[NASA Logo]

NASA Procedures and Guidelines

This Document is Obsolete and Is No Longer Used.
Check the NODIS Library to access the current version:
http://nodis3.gsfc.nasa.gov


NPR 1620.2A
Effective Date: October 07, 2015
Cancellation Date:
Responsible Office: LP2

Facility Security Assessments (Revalidated on December 13, 2019)


Table of Contents

Change History

Preface

P.1 Purpose
P.2 Applicability
P.3 Authority
P.4 Applicable Documents and Forms
P.5 Measurement/Verification
P.6 Cancellation

Chapter 1. Determining the Center/Facility Security Level (FSL)

1.1 General
1.2 Purpose of Center/Facility Security Level Determination
1.3 Risk
1.4 Undesirable Events
1.5 Vulnerabilities
1.6 Consequences
1.7 Assets

Chapter 2. Scoring Factors of the Determination Matrix

2.1 FSL Matrix
2.2 Mission Criticality
2.3 Symbolism
2.4 Facility Population
2.5 Facility Size
2.6 Campuses, Complexes, and Federal Centers
2.7 Undesirable Events to NASA
2.8 Intangible Factors

Chapter 3. Level V Centers/Facilities

Chapter 4. Transition to NPR 1620.3

Appendix A. Definitions
Appendix B. Acronyms


Change History

Change #
Date
Description
1
12/13/2019
Additional language added to clarify the difference between Department of Homeland Security/Interagency Security Committee, "Risk Management for Federal Facilities" Standard and NASA Facility Security Levels. (P.1, c.).
2
12/13/2019
Removed outdated language referencing CUI and replaced with current language.
3
12/13/2019
Changes made to remove all references to Facility Security Level (FSL) V. NASA does not use FSL V categorization. (1.1.3.d., 1.1.3.d.(1), and Chapter 3 in its entirety).


Preface

P.1 Purpose

a. This NASA Procedural Requirement (NPR) establishes NASA requirements for determining a Center/facility security level for NASA facilities, except Classified National Security Information (CNSI) and nuclear and chemical materials.

b. This security assessment procedure supports NASA's Center management in meeting the responsibility of protecting NASA's assets in a cost-effective manner. It is designed to assist security officers who support management and the NASA Security Program. The results of the physical security assessments are used to determine the appropriate level of protection needed to safeguard NASA's Center's/facilities adequately and economically.

c. The level of security adopted is based upon applicable physical security measures and security procedures contained in NPR 1600.1 and 1620.3. The methodology used in this document meets the Interagency Security Committee (ISC) Standards as outlined in "The Risk Management Process for Federal Facilities: an Interagency Security Committee Standard" published by the Department of Homeland Security (DHS). The results of the physical security vulnerability risk assessment are to be used to satisfy the requirements of Homeland Security Presidential Directive (HSPD)-7. The results of this assessment should also determine the corresponding criteria written in NPR 1620.3.

d. When completed, the results of the security assessment and mitigation plans is labeled and handled as Sensitive But Unclassified (SBU) in accordance with current policy and procedure (NID 1600.55).

[Note: Marking requirements for NASA sensitive unclassified information will be changed in FY 2016 (approximately) as Executive Order 13556 is executed and the current SBU program is replaced by the federally mandated Controlled Unclassified Information (CUI) program.] Until the CUI program is fully implemented, use of the CUI designation is not authorized. At the time of this version of NPR 1620.2, the policy for CUI has not been received from higher authority and is not implemented.

e. The overall purpose of this NPR and its sister document, NPR 1620.3, is to establish a baseline physical security posture for each assessed facility based on its mission criticality, symbolism, facility population, facility size, and undesirable event. Thereafter, subsequent changes in threat indicators could require the Center Security Chief to implement temporary security measures designed to mitigate threats based on current intelligence.

f. This assessment tool is a living document and will occasionally be updated to ensure its continued application and viability, based on direction from the DHS.

