NPR 1600.1.pdf

| NODIS Library | Organization and Administration(1000s) | Search |

NASA

Procedural Requirements

NPR 1600.1A

Effective Date: August 12, 2013

Expiration Date: June 12, 2021

COMPLIANCE IS MANDATORY FOR NASA EMPLOYEES

NASA Security Program Procedural Requirements

Responsible Office: Office of Protective Services

Table of Contents Preface P.1 Purpose P.2 Applicability P.3 Authority P.4 Applicable Documents and Forms P.5 Measurement/Verification P.6 Cancellation

Chapter 1. Introduction

1.1 Overview

1.2 Responsibilities

1.3 Best Practices

1.4 Exceptions and Waivers

Chapter 2. Security Operations

2.1 Security Control at NASA Centers

2.2 Inspection of Persons and Property

2.3 Violations of Security Requirements

2.4 Denial of Access

2.5 Imminent Security Threat or Safety Risk

2.6 Denial of Access - Security Considerations

2.7 NASA Security Areas

2.8 Standards for Secure Conference Rooms

2.9 Technical Surveillance Countermeasures (TSCM)

2.10 National Terrorism Advisory System (NTAS)

NPR 1600.1A -- TOC

This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1600.1A -- TOC Page 1 of 75 https://nodis3.gsfc.nasa.gov/main_lib.html https://nodis3.gsfc.nasa.gov/lib_docs.cfm?range=1___ https://nodis3.gsfc.nasa.gov/adv_search.cfm https://nodis3.gsfc.nasa.gov/

2.10 National Terrorism Advisory System (NTAS)

2.11 NASA NTAS Program

2.12 Security Threat and Incident Reporting

2.13 Protective Services Response to Demonstrations and Civil Disturbances

2.14 Hazardous Material Security

2.15 Investigations

2.16 Security Education, Training, and Awareness (SETA) Program

2.17 NASA OPS Functional Reviews

Chapter 3. Program Security and NASA Critical Infrastructure

(NCI)

3.1 General

3.2 Responsibilities

3.3 OPSEC

3.4 Risk Management Process

3.5 Special Security Programs

3.6 NASA Critical Infrastructure (NCI) and Key Resources Identification, Prioritization, and Protection

Chapter 4. Control, Issuance, and Storage of Arms, Ammunition, and Explosives (AA&E)

4.1 Authority

4.2 Responsibilities

4.3 Authorization to Carry Firearms

4.4 Carrying Weapons on Commercial Aircraft

4.5 Firearms Instruction

4.6 Training

4.7 Maintenance of Proficiency

4.8 Records

4.9 Firearms Standards

4.10 Weapons

4.11 Exchange of Weapons

4.12 Firearm Maintenance

4.13 Ammunition

4.14 Accountability of AA&E

4.15 Storage of AA&E

Chapter 5. NASA Protective Services Office Special Agent and Security Specialist Badges and Credentials (B&C)

5.1 Badge and Credential Use

5.2 Badge and Credential Issuance

5.3 Badge and Credential Return

5.4 Retired Law Enforcement Credentials

NPR 1600.1A -- TOC

This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1600.1A -- TOC Page 2 of 75

5.4 Retired Law Enforcement Credentials

Chapter 6. NASA Armed Personnel Training, Certification, and Authority

6.1 General

6.2 Applicability

6.3 Responsibilities

6.4 Security Equipment Approval and Use

Appendix A. Definitions Appendix B. Acronyms Appendix C. Property Loss and Incident Details Appendix D. NASA National Threat Advisory System (NTAS) Appendix E. NASA Serious Incident Report Format Appendix F. Identifying and Nominating NASA Assets for NASA Critical Infrastructure Identification, Prioritization, and Protection Appendix G. NASA Federal Arrest Authority and Use of Force Training Curriculum Appendix H. Discharge of Firearms

NPR 1600.1A -- TOC

This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1600.1A -- TOC Page 3 of 75

Preface P.1 Purpose

a. Per Title 51, section 20132, this NASA Procedural Requirement (NPR) establishes Agency protective services implementation requirements set forth in NASA Policy Directive (NPD) 1600.2, NASA Security Policy, as amended.

b. This NPR prescribes NASA protective services procedural requirements for NASA Centers and Component Facilities in executing the NASA security program to protect people, property, operations, and Classified National Security Information (CNSI). It establishes program specifications necessary to achieve uniformity, standardization, centralization, and decision-making authority where appropriate. Policy and procedural requirements for the protection of CNSI is further promulgated in NASA NPR 1600.2, NASA Classified National Security Information.

c. Protection and handling requirements for NASA sensitive unclassified information as of the date of this revision are provided for within the Sensitive But Unclassified (SBU) policy and procedures, NASA Interim Directive (NID) 1600.55, Sensitive But Unclassified (SBU) Information. This policy is scheduled to change in FY 2013 as NASA executes Executive Order 13556, November 4, 2010, Implement Controlled Unclassified Information (CUI). This Executive Order mandates the implementation of a Government-wide program which, when fully implemented, will replace SBU policy and procedures in their entirety. No use of the designation CUI is authorized at this time or until official notification is made by the Office of the Chief Information Officer.

d. NPR 1382.1, NASA Privacy Procedural Requirements, sets forth the requirements for protecting of the privacy of personal information, such as Personally Identifiable Information (PII).

