10.2.11 Basic Physical Security Concepts

Manual Transmittal

September 04, 2019

Purpose

(1) This transmits revised Internal Revenue Manual (IRM) 10.2.11, Basic Physical Security Concepts.

Material Changes

(1) IRM title change from “Basic Security Concepts” to “Basic Physical Security Concepts”.

(2) Facilities Management and Security Services (FMSS) partnered with the Federal Protective Service (FPS) to merge our Physical Security Risk Assessment (PSRA) process with the FPS Facility Security Assessment (FSA) process. The previous IRS PSRA process was made obsolete to reduce redundancies in favor of utilizing the FPS FSA process going forward. This IRM was updated to reflect changes to the program requirements, definitions and terminology.

(3) Changed Sensitive Areas to Critical Areas in subsection 10.2.11.7, as defined by the Interagency Security Committee (ISC).

(4) Included the ISC Building Automation and Control Systems (BACS) terminology and definition.

(5) Updated the risk assessment completion time lines from the previous IRS anniversary date, to FPS scheduling dates which is based on the fiscal year.

(6) Added Audit Management Checklist (AMC) subsection 10.2.11.3.5 and Corrective Action Report (CAR) requirements in subsection 10.2.11.3.6 per IG Memo FMSS-10-0818-0002.

(7) Removed Security Assurance and Maturity Access Levels.

(8) Removed IRM 10.2.11.8, Facility Security Level (FSL) IV Protective Measures.

(9) Removed IRM 10.2.11.8.1, Perimeter Security.

(10) Removed IRM 10.2.11.9.1, Perimeter Security FSL V Facilities.

(11) Removed IRM 10.2.11.10, Post of Duty (POD) Protective Measures.

(12) Changed Restricted Areas to Limited Areas.

(13) As of June 18, 2019, IRM 10.2.11.1.5 was updated to implement an end-date for obsoleting the Physical Security Risk Assessment (PSRA) process, in favor of the Facility Security Assessment Addendum (FSAA) process.

(14) As of January 1, 2017, the Internal Revenue Service (IRS) instituted a requirement that the IRM address relevant internal controls. This will inform employees about the importance of and context for internal controls by describing the program objectives and officials charged with program management and oversight. Internal controls are the program’s policies and procedures which ensure:

  1. Mission and program objectives are clearly delineated, and key terms defined.

  2. Program goals are established, and performance is measured to assess the efficient and effective mission and objective accomplishment.

  3. Program and resources are protected against waste, fraud, abuse, mismanagement and misappropriation.

  4. Program operations are in conformance with applicable laws and regulations.

  5. Financial reporting is complete, current and accurate.

  6. Reliable information is obtained and used for decision making and quality assurance.

Effect on Other Documents

This IRM supersedes IRM 10.2.11 dated August 4, 2016.

Audience

Servicewide

Effective Date

(09-04-2019)

Richard L. Rodriguez
Chief
Facilities Management and Security Services

Program Scope and Objectives

  1. Purpose: This IRM establishes physical security requirements for the reasonable protection of IRS personnel, tax information, infrastructure, property, and facilities against disclosure, loss, damage, or destruction without unnecessarily restricting or interfering with operations, in accordance with the Department of Homeland Security (DHS), Interagency Security Committee (ISC) and Risk Management process which outlines the accepted physical security standards for IRS. This applies to all IRS facilities (National Office, posts of duty, processing centers, computing centers and other IRS offices or space).

  2. Audience: Servicewide.

  3. Policy Owner: Chief, Facilities Management and Security Services (FMSS).

  4. Program Owner: FMSS Associate Director (AD), Security Policy.

  5. Primary Stakeholders: FMSS Field Operations, Business Unit Executives, Senior Managers, Chief Counsel Executives, Managers, and Employees.

  6. Program Goals: To provide security policy and procedures designed to mitigate physical security vulnerabilities and enforce basic physical security concepts.

Background

  1. Developing and implementing basic physical security concepts is essential to the safeguarding of IRS personnel, tax data, and other IRS assets. These concepts effectively keep our facilities safe and secure, by maintaining authoritative ISC, Treasury and IRS physical security standards.

  2. This IRM consolidates and revises all basic physical security concepts policy and standards identified in IRM 10.2, Physical Security Program.

  3. This IRM further solidifies the responsibilities of stakeholders in implementing these policies and concepts.

Authority

  1. 40 United States Code (USC) § 1315

  2. Executive Order (EO) 12977

  3. Executive Order (EO) 13286

  4. National Infrastructure Protection Plan (NIPP)

  5. ISC Risk Management Process (RMP)

  6. Treasury Directive Publication (TDP) 15-71

  7. National Institute of Standards and Technology (NIST) SP 800-53

Responsibilities

  1. The Chief, FMSS is responsible for oversight of basic physical security concepts policy and guidance.

  2. FMSS AD, Security Policy is responsible for oversight of the planning, developing, implementing, evaluating, and controlling basic physical security concepts policy and guidance.

  3. FMSS Territory Managers (TM) are responsible to ensure Security Section Chiefs (SSC) follow IRS policy and provide oversight in the implementation and enforcement of the basic physical security concepts.

  4. FMSS SSC are responsible for implementing and enforcing basic physical security concepts within their assigned territory, following IRS and ISC security policy and ISC standards.

  5. All IRS managers are responsible for informing all employees within their span of control of the importance of following established security practices at their facility.

  6. All employees and contractors are responsible for complying with established physical security practices and procedures.

Program Management and Review

  1. Program Reports: The authoritative data sources for monitoring the basic physical security concepts will be:

    1. Federal Protective Service (FPS) Facility Security Assessments (FSA)

    2. IRS Facility Security Assessment Addendum (FSAA)

    3. Security Information Management System (SIMS) Monthly FMSS Operations Deliverables Report

    4. Space Time and Resources (STAR) tool for physical security countermeasure funding and tracking

    5. Situation Awareness Management Center (SAMC) Incident Reports

  2. Program Effectiveness: Facility Security Assessment Program quarterly reviews of physical security threats, vulnerabilities and risk, consists of:

    1. Compliance with ISC standards, as validated in the FSA reports.

    2. Compliance with Treasury and IRS requirements, as validated in the FSAA reports.

    3. Timely completion of required FSAA reports in accordance with ISC Standards based on the Facility Security Level (FSL) determination for the facility.

