[Part 1228 -- Disposition of Federal Records]
Appendix A -- Minimum Security Standards for Level III Federal Facilities
Part 1228 was last amended on 12/2/99.
Reproduced from Section 2.3
(pp. 2-6 through 2-9) of
U.S. Department of Justice, United States Marshals Service report
Vulnerability Assessment of Federal Facilities
RECOMMENDED STANDARDS CHART
| PERIMETER SECURITY | LEVEL III |
| PARKING | |
| CONTROL OF FACILITY PARKING | Required |
| CONTROL OF ADJACENT PARKING | Desirable |
| AVOID LEASES WHERE PARKING CANNOT BE CONTROLLED | Desirable |
| LEASES SHOULD PROVIDE SECURITY CONTROL FOR ADJACENT PARKING | Desirable |
| POST SIGNS AND ARRANGE FOR TOWING UNAUTHORIZED VEHICLES | Required |
| ID SYSTEM AND PROCEDURES FOR AUTHORIZED PARKING (PLACARD, DECAL, CARD KEY, ETC.) | Required |
| ADEQUATE LIGHTING FOR PARKING AREAS | Required |
| CLOSED CIRCUIT TELEVISION (CCTV) MONITORING | |
| CCTV SURVEILLANCE CAMERAS WITH TIME LAPSE VIDEO RECORDING | Recommended |
| POST SIGNS ADVISING OF 24 HOUR VIDEO SURVEILLANCE | Recommended |
| LIGHTING | |
| LIGHTING WITH EMERGENCY POWER BACKUP | Required |
| PHYSICAL BARRIERS | |
| EXTEND PHYSICAL PERIMETER WITH BARRIERS (CONCRETE AND/OR STEEL COMPOSITION) | Desirable |
| PARKING BARRIERS | Desirable |
| ENTRY SECURITY | LEVEL III |
|---|---|
| RECEIVING/SHIPPING | |
| REVIEW RECEIVING/SHIPPING PROCEDURES (CURRENT) | Required |
| IMPLEMENT RECEIVING/SHIPPING PROCEDURES (MODIFIED) | Required |
| ACCESS CONTROL | |
| EVALUATE FACILITY FOR SECURITY GUARD REQUIREMENTS | Required |
| SECURITY GUARD PATROL | Recommended |
| INTRUSION DETECTION SYSTEM WITH CENTRAL MONITORING CAPABILITY | Required |
| UPGRADE TO CURRENT LIFE SAFETY STANDARDS (FIRE DETECTION, FIRE SUPPRESSION SYSTEMS, ETC.) | Required |
|
ENTRANCES/EXITS |
|
| X-RAY & MAGNETOMETER AT PUBLIC ENTRANCES | Recommended |
| REQUIRE X-RAY SCREENING OF ALL MAIL/PACKAGES | Recommended |
| HIGH SECURITY LOCKS | Required |
| INTERIOR SECURITY | LEVEL III |
| EMPLOYEE/VISITOR IDENTIFICATION | |
| AGENCY PHOTO ID FOR ALL PERSONNEL DISPLAYED AT ALL TIMES | Recommended |
| VISITOR CONTROL/SCREENING SYSTEM | Required |
| VISITOR IDENTIFICATION ACCOUNTABILITY SYSTEM | Recommended |
| ESTABLISH ID ISSUING AUTHORITY | Recommended |
| UTILITIES | |
| PREVENT UNAUTHORIZED ACCESS TO UTILITY AREAS | Required |
| PROVIDE EMERGENCY POWER TO CRITICAL SYSTEMS (ALARM SYSTEMS, RADIO COMMUNICATIONS, COMPUTER FACILITIES, ETC.) | Required |
| OCCUPANT EMERGENCY PLANS | |
| EXAMINE OCCUPANT EMERGENCY PLANS (OEP) AND CONTINGENCY PROCEDURES BASED ON THREATS | Required |
| OEPs IN PLACE, UPDATED ANNUALLY, PERIODIC TESTING EXERCISE | Required |
| ASSIGN & TRAIN OEP OFFICIALS (ASSIGNMENT BASED ON LARGEST TENANT IN FACILITY) | Required |
| ANNUAL TENANT TRAINING | Required |
| DAYCARE CENTERS | |
| EVALUATE WHETHER TO LOCATE DAYCARE FACILITIES IN BUILDINGS WITH HIGH THREAT ACTIVITIES | Required |
| COMPARE FEASIBILITY OF LOCATING DAYCARE IN OUTSIDE LOCATIONS | Required |
| SECURITY PLANNING | LEVEL III |
| INTELLIGENCE SHARING | |
| ESTABLISH LAW ENFORCEMENT AGENCY/SECURITY LIAISONS | Required |
| REVIEW/ESTABLISH PROCEDURE FOR INTELLIGENCE RECEIPT/DISSEMINATION | Required |
| ESTABLISH UNIFORM SECURITY/THREAT NOMENCLATURE | Required |
| TRAINING | |
| CONDUCT ANNUAL SECURITY AWARENESS TRAINING | Required |
| ESTABLISH STANDARDIZED UNARMED GUARD QUALIFICATIONS/ TRAINING REQUIREMENTS | Required |
| ESTABLISH STANDARDIZED ARMED GUARD QUALIFICATIONS/ TRAINING REQUIREMENTS | Required |
| TENANT ASSIGNMENT | |
| CO-LOCATE AGENCIES WITH SIMILAR SECURITY NEEDS | Desirable |
| DO NOT CO-LOCATE HIGH/LOW RISK AGENCIES | Desirable |
| ADMINISTRATIVE PROCEDURES | |
| ESTABLISH FLEXIBLE WORK SCHEDULE IN HIGH THREAT/ HIGH RISK AREAS TO MINIMIZE EMPLOYEE VULNERABILITY TO CRIMINAL ACTIVITY | Desirable |
| ARRANGE FOR EMPLOYEE PARKING IN/NEAR BUILDING AFTER NORMAL WORK HOURS | Recommended |
| CONDUCT BACKGROUND SECURITY CHECKS AND/OR ESTABLISH SECURITY CONTROL PROCEDURES FOR SERVICE CONTRACT PERSONNEL | Required |