P.2 Applicability This NPR is applicable to NASA Headquarters and all NASA Centers, including Component Facilities, to the Jet Propulsion Laboratory (JPL), a Federally Funded Research and Development Center, and NASA contractors to the extent specified in their contracts. Address comments regarding this NPR to the AA for the Office of Protective Services or the NASA Headquarters designee. Refer questions concerning the application of these requirements to specific NASA Centers to the appropriate NASA Center Protective Services Office.

P.3 Authority National and Commercial Space Programs, 51 U.S.C. § 20132, § 20133 and § 20134, Pub. L. No.

111—314, 124 Stat. 3328 (December 18, 2010).

P.4 Applicable Documents and Forms

a. Violation of Regulations of National Aeronautics and Space Administration, 18 U.S.C. § 799.

b. Unlawful Acts, 18 U.S.C. § 922 (d) (9).

NPR 1600.1A -- Preface This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1600.1A -- Preface Page 4 of 75

c. Atomic Energy Act of 1954, as amended, 42 U.S.C. § 2011 et seq.

d. Permission to Use Firearms, 51 U.S.C. § 20133.

e. Arrest Authority, 51 U.S.C. § 20134.

f. The Homeland Security Act, Pub. L. No. 107-296, 116 Stat. 2135 (2002).

g. Classified National Security Information, Exec. Order No. 13526, 75 C.F.R. 707 (2010).

h. Controlled Unclassified Information, Exec. Order No. 13556.

i. Suitability, 5 C.F.R. Part 731.

j. Chemical Facility Antiterrorism Standards (CFATS), 6 C.F.R. Part 27.

k. Security Programs; Arrest Authority and Use of Force by NASA Security Force Personnel, 14 C.F.R Part 1203(b).

l. Inspection of Persons and Personal Effects at NASA Installations or on NASA Property; Trespass or Unauthorized Introduction of Weapons or Dangerous Materials, 14 C.F.R. Part 1204, subpart 10.

m. Law Enforcement Officers Safety Act Improvements Act of 2013, as amended.

n. NPD 1000.3D, NASA Organization (w/change 37, dated June 11, 2013).

o. NPR 1382.1, NASA Privacy Procedural Requirements.

p. NPD 1440.6H, NASA Records Management.

q. NPD 1600.2E, NASA Security Policy.

r. NPD 1600.3, NASA Prevention of and Response to Workplace Violence.

s. NPD 1600.4, National Security Programs.

t. NPR 1600.2, NASA Classified National Security Information (CNSI).

u. NPR 1600.3, NASA Personnel Security.

v. NID 1600.55, Sensitive But Unclassified (SBU) Controlled Information.

w. NPR 1620.2, Facility Security Assessments.

x. NPR 1620.3A, Physical Security Requirements for NASA Facilities and Property.

y. NPR 2810.1, Security of Information Technology.

z. NPR 4200.1, NASA Equipment Management Procedural Requirements.

aa. NPR 8000.4A, Agency Risk Management Procedural Requirements.

bb. NPR 8621.1, NASA Procedural Requirements for Mishap and Close Call Reporting, Investigating, and Recordkeeping (w/Change 6, dated October 24, 2011).

cc. NPR 8715.3, NASA General Safety Program Requirements (w/Change 8 dated June 20, 2012).

dd. NASA Technical Standard (NASA-STD) 8719.12, Safety Standard for Explosives, Propellants, NPR 1600.1A -- Preface This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1600.1A -- Preface Page 5 of 75

dd. NASA Technical Standard (NASA-STD) 8719.12, Safety Standard for Explosives, Propellants, and Pyrotechnics

ee. Sensitive Compartmented Information Facilities (SCIFs), Director of National Intelligence (DNI) Intelligence Community Directive (ICD) 705.

ff. Technical Surveillance Countermeasures (TSCM) ICD 702. gg. NSDD 298: National Operations Security Program. hh. Critical Infrastructure Security and Resilience Presidential Policy Directive

(PPD)-21.

ii. Homeland Security - Interagency Security Committee Standards (ISC), Physical Security Criteria for Federal Facilities (2010).

jj. SF 312, Classified Information Nondisclosure Agreement.

kk. SCI NDI 4414 Sensitive Compartmented Information (SCI) Nondisclosure Agreement.

ll. NF 1506, Controlled Area Sign (Outdoors).

mm. NF 1506A, Controlled Area Sign (Indoors).

nn. NF 1507, Limited Area Sign (Outdoors).

oo. NF 1507A, Limited Area Sign (Indoors).

pp. NF 1508, Exclusion Area Sign (Outdoors).

qq. NF 1508A, Exclusion Area Sign (Indoors).

