Information Security Program Regulation

DEPARTMENT OF DEFENSE

Office of the Secretary

32 CFR Part 159a

Information Security Program Regulation

AGENCY: Department of Defense.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: The Department of Defense proposes to issue this amendment to

accommodate Congressional language incorporated into the Fiscal Year

1994 Appropriations Act which specifies that new purchases of

combination locks for GSA-approved security containers, vault doors,

and secure rooms shall conform to Federal Specifications FF-L-2740 as

well as the findings and recommendations of a senior panel established

by the Deputy Secretary of Defense regarding physical security measures

required to adequately safeguard classified information in the

possession of DoD activities.

DATES: Comments must be received by August 28, 1995.

ADDRESSES: Forward comments to the Office of the Assistant Secretary of

Defense for Command, Control, Communications, and Intelligence, 6000

Defense Pentagon, Washington, DC 20301-6000.

FOR FURTHER INFORMATION CONTACT: Mr. W. Bell, OUSD(P), 703-695-2289.

SUPPLEMENTARY INFORMATION: It has been determined that this amendment

is not a significant regulatory action. It has also been determined

that this amendment is not subject to the Regulatory Flexibility Act

and does not impose any reporting or recordkeeping requirements under

the Paperwork Reduction Act of 1980.

List of Subjects in 32 CFR Part 159a

Classified information.

Accordingly, 32 CFR part 159a is proposed to be amended to read as

follows:

PART 159a--INFORMATION SECURITY PROGRAM REGULATION

1. The authority citation for part 159a continues to read as

follows:

Authority: E.O. 12356, 5 U.S.C. 301.

Sec. 159a.9 [Amended]

2. In Sec. 159a.9, paragraph(s), DoD Component, is amended by

removing ``Organization'' and adding in its place ``Chairman'', by

removing ``(OJCS)'' and by removing ``and Specified'' and adding in its

place ``Combatant''.

Sec. 159a.12 [Amended]

3. Section 159a.12 is amended in paragraph (c)(1)(i)(A) by removing

``Office of the Deputy Under Secretary of Defense (Policy),

(ODUSD(P)),'' and adding in its place ``Office of the Assistant

Secretary of Defense for Command, Control, Communications, and

Intelligence, (OASD(C3I))'', paragraph (c)(1)(i)(B) and (c)(1)(ii)(B)

by removing ``including Specified Commands'', paragraph (c)(1)(i)(B) by

removing ``wo'' and adding in its place ``who'', and paragraphs

(c)(1)(ii)(C) by removing ``OJCS'' and adding in its place ``Chairman

of the Joint Chiefs of Staff''.

Sec. 159a.26 [Amended]

4. Section 159a.26(e)(7) is amended by removing ``ASD(PA)'' and

adding in its place ``ATSD(PA)'' and removing ``OJCS'' and adding in

its place ``the Chairman of the Joint Chiefs of Staff''.

Sec. 159a.33 [Amended]

5. Section 159a.33(e)(2) is amended by removing ``7920.1'' and

adding in its place ``8120.1''.

Sec. 159a.35 [Amended]

6. Section 159a.35(g) is amended by adding ``O-'' before

``5230.22''.

7. Subpart F is revised to read as follows:

Subpart F--Safekeeping and Storage

Sec.

159a.37 Storage and storage equipment.

159a.38 Custodial precautions.

159a.39 Installation entry and exit inspection program.

Subpart F--Safekeeping and Storage

Sec. 159a.37 Storage and storage equipment.

(a) General policy. Classified information shall be secured under

conditions adequate to prevent access by unauthorized persons. The

requirements specified in this part represent acceptable security

standards. Exceptions to these requirements should be approved by the

responsible DoD Component Senior Information Security Authority. This

approval authority may be delegated to major commanders. Supplemental

or compensatory security measures must be implemented to compensate for

the inability to meet the baseline standard. DoD policy concerning the

use of force for the protection of classified information is specified

in DoD Directive 5210.56.\17\ Weapons or sensitive items such as funds,

jewels, precious metals or drugs shall not be stored in the same

container used to safeguard classified information. Security

requirements for Sensitive Compartmented Information Facilities (SCIFs)

are established by the Director of Central Intelligence. Current

holdings of classified material shall be reduced to the minimum

required for mission accomplishment.

\17\ See footnote 2 to Sec. 159a.3.

---------------------------------------------------------------------------

(b) Standards for storage equipment. The GSA establishes and

publishes minimum standards, specifications, and supply schedules for

containers, vault doors, alarm systems, and associated security devices

suitable for the storage and protection of classified information. DoD

Directive 3224.3 \18\ describes acquisition requirements for physical

[[Page 33377]] security equipment used within the Department of

Defense.

\18\ See footnote 2 to Sec. 159a.3.

---------------------------------------------------------------------------

(c) Storage of classified information. Classified information is to

be guarded or stored in a locked security container, vault, room, or

area, as follows:

(1) Top Secret. Top Secret information shall be stored in the

following:

(i) A GSA-approved security container or modular vault, in a vault;

or in the U.S., in a secure room if under U.S. Government control (see

appendix F to this part). Other rooms that were approved for the

storage of Top Secret in the U.S. may continue to be used. When located

in areas not under U.S. Government control, the storage container,

vault, or secure room must be protected by an intrusion detection

system or guarded when unoccupied. U.S. Government control means access

to the classified material is controlled by an appropriately cleared

U.S. Government civilian, military, or contractor employee. An

intrusion detection system (IDS) used for this purpose shall meet the

requirements of appendix G to this part. Security forces shall respond

to the alarmed location within 15 minutes from time of notification.