Terms/Definitions/Acronyms

  1. Interpretation Words

    Word Definition Example of using a word that is open to interpretation.
    (This column is for illustration purposes only)
    Facility Security Assessment (FSA) The FPS process of evaluating and documenting credible threats, identifying vulnerabilities, and assessing consequences for a specific facility. A Facility Security Assessment was conducted by FPS to assess the physical security posture and determine if existing security is adequate for this facility
    Facility Security Assessment Addendum (FSAA) The IRS process of evaluating and documenting credible threats, identifying vulnerabilities, and assessing consequences for a specific facility. A Facility Security Assessment Addendum was completed by the FMSS PSS and provided to responsible FPS Inspector for incorporating into the FSA report of record.
    Interagency Security Committee (ISC) A collaborative organization that provides leadership to the nonmilitary federal community supporting physical security programs that are comprehensive and risk based. When conducting an FSA, FPS includes all Interagency Security Committee criteria from the most recent Appendix B, in accordance with the Facility Security Level (FSL) designation.
    Modified Infrastructure Survey Tool (MIST) A FPS proprietary Facility Security Assessment (FSA) tool and document repository. The SSC must verify with the assigned FPS Inspector that all completed FSAA reports are provided to them for uploading to the Modified Infrastructure Survey Tool (MIST)
    Building Automation and Control System (BACS) The automatic centralized control of a building's heating, ventilation and air conditioning, lighting and other systems through a building management system. Most commercial, institutional, and industrial buildings built after 2000 include a BACS The SSC has implemented appropriate countermeasures to protect and limit access to all areas that house Building Automation and Control Systems (BACS)
    Limited Area NIST terminology designation. Refers to an area to which houses critical assets and access is limited to authorized personnel only. The FMSS SSC designated the room as a "Limited Area" based on the critical assets housed within.
    Critical Areas An ISC terminology designation: Areas that, if damaged or compromised, could have significant adverse consequences for the IRS agency’s mission or the health and safety of individuals within the building or the surrounding community. May also be referred to as “Limited Areas,” “Restricted Areas,” or “Exclusionary Zones.” Critical areas do not necessarily have to be within government-controlled space (e.g., generators located outside government-controlled space). The SSC designated the room as a Limited Area and has implemented protective countermeasure, in accordance with the ISC Critical Area designation criteria.
    Controlled Area Is not a Limited Area; however, it requires controlled entry access with one-part authentication (access card or manual combination). Only personnel assigned to work in the area and other personnel designated by the responsible business unit are authorized unescorted access into a Controlled Area. All visitors entering a controlled area must be escorted by personnel with authorized unescorted access into a controlled area.
    Legacy Physical Security Risk Assessment (PSRA) Previous IRS Physical Security Risk Assessment reportused prior to transitioning to the FPS FSA Report. Legacy Physical Security Risk Assessment (PSRA) reports are obsolete and replaced with the FSAA.
    Campus As defined by the ISC: A campus consists of two or more federal facilities located contiguous to one another and sharing some aspects of the environment (e.g., parking courtyards, vehicle access roads, or gates) or security features (e.g., a perimeter fence, guard force, or onsite central alarm/Closed Circuit Television (CCTV) monitoring station). The Audit Management Checklist (AMC) will be completed every fiscal year at all Campus locations.
    Computing Center As defined by the Treasury Security Manual: Computing centers contain activities that are unique and vital to the mission of the Service and are designated as three of Treasury’s Critical Infrastructure Protection (CIP) assets. The IRS Martinsburg facility is a Computing Center.

     

    Acronyms

    Acronym Definition
    AD Associate Director
    ADP Automated Data Processing
    AMC Audit Management Checklist
    BACS Building Automation and Control Systems
    CAR Corrective Action Report
    CCC Child Care Centers
    CCTV Closed Circuit Television
    CID Criminal Investigation Division
    COOP Continuity of Operations
    COR Contracting Officer’s Representative
    CSCC Central Security Control Console
    DHS Department of Homeland Security
    DO Designated Official
    DO Departmental Office
    EO Executive Order
    FISMA Federal Information Security Management Act
    FMSS Facilities Management and Security Services
    FPS Federal Protective Service
    FSA Facility Security Assessment
    FSAA Facility Security Assessment Addendum
    FSL Facility Security Level
    FSP Facility Security Plan
    GSA General Services Administration
    HAZMAT Hazardous Materials
    ICAM Identify Credential & Access Management
    ID Identification
    IDF Intermediate Distribution Frame
    ISC Interagency Security Committee
    IT Information Technology
    LOP Level of Protection
    MDF Main Distribution Frame
    MIST Modified Infrastructure Survey Tool
    NCFB New Carrollton Federal Building
    NFPA National Fire Protection Association
    NIPP National Infrastructure Protection Plan
    NIST National Institute of Standards and Technology
    PERSEC Personnel Security
    POD Post of Duty
    PPD Presidential Policy Directive
    PSA Physical Security Assistant
    PSE Physical Security and Environmental
    PSRA Physical Security Risk Assessment
    PSS Physical Security Specialist
    RMP Risk Management Process
    RPS Remittance Processing
    SAMC Situation Awareness Management Center
    SBU Sensitive But Unclassified
    SCIF Sensitive Compartmented Information Facility
    SIMS Security Information Management System
    SSC Security Section Chiefs
    STAR Space Time and Resources
    TAC Taxpayer Assistance Center
    TAS Taxpayer Advocate Service
    TDP Treasury Directive Publication
    TIGTA Treasury Inspector General for Tax Administration
    TM Territory Managers
    TOC Treasury Office of Continuity
    USC United States Code
    VSS Video Surveillance System

     

Related Resources

  1. Interagency Security Committee (ISC) Risk Management Process (RMP)

  2. IRM 1.15, Records and Information Management

  3. IRM 1.4.6, Managers Security Handbook

  4. IRM 10.2.5, Identification Media

  5. IRM 10.2.9, Occupant Emergency Planning

  6. IRM 10.2.12, Security Guard and Explosive Detector Dog Services

  7. IRM 10.2.14, Methods of Providing Protection

  8. IRM 10.2.15, Minimum Protection Standards (MPS)

  9. IRM 10.2.18, Physical Access Control (PAC)

  10. IRM 10.23.2, Personnel Security

  11. IRM 6.800.2, Employee Benefits, IRS Telework Program

  12. Treasury Directive Publication (TDP) 15-71

  13. National Institute of Standards and Technology (NIST) SP 800-53

General

  1. Security protection should be provided through design, technology and procedural controls and must also incorporate physical, data, and space management requirements during the development, and planning phases of a facility. There are many security safeguards from which a viable security program may be developed to protect the property and personnel within a site or facility.

  2. Due to physical, operational, and financial limitations, absolute security is neither possible or practical. Therefore, the approach to physical security offered herein is a practical approach to protect information, facilities, property and personnel by employing a combination of measures to Deter, Detect, Deny, Delay, Defend/Respond to unauthorized entrants and to preserve the environment in which the IRS mission may be carried out without disruption.

