Atch__35_-_UFC_4_010_05_Sensitive_Compartmented_Information_Facilities_Planning,_Design,_and_Construction.pdf

UFC 4-010-05

1 February 2013

Change 1, 1 October 2013

UNIFIED FACILITIES CRITERIA (UFC)

APPROVED FOR PUBLIC RELEASE; DISTRIBUTION UNLIMITED

SENSITIVE COMPARTMENTED

INFORMATION FACILITIES

PLANNING, DESIGN, AND

CONSTRUCTION

SENSITIVE COMPARTMENTED INFORMATION FACILITIES PLANNING, DESIGN,

AND CONSTRUCTION

Any copyrighted material included in this UFC is identified at its point of use.

Use of the copyrighted material apart from this UFC must have the permission of the copyright holder.

U.S. ARMY CORPS OF ENGINEERS

NAVAL FACILITIES ENGINEERING COMMAND (Preparing Activity)

AIR FORCE CIVIL ENGINEER CENTER

Record of Changes (changes are indicated by \1\ ... /1/)

Change No. Date Location 1 1 Oct 2013 Added paragraphs 3-5.6.4, 3-5.6.1 and 3-5.14

Added Figure 3-3 Modified paragraphs 1-4, 1-12, 1-13, 3-5.4.5, 3-5.6, 3- 5.6.4, 3-5.6.5.1, 3-5.6.10, 3-5.7, 3-5.7.1, 3-5.8.1, 3- 5.8.2, 3-5.8.3, 3-5.9, 3-5.9.1, 3-5.10, 3-5.12.1, 3-5.12.3, 3-5.12.3.2 3-5.12.3.3, and 3-5.13 Modified Figure 3-10 Modified References

FOREWORD

The Unified Facilities Criteria (UFC) system is prescribed by MIL-STD 3007 and provides planning, design, construction, sustainment, restoration, and modernization criteria, and applies to the Military Departments, the Defense Agencies, and the DoD Field Activities in accordance with USD (AT&L) Memorandum dated 29 May 2002. UFC will be used for all DoD projects and work for other customers where appropriate. All construction outside of the United States is also governed by Status of Forces Agreements (SOFA), Host Nation Funded Construction Agreements (HNFA), and in some instances, Bilateral Infrastructure Agreements (BIA.)

Therefore, the acquisition team must ensure compliance with the most stringent of the UFC, the SOFA, the HNFA, and the BIA, as applicable.

UFC are living documents and will be periodically reviewed, updated, and made available to users as part of the Services’ responsibility for providing technical criteria for military construction. Headquarters, U.S. Army Corps of Engineers (HQUSACE), Naval Facilities Engineering Command (NAVFAC), and Air Force Civil Engineer Center (AFCEC) are responsible for administration of the UFC system. Defense agencies should contact the preparing service for document interpretation and improvements. Technical content of UFC is the responsibility of the cognizant DoD working group. Recommended changes with supporting rationale should be sent to the respective service proponent office by the following electronic form: Criteria Change Request. The form is also accessible from the Internet sites listed below.

UFC are effective upon issuance and are distributed only in electronic media from the following source:

• Whole Building Design Guide web site http://dod.wbdg.org/.

Refer to UFC 1-200-01, General Building Requirements, for implementation of new issuances on projects.

AUTHORIZED BY:

JAMES C. DALTON, P.E. JOSEPH E. GOTT, P.E.

Chief, Engineering and Construction Chief Engineer U.S. Army Corps of Engineers Naval Facilities Engineering Command

SCOTT HARTFORD, Colonel, USAF, P.E. MICHAEL McANDREW Acting Director Director, Facilities Investment and Management Facilities Engineering Center of Excellence AF Civil Engineer Center

Office of the Deputy Under Secretary of Defense (Installations and Environment) http://www.wbdg.org/pdfs/ufc_implementation.pdf http://www.wbdg.org/ccb/browse_cat.php?o=29&c=4 http://dod.wbdg.org/

REVISION DOCUMENT SUMMARY SHEET

Document: UFC 4-010-05, Sensitive Compartmented Information Facilities Planning, Design, and Construction, with Change 1

Superseding: UFC 4-010-05, Sensitive Compartmented Information Facilities Planning, Design, and Construction

Description: This change includes updates due to DoDM 5105.21, IC Tech Spec-for ICD/ICS 705 and added clarification on TEMPEST mitigation.

Reasons for Document:

Director of National intelligence issued policy for the planning, design, and construction of SCIF. There was no UFC document that prescribed facility criteria for SCIF. This UFC provides unified criteria for the planning, design, and construction of Sensitive Compartmented Information Facilities (SCIF).

• This document is one of a series of security engineering criteria documents covering physical countermeasures for the current threat environment.

• The design of physical security measures is a specialized technical area that does not fall in the normal skill record and resume of commanders, architects, engineers, and project managers. This document provides guidance to those parties tasked with implementing existing and emerging physical protection system requirements for SCIF.

• This document provides a unified approach for physical security measures for SCIF.

Impact:

• Implementation of Director of National Intelligence (DNI) policy for SCIF may have significant cost impacts for SCIF constructed overseas. This is primarily due to the security requirements for personnel and companies designing and constructing SCIF outside the United States and the access control measures that may have to be implemented during construction.