(ii) New purchases of combination locks for GSA-approved security

containers, vault doors and secure rooms shall conform to Federal

Specification FF-L-2740. Existing mechanical combination locks will not

be repaired. If they should fail, they will be replaced with locks

meeting FF-L-2740.

(iii) Under field conditions during military operations, the

commander may prescribe the measures deemed adequate to meet the

storage standard contained in paragraphs (a) and (b) of this section.

(iv) Protection of Top Secret outside the United States requires

application of one or more supplementary controls, i.e., continuous

guard or duty personnel, inspections of locked containers/vaults or an

alarm system.

(2) Secret and Confidential. Secret and Confidential information

shall be stored in the manner prescribed for Top Secret; or in secure

rooms that were approved for the storage of Secret or Confidential

material by the DoD Components prior to October 1, 1995. Until October

1, 2002, Secret and Confidential information may also be stored in

unapproved or obsolete steel filing cabinets having a built-in

combination lock or secured with a lockbar and approved combination

padlock in areas under U.S. Government control, or in areas not under

U.S. Government control provided the area is protected by an IDS or is

guarded when unoccupied. Where IDS is used to protect such information

it should meet the requirements of appendix G to this part. Security

forces shall respond to the alarmed location within 45 minutes from

time of notification.

(3) Specialized security equipment--(i) Military platforms or

classified munition items. The Heads of the DoD Components shall,

consistent with this part, delineate the appropriate security measures

required to protect classified information stored in containers on

military platforms or for classified minution items.

(ii) Special purpose containers. GSA-approved field safes and

special purpose one and two drawer light-weight security containers

approved by the GSA are used primarily for storage of classified

information in the field and in military platforms. Such containers

shall be securely fastened to the structure or under constant

surveillance to prevent their theft. Use of these containers in

ordinary office environmentas, or their procurement for this purpose,

must be approved by major commands or equivalents.

(iii) Map and plan files. GSA-approved map and plan files are

available for storage of odd-sized items such as computer media, maps,

charts, and classified equipment.

(iv) Modular vaults. GSA-approved modular vaults meeting Federal

Specification AA-V-2737 may be used to store classified information as

an alternative to vault requirements described in Appendix F to this

part.

(4) Replacement of combination locks. The mission and location of

the activity, the classification level and sensitivity of the

information, and the overall security posture of the activity

determines the priority for replacement of existing combination locks.

All system components and supplemental security measures including

electronic security systems (e.g., intrusion detection systems,

automated entry control subsystems, and video assessment subsystems),

and level of operations must be evaluated by the commander when

determining the priority for replacement of security equipemnt.

Appendix H to this part provides a matrix illustrating a prioritization

scheme for the replacement of existing combination locks on GSA-

approved security containers and vault doors. Priority 1 requires

immediate replacement.

(5) Storage of bulky material. Storage areas for bulky material

containing classified information may have access openings secured by

GSA-approved changeable combination padlocks (Federal Specification FF-

P-110 series) or high security key-operated padlocks (Military

Specification MIL-P-43607). Other security measures are required, in

accordance with paragraph (c)(1) of this section.

(i) The Heads of the DoD Components shall establish administrative

procedures for the control and accountability of keys and locks

whenever key-operated, high-security padlocks are utilized. The level

of protection provided such keys shall be equivalent to that afforded

the classified information being protected by the padlock.

(ii) 10 U.S.C. 1386 makes unauthorized possession of keys, key-

blanks, keyways or locks adopted by any part of the Department of

Defense for use in the protection of conventional arms, ammunition, or

explosives, special weapons, and classified equipment, a criminal

offense punishable by fine or imprisonment for up to 10 years, or both.

(d) Procurement of new storage equipment.--(1) New security storage

equipment shall be procured from those items listed on the GSA Federal

Supply Schedule. Exceptions may be made by the heads of the DoD

Components, with notification to the ASD(C31). Components should retain

and apply serviceable storage equipment made available as consequence

of draw downs, contractor turn-in of government furnished equipment, or

other events; promptly report excess containers to property disposal;

and fulfill requirements for added equipment through property disposal

when that is cost beneficial.

(2) Current holdings of classified material shall be reduced to the

minimum required for mission accomplishment.

(3) Nothing in this subpart shall be construed to modify existing

Federal supply class management assignments made under DoD Directive

5030.47 \19\

\19\ See footnote 2 to Sec. 159a.3.

---------------------------------------------------------------------------

(e) Equipment designations and combinations--(1) Numbering and

designating storage facilities. There will be no external mark

revealing the level of classified information authorized to be or

actually stored in a given contianer or vault. Priorities for emergency

evacuation and destruction will not be marked or posted on the exterior

of storage containers or vaults.

(2) Combinations to containers and vaults. (i) Changing.

Combinations to security containers, vaults and secure rooms shall be

changed only by individuals having that responsibility and an

appropriate security clearance. Combinations shall be

changed: [[Page 33378]]

(A) When placed in use;

(B) Whenever an individual knowing the combination no longer

requires access;

(C) When the combination has been subject to possible compromise;

(D) At least once every two years; or

(E) When taken out of service. Built-in combination locks shall be

reset to the standard combination 50-25-50; combination padlocks shall

be reset to the standard combination 10-20-30.

(ii) Selecting combinations. Combinations for each lock shall be

unique to that lock and shall have no systematic relationship to other

combinations used within a specific office. Combination numbers shall

not be derived from numbers otherwise associated with the specific

office or its personnel. The number within a combination shall be

selected on a random basis without deliberate relationship of one to

the other except to provide appropriate variance to operate the lock

properly.

