Doc:DoD 5220.22-M Chapter 5

From FISMApedia
Jump to: navigation, search

CHAPTER 5

Safeguarding Classified Information



Section 1. General Safeguarding Requirements

5-100 General
  Contractors shall be responsible for safeguarding classified information in their custody or under their control. Individuals are responsible for safeguarding classified information entrusted to them. The extent of protection afforded classified information shall be sufficient to reasonably foreclose the possibility of its loss or compromise.
5-101 Safeguarding Oral Discussions
  Contractors shall ensure that all cleared personnel are aware of the prohibition against discussing classified information over unsecured telephones, in public conveyances or places, or in any other manner that permits interception by unauthorized persons.
5-102 End of Day Security Checks
 

a. Contractors that store classified material shall establish a system of security checks at the close of each working day to ensure that all classified material and security repositories have been appropriately secured.
b. Contractors that operate multiple work shifts shall perform the security checks at the end of the last working shift in which classified material was removed from storage for use. The checks are not required during continuous 24-hour operations.
5-103 Perimeter Controls
  Contractors authorized to store classified material shall establish and maintain a system to deter and detect unauthorized introduction or removal of classified material from their facility. The objective is to discourage the introduction or removal of classified material without proper authority. If the unauthorized introduction or removal of classified material can be reasonably foreclosed through technical means, which are encouraged, no further controls are necessary. Personnel who have a legitimate need to remove or transport classified material should be provided appropriate authorization for passing through designated entry/exit points. The fact that persons who enter or depart the facility are subject to an inspection of their personal effects shall be conspicuously posted at all pertinent entries and exits.
a. All persons who enter or exit the facility shall be subject to an inspection of their personal effects, except under circumstances where the possibility of access to classified material is remote. Inspections shall be limited to buildings or areas where classified work is being performed. Inspections are not required of wallets, change purses, clothing, cosmetics cases, or other objects of an unusually personal nature.
b. The extent, frequency, and location of inspections shall be accomplished in a manner consistent with contractual obligations and operational efficiency. Inspections may be done using any appropriate random sampling technique. Contractors are encouraged to seek legal advice during the formulation of implementing procedures and to surface significant problems to the CSA.
5-104 Emergency Procedures
  Contractors shall develop procedures for safeguarding classified material in emergency situations. The procedures shall be as simple and practical as possible and should be adaptable to any type of emergency that may reasonably arise. Contractors shall promptly report to the CSA any emergency situation that renders the facility incapable of safeguarding classified material.


Section 2. Control and Accountability

5-200 Policy
  Contractors shall establish an information management system to protect and control the classified information in their possession. Contractors shall ensure that classified information in their custody is used or retained only for a lawful and authorized U.S. Government purpose. The U.S. Government reserves the right to retrieve its classified material or to cause appropriate disposition of the material by the contractor. The information management system employed by the contractor shall be capable of facilitating such retrieval and disposition in a reasonable period of time.
5-201 Accountability for TOP SECRET
 

a. TOP SECRET control officials shall be designated to receive, transmit, and maintain access and accountability records for TOP SECRET information. An inventory shall be conducted annually unless written relief is granted by the GCA.
b. The transmittal of TOP SECRET information shall be covered by a continuous receipt system both within and outside the facility.
c. Each item of TOP SECRET material shall be numbered in series. The copy number shall be placed on TOP SECRET documents and on all associated transaction documents.
5-202 Receiving Classified Material
  Procedures shall be established to ensure that classified material, regardless of delivery method, is received directly by authorized personnel. The material shall be examined for evidence of tampering and the classified contents shall be checked against the receipt. Discrepancies in the contents of a package or absence of a receipt for TOP SECRET and SECRET material shall be reported promptly to the sender. If the shipment is in order, the receipt shall be signed and returned to the sender. If a receipt is included with CONFIDENTIAL material, it shall be signed and returned to the sender.
5-203 Generation of Classified Material
 

a. A record of TOP SECRET material produced by the contractor shall be made when the material is: (1) completed as a finished document, (2) retained for more than 30 days after creation, regardless of the stage of development, or (3) transmitted outside the facility.
b. Classified working papers generated by the contractor in the preparation of a finished document shall be: (1) dated when created, (2) marked with its overall classification and with the annotation “WORKING PAPERS”, and (3) destroyed when no longer needed. Working papers shall be marked in the same manner prescribed for a finished document at the same classification level when: (1) transmitted outside the facility, or (2) retained for more than 30 days from creation for TOP SECRET, or 180 days from creation for SECRET and CONFIDENTIAL material.


