WIXLIB

Student GuideCourse: Storage Containers and FacilitiesLesson: Storage ContainersLesson IntroductionIn this lesson, you will learn about the types of storage containers used by the DoD andtheir physical security and labeling requirements. You will also learn some required andbest practices when using storage containers.The lesson objectives are: Identify the types of GSA-approved security containers and their uses Identify the labeling requirements for GSA-approved security containers Identify the physical security requirements for secure rooms and vaults Identify best practices and requirements when using storage containersOverview1. TypesStorage containers include security containers such as cabinets and field safes as wellas secure rooms and vaults.2. GSA-Approved vs. Non-GSA-ApprovedThe various types of storage containers can be categorized as either approved by theGeneral Services Administration (GSA) or not approved by the GSA. If a storagecontainer is GSA-approved, then it may be used to store classified information. If acontainer is not GSA-approved, it generally may not be used to store classifiedinformation except under certain circumstances.The information in the box below will not be on the test, but it may provide you with useful background andinsights.The General Services Administration (GSA) establishes and publishes minimumstandards, specifications, and supply schedules for containers, vault doors, modularvaults, and other associated security devices suitable for the storage and protection ofclassified information against forced, covert, and surreptitious entry.

Storage Containers and FacilitiesStorage ContainersStudent GuideSecurity Containers1. Non-GSA-ApprovedMany types of storage containers would fall under the non-GSA approved category.Some examples of non-GSA approved containers are money safes, record safes, andinsulated file cabinets. These containers may be burglary resistant or even fire resistant.For storage of classified information, the DoD does not authorize the use of non-GSAapproved containers, unless approved by heads of the DoD components with notificationto the Under Secretary of Defense for Intelligence, or (USD(I)), as outlined in DoD5220.22-M, the National Industrial Security Program Operating Manual (NISPOM).2. GSA-Approved ClassesGSA-approved containers are used to store both classified material andCommunications Security (COMSEC) material. DoDM 5200.01, Volumes 1-4, the DoDInformation Security Program, outlines the storage requirements for classifiedinformation within the DoD. Security requirements for classified contracts are stated inthe NISPOM. Any additional security requirements levied upon a contractor must bespecifically addressed in the contract. When used for the storage of COMSEC material,GSA-approved containers must also meet the security requirements established by theNational Security Agency (NSA). COMSEC material requires more stringent protectionand strict accountability such as the two person concept where two people are requiredto inventory, package, and destroy COMSEC material. There are several classes ofGSA-approved containers, from Class I to Class VI, which all offer varying degrees ofprotection against different types of unauthorized entry. However, there are only twoclasses that are currently being manufactured—Class V and Class VI containers. Whileboth classes offer protection against covert and surreptitious entry, only Class V offersprotection against forced entry. Neither of these classes offers protection against fire.Although you will primarily be dealing with Class V and Class VI containers, otherclasses of containers previously approved by GSA for the storage of classifiedinformation may still be used provided they are still serviceable.Protection Provided by Class of GSA-Approved ContainersIIIIIIIVVVIManipulation (hr)202020202020Radiological (hr)202020202020Surreptitious (m)302020203030----3030Forced Entry (m)105-510-Fire Protection (hr)11----Covert (m)**For containers produced after March 1991Page 2

Storage Containers and FacilitiesStorage ContainersStudent Guide3. GSA-Approved ConfigurationsGSA-approved containers come in various configurations such as 1, 2, 4, and 5 drawerswith either a single lock controlling all drawers or separate locks on individual drawers.Other configurations provide the ability to store bulky objects, such as map and plancontainers, weapons storage containers, and vented Information Processing System(IPS) containers, which have doors instead of drawers. For mobile applicationsincluding aircraft, vehicles, or field environments, a portable field safe is an approvedoption. However, due to their relative light weight and portability, they must be securedto a permanent, immovable structure or remain under 24 hour observation by dutypersonnel or guards. Special caution must be taken not to simply chain the containerthrough its lifting or carrying handle, as this provides little security and could damage thecontainer.4. GSA-Approved LocksDepending on the type of storage container or area, locks can be built-in combinationlocks, combination padlocks, or key-operated padlocks. Built-in combination locks arethe most widely used type of lock on security containers and vaults for protectingclassified information. The most common models of combination locks used on securitycontainers are the Kaba Mas X07, X08, X09, and X-10 locks and the Sargent andGreenleaf (S&G) 2740 and S&G 2740B locks because they meet the FederalSpecification FF-L-2740 series. The X-10 and the S&G 2740B are the models currentlyin production that meet the current Federal Specification FF-L-2740B. For vaults, themost common model is the CDX-09, CDX-10, and the S&G 2890 PDL. Vault doors canalso be equipped with emergency egress hardware. The LKM 7000 is the GSA approvedhardware. Padlocks may also be used to secure classified information, generally for bulkstorage. The combination padlock model that meets the current Federal Specification,FF-P-110, is the S&G 8077AD. The key-operated padlock model that meets the currentMilitary Specification, MIL-P-43607, is the S&G 951. However, the S&G 833C is stillauthorized for use. For more details about locks, refer to the Lock and Key SystemseLearning course offered by the DSS Center for Development of Security Excellence(CDSE).5. GSA-Approved LabelingGSA-approved security containers must clearly display the GSA-approved label on theface of the container in order to be used to store classified information. Labels forcontainers manufactured prior to October 1990 either have a silver background withblack lettering or a black background with silver lettering. Containers manufactured afterOctober 1990 are equipped with a silver label with red lettering. These containers arebuilt to slightly different construction standards.Other labels found on GSA-approved security containers include the test certificationlabel, cabinet identification label, number label, and warning label. The test certificationlabel and the cabinet identification label are located on the external side of the controldrawer, which is the drawer containing the lock. The test certification label includes theclass of container and amount of time the container protects against forced, covert, andsurreptitious entry. The cabinet identification label identifies the cabinet model and serialPage 3