(iii) Classifying combinations. The combination of a container,

vault or secure room used for the storage of classified information

shall be assigned a security classification equal to the highest

category of the classified information stored therein. Any written

record of the combination shall be marked with the classification.

Declassification of combinations occurs at the time they are changed.

(iv) Recording storage facility data. A record shall be maintained

for each vault or secure room door, or container used for storage of

classified information, showing location of the door or container, and

the names, home addresses, and home telephone numbers of the

individuals having knowledge of the combination. Standard Form 700,

``Security Container Information,'' shall be used for this purpose.

(A) Part 1 of the SF 700, when completed, shall be placed in an

interior location in security cabinets and on vault or secure room

doors. To the extent practical, Part 1 shall be on the inside face of

the locking drawer of file cabinets, and on the inside surface of map

and plan cabinet and vault doors.

(B) SF 700, Parts 2 and 2A, shall be marked conspicuously on their

front with the highest level of classification and any special access

notice applicable to the information authorized for storage in the

container and will be stored in a security container other than the one

to which they apply.

(C) Internal security procedures shall provide for prompt

notification to the official responsible for the area if a container is

found unsecured and unattended or show evidence of unauthorized entry

attempt or SF 700 is inaccessible or not available.

(D) Listings of persons having knowledge of the combination shall

be continued as necessary on an attachment to Part 2.

(E) Dissemination. Access to the combination of a vault or

container used for the storage of classified information shall be

granted only to those individuals who are authorized access to the

classified information to be stored therein.

(3) Access controls. Entrances to secure rooms or areas should be

under visual control at all times during duty hours to preclude entry

by unauthorized personnel or equipped with electric, mechanical or

electromechanical access control devices to limit access during duty

hours. Appendix I to this part provides standards for these access

control devices; the use of automated systems described therein is

encouraged.

(f) Repair of damaged security containers. Neutralization of lock-

outs or repair of any damage that affects the integrity of a security

container approved for storage of classified information shall be

accomplished only by authorized persons who have been the subject of a

trustworthiness determination in accordance with 32 CFR part 154 and

are continuously escorted while so engaged.

(1) With the exception of frames bent through application of

extraordinary stress, a GSA-approved security container manufactured

prior to October 1991 (identified by a silver GSA label with black

lettering affixed to the exterior of the container) is considered to

have been restored to its original state of security integrity as

follows:

(i) All damaged or altered parts, for example, the locking drawer,

drawer head, or lock, are replaced; or

(ii) Has been drilled immediately adjacent to or through the dial

ring to neutralize a lockout, a replacement lock meeting FF-L-2740 is

used, and the drilled hole is repaired with a tapered, hardened tool-

steel pin, or a steel dowel, drill bit, or bearing with a diameter

slightly larger than the hole and of such length that when driven into

the hole there shall remain at each end of the rod a shallow recess not

less than \1/8\ inch nor more than \3/16\ inch deep to permit the

acceptance of substantial welds, and the rod is welded both on the

inside and outside surfaces. The outside of the drawer head must then

be puttied, sanded, and repainted in such a way that no visible

evidence of the hole or its repair remains on the outer surface.

(2) In the interests of cost efficiency, the procedures identified

in paragraph (f)(2)(1)(i) of this section should not be used for GSA-

approved security containers purchased after October 1991

(distinguished by a silver GSA label with red lettering affixed to the

outside of the container control drawer) until it is first determined

whether warranty protection still applies. To make this determination,

it will be necessary to contact the manufacturer and provide the serial

number and date of manufacture of the container. If the container is

under warranty, a lock-out will be neutralized using the procedures

described in the Naval Facilities Engineering Service Center (NFESC)

Technical Data Sheet (TDS) 2000-SHR.

(3) Unapproved modification or repair of security containers and

vault doors is considered a violation of the container's or door's

integrity and the GSA label shall be removed. Thereafter, they may not

be used to protect classified information except as otherwise

authorized in this part.

(g) Maintenance and operating inspections--(1) Maintenance. The

Heads of the DoD Components shall establish procedures concerning

maintenance of classified material security containers and vaults to

accomplish the following:

(i) Permit only those persons who have been the subject of a

trustworthiness determination in accordance with 32 CFR part 154 to

perform maintenance which affects the protective features of the

container or vault.

(ii) Require a record of all maintenance performed on a container

or vault be maintained by the using activity and retained with the

container or vault. The record shall reflect the operating problem

requiring maintenance, the date maintenance was performed, the name and

organization of the maintenance technician, the work accomplished, and

the activity official certifying the subsequent proper operation of the

container or vault. These records shall be retained for the service

life of the container or vault.

(iii) Refer any discovery of unauthorized tampering or modification

of a container or vault to the supporting counterintelligence

organization for investigation.

(iv) Provide a preventive maintenance program for containers and

vaults to detect and correct operating problems affecting their

security.

(2) Operating inspections. Containers and vaults shall be inspected

before being used, and periodically thereafter, and whoever discovered

open and unattended or evidence of actual or [[Page 33379]] attempted

unauthorized forced or covert entry is present to assure the presence

and proper operation of their protective security features before they

may continue in use to store classified material.

Sec. 159a.38 Custodial precautions.

(a) Responsibilities of custodians. Anyone who has been duly

authorized/appointed to maintain classified information is responsible

for its safekeeping, to include storing the material in approved

storage containers or facilities when it is not in use or under the

supervision of an authorized person.