Section 3. Storage and Storage Equipment

5-300 General
  This section describes the uniform requirements for the physical protection of classified material in the custody of contractors. Where these requirements are not appropriate for protecting specific types or forms of classified material, compensatory provisions shall be developed and approved by the CSA. Nothing in this manual shall be construed to contradict or inhibit compliance with the law or building codes. Cognizant security officials shall work to meet appropriate security needs according to the intent of this manual and at acceptable cost
5-301 GSA Storage Equipment
  GSA establishes and publishes uniform standards, specifications, and supply schedules for units and key-operated and combination padlocks suitable for the storage and protection of classified information. Manufacturers and prices of storage equipment approved by the GSA are listed in the Federal Supply Schedule (P55) catalog (FSC GROUP 71-Pan II). Copies of specifications and schedules may be obtained from any regional office of the GSA.
5-302 TOP SECRET Storage
  TOP SECRET material shall be stored in a GSA-approved security container, an approved vault, or an approved closed area with supplemental controls.
5-303 SECRET Storage
  SECRET material shall be stored in a GSA-approved security container, an approved vault, or closed area. Supplemental controls are required for storage in closed areas. The following additional storage methods may be used until October 1, 2012:
a. A safe, steel file cabinet, or safe-type steel file container that has an automatic unit locking mechanism. All such receptacles will be accorded supplemental protection during non-working hours.
b. Any steel file cabinet that has four sides and a top and bottom (all permanently attached by welding, rivets or peened bolts so the contents cannot be removed without leaving visible evidence of entry) and is secured by a rigid metal lock bar and an approved key operated or combination padlock. The keepers of the rigid metal lock bar shall be secured to the cabinet by welding, rivets, or bolts so they cannot be removed and replaced without leaving evidence of the entry. The drawers of the container shall be held securely so their contents cannot be removed without forcing open the drawer. This type of cabinet will be accorded supplemental protection during non-working hours.
5-304 CONFIDENTIAL Storage
  CONFIDENTIAL material shall be stored in the same manner as TOP SECRET or SECRET material except that no supplemental protection is required.
5-305 Restricted Areas
  When it is necessary to control access to classified material in an open area during working hours, a restricted area may be established. A restricted area will normally become necessary when it is impractical or impossible to protect classified material because of its size, quantity or other unusual characteristic. The restricted area shall have a clearly defined perimeter, but physical barriers are not required. Personnel within the area shall be responsible for challenging all persons who may lack appropriate access authority. All classified material will be secured during non-working hours in approved repositories or secured using other methods approved by the CSA.
5-306 Closed Areas
  Due to the size and nature of the classified material, or for operational necessity, it may be necessary to construct closed areas for storage because GSA-approved containers or vaults are unsuitable or impractical. Closed areas must be constructed in accordance with section 8 of this chapter. Access to closed areas must be controlled to preclude unauthorized access. This may be accomplished through the use of a cleared person or by a supplanting access control device or system. Access shall be limited to authorized persons who have an appropriate security clearance and a need-to-know for the classified material/information within the area. Persons without the appropriate level of clearance and/or need to know shall be escorted at all times by an authorized person where inadvertent or unauthorized exposure to classified information cannot otherwise be effectively prevented. Closed areas storing TOP SECRET and SECRET material shall be accorded supplemental protection during non-working hours. During non-working hours and during working hours when the area is unattended, admittance to the area shall be controlled by locked entrances and exits secured by either an approved built-in combination lock or an approved combination or key-operated padlock. It is not necessary to activate the supplemental controls during working hours. Doors secured from the inside with a panic bolt (for example, actuated by a panic bar, a dead bolt, a rigid wood or metal bar) or other means approved by the CSA, will not require additional locking devices.
a. Contractors shall develop and implement procedures to ensure the structural integrity of closed areas above false ceilings and below raised floors.
b. Open shelf or bin storage of SECRET and CONFIDENTIAL documents in closed areas requires CSA approval. For SECRET material only areas protected by an approved Intrusion Detection System (IDS) will qualify for such approval. Open shelf or bin storage of TOP SECRET documents is not permitted.
c. The CSA and the contractor shall agree on the need to establish, and the extent of, closed areas prior to the award of the contract, when possible, or when the need for such areas becomes apparent during contract performance.
d. The CSA may grant self-approval authority to the FSO for closed area approvals provided the FSO meets specified qualification criteria as determined by the CSA.
5-307 Supplemental Protection
 

a. IDS as described in section 9 of this Chapter shall be used as supplemental protection.
b. Security guards approved as supplemental protection prior to January 1, 1995, may continue to be utilized. When guards are authorized, the sched¬ule of patrol is 2 hours for TOP SECRET material and 4 hours for SECRET material.
c. GSA-approved security containers and approved vaults secured with a locking mechanism meeting Federal Specification FF-L-2740 do not require supplemental protection when the CSA has determined that the GSA-approved security container or approved vault is located in an area of the facility with security-in-depth.
5-308 Protection of Combinations to Security Containers, Cabinets, Vaults and Closed Areas
  Only a minimum number of authorized persons shall have knowledge of combinations to authorized storage containers. Containers shall bear no external markings indicating the level of classified material authorized for storage.
a. A record of the names of persons having knowledge of the combination shall be maintained.
b. Security containers, vaults, cabinets, and other authorized storage containers shall be kept locked when not under the direct supervision of an authorized person entrusted with the contents.
c. The combination shall be safeguarded in accordance with the highest classification of the material authorized for storage in the container.
d. If a record is made of a combination, the record shall be marked with the highest classification of material authorized for storage in the container.
5-309 Changing Combinations
  Combinations shall be changed by a person authorized access to the contents of the container, or by the FSO or his or her designee. Combinations shall be changed as follows:
a. The initial use of an approved container or lock for the protection of classified material.
b. The termination of employment of any person hav¬ing knowledge of the combination, or when the clearance granted to any such person has been with¬drawn, suspended, or revoked.
c. The compromise or suspected compromise of a container or its combination, or discovery of a container left unlocked and unattended.
d. At other times when considered necessary by the FSO or CSA.
5-310 Supervision of Keys and Padlocks
  Use of key-operated padlocks are subject to the following require¬ments: (i) a key and lock custodian shall be appointed to ensure proper custody and handling of keys and locks used for protection of classified material; (ii) a key and lock control register shall be maintained to identify keys for each lock and their current location and custody; (iii) keys and locks shall be audited each month; (iv) keys shall be inventoried with each change of custody; (v) keys shall not be removed from the premises; (vi) keys and spare locks shall be protected equivalent to the level of classified material involved; (vii) locks shall be changed or rotated at least annually and shall be replaced after loss or compromise of their operable keys; and (viii) making master keys is prohibited.
