Physical Security v1.pdf

DLAM 5200.08-V1, CH 1

Change 1, 07/20/2019

Defense Logistics Agency

MANUAL

DLAM 5200.08-V1

Incorporating Change 1, Effective: 07/20/2019

Accountable Office: DLA Installation Management (DM), Security and Emergency Services

(DM-S)

SUBJECT: Physical Security

REFERENCES: See Enclosure 1

1. PURPOSE:

a. Manual. This Manual is composed of several volumes, each containing its own purpose.

The purpose of the overall Manual, in accordance with (IAW) DLAI 4306 (reference (b)) and Joint Regulation AR 190-16; OPNAVINST 5530.15A; AFR 207-4; MCO 5500.13A; DLAR

5710.4 (reference (c)), is to implement DoD 5200.8-R (reference (d)) and prescribes procedures and minimum standards for the physical protection of DLA personnel, installations, activities and separate facilities, operations, and assets.

b. Volume. This Volume provides a compact source of information to assist Major

Subordinate Command (MSC) Commanders/Directors, Installation Commanders, Site Commanders/Directors, managers, designated officials, property officers, and security personnel in understanding and establishing appropriate physical security measures necessary to protect personnel, real and personal property, resources, and information. No information contained in the manual is intended to alter any provision of any Federal law, Executive Order, or DoD directive.

c. Restrictions. This manual does not pertain to the construction standards of Sensitive

Compartmented Information Facilities (SCIFs), Special Access Program (SAP) Facilities or Communications Security (COMSEC) vaults. For regulatory guidance on the aforementioned areas, refer to the appropriate directive, instruction, or regulation. DLA utilizes Air Force (AF)

COMSEC accounts for secure communications and must adhere to AF COMSEC policy. In case of a conflict between DLA and AF COMSEC policy, AF policy takes precedence.

2. SUMMARY OF CHANGES: Primary Field Level Activity changed to Major Subordinate Command, PLFA changed to MSC, Installation Support changed to Installation Management, DS changed to DM, DS-S changed to DM-S, and DS-FF to DM-FF.

3. APPLICABILITY: This manual:

a. Applies to active duty military personnel, reserve duty military personnel, DoD civilians, and to contractors and their employees as required by binding agreement or obligation (Government Contract, Memorandum of Agreement/Understanding (MOA/MOU) or Inter- Service Support Agreement (ISSA), etc.) with DLA.

b. Does not apply when there is a conflict between this manual and the ISSA between DLA and the Host Installation. DLA, as a tenant, will abide by the Host Installation requirements and mutually agreed ISSA(s), MOA(s) and/or MOU(s), etc.

Note: When operations unique to an activity necessitate a divergence from the requirements of this Manual, the threat, operating environment and conditions will be evaluated to tailor the security requirements of this Manual to include compensatory measures implemented. The security requirements will be based on risk management, practicality, cost, and mission performance. In these instances, waivers, variances and exceptions to the requirements of this Manual will be submitted according to the provisions in Enclosure 8 of Volume 2.

4. DEFINITIONS: See Glossary.

5. RESPONSIBILITIES: See Enclosure 2

6. PROCEDURES:

a. Implement general guidance for the security of personnel, installations, military operations, and additional assets.

b. Provide security guidance and general procedures that are realistic, harmonized with other security disciplines, and provide the necessary flexibility for MSC Commanders/Directors, and Installation Commanders/Directors to protect personnel, Installations, projects, operations, Change 1, 07/20/2019 and related resources against capable threats from terrorists, criminal activity, and other subversive or illegal activity.

c. Reduce the loss, theft, diversion of, or damage to DoD assets through the use of advanced technologies; thereby enhancing overall security, while ensuring that the warfighting capability is maintained.

d. Ensure personnel identification and authentication to DLA installations and facilities is accomplished through the utilization of the DoD Personal Identity Verification (PIV) credential (Common Access Card (CAC)) as the universal authority of individual authenticity, consistent with applicable law. The DoD PIV credential provides the HSPD-12 (reference (e)) mandated level of identity assurance and government-wide recognition at DLA installations and facilities.

e. Safeguard Personally Identifiable Information (PII) collected and used in the execution of this Manual to prevent unauthorized use, disclosure, and/or loss.

f. Ensure the collection, use, and release of PII complies with the requirements of DoDD

5400.11 (reference (f)), DoD 5400.11-R (reference (g)) and DoDI 5400.16 (reference (h)).

7. INFORMATION REQUIREMENTS: Information required for identity proofing and vetting is provided by the Defense Enrollment Eligibility Reporting System (DEERS) for current employees and collected from individuals requesting installation access. The information is governed by the DBIDS Privacy Impact Assessment and is controlled with limited access.

8. RELEASABILITY: RESTRICTED. This manual is approved for restricted release. It is available to users with Common Access Card authorization from the DLA Issuances Intranet

9. INTERNAL CONTROLS: The internal management control requirements (see Responsibilities and Procedures) are subject to evaluation, testing, and approval.

10. EXPIRATION DATE: We will reissue or cancel this manual by the third anniversary of its publication date. If not, it will automatically expire effective 07/20/2022.