| CONSTRUCTION/RENOVATION | |
| INSTALL MYLAR FILM ON ALL EXTERIOR WINDOWS (SHATTER PROTECTION) | Recommended |
| REVIEW CURRENT PROJECTS FOR BLAST STANDARDS | Required |
| REVIEW/ESTABLISH UNIFORM STANDARDS FOR CONSTRUCTION | Required |
| REVIEW/ESTABLISH NEW DESIGN STANDARD FOR BLAST RESISTANCE | Required |
| ESTABLISH STREET SET-BACK FOR NEW CONSTRUCTION | Recommended |
| Vulnerability Assessment U.S. Department of Justice United States Marshals Service |
Appendix B Details of Recommended Security Standards |
B.1 Perimeter Security
PARKING
| Term | Definition/Description |
| CONTROL OF FACILITY PARKING | Access to government parking should be limited where possible to government vehicles and personnel. At a minimum, authorized parking spaces and vehicles should be assigned and identified. |
| CONTROL OF ADJACENT PARKING | Where feasible, parking areas adjacent to federal space should also be controlled to reduce the potential for threats against Federal facilities and employee exposure to criminal activity. |
| AVOID LEASES WHERE PARKING CANNOT BE CONTROLLED | Avoid leasing facilities where parking cannot be controlled. If necessary, relocate offices to facilities that do provide added security through regulated parking. |
| LEASE SHOULD PROVIDE CONTROL FOR ADJACENT PARKING | Endeavor to negotiate guard services as part of lease. |
| POST SIGNS AND ARRANGE FOR TOWING UNAUTHORIZED VEHICLES | Procedures should be established and implemented to alert the public to towing policies, and the removal of unauthorized vehicles. |
| ID SYSTEM AND PROCEDURES FOR AUTHORIZED PARKING | Procedures should be established for identifying vehicles and corresponding parking spaces. (placard, decal, card key, etc.) |
| ADEQUATE LIGHTING FOR PARKING AREAS | Effective lighting provides added safety for employees and deters illegal or threatening activities. |
CLOSED CIRCUIT TELEVISION (CCTV MONITORING
| Term | Definition/Description |
| CCTV SURVEILLANCE CAMERAS WITH TIME LAPSE VIDEO RECORDING | Twenty-four hour CCTV surveillance and recording is desirable at all locations as a deterrent. Requirements will depend on assessment of the security level for each facility. Time-lapse video recordings are also highly valuable as a source of evidence and investigative leads |
| POST SIGNS ADVISING OF 24 HOUR VIDEO SURVEILLANCE | Warning signs advising of twenty-four hour surveillance act as a deterrent in protecting employees and facilities. |
LIGHTING
| Term | Definition/Description |
| LIGHTING WITH EMERGENCY POWER BACKUP | Standard safety code requirement in virtually all areas. Provides for safe evacuation of buildings in case of natural disaster, power outage, or criminal/terrorist activity. |
PHYSICAL BARRIERS
| Term | Definition/Description |
| EXTEND PHYSICAL PERIMETER, WITH BARRIERS | This security measure will only be possible in locations where the Government controls the property and where physical constraints are not present. (barriers of concrete and/or steel composition) |
| PARKING BARRIERS | Desirable to prevent unauthorized vehicle access. |
B.2 Entry Security
RECEIVING/SHIPPING
| Term | Definition/Description |
| REVIEW RECEIVING/SHIPPING PROCEDURES (CURRENT) | Audit current standards for package entry and suggest ways to enhance security. |
| IMPLEMENT RECEIVING/SHIPPING PROCEDURES (MODIFIED) | After auditing procedures for receiving/shipping, implement improved procedures for security enhancements. |
ACCESS CONTROL
| Term | Definition/Description |
| EVALUATE FACILITY FOR SECURITY GUARD REQUIREMENTS | If security guards are required, the number of guards at any given time will depend on the size of the facility, the hours of operation, and current risk factors, etc. |
| SECURITY GUARD PATROL | Desirable for level I and II facilities and may be included as lease option. Level III, IV and V facilities will have security guard patrol based on facility evaluation. |