5-311 Repair of Approved Containers
  Repairs, maintenance, or other actions that affect the physical integrity of a security container approved for storage of classified information shall be accomplished only by appropriately cleared or continuously escorted person¬nel specifically trained in approved methods of maintenance and repair of containers. Repair procedures may be obtained from the CSA.
a. An approved security container is considered to have been restored to its original state of security integrity if all damaged or altered parts are replaced with manufacturer’s replacement or identical cannibalized parts. A signed and dated certification for each repaired container, pro¬vided by the repairer, shall be on file setting forth the method of repair used.
b. A container repaired using other than approved methods may be used for storage of SECRET material with supplemental controls only until October 1, 2012.
5-312 Supplanting Access Control Systems or Devices
  Automated access control systems and electronic, mechanical, or electromechanical devices which meet the criteria stated in paragraphs 5-313 and 5-314, below, may be used to supplant contractor-authorized personnel or guards to control admittance to closed areas during working hours. Approval of the FSO is required before effecting the installation of a supplanting access control device to meet a requirement of this Manual.
5-313 Automated Access Control Systems
  The automated access control system must be capable of identifying the individual entering the area and authenticating that person’s authority to enter the area.
a. Manufacturers of automated access control equip¬ment or devices must assure in writing that their sys¬tem will meet the following standards before FSOs may favorably consider such systems for protection of classified information:
(1) Chances of an unauthorized individual gaining access through normal operation of the equipment are no more than one in ten thousand.
(2) Chances of an authorized individual being rejected for access through normal operation of the equipment are no more than one in one thousand.
b. Identification of individuals entering the area can be obtained by an identification (ID) badge or card, or by personal identity.
(1) The ID badge or card must use embedded sen¬sors, integrated circuits, magnetic stripes or other means of encoding data that identifies the facility and the individual to whom the card is issued.
(2) Personal identity verification identifies the individual requesting access by some unique personal characteristic, such as, (a) fingerprint, (b) hand geometry, (c) handwriting. (d) retina, or (e) voice recognition.
c. In conjunction with an ID badge or card or personal identity verification, a personal identification number (PIN) is required. The PIN must be separately entered into the system by each individual using a keypad device. The PIN shall consist of four or more digits, randomly selected with no known or logical association with the individual. The PIN must be changed when it is believed to have been subjected to compromise.
d. Authentication of the individual’s authorization to enter the area must be accomplished within the system by comparing the inputs from the ID badge or card or the personal identity verification device and the keypad with an electronic database of individuals authorized into the area. A procedure must be established for removal of the individual’s authorization to enter the area upon reassignment, transfer or termination, or when the individual’s PCL is suspended or revoked.
e. Locations where access transactions are, or can be displayed, and where authorization data, card encoded data and personal identification or verification data is input, stored, displayed, or recorded must be protected.
f. Control panels, card readers, keypads, communication or interface devices located outside the entrance to a closed area shall have tamper-resistant enclosures, be securely fastened to a wall or other structure, be protected by a tamper alarm, or secured with an approved combination padlock. Control panels located within a closed area shall require only a minimal degree of physical security protection sufficient to preclude unauthorized access to the mechanism. Where areas containing TOP SECRET information are involved, tamper alarm protection is mandatory.
g. Systems that utilize transmission lines to carry access authorization, personal identification, or verification data between devices/equipment located outside the closed area shall receive circuit protection equal to or greater than that specified as Grade A by Underwriters Laboratories (UL).
h. Access to records and information concerning encoded ID data and PINs shall be restricted to individuals cleared at the same level as the highest classified information contained within the specific area or areas in which ID data or PINs are utilized. Access to identification or authorization data, operating system software or any identifying data associated with the access control system shall be limited to the least number of personnel possible. Such data or software shall be kept secured when unattended.
i. Records reflecting active assignments of ID badges/cards, PINs, levels of access, and similar system-related records shall be maintained. Records concerning personnel removed from the system shall be retained for 90 days.
j. Personnel entering or leaving an area shall be required to immediately secure the entrance or exit point. Authorized personnel who permit another individual entrance into the area are responsible for confirming the individual’s PCL and need-to-know. During shift changes and emergency situations, if the door remains open, admittance shall be controlled by a contractor-authorized person or guard stationed to supervise the entrance to the area.
5-314 Electronic, Mechanical, or Electro-mechanical Devices
  Provided the classified material within the closed area is no higher than SECRET, electronic, mechanical, or electro-mechanical devices that meet the criteria below may be used to supplant contractor authorized personnel or guards to control admittance to closed areas during working hours. Devices may be used that operate by either a push-button combination that activates the locking device or by a control card used in conjunction with a push-button combination, thereby excluding any system that operates solely by the use of a control card.
a. The electronic control panel containing the mechanism by which the combination is set may be located inside or outside the closed area. When located outside the closed area, the control panel shall be securely fastened or attached to the perimeter barrier of the area and secured by an approved combination padlock. If the control panel is located within the closed area, it shall require only a minimal degree of physical security designed to preclude unauthorized access to the mechanism.
b. The control panel shall be installed in a manner that precludes an unauthorized person in the immediate vicinity from observing the selection of the correct combination of the push buttons, or have a shielding device mounted.
c. The selection and setting of the combination shall be accomplished by an employee of the contractor who is authorized to enter the area. The combination shall be changed as specified in paragraph 5-309. The combination shall be classified and safeguarded in accordance with the classification of the highest classified material within the closed area.
d. Electrical gear, wiring included, or mechanical links (cables, rods, etc.) shall be accessible only from inside the area, or shall be secured within a protective covering to preclude surreptitious manipulation of components.
e. Personnel entering or leaving the area shall be required to secure the entrance or exit point immediately. Authorized personnel who permit another individual entrance into the area are responsible for confirming the individual’s PCL and need-to-know. During shift changes and emergency situations, if the door remains open, admittance shall be controlled by a contractor-authorized person or guard stationed to supervise the entrance to the area.