P.5 Measurement/Verification

a. Center Directors and Center Chiefs of Protective Services/Chiefs of Security (CCPS/CCS) or their designees determine, implement, ensure, and document compliance by applying a verification approach that is tailored to meet the needs of the Center. The Office of Protective Services (OPS) conducts functional reviews of the Centers, spot-checks, and inspections to review Center compliance and implementation.

b. To determine the OPS compliance with the requirements in this NPR, internal and external auditors responsible for verifying Headquarters requirements and processes shall evaluate performance against the requirements contained herein.

P.6 Cancellation This NPR cancels the remaining chapters of NPR 1600.1, NASA Security Program Procedural Requirements w/Change 2, dated April 1, 2009. The remaining Chapters are: 1, 6-10 and Appendices D, E, F, G, H, K, L, and O.

Original Signed by

Richard J. Keegan Associate Administrator Mission Support Directorate

NPR 1600.1A -- Preface This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1600.1A -- Preface Page 6 of 75

NPR 1600.1A -- Preface This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1600.1A -- Preface Page 7 of 75

Chapter 1. Introduction

1.1 Overview

1.1.1 This NPR establishes Agency-wide program policy and guidance for security operations, program security, and NASA Federal Arrest Authority (FAA).

1.1.2 This NPR establishes standards and specifications required to maintain consistency and uniformity for the protection of NASA assets, while considering the unique requirements, circumstances, and environments of individual NASA Centers and locations. During emergencies or periods of increased threat, exigent circumstances may require suspension of certain provisions of this NPR. In that event, immediate coordination with the Assistant Administrator, Office of Protective Services (AA, OPS) is required.

1.1.3 This NPR also presents terminology, definitions, and security measures that are intended to facilitate coordination and support with other U.S. Federal agencies such as the Department of Homeland Security (DHS), Federal Bureau of Investigation (FBI), and the Department of Defense (DoD).

1.1.4 This NPR provides for the assignment and delegation of certain security and protection responsibilities as required by law, regulation, and sound management practice.

1.2 Responsibilities

1.2.1 Security is the direct, immediate, and inherent responsibility of all NASA personnel, contractors, and all others who are granted access to NASA Centers, facilities, information, and technology. General security responsibilities are set forth in this NPR. Specific policy requirements are cited in this NPR.

1.2.2 The NASA Administrator is responsible for implementing a comprehensive and effective security program for the protection of people, property, operations, and information associated with the NASA mission. The Administrator shall appoint an AA, OPS.

1.2.3 The AA, OPS shall:

a. Oversee Agency implementation, integration of, and compliance with the NASA security program by providing executive management policy direction and ensuring through Agency advocacy, adequate resources are identified and committed to accomplish the security mission in support of the overall NASA mission, NASA Strategic Plan, and national-level security requirements.

b. Provide functional and operational support for physical and program security policy formulation.

c. Provide overall focus and direction for protecting the NASA workforce, visitors, programs, and infrastructure.

d. Develop and implement Agency policy and procedural requirements to ensure law enforcement and investigative activity performed in conjunction with OPS security responsibilities at NASA installations are developed and implemented in consistence with authorities granted under the Public Law 111-314. This shall be consistent with the NASA Office of Inspector General (OIG)

NPR 1600.1A -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1600.1A -- Chapter1 Page 8 of 75 investigative authorities and in close coordination and cooperation with local, state, and Federal law enforcement agencies as defined in the appropriate memoranda of agreement (MOA).

e. Serve as the Agency Risk Acceptance Authority (RAA) for all NASA security program risk management determinations that require a waiver of Agency security requirements. This does not include IT Security RAA, which is the Chief Information Officer's (CIO) responsibility.

f. Serve as the Agency point of contact with the intelligence community for intelligence matters and ensure development and issuance of policy and requirements related to NASA's counterintelligence program.

g. Serve as the Agency Critical Infrastructure Assurance Officer (ACIAO) responsible for approving all Center proposals for additions and deletions to the NASA Critical Infrastructure (NCI) Inventory List when such proposals are concurred on by the respective Mission Directorate Associate Administrator.

h. Comply with all relevant Executive Orders, Presidential Directives, Presidential Policy Directives (PPDs), and other binding directives including the requirements of PPD-217, Critical Infrastructure Security and Resilience.

i. Provide central oversight and conduct assessments of the NASA Critical Infrastructure Protection Program (NCIPP).

j. Effectively coordinate and collaborate with the CIO to ensure critical cyber assets are identified and included in the NCI inventory.

k. Establish and implement organizational standards that ensure NASA security programs are appropriately configured, properly staffed with qualified security professionals, and adequately funded to enable each NASA Center to properly and efficiently manage day-to-day security operations while allowing for transition to increased threat environments and emergency scenarios, including appropriate continuity of operations and contingency operations capabilities.

l. Develop and issue, under separate NPR, facility security assessment requirements and physical security requirements for NASA facilities and property. These NPRs shall include the facility assessment, physical and procedural standards to ensure consistency and uniformity in the application of security measures that comply with Interagency Security Committee (ISC) standards.

