PBS_3490.1_Document_Security.pdf

**This Handbook was only published electronically.

GENERAL SERVICES ADMINISTRATION

Washington, DC 20405

PBS 3490.1

March 8, 2002

GSA ORDER

SUBJECT: Document security for sensitive but unclassified paper and electronic building information

1. Purpose. This order sets forth the Public Buildings Service's (PBS's) policy on the dissemination of sensitive but unclassified (SBU) paper and electronic building information of General Services Administration's controlled space, including owned, leased, or delegated Federal facilities. A major goal of GSA and the Federal Government is the safety and security of people and facilities under the charge and control of GSA. This order outlines the PBS security procedures needed to reduce the risk that the material will be used for dangerous or illegal purposes.

2. Cancellation. PBS-IL-01-3 is canceled.

3. Objectives. In order to reduce the exposure to possible attacks or threats to

GSA controlled space, there are two principal objectives of PBS's policy regarding sensitive but unclassified (SBU) building information. These are to:

a. Diminish the potential that sensitive information about the building in either paper or electronic form will be available for use by a person or persons with an interest in causing harm to persons or property.

b. Respect GSA's legitimate business and other needs to allow access to this information to those who have a need-to-know, such as Federal agencies housed in GSA controlled space, the professional design community, contractors, and states, cities, and towns where GSA has facilities.

4. History.

a. The physical protection of Federal employees, the visiting public, and facilities has always been a priority for GSA. Environmental, fire, security, and other safety concerns have influenced how GSA builds and procures space and has impacted our construction criteria. However, after the Alfred P. Murrah

Federal Building bombing, GSA and other Government agencies have made a concerted review of GSA's construction and security criteria to find ways to prevent such an occurrence in the future.

b. There is rising apprehension that if building information is not restricted it could easily fall into the hands of terrorists or other criminal elements. In addition, there is particular concern that, with Internet technology, individuals, including terrorists and criminals worldwide, could have easy access to such information and remain anonymous.

c. Counterbalancing legitimate security concerns is the reality that a

"government of the people, by the people, and for the people" must be accessible to its citizens and able to perform its mission without excessive restrictions hampering competition. With certain limited exceptions, GSA is required by the Competition in Contracting Act to obtain full and open competition. Therefore, prospective offerors must have access to necessary information in competing for Government contracts. This includes interested vendors, contractors, subcontractors, manufacturers, and suppliers of our building materials, as well as providers of professional services such as building plans and security services or equipment. GSA must balance security with business requirements in a pragmatic way, without undue bureaucratic burdens on our regional offices, consultants, lessors, and contractors.

5. Application. This order applies to all SBU building information regarding

PBS-controlled space or procurements to obtain PBS-controlled space, either

Government owned or leased, and to all PBS employees in Central Office and the regions, and includes GSA space that is delegated to other Federal agencies.

It also imposes requirements on Federal employees to ensure that authorized users, both Government and non-Government, are aware of and adhere to specific obligations with respect to SBU building information.

6. Related authorities. This order supports and supplements the implementation of GSA order, Safeguarding sensitive unclassified information (ADM

1800.3B); Instructional Letter CIO IL-99-1, Safeguarding Sensitive

Unclassified Information; and the GSA Acquisition Manual (GSAM) (ADP P

2800.12B).

7. Responsibilities.

a. General. Because no policy can cover every circumstance, disseminators shall make every effort to apply the principles outlined in this order in those cases where circumstances require adaptation, by using good judgment, common sense, and reasonableness. The principles are:

Only give the information to those who have a need to know;

Keep records of who got the information; and

Safeguard the information during use and destroy it properly after use.