Section 4. Transmission

5-400 General
  Classified material shall be transmitted outside the contractor's facility in a manner that prevents loss or unauthorized access.
5-401 Preparation and Receipting
 

a. Classified information to be transmitted outside of a facility shall be enclosed in opaque inner and outer covers. The inner cover shall be a sealed wrapper or envelope plainly marked with the assigned classification and addresses of both sender and addressee. The outer cover shall be sealed and addressed with no identification of the classification of its contents. A receipt shall be attached to or enclosed in the inner cover, except that CONFIDENTIAL information shall require a receipt only if the sender deems it necessary. The receipt shall identify the sender, the addressee and the document, but shall contain no classified information. It shall be signed by the recipient and returned to the sender.
b. A suspense system will be established to track transmitted documents until a signed copy of the receipt is returned.
c. When the material is of a size, weight, or nature that precludes the use of envelopes, the materials used for packaging shall be of such strength and durability to ensure the necessary protection while the material is in transit.
5-402 TOP SECRET Transmission Outside a Facility
  Written authorization of the GCA is required to transmit TOP SECRET information outside of the facility. TOP SECRET material may be transmitted by the following methods within and directly between the United States and its territorial areas.
a. The Defense Courier Service, if authorized by the GCA.
b. A designated courier or escort cleared for access to TOP SECRET information.
c. By electrical means over CSA-approved secured communications security circuits, provided such transmission conforms with this Manual, the telecommunications security provisions of the contract, or as otherwise authorized by the GCA.
5-403 SECRET Transmission Outside a Facility
  SECRET material may be transmitted by one of the following methods within and directly between the United States and its territorial areas:
a. By the methods established for TOP SECRET.
b. U.S. Postal Service Express Mail and U.S. Postal Service Registered Mail. NOTE: The "Waiver of Signature and Indemnity" block on the U.S. Postal Service Express Mail Label 11-B may not be executed and the use of external (street side) express mail collection boxes is prohibited.
c. A cleared commercial carrier.
d. A cleared commercial messenger service engaged in the intracity/local area delivery (same day delivery only) of classified material.
e. A commercial delivery company, approved by the CSA, that provides nation-wide, overnight service with computer tracking and reporting features. Such companies need not be security cleared.
f. Other methods as directed in writing by the GCA.
5-404 CONFIDENTIAL Transmission Outside a Facility
  CONFIDENTIAL material shall be transmitted by the methods established for SECRET material, except that a commercial carrier does not have to be cleared, or by U.S. Postal Service Certified Mail.
5-405 Transmission Outside the United States and Its Territorial Areas
  Classified material may be transmitted to a U.S. Government activity outside the United States or a U.S. territory only under the provisions of a classified contract or with the written authorization of the GCA.
a. TOP SECRET material may be transmitted by the Defense Courier Service, Department of State Courier System, or a courier service authorized by the GCA.
b. SECRET and CONFIDENTIAL material may be transmitted by: (1) registered mail through U.S. Army, Navy, or Air Force postal facilities; (2) by an appropriately cleared contractor employee; (3) by a U.S. civil service employee or military person, who has been designated by the GCA; (4) by U.S. and Canadian registered mail with registered mail receipt to and from Canada and via a U.S. or a Canadian government activity; or (5) as authorized by the GCA.
5-406 Addressing Classified Material
  Mail or shipments containing classified material shall be addressed to the Commander or approved classified mailing address of a Federal activity or to a cleared contractor using the name and classified mailing address of the facility. An individual's name shall not appear on the outer cover. This does not prevent the use of office code letters, numbers, or phrases in an attention line to aid in internal routing.
a. When it is necessary to direct SECRET or CONFIDENTIAL material to the attention of a particular individual, other than as prescribed below, the identity of the intended recipient shall be indicated on an attention line placed in the letter of transmittal or on the inner container or wrapper.
b. When addressing SECRET or CONFIDENTIAL material to an individual operating as an independent consultant, or to any facility at which only one employee is assigned, the outer container shall specify: "TO BE OPENED BY ADDRESSEE ONLY" and be annotated: "POSTMASTER-DO NOT FORWARD. IF UNDELIVERABLE TO ADDRESSEE, RETURN TO SENDER."
5-407 Transmission Within a Facility
  Classified material may be transmitted within a facility without single or double-wrapping provided adequate measures are taken to protect the material against unauthorized disclosure.
5-408 SECRET Transmission by Commercial Carrier
  SECRET material may be shipped by a cleared commercial carrier that has been approved by the CSA to transport SECRET shipments. Commercial carriers may be used only within and between the 48 contiguous States and the District of Columbia or wholly within Alaska, Hawaii, or a U.S. territory. When the services of a commercial carrier are required, the contractor, as consignor, shall be responsible for the following:
a. The material shall be prepared for transmission to afford additional protection against pilferage, theft, and compromise as follows.
(1) The material shall be shipped in hardened containers unless specifically authorized otherwise by the contracting agency.
(2) Carrier equipment shall be sealed by the contractor or a representative of the carrier when there is a full carload, a full truckload, exclusive use of the vehicle, or when a closed and locked compartment of the carrier's equipment is used. The seals shall be numbered and the numbers indicated on all copies of the bill of lading (BL). When seals are used, the BL shall be annotated substantially as follows: DO NOT BREAK SEALS EXCEPT IN CASE OF EMERGENCY OR UPON PRIOR AUTHORITY OF THE CONSIGNOR OR CONSIGNEE. IF FOUND BROKEN OR IF BROKEN FOR EMERGENCY REASONS, APPLY CARRIER'S SEALS AS SOON AS POSSIBLE AND IMMEDIATELY NOTIFY BOTH THE CONSIGNOR AND THE CONSIGNEE.
(3) For DoD contractors the notation "Protective Security Service Required" shall be reflected on all copies of the BL. The BL will be maintained in a suspense file to follow-up on overdue or delayed shipments.
b. The contractor shall utilize a qualified carrier selected by the U.S. Government that will provide a single-line service from point of origin to destination, when such service is available, or by such transshipping procedures as may be specified by the U.S. Government.
c. The contractor shall request routing instructions, including designation of a qualified carrier, from the GCA or designated representative (normally the government transportation officer). The request shall specify that the routing instructions are required for the shipment of SECRET material and include the point of origin and point of destination.
d. The contractor shall notify the consignee (including U.S. Government transshipping activity) of the nature of the shipment, the means of the shipment, numbers of the seals, if used, and the anticipated time and date of arrival by separate communication at least 24 hours in advance (or immediately on dispatch if transit time is less than 24 hours) of the arrival of the shipment. This notification shall be addressed to the appropriate organizational entity and not to an individual. Request that the consignee activity (including a military transshipping activity) notify the consignor of any shipment not received within 48 hours after the estimated time of arrival indicated by the consignor.
e. In addition, the contractor shall annotate the BL: "CARRIER TO NOTIFY THE CONSIGNOR AND CONSIGNEE (Telephone Numbers) IMMEDIATELY IF SHIPMENT IS DELAYED BECAUSE OF AN ACCIDENT OR INCIDENT. IF NEITHER CAN BE REACHED, CONTACT (Enter appropriate HOTLINE Number). USE HOTLINE NUMBER TO OBTAIN SAFE HAVEN OR REFUGE INSTRUCTIONS IN THE EVENT OF A CIVIL DISORDER, NATURAL DISASTER, CARRIER STRIKE OR OTHER EMERGENCY."
5-409 CONFIDENTIAL Transmission by Commercial Carrier
  CONFIDENTIAL material may be shipped by a CSA or GCA-approved commercial carrier. For DoD contractors a commercial carrier authorized by law, regulatory body, or regulation to provide the required transportation service shall be used when a determination has been made by the Surface Deployment and Distribution Command (SDDC) (formerly known as the Military Traffic Management Command) that the carrier has a tariff, government tender, agreement, or contract that provides Constant Surveillance Service. Commercial carriers may be used only within and between the 48 contiguous states and the District of Columbia or wholly within Alaska, Hawaii, or a U.S. territory. An FCL is not required for the commercial carrier. The contractor, as consignor, shall:
a. Utilize containers of such strength and durability as to provide security protection to prevent items from breaking out of the container and to facilitate the detection of any tampering with the container while in transit;
b. For DoD contractors indicate on the BL, "Constant Surveillance Service Required." In addition, annotate the BL as indicated in 5-408e.
c. Instruct the carrier to ship packages weighing less than 200 pounds gross in a closed vehicle or a closed portion of the carrier's equipment.
5-410 Use of Couriers, Handcarriers, and Escorts
  Contractors who designate cleared employees as couriers, handcarriers, and escorts shall ensure:
a. They are briefed on their responsibility to safeguard classified information.
b. They possess an identification card or badge which contains the contractor's name and the name and a photograph of the employee.
c. The employee retains classified material in his or her personal possession at all times. Arrangements shall be made in advance of departure for overnight storage at a U.S. Government installation or at a cleared contractor's facility that has appropriate storage capability, if needed.
d. If the classified material is being handcarried to a classified meeting or on a visit, an inventory of the material shall be made prior to departure. A copy of the inventory shall be carried by the employee. On the employee's return to the facility, an inventory shall be made of the material for which the employee was charged.
5-411 Use of Commercial Passenger Aircraft for Transmitting Classified Material
  Classified material may be handcarried aboard commercial passenger aircraft by cleared employees with the approval of the FSO.
a. Routine Processing. Employees handcarrying classified material will be subject to routine processing by airline security agents. Hand-held packages will normally be screened by x-ray examination. If sec
5-412 Use of Escorts for Classified Shipments
  If an escort is necessary to ensure the protection of the classified information being transported, a sufficient number of escorts shall be assigned to each classified shipment to ensure continuous surveillance and control over the shipment while in transit. Specific written instructions and operating procedures shall be furnished escorts prior to shipping and shall include the following:
a. Name and address of persons, including alternates, to whom the classified material is to be delivered;
b. Receipting procedures;
c. Means of transportation and the route to be used;
d. Duties of each escort during movement, during stops en route, and during loading and unloading operations; and
e. Emergency and communication procedures.
5-413 Functions of an Escort
  Escorts shall be responsible for the following.
a. Accept custody for the shipment by signing a receipt and release custody of the shipment to the consignee after obtaining a signed receipt.
b. When accompanying a classified shipment in an express or freight car, provide continuous observation of the containers and observe adjacent areas during stops or layovers.
c. When traveling in an escort car accompanying a classified shipment via rail, keep the shipment cars under observation and detrain at stops, when practical and time permits, in order to guard the shipment cars and check the cars or containers locks and seals. The escort car (after arrangements with the railroad) should be pre-positioned immediately behind the car used for the classified shipment to enable the escort to keep the shipment car under observation.
d. Maintain liaison with train crews, other railroad personnel, special police, and law enforcement agencies, as necessary.
e. When escorting classified shipments via motor vehicles, maintain continuous vigilance for the presence of conditions or situations that might threaten the security of the cargo, take such action as circumstances might require to avoid interference with continuous safe passage of the vehicle, check seals and locks at each stop where time permits, and observe vehicles and adjacent areas during stops or layovers.
f. When escorting shipments via aircraft, provide continuous observation of plane and cargo during ground stops and of cargo during loading and unloading operations. The escort shall not board the plane until after the cargo area is secured. Furthermore, the escort should preferably be the first person to depart the plane to observe the opening of the cargo area. Advance arrangements with the airline are required.
g. Notify the consignor by the fastest means available if there is an unforeseen delay en route, an alternate route is used, or an emergency occurs. If appropriate and the security of the shipment is involved, notify the nearest law enforcement official.