Storage Containers and FacilitiesStorage ContainersStudent Guidenumber, date of manufacture, and government contract number. The number label liststhe container serial number and is securely fixed to the front face of the container,making it easy to reference if there is a recall or a need to request service or orderreplacement parts. For containers manufactured beginning in April 2007, a warninglabel is attached to the top inside of the control drawer. This label warns againstunapproved modification of the container.6. GSA-Approved Repair and RecertificationRepair and recertification of a GSA-approved container is required by Federal Standard809-B if its GSA-approved label is missing or if the structural integrity of the containerhas been compromised. Until a container has been repaired and restored to its originalcondition by a certified technician, recertified by an authorized certifying official, and anew GSA-approved label has been applied to the container by the certifying official, itmay not be used for storage of classified information.The information in the box below will not be on the test, but it may provide you with useful background andinsights.The locksmith must have favorable trustworthiness determination in accordance withDoD 5200.2-R or must be continuously escorted while so engaged.GSA-approved containers can be compromised through: Unauthorized entry Neutralization (drilled or cut open) by properly trained and equipped personnel Unauthorized modifications such as drilling, attaching items to the outside of thecontainer, or painting the container an unauthorized color Environmental damage, such as rustWhen in doubt if a GSA-approved container has been compromised, seek assistancefrom an authorized certifying official.Secure Rooms1. PurposeSecure rooms, referred to as closed areas in the NISPOM, are areas designated andauthorized for the open storage of classified information. Secure rooms are used whenlarger storage capability is needed than can be obtained from the use of GSA-approvedsecurity containers alone. These facilities are built to enhanced commercial constructionstandards, and do not afford the extra security inherent with vaults. Components mayhave additional requirements prohibiting the open storage of classified information insecure rooms.2. Construction StandardsWhen a secure room is approved for the open storage of classified material, it must beconstructed in accordance with standards contained in DoDM 5200.01, the InformationSecurity Program for the DoD, and in the NISPOM for cleared contractor facilities.Standards provide guidance for floors, walls, ceilings and roofs, and windows and otherPage 4

Storage Containers and FacilitiesStorage ContainersStudent Guideopenings. For example, walls must extend from true floor to true ceiling. Otherrequirements such as alarms or guard checks may be required. You should consult yourcomponent or agency authority or Cognizant Security Authority or Agency for additionalguidance.Vaults1. PurposeLike secure rooms, vaults are areas designated and authorized for the open storage ofclassified information. Vaults are constructed to meet strict forcible entry standardsestablished by the GSA and outlined in DoDM 5200.01, Information Security Program.Therefore, vaults are more secure than secure rooms.2. Construction StandardsVaults can either be constructed in place, or modular, which means they are prefabricated off-site and assembled in place. Standards are slightly different for vaults andmodular vaults, but when complete, both are considered equivalent for storagepurposes. Characteristics that set vaults apart from secure rooms include reinforcedconcrete on all walls, ceilings, and floors, plus a hardened steel door. Doors must meetGSA standards for surreptitious, covert, and forced entry. Class V is the current GSAstandard, and provides the following resistance to attack: 20 man-hours for surreptitiousentry, 30 man-minutes for covert entry, and 10 man-minutes against forced entry.To maintain certification, vault doors and frames must remain in their original color,which is gray. Another certification requirement is the placement of GSA-approvedlabels on the outside face of vault doors. Other labels that are used on GSA-approvedcontainers are also used on vault doors. Locks installed on vault doors have the samerequirements as locks installed on security containers. The locking capability of vaultdoors must provide for the emergency egress of personnel inside the vault. Otherrequirements, such as alarms or guard checks, may be required. You should consultyour component or agency authority or Cognizant Security Authority or Agency foradditional guidance.Storage Procedures1. Storage by Classification LevelMinimum storage requirements are different for each level of classified information. Thehigher the classification level of the information, the more secure the storage containeror closed area must be.a. TOP SECRET StorageTop Secret information must be stored in a GSA-approved security container,modular vault, vault, or secure room. No matter what container is used,supplemental protection is required for Top Secret information.If Top Secret information is stored in a GSA-approved container, at least one ofthe following supplemental protections is required: continuous protection bycleared guard or duty personnel, or cleared guard/duty personnel inspectsPage 5

