SBU 3490.2 Guide.pdf

INTRODUCTION 3

MAKING SBU DESIGNATION DECISIONS 3

BUILDING REVIEW CRITERIA 3

WHEN TO DESIGNATE SBU BUILDING INFORMATION 4

WHAT TO DESIGNATE AS SBU BUILDING INFORMATION 5

CONSULTING INTERNAL GSA RESOURCES 6

CONSULTING TENANT/PROSPECTIVE TENANT REPRESENTATIVES 6

DOCUMENTING SELECTIONS 6

THE PROJECT MANAGER ROLE 6

LIMITING THE USE OF SBU MARKING IS REQUIRED 6

PERIODIC MANDATORY REVIEWS & REEVALUATION BY PMs 6

PM’S CHECKLIST 7

OTHER RESOURCES 8

INTRODUCTION

This Guide provides instructions on how PBS associates can determine application of sensitive but unclassified (SBU) designation to building information of GSA-controlled space in accordance with 3490.2. PBS P 3490.2 DOCUMENT SECURITY FOR SENSITIVE BUT UNCLASSIFIED BUILDING INFORMATION. GSA-controlled space includes owned, leased, and delegated Federal facilities. Not all building information is automatically considered sensitive but unclassified. Only specific applicable information, marked with SBU designations, needs to be controlled in accordance with this policy. Building information predominantly refers to building drawings.

Note: The guide will be updated annually to reflect the implementation of new policy as well recommendations of the National Archives and Records Administration (NARA) regarding: Controlled Unclassified Information (CUI).

This document also provides links to other resources which may assist in making SBU decisions, such as links to frequently asked questions (FAQ), Regional point of contact (POC), and instructions on how to access the available SBU-related training on GSA Online University, which is mandatory for all PBS and GSA IT employees and contractors.

MAKING SBU DETERMINATIONS

BUILDING REVIEW CRITERIA (OWNED)

Project Managers (PM) have the responsibility to make the determination regarding overall building/facility’s sensitivity designation for owned properties. The determination of sensitivity is based on the needs of the occupying agency. Some examples include: Level 5 buildings, law enforcement field offices, etc. Specifically, PMs will use the following criteria to identify SBU:

● Identification of critical information

● Analysis of threats

● Analysis of vulnerabilities

● Assessment of risks

● Application of appropriate countermeasures

● Agency considerations

● Level Three or higher for buildings (See SBU Building list for scoring)

In delegated buildings the Designated Official determines the building sensitivity.

New leasing projects the Designated Official determines the sensitivity.

New Employees and PBS Associates: Use the following resources to make SBU designation decisions:

Complete the annual mandatory training from GSAOLU (approx. 60 min.);

https://gsaolu.gsa.gov Consult tenant representatives Contact Regional SBU Subject Matter Expert (SME) located on the PBS Design and Construction web page Read SBU Guide Check PBS Building Spreadsheet list for Scoring of each building- Click on file link to download

WHEN TO DESIGNATE SBU BUILDING INFORMATION

The PBS P 3490.2 policy describes the starting point when information related to both new and existing facilities will be considered SBU (section 4. b. on page 2 of the policy).

"Existing SBU documents shall be controlled under this directive when procuring and contracting for design and construction services for renovations to existing facilities. For new facilities, the building drawings and other related building information will be reviewed and may be designated SBU, as appropriate. This designation applies at the time SBU building information is turned over by the Architect-Engineering (A-E) personnel to the Government as part of the final construction control documents. However, not all building information will be designated as SBU."

The policy highlights an important distinction between existing building information and building information for new facilities.

For New Facilities (Owned and Leased):

• In the case of a new building in the planning stages, for a single tenant, the RC or regional delegated official, in consultation with the tenant, will hold decision-making authority in determining the appropriate sensitivity of the building areas and/or information

• In the case of a new building in the planning stages, for multiple tenants, the RC or regional delegated official, in consultation with all planned tenants, will hold decision-making authority in determining the appropriate sensitivity of the building

Essentially, the Regional Commissioner (RC) or delegated official must make a preliminary designation that will be followed up by specific markings, subsequently managed by the designated Project Manager (PM) for each new building or facility. The PM refers to the building’s/project’s manager which, depending on the region or stage of building lifecycle, can be either the project executive, the project manager, building manager or contract officer.