Section 5. Disclosure

5-500 General
  Contractors shall ensure that classified information is disclosed only to authorized persons.
5-501 Disclosure to Employees
  Contractors are authorized to disclose classified information to their cleared employees as necessary for the performance of tasks or services essential to the fulfillment of a classified contract or subcontract.
5-502 Disclosure to Subcontractors
  Contractors are authorized to disclose classified information to a cleared subcontractor when access is necessary for the performance of tasks or services essential to the fulfillment of a prime contract or a subcontract.
5-503 Disclosure between Parent and Subsidiaries
  Disclosure of classified information between a parent and its subsidiaries, or between subsidiaries, shall be accomplished in the same manner as prescribed in 5-502 for subcontractors.
5-504 Disclosure in an MFO
  Disclosure of classified information between cleared facilities of the MFO shall be accomplished in the same manner as prescribed in 5-501 for employees.
5-505 Disclosure to DoD Activities
  Contractors are authorized to disclose classified information received or generated under a DoD classified contract to another DoD activity unless specifically prohibited by the DoD activity that has classification jurisdiction over the information.
5-506 Disclosure to Federal Agencies
  Contractors shall not disclose classified information received or generated under a contract from one agency to any other Federal agency unless specifically authorized by the agency that has classification jurisdiction over the information.
5-507 Disclosure of Classified Information to Foreign Persons
  Contractors shall not disclose classified information to foreign persons unless release of the information is authorized in writing by the Government Agency having classification jurisdiction over the information involved, e.g. the DOE for RD and FRD, the NSA for COMSEC, the DNI for SCI, and all other Executive Branch departments and agencies for classified information under their jurisdiction. The disclosure must also be consistent with applicable U.S. laws and regulations.
5-508 Disclosure of Export Controlled Information to Foreign Persons
  Contractors shall not disclose export-controlled information and technology (classified or unclassified) to a foreign person, whether an employee or not, or whether disclosure occurs in the United States or abroad, unless such disclosure is in compliance with applicable U.S. laws and regulations.
5-509 Disclosure to Other Contractors
  Contractors shall not disclose classified information to another contractor except in furtherance of a contract, subcontract, or other GCA purpose.
5-510 Disclosure of Classified Information in Connection with Litigation
  Contractors shall not disclose classified information to attorneys hired solely to represent the contractor in any civil or criminal case in Federal or state courts unless the disclosure is specifically authorized by the agency that has jurisdiction over the information. Contractors shall not disclose classified information to any Federal or state court except on specific instructions of the agency which has jurisdiction over the information or the attorney representing the United States in the case. (For criminal cases in Federal courts, see paragraph 1-208.)
5-511 Disclosure to the Public
  Contractors shall not disclose classified or unclassified information pertaining to a classified contract to the public without prior review and clearance as specified in the Contract Security Classification Specification for the contract or as otherwise specified by the GCA.
a. Requests for approval shall be submitted through the activity specified in the GCA-provided classification guidance for the contract involved. Each request shall indicate the approximate date the contractor intends to release the information for public disclosure and identify the media to be used for the initial release. A copy of each approved request for release shall be retained for a period of one inspection cycle for review by the CSA. All information developed subsequent to the initial approval shall also be cleared by the appropriate office prior to public disclosure.
b. The following information need not be submitted for approval unless specifically prohibited by the GCA:
(1) The fact that a contract has been received, including the subject matter of the contract and/or type of item in general terms provided the name or description of the subject matter is not classified.
(2) The method or type of contract; such as, bid, negotiated, or letter.
(3) Total dollar amount of the contract unless that information equates to (a) a level of effort in a sensitive research area, or (b) quantities of stocks of certain weapons and equipment that are classified.
(4) Whether the contract will require the hiring or termination of employees.
(5) Other information that from time-to-time may be authorized on a case-by-case basis in a specific agreement with the contractor.
(6) Information previously officially approved for public disclosure.
c. The procedures of this paragraph also apply to information pertaining to classified contracts intended for use in unclassified brochures, promotional sales literature, reports to stockholders, or similar material.
d. Information that has been declassified is not automatically authorized for public disclosure. Contractors shall request approval for public disclosure of "declassified" information in accordance with the procedures of this paragraph.


