Title 36

PART 1234 APPENDIX A

Appendix A to Part 1234 - Minimum Security Standards for Level III Federal Facilities

36:3.0.10.2.22.4.5.4.21 : Appendix A

Appendix A to Part 1234 - Minimum Security Standards for Level III Federal Facilities

Recommended Standards Chart

[Reproduced from Section 2.3 (pp. 2-6 through 2-9) of U.S. Department of Justice, United States Marshals Service report Vulnerability Assessment of Federal Facilities]

	Level III
Perimeter Security
Parking:
Control of facility parking	Required.
Control of adjacent parking	Desirable.
Avoid leases where parking cannot be controlled	Desirable.
Leases should provide security control for adjacent parking	Desirable.
Post signs and arrange for towing unauthorized vehicles	Required.
ID system and procedures for authorized parking (placard, decal, card key, etc.)	Required.
Adequate lighting for parking areas	Required.
Closed Circuit Television (CCTV) Monitoring:
CCTV surveillance cameras with time lapse video recording	Recommended.
Post signs advising of 24 hour video surveillance	Recommended.
Lighting:
Lighting with emergency power backup	Required.
Physical Barriers:
Extend physical perimeter with barriers (concrete and/or steel composition)	Desirable.
Parking barriers	Desirable.
Entry Security
Receiving/Shipping:
Review receiving/shipping procedures (current)	Required.
Implement receiving/shipping procedures (modified)	Required.
Access Control:
Evaluate facility for security guard requirements	Required.
Security guard patrol	Recommended.
Intrusion detection system with central monitoring capability	Required.
Upgrade to current life safety standards (fire detection, fire suppression systems, etc.)	Required.
Entrances/Exits:
X-ray & magnetometer at public entrances	Recommended.
Require x-ray screening of all mail/packages	Recommended.
High security locks	Required.
Interior Security
Employee/Visitor Identification:
Agency photo ID for all personnel displayed at all times	Recommended.
Visitor control/screening system	Required.
Visitor identification accountability system	Recommended.
Establish ID issuing authority	Recommended.
Utilities:
Prevent unauthorized access to utility areas	Required.
Provide emergency power to critical systems (alarm systems, radio communications, computer facilities, etc.)	Required.
Occupant Emergency Plans:
Examine occupant emergency plans (OEP) and contingency procedures based on threats	Required.
OEPs in place, updated annually, periodic testing exercise	Required.
Assign & train OEP officials (assignment based on largest tenant in facility)	Required.
Annual tenant training	Required.
Daycare Centers:
Evaluate whether to locate daycare facilities in buildings with high threat activities	Required.
Compare feasibility of locating daycare in outside locations	Required.
Security Planning
Intelligence Sharing:
Establish law enforcement agency/security liaisons	Required.
Review/establish procedure for intelligence receipt/dissemination	Required.
Establish uniform security/threat nomenclature	Required.
Training:
Conduct annual security awareness training	Required.
Establish standardized unarmed guard qualifications/training requirements	Required.
Establish standardized armed guard qualifications/training requirements	Required.
Tenant Assignment:
Co-locate agencies with similar security needs	Desirable.
Do not co-locate high/low risk agencies	Desirable.
Administrative Procedures:
Establish flexible work schedule in high threat/high risk areas to minimize employee vulnerability to criminal activity	Desirable.
Arrange for employee parking in/near building after normal work hours	Recommended.
Conduct background security checks and/or establish security control procedures for service contract personnel	Required.
Construction/Renovation:
Install mylar film on all exterior windows (shatter protection)	Recommended.
Review current projects for blast standards	Required.
Review/establish uniform standards for construction	Required.
Review/establish new design standard for blast resistance	Required.
Establish street set-back for new construction	Recommended.

