36 CFR Appendix A to Part 1234 - Minimum Security Standards for Level III Federal Facilities

Appendix A to Part 1234 - Minimum Security Standards for Level III Federal Facilities

Recommended Standards Chart

[Reproduced from Section 2.3 (pp. 2-6 through 2-9) of U.S. Department of Justice, United States Marshals Service report Vulnerability Assessment of Federal Facilities]

Level III
Perimeter Security
Control of facility parking Required.
Control of adjacent parking Desirable.
Avoid leases where parking cannot be controlled Desirable.
Leases should provide security control for adjacent parking Desirable.
Post signs and arrange for towing unauthorized vehicles Required.
ID system and procedures for authorized parking (placard, decal, card key, etc.) Required.
Adequate lighting for parking areas Required.
Closed Circuit Television (CCTV) Monitoring:
CCTV surveillance cameras with time lapse video recording Recommended.
Post signs advising of 24 hour video surveillance Recommended.
Lighting with emergency power backup Required.
Physical Barriers:
Extend physical perimeter with barriers (concrete and/or steel composition) Desirable.
Parking barriers Desirable.
Entry Security
Review receiving/shipping procedures (current) Required.
Implement receiving/shipping procedures (modified) Required.
Access Control:
Evaluate facility for security guard requirements Required.
Security guard patrol Recommended.
Intrusion detection system with central monitoring capability Required.
Upgrade to current life safety standards (fire detection, fire suppression systems, etc.) Required.
X-ray & magnetometer at public entrances Recommended.
Require x-ray screening of all mail/packages Recommended.
High security locks Required.
Interior Security
Employee/Visitor Identification:
Agency photo ID for all personnel displayed at all times Recommended.
Visitor control/screening system Required.
Visitor identification accountability system Recommended.
Establish ID issuing authority Recommended.
Prevent unauthorized access to utility areas Required.
Provide emergency power to critical systems (alarm systems, radio communications, computer facilities, etc.) Required.
Occupant Emergency Plans:
Examine occupant emergency plans (OEP) and contingency procedures based on threats Required.
OEPs in place, updated annually, periodic testing exercise Required.
Assign & train OEP officials (assignment based on largest tenant in facility) Required.
Annual tenant training Required.
Daycare Centers:
Evaluate whether to locate daycare facilities in buildings with high threat activities Required.
Compare feasibility of locating daycare in outside locations Required.
Security Planning
Intelligence Sharing:
Establish law enforcement agency/security liaisons Required.
Review/establish procedure for intelligence receipt/dissemination Required.
Establish uniform security/threat nomenclature Required.
Conduct annual security awareness training Required.
Establish standardized unarmed guard qualifications/training requirements Required.
Establish standardized armed guard qualifications/training requirements Required.
Tenant Assignment:
Co-locate agencies with similar security needs Desirable.
Do not co-locate high/low risk agencies Desirable.
Administrative Procedures:
Establish flexible work schedule in high threat/high risk areas to minimize employee vulnerability to criminal activity Desirable.
Arrange for employee parking in/near building after normal work hours Recommended.
Conduct background security checks and/or establish security control procedures for service contract personnel Required.
Install mylar film on all exterior windows (shatter protection) Recommended.
Review current projects for blast standards Required.
Review/establish uniform standards for construction Required.
Review/establish new design standard for blast resistance Required.
Establish street set-back for new construction Recommended.

Terms and Definitions in Recommended Standards Chart

[Reproduced from Appendix B, Details of Recommended Security Standards, U.S. Department of Justice, United States Marshals Service report Vulnerability Assessment of Federal Facilities]