This order describes the minimum effort required. In some cases, the disseminator should take additional precautions as circumstances dictate. It is the responsibility of those disseminating SBU building information to provide the first line of defense against misuse.

b. Assistant Regional Administrators (ARA's). PBS ARA's, or their designated

Federal employee representatives (or in the case of delegated buildings, Agency officials), must ensure SBU building information is protected from unauthorized use. Federal Government employees who handle SBU building information shall have security training outlining the procedures in this order.

c. Federal Protective Service (FPS). The FPS at Central Office and in each

GSA region must inform regional security personnel regarding the information contained herein. FPS, in coordination with other PBS offices, shall participate in PBS regional security training.

d. Office of the Chief Architect (PC). PC must inform the GSA regional offices responsible for managing SBU building information of the requirements contained herein. The OCA shall work with private sector architects, engineers, and contractors to ensure that these groups are aware of the requirements contained in this order, including:

(1) Labeling of information. All SBU building information, either in electronic or paper formats, shall have imprinted on each page of the information:

PROPERTY OF THE UNITED STATES GOVERNMENT

FOR OFFICIAL USE ONLY

Do not remove this notice

Properly destroy documents when no longer needed

(2) The following paragraph will be included on the cover page of the information (such as the cover page on the set of construction drawings and on the cover page of the specifications) and on the label of all magnetic media:

PROPERTY OF THE UNITED STATES GOVERNMENT

COPYING, DISSEMINATION, OR DISTRIBUTION OF THESE DRAWINGS,

PLANS,

OR SPECIFICATIONS TO UNAUTHORIZED USERS IS PROHIBITED

Do not remove this notice Properly destroy documents when no longer needed

(3) The previous two statements shall be prominently labeled in bold type in a size appropriate for the document. On a set of construction drawings, for example, the statements should be in a minimum of 14 point bold type.

e. Office of General Counsel. The Office of General Counsel must provide legal advice concerning Freedom of Information Act (FOIA) requests pertaining to SBU building information.

f. Office of Customer Service (PB). PB must ensure that all GSA customers are aware of the requirements contained in this order.

g. Office of Realty Services (PE). PE must ensure that Leasing Contracting

Officers (GS-1170) and Realty Specialists (GS-1170) are aware of the requirements contained in this order.

h. Office of Portfolio Management (PT). PT must notify client agency officials of those GSA buildings delegated to them of the requirements contained in this order.

i. Office of Business Operations (PX). PX must notify all Procurement

Contracting Officers (GS-1102) and Property Management personnel of the requirements contained in this order.

j. Contracting Officers (CO). The CO's must post a synopsis of the work electronically to the Governmentwide Point of Entry (GPE), currently

FedBizOpps (http://fedbizopps.gov/), for all procurements containing SBU building information. For those procurements where SBU building information, such as exhibits, associated plans, specifications, etc., cannot be made available electronically on the GPE, the CO's must provide a notification as required by the GSA Acquisition Manual (APD P 2800.12B), GSAM 504.570(d).

8. Type of Information for Document Security

a. Sensitive But Unclassified (SBU) building information. Includes but is not limited to paper and/or electronic documentation of the physical facility information listed below. Building designs (such as floorplans), construction plans and specifications, renovation/alteration plans, equipment plans and locations, building operating plans, information used for building service contracts and/or contract guard services, or any other information considered a security risk, for all GSA controlled facilities, shall be considered covered http://fedbizopps.gov/ under this category. Specifically (but not exclusively), it includes:

(1) Location of secure functions in the facility such as judges' chambers and libraries, prisoner or judges' secure circulation paths (both vertical and horizontal), cell blocks, sally ports, judges' parking, security areas, and childcare, major computer processing areas or other client sensitive processing areas (such as major photo or computer labs, etc);

(2) Location of all utilities, such as heating, ventilation, air conditioning, information technology (IT) systems, location of air intake vents, water sources, gas lines, plumbing lines, building automation systems, power distribution systems, emergency generation equipment, uninterrupted power sources (UPS), security and fire alarm systems, routes and annunciation panels;

(3) Location and type of structural framing for the building and any information regarding structural analysis or building security and blast mitigation analysis and counter terrorism methods taken to protect the occupants and building; and

(4) Information regarding security systems or strategies of any kind (such as camera locations) or security guards (such as number and location).

b. Non-sensitive unclassified building information. Information regarding the building that may be made available for limited public dissemination under the following conditions:

(1) Building elevation or other drawings of new or existing buildings shall not show or label information defined under the SBU categories in 8.a., above.

