UL2050 Certification.pdf

© 2011 Underwriters Laboratories Inc.

National Industrial Security Systems (UL 2050) 5th

Edition November 5, 2010

JSAC April 2017

The Origin of the Program

• Purpose

• Partnership

• Flexibility of Application

– Rational

– Cost Effective

– Threat Appropriate

Documents Defining Security

National Industrial Security Systems ,UL 2050 National Industrial Security Systems Program Operating Manual (NISPOM) Director of Central Intelligence Directive 6/9 (DICD 6/9) (Now ICS 705-1) Manual for Physical Security of Sensitive Conventional Arms, Ammunition, and Explosives

(DoD 5100.76-M) Joint Air Force Army Navy Physical Security

Manual 6/9 (JAFAN 6/9)

US Government Representatives

Cognizant Security Office

•Applies when areas being protected are controlled by the Defense Security Service

Cognizant Security Agency

•Applies when areas being protected are controlled by other US Government organizations such as the intelligence community (soon to be known as Accrediting Official-see ICD-705)

Role of the CSO/CSA

• Define the Minimum Features of the IDS

• Provide Prior Approval of Variables

• Approve Security in Depth (SID) where applicable

• Confirm Clearances where Required

• Coordinate with Contractor and Alarm Company on non-technical IDS issues

• Coordinate with UL Representatives

Role of the UL Auditor

National Industrial Security Systems (CRZH)

• To Audit ASC’s that have requested UL Certificates for Compliance with UL 681 & UL 2050

National Industrial Monitoring Station (CRZM)

• To Audit Government Contractors or Central Stations that have established a Listing for Compliance with UL

UL 2050

How Standards are Created

• UL Staff Designated as Primary Engineer

• Work with Key Stakeholders

• Consider Proposed Requirements

How Standards are Maintained

• Input from Key Stakeholders

• UL Develop Proposed Revisions

• Consider Proposals

National Industrial Security Systems

(CRZH)

Who Is Responsible

• 4.3 of UL 2050

• ASC may assign monitoring & investigation but retain responsibility

• ASC may assign installation & service provided they supervise & verify correctness

• ASC may assign maintenance, but only to personnel that work exclusively for the ASC Service Center

Assigning Elements of Service

Alarm Service Company Correctness of Installation

Service & Maintenance Training & Performance of

Monitor & Investigator

Monitoring Government Contractor

Monitoring Station (GCMS) or

National Industrial Monitoring Station or UL Central Station or Law Enforcement

Investigation Government Contractor Investigator or Private Guard &

Government Contractor Rep.

or

Law Enforcement & Government Contractor Rep.

or Government Contractor Rep.

Impact of Security In Depth

Reduces electrical supervision of remote equipment rooms when a GCMS is used

(Does Not Apply When Areas Housing AA&E Are Monitored or DCID applies) Reduces standby power requirements when a GCMS is used

(except SCIF’s and SAPF’s)

Allows the use of an Extent 5 design of protection in closed areas (Does Not Apply to Areas Housing AA&E or When DCID applies)

Features Requiring Prior Approval

Use of Extent 5* vs. Extent 3

• *Extent 5 only applies to the NISPOM

Non Line Security Transmission Use of Data Networks Only Monitoring Alarm & Trouble Signals Monitoring in a Law Enforcement Agency Investigator Response Personnel Response Times beyond 5 or 15 Minutes

Government Contractor Monitoring Station Purpose - to monitor industrial security systems that are installed in the following areas:

• Areas occupied by the government contractor that operates the GCMS

• Areas occupied by a subcontractor

• Areas occupied by other government contractors

The station is verified & receivers are maintained by the ASC

National Industrial Monitoring Station Purpose - to monitor industrial security systems installed in the following areas that are more than 4 hours away from the monitoring station:

–Areas occupied by the government contractor that operates the NIMS

–Areas occupied by a subcontractor

–Areas occupied by other government contractors

Commercial UL Central Stations Provide Monitoring of Alarm System

• (operators & station may have to be cleared) Processing of Signals & Creation of Records Dispatching Investigators Periodic Testing of Communication Links to Investigators

Signal Processing in GCMS, NIMS, or a Central Station

Record each of the following types of signals

• Openings & Closings

• Alarms

• Troubles

Maintain current lists of the following

• Authorized operators of the system

• Personnel to be notified of an alarm

• The FSO/SSO

• Service department personnel in the alarm service company that maintains the system

Law-Enforcement Agency or Public Emergency Center

Requires Prior Approval by CSO/CSA

Monitors System for Alarms & Trouble Conditions

Dispatches Investigators

Receivers are maintained by a UL Listed Alarm Service Company

Alarms & Unauthorized Openings (Sec 12)

Contact-alarmed area Verification-speak to authorized user

•Late or None

- During business hours CALL FSO/SSO

- After business hours DISPATCH

•Timely Verification

- During business hours CALL FSO/SSO

- After business hours REPORT TO FSO/SSO

Follow UP to Alarm Signal

If the system resets in 1 minute

• Dispatch a single investigator who has access to the exterior of alarmed area

• Technician inspects area within 4 hours of facility opening for business

After verification

• When open for business, report to FSO/SSO by voice and in writing

• When closed for business, report to FSO/SSO in writing

Investigators

Government contractor investigators cleared & with unescorted access

Private guards without unescorted access and a representative of the government contractor

On-duty law-enforcement officer and a representative of the government contractor