| INTRUSION DETECTION SYSTEM WITH CENTRAL MONITORING CAPABILITY | Desirable in Level I facilities, based on evaluation for Level II facilities, and required for Levels III, IV and V. |
| UPGRADE TO CURRENT LIFE SAFETY STANDARDS | Required for all facilities as part of GSA design requirements, (e.g. fire detection, fire suppression systems, etc.) |
ENTRANCES/EXITS
| Term | Definition/Description |
| X-RAY AND MAGNETOMETER AT PUBLIC ENTRANCES | May be impractical for Level I and II facilities. Level III and IV evaluations would focus on tenant agencies, public interface, and feasibility. Required for Level V. |
| REQUIRE X-RAY SCREENING OF ALL MAIL/PACKAGES | All packages entering building should be subject to x-ray screening and/or visual inspection. |
| HIGH SECURITY LOCKS | Any exterior entrance should have a high security lock as determined by GSA specifications and/or agency requirements. |
B.3 Interior Security
EMPLOYEE/VISITOR IDENTIFICATION
| Term | Definition/Description |
| AGENCY PHOTO ID FOR ALL PERSONNEL DISPLAYED AT ALL TIMES | May not be required in smaller facilities. |
| VISITOR CONTROL/SECURITY SYSTEM | Visitors should be readily apparent in Level I facilities. Other facilities may ask visitors to sign-in with a receptionist or guard, or require an escort, or formal identification/badge. |
| VISITOR ID ACCOUNTABILITY SYSTEM | Stringent methods of control over visitor badges will ensure that visitors wearing badges have been screened and are authorized to be at the facility during the appropriate time frame. |
| ESTABLISH ID ISSUING AUTHORITY | Develop procedures and establish authority for issuing employee and visitor IDs. |
UTILITIES
| Term | Definition/Description |
| PREVENT UNAUTHORIZED ACCESS TO UTILITY AREAS | Smaller facilities may not have control over utility access, or locations of utility areas. Where possible, assure that utility areas are secure and that only authorized personnel can gain entry. |
| PROVIDE EMERGENCY POWER TO CRITICAL SYSTEMS | Tenant agency is responsible for determining which computer and communication systems require back-up power. All alarm systems, CCTV monitoring devices, fire detection systems, entry control devices, etc. require emergency power sources. (ALARM SYSTEMS, RADIO COMMUNICATIONS, COMPUTER FACILITIES, ETC.) |
OCCUPANT EMERGENCY PLANS
| Term | Definition/Description |
| EXAMINE OCCUPANT EMERGENCY PLAN (OEP) AND CONTINGENCY PROCEDURES BASED ON THREATS | Review and update current OEP procedures for thoroughness. OEPs should reflect the current security climate. |
| ASSIGN AND TRAIN OEP OFFICIALS | Assignment based on GSA requirement that largest tenant in facility maintain OEP responsibility. Officials should be assigned, trained and a contingency plan established to provide for the possible absence of OEP officials in the event of emergency activation of the OEP |
| ANNUAL TENANT TRAINING | All tenants should be aware of their individual responsibilities in an emergency situation. |
DAY CARE CENTER
| Term | Definition/Description |
| RE-EVALUATE CURRENT SECURITY AND SAFETY STANDARDS | Conduct a thorough review of security and safety standards. |
| ASSESS FEASIBILITY OF LOCATING DAY CARE WITHIN FEDERAL FACILITY | If a facility is being considered for a day care center, an evaluation should be made based on the risk factors associated with tenants and the location of the facility. |
B.4 Security Planning
INTELLIGENCE SHARING
| Term | Definition/Description |
| ESTABLISH LAW ENFORCEMENT AGENCY/SECURITY LIAISONS | Intelligence sharing between law enforcement agencies and security organizations should be established in order to facilitate the accurate flow of timely and relevant information between appropriate government agencies. Agencies involved in providing security must be part of the complete intelligence process. |
