ENCLOSURE 3. STORAGE AND DESTRUCTION
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 3
Change 3, 07/28/2020 35 ENCLOSURE 3
STORAGE AND DESTRUCTION
1. GENERAL REQUIREMENTS
a. Classified information shall be secured under conditions adequate to deter and detect access by unauthorized persons. The requirements specified in this Volume represent acceptable security standards. DoDD 5210.56 (Reference (ah)) specifies DoD policy concerning the use of force for the protection of classified information. Do not store weapons or items such as funds, jewels, precious metals, or drugs in the same container used to safeguard classified information. Holdings of classified material should be reduced to the minimum required to accomplish the mission.
b. GSA establishes and publishes minimum standards, specifications, and supply schedules for containers, vault doors, modular vaults, alarm systems, and associated security devices suitable for storing and protecting classified information. DoDI 3224.03 (Reference (ai)) describes requirements for acquiring physical security equipment for use within the Department of Defense.
c. The DNI establishes security requirements for sensitive compartmented information facilities (SCIFs). These are issued by Reference (i) within the Department of Defense.
d. The DoD Lock Program is designated as the DoD technical authority for locking and storage systems used for the protection of classified information. For technical support, call the DoD Lock Program Technical Support Hotline at 1-800-290-7607 or DSN 551-1212 or review the website at https://locks.navfac.navy.mil, for more information.
e. Volume 4 of this Manual specifies storage and destruction requirements for controlled unclassified information.
2. LOCK SPECIFICATIONS. Except as provided elsewhere in this Volume, combination locks on vault doors, secure rooms, and security containers protecting classified information shall conform to Federal Specification FF-L-2740 (hereafter referred to as “FF-L-2740”)(Reference (aj)).
3. STORAGE OF CLASSIFIED INFORMATION BY LEVEL OF CLASSIFICATION. Store classified information not under the personal control and observation of an authorized person, in a locked security container, vault, room, or area, as specified in this section.
a. Top Secret. Top Secret information shall be stored:
(1) In a GSA-approved security container with one of the following supplementary
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 3
Change 3, 07/28/2020 36 controls:
(a) An employee cleared to at least the Secret level shall inspect the security container once every 2 hours.
(b) The location that houses the security container is protected by an intrusion detection system (IDS) meeting the requirements of the Appendix to this enclosure with personnel responding to the alarm arriving within 15 minutes of the alarm annunciation.
(2) In a GSA-approved security container equipped with a lock meeting FF-L-2740, provided the container is located within an area that has been determined to have security-in- depth (see Glossary for definition);
(3) In an open storage area (also called a secure room) constructed according to the Appendix to this enclosure and equipped with an IDS with the personnel responding to an alarm within 15 minutes of the alarm annunciation if the area has been determined to have security-in- depth, or within 5 minutes of alarm annunciation if it has not;
(4) In a vault, or GSA-approved modular vault, meeting the requirements of Federal Standard (FED-STD) 832 (Reference (ak)) as specified in the Appendix to this enclosure; or
(5) Under field conditions during military operations, using such storage devices or security control measures as a military commander deems adequate to prevent unauthorized access. Military commanders should employ risk management methodologies when determining appropriate safeguards.
b. Secret. Secret information shall be stored by one of the following methods:
(1) In the same manner as prescribed for Top Secret information;
(2) In a GSA-approved security container or vault built to FED-STD 832 specifications, without supplementary controls;
(3) In an open storage area meeting the requirements of the Appendix to this enclosure, provided the senior agency official determines in writing that security-in-depth exists, and one of the following supplemental controls is utilized:
(a) An employee cleared to at least the Secret level shall inspect the open storage area once every 4 hours.
(b) An IDS meeting the requirements of the Appendix to this enclosure with the personnel responding to the alarm arriving within 30 minutes of the alarm annunciation.
(4) In a secure room that was approved for the storage of Secret information by the DoD Component prior to October 1, 1995, provided the DoD Component reassesses the requirement for the secure room and makes plans to bring the room up to the standards of subparagraphs
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 3
Change 3, 07/28/2020 37 3.b.(1) through 3.b.(3) of this section by October 1, 2013 and provided the area has been determined to have security-in-depth.
c. Confidential. Confidential information shall be stored in the same manner as prescribed for Top Secret or Secret information except that supplemental controls are not required.