m. Establish, disseminate, and enforce comprehensive performance standards that address overall security capabilities, training, response to likely emergencies and contingencies, and general compliance with Agency standards. Conduct inspections, as well as scheduled and unscheduled reviews, to ensure compliance and efficiency.

n. Establish, disseminate, and ensure adherence to NASA Protective Services Contract (NPSC) standards. Serve as the final approving official for technical portions of each Center contract prior to solicitation in order to maintain consistent contract standards.

o. Implement and manage procedures for certifying and obtaining accreditation of IT resources that process CNSI.

p. Serve as the Agency oversight official for implementation and management of the Agency FAA Program and Use of Force policy in compliance with 51 U.S.C. § 20133, 20134, and 14 C.F.R. Part 1203b-Security Programs; Arrest Authority and Use of Force by NASA Security Force Personnel.

NPR 1600.1A -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1600.1A -- Chapter1 Page 9 of 75

q. Establish and maintain a Central Adjudication Facility to adjudicate all Agency requests for security clearances for access to CNSI.

r. Coordinate security and law enforcement policy with the Office of General Counsel.

s. Evaluate compliance with this NPR and overall effectiveness of the NASA security program through periodic site visits and functional reviews.

t. Ensure that the NASA security program operates in compliance with national security policy, applicable DHS program directives, and other national-level regulations.

u. Coordinate NASA representation on all security policy development forums and committees.

v. Serve as NASA representative to the DHS ISC.

w. Responsible for the NASA TSCM program.

1.2.4 Center Directors shall:

a. Provide current and effective security for all Center and Component Facility personnel, property, facilities, operations, and CNSI consistent with this NPR.

b. Appoint a qualified and experienced CCPS/CCS in coordination with and after obtaining the concurrence of the AA, OPS, in accordance with NPD 1000.3D, The NASA Organization. Minimum qualifications include:

(1) Sufficient authority and resources to accomplish national, Agency, and Center security goals and objectives with coordination and concurrence of the AA, OPS.

(2) Relevant experience in the security management, national security intelligence, emergency management, or law enforcement professions.

(3) Leadership and managerial experience at a proven level commensurate with the expectations and requirements of the CCPS/CCS position.

(4) Ability to obtain and maintain a Top Secret security clearance.

c. In accordance with this NPR, establish, fund, and maintain a comprehensive security program through the CCPS/CCS. This includes:

(1) Personnel, facilities, and equipment necessary to implement and sustain an effective security program.

(2) Appropriate training and professional certification of security personnel, as established by the

AA, OPS.

(3) The development and management of Center-specific security program policy and procedural requirements that implement this NPR's requirements.

d. When recommended by the CCPS/CCS and Center CIAO, propose NCI and Key Resource assets for inclusion in the NCI Inventory to the Mission Directorate Associate Administrator(s).

e. Act as the Designated Official (DO) and RAA for Center security program risk management determinations that are not designated as NCI or do not require waiver of national security requirements.

NPR 1600.1A -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1600.1A -- Chapter1 Page 10 of 75

f. Appoint in writing a Center Designated Approval Authority (DAA) and Certifying Authority (CA) responsible for certifying to the Agency DAA, Center information technology (IT) resources identified to process CNSI.

1.2.5 Under authority delegated from the AA, OPS, the CCPS/CCS shall:

a. Act as the principal advisor and authority to the Center Director in all matters relating to the NASA security program, as established and defined in NPD 1600.2, NASA Security Policy, as amended.

b. Develop, implement, and maintain written Center-specific security program policy and procedural requirements that implement the requirements of this NPR.

c. Direct, plan, control, and evaluate the overall Center security program, regardless of the specific security discipline and processes involved.

d. Through periodic assessments, determine the adequacy of physical security, loss prevention, and antiterrorism programs and recommend improvements and associated budget requirements to the Center Director.

e. Coordinate with the Center CIAO and oversee all aspects of the Center NCIPP.

f. Using all available sources of intelligence information (i.e., NASA counterintelligence/counterterrorism program, local law enforcement, the NASA OIG, and other Federal agencies), continuously evaluate Center and program-level criticality and vulnerabilities and local threats and prepare appropriate countermeasures tailored to the resources requiring protection, specifically identifying Center Critical Infrastructure and Key Resources, in coordination with the Center CIO and CIAO, for inclusion in the NCIPP.

g. Establish priorities for the effective deployment of Center security resources and processes during routine and emergency situations.

h. Ensure FAA is properly administered at their respective Center and act as the Center Certifying Official for the authority to carry and use concealed or unconcealed firearms by security forces, both NASA civil service personnel and contractor.

i. Notify the OIG of suspected criminal activity consistent with existing Memoranda of Understanding (MOU) or agreements.

j. Integrate and maintain oversight of all Center security activity, including those of tenant organizations to the extent feasible.

k. Ensure appropriate training and professional certifications for security staff and armed security force personnel commensurate with their assigned tasks, weapons, and equipment. To the extent possible, follow NASA standard processes, procedures, and certifications.

l. Ensure the AA, OPS provides concurrence on NPSCs prior to solicitation.