(b) Residential storage arrangements. Only the Head of a DoD

Component, or single designee at the Component headquarters and major

command levels, may authorize removal of classified material from

designated working areas in off-duty hours, for work at home or

otherwise, provided that a GSA-approved security container is furnished

and appropriate regulations otherwise provide for the maximum

protection possible under the circumstances. Any such arrangements

approved before the effective date of this part shall be reevaluated

and, if continued approval is warranted, compliance with this paragraph

is necessary.

(c) Care during working hours. (1) Classified material removed from

storage shall be kept under constant surveillance by persons authorized

access and having a need to know thereto and, when not in use,

protected from unauthorized view of its classified contents until

returned to storage. Such protection shall be provided, as applicable,

by the material's unclassified cover or by an appropriate cover sheet.

Cover sheets shall be Standard Forms 703, 704 and 705 for,

respectively, Top Secret, Secret, and Confidential documents.

(2) Preliminary drafts, carbon sheets, plates, stencils,

stenographic notes, worksheets, computer and typewriter ribbons,

transfer medium and other items containing classified information shall

be safeguarded according to the level of classified information they

contain and shall be accordingly destroyed after they have served their

purpose. Transfer medium include drums, cartridges, belts, sheets,

memory, and other material in copiers, printers, facsimile and other

devices of items which receive or come in contact with classified

information.

(3) Destruction of personal computer printer or typewriter ribbons

from which classified information can be obtained shall be accomplished

in the manner prescribed for classified working papers of the same

classification. After the upper and lower sections have been cycled

through and overprinted five times in all ribbon or impact or typing

positions, fabric ribbons may be treated as unclassified regardless of

their previous classified use. Carbon and plastic ribbons and carbon

paper that have been used in the production of classified information

shall be destroyed in the manner prescribed for working papers of the

same classification after initial usage. However, any typewriter ribbon

that uses technology which enables the ribbon to be struck several

times in the same area before it moves to the next position may be

treated as unclassified.

(d) End-of-day security checks. The Heads of activities that

process or store classified information shall establish a system of

security checks at the close of each working day to ensure that the

area is secure. Standard Form 701, ``Activity Security Checklist,''

shall be used to record such checks. Standard Form 702. ``Security

Container Check Sheet,'' shall be used to record the use of all vaults,

secure rooms and containers used for the storage of classified

material.

(e) Emergency planning. (1) Plans shall be developed for the

protection, removal, or destruction of classified material in case of

fire, natural disaster, civil disturbance, terrorist activities, or

enemy action. Such plans shall establish detailed procedures and

responsibilities for the protection of classified material to ensure

that the material does not come into the possession of unauthorized

persons. These plans shall include the treatment of classified

information located in foreign countries. Emergency destruction

procedures are not needed for activities located inside the 50 states.

(2) These emergency planning procedures do not apply to material

related to COMSEC Planning for the emergency protection including

emergency destruction under no-notice conditions of classified COMSEC

material shall be developed in accordance with requirements of NACSI

4006.

(3) Emergency plans shall provide for the protection of classified

material in a manner that will minimize the risk of injury or loss of

life to personnel. In the case of fire or natural disaster, the

immediate placement of authorized personnel around the affected area,

preinstructed and trained to prevent the removal of classified material

by unauthorized personnel, is an acceptable means of protecting

classified material and reducing casualty risk. Such plans shall

provide for emergency destruction to preclude capture of classified

material when determined to be required in overseas locations.

(f) Telecommunications conversations. (1) Classifed information

shall not be discussed in telephone conversations except over approved

secure communications circuits, that is, cryptographically protected

circuits or protected distributions systems installed in accordance

with National COMSEC Instruction 4009.

(2) The Secure Telephone Unit-III (STU-III) is approved for

classified discussions within the limitations displayed by the STU-III.

The need-to-know must be established before discussing classified

information.

(3) Users of secure telephones shall assure that only persons with

appropriate clearance and need-to-know are within hearing range of

their conversation.

(g) Removal of classified storage and information processing

equipment. All classified storage containers and information processing

equipment shall be inspected by properly cleared personnel before

removal from protected areas or unauthorized persons are allowed access

to them. The inspection shall be accomplished to assure no classified

information remains within the equipment. Some examples of equipment

which shall be inspected are:

(1) Reproduction or facsimile machines and AIS components and other

office equipment used to process classified information.

(2) GSA-approved security containers, filing cabinets, or other

storage containers used for safeguarding classified information; and

(3) Other items of equipment that may inadvertently contain

classified information.

(h) Classified discussions, meetings and conferences. Security

requirements and procedures governing disclosure of classified

information at conferences, symposia, conventions, and similar

meetings, and those governing the sponsorship and attendance of U.S.

and foreign personnel at such meetings, are set forth in DoD Directive

5200.12,\20\ DoD Instruction 5230.20,\21\ DoD 5220.22-R,\22\ and DoD

5220.22-M.\23\

\20\ See footnote 2 to Sec. 159a.3.

\21\ See footnote 2 to Sec. 159a.3.

\22\ See footnote 2 to Sec. 159a.3.

\23\ See footnote 3 to Sec. 159a.3.

---------------------------------------------------------------------------

(i) Safeguarding of U.S. classified information located in foreign

countries. Except for classified information that has been authorized

for release to a foreign government or international

[[Page 33380]] organization pursuant to DoD Directive 5230.11 \24\ and

is under the security control of such government or organization, the

retention of U.S. classified material in foreign countries may be

authorized only when that material is necessary to satisfy specific

U.S. Government requirements. This includes classified material

temporarily transferred into a foreign country through U.S. Government

personnel authorized to escort or handcarry such material pursuant to

Sec. 159a.59, as applicable. Whether permanently or temporarily

retained, the classified materials shall be stored under U.S.