P.2 Applicability

a. This directive is applicable to NASA Headquarters and NASA Centers, including Component Facilities and Technical and Service Support Centers. This directive applies to the Jet Propulsion Laboratory, other contractors, grant recipients, or parties to agreements only to the extent specified or referenced in the appropriate contracts.

b. "Facility Security Level Determinations for Federal Facilities - An Interagency Security Committee Standard" (the Standard) defines the criteria and process to be used in determining the facility security level (FSL) of a Federal facility, a categorization which then serves as the basis for implementing protective measures under other ISC standards. Consistent with the authority contained in Executive Order (EO) 12977, dated October 19, 1995, the Standard is applicable to all buildings and facilities in the United States occupied by Federal employees for non-military activities. These include existing buildings, new construction, or major modernizations; facilities owned, to be purchased, or leased; stand-alone facilities, Federal campuses, and, where appropriate, individual facilities on Federal campuses; and special-use facilities.

c. This NPR is applicable to all NASA leased and owned facilities excluding CNSI, nuclear, and chemical storage facilities mentioned in Section P1 of this NPR.

d. Address comments regarding this NPR to the:

Office of Protective Services
NASA Headquarters
300 E ST SW
Washington, DC 20546.

e. Refer questions concerning the application of these standards at NASA Centers to the appropriate NASA Center Security Office.

P.3 Authority

a. National Space Program, 42 U.S.C. § 2473(c) (1).

b. Interagency Security Committee, E.O. 12977.

c. National Aeronautics and Space Administration, 14 CFR pt. 1203a.

d. NPD 1600.2, NASA Security Policy.

P.4 Applicable Documents and Forms

a. Critical Infrastructure Security and Resilience, PPD-21.

b. Implement Controlled Unclassified Information, E.O. 13556.

c. DHS-ISC, The Risk Management Process: An Interagency Security Committee Standard

d. DHS-ISC, The Design-Basis Threat

e. HSPD-7, Critical Infrastructure Identification, Prioritization, and Protection.

f. NPR 1600.1, NASA Security Program Procedural Requirements.

g. NPR 1620.3, Physical Security Requirements for NASA Facilities and Property.

h. NID 1600.55, Sensitive But Unclassified (SBU) Information.

i. NHQ Form 1805, Facility Security Level Determination Matrix

P.5 Measurement / Verification

Verification of this NPR will be documented on NASA Form 1805, Facility Security Level Determination Matrix. All authorized signatures on the NF 1805 will be completed and the form maintained by the Center Office of Protective Services. Upon request of the Headquarters Office of Protective Services, copies of Form 1805 will be electronically sent.

P.7 Cancellation

NPR 1620.2, Physical Security Vulnerability Risk Assessments, dated July 15, 2004

Revalidated on December 13, 2019.

/S/
Woodrow Whitlow, Jr.
Associate Administrator
Mission Support Directorate


Chapter 1. Determining the Center/Facility Security Level

1.1 General

1.1.1 The initial FSL determination for new leased or owned space will be made as soon as practical after the identification of a space requirement (including succeeding leases). The determination should be made early enough in the space acquisition process to allow for the implementation of required countermeasures (or reconsideration of the acquisition caused by an inability to meet minimum physical security requirements.)

1.1.2 Upon the effective date of this NPR, all NASA facilities/buildings will be initially assessed using this methodology. Once the initial assessments are completed, risk assessments will be conducted at least every five years for level one and level two facilities and every three years for levels three and four facilities from the facility's previous assessment date. There will be an FSL designated for the Center overall, and each facility within the Center will have its own FSL designation. Center Chiefs of Protective Services, at their discretion, may decline to conduct assessments of buildings determined not to have any Center operational or mission support value (e.g., abandoned or decommissioned facilities, vacant sheds, and vacant trailers.) 1.1.3 Implementation of countermeasures inclusive of policies and procedures will be based on risk with the appropriate FSL level. The FSL will be reviewed and adjusted, if necessary, as part of each initial and recurring risk assessment. The responsibility for making the final FSL determination rests with the Center Director as the Designated Official (DO), who must either accept the risk or fund security measures to reduce the risk. Artificially lowering the FSL level to avoid countermeasure implementation is not permitted.