Unification Issues There are no unification issues i

TABLE OF CONTENTS

CHAPTER 1 INTRODUCTION

1-1 BACKGROUND

1-2 PURPOSE

1-3 APPLICABILITY

1-4 REFERENCES

1-5 GLOSSARY

1-6 POLICY

1-7 IMPLEMENTATION

1-8 GENERAL BUILDING REQUIREMENTS

1-9 RISK MANAGEMENT

1-9.1 Security in Depth (SID)

1-10 SCIF CLASSIFICATIONS

1-10.1 Secure Working Area (SWA)

1-10.2 Temporary Secure Working Area (TSWA)

1-10.3 Temporary SCIF

1-10.4 Closed Storage

1-10.5 Open Storage

1-10.6 Continuous Operation

1-11 SCIF SECURITY REQUIREMENTS

1-12 CONSTRUCTION SECURITY PLAN (CSP)

1-13 INFORMATION SECURITY

1-14 SCIF DESIGN SECURITY

1-15 SCIF CONSTRUCTION SECURITY

1-15.1 SCIF Within the United States

1-15.2 SCIF Outside the United States

1-16 SCIF ACCREDITATION

1-16.1 Accreditation Process

1-16.2 Fixed Facility Checklist (FFC)

1-16.3 TEMPEST Review

1-17 HISTORIC PRESERVATION COMPLIANCE

1-17.1 Security and Stewardship ii

1-17.2 Compliance with Laws

1-17.3 Compliance with DoD Standards

1-18 SECURITY ENGINEERING UFC SERIES

1-18.1 DoD Minimum Antiterrorism Standards for Buildings

1-18.2 DoD Security Engineering Facilities Planning Manual

1-18.3 DoD Security Engineering Facilities Design Manual

1-18.4 Security Engineering Support Manuals

1-18.5 Security Engineering UFC Application

CHAPTER 2 PLANNING

2-1 ESTABLISH PLANNING REQUIREMENTS

2-1.1 Minimum and Enhanced Security

2-1.2 Planning Team

2-2 PLANNING DOCUMENTATION

2-2.1 Configuration of SCIF Spaces

2-2.2 SCIF and Historic Preservation

2-2.3 Construction Security

2-2.4 Project Documentation

CHAPTER 3 DESIGN

3-1 VALIDATE PLANNING REQUIREMENTS

3-2 MINIMUM AND ENHANCED SECURITY

3-3 DESIGN APPROVAL

3-4 GENERAL DESIGN STRATEGY

3-4.1 Configuration of SCIF Spaces

3-4.2 SCIF Perimeter

3-4.3 Intrusion Detection System

3-4.4 Sound Attenuation

3-4.5 Electronic Emanations - TEMPEST

3-5 SPECIFIC DESIGN STRATEGY

3-5.1 Adjacent Space

3-5.2 Vestibule

3-5.3 Perimeter Construction

3-5.4 Perimeter/Compartmented Areas Walls iii

3-5.5 Ceiling and Floors

3-5.6 Perimeter Doors

3-5.7 Windows

3-5.8 Perimeter Penetrations

3-5.9 Vents, Ducts, and Pipes

3-5.10 Access Port

3-5.11 Flashing or Rotating Light

3-5.12 Duress Alarm

3-5.13 Electronic Security System (ESS)

3-5.14 Telecommunication Cabling System

3-5.15 TEMPEST Countermeasures

CHAPTER 4 CONSTRUCTION

4-1 DESIGN APPROVAL

4-2 CONSTRUCTION SECURITY

4-3 ACCREDITATION PROCESS

4-4 INSPECTIONS

4-5 PHOTOGRAPHIC CONSTRUCTION SURVEILLANCE RECORD

APPENDIX A REFERENCES

APPENDIX B GLOSSARY

APPENDIX C MINIMUM CONSTRUCTION

FIGURES

Figure 1-1 Security-in-Depth Figure 1-2 SCIF Drawings Figure 1-3 Security Engineering UFC Application Figure 3-1 Six Sided Approach Figure 3-2 Wall Finish Figure 3-3 Furred Out Wall for Utilities Figure 3-4 Tamper Resistant Hinges Figure 3-5 Emergency Exit Doors Figure 3-6 Duct Penetrations Figure 3-7 Sealing Penetrations Figure 3-8 Bars on Penetration Figure 3-9 Access Port Figure 3-10 Notional IDS Layout

TABLES

Table C-1 Minimum SCIF Wall Construction and Alarm iv

This Page Intentionally Left Blank

CHAPTER 1 INTRODUCTION

1-1 BACKGROUND.

Sensitive Compartmented Information (SCI) is classified Confidential, Secret or Top Secret information that is derived from intelligence sources, methods or analytical processes which is required to be handled within formal control systems established by the Director of National Intelligence. Sensitive Compartmented Information (SCI) can only be handled, processed, discussed, or stored in an accredited Sensitive Compartmented Information Facilities (SCIF).

Sensitive Compartmented Information Facilities (SCIF) are accredited areas, room(s) or building(s) where Sensitive Compartmented Information (SCI), is stored, used, processed or discussed. SCIF are only required for SCI and not necessarily required for Secret or Top Secret information. When required, SCIF provide an operational capability that is critical to the supported command’s mission.

1-2 PURPOSE.

Intelligence Community Directive (ICD) 705 established that all Intelligence Community (IC) SCIF comply with uniform IC physical and technical security requirements.

Intelligence Community Standard (ICS) 705-1 and the IC Tech Spec-for ICD/ICS 705 provide the physical and technical security standards for all SClF including existing and new construction, and renovation projects. This UFC is intended to make planning, design and construction communities aware of the published policy and ensure timely and appropriate implementation.

1-3 APPLICABILITY.

This document provides planning and design criteria for DoD components and participating organizations. This document applies to all construction, renovation, and repair projects for SCIF.

1-4 REFERENCES.

Appendix A contains a list of references used in this document. The publication date of the code or standard is not included in this document. \1\ The most recent edition of referenced publications applies, unless otherwise specified. /1/

1-5 GLOSSARY.

Appendix B contains acronyms, abbreviations, and terms.

1-6 POLICY.

Director of Central Intelligence Directive (DCID) No. 6/9 was rescinded by the issuance of ICD 705 by the Director of National Intelligence. ICD 705 replaces DCID No. 6/9 and all its annexes as the policy for SCIF. ICS 705-1 was issued by the Director of National

Intelligence (DNI) on 17 September 2010. ICS 705-1 and the IC Tech Spec-for ICD/ICS 705 provide the standards for the physical and technical security standards that apply to a SCIF, including existing, new construction, and renovation of SCIF. Refer to ICD 705, ICS 705-1, and IC Tech Spec-for ICD/ICS 705 for more information.