  3. In addition to providing safeguards to control unauthorized access, a well- balanced security program must provide measures to protect IRS facilities and personnel from threats that may cause property damage or risk to life. Such measures are included in IRM 10.2.9, Occupant Emergency Planning. The options available to Deter, Detect, Deny, Delay, Defend/Respond to unauthorized entrants and the required Minimum Protection Standards (MPS) for certain types of IRS facilities and operations are contained in IRM 10.2.11.2.8, Safeguard Functions.

  4. ISC standards will be applied as a minimum-security standard. IRS protection requirements may exceed the ISC minimum standards, if appropriate.

Basic Physical Security Concepts

  1. This IRM establishes security guidelines for the reasonable protection of employees, tax information, infrastructure, property, and facilities against disclosure, loss, damage, or destruction without unnecessarily restricting or interfering with operations. It also provides instructions on the minimum-security standards for the IRS and serves as a procedural and technical guide for security personnel. It includes optional methods for providing security under varying local conditions, provides for specific items requiring protection and identifies the various methods for protection.

  2. This IRM includes the physical security requirements for the federal tax administration system as administered within the IRS. This includes all IRS facilities (National Office, Posts of Duty (POD), processing centers, computing centers and other IRS offices or space).

Facility Security Committee (FSC)

  1. The FSC, is a committee consisting of representatives of all federal tenants in the facility, the security organization (for example: FPS for General Services Administration (GSA) owned and operated facilities). An IRS FMSS physical security representative must provide consultation to the IRS representative on the FSC established for each building.

  2. The FSC is responsible for addressing the facility-specific security issues outlined in the FSA and approving the implementation of security countermeasures and practices recommended by the security organization. The implementation may be a combination of operational, procedural and/or physical security measures based on the Facility Security Level (FSL) determination, and the Level of Protection (LOP) that are deemed appropriate and achievable.

  3. As outlined in the ISC FSC standards, if a single federal tenant occupies a facility, they have the option to use this standard or other internal procedure to determine what security countermeasures are implemented, how funding is provided and what risk is accepted.

    Note:

    For additional information on the FSC, see ISC Appendix D: How to Conduct a Facility Security Committee

Facility Security Level (FSL) Determinations

  1. Minimum security levels must be established for each facility. The FSL is based on the characteristics of each facility and the federal occupant. The initial FSL determination for newly leased or owned space will be made as soon as practical, after the Identification (ID) of a space requirement (including succeeding leases). Each facility will be designated Level I, II, III, IV, or V in accordance with the ISC Standards, and appropriate security measures must be implemented. Inherent risks associated with Taxpayer Assistance Center (TAC) locations accepting cash must be considered when making FSL determinations.

  2. The five factors quantified to determine the FSL are:

    1. Mission criticality

    2. Symbolism

    3. Facility population

    4. Facility size

    5. Threat to tenant agencies

    6. A sixth factor, "intangible" to allow the assessor to consider other factors unique to the agency or facility.

  3. To determine the FSL the ISC FSL Matrix should be utilized. The FSL matrix is comprised of five equally weighted security evaluation factors with corresponding points of 1, 2, 3, or 4 allocated for each factor.

  4. A Level V designation necessitates implementation of extensive security measures. IRS facilities identified as critical infrastructure and those housing critical infrastructure and key resources must be designated and protected as Level IV, at a minimum.

  5. The FSL determination will be established by FPS with input and coordination from the assigned FMSS SSC.

    Note:

    For additional information on the FSL process, see the ISC Risk Management Process for Federal Facilities.

Photography and Video Recordings Prohibition

  1. Taking photographs within or recording images inside of the IRS is prohibited except when specifically authorized by the assigned FMSS Physical Security Section Chief. Taking photographs of external features of a facility or other property which provides information not accessible to the public must be reported to local FMSS Physical Security staff, the Treasury Inspector General for Tax Administration (TIGTA), and FPS. Photography means any physical or electronically recorded image, including still photographs, x-ray images, video or recordings.

Facility Security Risk Management

  1. In compliance with ISC standards for non-military federal facilities, FPS has established minimum security standards and requirements for the protection of IRS facilities, personnel and information. These standards are based on possible threats and identified countermeasures that could minimize the impact of an occurrence. A periodic FSA is conducted by FPS, FMSS Physical Security staff and management officials with information on the effectiveness and appropriateness of existing standards and countermeasures, identified risks, security countermeasures recommendations, and guidance on how to best implement approved recommendations.

  2. Evaluation of the risk is the first step in determining the degree of security required for a facility. Security measures should be relative to the type of risks to which the facility and its contents are exposed, the probability that these risks will occur, and the impact that an occurrence would have on the IRS.

  3. As directed in the ISC standards, an FSA will be conducted by FPS at the following intervals, at a minimum: Level III, IV and V facilities, every three years; and Level I and II facilities, every five years. If the security posture has been enhanced by the addition of security countermeasures, those enhancements should be noted in the succeeding report based on recurring cycle. All facilities will follow the ISC and FPS recurring cycle for completing the subsequent FSA of every three or five years or more frequently, if circumstances warrant and/or when the following conditions have occurred:

    1. Change in location

    2. Major building renovation

    3. Increase in significant incidents and/or

    4. Change in the mission of the businesses located at the facility

  4. FMSS Physical Security staff will complete a FSAA at all locations where IRS employees are assigned. The FSAA will include Treasury and IRS specific requirements and any findings with cost estimates for the facility being assessed. The completed and signed FSAA will be given to the FPS inspector assigned to complete the associated FSA. The IRS FSAA will be incorporated into the final FPS FSA report. The FSA with FSAA must be performed within six months of occupying the facility or space. IRS will not conduct an FSA or complete an FSAA for Child Care Centers (CCC), credit unions or parking lots not within IRS controlled perimeter and/or facility access.

  5. FPS will conduct an FSA at CCC, credit unions or parking lots that are not within IRS controlled perimeter and/or facility access. No IRS FSAA is required for these types of facilities. and locations.

    Note:

    For additional information, see IRM 1.15, Records and Information Management series for compliance with records and files management lifecycle (hardcopy and electronic), including creation, maintenance, retrieval, preservation and disposition of all records to avoid inadvertent/unlawful destruction of records.

    Note:

    All FSA and FSAA risk assessment documents are considered Sensitive but Unclassified (SBU) and as such must be handled in accordance with requirements outlined in TDP 15-71.

Audit Management Checklist (AMC)

  1. The AMC is a self-inspection tool used to assess compliance with physical security criteria identified as non-compliant in past audits of the physical security program. The AMC will be completed by a local FMSS Physical Security Specialist (PSS).