Term	Definition/description
B.1 Perimeter Security
Parking
Control of Facility Parking	Access to government parking should be limited where possible to government vehicles and personnel. At a minimum, authorized parking spaces and vehicles should be assigned and identified.
Control of Adjacent Parking	Where feasible, parking areas adjacent to federal space should also be controlled to reduce the potential for threats against Federal facilities and employee exposure to criminal activity.
Avoid Leases Where Parking Cannot Be Controlled	Avoid leasing facilities where parking cannot be controlled. If necessary, relocate offices to facilities that do provide added security through regulated parking.
Lease Should Provide Control for Adjacent Parking	Endeavor to negotiate guard services as part of lease.
Post Signs and Arrange for Towing Unauthorized Vehicles	Procedures should be established and implemented to alert the public to towing policies, and the removal of unauthorized vehicles.
ID System and Procedures for Authorized Parking	Procedures should be established for identifying vehicles and corresponding parking spaces (placard, decal, card key, etc.)
Adequate Lighting for Parking Areas	Effective lighting provides added safety for employees and deters illegal or threatening activities.
Closed circuit television (CCTV) monitoring
CCTV Surveillance Cameras With Time Lapse Video Recording	Twenty-four hour CCTV surveillance and recording is desirable at all locations as a deterrent. Requirements will depend on assessment of the security level for each facility. Time-lapse video recordings are also highly valuable as a source of evidence and investigative leads.
Post Signs Advising of 24 Hour Video Surveillance	Warning signs advising of twenty-four hour surveillance act as a deterrent in protecting employees and facilities.
Lighting
Lighting with Emergency Power Backup	Standard safety code requirement in virtually all areas. Provides for safe evacuation of buildings in case of natural disaster, power outage, or criminal/terrorist activity.
Physical Barriers
Extend Physical Perimeter, With Barriers	This security measure will only be possible in locations where the Government controls the property and where physical constraints are not present. (barriers of concrete and/or steel composition)
Parking Barriers	Desirable to prevent unauthorized vehicle access.
B.2 Entry Security
Receiving/Shipping
Review Receiving/Shipping Procedures (Current)	Audit current standards for package entry and suggest ways to enhance security.
Implement Receiving/Shipping Procedures (Modified)	After auditing procedures for receiving/shipping, implement improved procedures for security enhancements.
Access Control
Evaluate Facility for Security Guard Requirements	If security guards are required, the number of guards at any given time will depend on the size of the facility, the hours of operation, and current risk factors, etc.
Security Guard Patrol	Desirable for level I and II facilities and may be included as lease option. Level III, IV and V facilities will have security guard patrol based on facility evaluation.
Intrusion Detection System With Central Monitoring Capability	Desirable in Level I facilities, based on evaluation for Level II facilities, and required for Levels III, IV and V.
Upgrade to Current Life Safety Standards	Required for all facilities as part of GSA design requirements, (e.g. fire detection, fire suppression systems, etc.)
Entrances/Exits
X-Ray and Magnetometer at Public Entrances	May be impractical for Level I and II facilities. Level III and IV evaluations would focus on tenant agencies, public interface, and feasibility. Required for Level V.
Require X-Ray Screening of all Mail/Packages	All packages entering building should be subject to x-ray screening and/or visual inspection.
High Security Locks	Any exterior entrance should have a high security lock as determined by GSA specifications and/or agency requirements.
B.3 Interior Security
Employee/Visitor Identification
Agency Photo ID for all Personnel Displayed At All Times	May not be required in smaller facilities.
Visitor Control/Security System	Visitors should be readily apparent in Level I facilities. Other facilities may ask visitors to sign-in with a receptionist or guard, or require an escort, or formal identification/badge.
Visitor Id Accountability System	Stringent methods of control over visitor badges will ensure that visitors wearing badges have been screened and are authorized to be at the facility during the appropriate time frame.
Establish Id Issuing Authority	Develop procedures and establish authority for issuing employee and visitor IDs.
Utilities
Prevent Unauthorized Access to Utility Areas	Smaller facilities may not have control over utility access, or locations of utility areas. Where possible, assure that utility areas are secure and that only authorized personnel can gain entry.
Provide Emergency Power To Critical Systems	Tenant agency is responsible for determining which computer and communication systems require back-up power. All alarm systems, CCTV monitoring devices, fire detection systems, entry control devices, etc. require emergency power sources. (Alarm Systems, Radio Communications, Computer Facilities, Etc.)
Occupant Emergency Plans