GORDON B. HACKETT III

Director DLA Installation Management

Enclosure(s) Enclosure 1 – References Enclosure 2 – Responsibilities Enclosure 3 – Physical Security Planning Enclosure 4 – Installation Entry and Internal Control Enclosure 5 – Perimeter Control Enclosure 6 – Loss/Crime Prevention Enclosure 7 – Protective Lighting Enclosure 8 – Electronic Security System (ESS) Enclosure 9 – Key and Lock Control Enclosure 10 – Safes and Storage Equipment Enclosure 11 – Control of Privately-Owned Weapons

Glossary

TABLE OF CONTENTS

ENCLOSURE 1: REFERENCES

ENCLOSURE 2: RESPONSIBILITIES

DLA DIRECTOR

DLA HUMAN RESOURCES DIRECTOR (J1)

DLA INFORMATION OPERATIONS DIRECTOR (J6)

DLA AQUSITION DIRECTOR (J7)

DLA INSTALLATION MANAGEMENT SECURITY AND EMERGECY SERVICES

STAFF DIRECTOR (DM-S)

MSC COMMANDERS, HOST INSTALLATION COMMANDERS, AND DM-FF

MSC, INSTALLATION, AND HQC CHIEFS, SECURITY AND EMERGENCY

SERVICES/CHIEFS, SECURITY SERVICES

VETTING OFFICIAL (VO)

DEFENSE BIOMETRIC IDENTIFICATION SYSTEM (DBIDS) OPERATORS

DLA POLICE AND VISITOR CONTROL PERSONNEL

DLA PERSONNEL, CONTRACTORS, AND VISITORS

ENCLOSURE 3: PHYSICAL SECURITY PLANNING

GENERAL

PLANNING CONSIDERATIONS

PHYSICAL SECURITY PLAN

PHYSICAL SECURITY FUNDING

SECURITY EXECUTIVE COMMITTEE (SEC) AND SECURITY WORKING

GROUPS

SECURITY ENGINEERING

PHYSICAL SECURITY AND OPERATIONS SECURITY (OPSEC)

SECURITY DEVIATIONS

ENCLOSURE 4: INSTALLATION ENTRY AND INTERNAL CONTROL

GENERAL

LEGAL AUTHORITY

ESTABLISHING AND PUBLISHING LOCAL PROCEDURES

INSTALLATION ENTRY CONTROL POINTS (GATES)

GATE CLOSURE PROCEDURES

IDENTITY PROOFING AND VETTING

DBIDS IMPLEMENTATION POLICY

DBIDS USAGE

ADJUDUICATION OF CERTIFICATE REVOCATIONS/SECURITY ALERTS

IDENTIFIATION CARDS

VISITOR IDENTIFICATION AND CONTROL

UNAUTHORIZED ENTRY

RANDOM ANTITERRORISM MEASURES (RAMS)

BARMENT PROCEDURES

TRUSTED TRAVELER

VEHICLE CONTROL

PHOTOGRAPHY

ENCLOSURE 5: PERIMETER CONTROL

GENERAL

PLANNING CONSIDERATIONS

FENCING

BARRIER OPENINGS

WALLS AND OTHER STRUCTURAL BARRIERS

BARRIER INSPECTION

CLEAR ZONES AND STANDOFF DISTANCES

ENCLOSURE 6: CRIME PREVENTION

RESPONSIBILITIES

METHODS OF OBTAINING DATA

PREVENTING PILFERAGE

INTERNAL PHYSICAL SECURITY MEASURES

ENCLOSURE 7: PROTECTIVE LIGHTING

GENERAL

PLANNING CONSIDERATIONS

LIGHTING REQUIREMENTS AND SPECIFICATIONS

WIRING

POWER SOURCES

CLOSED CIRCUIT TELEVISION (CCTV) LIGHTING REQUIREMENTS

REPLACING LIGHTS

ENCLOSURE 8: ELECTRONIC SECURITY SYSTEMS (ESS)

GENERAL

USE OF ELECTRONIC SECURITY SYSTEM (ESS)

GENERAL DESCRIPTIONS

DESIGN CONSIDERATIONS

ESS EFFECTIVENESS

TAMPER PROTECTION

ACCESS/SECURE MODE

PERIMETER LAYOUT AND ZONING

ALARM-ANNUNCIATION SYSTEM

CCTV INTERFACE

ESS SOFTWARE

INTRUSION DETECTION SYSTEM (IDS) INSTALLATION, MAINTENANCE AND

MONITORING

INTERIOR INTRUSION DETECTION SENSORS

EXTERIOR INTRUSION DETECTION SENSORS

ELECTRONIC ENTRY CONTROL

DATA TRANSMISSION

CCTV FOR ALARM ASSESSMENT AND SURVEILLANCE

VIDEO PROCESSING AND DISPLAY COMPONENTS

CCTV APPLICATION GUIDELINES

ADDITIONAL REQUIREMENTS

ENCLOSURE 9: KEY AND LOCK CONTROL

GENERAL

SECURITY AND CONTROL MEASURES

RECORDS

AUTOMATED KEY CONTROL SYSTEMS

LOCAL PROCEDURES

ENCLOSURE 10: SAFES AND STORAGE EQUIPMENT

PHYSICAL PROTECTION AND STORAGE OF MATERIALS

GENERAL SERVICES ADMINSTRATION (GSA) APPROVED SECURITY

CONTAINERS

RECORD SAFES DESIGNED FOR FIRE PROTECTION

BURGLARY-RESISTANT SAFES

PADLOCKS AND COMBINATION LOCKS

COMBINATIONS

REPAIRING SECURITY CONTAINERS

ENCLOSURE 11: CONTROL OF PRIVATELY-OWNED WEAPONS

GENERAL

DEVELOPING LOCAL POLICY

TRANSPORTATION OF PRIVATELY OWNED FIREARMS AND AMMUNITION

ON DLA INSTALLATIONS

FAMILY HOUSING STORAGE

PROHIBITED WEAPONS AND AMMUNITION

GLOSSARY

PART I: ABBREVIATIONS AND ACRONYMS

PART II: DEFINITIONS

10 ENCLOSURE 1

ENCLOSURE 1: REFERENCES

(a) DLA Manual (DLAM) Physical Security; 5200.08 V1; July 15, 2016 (hereby cancelled)

(b) DLA Instruction (DLAI) 4306, Physical Security Program; December 7, 2009.

(c) Joint Regulation AR 190-16/OPNAVINST 5530.15A/AFR 207-4/MCO

5500.13A/DLAR 5710.4; Military Police, Physical Security, May 31, 1991.

(d) DoD 5200.08-R, Physical Security Program; May 27, 2009.

(e) Homeland Security Presidential Directive (HSPD) 12: Policy for a Common

Identification Standard for Federal Employees and Contractors, August 27, 2004.