  2. The AMC will be completed every fiscal year at the following large IRS facilities:

    1. Campuses

    2. Computing Centers

    3. Main IR (1111 Constitution Ave)

    4. New Carrollton Federal Building (NCFB)

  3. The AMC must be completed at least once every five years at other POD locations. The AMC may be completed in conjunction with the scheduled PSRA, other scheduled site visits or at the discretion of the local FMSS Physical SSC. The local SSC must review and approve the AMC and direct the completion of a Corrective Action Report (CAR), if deficiencies are found.

  4. The FMSS AMC Program Manager will review and update the AMC checklist content every fiscal year and reassess the AMC process and frequency of conducting reviews every two fiscal years.

Corrective Action Report

  1. Security deficiencies identified in the AMC must be corrected. The local PSS will identify and document immediate and long-term corrective actions using the CAR. The local SSC and TM must review and approve CAR corrective actions. The CAR will be used to monitor and track all corrective actions until fully implemented.

  2. The local SSC, TM and FMSS AMC Program Manager will monitor the status of all corrective actions until fully implemented.

Facility Security Plan

  1. The FSP provides summary information used to describe all significant Safeguards and Security programs at applicable sites and facilities occupied by IRS employees and contractors. The FSP will be completed for each IRS facility, including computing centers, campuses and critical POD. The FSP documents the implementation of Federal Information Security Management Act (FISMA) Physical Security and Environmental (PSE) Control as prescribed within the National Institute of Standards and Technology (NIST SP 800-53), TDP 15-71, and ISC criteria. Development and maintenance of the FSP is directed in TDP 15-71 Security Manual and the ISC standards.

  2. The intent of the FSP is to outline the protection plan in place at IRS occupied facilities and provide a snapshot of the actual security measures in effect for several security disciplines - physical, Information Technology (IT), environmental, media protection, etc. This requires coordination and cooperation of all business units responsible for each discipline. The description of how those programs are implemented should be contained in site and facility procedures, directives, supplemental orders or other authoritative documentation.

  3. In accordance with ISC standards, at a minimum, the FSP must be reviewed annually and revised as necessary. Documents must be marked as SBU and must identify the following:

    1. Site/Facility ID

    2. Threat Information

    3. Roles and Responsibilities of FMSS Physical Security staff

    4. Personnel Security (PERSEC)

    5. PSE Protection Policy and Procedures

Limiting and Controlling Access

  1. Limiting Access - The basic principle of security within the IRS or anywhere, is to limit access to assets based upon need. When protecting information, for example, access to documents should be "limited" to those persons with a need to know the information. When the asset to be protected is a room, an area, a building, a computer, or other such property, access to that property should be restricted to those persons who, due to their official duties and/or responsibilities, have a need for such access.

  2. Controlling Access - Access will be controlled by implementing procedures to ensure ensuring that employees, contractors, and visitors entering IRS facilities are screened in accordance with ISC standards.

  3. Visitors are restricted from entering IRS space unless they have a justified business need approved by the local FMSS Physical Security office. Visitors and federal employees employed by other agencies must meet all access requirements as outlined in IRM 10.2.5, Identification Media, IRM 10.2.18, Physical Access Control (PAC) and IRM 10.23.2, Personnel Security, Contractor Investigations.

    Note:

    For additional information on access control, see IRM 10.2.18, Physical Access Control (PAC).

Safeguard Functions

  1. Most of the methods of protection are designed for protection after normal duty hours or at any time the assets to be protected are not under the personal custody of authorized IRS employees.

  2. Because any single safeguard is often insufficient protection for any asset, the concept of layering of safeguards was developed provide security-in-depth. To facilitate understanding of security-in-depth, the following functions of safeguards are presented.

    1. Deter - The psychological effect which a safeguard or a system of safeguards has upon the potential perpetrator or human originated threat is difficult to measure. One can determine the effectiveness of an alarm by the number of bona fide "catches" it makes, but we can only guess the effectiveness of a safeguard which is designed only or primarily to deter a human being. The best example of a pure deterrent is a sign which identifies a Limited Area. While it would be ideal to have effective security simply using such inexpensive means as signs or lights, it is not practical. A good security program will not rely solely upon safeguards which are only deterrents.

    2. Detect - Many safeguards will automatically provide detection of an unauthorized act. For example, a door may show signs of a forced entry. However, an alarm might give evidence of an attempted surreptitious or forced entry. Depending once again upon the value of the asset, the timing of detection is crucial. Perimeter alarms and alarm activated cameras will help achieve this goal. Such a goal will also require a response by internal security personnel, DHS/FPS guards, or local police which will monitor detection devices and respond to them as appropriate. The functions of assessing, identifying, and tracking can be accomplished by Closed Circuit Television (CCTV) systems or Video Surveillance System (VSS), alarm systems and entry control systems. The most important of these functions is assessment, since the nature of the unauthorized act (e.g. unauthorized access, theft, robbery, assault, etc.) will influence the nature of the response to that act. In some cases, we may only be able to respond to a threat as it is occurring. While the act has not been prevented, ID of the perpetrator enables the IRS to take appropriate action. The tracking function is most useful for the response force to focus on the current location of the problem or perpetrator.

    3. Deny - The only real way to accomplish this function is to destroy an asset to prevent unauthorized personnel from obtaining it. Clearly, for the IRS, this only pertains to information on paper, microfilm, or magnetic media, etc. which is no longer needed, or which is a waste by-product of a tax administration function.

    4. Delay - Ideally, the IRS should be able to deny access to its assets to separate them from human originated threats. But this is not practical since to perform its mission the IRS must allow access to its assets. The objective then is to limit access to authorized personnel at approved times for official reasons. At times when the assets are not in the personal custody of an authorized IRS employee, they should be protected by means which delay as long as practical access by unauthorized persons. Safeguards such as locks, containers and walls will withstand (depending on the type of lock, container, etc.) forced entry and surreptitious entry attempts for a given period. This time is, hopefully, enough to discourage most would-be thieves, saboteurs, etc. However, given enough determination and resources (i.e., time, tools, and money) all such safeguards can be breached. If the asset being protected merits more than a deterring and delaying effort, the next function we would add is detection.

    5. Defend/Respond - Ideally, response to a threat in progress is to detect it and to take appropriate action soon enough to prevent it from causing any harm or loss. To achieve this ideal, the delaying safeguard, the detection devices, and the response force must be designed to ensure that the safeguard delays the perpetrator long enough for a detection device to alert the response force and long enough to allow the response force to arrive in time to intervene to prevent access or to prevent a perpetrator from leaving the area with stolen government property or information. An onsite contract security force should respond to a threat condition within five minutes and at other buildings (protected with central station alarm systems) within 15 minutes. If this is not possible, then compensating measures must be included in the protective system design to delay an adversary until an effective response can be executed.