Examine Occupant Emergency Plan (OEP) and Contingency Procedures Based on Threats	Review and update current OEP procedures for thoroughness. OEPs should reflect the current security climate.
Assign and Train OEP Officials	Assignment based on GSA requirement that largest tenant in facility maintain OEP responsibility. Officials should be assigned, trained and a contingency plan established to provide for the possible absence of OEP officials in the event of emergency activation of the OEP.
Annual Tenant Training	All tenants should be aware of their individual responsibilities in an emergency situation.
Day Care Center
Re-Evaluate Current Security and Safety Standards	Conduct a thorough review of security and safety standards.
Assess Feasibility of Locating Day Care Within Federal Facility	If a facility is being considered for a day care center, an evaluation should be made based on the risk factors associated with tenants and the location of the facility.
B.4 Security Planning
Intelligence Sharing
Establish Law Enforcement Agency/Security Liaisons	Intelligence sharing between law enforcement agencies and security organizations should be established in order to facilitate the accurate flow of timely and relevant information between appropriate government agencies. Agencies involved in providing security must be part of the complete intelligence process.
Review/Establish Procedures for Intelligence Receipt/Dissemination	Determine what procedures exist to ensure timely delivery of critical intelligence. Review and improve procedures to alert agencies and specific targets of criminal/terrorist threats. Establish standard administrative procedures for response to incoming alerts. Review flow of information for effectiveness and time critical dissemination.
Establish Uniform Security/Threat Nomenclature	To facilitate communication, standardized terminology for Alert Levels should be implemented. (Normal, Low, Moderate, and High - As recommended by Security Standards Committee)
Training
Conduct Annual Security Awareness Training	Provide security awareness training for all tenants. At a minimum, self-study programs utilizing videos, and literature, etc. should be implemented. These materials should provide up-to-date information covering security practices, employee security awareness, and personal safety, etc.
Establish Standardized Armed And Unarmed Guard Qualifications/Training Requirements	Requirements for these positions should be standardized government wide.
Tenant Assignment
Co-Locate Agencies With Similar Security Needs	To capitalize on efficiencies and economies, agencies with like security requirements should be located in the same facility if possible.
Do Not Co-Locate High/Low Risk Agencies	Low risk agencies should not take on additional risk by being located with high risk agencies.
Administrative Procedures
Establish Flexible Work Schedule in High Threat/High Risk Area to Minimize Employee Vulnerability to Criminal Activity	Flexible work schedules can enhance employee safety by staggering reporting and departure times. As an example flexible schedules might enable employees to park closer to the facility by reducing the demand for parking at peak times of the day.
Arrange for Employee Parking In/Near Building After Normal Work Hours	Minimize exposure to criminal activity by allowing employees to park at or inside the building.
Conduct Background Security Checks and/or Establish Security Control Procedures for Service Contract Personnel	Establish procedures to ensure security where private contract personnel are concerned. Procedures may be as simple as observation or could include sign-in/escort. Frequent visitors may necessitate a background check with contractor ID issued.
Construction/Renovation
Install Mylar Film on All Exterior Windows (Shatter Protection)	Application of shatter resistant material to protect personnel and citizens from the hazards of flying glass as a result of impact or explosion.
Review Current Projects For Blast Standards	Design and construction projects should be reviewed if possible, to incorporate current technology and blast standards. Immediate review of ongoing projects may generate savings in the implementation of upgrading to higher blast standards prior to completion of construction.
Review/Establish Uniform Standards For Construction	Review, establish, and implement uniform construction standards as it relates to security considerations.
Review/Establish New Design Standard for Blast RESISTANCE	In smaller facilities or those that lease space, control over design standards may not be possible. However, future site selections should attempt to locate in facilities that do meet standards. New construction of government controlled facilities should review, establish, and implement new design standards for blast resistance.
Establish Street Set-Back for New Construction	Every foot between a potential bomb and a building will dramatically reduce damage and increase the survival rate. Street set-back is always desirable, but should be used in conjunction with barriers in Level IV and V facilities.
(Reproduced from Appendix C, Classification Table, U.S. Department of Justice, United States Marshals Service report Vulnerability Assessment of Federal Facilities)
Level	Typical location
III	Agency Mix: Government Records.