Term Definition/description
B.1 Perimeter Security
Control of Facility Parking Access to government parking should be limited where possible to government vehicles and personnel. At a minimum, authorized parking spaces and vehicles should be assigned and identified.
Control of Adjacent Parking Where feasible, parking areas adjacent to federal space should also be controlled to reduce the potential for threats against Federal facilities and employee exposure to criminal activity.
Avoid Leases Where Parking Cannot Be Controlled Avoid leasing facilities where parking cannot be controlled. If necessary, relocate offices to facilities that do provide added security through regulated parking.
Lease Should Provide Control for Adjacent Parking Endeavor to negotiate guard services as part of lease.
Post Signs and Arrange for Towing Unauthorized Vehicles Procedures should be established and implemented to alert the public to towing policies, and the removal of unauthorized vehicles.
ID System and Procedures for Authorized Parking Procedures should be established for identifying vehicles and corresponding parking spaces (placard, decal, card key, etc.)
Adequate Lighting for Parking Areas Effective lighting provides added safety for employees and deters illegal or threatening activities.
Closed circuit television (CCTV) monitoring
CCTV Surveillance Cameras With Time Lapse Video Recording Twenty-four hour CCTV surveillance and recording is desirable at all locations as a deterrent. Requirements will depend on assessment of the security level for each facility. Time-lapse video recordings are also highly valuable as a source of evidence and investigative leads.
Post Signs Advising of 24 Hour Video Surveillance Warning signs advising of twenty-four hour surveillance act as a deterrent in protecting employees and facilities.
Lighting with Emergency Power Backup Standard safety code requirement in virtually all areas. Provides for safe evacuation of buildings in case of natural disaster, power outage, or criminal/terrorist activity.
Physical Barriers
Extend Physical Perimeter, With Barriers This security measure will only be possible in locations where the Government controls the property and where physical constraints are not present. (barriers of concrete and/or steel composition)
Parking Barriers Desirable to prevent unauthorized vehicle access.
B.2 Entry Security
Review Receiving/Shipping Procedures (Current) Audit current standards for package entry and suggest ways to enhance security.
Implement Receiving/Shipping Procedures (Modified) After auditing procedures for receiving/shipping, implement improved procedures for security enhancements.
Access Control
Evaluate Facility for Security Guard Requirements If security guards are required, the number of guards at any given time will depend on the size of the facility, the hours of operation, and current risk factors, etc.
Security Guard Patrol Desirable for level I and II facilities and may be included as lease option. Level III, IV and V facilities will have security guard patrol based on facility evaluation.
Intrusion Detection System With Central Monitoring Capability Desirable in Level I facilities, based on evaluation for Level II facilities, and required for Levels III, IV and V.
Upgrade to Current Life Safety Standards Required for all facilities as part of GSA design requirements, (e.g. fire detection, fire suppression systems, etc.)
X-Ray and Magnetometer at Public Entrances May be impractical for Level I and II facilities. Level III and IV evaluations would focus on tenant agencies, public interface, and feasibility. Required for Level V.
Require X-Ray Screening of all Mail/Packages All packages entering building should be subject to x-ray screening and/or visual inspection.
High Security Locks Any exterior entrance should have a high security lock as determined by GSA specifications and/or agency requirements.
B.3 Interior Security
Employee/Visitor Identification
Agency Photo ID for all Personnel Displayed At All Times May not be required in smaller facilities.
Visitor Control/Security System Visitors should be readily apparent in Level I facilities. Other facilities may ask visitors to sign-in with a receptionist or guard, or require an escort, or formal identification/badge.
Visitor Id Accountability System Stringent methods of control over visitor badges will ensure that visitors wearing badges have been screened and are authorized to be at the facility during the appropriate time frame.
Establish Id Issuing Authority Develop procedures and establish authority for issuing employee and visitor IDs.
Prevent Unauthorized Access to Utility Areas Smaller facilities may not have control over utility access, or locations of utility areas. Where possible, assure that utility areas are secure and that only authorized personnel can gain entry.
Provide Emergency Power To Critical Systems Tenant agency is responsible for determining which computer and communication systems require back-up power. All alarm systems, CCTV monitoring devices, fire detection systems, entry control devices, etc. require emergency power sources. (Alarm Systems, Radio Communications, Computer Facilities, Etc.)
Occupant Emergency Plans