  3. Exhibit 10.2.11-3, SAFEGUARDS and Their Related Protection Functions, shows the functions generally performed by certain security devices/techniques. No attempt is made to address the effectiveness of each, as this depends on the quality of the device selected monitoring activities and timely reactionary measures. Conversely, ID media, electronic access control systems, sign in and other audit trail procedures and task separation techniques are generally used during working hours to protect against a potential perpetrator with access.

    Note:

    For additional information regarding these safeguards and access control, see IRM 10.2.18, Physical Access Control (PAC).

Security Awareness
  1. A security program is enhanced when all managers and all employees are aware of security requirements including the reasons for each of the security requirements they are expected to follow or enforce. Each manager must know the general security requirements, as well as, the specific security measures which apply to their area of responsibility. The key to an effective awareness program is to show how the requirements relate to the work in which an employee is involved. For example, awareness efforts directed toward computer room employees should relate to security requirements in a computer room, while those efforts directed toward a tax auditor should relate to protecting the privacy of the taxpayer and the sensitivity to the tax return and return information.

    Note:

    For additional manager responsibilities, see IRM 1.4.6, Managers Security Handbook.

Security Briefings
  1. Security awareness programs will, at a minimum, include briefings as specified below:

    1. All employees are required to complete the annual mandatory FMSS Physical Security briefing.

    2. All assigned employees will be provided a refresher security orientation outlining site specific measures, protocols and procedures within the first week of returning from non-work status.

    3. Management will inform each employee of special security requirements pertaining to their work area or facility when the employee reports to a new manager for duty.

      Note:

      For additional information on Contractor Security Awareness training requirements, see IRM 10.23.2, Personnel Security, Contractor Investigations.

      Note:

      For additional information on manager responsibilities, see IRM 1.4.6, Managers Security Handbook.

Building Structure and Location

  1. One of the first considerations in establishing a security program for a particular activity is the building in which the activity is located. The number of floors, doors, windows, fire exits, roof vents, the degree of ground level access and adjacent parking facilities, all affect entry control considerations. At processing and computing centers, loading docks, kitchen entrances and boiler room doors are normally more vulnerable points in the building perimeter security; therefore, they should be given special attention and should not be used as routine recurring entrances for the building population. The material structure of the building (interior partitioning, ceilings, and doors) affects the degree of security afforded contents against destruction, theft and unauthorized disclosure. If the building is not entirely occupied by the IRS, the nature of operations conducted by other tenants will affect security in IRS occupied space. An FSA must be conducted to determine minimum security requirements. An FSA should be completed prior to occupying the building but if that is not possible, an FSA must be completed no later than six months after occupancy.

  2. If a CCC is co-located in facilities with IRS controlled perimeter and/or facility access, IRS will ensure that the CCC meets the criteria established by the ISC standards for that facility.

    Note:

    For additional information, see ISC Appendix C: Child Care Centers for further requirements. Physical security staff and management must ensure that countermeasures are in place to minimize risk and ensure that only authorized individuals are provided access.

Interior Space Planning - Open Office Concept

  1. The open office concept requires different security considerations from the traditional style individual office concept. In open office planning, an entire open area must be treated in its entirety with perimeter security provided that is commensurate with the security needs of the most critical operation. During operating hours, entrance areas should be arranged to control visitor access such as channeling visitors to a receptionist.

  2. Because of the increasing costs of office space, construction/alteration and the implementation of the "open office" concept, it is imperative that security considerations be addressed whenever IRS space is designed, acquired, altered or redesigned. A failure to consider adequate security during the early phases of space planning could result in the need for costly modifications after the completion of the project. In "open office" environments, we must ensure that acoustical planning guidelines are considered to minimize the potential for inadvertent unauthorized disclosures and to reduce ambient noise to an acceptable level. Security personnel and operational managers must be aware of the acoustical design goals for "open office" planning, and the speech privacy considerations.

  3. All managers will ensure that open office concept plans provide for:

    1. perimeter security commensurate with the needs of the most critical operation to be performed in the office.

    2. use of dividers, as appropriate, to separate operational areas and to minimize extraneous traffic.

    3. functional aural and visual privacy to minimize inadvertent disclosures of tax and privacy data.

    4. appropriate storage for items requiring protection when they are not in plain sight of the owner/user and during non-duty hours.

Alternative Duty Stations - IRS Telework Program

  1. The IRS Telework Program provides employees the opportunity to perform their duties at alternative duty stations remote to the conventional office site (e.g., satellite locations, employee’s residence). The policy of the IRS is to provide the highest level of protection to critical data, including taxpayer related information, and to assure that proper controls are in place to secure information that is being processed at satellite locations or in the residences of employees. The standards provided in IRM 10.2.11 will be applied to satellite locations and the home environment. Files containing critical IRS information or data will be secured when not in use or not in the possession of the telework employee. Employees are responsible for protecting all government records and data against unauthorized disclosure, access, mutilation, obliteration or destruction.

    Note:

    For additional guidance on Employee Responsibilities, see IRM 6.800.2, Employee Benefits, IRS Telework Program.

Critical Areas

  1. Certain areas in the IRS require more protection or are considered more critical due to one or more of the reasons listed below and should be given special attention during planning. The protection given critical areas during construction and redesign will minimize the need for costly safeguards to protect information once the areas become functional. Critical Areas could:

    1. contain large amounts of cash, negotiable instruments, and valuable property (which can be easily stolen or damaged).

      Note:

      For additional guidance, see Taxpayer Assistance Center (TAC) Design Guide

      .

    2. contain large amounts of information requiring protection or in highly concentrated and easily alterable or destroyable form.

    3. have a process or function being performed in the area that is critical and must be protected.

    4. have personnel in the area that due to the positions they hold (e.g., executives), the functions they perform, or employees with disabilities that may be subject to potential threats such as assault, hostage taking, robbery, etc.

  2. The following critical areas require minimum protective measures:

    1. Computer Rooms - Computer room walls must be slab-to-slab and where feasible should be in a central building location away from the building exterior, parking garages or top floor locations. Computer rooms will be windowless and lockable with controlled access into the area. Computer rooms are secured, Limited Areas. Access must be controlled in accordance with Limited Area standards. Computer rooms must be secured with IDS systems and monitored 24/7.

      Note:

      For additional guidance, also see National Fire Protection Association (NFPA) Standard No. 75, Section 25.

    2. Tape Libraries - Tape library walls must be slab-to-slab and where feasible should be in a central building location away from the building exterior. Tape libraries are secured, Limited Areas and must meet Limited Area standards. Access must be controlled in accordance with standards.