Term

Definition/description

B.1 Perimeter Security

Parking

Control of Facility Parking

Access to government parking should be limited where possible to government vehicles and personnel. At a minimum, authorized parking spaces and vehicles should be assigned and identified.

Control of Adjacent Parking

Where feasible, parking areas adjacent to federal space should also be controlled to reduce the potential for threats against Federal facilities and employee exposure to criminal activity.

Avoid Leases Where Parking Cannot Be Controlled

Avoid leasing facilities where parking cannot be controlled. If necessary, relocate offices to facilities that do provide added security through regulated parking.

Lease Should Provide Control for Adjacent Parking

Endeavor to negotiate guard services as part of lease.

Post Signs and Arrange for Towing Unauthorized Vehicles

Procedures should be established and implemented to alert the public to towing policies, and the removal of unauthorized vehicles.

ID System and Procedures for Authorized Parking

Procedures should be established for identifying vehicles and corresponding parking spaces (placard, decal, card key, etc.)

Adequate Lighting for Parking Areas

Effective lighting provides added safety for employees and deters illegal or threatening activities.

Closed circuit television (CCTV) monitoring

CCTV Surveillance Cameras With Time Lapse Video Recording

Twenty-four hour CCTV surveillance and recording is desirable at all locations as a deterrent. Requirements will depend on assessment of the security level for each facility. Time-lapse video recordings are also highly valuable as a source of evidence and investigative leads.

Post Signs Advising of 24 Hour Video Surveillance

Warning signs advising of twenty-four hour surveillance act as a deterrent in protecting employees and facilities.

Lighting

Lighting with Emergency Power Backup

Standard safety code requirement in virtually all areas. Provides for safe evacuation of buildings in case of natural disaster, power outage, or criminal/terrorist activity.

Physical Barriers

Extend Physical Perimeter, With Barriers

This security measure will only be possible in locations where the Government controls the property and where physical constraints are not present. (barriers of concrete and/or steel composition)

Parking Barriers

Desirable to prevent unauthorized vehicle access.

B.2 Entry Security

Receiving/Shipping

Review Receiving/Shipping Procedures (Current)

Audit current standards for package entry and suggest ways to enhance security.

Implement Receiving/Shipping Procedures (Modified)

After auditing procedures for receiving/shipping, implement improved procedures for security enhancements.

Access Control

Evaluate Facility for Security Guard Requirements

If security guards are required, the number of guards at any given time will depend on the size of the facility, the hours of operation, and current risk factors, etc.

Security Guard Patrol

Desirable for level I and II facilities and may be included as lease option. Level III, IV and V facilities will have security guard patrol based on facility evaluation.

Intrusion Detection System With Central Monitoring Capability

Desirable in Level I facilities, based on evaluation for Level II facilities, and required for Levels III, IV and V.

Upgrade to Current Life Safety Standards

Required for all facilities as part of GSA design requirements, (e.g. fire detection, fire suppression systems, etc.)

Entrances/Exits

X-Ray and Magnetometer at Public Entrances

May be impractical for Level I and II facilities. Level III and IV evaluations would focus on tenant agencies, public interface, and feasibility. Required for Level V.

Require X-Ray Screening of all Mail/Packages

All packages entering building should be subject to x-ray screening and/or visual inspection.

High Security Locks

Any exterior entrance should have a high security lock as determined by GSA specifications and/or agency requirements.

B.3 Interior Security

Employee/Visitor Identification

Agency Photo ID for all Personnel Displayed At All Times

May not be required in smaller facilities.

Visitor Control/Security System

Visitors should be readily apparent in Level I facilities. Other facilities may ask visitors to sign-in with a receptionist or guard, or require an escort, or formal identification/badge.

Visitor Id Accountability System

Stringent methods of control over visitor badges will ensure that visitors wearing badges have been screened and are authorized to be at the facility during the appropriate time frame.

Establish Id Issuing Authority

Develop procedures and establish authority for issuing employee and visitor IDs.

Utilities

Prevent Unauthorized Access to Utility Areas

Smaller facilities may not have control over utility access, or locations of utility areas. Where possible, assure that utility areas are secure and that only authorized personnel can gain entry.

Provide Emergency Power To Critical Systems

Tenant agency is responsible for determining which computer and communication systems require back-up power. All alarm systems, CCTV monitoring devices, fire detection systems, entry control devices, etc. require emergency power sources. (Alarm Systems, Radio Communications, Computer Facilities, Etc.)