4. RISK ASSESSMENT. When considering the storage alternatives specified in section 3, a risk assessment shall be performed to facilitate a security-in-depth determination and to aid identification and selection of supplemental controls that may need to be implemented. The analysis should, at a minimum, consider local threats, both known and anticipated, and vulnerabilities; the existing security environment and controls; the ease of access to containers or other areas where classified data is stored; the criticality, sensitivity, and value of the information stored; and cost verses benefits of potential countermeasures. The risk assessment shall be used to determine whether installation of an IDS is warranted or whether other supplemental controls are sufficient.
5. U.S. CLASSIFIED INFORMATION LOCATED IN FOREIGN COUNTRIES. Except for classified information that has been authorized for release to a foreign government or international organization in accordance with Reference (y), and is under that government’s or organization’s security control, U.S. classified material may be retained and stored in a foreign country only when necessary to satisfy specific U.S. Government requirements. The Heads of the DoD Components shall prescribe requirements for protecting this information, paying particular attention to ensuring proper enforcement of controls on release of U.S. classified information to foreign entities. Compliance with the provisions of this enclosure is required. U.S. classified material in foreign countries shall be stored at a:
a. U.S. military installation, or a location where the United States enjoys extraterritorial status, such as an embassy or consulate.
b. U.S. Government activity located in a building used exclusively by U.S. Government tenants, provided the building is under continuous (i.e., 24/7) control by U.S. Government personnel.
c. U.S. Government activity located in a building not used exclusively by U.S. Government tenants which is under host government control, provided that the classified material is stored in GSA-approved security containers which are further secured in a locked room or area to which only U.S. personnel have access and the room or area is under continuous (i.e., 24/7) control by U.S. Government personnel.
d. U.S. Government activity located in a building not used exclusively by U.S. Government tenants nor under host-government control, provided the classified material is stored in GSA- approved security containers and is placed under continuous (i.e., 24/7) control by U.S. Government personnel.
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 3
Change 3, 07/28/2020 38
6. SPECIALIZED STORAGE
a. Military Platforms
(1) The Heads of the DoD Components shall, consistent with this Volume, delineate the appropriate security measures required to protect classified information stored in security containers on military platforms (e.g., aircraft, militarized or tactical vehicle) and for classified munitions items.
(2) GSA-approved field safes and special size one- and two-drawer security containers approved by the GSA may be used for storage of classified information in the field and in military platforms. These containers shall use locks conforming to FF-L-2740 or Federal Specification FF-L-2937 (Reference (al)), as required by Federal Specification AA-F-358 (Reference (am)). Special size containers shall be securely fastened to the platform; field safes shall be under sufficient control and surveillance when in use to prevent unauthorized access or loss.
b. IT Equipment. GSA-approved information processing system cabinets are available for protection of operational IT equipment. The cabinets can be used for storage of network equipment (such as routers, switches, and crypto devices), servers, power control units, and laptops and can be configured for rack mounting with interior fans for heat management and cable connections for exterior data transmission and power.
c. Map and Plan File Cabinets. GSA-approved map and plan file cabinets are available for storing odd-sized items such as computer media, maps, charts, and classified equipment.
d. Modular Vaults. GSA-approved modular vaults meeting Federal Specification AA-V- 2737 (Reference (an)) may be used to store classified information as an alternative to vault requirements described in the Appendix to this enclosure.
e. Bulky Material. Storage areas for bulky material containing Secret or Confidential information may have access openings (e.g., roof hatches, vents) secured by GSA-approved changeable combination padlocks meeting Federal Specification FF-P-110 (Reference (ao)). Other security measures are required, in accordance with paragraphs 3.b. and 3.c. of this enclosure.
(1) When special circumstances exist, the Heads of the DoD Components may authorize the use of key operated locks for storing bulky material containing Secret and Confidential information. The authorization shall be documented with an explanation of the special circumstances that warrant deviation from other established standards. Whenever using such locks, administrative procedures for the control and accounting of keys and locks shall be established. The level of protection provided to such keys shall be equivalent to that afforded the classified information the padlock protects.