      Note:

      For additional guidance, also see NFPA Standard No. 75, Section 25.

    3. Telecommunications Closet - The telecommunications closet walls must be slab-to- slab and must be lockable with access permitted only for authorized personnel.

    4. All BACS - Mechanical/Electrical Rooms - Security control and power distribution boxes and panels must be in secured closets/rooms. Doors must be key locked, keys controlled, and access limited to authorized personnel only.

      Note:

      For additional information, see ISC Appendix B for additional BACS requirements and security criteria.

    5. Armory - Weapons and ammunition storage areas require additional measures that include limiting unescorted access to authorized law enforcement, armed security personnel, authorized contract supervisors, quality control inspectors, FMSS Physical Security Contracting Officer’s Representative (COR), policy office quality assurance review personnel, and those with oversight authority. Without exception, all Armories/Arms Rooms must be constructed of ballistic resistant material (e.g. masonry, steel or Kevlar materials) including the door, ceiling and floor, that would prohibit an accidentally discharged firearm projectile from escaping the confines of the armory/arms room space endangering the lives of building occupants. Armory /arms rooms cannot be used as office space and should never be occupied by persons except those performing armory duties and functions.

      Note:

      Additional governing standards and criteria include: ISC, NIST, the Federal Information Processing Standards (FIPS) and NFPA standards.

Vehicle ID - FSL IV Facilities

  1. In accordance with ISC standards, utilize a parking pass or other similar system to clearly identify authorized vehicles upon entry and while parked. Passes must be visible, numbered, and have an expiration date. Issuance should be managed by the servicing FMSS Physical Security office. Visitor parking must be located as far from the facility as practical. Proper vehicle ID is required for entering controlled parking. This can be accomplished by guards checking ID cards and media (stickers, decals, hang tags, etc.). Vehicle ID media, when used, will meet the following specifications.

    1. Materials used in stickers will be reflective vinyl

    2. Dimensions - 2 3/4” X 4 3/4” (minimum)

    3. All printing (including serial numbers) 1 1/2” high (minimum)

    4. Style of printing - block letters in upper case

    5. Colors may be used to further identify owners of registered vehicles

    6. Media should be designed so that they cannot be reused when removed

  2. The media will be placed so that they can be readily seen by the guard. Stickers/identifiers may be placed on either rear side windows, front or rear windows, or any other prominent location that is compliant with state and local laws.

  3. The FMSS Physical Security office is responsible for development, implementation, maintenance and control of the vehicle ID system.

  4. Records of all media issued and their disposition (i.e. lost, stolen, destroyed) will be maintained by the FMSS Physical Security office for a period of three years.

    Note:

    For additional information on the National Archives and Records Administration (NARA) approved records disposition authority, see the General Records Schedule 5.6, Security Records on the Nara website.

  5. Concurrent with the issuance of a vehicle ID, the employee will be informed of the requirement to remove and return the media or remains to the FMSS Physical Security office prior to selling or trading the vehicle, or if that area on the vehicle where the media is affixed is damaged and replaced. In addition, the FMSS Physical Security office must be informed when the identifier is destroyed, lost or stolen.

  6. The identifier will be removed from vehicles of employees who terminate employment.

  7. Identifiers will be replaced at the discretion of the local FMSS physical security office; consideration should be given to loss rates and frequency of turnover. Color scheme and designation should be varied each time the identifiers are changed.

  8. Vehicle passes, logs, written advance notice of visits, etc. can be used to authorize access to vehicles of employees, visitors and cleared contractors who have not been issued a sticker by the guard at the parking gate.

  9. Temporary vehicle passes may be issued to employees who do not have vehicle identifiers, providing they show an authorized IRS ID card. A log will be maintained by the guard showing all the following information:

    1. Vehicle pass number

    2. Name of employee

    3. Vehicle license number

    4. Date of issue

  10. The temporary pass must display the license plate number, expiration date, and permit number. If an employee does not have a proper IRS ID card, their employment status must be verified by checking with the appropriate IRS supervisor. Temporary vehicle passes for employees may not exceed 30 days. If necessary, the permit may be reissued after the 30-day period.

  11. Visitors can be issued a Visitor Vehicle Pass. Visitors must show a picture ID and must be on the approved access list. The vehicle pass may not be used for in and out access, but rather the visitor must show a picture ID and be checked against the access list each time he/she enters. A Visitor Vehicle Pass is valid for the date of issuance only and must be dated.

  12. Temporary Vehicle Passes may be issued to vendors and others requiring access. These individuals must show a picture ID and must be on the approved access list. The vehicle pass may not be used for in and out access and is valid for the date of issuance only and must be dated. The vehicle pass will be recovered by the guard when individuals exit the facility.

  13. If ID of employee vehicles is going to be made by use of the parking permit (that is cannot be adhered to the vehicle to prevent tampering) in lieu of vehicle ID stickers or windshield decals, these permits will show a serial number and the employee must show IRS ID to guard to gain access.

  14. The FMSS Physical Security office will follow the same procedures for the parking permits as are used for stickers or decals for issuance, records maintenance and recovery.

Interior Security and Control

  1. Each Designated Official (DO), in collaboration with the FMSS Physical Security Section will institute such internal controls beyond the minimum as are necessary to properly protect employees, assets, and preserve the confidentiality of the tax return and related documents.

  2. Control of the internal movement of personnel within a facility is necessary to ensure that only authorized IRS personnel are permitted in critical security areas. The ID card has been designed to assist management in maintaining this internal control. The need to maintain security always requires that only authorized visitors be permitted to enter the facility. Granting access to interested non-tax related individuals or groups for purposes of orienting them with operations are not authorized.

    Note:

    For additional information on access control, see IRM 10.2.18, Physical Access Control (PAC).

Limited Area

  1. The designation of Limited Area, formerly called Restricted Area, is a method of controlling the movement of individuals and eliminating unnecessary traffic through critical security areas, thereby reducing the opportunity for unauthorized disclosure or theft of tax information.

  2. A SmartID card containing the "R" indicator must always be worn by all personnel within each Limited Area as outlined in IRM 10.2.5, Identification Media.

  3. Admittance to a Limited Area is permitted only on a valid business need. Limited Areas include, but are not limited to:

    1. Any space housing Continuity of Operations (COOP)

    2. Computer Media Safe/Vault

    3. Computer Room

    4. Computer Room Command Center

    5. Computer Tape/Media Storage Library

    6. Consolidated Files

    7. Intermediate Data Frame (IDF)

    8. Master Data Frame (MDF)

    9. Mail/Receipt Room

    10. Micro/Mini Computer Room

    11. Receipt and Control

    12. Remittance Processing (RPS)

    13. Returns Files

    14. SAMC

      Note:

      For additional information on access control for a Limited Area, see IRM 10.2.18, Physical Access Control (PAC).