DoDM 5200.01 is the primary document associated with SCIF administration. The manual is composed of several volumes, each having its own purpose. It assigns responsibilities and prescribes procedures for the implementation of Director of Central Intelligence and Director of National Intelligence (DNI) policies for SCI.

1-7 IMPLEMENTATION.

Intelligence Community (IC) elements shall fully implement ICS 705-1 and IC Tech Spec-for ICD/ICS 705 within 180 days of signing. ICS 705-1 was signed on 17 Sep 2010 and IC Tech Spec-for ICD/ICS 705 was signed on 5 May 2011. Facilities under construction or renovation as of the effective date of ICS 705-1 shall be required to meet these standards or request a waiver to the standards. The Accrediting Official (AO) is responsible to request waiver approval.

Each SCIF must be planned, programmed, designed, and constructed on a project by project basis. Work closely with the supported command, designated Site Security Manager (SSM), and the Certified TEMPEST Technical Authority (CTTA) to determine the requirements for each SCIF.

1-8 GENERAL BUILDING REQUIREMENTS.

UFC 1-200-01, "General Building Requirements", provides applicability of model building codes and government-unique criteria for typical design disciplines and building systems, as well as for accessibility, antiterrorism, security, sustainability, and safety.

Use this UFC in addition to UFC 1-200-01 and the UFCs and government criteria referenced therein.

1-9 RISK MANAGEMENT.

Per ICS 705-1, the AO must ensure the application of analytical risk management in the SCIF planning, design and construction. Analytical risk management is the process of assessing threats against vulnerabilities and implementing security enhancements to protect assets at an acceptable level of risk, and within acceptable cost.

The CTTA will use a risk based approach outlined in CNSSI No. 7000 to determine applicable countermeasures for each SCIF. Supported command will provide the CTTA with a completed DNI TEMPEST Checklist for review. The TEMPEST Checklist is included in the IC Tech Spec-for ICD/ICS 705. Project Managers may need to provide site plans and building floor plans to assist CTTA in the determination of TEMPEST countermeasures.

1-9.1 Department of State (DoS) Security Environment Threat List (SETL).

The SETL and its contents are classified information. The SETL reflects four categories of security threats for overseas locations. The AO will utilize the SETL category to determine security requirements for locations outside the United States.

1-9.2 Security in Depth (SID).

SID is desired for all SCIF and required for all SCIF located outside the United States.

SID is a multilayered approach, which effectively employs human and other physical security measures throughout the installation or facility to create a layered defense against potential threats. The intent of SID is to increase the possibility of detection of potential aggressors prior to compromising the SCI. The AO will assess the layers of security measures in place to determine if any security enhancements are required.

The primary means to achieve SID include:

• Located on a Military installation or compound with a dedicated response force of U.S. citizens or U.S. persons.

• Located within a building or fenced compound that employs access control.

• Office areas adjacent to or surrounding the SCIF are controlled and are protected by alarm.

Figure 1-1 Security-in-Depth

1-10 SCIF CLASSIFICATIONS.

SCIF are classified based on operational requirements. Per ICS 705-1, there are six SCIF classifications.

1-10.1 Secure Working Area (SWA).

Area where SCI is handled, discussed, and/or processed but not stored.

1-10.2 Temporary Secure Working Area (TSWA).

Secure working area is SCIF that is used less than 40 hours per month.

1-10.3 Temporary SCIF.

SCIF established for a limited time to meet tactical, emergency, or immediate operational requirements.

1-10.4 Closed Storage.

SCIF where SCI material is stored in GSA approved storage containers when not in use. This includes documents, computer hard drives, and storage media.

1-10.5 Open Storage.

SCIF in which SCI may be openly stored or processed.

1-10.6 Continuous Operation.

SCIF which is staffed and operated 24/7

1-11 SCIF SECURITY REQUIREMENTS.

ICS 705-1 and IC Tech Spec-for ICD/ICS 705 provide the minimum and enhanced security requirements. The minimum security requirements for a SCIF are based on classification and location. To implement security enhancements above the minimum, the AO must evaluate the threat, SID and balance the enhancements with risk at acceptable cost.

1-12 CONSTRUCTION SECURITY PLAN (CSP).

Per ICS 705-1, a Construction Security Plan (CSP) shall be developed by the SSM and approved by the AO to address the application of security to the SCIF planning, design, and construction. \1\ /1/

1-13 INFORMATION SECURITY.

Per ICS 705-1, construction plans and all related documents shall be handled and protected in accordance with the CSP. If classification guides dictate, plans and related documents may require classification. DoDM 5105.21 Vol 2 states the facility’s location (complete address) and identity as a SCIF shall be protected at a minimum of FOR OFFICIAL USE ONLY (FOUO). Drawings or diagrams identified as a SCIF may not be posted on an UNCLASSIFIED website or transmitted over the Internet without some type of encryption. Therefore, do not identify SCIF locations on planning or construction documents; see Figure 1-2. With SSM’s approval, areas may be identified as “Secure Area” or “Controlled Area”. Under no circumstances shall plans or diagrams that are identified for SCI be sent or posted on unprotected information technology systems or Internet venue without encryption. Refer to DoDM 5200.01 \1\ /1/ and the Service’s related policy documents for guidance on the handling of classified information.

Figure 1-2 SCIF Drawings

1-14 SCIF DESIGN SECURITY.

Per ICS 705-1, design of SCIF shall be performed by U.S. companies using U.S.

citizens or U.S. persons. AO shall ensure mitigations are implemented when using non- U.S. citizens and these mitigations shall be documented in the CSP.