Government control, as follows. See Sec. 159a.37(c) additional guidance

on Top Secret information.

\24\ See footnote 2 to Sec. 159a.3.

---------------------------------------------------------------------------

(1) At a U.S. military installation, or a location where the United

States enjoys extraterritorial status, such as an embassy or consulate.

(2) At a U.S. Government activity located in a building used

exclusively by U.S. Government tenants, if the building is under 24-

hour control by U.S. Government personnel.

(3) At a U.S. Government activity located in a building not used

exclusively by U.S. Government tenants nor under host-government

control, provided the classified material is stored in security

containers approved by the GSA and is placed under 24-hour control by

U.S. Government personnel.

(4) At a U.S. Government activity located in a building not used

exclusively by U.S. Government tenants, but which is under host-

government control, provided the classified material is stored in GSA-

approved security containers that are further secured in a locked room

or area to which only U.S. personnel have access.

(5) When host government and U.S. personnel are collocated, U.S.

classified material that has not been authorized for release to the

host government under DoD Directive 5230.11, shall, be segregated from

releasable classified material to facilitate physical control and

prevent inadvertent compromise. U.S. classified material that is

releasable to the host country need not be subject to the 24-hour U.S.

control requirement provided the host government exercises its own

control measures over the pertinent areas or containers during nonduty

hours.

(6) Foreign nationals shall be escorted while in areas where

nonreleasable U.S. classified material is handled or stored. When

required by operational necessity, foreign nationals may be permitted,

during duty hours unescorted entry to such areas provided the

nonreleasable information is properly stored or is under the direct

personal supervision and control of cleared U.S. personnel who can

prevent unauthorized access.

(7) Under field conditions during military operations, the

commander may prescribe the measures deemed adequate to protect

classified material.

(j) Non-COMSEC classified information processing equipment. The

Department of Defense has a variety of non-COMSEC approved equipment to

process classified information. This includes copiers, fascimile

machines, printers, scanners, cameras, printers for AISs, AISs,

electronic typewriters, and other word processing systems among others.

Because much of this equipment has known security vulnerabilities, its

use can cause unauthorized disclosure.

(1) Activities must identify those features, parts, or functions of

equipment used to process classified information which may retain all

or part of the information. Activity security procedures must prescribe

safeguards to:

(i) Prevent unauthorized access to that information.

(ii) Replace and destroy equipment parts as classified material

when the information cannot be removed from them. Alternatively, the

equipment may be designated as ``classified'' and protected at least at

the retained information's classification level.

(2) Activities will select equipment that performs the needed

function and presents the lowest acceptable risk to the classified

information the equipment processes.

(3) Activities will comply with guidance on security

vulnerabilities issued by appropriate authority and must report

equipment problems and failures.

(k) Reporting equipment problems and vulnerabilities. (1) The

equipment that the Department of Defense uses to safeguard, destroy or

process classified information can fail to function properly or

otherwise perform in a way that threatens that information. When that

occurs, responsible individuals within the using activities must

promptly:

(i) Restore the protection to the information.

(ii) Report the incident to their Component security office. Such

report shall:

(A) Be classified or transmitted by secure means, as warranted by

the nature of the problem.

(B) Describe the problem; the equipment's type, manufacturer, and

any serial number; the number of equipment units involved; and any

means found to overcome the problem.

(C) Be in addition to those made to logistics, supply, or

contracting offices, or those made in reporting security violations.

(2) Component security offices receiving such reports shall assess

the impact on other Component activities and advise them accordingly.

They shall also promptly send a copy of the initial and any subsequent

reports to the Director, Counterintelligence and Security Programs,

ODASD(I&S), OASD(C3I). They shall include their assessment of the

impact and a summery of the related Component actions.

(3) Problems or vulnerabilities with COMSEC equipment and

controlled Cryptographic Items shall be reported as prescribed by the

controlling COMSEC authorities rather than under this paragraph. The

COMSEC authority shall promptly coordinate these reports and correcting

actions with the Director, Counterintelligence and Security Programs,

OASD(C3I), when the problems or vulnerabilities are common to all such

equipment.

Sec. 159a.39 Installation entry and exit inspection program.

(a) Policy. Commanders shall prescribe procedures for inspecting

persons, their property and vehicles at entry and exit points of

installations or at designated secure areas within an installation and

for search of persons and their possessions while on an installation.

(1) This shall include determination of whether inspections are

randomly conducted or mandatory for all, and shall prescribe procedures

to ensure the safeguarding of classified information.

(2) Examinations of individuals and their possessions while on the

installation for the primary purpose of obtaining evidence is

classified as a ``search'' under the fourth amendment and separate

guidance regarding the conduct of these searches shall be issued.

(3) All procedures shall be reviewed for legal sufficiency by the

general counsel or legal advisor before issuance. These procedures

shall require Commanders to consult with their servicing Judge Advocate

or other legal advisor before authorizing gate inspections.