m. Act as the Center Director's primary staff advisor during any security-related crisis or serious incident and as primary representative to all external law enforcement agencies on security matters.

n. Establish and maintain annual security awareness and training programs for Center employees.

o. Participate as a principal member of Center teams dealing with resolution of workplace violence

NPR 1600.1A -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1600.1A -- Chapter1 Page 11 of 75 and protection issues as set forth in NPD 1600.3, NASA Policy Directive on Prevention of and Response to Workplace Violence.

p. Maintain a Center map of the precise jurisdictional boundaries of Center geographical areas, as determined by the Chief Counsel.

q. Maintain Center security program statistics and provide quarterly reports to the AA, OPS utilizing the format in Appendix C, Property Loss and Incident Details of this NPR.

r. Establish and maintain all organization informational and operational files pursuant to NPD 1440.6H, NASA Records Management, and NPR 1441.1D, NASA Records Retention Schedules.

s. Establish a system that ensures security requirements and provisions are identified at the outset of new or changing programs, acquisitions, new construction, major renovations, and modifications.

t. Ensure compliance with NPR 4200.1, NASA Equipment Management Procedural Requirements.

1.2.6 Program, Line Managers, and Supervisors shall:

a. Support the CCPS/CCS in the implementation of comprehensive security programs and mission-oriented protective services for the Center, along with individual programs and projects.

b. Ensure deployment of CCPS/CCS recommended security and loss-prevention measures within their programs and/or project or organizations.

c. Report adverse information discovered to the CCPS/CCS.

d. When an employee's clearance, eligibility for a sensitive position, or access to NASA facilities is suspended or revoked and when an employee violates security rules and procedures, take appropriate action as directed by the CCPS/CCS.

1.2.7 Individual employees shall:

a. Report suspicious activity, criminal activity, violations or suspected violations of national security, and other Center security requirements to the Center Protective Services or Security Office.

b. Recognize and comply with individual responsibilities and roles in maintaining the Agency and Center security program.

c. Protect Government property, programs, IT systems, CNSI, and sensitive information in accordance with the requirements of this NPR, NPR 1600.2, NASA CNSI, and NPR 1382.1, Privacy Procedural Requirements.

d. Cooperate with NASA security officials during inquiries and investigations.

e. Complete security education, awareness orientation, and refresher training as required.

1.3 Best Practices

In conjunction with other programs, directories, or offices, the AA, OPS and CCPS/CCS shall develop and share "best practices" programs and processes where appropriate.

1.4 Exceptions and Waivers

NPR 1600.1A -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1600.1A -- Chapter1 Page 12 of 75

1.4.1 Centers may occasionally experience difficulty in meeting specific security program requirements established in this NPR and may request an exception or waiver.

1.4.1.1 An "exception" is a request for a one-time deviation or exemption from compliance otherwise with a specific procedural requirement, typically for a single event granted by the Associate Administrator, Mission Support Directorate (AA, MSD). Exceptions are for a specified period of time, normally not exceeding one year, and are based upon appropriate justification to allow a Center, organization, or program time to achieve compliance. Upon expiration of the approved exception, compliance is mandatory unless an extension is granted by the AA, MSD.

1.4.1.2 A "waiver" is a request for a permanent or extended deviation or exemption (for the foreseeable future) for compliance with a specific procedural requirement granted by the AA, MSD.

Waiver requests may be approved only in part, such as for a period less than requested or for only parts of the measures requested to be waived.

1.4.2 The process for submitting requests for exceptions or waivers to specific elements of the NASA security program requires that the program or project manager and CCPS/CCS justify the waiver request through:

a. Security risk analysis (e.g., cost of implementation).

b. Effect of potential loss of capability to the Center.

c. Compromise of CNSI.

d. Injury or loss of life; loss of one-of-a-kind capability.

e. Inability of the Center to perform its missions and goals.

(1) Justification will also include an explanation of any compensatory security measures implemented in lieu of specific requirements.

(2) The waiver request shall be submitted to the Center Director.

1.4.3 The Center Director shall either recommend approval or return the waiver request to the CCPS/CCS for further study or closure. The Center Director forwards concurrence to the AA, MSD.

1.4.4 The AA, MSD shall review waiver requests and forward to the AA, OPS requesting concurrence and/or comments.

1.4.5 The AA, OPS shall return the waiver request to the AA, MSD with a recommendation for approval of the waiver, further study, or denial.

1.4.6 The AA, MSD shall return the waiver requests to the Center Director with his approval or disapproval.

NPR 1600.1A -- Chapter1 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1600.1A -- Chapter1 Page 13 of 75

Chapter 2. Security Operations

2.1 Security Controls at NASA Centers

2.1.1 Procedures shall be implemented to ensure only authorized personnel are admitted to NASA controlled, owned, and leased property.

2.1.2 Each Center shall apply and maintain appropriate physical security measures necessary to provide for protection of persons, missions, information, and property as promulgated in NPR 1620.3A, Physical Security Requirements for NASA Facilities and Property.