(f) DoD Directive (DoDD) 5400.11, DOD Privacy Program, October 29, 2014.

(g) DoD Regulation 5400.11-R, Department of Defense Privacy Program, May 14, 2007.

(h) DoD Instruction (DoDI) 5400.16, DoD Privacy Impact Assessment (PIA) Guidance,

(i) DoD 7000.14-R, DoD Financial Management Regulation; Date varies by volume.

(j) DLA Instruction (DLAI) 4301, Security of DLA Installations, Activities, and Resources, May 13, 2011.

(k) DoDD 5205.02E, DoD Operations Security (OPSEC) Program; June 20, 2012.

(l) Unified Facilities Criteria (UFC) 3-600-01, Fire Protection Engineering for Facilities, Change 1, March 1, 2013

(m) Internal Security Act of 1950 (50 U.S.C. 797)

(n) DoDI 5200.08, Security of DoD Installations and Resources and the DoD Physical

Security Review Board (PSRB); Change 2, April 8, 2014.

(o) Title 18 U.S.C. Chapter 67, Section 1382, Entering military, naval or Coast Guard

Property.

(p) Directive-Type Memorandum (DTM) 09-012, Interim Policy Guidance for DoD Physical

Access Control, March 3, 2015.

(q) DoD Manual (DoDM) 1000.13, Volume 1, DoD Identification (ID) Cards: ID Card

Life-Cycle, January 23, 2014.

(r) U.S. Citizenship and Immigration Services (USCIS) Form I-9.

(s) (FOUO) DLA Manual (DLAM) 4302.30.001, Authority, Jurisdiction, and Limitations, July 23, 2013.

(t) 18 United Stated Code (U.S.C.) 701, Official Badges, Identification Cards, Other

Insignia, February 1, 2010.

(u) DoDD 5015.02, DoD Records Management Program; February 24, 2015.

(v) Request for Records Disposition Authority, N1-361-91-7, June 13, 1991.

(w) DLA Form 584, Visitor Register, June 2013.

(x) DLA Records Schedule.

(y) DoDI 2000.16, DoD Antiterrorism (AT) Standards; December 8, 2006.

(z) Unified Facilities Criteria (UFC) 4-022-3, Security Fences and Gates, October 1, 2013.

(aa) Unified Facilities Criteria (UFC) 4-022-01, Security Engineering: Entry Control

Facilities/Access Control Points, May 25, 2005.

(aa) Unified Facilities Criteria (UFC) 4-022-02, Selection and Application of Vehicle

Barriers, Change 1, August 9, 2010.

11 ENCLOSURE 1

(ab) DLA Regulation (DLAR) 4145.11, Safeguarding of DLA Sensitive Inventory Items, Controlled Substances, and Pilferable Items of Supply February 1, 1990.

(ac) Department of Defense (DD) Form 200, Financial Liability Investigation of Property Loss, Jul 2009.

(ad) Unified Facilities Criteria (UFC) 3-530-01, Design: Interior, Exterior Lighting and Controls, Change 3, September 1, 2013.

(ae) Unified Facilities Criteria (UFC) 4-021-02, Electronic Security Systems, October 1, 2013.

(af) DoD 5200.2-R, Personnel Security Program; February 23, 1987.

(ag) DoDM 5200.01, DoD Information Security Program: Protection of Classified

Information.

(ah) DLA Form 1610, Key Repository Index, Feb 79.

(ai) DLA Form 1610a, Key Repository Accountability Record, February 79.

(aj) DLA Form 1610B, Delegation of Authority (Key Control), January 97.

(ak) DLA Form 1610c, Key Control Register, February 79.

(al) DoDM 5200.01 Volume 3, DoD Information Security Program: Protection of Classified

Information, March 19, 2013.

(am) Standard Form (SF) 700, Security Container Information

(an) Standard Form (SF) 702, Security Container Check Sheet,

(ao) 41 Code of Federal Regulation, Title 41, Section 102.74.440, Weapons,

(ap) Joint Publication 1-02, “Department of Defense Dictionary of Military and Associated

Terms,” current edition

(aq) Joint Publication 3-0, “Joint Operations,” current edition

(ar) Joint Publication 3-07.02, “Antiterrorism,” current edition

(as) Joint Publication 3-28, “Defense Support of Civil Authorities,” current edition

12 ENCLOSURE 2

ENCLOSURE 2: RESPONSIBILITIES

1. THE DLA DIRECTOR. The DLA Director, per reference (d), will designate a program manager to oversee DLA’s physical security program.

2. THE DLA HUMAN RESOURCES DIRECTOR (J1). The J1 will ensure policy and procedures are in place to immediately evaluate a DLA employee’s continued employment if Physical Access Control System (PACS) or Identity Management Capability Enterprise Services Application (IMESA) continuous vetting validates an outstanding felony want or warrant. The J1 will:

a. Maintain a current list of J1 personnel to be notified if IMESA continuous vetting validates an outstanding felony want or warrant of a DLA employee.

b. Coordinate with DLA Intelligence (DI), Personnel Security on incidents where a DLA employee currently occupies a noncritical sensitive or critical sensitive position.

c. Ensure disposition of felony information captured during a National Criminal Information Center (NCIC) query or PACS security alert, including determination of employment impact and employee duty status, is provided to the respective Installation Commander and office of Security and Emergency Services.

d. When required, notify the DLA employee’s supervisor and coordinate with the local

DLA Human Resource Office (DHRS) to evaluate the appropriateness of continued employment except for Registered Sex Offenders.

3. THE DLA INFORMATION OPERATIONS DIRECTOR (J6). The J6 will:

a. Serve as the office of primary responsibility for Defense Biometric Identification System (DBIDS) integration and sustainment.

b. Provide lifecycle program management for all DBIDS end users.

c. Coordinate and submit technical refresh requirements to the Defense Manpower Data

Center (DMDC) for DBIDS hardware and system software upgrades.

d. Ensure coordination with DM-S on all physical security requirements pertaining to

DBIDS.