(b) [Reserved]

Appendix C to Part 159a [Amended]

7. Appendix C to Part 159a, paragraphs 1.a. and 2.a., paragraphs

2.b.(d)(4), introductory text, and 2.b.(d)(5)(b) paragraph c.(4)(b),

and paragraphs 4.a. and 4.c. are amended by [[Page 33381]] adding

``Chairman of the'' before ``Joint Chiefs of Staff''

8. Appendices F through I to part 159a are added as follows:

Appendix F to Part 159a--Vault and Secure Room Construction Standards

1. Vault

a. Floor and Walls. Eight inches of concrete reinforced to meet

current structural standards. Walls are to extend to the underside

of the roof slab above.

b. Roof. Monolithic reinforced concrete slab of thickness to be

determined by structural requirements, but not less than the floor

and walls.

c. Ceiling. The roof or ceiling must be reinforced concrete of a

thickness to be determined by structural requirements, but not less

than the floors and walls.

d. Vault door and frame unit should conform to Federal

Specification AA-D-2757 Class 8 vault door, or Federal Specification

AA-D-600 Class 5 vault door.

2. Secure Room

a. The walls, floor, and roof construction of secure rooms must

be of permanent construction materials; i.e., plaster, gypsum

wallboard, metal panels, hardboard, wood, plywood, or other

materials offering resistance to, and evidence of unauthorized entry

into the area. Walls shall be extended to the true ceiling and

attached with permanent construction materials, wire mesh or 18

gauge expanded steel screen.

b. Ceiling. The ceilings shall be constructed of plaster,

gypsum, wallboard material, hardwood, or any other acceptable

material.

c. Doors. The access door to the room shall be substantially

constructed of wood or metal. The hinge pins of outswing doors shall

be peened, brazed, or spot welded to prevent removal. Door should be

equipped with a built-in GSA-approved combination lock meeting

Federal Specification FF-L-2740.

d. Windows. Windows which are less than 18 feet above the ground

measured from the bottom of the window, or are easily accessible by

means of objects directly beneath the windows, shall be constructed

from or covered with materials which will provide protection from

forced entry. The protection provided to the windows need be no

stronger than the strength of the contiguous walls.

e. Openings. Utility openings such as ducts and vents should be

kept at less than man-passable (96 square inches) opening. Openings

larger than 96 square inches will be hardened in accordance with

Military Handbook 1013/1A.

Appendix G to Part 159a--IDS Standards

1. An IDS must detect an unauthorized penetration in the secured

area. An IDS complements other physical security measures and

consists of the following:

a. Intrusion Detection Equipment (IDE).

b. Security forces.

c. Operating procedures.

2. System functions.

a. IDS components operate as a system with the following four

distinct phases:

(1) Detection.

(2) Communications.

(3) Assessment.

(4) Response.

b. These elements are equally important, and none can be

eliminated if an IDS is to provide an acceptable degree of

protection.

(1) Detection: The detection phase begins as soon as a detector

or sensor reacts to stimuli it is designed to detect. The sensor

alarm condition is then transmitted over cabling located within the

protected area to the Premise Control Unit (PCU). The PCU may

service many sensors. The PCU and the sensors it serves comprise a

``zone'' at the monitor station. This shall be used as the

definition of an alarmed zone for purposes of this part.

(2) Reporting: The PCU receives signals from all sensors in a

protected area and incorporates these signals into a communication

scheme. Another signal is added to the communication for supervision

to prevent compromise of the communication scheme. This supervised

signal is intended to disguise the information and protect the IDS

against tampering or injection of false information by an intruder.

The supervised signal is sent by the PCU through the transmission

link to the monitor station. Inside the monitor station either a

dedicated panel or central processor monitors information from the

PCU signals. When an alarm occurs, an annunciator generates an

audible and visible alert to security personnel. Alarms result

normally from intrusion, tampering, component failure, or system

power failure.

(3) Assessment: The assessment period is the first phrase that

requires human interaction. When alarm conditions occur, the

operator assesses the situation and dispatches the response force.

(4) Response: The response phase begins as soon as the operator

assesses an alarm condition. A response force must immediately

respond to all alarms. The response phase must also determine the

precise nature of the alarm and take all measures necessary to

safeguard the secure area.

3. Use of IDS

a. As determined by the commander all areas that reasonably

afford access to the container, or where classified data is stored

should be protected by IDS unless continually occupied. Prior to the

installation of an IDS, commanders shall consider the threat,

vulnerabilities, in-depth security measures and shall perform a risk

analysis.

b. Acceptability of Equipment: All IDE must be UL-listed (or

equivalent) and approved by the DoD Component or government

contractor. Government installed, maintained, or furnished systems

are acceptable.

4. Equipment

a. Transmission Line Security: When the transmission line leaves

the facility and traverses an uncontrolled area, Class I or Class II

line supervision shall be used.

(1) Class I: Class I line security is achieved through the use

of DES or an algorithm based on the cypher feedback or cypher block

chaining mode of encryption. Certification by NIST or another

independent testing laboratory is required.

(2) Class II: Class II line supervision refers to systems in

which the transmission is based on pseudo random generated tones or

digital encoding using an interrogation and response scheme

throughout the entire communication, or UL Class AA line

supervision. The signal shall not repeat itself within a minimum 6

month period. Class II security shall be impervious to compromise

using resistance, voltage, current, or signal substitution

techniques.

b. Internal Cabling: The cabling between the sensors and the PCU

should be dedicated to IDE and must comply with national and local

code standards.

c. Entry Control Systems: If an entry control system is

integrated into an IDS, reports from the automated entry control

system should be subordinate in priority to reports from intrusion

alarms.

d. Maintenance Mode: When an alarm zone is placed in the

maintenance mode, this condition shall be signaled to the monitor

station. This signal must appear as an alarm or maintenance message

at the monitor station and the IDS shall not be securable while in

the maintenance mode. The alarm or message must be continually

visible at the monitor station throughout the period of maintenance.