a. For single-tenant Government-owned or leased facilities, a representative of the Center's Office of Protective Services will make the FSL determination, in consultation with the Center Director responsible for the facility. For single tenant facilities owned or leased through General Services Administration (GSA), the FSL determination will be made by the Federal Protective Services in coordination with the Center Office of Protective Services and in consultation with the Center Director.

b. In multitenant Government-owned or leased facilities, the DO in coordination with a representative of each Federal tenant i.e., the Facility Security committee will make the FSL determination in consultation with the owning/leasing department or agency and the security organization(s) responsible for the facility.

c. A campus or NASA Center consists of two or more Federal facilities located contiguous to one another and sharing some aspects of the environment (e.g., parking, courtyards, vehicle access roads, or gates) or security features (e.g., a perimeter fence, guard force, or onsite central alarm/closed circuit television monitoring station). In multitenant Centers, all individual facilities in the campus will be assigned an FSL in accordance with this NPR. d. While the incorporation of additional factors and criteria makes this NPR more useful to determine the FSL for special-use and other unique facilities, such as high-security laboratories, hospitals, or unique storage facilities for chemicals or munitions, some facilities may still not fit neatly into the criteria defined here. The criticality of the mission or the symbolic nature of the facility could be such that it merits a degree of protection above that specified for a FSL Level IV facility, even though the other contributing factors, such as population or square footage may be scored lower.

(1) For example, a research laboratory might receive lower score values for symbolism, square footage, and population size. However, the laboratory may be responsible for critical research and diagnostic activities that are vital to protecting NASA research and intellectual property that if compromised could pose a threat to the United States National Security. This mission, combined with the fact that it may be the only such laboratory in the country, would suggest that the criticality factor would far outweigh lower score values in symbolism, population, and/or facility size, and thus the facility should be considered for a Level V designation. As a result, the criteria and decision-making authority for identifying Level V facilities are within the purview of the individual Center. As general guidance, Centers should consider a facility as potentially suitable for a Level V designation if it receives a "very high" score value for criticality or symbolism and is a one-of-a-kind facility (or nearly so).

1.2 Purpose of a Center/Facility Security Level Determination

1.2.1 Not all NASA assets at all Centers and locations require the same degree of protection.

1.2.2 Protection of assets must be based on a realistic assessment of the risk associated with the types of threats likely to be directed at the assets in their actual locations, the vulnerability of the asset, the asset value, and response capabilities of law enforcement and/or security forces.

1.2.3 Performing the Center/FSL assessment allows NASA managers to establish asset protection programs appropriate for their value and the likelihood of an attempt to compromise them.

1.2.4 The Center/FSL Determination allows Center management to prioritize assets so that physical security resources can be applied in the most efficient and cost-effective manner possible.

1.3 Risk

For the purposes of this NPR, risk is the identification of credible threats, vulnerabilities, and measuring the probability of the consequences using counter-measures to mitigate the threats and vulnerabilities, and/or accepting the risk as they are associated with NASA assets.

1.4 Undesirable Events

The undesirable events to NASA facilities from criminal elements must also be evaluated in determining the FSL. Consideration must be given to the risk from more common criminal acts, such as theft, assault, unlawful demonstrations, workplace violence, and vandalism acts which historically occur more frequently at Federal facilities than acts of terrorism. Although terrorism is of concern based on past events, it should not be the default threat unless there is credible threat intelligence directly related to NASA assets. Possible sources of references could be local Center incident reports; local police reports; NASA OPS counterintelligence; and other Federal, state, and local law enforcement credible information.

1.5 Vulnerabilities

Vulnerabilities for purposes of this NPR are identified as the unmitigated threats and/or mitigated threats of a NASA asset that can be compromised. Although the vulnerability may be already mitigated, outdated technologies or more sophisticated threats may create the vulnerability.

1.6 Consequences

After identifying the threats and vulnerabilities of NASA assets, a consequence will be identified as a result of the attack. Based on the severity of the attack and the criticality of the asset, the consequence will need to be mitigated. Although the consequence could be severe, the likelihood of a threat event taking place could be low. This should not be reason to eliminate or not address the consequences of the threat and vulnerabilities. It should be a consideration of the mitigation strategy implemented.