Occupant Emergency Plans

Examine Occupant Emergency Plan (OEP) and Contingency Procedures Based on Threats

Review and update current OEP procedures for thoroughness. OEPs should reflect the current security climate.

Assign and Train OEP Officials

Assignment based on GSA requirement that largest tenant in facility maintain OEP responsibility. Officials should be assigned, trained and a contingency plan established to provide for the possible absence of OEP officials in the event of emergency activation of the OEP.

Annual Tenant Training

All tenants should be aware of their individual responsibilities in an emergency situation.

Day Care Center

Re-Evaluate Current Security and Safety Standards

Conduct a thorough review of security and safety standards.

Assess Feasibility of Locating Day Care Within Federal Facility

If a facility is being considered for a day care center, an evaluation should be made based on the risk factors associated with tenants and the location of the facility.

B.4 Security Planning

Intelligence Sharing

Establish Law Enforcement Agency/Security Liaisons

Intelligence sharing between law enforcement agencies and security organizations should be established in order to facilitate the accurate flow of timely and relevant information between appropriate government agencies. Agencies involved in providing security must be part of the complete intelligence process.

Review/Establish Procedures for Intelligence Receipt/Dissemination

Determine what procedures exist to ensure timely delivery of critical intelligence. Review and improve procedures to alert agencies and specific targets of criminal/terrorist threats. Establish standard administrative procedures for response to incoming alerts. Review flow of information for effectiveness and time critical dissemination.

Establish Uniform Security/Threat Nomenclature

To facilitate communication, standardized terminology for Alert Levels should be implemented. (Normal, Low, Moderate, and High - As recommended by Security Standards Committee)

Training

Conduct Annual Security Awareness Training

Provide security awareness training for all tenants. At a minimum, self-study programs utilizing videos, and literature, etc. should be implemented. These materials should provide up-to-date information covering security practices, employee security awareness, and personal safety, etc.

Establish Standardized Armed And Unarmed Guard Qualifications/Training Requirements

Requirements for these positions should be standardized government wide.

Tenant Assignment

Co-Locate Agencies With Similar Security Needs

To capitalize on efficiencies and economies, agencies with like security requirements should be located in the same facility if possible.

Do Not Co-Locate High/Low Risk Agencies

Low risk agencies should not take on additional risk by being located with high risk agencies.

Administrative Procedures

Establish Flexible Work Schedule in High Threat/High Risk Area to Minimize Employee Vulnerability to Criminal Activity

Flexible work schedules can enhance employee safety by staggering reporting and departure times. As an example flexible schedules might enable employees to park closer to the facility by reducing the demand for parking at peak times of the day.

Arrange for Employee Parking In/Near Building After Normal Work Hours

Minimize exposure to criminal activity by allowing employees to park at or inside the building.

Conduct Background Security Checks and/or Establish Security Control Procedures for Service Contract Personnel

Establish procedures to ensure security where private contract personnel are concerned. Procedures may be as simple as observation or could include sign-in/escort. Frequent visitors may necessitate a background check with contractor ID issued.

Construction/Renovation

Install Mylar Film on All Exterior Windows (Shatter Protection)

Application of shatter resistant material to protect personnel and citizens from the hazards of flying glass as a result of impact or explosion.

Review Current Projects For Blast Standards

Design and construction projects should be reviewed if possible, to incorporate current technology and blast standards. Immediate review of ongoing projects may generate savings in the implementation of upgrading to higher blast standards prior to completion of construction.

Review/Establish Uniform Standards For Construction

Review, establish, and implement uniform construction standards as it relates to security considerations.

Review/Establish New Design Standard for Blast RESISTANCE

In smaller facilities or those that lease space, control over design standards may not be possible. However, future site selections should attempt to locate in facilities that do meet standards. New construction of government controlled facilities should review, establish, and implement new design standards for blast resistance.

Establish Street Set-Back for New Construction

Every foot between a potential bomb and a building will dramatically reduce damage and increase the survival rate. Street set-back is always desirable, but should be used in conjunction with barriers in Level IV and V facilities.

(Reproduced from Appendix C, Classification Table, U.S. Department of Justice, United States Marshals Service report Vulnerability Assessment of Federal Facilities)

Level

Typical location

III

Agency Mix: Government Records.