PBS Project Executive or Project Manager: Use the following resources to make SBU designation decisions for new facilities:

Contact Regional SBU SME to facilitate deliberations Consult tenant representatives

New Employees and PBS Associates: Use the following resources to make SBU designation decisions for existing facilities:

Contact Regional SBU SME Consult PBS Building Spreadsheet list for Scoring of each building- Click on file link to download Consult tenant representatives

WHAT TO DESIGNATE AS SBU BUILDING INFORMATION (LEASED)

A Facility Security Committee (FSC) is the lead entity for designation of sensitive content in leased facilities. Without a Facility Security Committee (FSC) in place, the above criteria used for decision-making will likely be presented by the tenant. Law enforcement agencies, such as FBI or other high security agencies frequently advocate for SBU markings on the building information for the space they occupy. Most other agencies will not usually advocate for SBU markings, due to the increased costs associated (i.e. MBI clearance) with marking and handling SBU building information. Extra costs affecting the rent bill may be due to additional restrictions on Architect-Engineering (A-E) personnel access and clearances, bidding restrictions, reduced competition for construction or facility management, or other factors.

The default approach to designation as sensitive is that there will be no SBU markings unless deemed necessary and the respective tenant agencies agree to the resulting extra costs associated with higher security requirements and less competition in procurement. The tenant(s) will agree to fund such costs via rent, Reimbursable Work Authorization, etc., as applicable. See PBS P 3490.2, CIO P 2181.1 and the SBU FAQ document for further information on Minimum Background Investigations (MBIs).

CONSULTING INTERNAL GSA RESOURCES

The Office of Mission Assurance, GSA IT Security, regional SBU POC and Records Management Officers (among others) are excellent resources for questions related to SBU designations.

CONSULTING TENANT/PROSPECTIVE TENANT REPRESENTATIVES(LEASED)

The Project Manager works with the Facility Security Committee and each tenant or group of tenants to evaluate the criteria for the safety and security for that tenant and the GSA property.

The sensitive facility determination triggers the action to mark the necessary components as SBU. Additionally, during the initial consultation the PM serves as an advisor to the tenant and the appropriate Facility Security Committee (FSC) will then ensure all necessary information is properly marked, and alternately, will ensure no unnecessary SBU markings are used.

DOCUMENTING SELECTIONS

THE PROJECT MANAGER

The PM may be a Project Executive, Project Manager, or Building Manager for the building or facility. The designated PM for each building/facility will take the steps necessary to mark only the necessary building information with the correct SBU label.

LIMITING THE USE OF SBU MARKING IS REQUIRED

The revised policy is very specific in limiting what information may be labeled as SBU. The practice of labelling all building information in a building as SBU if any part of the building is sensitive components is not appropriate.

PERIODIC MANDATORY REVIEWS & REEVALUATION BY PMs The PM will mark only the necessary building information with the correct SBU label after determining the sensitivity via the building inventory list and internal regional resources. For building projects (for design, construction, facility management, etc.), the PBS PM is also responsible for reviewing all building information which does or may contain SBU building information at regular milestones, such as change in use, configuration or tenant, and identifying and validating that SBU markings are correct and current. If building information designation is found to be incorrectly marked or no longer required, the PBS PM will correct the marking immediately or ensure that action is taken promptly to change or remove the marking.

CHECKLIST OF RECOMMENDATIONS FOR REGIONAL PM’S

Read the SBU policy.

Consult Regional SBU POC.

Take annual mandatory training (approx. 60 min.) as initial or refresher.

Work with prospective tenants to identify building information that will require the SBU designation.

Use the criteria above to designate buildings or facilities that will require SBU markings.

Consult internal GSA resources (Office of Mission Assurance, Information Technology Security, etc.).

Consult tenant representatives ( Department of Homeland Security, etc.).

Designate a Building Manager for each own building/facility who is responsible for the SBU building information associated with that building/facility. The Building Manager is responsible to mark only the building information deemed sensitive with the SBU label.

Actively engage with other Project and Building Managers to share lessons learned as to whether the policy is being implemented in a uniform, consistent manner across the region.

OOTHER RESOURCES

LINK to CUI https://insite.gsa.gov/portal/content/644478

LINK TO PBS P 3490.2 DOCUMENT SECURITY FOR SENSITIVE BUT UNCLASSIFIED

BUILDING INFORMATION

http://www.gsa.gov/portal/mediaId/202203/fileName/PBS_P_34902_Document_Security_for_Se nsitive_But_Unclassified_Building_Information_-_(Signed_on_Sept_2__2014).action

Building inventory list determination

LINK TO LIST OF REGIONAL SBU POINT OF CONTACTS

https://docs.google.com/spreadsheets/d/1Uwgrqtdtnb8mAuv5ciObVmS8EJ6T8Zx7Vrtc0-sDIc0/ edit

Link to SBU Flow Chart

LINK TO FREQUENTLY ASKED QUESTIONS DOCUMENT RE SBU BUILDING

INFORMATION

https://docs.google.com/document/d/1n1NktOBSNP5-77JNZz4WghCocObf2Ttz0bv-uBLi8Jo/edi t?ts=565375d6

LINK TO GSA ONLINE UNIVERSITY SYSTEM FOR SBU TRAINING

https://gsaolu.gsa.gov