13 ENCLOSURE 2

4. THE DLA ACQUISITION DIRECTOR (J7). The J7 will ensure installation access control guidance established in this DLAM is included in all contracts, as applicable.

5. THE DLA INTELLIGENCE DIRECTOR (DI). The DI Director will:

a. Process all personnel derogatory information received from J1, via DBIDS, as prescribed in DoDM 5200.2-R, Personnel Security Program.

b. Immediately address any activity reported through IMESA, PACS, or NCIC if the incident shows a potential for insider threat.

c. As needed, work with DM-S to conduct the physical security inspection for open storage.

d. Provide intelligence support in the accomplishment of the DM-S security mission.

6. THE DLA INSTALLATION MANAGEMENT SECURITY AND EMERGENCY SERVICES

STAFF DIRECTOR (DM-S). The DM-S, under the authority, direction, and control of the Director of DLA, will:

a. Develop and prescribe general physical security requirements and ensure HQ DLA staff supervision of the DLA Physical Security Program.

b. Conduct staff assistance visits and inspections of DLA Activities.

c. Sponsor programs and measures with other Government agencies that will contribute to the ultimate objectives of the DLA Physical Security Program.

d. Appoint, in writing, a point of contact (POC) for Military Construction (MILCON) projects.

e. Establish policy for identity proofing, vetting and fitness standards, and DBIDS implementation and operation.

f. Ensure DBIDS equipment is distributed to DLA installations for the purpose of electronic identity verification of credentials.

g. Coordinate DBIDS operational policy and training requirements with DMDC, DLA Major Subordinate Command (MSC) Commanders, DLA Host Installation Commanders, and the DS Site Director for Fort Belvoir (DM-FF).

14 ENCLOSURE 2

h. Support continuity of DBIDS at each DLA installation.

i. Attend, provide input to, and gather information from DBIDS and biometric conferences/working groups.

7. THE DLA MSC COMMANDERS, DLA HOST INSTALLATION COMMANDERS, AND

DM-FF. The DLA MSC Commanders, DLA Host Installation Commanders, and DM-FF (as applicable) will:

a. Promulgate orders for the safety of personnel and protection of Federal property under their control.

b. Be responsible for the implementation of physical security measures designed to minimize the loss of supplies and equipment by natural or manmade hazards.

c. Ensure the organization of their activity includes a Chief, Security and Emergency

Services/Chief, Security Services and organizational placement of this individual does not hinder accomplishment of the security mission.

d. Appoint, in writing, a POC for MILCON projects.

e. Employ access control measures at the installation perimeter to enhance security for the protection of personnel and resources.

f. Establish local procedures for vetting individuals requesting access to DLA installations

IAW this manual, including incorporation and maximized use of electronic credential authentication for installation access control.

g. Ensure legal review of local procedures and policies by the supporting DLA Office of

General Counsel attorney.

h. Appoint Vetting Official(s) (VOs) in writing.

i. Establish and promulgate procedures for the use of DBIDS based on the guidelines established by this manual.

j. Leverage DBIDS for security alert information to determine fitness for access control determinations.

k. Implement local procedures for off-installation first responders’ physical access requirements during emergencies.

15 ENCLOSURE 2

l. Approve frequency and formula for use of DBIDS’ handheld credential scanners.

m. Ensure all DBIDS equipment is controlled and accounted for on the official property book with serial number, barcode, etc. IAW existing DLA Police procedures.

n. Establish and promulgate procedures for a Trusted Traveler program (TTP) based on the guidelines established in Enclosure 4 of this Manual.

o. Ensure procedures for suspending the TTP are part of the established guidelines, to include a process to document and monitor removal of Trusted Traveler privileges from individuals who violate procedures.

p. Conduct a risk analysis prior to implementing a TTP.

8. THE DLA MSC, INSTALLATION, AND HQC CHIEFS, SECURITY AND EMERGENCY

SERVICES/CHIEFS, SECURITY SERVICES. The DLA MSC, Installation, and HQC Chiefs, Security and Emergency Services/Chiefs, Security Services will (as applicable):

a. Administer the activity's physical security program.

b. Assist the MSC Commander/Director, Installation Commander, Site Director, leadership and supervisors in discharging their security responsibilities by analyzing security deficiencies, hazards and making recommendations for appropriate corrective action.

c. Ensure physical security inspections are conducted annually. In addition, where applicable, conduct surveys and exercises of DLA restricted and controlled areas, facilities storing arms, ammunition, and explosives (AA&E), and other facilities storing sensitive or pilferable resources as outlined in this manual.

d. Direct and control the training and utilization of the activity's security forces personnel.

e. Review security reports and logs on a daily basis to ensure compliance with established security procedures.

f. Appoint in writing a physical security specialist to manage the physical security program.

g. Advise the MSC Commander, Host Installation Commander, and DM-FF on establishing vetting and fitness determination factors based on local threat and mission requirements.

16 ENCLOSURE 2

h. Appoint DBIDS Operators (i.e. Base Security Officer (BSO), Site Security Manager (SSM), etc.) in writing IAW the DBIDS User Manual.

i. Establish vetting process for VOs to follow based on the MSC Commander, Host

Installation Commander, and DM-FF requirements.

j. Monitor and enforce procedures for vetting individuals requesting installation access.

k. Ensure DLA police and visitor control/Pass & ID personnel are trained in installation access control policies and in operation of DBIDS handheld credential scanners and workstations, respectively.

l. Establish procedures for DoD ID-card holders to register in and deregister from DBIDS during in and out-processing, as well as deregistration for lost/stolen credentials.

m. Coordinate the inclusion of registration and deregistration into DBIDS on installation in-processing and out-processing checklists.

n. Program for DBIDS expendable costs to include: laminate, printer ribbon, and card stock.

o. Establish procedures to protect DBIDS equipment against theft or damage at operating locations and access control points (ACPs).

p. Ensure current debarment information is loaded into DBIDS as necessary.

q. Implement processes to identify installation access and approval authority during Force

Protection Condition (FPCON) Bravo, Charlie, and Delta, IAW DLA Instruction 6308.

r. Ensure incident reports are completed and notification procedures are in place to record negatively adjudicated vetting of visitors and validated outstanding felony wants or warrants on DLA employees obtained during an NCIC query or PACS security alert.

s. Ensure NCIC security alerts which are not validated after an initial match or which do not result in a change in employment status or adverse action are identified in DBIDS to avoid re-adjudication of the same incident.

t. Ensure all access control and security personnel are trained in TTP procedures.

u. Establish a mechanism to ensure adherence to TTP procedures.