A standard operating procedure must be established to address

appropriate actions when maintenance access is indicated at the

panel. All maintenance periods shall be archived in the system. A

self-test feature shall be limited to one second per occurrence.

e. Annunciation of Shunting or Masking Condition: Shunting or

masking of any internal zone or sensor must be appropriately logged

or recorded in archive. A shunted or masked internal zone or sensor

must be displayed as such at the monitor station throughout the

period the condition exists whenever there is a survey of zones or

sensors.

f. Indications of alarm status shall be revealed at the

monitoring station and optionally within the confines of the secure

area.

g. Power Supplies: Primary power of all IDE shall be commercial

AC or DC power. In the event of commercial power failure at the

protected area or monitor station, the equipment shall change power

sources without causing an alarm indication.

(1). Emergency Power. Emergency power shall consist of a

protected independent backup power source that provides a minimum of

4 hours operating power battery and/or generator power. When

batteries are used for emergency power, they shall be maintained at

full charge by automatic charging circuits. The manufacturer's

periodic maintenance schedule shall be followed and results

documented.

(2) Power Source and Failure Indication: An illuminated

indication shall exist at the PCU of the power source in use (AC or

DC). Equipment at the monitor station shall indicate a failure in

power source, a change in power source, and the location of the

failure or change.

h. Component Tamper Protection: IDE components located inside or

outside the secure area should be evaluated for a tamper protection

requirement. If access to a [[Page 33382]] junction box or

controller will enable an unauthorized modification, tamper

protection should be provided.

5. System Requirements

a. Independent Equipment. When many alarmed areas are protected

by one monitor station, secure room zones must be clearly

distinguishable from the other zones to facilitate a priority

response. All sensors shall be installed within the protected area.

b. Access and/or Secure Switch and PCU: No capability should

exist to allow changing the access status of the IDS from a location

outside the protected area. All PCUs must be located inside the

secure area and should be located near the entrance. Assigned

personnel should initiate all changes in access and secure status.

Operation of the PCU may be restricted by use of a device or

procedure that verifies authorized use. In the secure mode, any

unauthorized entry into the space shall cause an alarm to be

transmitted to the monitor station.

c. Motion Detection Protection: Secure areas that reasonably

afford access to the container or where classified data is stored

should be protected with motion detection sensors; e.g., ultrasonic

and passive infrared. Use of dual technology is authorized when one

technology transmits an alarm condition independent from the other

technology. A failed detector shall cause an immediate and

continuous alarm condition.

d. Protection of Perimeter Doors: Each perimeter door shall be

protected by a balanced magnetic switch (BMS) that meets the

standards of UL 634.

e. Windows: All readily accessible windows (within 18 feet of

ground level) shall be protected by an IDS, either independently or

by the motion detection sensors in the space.

f. IDS Requirements for Continuous Operations Facilities: A

continuous operations facility may not require an IDS. This type of

secure area should be equipped with an alerting system if the

occupants cannot observe all potential entrances into the room.

Duress devices may also be required.

g. False and/or Nuisance Alarm: Any alarm signal transmitted in

the absence of detected intrusion or identified as a nuisance alarm

is a false alarm. A nuisance alarm is the activation of an alarm

sensor by some influence for which the sensor was designed but which

is not related to an intrusion attempt. All alarms shall be

investigated and the results documented. The maintenance program for

the IDS should ensure that incidents of false alarms should not

exceed 1 in a period of 30 days per zone.

6. Personnel

a. IDS Installation and Maintenance Personnel: Alarm

installation and maintenance should be accomplished by U.S. citizens

who have been subjected to a trustworthiness determination in

accordance with 32 CFR part 154.

b. Monitor Station Staffing: The monitor station should be

supervised continuously by U.S. citizens who have been subjected to

a trustworthiness determination in accordance with 32 CFR part 154.

Appendix H to Part 159a--Priority for Replacement

Priorities range from 1 to 4, with 1 being the highest and 4 the

lowest.

Lock Replacement Priorities in the United States and its Territories

------------------------------------------------------------------------

Item TS/SAP TS S/SAP S-C

------------------------------------------------------------------------

Vault Doors......... 1 1 3 4

Containers (A) \1\.. 3 4 4 4

Containers (B) \2\.. 1 1 1 2

Crypto.............. 1 1 2 2

------------------------------------------------------------------------

Lock Replacement Priorities Outside the United States and its

Territories

------------------------------------------------------------------------

Item TS/SAP TS S/SAP S-C

------------------------------------------------------------------------

Vault Doors......... 1 1 2 2

Containers (A) \1\.. 2 2 3 3

Containers (B) \2\.. 1 1 1 2

Crypto.............. 1 1 2 2

High Risk Areas..... 1 1 1 1

------------------------------------------------------------------------

\1\ A--Located in a controlled environment where the Department of

Defense has the authority to prevent unauthorized disclosure of

classified information. The Government may control or deny access to

the space, post guards, require identification, challenge presence,

inspect packages, program elevators, or take other reasonable measures

necessary to deny unauthorized access.

\2\ B--Located in an uncontrolled area without perimeter security

measures.

Appendix I to Part 159a--Access Controls

1. Access Controls: The perimeter entrance should be under

visual control at all times during working hours to preclude entry

by unauthorized personnel. This may be accomplished by several

methods (e.g., employee work station, guard, and CCTV). Regardless

of the method utilized, an access control system shall be used on

the entrance. Uncleared persons are to be escorted within the

facility by a cleared person who is familiar with the security

procedures at the facility.

a. Automated Entry Control Systems: An automated entry control

system may be used to control admittance during working hours

instead of visual control, if it meets the criteria stated below.