Section 6. Reproduction

5-600 General
  Contractors shall establish a control system to ensure that reproduction of classified material is held to the minimum consistent with contractual and operational requirements. Classified reproduction shall be accomplished by authorized personnel knowledgeable of the procedures. The use of technology that prevents, discourages, or detects the unauthorized reproduction of classified documents is encouraged.
5-601 Limitations
 

a. TOP SECRET documents may be reproduced as necessary in the preparation of a contract deliverable. Reproduction for any other purpose requires the consent of the GCA.
b. Unless restricted by the GCA, SECRET and CONFIDENTIAL documents may be reproduced as follows:
(1) Performance of a prime contract or a subcontract in furtherance of a prime contract.
(2) Preparation of a solicited or unsolicited bid, quotation, or proposal to a Federal agency or prospective subcontractor.
(3) Preparation of patent applications to be filed in the U.S. Patent Office.
c. Reproduced copies of classified documents shall be subject to the same protection as the original documents.
5-602 Marking Reproductions
  All reproductions of classified material shall be conspicuously marked with the same classification markings as the material being reproduced. Copies of classified material shall be reviewed after the reproduction process to ensure that these markings are visible.
5-603 Records
  Contractors shall maintain a record of the reproduction of all TOP SECRET material for 2 years.


Section 7. Disposition and Retention

5-700 General
 

a. Classified information no longer needed shall be processed for appropriate disposition. Classified information approved for destruction shall be destroyed in accordance with this section. The method of destruction must preclude recognition or reconstruction of the classified information or material.
b. Contractors shall establish procedures for review of their classified holdings on a recurring basis to reduce these classified inventories to the minimum necessary for effective and efficient operations. Multiple copies, obsolete material, and classified waste shall be destroyed as soon as practical after it has served its purpose. Any appropriate downgrading and declassification actions shall be taken on a timely basis to reduce the volume and to lower the level of classified material being retained by the contractor.
5-701 Retention of Classified Material
  Contractors are authorized to retain classified material received or generated under a contract for a period of 2 years after completion of the contract, provided the GCA does not advise to the contrary. If retention is required beyond the 2-year period, the contractor must request and receive written retention authority from the GCA.
a. Contractors shall identify classified material for retention beyond 2 years as follows:
(1) TOP SECRET material shall be identified in a list of specific documents unless the GCA authorizes identification by subject matter and approximate number of documents.
(2) SECRET and CONFIDENTIAL material may be identified by general subject matter and the approximate number of documents.
b. Contractors shall include a statement of justification for retention based on the following:
(1) The material is necessary for the maintenance of the contractor's essential records.
(2) The material is patentable or proprietary data to which the contractor has title.
(3) The material will assist the contractor in independent research and development efforts.
(4) The material will benefit the U.S. Government in the performance of other prospective or existing agency contracts.
(5) The material will benefit the U.S. Government in the performance of another active contract and will be transferred to that contract (specify contract).
c. If retention beyond 2 years is not authorized, all classified material received or generated in the performance of a classified contract shall be destroyed unless it has been declassified or the GCA has requested that the material be returned.
5-702 Termination of Security Agreement
  Notwithstanding the provisions for retention outlined above, in the event that the FCL is to be terminated, the contractor shall return all classified material in its possession to the GCA concerned, or dispose of such material in accordance with instructions from the CSA.
5-703 Disposition of Classified Material Not Received Under a Specific Contract
 

a. Contractors shall return or destroy classified material received with a bid, proposal, or quote in accordance with the following schedule:
(1) If a bid, proposal, or quote is not submitted or is withdrawn within 180 days after the opening date of bids, proposals, or quotes.
(2) If a bid, proposal, or quote is not accepted within 180 days after notification that a bid, proposal, or quote has not been accepted.
b. If the classified material was not received under a specific contract, such as material obtained at classified meetings or from a secondary distribution center, within 1 year after receipt.
5-704 Destruction
  Contractors shall destroy classified material in their possession as soon as possible after it has served the purpose for which it was released by the government, developed or prepared by the contractor, or retained after completion or termination of the contract.
5-705 Methods of Destruction
  Classified material may be destroyed by burning, shredding, pulping, melting, mutilation, chemical decomposition, or pulverizing (for example, hammer mills, choppers, and hybridized disintegration equipment). Pulpers, pulverizers, or shredders may be used only for the destruction of paper products. High wet strength paper, paper mylar, durable-medium paper substitute, or similar water repellent papers are not sufficiently destroyed by pulping; other methods such as disintegration, shredding, or burning shall be used to destroy these types of papers. Residue shall be inspected during each destruction to ensure that classified information cannot be reconstructed. Crosscut shredders currently in use capable of maintaining a shred size not exceeding 1/32 inch in width (with a 1/64 inch tolerance by 1/2 inch in length) may continue to be used. However, any crosscut shredders requiring replacement of the unit and/or rebuilding of the shredder blades assembly must be replaced by a crosscut shredder on the latest NSA Evaluated Products List of High Security Crosscut Shredders. The list may be obtained from the CSA. Classified material in microform; that is, microfilm, microfiche, or similar high data density material; may be destroyed by burning or chemical decomposition, or other methods as approved by the CSA.
a. Public destruction facilities may be used only with the approval of, and under conditions prescribed by, the CSA.
b. Classified material removed from a cleared facility for destruction shall be destroyed on the same day it is removed.
5-706 Witness to Destruction
  Classified material shall be destroyed by authorized personnel who have a full understanding of their responsibilities. For destruction of TOP SECRET material, two persons are required. For destruction of SECRET and CONFIDENTIAL material, one person is required.
5-707 Destruction Records
  Destruction records are required for TOP SECRET material. The records shall indicate the date of destruction, identify the material destroyed, and be signed by the individuals designated to destroy and witness the destruction. Destruction officials shall be required to know, through their personal knowledge, that such material was destroyed. At the contractor's discretion, the destruction information required may be combined with other required control records. Destruction records shall be maintained by the contractor for 2 years.
5-708 Classified Waste
  Classified waste shall be destroyed as soon as practical. This applies to all waste material containing classified information. Pending destruction, classified waste shall be safeguarded as required for the level of classified material involved. Receptacles utilized to accumulate classified waste shall be clearly identified as containing classified material.