17 ENCLOSURE 2

9. THE VETTING OFFICIAL (VO). VOs will:

a. Adhere to and enforce the guidelines prescribed by the MSC Commander, DLA Host Installation Commander and DM-FF for personnel requesting access to the installation.

b. Serve as law enforcement/security officials authorized to receive information from the NCIC Database and the Terrorist Screening Database (TSDB) IAW respective state law enforcement requirements.

c. Notify J1, DHRS, and supporting DLA Office of General Counsel attorney when a valid outstanding felony want or warrant is discovered for a DLA employee from an NCIC query or PACS security alert. Notifications will be made during the duty day (0800-1700). Notification of alerts received after the duty day and non-duty days will made during the first hour (i.e., 0800- 0900) of the next duty day.

10. THE DBIDS OPERATORS. DBIDS Operators will conduct their duties IAW the guidelines delineated in the DBIDS User Manual.

11. THE DLA POLICE AND VISITOR CONTROL PERSONNEL. DLA Police and Visitor Control Personnel will:

a. Stay apprised of current policies and directives on installation access.

b. Adhere to and enforce directives and policies established for personnel requesting access to the installation.

12. THE DLA PERSONNEL, CONTRACTORS, AND VISITORS. All individuals requiring recurring and/or unescorted access to DLA installations with DBIDS must:

a. Enroll the credential authorized to facilitate access in DBIDS according to locally established guidance.

b. Carry their DoD ID card or approved credential on their person while on DLA installations IAW local policy.

c. Upon request, present their DoD ID card or approved access credential to DLA Police.

Individuals who refuse to present their DoD ID card or approved credential are subject to immediate surrender of the credential and may be subject to further administrative action.

18 ENCLOSURE 2

d. Immediately report a lost or stolen DoD ID card or access credential to DLA Police.

e. Turn in access credentials to the issuance office or sponsoring organization when the credential expires or when the basis for possessing the credential no longer exists.

19 ENCLOSURE 3

ENCLOSURE 3: PROCEDURES

1. GENERAL.

a. Physical security is that portion of security concerned with procedures and physical measures designed to safeguard personnel, property, and operations; to prevent unauthorized access to equipment, facilities, material, and information; and to protect against espionage, terrorism, sabotage, damage, misuse, and theft.

(1) Physical security procedures include, but are not limited to, the application of physical measures to reduce vulnerability to the threat; integration of physical security into contingency, mobilization, and wartime plans; the testing of physical security procedures and measures during the exercise of these plans; the interface of installation OPSEC, crime prevention and physical security programs to protect against the traditional criminal; training of security forces in tactical defense against and response to attempted penetrations; and creating physical security awareness.

(2) Physical security measures are physical systems, devices, personnel, animals, and procedures employed to protect security interests from possible threats and include, but are not limited to, security guards; military working dogs; lights and physical barriers; explosives and bomb detection equipment; protective vests and similar equipment; badging systems; electronic entry control systems and access control devices; security containers; locking devices; electronic intrusion detection systems; standardized command, control, and display subsystems; radio frequency data links used for physical security; security lighting; delay devices; biometrics; and assessment and/or surveillance systems to include closed-circuit television.

b. Many regulations specify protective measures, policies, and operations related to security.

Physical, personnel, antiterrorism (AT), force protection, law enforcement, operations, communications and information security programs and surveys are all vital components of a total security system and integrated effectively will provide security in-depth.

c. An activity Physical Security Program will include, at a minimum, the following functions:

(1) Implementation of physical protective measures and operational procedures designed to safeguard personnel and protect DLA resources from unauthorized use, theft, damage, sabotage, and espionage.

(2) Development of site-specific procedures in concert with higher HQ regulations to enhance security at specific activities.

(3) Inspection of all areas to ensure compliance with higher HQ directives and activity procedures.

20 ENCLOSURE 3

(4) Implementation of physical protective measures and operational procedures designed to safeguard personnel and protect DLA resources from unauthorized use, theft, damage, sabotage, and espionage.

(5) Implementation and management of a Physical Security Education and Training

Program for all activity employees.

(6) Implementation and management of loss prevention procedures to identify loss trends and detect criminal activity, to include a process to identify, report and track the correction of all security related faults and deficiencies.

(7) Where applicable, management and utilization of DLA police.

d. This manual addresses minimum security standards and procedures for DLA. DLA activities will maintain flexibility in planning and in determining the degree of protection and the scope of the Physical Security Program, commensurate with the mission.

2. PLANNING CONSIDERATIONS.

a. In determining the type and extent of physical protection required at an activity, a risk management and analysis approach will be used. Prime consideration will be given to the activity's operational requirements. The following factors should be considered:

(1) Mission - What is the importance of the activity to the continuing mission of DLA;

(2) Areas to be protected;

(3) Local threats and vulnerabilities;

(4) Impact of physical security measures on efficiency of operations;

(5) Costs of material and equipment to be installed and availability of funds;

(6) Potential damage or loss to the activity, to DLA and/or to DoD;

(7) Alternate security measures or techniques;

(8) Security, AT, and force protection standards directed by higher headquarters.

b. Each activity must continually evaluate its security posture in light of the factors above and then devise appropriate physical security measures. When evaluating the degree and type of

21 ENCLOSURE 3

physical security required, planners must remember that the criticality of an activity may vary as its products or services become more or less important to the mission of DLA.

c. During planning, consider standards and procedures for the following:

(1) Education of personnel in the use of internal control procedures and the need for vigilance to prevent losses;

(2) Receiving stock, stock control, and shipping;

(3) Receiving, holding, or banking money;

(4) Storing and accounting for controlled items, including narcotics, AA&E, classified mission stock, and hazardous materials;

(5) Structural criteria of buildings (use Unified Facilities Criteria);

(6) Police or contract guard utilization;

(7) Communications.

