (or alternatives shall be stated in CSP).

d) Conducts periodic security inspections for the duration of the project to ensure compliance with the CSP.

e) Documents security violations or deviations from the CSP and notifies the AO.

f) Maintains a list of all workers used on the project; this list shall become part of the facility accreditation files.

g) Implements procedures to deny unauthorized site access.

h) Works with the construction firm(s) to ensure security of the construction site and compliance with the requirements set forth in this document.

i) Notifies the AO if any construction requirements cannot be met.

2. CST Requirements and Responsibilities

a) Possesses U. S. TOP SECRET clearances.

b) Is specially trained in surveillance and the construction trade to deter technical penetrations and thwart implanted technical collection devices.

c) Supplements site access controls, implements screening and inspection procedures, and, when required by the CSP, monitors construction and personnel.

d) Is not required when U.S. TOP SECRET-cleared contractors are used

e) In Category III countries, must do the following:

(1) Shall begin surveillance of non-cleared workers at the start of SCIF construction or the installation of major utilities, whichever comes first.

(2) Upon completion of all work, shall clear and secure the areas for which they are responsible prior to turning control over to the cleared American guards

(CAGs).

f) In Category I and II countries, must do the following:

(1) Shall begin surveillance of non-cleared workers at the start of construction of public access or administrative areas adjacent to the SCIF, SCIF construction, or the installation of major utilities, whichever comes first.

(2) Upon completion of all work, shall clear and secure the areas for which the

CST is responsible prior to turning over control to the CAGs.

g) On U.S. military installations, when the AO considers the risk acceptable, alternative countermeasures may be substituted for the use of a CST as prescribed in the CSP.

3. CAG Requirements and Responsibilities

a) Possesses a U.S. SECRET clearance (TOP SECRET required under COM authority)

b) Performs access-control functions at all vehicle and pedestrian entrances to the site except as otherwise noted in the CSP.

(1) Screens all non-cleared workers, vehicles, and equipment entering or exiting the site.

(2) Denies introduction of prohibited materials, such as explosives, weapons, electronic devices, or other items as specified by the AO or designee.

(3) Conducts random inspections of site areas to ensure no prohibited materials have been brought on to the site. (All suspicious materials or incidents shall be brought to the attention of the SSM or CST.)

D. Construction Security Requirements

1. Prior to awarding a construction contract, a CSP for each project shall be developed by the SSM and approved by the AO.

2. Construction plans and all related…