U.S. Person is defined as an individual who has been lawfully admitted for permanent residence as defined in 8 U.S.C. 1101(a)(20) or who is a protected individual as defined by Title 8 U.S.C. 1324b (a)(3), and able to provide two forms of identification listed on Department of Homeland Security Form I-9, Employment Eligibility Verification.

1-15 SCIF CONSTRUCTION SECURITY.

Per ICS 705-1, construction security requirements are documented in the CSP.

Depending on the location of the SCIF, the AO may impose procedures for the procurement, shipping, and storing of construction materials at the site. These procedures must be documented in the CSP.

1-15.1 SCIF Within the United States.

General construction of SCIF shall be performed by U.S. companies using U.S. citizens or U.S. persons. The AO shall ensure mitigations are implemented when using non- U.S. citizens. These mitigations shall be documented in the CSP.

Intrusion Detection System (IDS) installation and testing shall be performed by U.S.

companies using U.S. citizens.

1-15.2 SCIF Outside the United States.

General SCIF construction shall be performed using U.S. companies using U.S.

citizens.

• On military facilities, the AO may authorize foreign national citizens or companies to perform general construction of SCIF. In this situation, the SSM shall prescribe, with AO approval, mitigating strategies. These mitigations shall be documented in the CSP.

• U.S. Top Secret-cleared personnel shall perform finish work in Category I and II countries. U.S. Secret-cleared personnel shall perform finish work in Category III countries. Finish work includes closing up wall structures; installing, floating, taping and sealing wallboards; installing trim, chair rail, molding, and floorboards;

painting, etc.

• Intrusion Detection System (IDS) installation and testing shall be performed by personnel who are U.S. TOP SECRET-cleared or U.S. SECRET-cleared and escorted by SCIF personnel.

1-16 SCIF ACCREDITATION.

A letter of accreditation is a formal statement on behalf of the IC element head that a facility has been designed, constructed, inspected, and certified for the protection of all Sensitive Compartmented Information (SCI) compartments, programs or special activities in accordance with the provisions of ICD 705. Refer to ISC 705-2 for the policy on SCIF accreditation.

1-16.1 Accreditation Process.

SClF inspections and evaluations shall be performed by the AO, or designee, prior to initial accreditation. The accreditation process shall include a review of documents relating to SClF design, construction, and operations. The SSM shall be responsible for assembling and submitting documents for AO approval. Documents shall include, but not be limited to:

• Fixed Facility Checklist

• Standard Operating Procedures

• Emergency Plans

• Construction Security Plan

• TEMPEST countermeasures evaluation from CTTA

• Waiver request packages and supporting documentation, if applicable.

1-16.2 Fixed Facility Checklist (FFC).

The FFC is a standardized document used in the process of accrediting a SCIF. It documents physical, technical, and procedural security information for obtaining an initial or subsequent accreditation.

To support the accreditation process, Designers of Record, Project Managers, and Construction mangers shall provide the AO/SSM site plans, building floorplans, IDS plans, and information related to perimeter and compartment area wall construction, doors, locks, deadbolts, IDS, telecommunication systems, acoustical protection, and TEMPEST countermeasure. See chapter 4 for additional information.

1-16.3 TEMPEST Review.

A TEMPEST review and evaluation shall be included in the accreditation documentation. TEMPEST review and verification of countermeasures by the appropriate Certified Technical TEMPEST Authority (CTTA) is a part of the accreditation process.

1-17 HISTORIC PRESERVATION COMPLIANCE.

1-17.1 Security and Stewardship.

The Department of Defense remains the lead federal agency in balancing security threats with the protection of historic properties. The Department of Defense abides by federal legislation on protecting cultural resources, and issues its own complementary policies for stewardship.

1-17.2 Compliance with Laws.

Implementation of ICD 705 will not supersede DoD’s obligation to comply with federal laws regarding cultural resources to include the National Historic Preservation Act and the Archaeological Resources Protection Act. Installation personnel need to determine possible adverse effects upon an historic structure and/or archaeological resource during project development and consult accordingly. Personnel at installations outside the United States should coordinate with the applicable host nation regarding possible adverse effects to cultural resources.

http://fismapedia.org/index.php?title=Term:Document http://fismapedia.org/index.php?title=Term:Accreditation

1-17.3 Compliance with DoD Standards.

Conversely, historic preservation compliance does not negate the requirement to implement Department of Defense policy. Federal agencies are always the decision-maker in the Section 106 process of the National Historic Preservation Act. An agency should not allow for prolonged consultations that conflict with the eminent need to implement security requirements. Preservation issues need to be quickly and effectively resolved.

1-18 SECURITY ENGINEERING UFC SERIES.

This UFC is one of a series of security engineering unified facilities criteria documents that cover minimum standards, planning, preliminary design, and detailed design for security and antiterrorism. The manuals in this series are designed to be used sequentially by a diverse audience to facilitate development of projects throughout the design cycle. The manuals in this series include the following:

1-18.1 DoD Minimum Antiterrorism Standards for Buildings.

This UFC 4-010-01 and 4-010-02 establish standards that provide minimum levels of protection against terrorist attacks for the occupants of all DoD inhabited buildings.

These UFCs are intended to be used by security and antiterrorism personnel and design teams to identify the minimum requirements that must be incorporated into the design of all new construction and major renovations of inhabited DoD buildings. They also include recommendations that should be, but are not required to be incorporated into all such buildings.

1-18.2 DoD Security Engineering Facilities Planning Manual.

UFC 4-020-01 presents processes for developing the design criteria necessary to incorporate security and antiterrorism into DoD facilities and for identifying the cost implications of applying those design criteria. Those design criteria may be limited to the requirements of the minimum standards, or they may include protection of assets other than those addressed in the minimum standards (people), aggressor tactics that are not addressed in the minimum standards or levels of protection beyond those required by the minimum standards. The cost implications for security and antiterrorism are addressed as cost increases over conventional construction for common construction types. The changes in construction represented by those cost increases are tabulated for reference, but they represent only representative construction that will meet the requirements of the design criteria. The manual also addresses the tradeoffs between cost and risk. The Security Engineering Facilities Planning Manual is intended to be used by planners as well as security and antiterrorism personnel with support from planning team members.