1.7 Assets

NASA assets are people, property, and information. Much of the direction of the NASA Critical Infrastructure Protection Program (NCIPP) is directed at protecting NASA critical infrastructure assets. Typically, it is the potential publicity that would come with bombing a NASA facility or destroying and compromising a critical or symbolic NASA resource that an aggressor would find desirable. The NASA Security program is based upon protecting the greater installation, its critical facilities, and other critical assets, which will in turn provide greater protection for NASA assets.


Chapter 2. Scoring Factors of the Determination Matrix

2.1 FSL Matrix (NASA Form 1805)

2.1.1 The FSL matrix uses five equally weighted security factors to be evaluated, with corresponding points of 1, 2, 3, or 4 allocated for each factor. The sections that follow provide the criteria to be used in evaluating each factor and assigning points. However, the criteria cannot capture all of the circumstances that could be encountered. Thus, the NPR includes a sixth factor, "intangibles," to allow the assessor to consider other factors unique to the department/Agency's needs or to the facility.

2.1.2 Additionally, although the requirement for assessment specific judgment has been reduced to the extent possible, it may still be necessary. To that end, this NPR includes an explanation of why each factor was included, a description of its intended impact on the score, and examples to allow security professionals encountering conditions that do not clearly match those anticipated here to make informed decisions based on the same rationale used in the development of this process.

2.1.3 To use the FSL matrix, each of the factors will be examined and a point value assigned based on the scoring criteria provided. The points for all factors will then be added together and a preliminary FSL identified, based on the sum. The assessor may then consider any intangibles that may be associated with the facility. A documented adjustment to the FSL may be made accordingly and a final FSL determined.

Points
Factor 1 2 3 4 Score
Mission Criticality LOW MEDIUM HIGH VERY HIGH
Symbolism LOW MEDIUM HIGH VERY HIGH
Facility Population < 100 101-250 251-750 > 750
Facility Size < 10,000 sq. ft. 10,001-100,000 sq. ft. 100,001-250,000 sq. ft. > 250,000 sq. ft.
Threat to Tenant Agencies LOW MEDIUM HIGH VERY HIGH
Sum of above
Facility Security Level I 5-7 Points II 8-12 Points III 13-17 Points IV 18-20 Points Preliminary FSL
Intangible Adjustment Justification + / - 1 FSL
Final FSL

2.2 Mission Criticality

2.2.1 The value of a facility to NASA is based largely on the mission of the facility, particularly as it may relate to NCIPP and other important business of the Government.

2.2.2 The mission criticality score is based on the criticality of the missions carried out by tenants in the Center/facility. In a multitenant or mixed multitenant facility, the highest rating for any tenant in the facility should be used for this factor. Continuity of Government (COG) and Continuity of Operations (COOP) documents are good sources of information regarding the performance of essential functions.

Table 2 - Criticality Scoring

Value Points Criteria Examples
Very High 4 Communications centers that support national essential NASA functions.

NASA- essential communications equipment necessary for defense or intelligence activities.

NASA individuals necessary to advance American interests with foreign governments.

NASA government officials of foreign nations.

NASA individuals or specialized equipment necessary to identify and analyze threats to homeland security.

Intelligence community facilities, including communications and weapons/munitions storage.

Emergency operations Centers, national response assets (e.g., Nuclear Emergency Support Teams).

CNSI TS/SCI Program, Sensitive Compartmented Information Facility (SCIF), Operations, National Security Programs.

High 3 Original, irreplaceable material or information central to the daily conduct of NASA.

Designated as a shelter in the event of an emergency incident. Center or Headquarters policy and management oversight.

Biological/chemical/radiological/medical research or storage of research and development (de minimis) quantities of chemicals, biohazards, explosives, and similar items. COOP facilities for department and agency headquarters. General criminal investigative work.

Special program area storing CNSI, MEI facility, other very sensitive documents or equipment, Source Evaluation Board (SEB), Mishap Investigation Facility.
Medium 2 State-wide service or regulatory operations. COOP facilities for other than national headquarters. Building program or code has requested accountability controls, access to program area not storing CNSI, no Mission Essential Infrastructure (MEI) Facility
Low 1 Administrative, direct service or regulatory activities. Visitors Center, roadways, cafeterias, gift shop, recreation facilities.