(8) Installation and use of intrusion detection systems (IDS), card reader systems, automated key control systems, and other physical security equipment.

3. PHYSICAL SECURITY PLAN (PSP). Each DLA MSC/Installation will develop a localized PSP to supplement this manual (tenant sites will develop standard operating procedures to supplement host’s PSP). The plan will be fully integrated with Antiterrorism (AT) plans to ensure a holistic security system to counter terrorist capabilities. Annexes to the plan may be separated for operational purposes as required; however, the location of the annexes will be listed in the plan. The PSP, including all annexes, will be exercised annually in order to evaluate its effectiveness. As a minimum, the plan will include:

a. An installation local threat statement;

b. An installation access control and closure plan;

c. Protective lighting plan;

d. A civil disturbance plan. It is the MSC/Installation Commander’s responsibility to formulate a civil disturbance plan based on local threats;

22 ENCLOSURE 3

e. A resource plan to meet minimum essential physical security needs for the installation or activity;

f. A list of Installation Critical Assets;

g. Lists of designated Restricted and Controlled areas, areas assigned to a Resource Level

(1, 2, or 3), and the associated Alarm Priority Response Lists (APRLs);

h. A contingency plan. Such contingencies may include hostage negotiations, active shooter response, protective services, and special reaction teams;

i. Annexes containing the installation/facility AT Plan and the Chemical, Biological, Radiological, Nuclear, and Explosive (CBRNE)/Hazardous Material (HAZMAT) Protection Plan.

4. PHYSICAL SECURITY FUNDING. DoD 7000.14-R (reference (i), Volume 2B; Chapter 19, provides instructions applicable to budget formulation for the DoD Combating Terrorism (CbT) funding requirements.

a. AT CbT subcategories include the following:

(1) Physical Security Equipment;

(2) Physical Security Site Improvements;

(3) Physical Security Management and Planning;

(4) Security Forces/Technicians;

(5) Law Enforcement;

(6) Security Matters;

(7) Consequence Management.

b. Chiefs, Security and Emergency Services/Chiefs, Security Services will coordinate funding requests through the respective activity budget analyst and DLA Installation Management, Office of Security and Emergency Services.

5. SECURITY EXECUTIVE COMMITTEE (SEC) and SECURITY WORKING GROUPS (SWG). The SEC and all the subordinate working groups will comply with DLAI 4301

23 ENCLOSURE 3

(reference (j)), which provides specific requirements and responsibilities for the SEC. See Volume 2, Enclosure 8, Working Groups for additional information and requirements.

6. SECURITY ENGINEERING.

a. The security engineering design process identifies assets requiring protection, determines the threat to and vulnerability of those assets, and designs a protective system to protect the assets.

b. A security engineering survey is the process of identifying, by means of an on–site survey, engineering requirements associated with facility enhancements for physical security and anti–terrorism, including intrusion detection system (IDS) installation. Using a team concept, security engineering surveys should be performed locally when planning any new construction or renovations or upgrades to existing facilities where there are likely to be physical security requirements. Security engineering surveys may also be requested by the Chiefs, Security and Emergency Services/Chiefs, Security Services to evaluate existing security.

c. The scope of a security engineering survey is to:

(1) Identify the assets to be protected.

(2) Identify the threats to the assets and the levels of protection to which the assets should be protected.

(3) Identify protective measures, including IDS, to reduce the vulnerabilities of the assets to the threats.

(4) Determine the cost of proposed protective measures.

d. As a minimum, the following personnel should make up the security engineering planning team:

(1) Physical Security Specialist;

(2) Antiterrorism Officer;

(3) Installation or Facility Engineer;

(4) Intelligence Officer (if applicable);

(5) Customer;

(6) Logistics Officer;

24 ENCLOSURE 3

(7) Safety Officer;

(8) Fire and Emergency Services;

(9) Investigator (if applicable) and;

(10) Other representatives as needed.

7. PHYSICAL SECURITY AND OPERATIONS SECURITY (OPSEC). OPSEC is an analytic process used to deny an adversary unclassified but sensitive information concerning our intentions and capabilities by identifying, controlling, and protecting indicators associated with our planning processes or operations. OPSEC does not replace physical security and other security disciplines - it supplements them.

a. The threat defines the physical security challenges.

b. Chiefs, Security and Emergency Services/Chiefs, Security Services must consider

OPSEC in physical security planning and ensure OPSEC is implemented to support physical security measures. Examples include providing soundproof rooms for conducting briefings, not publicizing RAMS or security system layouts, etc.

c. Chiefs, Security and Emergency Services/Chiefs, Security Services must work in concert with OPSEC personnel to ensure physical security critical information is included within the installation/activity Critical Information List.

d. For additional information refer to DoD 5205.02E (reference (k)).

8. SECURITY DEVIATIONS. Security deviations, volume 2, enclosure 7, (Waivers, Limited Exceptions and Permanent Exceptions) will not conflict with UFC 3-600-01 ‘Fire Protection Engineering For Facilities” (reference (l)).

25 ENCLOSURE 4

ENCLOSURE 4: INSTALLATION ACCESS AND INTERNAL CONTROL

1. GENERAL.

a. This enclosure outlines procedures for installation access and internal control of DLA installations and facilities. MSC/Host Installation Commanders/Directors must establish installation entry and internal control procedures that comply with DoD and DLA policy.

b. Access Controls. These procedures are designed to deter unauthorized access and counter the introduction of hazardous materials, contraband, and/or prohibited items.

c. Internal Controls. These procedures are designed to detect hostile actions within areas, and prevent unauthorized removal of material from areas.