1-18.3 DoD Security Engineering Facilities Design Manual.

UFC 4-020-02 provides interdisciplinary design guidance for developing preliminary systems of protective measures to implement the design criteria established using UFC 4-020-01. Those protective measures include building and site elements, equipment, and the supporting manpower and procedures necessary to make them all work as a system. The information in UFC 4-020-02 is in sufficient detail to support concept level project development, and as such can provide a good basis for a more detailed design.

The manual also provides a process for assessing the impact of protective measures on risk. The primary audience for the Security Engineering Design Manual is the design team, but it can also be used by security and antiterrorism personnel.

1-18.4 Security Engineering Support Manuals.

In addition to the standards, planning, and design UFCs mentioned above, there is a series of additional UFCs that provide detailed design guidance for developing final designs based on the preliminary designs developed using UFC 4-020-02. These support manuals provide specialized, discipline specific design guidance. Some address specific tactics such as direct fire weapons, forced entry, or airborne contamination. Others address limited aspects of design such as resistance to progressive collapse or design of portions of buildings such as mail rooms. Still others address details of designs for specific protective measures such as vehicle barriers or fences. The Security Engineering Support Manuals are intended to be used by the design team during the development of final design packages.

1-18.5 Security Engineering UFC Application.

The application of the security engineering series of UFCs is illustrated in Figure 1-1.

UFC 4-020-01 is intended to be the starting point for any project that is likely to have security or antiterrorism requirements. By beginning with UFC 4-020-01, the design criteria will be developed that establishes which of the other UFCs in the series will need to be applied. The design criteria may indicate that only the minimum standards need to be incorporated, or it may include additional requirements, resulting in the need for application of additional UFCs. Even if only the minimum standards are required other UFCs may need to be applied if sufficient standoff distances are unavailable.

Applying this series of UFCs in the manner illustrated in Figure 1-3 will result in the most efficient use of resources for protecting assets against security and antiterrorism related threats.

Figure 1-3 Security Engineering UFC Application

CHAPTER 2 PLANNING

2-1 ESTABLISH PLANNING REQUIREMENTS.

This chapter is intended to make planners aware of SCIF requirements that may affect the facility scope and budget. It is not intended to document the standard planning processes related to project development.

SCIF are established only when there are clear operational requirements which are critical to the supported command’s mission. All SCIF projects begin with an Accrediting Official's Sponsorship. If a supported command requests a SCIF be included in a project, that SCIF has an Accrediting Official and a Site Security Manager

(SSM).

2-1.1 Minimum and Enhanced Security.

ICS 705-1 and IC Tech Spec-for ICD/ICS 705 provide the minimum and enhanced security requirements for SCIF including construction details. The minimum security requirements are based on classification and location. Table C-1 in Appendix C provides an overview of the minimum SCIF construction requirements. To implement security enhancements above the minimum, the AO and CTTA will evaluate the threat, TEMPEST, SID and balance the security enhancements with cost at acceptable risk.

2-1.2 Planning Team.

Establish an interdisciplinary planning team with local considerations. The interdisciplinary planning team must work together to determine classification of SCIF and establish the minimum/enhanced security requirements. The planning team may consider user constraints such as operations, manpower requirements or limitations, and sustainment costs when determining the requirements for the overall security solution. The planning team should include the following:

• Planning

• Supported Command

• Site Security Manager (SSM)

• Certified TEMPEST Technical Authority (CTTA)

• Communications

• Security

• Engineering

• Cultural resources (if historical building)

2-2 PLANNING DOCUMENTATION.

The SCIF classification, operation, TEMPEST countermeasures, and resulting facility related requirements must be determined, documented, and budgeted during the planning process.

2-2.1 Configuration of SCIF Spaces.

When a facility has more than one SCIF, serious consideration should be given to consolidate SCIF with Compartmented Areas within. Any consolidation of spaces will reduce initial and sustainment costs for infrastructure and electronic security systems and the associated accrediting requirements. This must be coordinated with the supported commands to insure the configuration will meet their operational (compartmented) requirements.

2-2.2 SCIF and Historic Preservation.

Preservation of Cultural Resources must be considered when converting a historical building into a SCIF or locating a SCIF within a historic building. In a SCIF, every effort should be made to minimize or eliminate windows, especially on the ground floor.

Windows less than 18 feet above the ground or from the nearest platform affording access to the window (measured from the bottom of the window) and doors shall be protected against forced entry and meet the standard for the SCIF perimeter which may include acoustic and TEMPEST mitigation. State Historic Preservation Officers (SHPO) may consider window and door modifications to have an adverse effect but may allow the modification if the impact is minimized and the effect mitigated. Planners will need to explore options and consult with the State Historic Preservation Office (SHPO) to determine options that meet security requirements and are compatible with the Secretary of the Interior's Standards for Rehabilitation.

2-2.3 Construction Security.

For locations outside the United States, the AO may impose procedures for the procurement, shipping, and storing of construction materials at the site. In addition, the AO may require access control to the construction materials and the SCIF construction area. Since these additional security measures may have significant cost impacts on project, they must be determined during project development.

2-2.4 Project Documentation.

Work with the Supported Command, SSM, and the CTTA to determine and document the classification, operation, and resulting facility requirements for the SCIF. SCIF located in higher threat areas (outside the United States) may have additional security requirements. Determine and document the following during project development:

• Is the SCIF the entire facility or an area within the facility?

• Will there be more than one SCIF, if so how many?

• What is the classification of the SCIF?

• Will the SCIF perimeter wall be standard, enhanced, or vault construction?