(2) Interior photographs that are limited to publicly accessible space or have been cleared for publication by GSA or the agency responsible for the space.

(3) Conceptual space planning drawings with floor layouts may be made available for presentations to professional designers (architect/engineers, etc.), professional schools for educational purposes, community planning groups participating in the design of new Federal space, or professional print publications if specific SBU building information (structural columns, utilities, etc.) is not shown and judges' chambers, secure circulation routes, secure elevator locations, etc. are shown as generic space with no wall partitions (such as a block of unpartitioned space labeled "Judicial Space"). Generic concept

(bubble) diagrams may be shown to convey information for a non-specific building.

Note: It is the responsibility of the disseminator to use good judgement and to apply the principle that the more open the forum, the more generic/conceptual the information must be.

(4) Detailed floor layout drawings of any kind for specific buildings shall not be made available over the public internet or in public presentations or print media, such as brochures, magazines, books, etc.

9. Reasonable care for dissemination of sensitive but unclassified (SBU) building information. Those who are disseminating SBU building information

(which includes flowdown dissemination by prime/general contractors, subcontractors, suppliers, architects/engineers, Federal Agencies, lessors, private sector planrooms, state and local governments, print shops/reprographic firms, etc.) must obtain a signed copy of the Document Security Notice

(attached) by authorized users of SBU building information that they will exercise reasonable care when handling SBU building documents.

"Reasonable care" is defined as:

a. Limiting dissemination to authorized users. Dissemination of information shall only be made upon determination that the recipient is authorized to receive it. The criterion to determine authorization is need-to-know. Those with a need-to-know are other Federal Government agencies (who shall make requests through their agency management), and non-Government entities that are specifically granted access for the conduct of business on behalf of or with

GSA. This includes those necessary to do work at the request of the

Government, such as architects and engineers, consultants, contractors, subcontractors, suppliers, planrooms, and others that the contractor deems necessary in order to submit an offer/bid or to complete the work or contract, as well as maintenance and repair contractors and equipment service contractors.

Note: It is the responsibility of the person or firm disseminating the information to assure that the recipient is an authorized user and to keep the Document Security

Notice records of recipients.

Authorized users shall provide identification as set forth below:

(1) Valid identification for Federal Government users. Valid identification of authorized Government users receiving SBU building information shall be verification of Government employment.

(2) Valid identification for non-Government users. Authorized non-

Government users shall provide valid identification to receive SBU building information. Valid identification shall be all items I through III, and including item IV, as necessary:

I. A copy of a valid business license or other documentation granted by the state or local jurisdiction to conduct business. The license at a minimum shall provide the name, address, phone number of the company, state of incorporation, and the name of the individual legally authorized to act for the company. The business must be of the type required to do the work. A general contractor's license may be substituted for the business license in states that issue such licenses. In the rare cases where a business license is not available from the jurisdiction, the information shall be provided and testified to by the submitter; and

II. Verification of a valid DUNS Number against the company name listed on the business license or certification. Verification may be obtained through http://www.fpdc.gov, or by calling Dun & Bradstreet at 703-807-5078 to set up an account; and

III. A Valid IRS Tax ID Number of the company requesting the information;

and, as necessary, IV. A Valid picture state driver's license shall be required of person(s) picking up SBU documents. Phone verification must be made to a previously validated authorized user that the individual(s) picking up the documentation is/are authorized to do so by the company obtaining the documents. SBU documents will not be released to any individual or firm who has not, either previously or at the time of pickup, supplied the required documentation as outlined in paragraphs I through III, above.

b. Record keeping. Those who disseminate SBU building information must require a signed Document Security Notice from those who receive the information. Records of the signed Document Security Notices shall be maintained by the disseminator pursuant to the GSA system of keeping long-term records and plans. At the completion of work, secondary and other disseminators shall be required to turn over their Document Security Notice dissemination records to GSA to be kept with the permanent files.

c. Retaining and destroying documents. The efforts required above shall continue throughout the entire term of contract and for whatever specific time thereafter as may be necessary. Necessary record copies for legal purposes