Section 8. Construction Requirements

5-800 General
  This section describes the construction requirements for closed areas and vaults. Construction shall conform to the requirements of this section or, with CSA approval, to the standards of DCID 6/9 (reference (o)).
5-801 Construction Requirements for Closed Areas
  This paragraph specifies the minimum safeguards and standards required for the construction of closed areas that are approved for use for safeguarding classified material. These criteria and standards apply to all new construction and reconstruction, alterations, modifications, and repairs of existing areas. They will also be used for evaluating the adequacy of existing areas.
a. Hardware. Only heavy-gauge hardware shall be used in construction. Hardware accessible from outside the area shall be peened, pinned, brazed, or spot welded to preclude removal.
b. Walls. Construction may be of material offering resistance to, and evidence of, unauthorized entry into the area. If insert-type panels are used, a method shall be devised to prevent the removal of such panels without leaving visual evidence of tampering. If visual access is a factor, area barrier walls up to a height of 8 feet shall be of opaque or translucent construction.
c. Windows. Windows that can be opened and that are less than 18 feet from an access point (for example, another window outside the area, roof, ledge, or door) shall be fitted with 1/2-inch bars (separated by no more than 6 inches), plus crossbars to prevent spreading, 18-gauge expanded metal or wire mesh securely fastened on the inside. When visual access of classified information is a factor, the windows shall be covered by any practical method, such as drapes, blinds, or paint covering the inside of the glass. During nonworking hours, the windows shall be closed and securely fastened to preclude surreptitious entry.
d. Doors. Doors shall be constructed of material offering resistance to and detection of unauthorized entry. When windows, louvers, baffle plates, or similar openings are used, they shall be secured with 18-gauge expanded metal or with wire mesh securely fastened on the inside. If visual access is a factor, the windows shall be covered. When doors are used in pairs, an astragal (overlapping molding) shall be installed where the doors meet.
e. Door Locking Devices. Entrance doors shall be secured with either an approved built-in combination lock, an approved combination padlock, or with an approved key-operated padlock. Other doors shall be secured from the inside with a panic bolt (for example, actuated by a panic bar); a dead bolt; a rigid wood or metal bar (which shall preclude "springing") which extends across the width of the door and is held in position by solid clamps, preferably on the door casing; or by other means approved by the CSA consistent with relevant fire and safety codes.
f. Ceilings. Ceilings shall be constructed of material offering resistance to and detection of unauthorized entry. Wire mesh or other non-opaque material offering similar resistance to, and evidence of, unauthorized entry into the area may be used if visual access to classified material is not a factor.
g. Ceilings (Unusual Cases). When wall barriers do not extend to the true ceiling and a false ceiling is created, the false ceiling must be reinforced with wire mesh or 18-gauge expanded metal to serve as the true ceiling. When wire mesh or expanded metal is used, it must overlap the adjoining walls and be secured in a manner that precludes removal without leaving evidence of tampering. When wall barriers of an area do extend to the true ceiling and a false ceiling is added, there is no necessity for reinforcing the false ceiling. When there is a valid justification for not erecting a solid ceiling as part of the area, such as the use of overhead cranes for the movement of bulky equipment within the area, the contractor shall ensure that surreptitious entry cannot be obtained by entering the area over the top of the barrier walls.
h. Miscellaneous Openings. All vents, ducts and similar openings into closed areas that measure in excess of 96 square inches and over 6 inches in their smallest dimension must be protected with either ½-inch diameter steel bars with a maximum space of 6 inches between the bars; grills consisting of 18-gauge expanded metal, wire mesh; or an equivalent gauge commercial metal duct barrier. The barriers must be secured to preclude removal from outside the area, and the method of installation must ensure that classified material cannot be removed through the openings with the aid of any type of instrument. A barrier will not be required if an approved IDS provides protection of the opening.
5-802 Construction Required for Vaults
  This paragraph specifies the minimum standards required for the construction of vaults approved for use as storage facilities for classified material. These standards apply to all new construction and reconstruction, alterations, modifications, and repairs of existing vaults. They will also be used for evaluating the adequacy of existing vaults. In addition to the requirements given below, the wall, floor, and roof construction shall be in accordance with nationally recognized standards of structural practice. For the vaults described below, the concrete shall be poured in place and will have a compressive strength of 2,500 pounds per square inch.
a. Floor. The floor must be a monolithic concrete construction of the thickness of adjacent concrete floor construction, but not less than 4 inches thick.
b. Walls. Walls must be not less than 8-inch-thick hollow clay tile (vertical cell double shells) or concrete blocks (thick shells). Monolithic steel-reinforced concrete walls at least 4 inches thick may also be used. Where hollow clay tiles are used and such masonry units are flush, or in contact with, facility exterior walls, they shall be filled with concrete and steel-reinforced bars. Walls are to extend to the underside of the roof or ceiling above.
c. Roof/Ceiling. The roof or ceiling must be a monolithic reinforced concrete slab of a thickness to be determined by structural requirements.
d. Vault Door and Frame Unit. A GSA-approved vault door and frame unit shall be used.
e. Miscellaneous Openings. Omission of all miscellaneous openings is desirable, but not mandatory. Openings of such size and shape as to permit unauthorized entry, (normally in excess of 96 square inches in area and over 6 inches in its smallest dimension) and openings for ducts, pipes, registers, sewers and tunnels shall be equipped with man-safe barriers such as wire mesh, 18-gauge expanded metal, or rigid metal bars of at least 1/2 inch in diameter extending across their width with a maximum space of 6 inches between the bars. The rigid metal bars shall be securely fastened at both ends to preclude removal and, if the bars exceed 18 inches in length, shall have crossbars to prevent spreading. Where wire mesh, expanded metal, or rigid metal bars are used, care shall be exercised to ensure that classified material within the vault cannot be removed with the aid of any type of instrument. Pipes and conduits entering the vault shall enter through walls that are not common to the vault and the structure housing the vault. Preferably such pipes and conduits should be installed when the vault is constructed. If this is not practical, they shall be carried through snug-fitting pipe sleeves cast in the concrete. After installation, the annular space between the sleeve and the pipe or conduit shall be caulked solid with lead, wood, waterproof (silicone) caulking, or similar material, which will give evidence of surreptitious removal.


Section 9. Intrusion Detection Systems

5-900 General
  This section specifies the minimum standards for an approved IDS when supplemental protection is required for TOP SECRET and SECRET material. The IDS shall be connected to, and monitored by, a central monitoring station. Alarm system installation shall conform to the requirements of this section or to the standards set forth in reference (o). The CSA will approve contingency protection procedures in the event of IDS malfunction.
5-901 CSA Approval
 

a. CSA approval is required before installing an IDS. Approval of a new IDS shall be based on the criteria of reference (o) or UL Standard 2050, reference (p), as determined by the CSA.
b. The UL listed Alarm Service Company (ASC) is responsible for completing the Alarm System Description Form.
5-902 Central Monitoring Station
 