• What is the required Sound Transmission Class (STC) rating for the SCIF perimeter?

• Will the SCIF have Compartmented Areas? If so, how many and what is the required STC rating for the Compartmented Areas?

• Will an Electronic Security System (ESS) be required?

• Is there equipment that will be processing National Security Information (NSI)?

• Has the supported command provided the CTTA with a completed TEMPEST

Checklist for review? The TEMPEST Checklist is included in the IC Tech Spec-for ICD/ICS 705.

• Will there be a TEMPEST requirement? If so, what will be required TEMPEST countermeasures?

• Are there special procurement, shipping, and storing of SCIF construction materials at the site required? If so, what will be required?

• Are there access control requirements for the construction materials and the SCIF construction area?

• Will U.S. companies using U.S. citizens be required for construction and oversight?

• Will U.S. Secret or U.S. Top Secret cleared personnel be required to perform finish work?

• Will installation and testing of the ESS be performed by U.S. TOP SECRET-cleared personnel or U.S. SECRET-cleared personnel escorted by SCIF personnel.

Some of these requirements are documented in the approved CSP. Therefore, it is very important to obtain the approved CSP during project development to ensure appropriate security requirements are included in the project budget and scope.

CHAPTER 3 DESIGN

3-1 VALIDATE PLANNING REQUIREMENTS.

Work with the Supported Command, SSM, and the CTTA to validate planning requirements. Operation, classification, and threat classification of the SCIF may have changed since the project was planned. Validate and document the classification, operation, and resulting facility requirements for the SCIF. Include requirements in the Design Build RFP, design documents, and construction contracts to insure the SCIF can be accredited to meet the supported command’s operational capabilities.

3-2 MINIMUM AND ENHANCED SECURITY.

ICS 705-1 and IC Tech Spec-for ICD/ICS 705 provide the minimum and enhanced security requirements for SCIF. The minimum security requirements are based on classification and location. Table C-1 in Appendix C provides an overview of the minimum SCIF construction requirements. To implement security enhancements above the minimum, the SSM and CTTA will evaluate the threat, SID and balance the security enhancements with cost at an acceptable risk.

3-3 DESIGN APPROVAL.

Per ICS 705-1, Concept and final design for each construction project must be reviewed and approved by the Accrediting Official prior to start of construction.

3-4 GENERAL DESIGN STRATEGY.

The general design strategy for any tactic is the basic approach to developing a protective system to mitigate the effects of that tactic. It governs the general application of construction, building support systems, equipment, manpower, and procedures.

SCIF design will vary depending on type of SCIF, location, SID, SCI discussion, and NSI processing requirements. Mitigation against forced entry, covert entry, visual surveillance, acoustic eavesdropping, and electronic emanations will dictate security requirements. Designers must take a six-sided approach when implementing SCIF requirements, see Figure 3-1. The floor, ceiling, walls and any penetrations must be designed to meet the performance requirements for the SCIF perimeter.

Figure 3-1 Six Sided Approach

3-4.1 Configuration of SCIF Spaces.

If a facility has more than one SCIF, serious consideration should be given to the consolidation SCIF spaces with Compartmented Areas within. Any consolidation of spaces will reduce accrediting requirements and the initial/sustainment costs for infrastructure and electronic security systems. This must be coordinated to insure configuration will meet operational (compartmented) requirements.

3-4.2 SCIF Perimeter.

The perimeter of the SCIF includes perimeter walls, windows, doors, ceiling, floor, and all penetrations. At a minimum, SCIF Perimeter shall provide:

• Resistance to forced entry

• Resistance to covert entry

• Visual evidence of surreptitious penetration

• Sound Attenuation

• Countermeasures for Electronic Emanations -TEMPEST (when required)

This includes above the false ceilings and below raised floors.

3-4.3 Intrusion Detection System.

All Interior areas of a SCIF through which reasonable access could be gained, including walls common to areas not protected at the SCI level, shall be protected by IDS, unless continuously occupied.

3-4.4 Sound Attenuation.

The ability of a SCIF structure to retain sound within the perimeter is rated using a descriptive value, the Sound Transmission Class (STC). Architectural Graphics Standards (AGS) established Sound Groups I through 4, of which Groups 3 and 4 are considered adequate for specific acoustical security requirements for SCIF construction.

Per AGS:

• Sound Group 3 – (STC of 45) or better. Loud speech can be faintly heard but not understood. Normal speech is unintelligible.

• Sound Group 4 – (STC of 50) or better. Very loud sounds, such as loud singing, brass musical instruments or a radio at full volume, can be heard only faintly or not at all.

SCIF and compartmented area perimeters shall meet Sound Group 3, unless additional protection is required for amplified sound. This applies to the entire perimeter of the space to include walls, ceilings and floors and perimeter penetrations such as conduit, pipe, ducts, doors, and windows. Conference rooms or other areas where amplified audio is used such as video teleconference (VTC) equipment, audio visual systems, and speakerphones shall meet Sound Group 4 performance criteria.

3-4.5 Electronic Emanations - TEMPEST.

National Security Telecommunications and Information System Security Instruction (NSTISSI) No. 7000, “TEMPEST Countermeasures for Facilities,” establish guidelines and procedures that shall be used by departments and agencies to determine the applicable TEMPEST countermeasures for national security systems. In general, TEMPEST countermeasures apply when the SCIF contains equipment that will be processing national security information (NSI). However, having equipment that will be processing NSI does not necessarily imply the need to implement TEMPEST countermeasures.

The Certified TEMPEST Technical Authority (CTTA) has responsibility for conducting or validating TEMPEST reviews and recommending TEMPEST countermeasures. Failure to consult the CTTA could result in installation of unnecessary and/or expensive countermeasures or the omission of needed countermeasures. If required TEMPEST countermeasures are omitted, the facility will not be accredited and the Supported Command will not be mission capable.