A representative of the government contractor having authorized access

*Requires Prior Approval by CSO/CSA

Details

If Government Contractor Representatives are used

•3 people shall be on call

•The name & phone number of the FSO/SSO shall be maintained

•The phone numbers shall be verified in writing every 90 days

Response Teams & Times

Primary Investigator Secondary Investigator

Response Times

Government Contractor Investigator

None 5, 15, 20, or 30*

Private Guard (without unescorted access)

Government Contractor

Representative

5, 15, 20, or 30 (Primary), 60 min for

Representative Law Enforcement Government

Contractor Representative

No Time Stated for Primary, 60 Min for Representative

Government Contractor Representative

None 60 Minutes

*Requires prior approval by CSO/CSA

Auditing Alarm Records

Records are held at ASC office or at the Government Contractor office Review is conducted on responses to each individual alarm system The calculation of the percentage of overruns starts at the fifth alarm No arrival results in a cause analysis

Communication Channel Failures

Attempted Compromise (See Sec 13)

• Treated as an Alarm if System is Armed

• Treated as a Trouble if System is Disarmed

Disruption of Channel (See Sec 14)

• Applies when Channel Serves More that 1 System

- Contact Communication Provider

- Contact FSO/SSO

Upon Arrival and Beyond

No Cause Was Found -

• Test and Reset by Investigator

- Checked by service technician within 4 hours of opening of the facility.

• Not Reset by Investigator

- Area check by investigator and service technician dispatched

Trouble Signals & Service Calls

Occupied or Checked Areas Initiate repairs within 4 hours after facility opens if

- Area is occupied by a person with authorized access

OR

- Area is checked by cleared personnel based on

NISPOM

Not Occupied or Checked Areas

• Initiate repairs within 4 hours

Contracts When monitoring and/or investigation is assigned (See 18.1 & 18.2) 30 Day cancellation clause DD254 is required if monitoring or investigation is assigned to a central station AND the NISPOM applies (See 18.3) Contracts do not relieve the Alarm Service Company from keeping the alarm and monitoring systems in compliance (see 18.4) Failure to uphold the contracts – Cancel Certificate (See 18.6)

Training

The ASC is responsible to arrange for and/or verify Training

Training shall be conducted annually or when there is a change

The ASC shall keep a record of the specific training and the name of who was trained.

Conducting a Service Test

During business hours

•Trip a signal at an unoccupied area

- Verification

- Dispatch

After business hours (rarely done)

•Trip a signal with FSO/SSO

• Initiate a telephone test

- Dispatch

Security of Communication Channels

Communication paths from the alarmed area to the monitoring center are as important as the installation

Line Security - The supervision against compromise using 2 way communication May be either Standard or Encrypted

Non-Line Security - (Requires prior approval by CSO/CSA)

The supervision of a single fault condition on the communication path

Exists when there is 1 way communication

Security of Communication Channels

Transmission methods that provide Line Security - 2 Way Radio Frequency Data Networks

Transmission methods that do not provide Line Security -

Digital Communicators Cellular Transmitters* (Some do provide line security-check the Listing) 1 Way Radio Frequency

Requirements for Encryption

Certified by NIST

• At least 128 Bit Encryption

• Complying with FIPS 140-2 OR FIPS-197

Listed by UL as Line Security Equipment

Generally Required by the CSO/CSA When Data Networks are used

Degraded Network

If the network becomes degraded or inoperative, the areas have to be watched or occupied

Service response times and notification in accordance with Sec 14 of UL 2050

Alarm Installations

Installed in Closed Areas, SCIF’s or SAPF’s

• Extent 5 (Only Applies to Closed Areas under the

NISPOM)

• Extent 3

Installed in Vaults or on Container

• Extent Complete

Extent of Protection #3

Area B contact on exterior door 4 step motion

Area A contact on exterior door 4 step motion

Movable Windows

A

B

Using Motion Detection

Extent of Protection #3

Area B contact on exterior door contact 1 window motion to cover door & window glass break on 2 windows

Area A contact on exterior door motion to cover door glass break on 3 windows

Movable Windows

A

B

Using Perimeter Protection

Protection of Containers & Vaults

Extent Partial consists of a contact that is Listed for safe & vault applications on each door. One contact may be used on GSA approved containers.

Extent Complete consists of a contact that is Listed for safe & vault applications on each door.

One contact may be used on GSA approved containers. In addition all exterior surfaces of the vault or container is protected with vibration sensors or proximity detectors.

National Industrial Monitoring Stations (CRZM)

Origin of Category

To develop a means of determining the qualification of a monitoring location that is distant from the protected property

To clarify the responsibility for the continued compliance of the monitoring facility

A Listing is Required When -

The station is not within the 4 hour service territory of the ASC service center to which the certificate was provided

The station is maintained by another ASC service center

Auditing a National Industrial Monitoring Station

The Purpose

An NIMS has been evaluated for compliance with Section 6 & 7 of UL 2050 (when operated by a government contractor) or UL 827 as a Central Station (when operated by an ASC)

The Audit is to verify

• The facility continues to comply

• The staff performs the required tests

• The staff is trained in their duties

The UL Alarm System Description Form

UL Certificate Service Territories for Alarm Systems and Services

ND

MO

AR

NY

AK

HI

WA

CA

NV

OR ID

MT

WY

UT

AZ NM

TX

OK

KS

NE

SD

MN

IA

WI

IL

LA

MS AL GA

FL

SC

NCTN

KY

IN

MI

OH

VA

WV DE

MD

NJ

CT

MA

VT

NH

ME

CO

Puerto Rico

US Virgin Islands

East

West

Midwest

Washington, D.C.

PA

Regional Contacts Mid West: Joe Weller 847 664 2368 East Coast Pete Tallman 631 546 2415

Additional Contact for Texas area is Nick Mirus 972-509-1294