Storage Containers and FacilitiesStorage ContainersStudent Guidecontainer every 2 hours, an intrusion detection system (IDS) used with 15 minuteresponse time, or security-in-depth using a GSA-approved container equippedwith a GSA-approved lock.If Top Secret information is stored in a vault or secure room, the alarm responsetime must be within 15 minutes if the area is covered by security-in-depth orwithin 5 minutes if the area is not covered by security-in-depth.The information in the box below will not be on the test, but it may provide you with usefulbackground and insights.Security-in-depth is a determination made by the Component Head or SeniorAgency Official (for the DoD) or the Cognizant Security Agency (for clearedcontractor facilities) that a security program consists of layered andcomplementary security controls sufficient to deter and detect unauthorized entryand movement within a facility.b. SECRET StorageSecret information must be stored in one of the areas approved for Top Secretinformation. Supplemental protection is required for Secret information that isstored by defense contractors in a closed area. Supplemental protection is notrequired for Secret information stored in a GSA-approved security container orvault. Supplemental protection is required for Secret information that is stored bydefense contractors in a closed area; it must have at least one of the followingsupplemental protections: continuous protection by cleared guard or dutypersonnel, or cleared guard or duty personnel inspects container every 4 hours,or IDS used with a 30 minute response time.c. CONFIDENTIAL StorageConfidential information must be stored in one of the areas approved for TopSecret or Secret information. Supplemental protection is not normally requiredfor the storage of Confidential information.2. Required Storage Practices: ContainersWhen working with storage containers, you must follow certain procedures related toaccessing the containers, the containers themselves, and what is stored inside thecontainers.a. AccessAccess to security containers, vaults, and secure rooms is granted only to thosewho are authorized to access the classified information stored inside, or to thosewho are authorized to change combinations or make repairs on the securitycontainers and locks. In addition, entrances to storage containers must be keptunder visual observation or equipped with electric, mechanical, orelectromechanical access control devices at all times during work hours. Finally,Page 6

Storage Containers and FacilitiesStorage ContainersStudent Guideyou must keep records of security containers, vaults, and secure rooms used forthe storage of classified material.Use Form SF-700, Security Container Information, to track the location of thestorage container as well as the contact information for each individual whoknows the combination and should be contacted in the event the container isfound open and unattended. The SF-700 must be stored in a sealed, opaqueenvelope inside the control drawer. The SF-700 forms can be ordered by callingFederal Supply Service customer assistance. Use Form SF-701, ActivitySecurity Checklist, to record end-of-day security checks which are conducted toensure all vaults, secure rooms, and containers used for the storage of classifiedinformation are secured at the end of each working day. Use Form SF-702,Security Container Check Sheet, to track each opening and closing of storagecontainers. If there is an open container violation, this form helps to narrow thescope of inquiry. This form also gives you a snapshot of the types of uses for thecontainer and serves as a reminder to take certain actions with the container.b. ContainersThere are certain procedures you must follow in obtaining, using, and returningstorage containers. You must procure new security storage equipment from theGSA Federal Supply Schedule. Exceptions to this may only be made by the DoDcomponent head with notification to the Under Secretary of Defense forIntelligence (USD(I)). You must not mark the outside of a storage container inany way that could divulge the classification level of the material being stored.This includes emergency evacuation and destruction priorities.Additionally, it is recommended that you keep the sides and tops of containersclear. When removing security containers, you must completely inspect theinside of the container, including complete drawer removal, to ensure there is noclassified material left inside, and turn in the containers in accordance with localproperty control procedures.c. ContentsDo not store classified information with sensitive items or weapons. Doing socould make the classified storage container more of a target for thieves lookingfor valuables. Also, destroy classified information no longer needed. Thisreduces the need for additional storage containers.3. Required Storage Practices: LocksLocks, keys, and combinations must be protected at all times. Here are therequired practices for protecting key-operated locks and combination locks, aswell as procedures for neutralization. For more detailed information aboutsafeguarding locks and keys, refer to the Lock and Key Systems eLearningcourse offered by the DSS Center for Development of Security Excellence.a. Key-Operated LocksKeys and locks must be protected at all times. Protect keys and spare locks in asecure container at the same level of protection afforded the material orinformation being secured.b. Combination LocksPage 7

Storage Containers and FacilitiesStorage ContainersStudent GuideCombinations must be protected at all times. Treat combinations at the samelevel of classified material they protect. It is recommended you always securemechanical combination locks with four rotations of the dial. Changecombinations at specific times such as when they are first placed in use, when anindividual who knows the combination no longer requires access, when thecombination has been subject to possible compromise, and when the container istaken out of service. Also note when a container is taken out of service, thecombination must be reset to the factory default setting.c. NeutralizationWhen a lock freezes, or if you forget the combination or lose the key, only properlytrained and equipped personnel shall neutralize the lock or container by drilling orcutting it open. Neutralization must be done by a GSA Authorized Safe

As a security professional, you must prevent our sensitive assets from getting into the wrong hands and being used against us. Storage of our sensitive assets, such . by manipulating a lock by using an auto dialer machine to learn the combination of a combination lock or by picking a keyed lock, for example. Covert entry is not as easily