3-5 SPECIFIC DESIGN STRATEGY.

The specific design strategy for any tactic governs how the general design strategy varies for different levels of protection or threat severity. They may vary by the sophistication of the protective measures and the degree of protection provided. The specific design strategies reflect the degree to which assets will be left vulnerable after the protective system has been employed.

3-5.1 Adjacent Space.

To increase SID, locate other areas that require access control adjacent to or surrounding the SCIF.

3-5.2 Vestibule.

When practical, the entrance into a SCIF should incorporate a vestibule to preclude visual observation and enhance acoustic protection.

3-5.3 Perimeter Construction.

The SCIF and compartmented area perimeters and the penetrations in those perimeters are the primary focus of SCIF design. IC Tech Spec-for ICD/ICS 705 provides the minimum and enhanced construction requirements for SCIF perimeter and compartmented area with regard to forced entry, covert entry, visual evidence of surreptitious penetration, and sound attenuation. In addition, radio frequency (RF) shielding and other TEMPEST mitigation shall be provided as determined by the CTTA.

IC Tech Spec-for ICD/ICS 705 includes recommended construction details for acoustic wall construction and duct penetrations. Designers must ensure that details used from IC Tech Spec-for ICD/ICS 705 comply with UFC 1-200-01. For example, IC Tech Spec-for ICD/ICS 705 has a wall detail for Wall C - enhanced construction utilizing plywood.

To meet UFC 1-200-01, the plywood must be Fire Retardant Treated (FRT) plywood.

3-5.4 Perimeter/Compartmented Areas Walls.

Walls must go from floor slab (true floor) to underside of floor or roof deck (true ceiling).

Perimeter walls, floor and ceiling shall be permanently and solidly constructed and attached to each other. Seal partition continuously with acoustical foam or sealant (both sides) and finished to match wall wherever it abuts another element such as the floor, ceiling, wall, column, or mullion.

3-5.4.1 Wall Finish.

Walls must be uniformly finished on both sides from floor slab (true floor) to underside of floor or roof deck (true ceiling). See Figure 3-2.

Figure 3-2 Wall Finish

UNACCEPTABLE

• Wall not uniformly finished above false ceiling.

• Wall not sealed where wall abuts floor pan.

• Wall penetrations unsealed.

ACCEPTABLE

• Wall is uniformly finished above false ceiling

• Wall is sealed where wall abuts floor pan.

• Wall penetrations are sealed.

3-5.4.2 Sound Attenuation.

Provide acoustical protection to protect SCI against being inadvertently overheard by the casual passerby, not to protect against deliberate interception of audio.

3-5.4.3 Minimum Sound Attenuation.

The amount of sound energy reduction may vary according to individual facility requirements. However, Sound Group ratings shall be used to describe the effectiveness of SCIF acoustical security measures afforded by various wall materials and other building components.

• SCIF Perimeter shall meet Sound Group 3, unless additional protection is required for amplified sound. This applies to the entire perimeter of the space to include walls, ceilings and floors and perimeter penetrations such as conduit, pipe, ducts, doors, and windows.

• Compartmented Area: If compartmented areas are required within the SCIF, the dividing office walls must meet Sound Group 3, unless additional protection is required for amplified sound.

• Conference rooms or other areas where amplified audio is used such as video teleconference (VTC) equipment, audio visual systems, and speakerphones shall meet Sound Group 4 performance criteria.

3-5.4.4 Sound Masking.

When normal construction and baffling measures have been determined to be inadequate to meet the sound attenuation requirement, sound masking shall be employed. A sound masking system may utilize a noise generator as a noise source with speakers or transducers located on the perimeter of the SCIF. When required, provide sound masking devices at penetrations to the SCIF perimeter such as doors and duct penetrations.

3-5.4.5 Utilities on Perimeter Wall.

Utilities such as power,\1\ telecommunications, /1/ signal, and plumbing on the interior of a perimeter/compartmented wall treated for acoustic or RF shall be surface mounted, contained in a raceway, or a furred out wall shall be constructed for routing of utilities.

Utilities shall not be mounted in a manner that affects the acoustic or RF shielding performance. If a furred out wall is used, gypsum board may be 3/8 inch (10 mm) and shall terminate above the false ceiling. \1\ See Figure 3-3 for an example. /1/

3-5.4.6 Recessed Fire Extinguisher Cabinets.

Recessed fire extinguisher cabinets are prohibited on perimeter walls.

3-5.5 Ceiling and Floors.

Ceilings and floors shall meet the same requirements as walls with regard to forced entry, covert entry, visual evidence of surreptitious penetration, and sound attenuation.

In addition, ceilings, floors and all penetrations shall meet TEMPEST requirements when required by CTTA.

3-5.6 Perimeter Doors.

SCIF perimeter doors and frame assembles shall meet acoustic requirements (vestibule of two doors may be used) unless declared a non-discussion area. \1\ /1/ Provide dead bolts for perimeter doors with day access controls for SCIF residents. In addition, perimeter doors shall meet TEMPEST requirements when required by CTTA.

\1\

Figure 3-3 Furred Out Wall for Utilities

/1/

3-5.6.1 Acoustic Rated Doors.

Specify an acoustical assembly to include door, seals, hinges, frame, and threshold tested to ASTM-E336 to obtain a STC 45 or 50 rated door. Fill voids between frame and adjacent wall with sound deadening material. For STC 46 or higher rated door assemblies, fill voids between frame and adjacent wall with lightweight gypsum plaster, foam, or sealant. Seal both sides of the entire perimeter of the door assembly with acoustical caulk where it interfaces with wall.

3-5.6.2 Wood doors.

At a minimum, wood doors shall be 1 ¾ inch (45 mm) thick solid wood core (wood stave).

\1\

3-5.6.3 Steel Doors.

At a minimum, steel doors shall meet following specifications:

• 1 ¾ inch (45 mm) thick face steel equal to 18 gauge.