2.1.3 The maintenance of a controlled perimeter and entry access control points (ACPs) are fundamental to NASA's security-in-depth approach to physical security.

2.1.3.1 All Center perimeter entry ACPs open to traffic shall be staffed by armed, uniformed Security Police Officer (SPO)/Security Officer (SO) personnel at all times. The SPO/SO will:

a. Validate the personnel identification and access eligibility of all personnel entering NASA property by visually examining Federal identification or locally produced, temporary visitor identification or passes.

b. Visually match the photograph with the face of the person presenting the identification.

c. Authenticate identification cards and access using automated means where available.

d. Assess entering vehicles for obvious security concerns.

2.1.3.2 To prevent unauthorized access to critical areas, information, or personnel, additional access control measures, including the use of unarmed personnel, electronic access equipment, and passive and active barriers may be established at individually designated ACPs, security areas, and facilities within the Center.

2.1.3.3 Each Center shall be responsible for the procurement, installation, management, and maintenance of all Center premise access control equipment, integrated intrusion detection, closed-circuit video equipment, and any peripheral equipment.

2.1.3.4 SPO/SOs shall be used throughout the Center to provide traffic safety, detect and deter criminal conduct, enforce security rules and policies, detect unauthorized personnel, act as first responders to critical incidents, establish emergency or temporary control points, respond to calls for assistance, and perform other duties as determined by the CCPS/CCS.

2.1.4 Photography at NASA Facilities.

2.1.4.1 Center Directors, in coordination with the CCPS/CCS and the Center Office of the Chief Counsel, shall establish and implement an individual Center photography policy for the general and public access areas consistent with existing security conditions.

2.1.4.2 Photography is prohibited in Limited areas, Exclusion areas, and within NCI facilities without prior approval of the CCPS/CCS.

2.2 Inspection of Persons and Property

NPR 1600.1A -- Chapter2 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1600.1A -- Chapter2 Page 14 of 75

2.2 Inspection of Persons and Property

2.2.1 General.

2.2.1.1 Consistent with NASA's requirement to ensure appropriate protection for personnel, property, and facilities, NASA reserves the right to conduct an inspection of any person and property in his/her possession as a condition of admission to, continued presences on, or upon exit from any NASA facility. Implementation of requirements, policy, and procedures for all aspects of this program shall be in accordance with 14 C.F.R. Part 1204, subpart 10. NPR 1620.3, Physical Security Requirements for NASA Facilities and Property, Appendix C addresses items prohibited from NASA facilities. Where NASA facilities are located on a military installation or an area of concurrent/proprietary jurisdiction, NASA personnel are subject to their policies and procedures.

2.2.1.2 All entrances to NASA real property or installations shall be conspicuously posted with the following notices:

a. "CONSENT TO INSPECTION: Your entry into, continued presence on, or exit from this installation is contingent upon your consent to inspection of person and property."

b. "UNAUTHORIZED INTRODUCTION OF WEAPONS OR DANGEROUS MATERIALS IS PROHIBITED: Unless specifically authorized by NASA, you may not carry, transport, introduce, store, or use firearms or other dangerous weapons, explosives or other incendiary devices, or other dangerous instrument or material likely to produce substantial injury or damage to persons or property."

2.2.2 SPO/SOs shall be trained on how to perform inspections and, with appropriate training, may use inspection tools and detection devices (mirrors, x-ray, and other sensing devices) and/or canines, as necessary.

2.2.2.1 Training for security personnel conducting searches shall include:

a. Appropriate search techniques for the type of vehicle being searched.

b. Key locations where devices or other contraband may be secreted.

c. Procedures for confiscating illegal or dangerous items, detaining of individuals, and referring incidents to the NASA OIG or appropriate external law enforcement.

2.2.2.2 Such inspections shall be conducted in accordance with the following guidelines:

a. Consent to Inspection Notices shall be prominently posted at entrances to NASA Centers and Facilities. Language for these notices is contained in 14 C.F.R. §1204.1003, Subpart 10.

b. Only NASA security personnel or members of the installation's uniformed security force will conduct inspections. Such inspections will be conducted in accordance with guidelines established by the AA, OPS.

c. Prior to undertaking an inspection, security personnel not in uniform shall present their NASA credentials to the subject of the inspection.

d. If, during inspection, an individual is found to be in unauthorized possession of items believed to represent a threat to the safety or security of the Center (e.g., CNSI, weapons, drugs, or explosives), or other prohibited items described in NPR 1620.3A, Physical Security Requirements for NASA

NPR 1600.1A -- Chapter2 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1600.1A -- Chapter2 Page 15 of 75

Facilities and Property, Appendix C, the items shall be confiscated, and the individual will be denied admission to or be escorted from the Center or detained at the scene as directed by the CCPS/CCS or his/her designee. The NASA OIG or appropriate local law enforcement authorities will be notified immediately.

e. If, during an inspection conducted pursuant to this subpart, an individual is in possession of U.S.

Government property without proper authorization, that person will be required to relinquish the property to the security representative pending a determination on the proper authorization for the possession of the property or its removal from the installation. The individual relinquishing the property will be provided with a receipt for the property.