2.3 Symbolism

2.3.1 The symbolism of the facility is based on both its attractiveness as a target and the consequences of an event. The symbolic value is first based on external appearances or well-known/publicized operations within the facility that indicate it is a NASA facility. Domestic criminals may seek to make a statement against NASA for many reasons that range from espionage, vandalism, sabotage, assault, or a number of other criminal acts. It should be recognized that the partnerships that NASA has with foreign governments and various contractors sometimes presents opportunities for these types of crimes to occur and should be considered when evaluating threats.

2.3.2 Symbolism is also important because of the potential negative psychological impact of an undesirable event occurring at a prominent Federal facility. Attacks at certain NASA facilities, particularly those that are perceived to be well protected and central to the safety and well-being of NASA could result in a loss of confidence of NASA and the U.S. Government domestically or internationally.

2.3.3 It is also necessary to recognize that even if there are no external appearances or well-known operations of NASA, a mixed tenant or mixed-multitenant facility may be symbolic to terrorists with other motivations. For example, facilities such as financial institutions, communications centers, transportation hubs, and controversial testing laboratories may be symbolic in the eyes of single-interest radicals and international terrorist organizations, whose leaders have stated that strikes against the American economy are a high priority. The symbolism of non-U.S. Department of Defense (DoD) Federal facilities on a DoD campus should be assessed similarly.

Table 3 - Symbolism

Value Points Criteria Examples
Very High 4 Popular destination for tourists. A nationally significant historical event has occurred at the facility. Contains significant original historical records or unique artifacts that could not be replaced in the event of their damage or destruction. Executive department headquarters building. Other prominent symbols of U.S. power or authority. Centers or NASA facilities that meet these criterion.
High 3 Well-known, regional U.S. Government facility. Agency/bureau headquarters. Located in a symbolic commercial financial building. Co-located with other nongovernmental but highly symbolic facilities. Centers or NASA facilities that meet these criterion.
Medium 2 Readily identified as a U.S. Government facility based on external features. Readily identified as a U.S. Government facility based on the nature of public contact or other operations (even without external features). Dominant, single Federal facility in a community or rural area. Nongovernmental commercial laboratory or research facility that may be symbolic to single-interest radicals. Centers or NASA facilities that meet these criterion.
Low 1 No external features or public contact readily identifying it as a U.S. Government facility. Centers or NASA facilities that meet these criterion.

2.4 Facility Population

2.4.1 The infliction of mass casualties is an acknowledged goal of many terrorist organizations. Recovered terrorist pre-operational surveillance reports include considerable details on the times of day that the target population is at its highest and do not distinguish between tenants and visitors. From a consequence perspective, the potential for mass casualties should be a major consideration.

2.4.2 Thus, the facility population factor is based on the peak total number of personnel in Government space, including employees, onsite contract employees, and visitors. This number will not include such transient influxes in population as an occasional conference (or similar event), unless the facility is intended for use in such a manner (such as a conference center) and the population is part of normal business. Transient shifts in population such as the occasional conference should be addressed by contingency security measures.

2.4.3 The number of daily visitors should be determined using the best metrics available to ensure the most accurate population. Ideally, this would be achieved through a review of visitor logs and access control lists; however, it may necessitate an estimate or a short-term sampling of visitor data.

2.4.4 Facilities such as stand-alone parking garages should be considered to have a population of less than 100.

2.4.5 The sensitive nature of childcare centers located in Federal facilities requires every Federal childcare center or facility with a childcare center to receive a facility population score of "very high" and a point value of 4.

2.4.6 If the non-Federal population of a mixed tenant or mixed-multitenant facility contributes to the target attractiveness (e.g., creates a substantial population over and above the Federal population), document the rationale and add 1 point, not to exceed the maximum of 4 points.