The automated entry control system must identify an individual

authenticate that person's authority to enter the area through the

use of an identification (ID) badge or card, and number or by

personal identity verification. Exist should also be recorded.

(1) ID Badges or Key Cards. The ID badge or key card must use

embedded sensors, integrated circuits, magnetic stripes or other

means of encoding data that identifies the facility and the

individual to whom the card is issued.

(2) Personal Identity Verification. Personel identity

verification (biometrics device) identifies the individual

requesting access by some unique personal characteristic, such as:

(a) Fingerprinting

(b) Hand Geometry

(c) Handwriting

(d) Retina

(e) Voice recognition. A biometrics device may be required for

access to most sensitive information.

2. In conjunction with subparagraph 1.a(2)(a), above, a personal

identification number (PIN) may be required. The PIN must be

separately entered into the system by each individual using a keypad

device and shall consist of four or more digits, randomly selected,

with no known or logical association with the individual. The PIN

must be changed when it is believed to have been compromised or

subjected to compromise.

3. Authentication of the individual's authorization to enter the

area must be accomplished within the system by the inputs from the

ID badge and/or card or the personal identity verification device or

the keypad with an electronic data base of individuals authorized

into the area. A procedure must be established for removal of the

individual's authorization to enter the area upon reassignment,

transfer or termination, or when the individual's access is

suspended, revoked, or downgraded to a level lower than required.

4. Protection must be established and continuously maintained

for all devices and/ [[Page 33383]] or equipment that constitute the

system. The level of protection may vary depending on the type of

devices and/or equipment being protected with the basic intent of

utilizing the security controls already in effect within the

facility.

a. Location where authorization data, card encoded data, and

personal identification or verification data is input, stored, or

recorded must be protected.

b. Card readers, keypads, communication, or interface devices

located outside the entrance to a controlled area shall have tamper

resistant enclosures, and be securely fastened to a wall or other

structure. Control panels located within a controlled area shall

require only a minimal degree of physical security protection

sufficient to preclude unauthorized access to the mechanism.

c. Keypad devices shall be designed or installed in such a

manner that an unauthorized person in the immediate vicinity cannot

observe the selection of input numbers.

d. Systems that utilize transmission lines to carry access

authorizations, personal identification, or verification data

between devices/equipment located outside the controlled area shall

have line supervision.

e. Electric strikes used in access control systems shall be

heavy duty industrial grade.

5. Access to records and information concerning encoded ID data

and PINs shall be restricted. Access to identification or

authorization data, operating system software or any identifying

data associated with the access control system shall be limited to

the fewest number personnel as possible. Such data or software shall

be kept secure when unattended.

6. Records shall be maintained reflecting active assignment of

ID badge and/or card, PIN, level of access, access, and similar

system-related records. Records concerning personnel removed form

the system shall be retained for 90 days. Records of entries shall

be retained for at least 90 days or until investigations of system

violations and incidents have been successfully resolved and

recorded.

7. Personnel entering or leaving an area shall be require to

immediately secure the entrance or exit point. Authorized personnel

who permit another individual to enter the area are responsible for

confirming the individual's access and need-to-know. The Heads of

the DOD components may approve the use of standardized AECS, which

meet the following criteria:

a. For a Level 1 key card system, the AECS must provide a 0.95

probability of granting access to an authorized user providing the

proper identifying information within three attempts. Additionally,

the system must ensure an unauthorized user is granted access with

less than 0.05 probability after three attempts to gain entry have

been made.

b. For a Level 2 key card and PIN system, the AECS must provide

a 0.97 probability of granting access to an authorized user

providing the proper identifying information within three attempts.

Additionally, the system must ensure an unauthorized user is granted

access with less than 0.010 probability after three attempts to gain

entry have bee made.

c. For a Level 3 key card and PIN and biometrics identifier

system, the AECS must provide a 0.99 probability of granting access

to an authorized user providing the proper identifying information

within three attempts. Additionally, the system must ensure an

unauthorized user is granted access with less than 0.005 probability

after three attempts to gain entry have been made.

1. Electric, Mechanical, or Electromechanical Access Control

Devices. Electric, mechanical, or electromechanical devices which

meet the criteria stated in subparagraphs 7.c.2. and 3, below, may

be used to control admittance to secure areas during duty hours if

the entrance is under visual control. These devices are also

acceptable to control access to compartmented areas within a secure

area. Access control devices must be installed in the following

manner:

2. The electronic control panel containing the mechanical

mechanism by which the combination is set is to be located inside

the area. The control (located within the area) shall require only

minimal degree of physical security designated to preclude

unauthorized access to the mechanism.

3. The control panel shall be installed in such a manner, or

have a shielding device mounted, so that an unauthorized person in

the immediate vicinity cannot observe the setting or changing of the

combination.

4. The selection and setting of the combination shall be

accomplished by an individual cleared at the same level as the

highest classified information controlled within.

5. Electrical components, wiring included, or mechanical links

(cables, rods, etc.) should be accessible only from inside the area,

or if they traverse an uncontrolled area they should be secured

within protecting covering to preclude surreptitious manipulation of

components.

Dated: June 22, 1995.

L.M. Bynum,

Alternate OSD Federal Register Liaison Officer, Department of Defense.

[FR Doc. 95-15707 Filed 6-27-95; 8:45 am]

BILLING CODE 5000-04-M