2.3 Violations of Security Requirements

Anyone who willfully violates, attempts to violate, or conspires to violate any regulation or order involving NASA security requirements is subject to disciplinary action up to and including termination of employment and/or possible prosecution under 18 U.S.C. § 799, which provides fines or imprisonment for not more than one year, or both.

2.4 Denial of Access

2.4.1 To address immediate security and safety issues, the AA, OPS has delegated authority to the CCPS/CCS for denial of access. CCPS/CCS, Center Directors, and the Headquarters Operations Director or their designees may order the temporary denial of access or removal from NASA facilities/resources of any person who violates NASA security requirements, national security regulations, or whose continued presence on NASA property constitutes a security or safety risk to persons or property.

2.4.2 The foregoing is a denial of access and is distinct from suspension or removal from Federal employment of Federal civil servants, which is governed by 5 C.F.R. Parts 315, 731, 752, or 359 and in coordination with the Center Office of the Chief Human Capital Officer (OCHCO) and Center

OCC/OGC.

2.5 Imminent Security Threat or Safety Risk

2.5.1 The CCPS/CCS, Center Directors, and the Headquarters Operations Director or their designees shall order the temporary removal and/or denial of access to all NASA facilities of any person who violates NASA security requirements and whose continued presence on NASA property constitutes an imminent security threat or safety risk to persons or property. Circumstances of removal and/or denial of access will be articulated in a report to become a matter of official record.

2.5.2 Civil Service Employees.

2.5.2.1 Immediately upon taking such action, the CCPS/CCS will notify the Center Director, Center OCHCO, and Center OGC of the reasons for the decision to temporarily deny access or remove from NASA facilities/resources any civil service employee. As soon as reasonably possible, the CCPS/CCS will notify the AA, OPS. If no imminent security threat or safety risk exists, any contemplated temporary denial of access shall be advised and commented upon prior to action by Center OHCM and Center OCC/OGC. Any non-concurrence requires Center Director decision or

NPR 1600.1A -- Chapter2 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1600.1A -- Chapter2 Page 16 of 75 notification.

2.5.2.2 Upon notification by the CCPS/CCS, as designee, of the temporary removal or denial of access of the civil service employee, the Center OCHCO in consultation with OCC/OGC shall then determine the appropriate access status and any other employment limitations of the civil service employee. The employee may continue to be denied access until this status is finalized.

2.5.3 Contractor and Non-NASA Employees.

2.5.3.1 For contractor and non-NASA employees (e.g., visitors and guests) denied access, and immediately after denying access, the CCPS/CCS, as designee, shall notify the appropriate Government sponsor and contracting officer of the reasons for the decision to temporarily deny the individual's access to or remove them from the Center.

2.5.3.2 The CCPS/CCS shall notify the non-NASA employee who is denied access in writing of the reason for the temporary removal or denial of access and of the Denial of Access Reconsideration Process. Should the individual elect not to request reconsideration/appeal, the decision may become final. In his discretion, the AA, OPS may reconsider any denial of an access decision.

2.5.3.3 The CCPS/CCS shall conduct a new determination in consideration of the security violation to determine continued access eligibility of the employee consistent with the HSPD-12 credentialing standards listed in NPR 1600.3, Personnel Security Section 2.16.

2.5.3.4 Should the CCPS/CCS make a final determination to deny access, the individual may initiate the Denial of Access Reconsideration Process. This shall occur in accordance with NPR 1600.3, Personnel Security Section 2.17.

2.5.3.5 If the non-NASA employee denied access declines to appeal, either through communicating in writing or time for the appeal has expired, the original determination will be final. During the reconsideration process the individual is not granted access to any NASA facility unless coordinated with the CCPS/CCS.

2.5.3.6 Upon resignation, termination of employment, or release of the non-NASA employee by his/her employer or sponsor, the reconsideration/appeal process will otherwise continue, per NPR 1600.3, Personnel Security Section 2.17.

2.6 Denial of Access - Security Considerations

2.6.1 As designee of the AA, OPS, the CCPS/CCS shall take appropriate security measures to monitor, control, and restrict physical and logical access by individuals to the Center. These measures may include:

a. Recovery and confiscation of NASA issued access badge(s) and IT resources.

b. Posting of denial of access information at all Center access locations.

c. Notification to Center IT resources to deny IT access.

d. Suspension of access to CNSI.

e. Notification to appropriate supervisory personnel referencing denial of access.

f. Inspections and securing of the individual's Center work space.

NPR 1600.1A -- Chapter2 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1600.1A -- Chapter2 Page 17 of 75

g. Notification to other NASA Centers and the AA, OPS.

2.7 NASA Security Areas

2.7.1 Types of NASA Security Areas.

2.7.1.1 NASA Controlled Area (formerly known as "Restricted Area") as defined in 14 C.F.R. Part 1203a. A Controlled Area is a physical area, including buildings or facilities, in which security measures are taken to safeguard and control access to property and hazardous materials or other sensitive material or to protect operations that are vital to accomplishing the mission assigned to a Center or Component Facility. The Controlled Area shall have a clearly defined perimeter, but perimeter physical barriers are not required.

a. Personnel within the area shall be responsible for challenging all persons who may lack appropriate access authority.