| REVIEW/ESTABLISH PROCEDURES FOR INTELLIGENCE RECEIPT/DISSEMINATION | Determine what procedures exist to ensure timely delivery of critical intelligence. Review and improve procedures to alert agencies and specific targets of criminal/terrorist threats. Establish standard administrative procedures for response to incoming alerts. Review flow of information for effectiveness and time critical dissemination. |
| ESTABLISH UNIFORM SECURITY/THREAT NOMENCLATURE | To facilitate communication, standardized terminology for Alert Levels should be implemented. (Normal, Low, Moderate, and High - As recommended by Security Standards Committee) |
TRAINING
| Term | Definition/Description |
| CONDUCT ANNUAL SECURITY AWARENESS TRAINING | Provide security awareness training for all tenants. At a minimum, self-study programs utilizing videos, and literature, etc. should be implemented. These materials should provide up-to-date information covering security practices, employee security awareness, and personal safety, etc. |
| ESTABLISH STANDARDIZED ARMED AND UNARMED GUARD QUALIFICATIONS/ TRAINING REQUIREMENTS | Requirements for these positions should be standardized government wide. |
TENANT ASSIGNMENT
| Term | Definition/Description |
| CO-LOCATE AGENCIES WITH SIMILAR SECURITY NEEDS | To capitalize on efficiencies and economies, agencies with like security requirements should be located in the same facility if possible. |
| DO NOT CO-LOCATE HIGH/LOW RISK AGENCIES | Low risk agencies should not take on additional risk by being located with high risk agencies. |
ADMINISTRATIVE PROCEDURES
| Term | Definition/Description |
| ESTABLISH FLEXIBLE WORK SCHEDULE IN HIGH THREAT/HIGH RISK AREA TO MINIMIZE EMPLOYEE VULNERABLITY TO CRIMINAL ACTIVITY. | Flexible work schedules can enhance employee safety by staggering reporting and departure times. As an example flexible schedules might enable employees to park closer to the facility by reducing the demand for parking at peak times of the day. |
| ARRANGE FOR EMPLOYEE PARKING IN/NEAR BUILDING AFTER NORMAL WORK HOURS | Minimize exposure to criminal activity by allowing employees to park at or inside the building. |
| CONDUCT BACKGROUND SECURITY CHECKS AND/OR ESTABLISH SECURITY CONTROL PROCEDURES FOR SERVICE CONTRACT PERSONNEL | Establish procedures to ensure security where private contract personnel are concerned. Procedures may be as simple as observation or could include sign-in/escort. Frequent visitors may necessitate a background check with contractor ID issued. |
CONSTRUCTION/RENOVATION
| Term | Definition/Description |
| INSTALL MYLAR FILM ON ALL EXTERIOR WINDOWS (SHATTER PROTECTION) | Application of shatter resistant material to protect personnel and citizens from the hazards of flying glass as a result of impact or explosion. |
| REVIEW CURRENT PROJECTS FOR BLAST STANDARDS | Design and construction projects should be reviewed if possible, to incorporate current technology and blast standards. Immediate review of ongoing projects may generate savings in the implementation of upgrading to higher blast standards prior to completion of construction. |
| REVIEW/ESTABLISH UNIFORM STANDARDS FOR CONSTRUCTION | Review, establish, and implement uniform construction standards as it relates to security considerations. |
| REVIEW/ESTABLISH NEW DESIGN STANDARD FOR BLAST RESISTANCE | In smaller facilities or those that lease space, control over design standards may not be possible. However, future site selections should attempt to locate in facilities that do meet standards. New construction of government controlled facilities should review, establish, and implement new design standards for blast resistance. |
| ESTABLISH STREET SET-BACK FOR NEW CONSTRUCTION | Every foot between a potential bomb and a building will dramatically reduce damage and increase the survival rate. Street set-back is always desirable, but should be used in conjunction with barriers in Level IV and V facilities. |
| Vulnerability Assessment U.S. Department of Justice United States Marshals Service |
Appendix C Classification Table |
Excerpted from Appendix C:
| LEVEL | TYPICAL LOCATION |
| III | Agency Mix: Government Records |