(such as those retained by the architect, engineer, or contractor) must be safeguarded against unauthorized use for the term of retention. Documents no longer needed shall be destroyed (such as after contract award, after completion http://www.fpdc.gov/ of any appeals process, or completion of the work). Destruction shall be done by burning or shredding hardcopy, and/or physically destroying CD's, deleting and removing files from the electronic recycling bins, and removing material from computer hard drives using a permanent erase utility or similar software.

d. Notice of disposal. For all contracts using SBU building information, the contractor shall notify the GSA contracting officer that he and his subcontractors have properly disposed of the SBU building documents, with the exception of the contractor's record copy, at the time of Release of Claims to obtain final payment.

10. Miscellaneous.

a. State and local governments. In order to comply with local regulations, GSA must provide localities with documents to issue building permits and to approve code requirements. Public safety entities such as fire departments and utility departments require unlimited access on a need-to-know basis. These authorities must be informed at the time they receive the documents that the information requires restricted access from the general public. When these documents are retired to local archives, they should be stored in restricted access areas. This order will not preclude the dissemination of information to those public safety entities.

b. Electronic transfer and dissemination. Transfer and dissemination of SBU information beyond the GSA intranet (internet or extranet, modem, DSL, wireless, etc.) must use at least 128 bit symmetric key encryption following

NIST Special Publication 800-21 Guideline For Implementing Cryptography in the Federal Government. All transfers must use standard commercial products

(such as PGP and Secret Agent) with encryption algorithms that are at least 128 bit symmetric (3DES, AES, RC4, IDEA, etc.), and follow the instructions outlined in this order. Authorized users that use project extranets for electronic project management during design or after construction contract award to transfer SBU building information are responsible for verifying and certifying to the Government contracting officer that project extranets meet applicable physical and technical GSA security requirements as determined by the PBS

Chief Information Officer (CIO). Access to the sites shall be password protected and access shall be granted only on a need-to-know basis. A record of those individuals who have had electronic access shall be maintained by the contracting officer or other disseminator in accordance with the GSA system of keeping long-term records.

c. Appropriate levels of security. GSA intends to meet project security requirements as defined by our client agencies. This order is meant to define the minimum security requirements of GSA for SBU building information. A client agency may define an individual project requiring additional security over that outlined in this order. Any information classified for national security purposes shall be handled according to the DOD 5220.22-M National Industrial

Security Program Operating Manual (NISPOM) and other appropriate national security directives.

d. Freedom of Information Act (FOIA) requests. Because of the sensitive nature of SBU building information from a security standpoint, it shall not be disclosed pursuant to a FOIA request without a thorough analysis of the security implications and any potentially applicable exemptions under the

FOIA. Any determination to disclose SBU building information pursuant to a

FOIA request must be made by the PBS ARA or the PBS Deputy

Commissioner, after consultation with the servicing legal office and the servicing FPS office.

e. Proprietary information owned by Architect/Engineers. All professional services consultants shall sign the Document Security Notice that documents containing SBU building information created under contract to the Federal

Government shall be handled according to the procedures under this order.

f. Private sector planrooms. Numerous private sector businesses provide planrooms, which provide access to construction plans and specifications for bidding purposes as a service to construction contractors and subcontractors.

Before receiving GSA SBU building information from any source for dissemination, the private sector planroom shall demonstrate to GSA that they can and will adhere to the procedures outlined in this order, and sign the

Document Security Notice.

g. Reporting incidents of concern. Any concern of a significant security risk should be reported immediately to the FPS Megacenter or to the FPS

Investigation Section at (202) 501-0793 and any other security agencies as deemed appropriate.

F. JOSEPH MORAVEC

Commissioner

Public Buildings Service

Request for Construction Documents Exhibit _______________

Attachment _______________

Solicitation _______________

DOCUMENT SECURITY

NOTICE TO PROSPECTIVE BIDDERS/OFFERORS

This solicitation includes Sensitive But Unclassified (SBU) building information.

SBU documents provided under this solicitation are intended for use by authorized users only. In support of this requirement, GSA requires bidders/offerors to exercise reasonable care when handling documents relating to SBU building information per the solicitation.