2. LEGAL AUTHORITY.

a. Commanders of military installations have the authority to publish and enforce regulations for safeguarding personnel, facilities, and property. This authority is derived from 50 USC 797 (reference (m)), and is implemented by DoDI 5200.08 (reference (n)), reference (d), and reference (c).

b. Jurisdiction. There are four possible types of jurisdiction to be found on U.S.

government installations: exclusive, concurrent, partial, and proprietary. Depending upon where an incident occurs on an installation, the jurisdictional status may differ, due to the installation having more than one type of jurisdiction. For those installations or off-installation areas under government control where DLA does not exercise exclusive federal jurisdiction, security forces chiefs must work closely with the MSC Office of Counsel and local civil authorities to establish protocols for handling civilian violators.

c. Continental United States (CONUS): In CONUS, Commanders publish and enforce regulations to protect installation resources IAW DoD and DLA policy. In addition, Title 18 USC (reference (o)) prohibits individuals in the United States from entering any military installation for a purpose prohibited by law or lawful regulation or reentering an installation after being ordered not to reenter by any officer in command of the installation.

d. Outside the Continental United States (OCONUS). At OCONUS and its possessions, a

Commander's right to exercise this authority comes from United States laws applying in the overseas area and from bilateral and multilateral agreements between the United States and host countries.

26 ENCLOSURE 4

3. ESTABLISHING AND PUBLISHING LOCAL PROCEDURES.

a. Procedures are established to deter unauthorized personnel from entering an installation and to protect installation resources. In establishing procedures, MSC/Host Installation Commanders/Directors must determine the level of control necessary to prevent property loss and destruction, espionage, terrorism, or sabotage. Requirements and procedures are then published in the installation security plan as appropriate.

Note: The servicing Office of General Counsel must review installation access procedures for legal sufficiency.

b. Determining Levels of Control. MSC/Installation Commanders/Directors use the following factors to determine levels of control.

(1) The threat to the installation.

(2) The protection requirements of assigned resources.

(3) Installation features that could present significant hazards to public safety.

(4) Pilferage problems specific to the installation. (Pilferage is deliberate taking of property through circumvention of human controls and physical protection measures.)

c. It is DLA policy that MSC Commanders with the responsibility of installation access, DLA Host Installation Commanders, and DM-FF will employ access control measures at the installation perimeter to enhance security for the protection of personnel and resources as follows:

(1) Institute identity proofing and vetting to determine the fitness (as defined in DoD

DTM 09-012) of individuals requesting and/or requiring access to installations, as well as issuance of access credentials.

(2) Deploy DMDC’s DBIDS as DLA’s PACS.

(3) Incorporate and maximize the use of electronic credential authentication for installation access control.

(4) Implement local procedures for DBIDS IAW this Manual.

(5) Leverage DBIDS for security alert information to determine fitness for access control determinations.

27 ENCLOSURE 4

4. INSTALLATION ACCESS CONTROL POINTS (ACPs).

a. ACPs include those used on a routine basis, day-to-day operations, and those staffed only on a specified day or for a specific period of time. ACPs may be used for vehicles only, pedestrians only, or both. At least one individual at each gate must be armed.

b. Routine ACPs. Pedestrian and vehicle traffic must enter the installation through these access points. These gates are staffed by DLA Police Officers or trained, armed augmenters (per installation augmentee program).

c. Special-Purpose ACPs. These access points may be used for pedestrian and vehicle traffic. Personnel trained by the installation security forces, including contractors and owners or users, may open and staff installation special purpose gates. Close and lock these gates during periods of low traffic volume. NOTE: As a general rule the general base populace will not be allowed to use these gates.

5. GATE CLOSURE PROCEDURES. The Installation Commander/Director will develop local procedures for gate closure and gate closure devices. Ensure approved procedures, to include alarm and other emergency response procedures to installation gates, are outlined in local policies.

6. IDENTITY PROOFING AND VETTING. The access control standards will include identity proofing, determining the fitness of an individual requesting and/or requiring access to DLA installations, and vetting.

a. Individuals possessing the following identification credentials will be considered identity proofed by DODM 1000.13 Volume 1 (reference (q)) and do not require additional vetting determinations for installation access: (Note: additional vetting only necessary to validate NCIC alert via IMESA).

(1) DoD-issued CAC.

(2) DoD-issued card IAW paragraph 10, below.

(3) Federal Personal Identity Verification (PIV) credential that conforms to reference (p).

(4) Transportation Worker Identification Credential (TWIC) accompanied by bill of laden with a NCIC check conducted at Truck Gate

b. For identification credentials that are considered identity proofed but are not compatible with DBIDS, MSC Commander, DLA Host Installation Commanders and the DM-FF may issue

28 ENCLOSURE 4

supplementary DBIDS credentials to ensure electronic credential authentication is viable at all installation ACPs.

c. Off-installation emergency first responders may be granted unescorted access during emergencies based on locally established procedures.

d. Non-Federal Government and non-DoD-issued card holders who are provided unescorted access require identity proofing and vetting to determine fitness and eligibility for installation access.

e. Individuals requiring unescorted access to DLA installations must submit biometric data.

DBIDS collects a digitized photo and Digitized Fingerprint Minutia Data (DFMD). (Note:

DBIDS cards require biometrics. DBIDS visitor passes may require some biometrics i.e.

digitized photo) (Note: For DoD ID cardholders, biometric data is submitted when an individual is enrolled in the Defense Enrollment and Eligibility Reporting System (DEERS) and issued a DoD ID card.)

f. Local procedures for denial of installation access will include the following provisions:

(1) Appointment of VO(s) will be in writing to perform fitness determinations, including validation of NCIC alerts IAW Enclosure 4 of this Manual. The number of VOs assigned will be based on mission requirements and continuity of operations.