(2) Section 1386 of title 18, United States Code (U.S.C.) (Reference (ap)), makes
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 3
Change 3, 07/28/2020 39 unauthorized possession of keys, key-blanks, keyways, or locks that any part of the Department of Defense adopts for protecting conventional arms, ammunition, or explosives, special weapons, and classified equipment, a criminal offense punishable by fine or imprisonment for up to 10 years, or both.
7. PROCURING NEW STORAGE EQUIPMENT. New security storage equipment shall be procured from those items listed on the GSA Federal Supply Schedule. When GSA-approved security containers or vault doors with locks meeting FF-L-2740 are placed in service or when existing mechanical locks are replaced with locks meeting FF-L-2740, the custodian or security manager shall record the lock serial number on an SF 700, “Security Container Information.” For procurement or technical support, call the DoD Lock Program as specified in paragraph 1.d of this enclosure.
8. SECURITY CONTAINER LABELS. GSA-approved security containers must have a label stating “General Services Administration Approved Security Container,” affixed to the front of the container, usually on the control or the top drawer.
a. If the label is missing or if the container’s integrity is in question, the container shall be inspected by a GSA certified inspector. Information on obtaining inspections and recertification of containers can be found on the DoD Lock Program Website (https://locks.navfac.navy.mil) or by calling the DoD Lock Program at (800) 290-7607 or DSN 551-1212.
b. When the container is being sent to the Defense Reutilization and Marketing Office, the GSA label shall be removed.
9. EXTERNAL MARKINGS ON CONTAINERS. There shall be no external mark revealing the level of classified information authorized to be or actually stored in a given container or vault, or indicating the priority assigned to the container for emergency evacuation and destruction. This does not preclude placing a mark or symbol (e.g., a bar code) on the container for other purposes (e.g., identification and/or inventory purposes) or from applying decals or stickers the DNI requires for containers and equipment used to store or process intelligence information. If a GSA container or vault door recertification is required, such labels and markings must be removed, but may be reapplied as needed after recertification.
10. SECURITY CONTAINER INFORMATION. Maintain a record for each container, or vault or secure room door, used for storing classified information. SF 700 with all information blocks completed, shall be used for this purpose. Update the form each time the security container combination is changed.
a. Part 1 of SF 700 is not classified, but contains personally identifiable information (PII) that shall be protected by sealing Part 1 in an opaque envelope (not provided as part of the SF 700) conspicuously marked “Security Container Information” and stored in accordance with SF
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 3
Change 3, 07/28/2020 40 700 instructions. If the information must be accessed during non-duty hours and a new opaque envelope is not available to replace the opened one, the original envelope should be temporarily resealed, to the extent possible, until Part 1 can be placed in a new envelope the next working day.
b. Part 2 of SF 700, when completed, is classified at the highest level of classification authorized for storage in the security container. It shall be sealed and stored in accordance with SF 700 instructions. The classification authority block shall state “Derived From: 32 CFR 2001.80(d)(3)),” with declassification upon change of combination.
11. COMBINATIONS TO CONTAINERS, VAULTS AND SECURE ROOMS
a. Protecting and Storing Combinations. In accordance with section 2001.45(a)(1) of Reference (f), the combination shall be classified at the same level as the highest classification of the material authorized for storage in the container.
(1) Use SF 700 Part 2, as specified in section 10 of this enclosure, to record the combination and other required data.
(2) If another record of the combination is made, the record shall be marked as required by Volume 2 of this Manual.
(3) Only a minimum number of authorized persons shall have knowledge of combinations to authorized storage containers, including vaults and secure rooms.
(4) Security containers, vaults, secure rooms and other authorized storage containers shall be kept locked when not under the direct supervision of an authorized person entrusted with the contents.
(5) A record of the names of persons having knowledge of the combination shall be maintained.
b. Changing Combinations. Only individuals with the responsibility and an appropriate security clearance shall change combinations to security containers, vaults and secure rooms used for storing classified information. Combinations shall be changed:
(1) When the container, vault, or secure room door is placed in service.
(2) Whenever an individual knowing the combination to the container or vault door no longer requires access, unless other sufficient controls exist to prevent that individual’s access to the lock.
(3) When compromise of the combination is suspected.