Table 4 - Facility Population

Value Points Criteria
Very High 4 Greater than 750 or facilities with
childcare centers
High 3 251 to 750
Medium2 101 to 250
Low 1 Less than 100

2.5 Facility Size

2.5.1 The facility size factor is based on the square footage of all Federally occupied space in the facility, including cases where an Agency with real property authority controls some other amount of space in the facility. If the entire facility or entire floors are occupied, gross square footage should be used (L x W); if only portions of floors are occupied in a multitenant facility, assignable or rentable square footage should be used.

2.5.2 Size may be directly or indirectly proportional to the facility population. An office facility with a large population will generally have a correspondingly large amount of floor space; while a large warehouse may have a very small population.

2.5.3 For a terrorist, an attack on a large, recognizable facility results in more extensive press (video) coverage. However, it should also be understood that large facilities require a more substantial attack to create catastrophic damage, entailing more planning and preparation by adversaries, which could be a deterrent.

2.5.4 From a consequence perspective, the cost to replace or repair a large facility is a major consideration. The National Infrastructure Protection Plan considers the cost to rebuild a facility in determining the potential economic impact of a successful attack.

2.5.5 If the total size of a mixed tenant or mixed-multitenant facility beyond that occupied by the Federal population contributes to the target attractiveness (e.g., creates a highly recognizable structure based on size alone), document the rationale and add 1 point, not to exceed the maximum of 4 points.

Table 5 - Facility Size

Value Points Criteria
Very High 4 Greater than 250,000 square feet
High 3 100,000 to 250,000 square feet
Medium 2 10,000 to 100,000 square feet
Low 1 Up to 10,000 square feet

2.6 Campuses, Complexes, and Federal Centers

2.6.1 A campus consists of two or more Federal facilities located contiguous to one another and sharing some aspects of the environment (e.g., parking, courtyards, vehicle access roads, or gates) or security features (e.g., a perimeter fence, guard force, or onsite central alarm/closed circuit television monitoring station). It may also be referred to as a "complex" or "Federal center."

2.6.2 In the case of a campus that houses a single tenant, such as some of NASA's Centers, an overall FSL will be established for the Center and for each facility within the Center. Single tenant in this scenario will consist of all NASA and NASA contractor's physical space. If this Center is shared with a DoD entity, the perimeter of the facility where the demarcation point(s) are located will be considered the NASA Center. If the NASA facility sits within another property footprint, this NASA facility will be considered a single tenant facility and will require its own assessment unless the organization that has real property authority is consistent with Inter-Agency Security (ISC) criteria and meets this NPR. In multitenant campuses, all individual facilities in the campus will either be assigned an FSL in accordance with this NPR or all tenants may agree to determine an overall FSL for the entire campus with the approval of the AA of OPS treating the entire campus as though it were a multitenant facility (using the highest rating of any tenant in the facility for each factor). All NASA facilities that are being leased through NASA or the General Service Administration (GSA) will follow this NPR.

2.7 Undesirable Events to NASA Centers/Facilities

2.7.1 Unlike the criticality of mission criterion, which is considered in terms of consequences, the threat to tenant agencies criterion is considered from a perspective of target attractiveness. The facility should be viewed in terms of whether the nature of public contact required in or resulting from the conduct of business is adversarial, whether there is a history of adversarial acts committed at the facility, against facility tenants, or against the tenant agencies elsewhere. To determine undesirable events, inquires to the OPS Counter-Intelligence division should be made as well as reading the ISC's Design Basis Threat Update document.

2.7.2 The highest score applicable to any tenant in a multitenant facility will be considered when determining the FSL, even though it may be possible to limit the implementation of countermeasures for that threat to a specific tenant's space or part of the facility.

2.7.3 As with the impact of commercial tenants on the facility's symbolism score, the potential threat to non-Federal tenants in a mixed tenant or mixed-multitenant facility could result in a collateral risk to Federal tenants. Thus, in considering the criteria, the threat to all tenants in a facility, including non-Federal tenants, should be considered and the highest score used for the rating.