Controlled Area

  1. A controlled area is not a Limited Area; however, it requires controlled entry access with one-part authentication (access card or manual combination). Only personnel assigned to work in that area and other personnel designated by the responsible business unit are authorized unescorted access into a controlled area. All visitors entering a controlled area must be escorted by personnel with authorized unescorted access into a controlled area.

  2. Controlled Areas include, but are not limited to:

    1. Alarm Panel room/closet

    2. Central Security Control Console (CSCC)

    3. Other similar facilities designated for controlled access by the responsible business unit

      Note:

      For additional information on access for a Controlled Area, see IRM 10.2.18, Physical Access Control.

Remittance Processing Areas

  1. The entire Remittance Processing area will adhere to Limited Area security criteria. Keys and lock combinations to cash drawers, cash boxes and the security containers will be strictly issued and controlled as outlined in IRM 10.2.14, Methods of Providing Protection.

  2. The remittance clerk will:

    1. lock the cash drawers and remove the key when leaving the area.

    2. empty the cash drawers and store cash boxes in an appropriate container at the end of each work day.

Facility Security Level (FSL) V Protective Measures

  1. The activities performed at Level V facilities are unique and vital to the mission of the IRS. The nature and significance of Level V facility operations require the implementation and maintenance of a sound physical security program.

  2. To provide a minimum acceptable level of protection, ISC FSL criteria must be met as well as all other requirements outlined in this section. The requirements outlined in this section will be implemented and maintained at all Level V facilities.

  3. While some Level IV facilities may have interior space that is designated by IRS as Level V, such as Automated Data Processing (ADP) Computer Rooms, this section applies to facilities and campuses with Level V designation throughout. The five factors quantified to determine the FSL are:

    1. Mission criticality

    2. Symbolism

    3. Facility population

    4. Facility size

    5. Threat to tenant agencies

    6. Intangible factors

  4. Additionally, all facilities that house, in addition to IRS mission critical ADP Processing and/or tax processing, at least seven of the following business functions are considered Level V throughout:

    1. Treasury Departmental Office Continuity relocation space

    2. Treasury or IRS Continuity or Business resumption assets

    3. Continuity plans that included relocation of high level government officials, agency heads, and/or senior leadership in the event of a national emergency to ensure Continuity of Government

    4. Conducts government business at a classified, Secret, or Top Secret level with National Security nexus

    5. Campus/Facility serves as a Sensitive Compartmented Information Facility (SCIF) for government operations

    6. Serves Treasury, Treasury Office of Continuity (TOC) or IRS SAMC/Threat Response Center (TRC) functions

    7. Houses critical TIGTA assets

    8. Houses and supports critical IRS Criminal Investigation Division (CID) assets/operations

    9. Houses IT/research, analysis and statistics assets with Congressional responsibility

    10. Houses Financial Crimes Enforcement Network (FinCEN) critical assets and provides logistics and support to the FinCEN mission and continuity functions

    11. Houses U.S. Department of the Treasury, Departmental Office (DO) staff as a permanent POD conducting Treasury emergency/mission critical functions

Interior Security and Control

  1. Control of the internal movement of personnel is necessary to ensure that only authorized IRS personnel are permitted in critical areas. The personnel identification card has been designed to assist management in maintaining this internal control.

  2. The local FMSS Physical Security staff office, in accordance with FMSS Identity Credential & Access Management (ICAM) and other applicable Treasury and IRS policies will administer the personnel identification card program which will permit entry only to authorized personnel. This system is also designed to assist management in controlling movement within the facility.

  3. Requests for tours of the facility must should be made in writing and sent to the FMSS Physical SSC. The tour participants must be listed in the request and identities confirmed through the use of a photo ID at the onset of the tour. Tours of the facility (except the computer area) require the approval of the director of the facility.

  4. Tours of the computer area require approval of the Chief of IT Systems Operations Branch in addition to the FMSS Physical SSC and facility director. A senior official must conduct the tour.

    Note:

    For additional information on access control, see IRM 10.2.18, Physical Access Control (PAC).

Teller Operations

  1. Certain minimum-security measures are required to protect currency and other negotiable items received by the teller. These measures include the following:

    1. The teller operation may be located in the same area as other taxpayer assistance operations, however, direct access to the teller area will be physically limited by bank-type counters, counter-high partitions, lockable half-doors, or some similar type of construction that provides equal protection. When this operation is located on the ground floor of a building with windows to the exterior grade level, windows will be alarmed.

    2. The exact construction of the teller area and the type of security container needed will depend on the average daily receipts, the location of the IRS office and other appropriate security considerations. For this reason, FMSS will be consulted before making any changes to the teller area.

    3. The use of appropriate duress alarm systems must be considered for these areas. The alarm will annunciate at the control center (Facility Protection Officer, local police, etc.) or may alarm in the TIGTA, or the IRS CID function if that office is located on-site and has a response team available.

    4. Money chests, vaults or cabinets affording adequate security must be available for deposit activities in a designated area of the office.

    5. Each teller will be provided with a separate money bag, cash box, or compartment (depending on the protective facilities used) which opens with a separate key or combination. Each teller may also be furnished with the combination to the safe.

  2. Excess currency will not be kept in the teller area. As often as business permits, currency in excess of the change making fund will be transferred to a security container. It is preferable to have this located in a room away from the teller area. However, if this cannot be accomplished, the FMSS Physical Security staff will be consulted for assistance in determining the most secure alternate location.

    1. Whenever a teller operation area is left unattended, tellers’ cash drawers or boxes must be locked in the safe and all protectable items must be containerized. During a teller’s brief absence, when the area is unattended, that teller’s cash drawer, or box must be locked, and the key removed.

    2. Cash drawers must be emptied, and cash boxes stored in the security container at the end of each workday.

    3. After the balancing operation has been completed, the cash must be kept in a locked container to wait deposit. The key to that container should be held by the teller’s immediate supervisor.

  3. Keys and lock combinations for cash drawers, cash boxes and the security containers will be protected, controlled and changed.

    1. If it becomes necessary to open a teller’s locked compartment in the absence of the teller, the manager will assign two responsible employees who will be responsible for utilizing the duplicate key or combination. They must count the money and documents found, sign the statement and attach it to the receipt that the teller previously signed for the change fund.

    2. The duplicate keys to tellers’ cash containers and the copy of the combination to the safe or vault are not to be in the possession of the same employee.

  4. Managers will make unannounced reviews of the physical and fiscal security of teller operations in accordance with IRM 1.4.6, Managers Security Handbook.