2.7.1.2 NASA Limited Area as defined in 14 C.F.R. Part 1203a. A Limited Area is a physical area in which security measures are taken to safeguard or control access to classified material or unclassified property warranting special protection or property and hazardous materials or to protect operations that are vital to the accomplishment of the mission assigned to a Center or Component Facility. A Limited Area shall also have a clearly defined perimeter; but where it differs from a Controlled Area is that permanent physical barriers and access control devices, including walls and doors with locks or access devices are implemented to assist occupants in keeping out unauthorized personnel. All facilities designated as NASA Critical Infrastructure (NCI) or key resources will be designated at minimum as "Limited" areas.

a. During working hours, personnel within the area will be responsible for challenging all persons who may lack appropriate access authority.

b. Sensitive material, property, and hazardous material can be stored in this area in approved containers. All CNSI material will be secured during non-working hours or when no cleared personnel are present in GSA approved security containers or other methods approved by the CCPS/CCS. c. When the Limited Area is not in use, access through the access control devices (i.e., keys, combinations to mechanical/electronic cipher locks, and badge reader controls) will be limited to authorized personnel. To prevent unauthorized access to such property, visitors will be escorted or other internal restrictions implemented, as determined by the CCPS/CCS.

2.7.1.3 NASA Exclusion Area (formerly known as a "Closed Area") as defined in 14 C.F.R. Part 1203a. An Exclusion Area is a permanent facility dedicated solely for safeguarding and use of CNSI.

It is used when vaults are unsuitable or impractical and where entry to the area alone provides visible or audible access to classified material.

a. To prevent unauthorized access to an Exclusion Area, visitors will be escorted or other internal restrictions implemented, as determined by the CCPS/CCS.

2.7.2 Establishment, Maintenance, and Revocation.

2.7.2.1 Establishment.

2.7.2.1.1 Center Directors, Director of Headquarters Operations, or their designee (the designee is CCPS/CCS unless otherwise specified), and the AA, OPS shall establish, maintain, and protect such

NPR 1600.1A -- Chapter2 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1600.1A -- Chapter2 Page 18 of 75 areas designated as NASA Controlled (formerly known as a "Restricted Area"), NASA Limited, or NASA Exclusion (formerly known as a "Closed Area") per the foregoing definitions and criteria.

a. Only the AA, OPS or the CCPS/CCS will establish an area functioning for the protection, use and storage of CNSI.

b. Only a coordinating office or the AA, OPS will establish a Special Access Program Facility (SAPF) or Sensitive Compartmented Information Facility (SCIF) based on legal authority, Memorandum of Agreement (MOA) or Memorandum of Understanding (MOU) with the Cognizant Security Authority and as promulgated in NPD 1600.4, National Security Programs.

2.7.2.2 Maintenance.

2.7.2.2.1 Security measures shall vary according to individual situations; however, the following minimum-security measures will be taken in all security areas:

a. Post appropriate signage at entrances and at intervals along the perimeter of the designated area, for the facility to provide reasonable notice to persons that the area is a security area. SAPFs and SCIFs are not required to use identifying signs due to Operations Security (OPSEC) concerns.

(1) Outdoor signs are metal, measuring approximately 40.64 cm/16 inches high and 50.8 cm/20 inches wide.

(2) Indoor signs are of cardboard or foam board, measuring approximately 22.86 cm/9 inches high and 12 inches wide.

b. Signage shall be ordered through Center supply sources for NASA Forms. Available signage includes:

(1) Controlled Area Sign (Outdoors), NASA Form 1506

(2) Controlled Area Sign (Indoors), NASA Form 1506A

(3) Limited Area Sign (Outdoors), NASA Form 1507

(4) Limited Area Sign (Indoors), NASA Form 1507A

(5) Exclusion Area Sign (Outdoors), NASA Form 1508

(6) Exclusion Area Sign (Indoors), NASA Form 1508A

c. Regulate authorized personnel entry and movement within the area; deny entry to unauthorized persons or material.

2.7.2.3 Revocation.

Once the need for a security area no longer exists, the area must return to normal non-secure area procedures as soon as practical.

2.7.3 Access.

2.7.3.1 Only those NASA employees, contractors, and visitors who need access and who meet the following access criteria shall enter a security area unescorted. All other individuals requiring access must be continually escorted by authorized NASA employees or NASA contractors.

2.7.3.2 To enter a NASA Controlled Area (formerly known as "Restricted Area") unescorted, NPR 1600.1A -- Chapter2 This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.

NPR 1600.1A -- Chapter2 Page 19 of 75 individuals must undergo the appropriate investigation or training procedures required for that area as established by the individual Center or program. When an investigation is required, at a minimum, a National Agency Check with Inquiries (NACI) shall be initiated for civil service employees and for non-NASA personnel.

2.7.3.3 To enter a NASA Limited Area unescorted,…