(2) Processes for denial of access and confiscation of access credentials.

g. VOs will:

(1) As a minimum, check all unescorted visitors against the authoritative databases

IAW reference (p) and follow guidelines provided by authoritative databases.

(2) For unescorted visitors, validate with the originating agency concerning the results from the NCIC database or TSDB. Based on results, the VO will deny access to anyone according to the following guidelines:

(a) The individual is known to be or reasonably suspected of being a terrorist or belongs to an organization with known terrorism links/support.

(b) The individual is unable to provide a valid ID (driver’s license) or approved identification listed on the US Citizenship and Immigration Services USCIS Form I-9 (reference (r)).

(c) There is a reasonable basis to believe the individual has submitted fraudulent information concerning his or her identity.

29 ENCLOSURE 4

(d) There is a reasonable basis to believe the individual will attempt to gain unauthorized access to classified documents, information protected by the Privacy Act, information that is proprietary in nature, or other sensitive or protected information.

(e) There is a reasonable basis to believe the individual will unlawfully or inappropriately use an access credential outside the workplace.

(f) There is a reasonable basis to believe based on an individual's criminal history, that issuance of an access credential poses an unacceptable risk to the installation/mission.

(g) The individual has any conviction for espionage, sabotage, treason, terrorism, or murder.

(h) The individual has been convicted of a firearms or explosive violation within the past ten years.

(i) The individual has been convicted of sexual assault, armed robbery, rape, child molestation, child pornography, trafficking in humans, drug possession with intent to sell, or drug distribution within the past ten years.

(j) There is a reasonable basis to believe, based on the individual's material, intentional false statement, deception, or fraud in connection with Federal or contract employment, that issuance of an access credential poses an unacceptable risk to the installation/mission.

(k) There is a reasonable basis to believe, based on the criminal history of driving while intoxicated or suspension of driver’s license for repeat alcohol offenses, that issuance of an access credential poses an unacceptable risk to the installation/mission.

(l) There is a reasonable basis to believe based on the criminal history of repeated drug offenses for use and possession, that issuance of an access credential poses an unacceptable risk to the installation/mission.

(m) The individual has knowingly and willfully engaged in acts or activities designed to overthrow the U.S. Government by force.

(n) The individual’s name appears on any Federal or State agency’s authoritative watch list or hit list for criminal behavior or terrorist activity (follow originating agency’s handling instructions).

(3) Adjudicate on a case-by-case basis, in coordination with supporting DLA Office of

General Counsel attorney, for the following instances in which an access denial may be warranted:

30 ENCLOSURE 4

(a) The individual has/had been barred from entry/access to another DoD installation or Federal facility.

(b) The individual is wanted by Federal or civil law enforcement authorities, regardless of offense or violation.

(c) The individual has been incarcerated following a conviction within the past ten years, regardless of offense/violation, unless released on proof of innocence (annotated in NCIC database or via signed court order).

(4) Ensure unfavorable results received from authoritative databases are only provided to personnel authorized to view IAW respective state law enforcement requirements.

(5) Provide favorable results to visitor control personnel who will in-turn issue the appropriate access credential/pass.

(6) If there is any discrepancy or doubt regarding the granting of installation access, consult the Chief, Security and Emergency Services for further guidance and resolution.

h. DLA Police will:

(1) (FOUO) Divert to the visitor control center all individuals who do not possess a DoD-approved credential for installation access.

(2) (FOUO) Follow established DLA Police guidance, DLAM 4302.30.001 (reference

(s)), Authority, Jurisdiction, and Limitations, concerning detainment or apprehension of individuals.

i. Visitor control personnel will issue passes only to individuals who have been favorably vetted through the VO.

7. DBIDS IMPLEMENTATION POLICY. At a minimum, installation DBIDS implementation policies must include the following provisions and coordinated with a supporting DLA Office of General Counsel attorney:

a. Standard operating procedures for DBIDS registration and permissions provisioning.

b. Standard operating procedures for DBIDS handheld credential scanner operations.

c. Frequency and formula for use of DBIDS handheld credential scanners.

31 ENCLOSURE 4

d. Mitigating measures when DBIDS handheld credential scanners are unavailable/not in use.

e. Contingency credential validation when DBIDS handheld credential scanners are unable to authenticate a presented credential.

f. Adjudication procedures in the event of an invalid credential or identified security alert.

g. Integration of DBIDS usage into installation Trusted Traveler Program (TTP), if applicable.

8. DBIDS USAGE.

a. DBIDS handheld credential scanners will be used IAW MSC/Installation Commander/DS Site Director policy for maximizing both usage and traffic throughput.

b. A minimum of one DBIDS handheld credential scanner will be deployed for each operational entry lane at installation ACPs. One backup DBIDS handheld credential scanner will be deployed at each ACP. Each DBIDS handheld credential scanner will include a replacement battery.

c. Additional factors for credential verification (PIN/Biometrics) may be required during higher FPCONs or as part of the Random Antiterrorism Measure (RAM) plan.

d. All operators of DBIDS handheld credential scanners will receive training prior to utilization of the scanner. The training will include proper operations, troubleshooting methods, and entry control procedures while using the scanner. Training will be annotated via the DLA Learning Management System (LMS).

e. When handhelds are not in use, DLA Police will conduct physical and visual inspection of credentials presented for installation access IAW reference (p) and local installation

9. ADJUDICATION OF CERTIFICATE REVOCATIONS/SECURITY ALERTS.

a. During the process of authenticating credentials presented for installation access, DLA Police may encounter credentials with revoked/expired certificates and/or credentials associated with security alerts. In these instances, DLA Police will:

(1) Immediately redirect the vehicle out of the lane of traffic and adjudicate the situation with their respective control centers.

32 ENCLOSURE 4

(2) For certificate alerts (revoked/expired), direct the individual to the Visitor Center/Pass and ID office…