  5. "Received" and "Received with Remittance" stamps will be assigned to specific employee’s individuals and a record kept by serial number of each assignment. The number of stamps in each office will be held to a practical minimum. Each individual assigned a stamp should furnish sufficient physical protection to safeguard against unauthorized or indiscriminate use. When a stamp is not in use, it will be stored in a locked container under the exclusive control of the individual to whom the stamp is assigned. Where this is not practical, special care must be exercised to ensure against unauthorized use. The face of each stamp will be inscribed with the following elements:

    1. "Internal Revenue Service"

    2. "Received"

    3. The Month, Day and Year

    4. The Stamp’s serial number

  6. Taxpayer Advocate Service (TAS) Adjacency Requirements

    1. Interview rooms and conference rooms should be adjacent to the reception area.

    2. TAS should not be adjacent to Criminal Investigation (CI) or any compliance function.

      Note:

      For additional TAC requirements, see the Taxpayer Assistance Center (TAC) Design Guide.

Protection of Mail

  1. Incoming mail, not being distributed or processed, will be stored in a secured area or in locked containers when possible. Mail, incoming and outgoing, will not be left unattended in areas open to the public.

Handling of Suspicious Mail and Packages

  1. In accordance with ISC guidelines and procedures, mail should be opened in centralized or officially designated mail opening areas. All designated mail rooms and mail opening areas must have Safe/Suspicious Mail Handling and Incident Reporting procedures posted for all mail opening employees and/or contractors to view. At a minimum, the following guidance and procedures will be posted within the mail opening area and employed when handling suspicious mail and packages.

  2. Features of a suspicious package or packages:

    1. with soft spots or lopsided

    2. wrapped with string

    3. containing distorted handwriting

    4. that have leaks, stains, powders, or protruding materials

    5. containing no or excess postage

    6. containing an odor

  3. Procedures to be followed when handling suspicious letters and packages:

    1. Remain calm

    2. Do not open the letter or package

    3. Do not shake or empty contents of package

    4. Do not carry the package to show it to others

    5. Make a list of all persons who touched the package

    6. Put the package on a stable surface

    7. Do not touch your eyes, nose, or other body parts

    8. Isolate the package and secure the room

    9. Wash your hands with soap and water

  4. Reporting the incident:

    1. Call first responders for your respective office (local guard service)

    2. Report to your manager and call 911

    3. Contact FPS at 1-877-4FPS-411

    4. Contact TIGTA at 1-800-589-3718

    5. Report to SAMC within 30 minutes of incident discovery

      Note:

      IRS personnel should in no way attempt to act as a first responder or make determinations as to the safety of a substance. Only qualified emergency first responders, i.e. Hazardous Materials (HAZMAT) are authorized to make decisions related to the safety of suspicious items

  5. Incidents may be reported to SAMC through any of the following methods:

    1. SAMC Web-site link https://tscc.enterprise.irs.gov/irc/

    2. Telephone: 202-317-6124 or 1-866-216-4809

    3. Fax: 202-317-6129

    4. E-mail at samc@irs.gov

Computer Rooms

  1. Computer rooms will be slab-to-slab and where possible should be located in a central building location away from the building exterior, parking garages or top floor locations. Computer rooms will be windowless and lockable with controlled access into the area. Computer rooms are secured Limited Areas.

Off-Site Facilities

  1. Protection provided to off-site facilities, such as satellite buildings, and/or storage facilities, associated with Computing Centers and/or Campus locations, will depend on the use that is made of the space. The need for security guard service, electronic protective systems, Limited Areas and other type of secured areas will be evaluated on an individual basis.

Categories of Vulnerability Levels

Vulnerability Categories
The vulnerability assessment considers the potential impact from a successful attack, as well as the vulnerability of the facility/location to attack. A key component of the vulnerability assessment is properly defining the ratings for impact of loss.
Devastating The facility is damaged beyond habitation. Most items/assets are lost, destroyed, or damaged beyond repair restoration.
Severe The facility is partially damaged or contaminated. Some items/assets are damaged beyond repair/restoration, but the facility remains mostly intact.
Noticeable The facility is temporarily closed or unable to operate without an interruption of more than one day. A limited number of items/assets may be damaged, but the majority of the facility is not affected.
Minor The facility experiences no significant impact on operation (disruption to operation is less than four hours) and there is no loss of major assets.

Vulnerability Ratings

Vulnerability Ratings
Vulnerability is defined to be a combination of the attractiveness of the target and the level of deterrence and/or defense provided by established countermeasures. Target attractiveness is a measure of the asset or facility in the eyes of an aggressor and is influenced by the function and/or symbolic
Very High This is a high-profile facility that provides a very attractive target for potential adversaries. The level of deterrence and/or defense provided by the existing countermeasures is inadequate.
High This is a high-profile regional facility that provides an attractive target. The level of deterrence and/or defense provided by the existing countermeasures is inadequate.
Moderate This is a moderate profile facility (not well known outside the local area) that provides a potential target. The levels of deterrence and/or defense provided by the existing countermeasures are marginally adequate.
Low This is not a high-profile facility and provides a possible target. The level of deterrence and/or defense provided by the existing countermeasures is adequate.

SAFEGUARDS and Their Related Protection Functions

Safeguards Deter Delay Detect Assess Identify Track Respond Deny
Intervene Apprehend Access
 
Alarms x   x x* x x x** x**  
 
Areas x x x   x        
 
Building x x x            
 
CCTV x   x x x x      
 
Containers x x x            
 
Degaussers                 x
                   
Document Destructors and Shredders                 x
 
Entry Control Systems x   x x x x     x
 
Fences x x              
 
Guards x x x x x x x x x
 
ID Media Systems x   x   x        
 
Locks x x x            
 
Procedures (e.g., Audit Trail) x   x   x x      
 
Secured Areas/ Security Rooms x x x            
 
Signs x                
 
Task Separation Compart- mentation x                
Note: The functions of each safeguard may vary according to the quality of the safeguard and the nature of the threat. The chart represents generally the functions each safeguard provides. Not included here are other functions such as promoting awareness of security to meet responsibilities to prevent violations or crimes, and investigation and appropriate remedial actions for violations. These are not within the scope of the manual.
*Alarms can be arranged to determine the extent of a fire (by zoning) or the nature of unauthorized entry (by duress to an authorized entrant).
** Alarm systems can be designed to provide for a response force; by themselves of course, they merely annunciate an unauthorized access. Programmed into an integrated system can be instructions to automatically shut doors, operate cameras, start/stop sprinklers, or perform other actions which go beyond detection and assessment of a threat to intervening or, as in the case of some entry controls, rejecting personnel who attempt an unauthorized access.