REASONABLE CARE:

1. Limiting dissemination to authorized users. Dissemination of information shall only be made upon determination that the recipient is authorized to receive it. The criterion to determine authorization is need-to-know. Those with a need-to-know are those who are specifically granted access for the conduct of business on behalf of or with GSA. This includes all persons or firms necessary to do work at the request of the Government, such as architects and engineers, consultants, contractors, sub-contractors, suppliers, and others that the contractor deems necessary in order to submit an offer/bid or to complete the work or contract, as well as maintenance and repair contractors and equipment service contractors.

Note: It is the responsibility of the person or firm disseminating the information to assure that the recipient is an authorized user and to keep records of recipients.

Authorized users shall provide identification as set forth below:

Valid identification for non-Government users. Authorized non-Government users shall provide valid identification to receive SBU building information. The identification shall be presented and verified for each dissemination. Valid identification shall be all items

(a) through (c), below, and including item (d), as necessary:

(a) A copy of a valid business license or other documentation granted by the state or local jurisdiction to conduct business. The license at a minimum shall provide the name, address, phone number of the company, state of incorporation, and the name of the individual legally authorized to act for the company. The business must be of the type required to do the work. A general contractor's license may be substituted for the business license in states that issue such licenses. In the rare cases where a business license is not available from the jurisdiction, the information shall be provided and testified to by the submitter; and

(b) Verification of a valid DUNS Number against the company name listed on the business license or certification. Verification may be obtained through http://www.fpdc.gov, or by calling Dun & Bradstreet at 703-807-5078 to set up an account; and

(c) A Valid IRS Tax ID Number of the company requesting the information; and, as necessary,

(d) A Valid picture state driver's license shall be required of person(s) picking up SBU documents. Phone verification must be made to a previously validated authorized user that the individual(s) picking up the documentation is authorized to do so by the company obtaining the documents. SBU documents will not be released to any individual or firm who has not, either previously or at the time of pickup, supplied the required documentation as outlined in paragraphs (a) through (c), above.

2. Retaining and destroying documents. The efforts required above shall continue throughout the entire term of the contract and for whatever specific time thereafter as may be necessary. Necessary record copies for legal purposes (such as those retained by the architect, engineer, or contractor) must be safeguarded against unauthorized use for the term of retention. Documents no longer needed shall be destroyed (such as after contract award, after completion of any appeals process or completion of the work).

Destruction shall be done by burning or shredding hardcopy, and/or physically destroying

CD's, deleting and removing files from the electronic recycling bins, and removing material from computer hard drives using a permanent erase utility or similar software.

3. Term of Effectiveness. The efforts required above shall continue throughout the entire term of contract and for what specific time thereafter as may be necessary, as determined by the Government. Necessary record copies for legal purposes (such as those retained by the architect, engineer, or contractor) must be safeguarded against unauthorized use for the term of retention.

4. Written agreement of disposal. For all contracts using SBU building information, the contractor shall provide a written statement that he and his subcontractors have properly disposed of the SBU building documents, with the exception of the contractor's record copy, at the time of Release of Claims to obtain final payment. Documents no longer needed shall be destroyed (such as after contract award, after completion of any appeals process or completion of the work). Destruction shall be done by burning or shredding hardcopy, and/or physically destroying CDs, deleting and removing files from the electronic recycling bins, and removing material from computer hard drives using a permanent erase utility or similar software.

The recipient acknowledges the requirement to use reasonable care, as outlined above, to safeguard the documents and, if not awarded, the contract (and at the completion of any protest/appeal process) will make every reasonable and prudent effort to destroy or render useless all SBU information received during the solicitation.

http://www.fpdc.gov/

I agree that I will abide by this agreement and will only disseminate Sensitive But

Unclassified (SBU) building information to other authorized users under the conditions set forth above.

Signature:______________________________________________

Title:__________________________________________________

Date:__________________________________________________

Copy of business license attached

DUNS Number:_________________________________________

Verified: Yes No

IRS Tax ID Number______________________________________