(4) When the container, vault, or secure room door is taken out of service or is no longer
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 3
Change 3, 07/28/2020 41 used to store classified information, at which time built-in combination locks shall be reset to the standard combination 50-25-50, and combination padlocks shall be reset to the standard combination 10-20-30.
12. ENTRANCES TO OPEN STORAGE AREAS FOR CLASSIFIED INFORMATION
a. When areas storing classified information are occupied by authorized individual(s), the entrances shall either be:
(1) Under visual control at all times to detect entry by unauthorized persons; or
(2) Equipped with an automated entry control system to limit access (see section 3 of the Appendix to this enclosure).
b. Secure rooms or other areas storing classified information shall be secured when the area is not occupied by authorized individual(s) or under continual visual control.
c. The Appendix to this enclosure provides standards for access control devices. Electrically actuated locks (e.g., magnetic strip card locks) do not, by themselves, meet the required standards for protecting classified information and shall not be used as a substitute for the locks prescribed in section 2 of this enclosure.
13. INSPECTION OF STORAGE CONTAINERS PRIOR TO REMOVAL, REPAIR, ETC. Cleared personnel shall inspect storage containers that may have been used to store classified information before removing them from protected areas or allowing unauthorized persons access to them to ensure no classified material remains within.
14. NEUTRALIZATION AND REPAIR PROCEDURES. The procedures described in FED- STD 809 (Reference (aq)) shall be followed for neutralization and repair of security containers and vault doors. Reference (aq) can be found on the DoD Lock Program Website, https://locks.navfac.navy.mil.
a. Neutralization and repair of a security container or door to a vault approved for storage of classified information shall be accomplished only by appropriately cleared or continuously escorted personnel specifically trained in the methods specified by Reference (aq).
b. Neutralization or repair by, or using, methods and procedures other than described in Reference (aq) is considered a violation of the security container’s or vault door’s security integrity and the GSA label shall be removed. Thereafter, the containers or doors may not be used to protect classified information.
15. STORAGE OF FGI. To the extent practical, FGI shall be stored separately from other
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 3
Change 3, 07/28/2020 42 information to facilitate its control. To avoid additional costs, separate storage may be accomplished by methods such as using separate drawers in the same container as other information or, for small amounts, the use of separate file folders in the same drawer.
16. RETENTION OF CLASSIFIED INFORMATION. Classified documents and other material shall be retained within DoD organizations only if they are required for effective and efficient operation of the organization or if law or regulation requires their retention. Documents no longer required for operational purposes shall be disposed of according to the provisions of chapter 33 of Reference (t) and appropriate implementing directives and records schedules, and in accordance with sections 17 and 18 of this enclosure.
17. DESTRUCTION OF CLASSIFIED INFORMATION. Classified documents and material identified for destruction shall be destroyed completely, to prevent anyone from reconstructing the classified information, according to procedures and methods the DoD Component Head prescribes. Methods and equipment used to routinely destroy classified information include burning, crosscut shredding, wet pulping, mutilation, chemical decomposition or pulverizing. Methods used for clearing, sanitization or destruction of classified IT equipment and media include overwriting, degaussing, sanding, and physical destruction of components or media.
a. Documents and other material identified for destruction shall continue to be protected as appropriate for their classification until actually destroyed.
b. Each activity with classified holdings shall establish at least 1 day each year when specific attention and effort is focused on disposing of unneeded classified material (“clean-out day”).
c. Guidance on standards, processes, and procedures for the destruction of COMSEC and other classified material can be found in Reference (r). NATO material shall be destroyed in accordance with Reference (ab). FGI shall be destroyed in the same manner as U.S. classified information of the equivalent level, except where otherwise required by international treaty or agreement. Also see Enclosure 2, subparagraphs 17.b.(7)(a) through (d) for guidance on recording FGI destruction.
d. Effective January 1, 2011, only equipment listed on an evaluated products list (EPL) issued by NSA may be used to destroy classified information using any method covered by an EPL. EPLs currently exist for paper shredders, punched tape destruction devices, optical media destruction devices (for compact discs (CDs) and digital video discs (DVDs)), degaussers (for magnetic media sanitization), and disintegrators (for paper and punched tape material). The EPLs may be obtained by calling (410) 854-6358 or at http://www.nsa.gov/ia/guidance/media_destruction_guidance/index.shtml.