a. The central monitoring station may be located at a UL-listed: (1) Government Contractor Monitoring Station (GCMS), formerly called a proprietary central station; (2) cleared commercial central station; (3) cleared protective signal service station (e.g., fire alarm monitor); or (4) cleared residential monitoring station. For the purpose of monitoring alarms, all provide an equivalent level of monitoring service.
b. SECRET-cleared central station employees shall be in attendance at the alarm monitoring station in sufficient number to monitor each alarmed area within the cleared contractor facility.
c. The central monitoring station shall be required to indicate whether or not the system is in working order and to indicate tampering with any element of the system. Necessary repairs shall be made as soon as practical. Until repairs are completed, periodic patrols shall be conducted during non-working hours, unless a SECRET cleared employee is stationed at the alarmed site.
d. When an IDS is used, it shall be activated immediately at the close of business at the alarmed area or container. This may require that the last person who departs the controlled area or checks the security container notify the central monitoring station to set the alarm. A record shall be maintained to identify the person responsible for setting and deactivating the IDS. Each failure to activate or deactivate shall be reported to the FSO. Such records shall be maintained for 30 days.
e. Records shall be maintained for 90 days indicating time of receipt of alarm, name(s) of security force personnel responding, time dispatched to facility/area, time security force personnel arrived, nature of alarm, and what follow-up actions were accomplished.
5-903 Investigative Response to Alarms
  The primary purpose of any alarm response team is to ascertain if intrusion has occurred and if possible assist in the apprehension of the individuals involved. If an alarm activation resets in a reasonable amount of time and no damage to the area or container is visible, then entrance into the area or container is not required. Therefore, the initial response team may consist of uncleared personnel. If the alarm activation does not reset and damage is observed, then a cleared response team must be dispatched. The initial uncleared response team must stay on station until relieved by the cleared response team. If a cleared response team does not arrive within one hour, then a report to the CSA must be made by the close of the next business day.
a. The following resources may be used to investigate alarms: proprietary security force personnel, central station guards, or a subcontracted guard service.
(1) For a GCMS, trained proprietary or subcontractor security force personnel, cleared to the SECRET level and sufficient in number to be dispatched immediately to investigate each alarm, shall be available at all times when the IDS is in operation.
(2) For a commercial central station, protective signaling service station, or residential monitoring station, there shall be a sufficient number of trained guards available to respond to alarms. Guards shall be cleared only if they have the ability and responsibility to access the area or container(s) housing classified material; i.e., keys to the facility have been provided or the personnel are authorized to enter the building or check the container or area that contains classified material.
(3) Uncleared guards dispatched by a commercial central station, protective signaling service station, or residential monitoring station in response to an alarm shall remain on the premises until a designated, cleared representative of the facility arrives, or for a period of not less than 1 hour, whichever comes first. If a cleared representative of the facility does not arrive within 1 hour following the arrival of the guard, the central control station must provide the CSA with a report of the incident that includes the name of the subscriber facility, the date and time of the alarm, and the name of the subscriber's representative who was contacted to respond. A report shall be submitted to the CSA within 24 hours of the next working day.
(4) Subcontracted guards must be under a classified contract with either the installing alarm company or the cleared facility.
b. The response time shall not exceed 15 minutes. When environmental factors (e.g., traffic, distance) legitimately prevent a 15-minute response time, the CSA may authorize up to a 30-minute response time. The CSA approval shall be documented on the UL Alarm System Description Form and the specified response time shall be noted on the alarm certificate. The UL standard for response within the time limits is 80%. That is the minimum allowable on-time response rate and anything less than 80% is unacceptable. However, in all cases, a guard or cleared employee must arrive at the alarmed premises.
5-904 Installation
  The IDS at the facility, area or container shall be installed by a UL listed ASC or by a company approved by the CSA. When connected to a commercial central station, GCMS protective signaling service or residential monitoring station, the service provided shall include line security (i.e., the connecting lines are electronically supervised to detect evidence of tampering or malfunction), the extent of protection for a container shall be “Complete,” and for an alarmed area shall be “Extent 3” as described in the reference (p) installation guide. CSA authorization on the Alarm System Description Form is required in the following circumstances:
a. Line security is not available. Installation will require two independent means of transmission of the alarm signal from the alarmed area to the monitoring station.
b. Alarm installation provides Extent 5 Protection. Reference (p) allows for Extent 5 based on patrolling guards and CSA approval of security-in-depth.
c. Law enforcement personnel are the primary alarm response. The contractor must obtain written assurance from the police department regarding the ability to respond to alarms.
d. Alarm signal transmission is over computer controlled data-networks (internet, intranet, etc.). The CSA will provide specific acceptance criteria (e.g., encryption requirements, etc.) for alarms monitored over data networks.
e. Alarm investigator response time exceeds 15 minutes.
5-905 Certification of Compliance
  Evidence of compliance with the requirements of this section will consist of a valid (current) UL Certificate for the appropriate category of service. This certificate will have been issued to the protected facility by UL, through the alarm installing company. The certificate serves as evidence that the alarm installing company: (a) is listed as furnishing security systems of the category indicated; (b) is authorized to issue the certificate of installation as representation that the equipment is in compliance with requirements established by UL for the class; and (c) is subject to the UL field countercheck program whereby periodic inspections are made of representative alarm installations by UL personnel to verify the correctness of certification practices.
5-906 Exceptional Cases
 

a. If the requirements set forth above cannot be met, the contractor may request CSA approval for an alarm system meeting one of the conditions listed below. CSA approval will be documented on the Alarm System Description Form.
(1) Monitored by a central control station but responded to by a local (municipal, county, state) law enforcement organization.
(2) Connected by direct wire to alarm receiving equipment located in a local (municipal, county, state) police station or public emergency service dispatch center. This alarm system is activated and deactivated by employees of the contractor, but the alarm is monitored and responded to by personnel of the monitoring police or emergency service dispatch organization. Personnel monitoring alarm signals at police stations or dispatch centers do not require PCLs. Police department response systems may be requested only when: (a) the contractor facility is located in an area where central control station services are not available with line security and/or proprietary security force personnel, or a contractually-dispatched response to an alarm signal cannot be achieved within the time limits required by the CSA, and, (b) it is impractical for the contractor to establish a GCMS or proprietary guard force at that location. Nonetheless, installation of these systems must use UL-listed equipment and be accomplished by an ASC Service Center listed by UL for any of the following categories:
1. Defense (National) Industrial Security Systems
2. Proprietary Alarm Systems
3. Central Station Burglar Alarm Systems
4. Police - Station - Connected Burglar Alarm Systems
b. An installation proposal, explaining how the system would operate, shall be submitted to the CSA. The proposal must include sufficient justification for the granting of an exception and the full name and address of the police department that will monitor the system and provide the required response. The name and address of the UL listed company that will install the system, and inspect, maintain, and repair the equipment, shall also be furnished.
c. The contractor shall require a 15-minute response time from the police department. Arrangements shall be made with the police to immediately notify a contractor representative on receipt of the alarm. The contractor representative is required to go immediately to the facility to investigate the alarm and to take appropriate measures to secure the classified material.
d. In exceptional cases where central station monitoring service is available, but no proprietary security force, central station, or subcontracted guard response is available, and where the police department does not agree to respond to alarms, and no other manner of investigative response is available, the CSA may approve cleared employees as the sole means of response.


Source