• Hinges reinforced to 7 gauge.

• Door closure reinforced to 12 gauge.

• Lock area predrilled and/or reinforced to 10 gauge.

3-5.6.4 Door Closers.

All perimeter SCIF doors shall be equipped with a heavy duty automatic non-hold door-closer installed internal to the SCIF.

/1/

3-5.6.5 Hinges.

Hinges shall be full mortise, half mortise, full surface, or half surface design as recommended by the manufacturer for acoustical door assembly.

3-5.6.5.1 Hinge Pins.

Hinge pins on SCIF perimeter doors shall be tamper resistant unless mounted on the protected side of the door. Tamper resistant hinges shall have non-removable pins, security pins,\1\ set screws, welded, /1/ or equipped with a safety stud. \1\ See Figure 3-

4. /1/

Figure 3-4 Tamper Resistant Hinges

3-5.6.6 Primary Entrance.

Unless approved by the AO, each SCIF shall have one primary SCIF entrance where visitor control is conducted. The primary entrance should incorporate a vestibule to preclude visual observation and enhance the acoustic protection. Primary entrance shall be:

• Equipped with an approved automated access control device.

• Equipped with a GSA-approved pedestrian door deadbolt meeting Federal

Specification FF-L- 2890.

• Equipped with combination lock meeting Federal Specification FF-L 2740.

Federal Specification FF-L-2890 requires a combination lock that meets Federal Specification FF-L-2740. Therefore, only one locking device is provided on the door, that locking device shall meet Federal Specification FF-L- 2890.

3-5.6.7 Emergency Exit Doors.

Emergency exit doors shall meet perimeter door requirements and:

• Have no exterior hardware; see \1\ Figure 3-5. /1/

• Secured with deadlocking panic hardware.

• Alarmed 24/7 and equipped with a local annunciation.

• Delayed-egress is recommended with NFPA 101 compliance.

Figure 3-5 Emergency Exit Doors

3-5.6.8 Vault Doors.

All vaults shall be GSA-approved Class 5 vault door.

3-5.6.9 Roll-up Doors.

Roll-up doors shall only be located in an area of the SCIF that is a non- discussion area due to the inability to treat for acoustics. Roll-up doors shall be 18 gauge or greater and secured with dead bolts on each side of the door.

3-5.6.10 Double Doors.

Double doors should not be used on SCIF perimeter. If double doors are used:

• One side shall be secured top and bottom with deadbolts.

• Have an astragal strip attached to \1\ either /1/ door to prevent observation of the

SCIF through the opening between the doors.

• Each door shall be alarmed (have a balanced magnetic switch).

• A GSA approved lock shall be installed on the moving door.

3-5.7 Windows.

SCIF perimeters should have no windows. Therefore, every effort should be made to minimize or eliminate windows, especially on the ground floor. If provided, \1\ windows shall be non-operable. /1/ Provide mitigation for visual surveillance, acoustic protection and meet TEMPEST requirements when required by CTTA. Large windows may require noise generator transducers to achieve acoustic protection. For visual surveillance protection, windows shall be made opaque or with SSM approval equipped with blinds, drapes or other coverings.

Windows less than 18 feet (5.5 meters) (measured from the bottom of the window) above the ground or from the nearest platform; such as lower roof, canopy or mechanical equipment, which affords access to the window shall:

• Be fixed non-opening.

• Meet the standards of the SCIF perimeter.

• Be protected against forced entry.

• Be alarmed.

3-5.7.1 Windows greater than 18 feet (5.5 meters).

Windows located above 18 feet (5.5 meters) shall be fixed non-opening \1\ /1/

3-5.8 Perimeter Penetrations.

Penetrations of the perimeter shall be kept to a minimum. Ducts, conduits, pipes, or anything that penetrates the SCIF perimeter present a vulnerability that must be addressed. Ducts, conduits or pipes servicing areas other than SCIF shall not penetrate the SCIF Perimeter unless mitigation is provided. \1\ In addition, perimeter penetrations shall meet TEMPEST requirements when required by CTTA. /1/

3-5.8.1 Utility Penetrations.

Utilities (power and signal) should enter the SCIF at a single point. Seal all utility penetrations to mitigate acoustic emanations and covert entry. Spare conduits are allowed for future expansion \1\ provided the expansion conduit is filled with acoustic fill and capped. /1/

3-5.8.2 Metallic Penetrations.

All metallic penetrations through SCIF walls shall be considered carriers of compromising emanations (CE) and pose TEMPEST hazards that shall be addressed.

Unless directed otherwise by the CTTA:

• Metal conduit or pipe: provide a dielectric union inside the SCIF perimeter adjacent to the penetration, or ground the conduit within 6 inch (150 mm) of the perimeter penetration using a no. 4 wire (0.2043-diameter copper wire) to the building ground.

• Metallic sprinkler (fire suppression) pipe: provide a UL Listed dielectric union inside the SCIF perimeter adjacent to the penetration, or ground the conduit within 6 inch (150 mm) of the perimeter penetration using a no. 4 wire (0.2043-diameter copper wire) to the building ground.

• Mechanical system refrigerant lines: ground the line within 6 inch (150 mm) of the perimeter penetration using a no. 4 wire (0.2043-diameter copper wire) to the building ground. Maintain integrity of refrigerant line insulation.

• HVAC ducts: provide a nonconductive break (flex connection) using material appropriate for the climate, for a 2- to 6-inch (50 to 150 mm) section of the duct inside the SCIF perimeter adjacent to the penetration; see \1\ Figure 3-6. When a waveguide-below-cutoff RF filter is required by CTTA, provide between the SCIF perimeter and the nonconductive break. /1/

In addition, the CTTA may require additional TEMPEST countermeasures.

Figure 3-6 Duct Penetrations

3-5.8.3 Penetration Seals.

Seal both sides of perimeter…