Examine Occupant Emergency Plan (OEP) and Contingency Procedures Based on Threats Review and update current OEP procedures for thoroughness. OEPs should reflect the current security climate.
Assign and Train OEP Officials Assignment based on GSA requirement that largest tenant in facility maintain OEP responsibility. Officials should be assigned, trained and a contingency plan established to provide for the possible absence of OEP officials in the event of emergency activation of the OEP.
Annual Tenant Training All tenants should be aware of their individual responsibilities in an emergency situation.
Day Care Center
Re-Evaluate Current Security and Safety Standards Conduct a thorough review of security and safety standards.
Assess Feasibility of Locating Day Care Within Federal Facility If a facility is being considered for a day care center, an evaluation should be made based on the risk factors associated with tenants and the location of the facility.
B.4 Security Planning
Intelligence Sharing
Establish Law Enforcement Agency/Security Liaisons Intelligence sharing between law enforcement agencies and security organizations should be established in order to facilitate the accurate flow of timely and relevant information between appropriate government agencies. Agencies involved in providing security must be part of the complete intelligence process.
Review/Establish Procedures for Intelligence Receipt/Dissemination Determine what procedures exist to ensure timely delivery of critical intelligence. Review and improve procedures to alert agencies and specific targets of criminal/terrorist threats. Establish standard administrative procedures for response to incoming alerts. Review flow of information for effectiveness and time critical dissemination.
Establish Uniform Security/Threat Nomenclature To facilitate communication, standardized terminology for Alert Levels should be implemented. (Normal, Low, Moderate, and High - As recommended by Security Standards Committee)
Conduct Annual Security Awareness Training Provide security awareness training for all tenants. At a minimum, self-study programs utilizing videos, and literature, etc. should be implemented. These materials should provide up-to-date information covering security practices, employee security awareness, and personal safety, etc.
Establish Standardized Armed And Unarmed Guard Qualifications/Training Requirements Requirements for these positions should be standardized government wide.
Tenant Assignment
Co-Locate Agencies With Similar Security Needs To capitalize on efficiencies and economies, agencies with like security requirements should be located in the same facility if possible.
Do Not Co-Locate High/Low Risk Agencies Low risk agencies should not take on additional risk by being located with high risk agencies.
Administrative Procedures
Establish Flexible Work Schedule in High Threat/High Risk Area to Minimize Employee Vulnerability to Criminal Activity Flexible work schedules can enhance employee safety by staggering reporting and departure times. As an example flexible schedules might enable employees to park closer to the facility by reducing the demand for parking at peak times of the day.
Arrange for Employee Parking In/Near Building After Normal Work Hours Minimize exposure to criminal activity by allowing employees to park at or inside the building.
Conduct Background Security Checks and/or Establish Security Control Procedures for Service Contract Personnel Establish procedures to ensure security where private contract personnel are concerned. Procedures may be as simple as observation or could include sign-in/escort. Frequent visitors may necessitate a background check with contractor ID issued.
Install Mylar Film on All Exterior Windows (Shatter Protection) Application of shatter resistant material to protect personnel and citizens from the hazards of flying glass as a result of impact or explosion.
Review Current Projects For Blast Standards Design and construction projects should be reviewed if possible, to incorporate current technology and blast standards. Immediate review of ongoing projects may generate savings in the implementation of upgrading to higher blast standards prior to completion of construction.
Review/Establish Uniform Standards For Construction Review, establish, and implement uniform construction standards as it relates to security considerations.
Review/Establish New Design Standard for Blast RESISTANCE In smaller facilities or those that lease space, control over design standards may not be possible. However, future site selections should attempt to locate in facilities that do meet standards. New construction of government controlled facilities should review, establish, and implement new design standards for blast resistance.
Establish Street Set-Back for New Construction Every foot between a potential bomb and a building will dramatically reduce damage and increase the survival rate. Street set-back is always desirable, but should be used in conjunction with barriers in Level IV and V facilities.
(Reproduced from Appendix C, Classification Table, U.S. Department of Justice, United States Marshals Service report Vulnerability Assessment of Federal Facilities)
Level Typical location
III Agency Mix: Government Records.