(1) Equipment approved for use prior to January 1, 2011, and not found on the appropriate EPL may be used for destruction of classified information until December 31, 2016.
(2) Unless determined otherwise by NSA, whenever an EPL is revised, equipment
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 3
Change 3, 07/28/2020 43 removed from the EPL may be utilized for destruction of classified information for up to 6 years from the date of its removal from the EPL.
(3) In all cases, if any such previously approved equipment needs to be replaced or otherwise requires a rebuild or replacement of a critical assembly (e.g., shredder blade assembly), the unit must be replaced with one listed on the appropriate EPL.
e. Classified IT storage media (e.g., hard drives) cannot be declassified by overwriting. Sanitization (which may destroy the usefulness of the media) or physical destruction is required for disposal. See also section 6 of Enclosure 7 of this Volume.
18. TECHNICAL GUIDANCE ON DESTRUCTION METHODS. Contact the National Security Agency/Central Security Service (NSA/CSS) System and Network Analysis Center at (410) 854-6358 or via e-mail at [email protected], to obtain technical guidance concerning appropriate methods, equipment, and standards for destroying classified electronic media, IT equipment, electronic components, and other similar or associated materials.
a. Crosscut Shredders. Only crosscut shredders listed on the “NSA/CSS Evaluated Products List for High Security Crosscut Paper Shredders” (Reference (ar)) may be used to destroy classified material by shredding.
(1) The EPL is updated on an as-needed basis as new models are successfully evaluated. Users are encouraged to contact shredders manufacturers and/or distributors for assistance in selecting unit(s) best suited to their requirements. Vendors and/or distributors can provide guidance on whether a specific model not listed meets the specifications in Reference (ar) (e.g., for shred size) and, as applicable, a copy of the NSA/CSS letter confirming that the model will be included on the EPL at its next update.
(2) Crosscut shredders currently in use and not on the EPL that were at the time of acquisition on a NSA/CSS evaluated approved products list as being capable of maintaining a shred size of 1/2 inch by 1/32 inch (variance of 1/64 inch) may be used until December 31, 2016 in accordance with paragraph 17.d of this enclosure, EXCEPT for destruction of COMSEC materials. However, any such crosscut shredders requiring replacement of the unit and/or rebuild of the shredder blades assembly MUST BE REPLACED by a crosscut shredder on the latest NSA/CSS EPL. When COMSEC material is destroyed by shredding, ONLY crosscut shredders listed in Reference (ar) at the time of acquisition shall be used.
(a) Pending replacement, the Heads of DoD Components shall ensure that procedures are in place to manage the risk posed by crosscut shredders not on the approved NSA/CSS list. At a minimum, the volume and content of each activity’s classified material destruction flow shall be assessed and a process established to optimize the use of high security crosscut paper shredders (i.e., with top secret collateral material being the highest collateral priority) to take full advantage of the added security value of those shredders.
(b) The bag of shred must be “stirred” to ensure that the content is mixed up.
DoDM 5200.01-V3, February 24, 2012
ENCLOSURE 3
Change 3, 07/28/2020 44
(c) Shredding of unclassified material along with the classified material is encouraged.
b. Pulverizers and Disintegrators. Pulverizers and disintegrators must have a 3/32 inch or smaller security screen. Consult the “NSA/CSS Evaluated Products List for High Security Disintegrators” (Reference (as)) for additional details and guidance.
c. Pulping. Pulping (wet process) devices with a 1/4 inch or smaller security screen may be used to destroy classified water-soluble material.
19. DESTRUCTION PROCEDURES
a. The Heads of the DoD Component shall establish procedures to ensure that all classified information intended for destruction is destroyed by authorized means and appropriately cleared personnel.
b. Classified information that cannot be destroyed shall be reevaluated and, when appropriate, downgraded, declassified, or retired to a designated record center.
c. Classified information shall be controlled in a manner designed to minimize the possibility of unauthorized removal and/or access. A burn bag may be used to store classified information awaiting destruction at a central destruction facility. Seal and safeguard each burn bag per this Volume until actually destroyed.
d. Records of destruction are not required, except as noted in paragraph 17.c of this enclosure and, for destruction of classified FGI, in Enclosure 2, subparagraphs 17.b.(7)(a) through (d).
Appendix Physical Security Standards