Table 6 - Undesirable Events

Value Points Criteria Examples
Very High 4 Tenant mission and interaction with certain segments of the public is adversarial in nature. Tenant mission is controversial in nature and routinely draws the attention of organized protest groups. Located in a high-crime area. Significant history of violence directed at or occurring in the facility. More than 10 incidents per year requiring law enforcement/security response for unruly or threatening persons on site. Centers or facilities that meet this criterion.
High 3 Public contact is occasionally adversarial based on the nature of business conducted at the facility. History of demonstrations at the facility. Located in a moderate-crime area. History of violence directed at the facility or the occupants; 5-10 incidents per year requiring law enforcement/security response for unruly or threatening persons on site. Centers or facilities that meet this criterion.
Medium2 Generally non-adversarial public contact based on the nature of business conducted at the facility. History of demonstrations against the tenant agency (not at the facility). Located in a low-crime area. History of violence directed at tenant agencies/companies (not at the facility). Centers or facilities that meet this criterion.
Low 1 Generally little-to-no public contact. No history of demonstrations at the facility. No history of violence directed at the facility or the occupants. Centers or facilities that meet this criterion.

2.8 Intangible Factors

2.8.1 It is not possible for this criterion to take into account all the conditions that may affect the FSL decision for all the different NASA Centers/facilities. Certain factors, such as a short duration of occupancy, may reduce the value of the facility in terms of investment or mission, which could justify a reduction of the FSL. Such factors are in essence indicative of a reduced value of the facility itself and a corresponding reduction in the consequences of its loss.

2.8.2 Other factors may suggest an increase in the FSL, such as the potential for cascading effects or downstream impacts on interdependent infrastructure or costs associated with the reconstitution of the facility.

2.8.3 Accordingly, the FSL may be raised or lowered one level at the discretion of the Associate Administrator by a written request of the Center Security Chief and the concurrence of the Center Director, based on intangible factors. However, the intangible factor should not be used to raise or lower the FSL in response to a particular threat act. The FSL characterizes the entire facility; concerns about specific threats should be addressed with specific countermeasures, even if they are over and above those required as the baseline for a particular security level.

2.8.4 Short-term events could also temporarily affect the factors evaluated here. Unless these events happen on a recurring basis, they should not affect the FSL determination. Instead, contingency plans should be developed to implement temporary measures until the event has passed. For example, a weeklong conference may increase the population of a facility substantially during the conference, but it should not be considered in the FSL determination. On the other hand, if the facility is a conference center that normally holds such gatherings, the population during those conferences should be factored into the FSL.

2.8.5 Like all risk-management decisions, it is important to document these intangible factors and the resulting adjustments made to the FSL score. The decision-making authority should document any intangible factors and the associated adjustment and retain this information as part of the official facility security records.


Chapter 3. Level V Facilities

3.1.1 While the incorporation of additional factors and criteria makes this NPR more useful to determine the FSL for special-use and other unique facilities, such as high-security laboratories, hospitals, or unique storage facilities for chemicals or munitions, some facilities may still not fit neatly into the criteria defined here. The criticality of the mission or the symbolic nature of the facility could be such that it merits a degree of protection above that specified for a FSL Level IV facility, even though the other contributing factors, such as population or square footage, might be scored lower.

3.1.2 For example, a research laboratory might receive lower score values for symbolism, square footage, and population size. However, the laboratory may be responsible for critical research and diagnostic activities that are vital to protecting the Nation's citizenry or animal and food products from disease agents accidentally or deliberately introduced into the United States. This mission, combined with the fact that it may be the only such laboratory in the country, would suggest that the criticality factor would far outweigh lower score values in symbolism, population, and/or facility size, and thus the facility should be considered for a Level V designation. As a result, the criteria and decision-making authority for identifying Level V facilities are within the purview of the individual center. As general guidance, Centers should consider a facility as potentially suitable for a Level V designation if it receives a "very high" score value for criticality or symbolism and is a one-of-a-kind facility (or nearly so).


Chapter 4. Transition to NPR 1620.3

4.1.1 Once the FSL determination has been established, the security specialist will move to NPR 1620.3 to implement the countermeasures that are associated with the FSL level. The corresponding FSL number is found at the top of the columns of Chapter 7 in NPR 1620.3. Based on risk to the asset, an appropriate level of protection will be implemented.


Appendix A. Definitions

Campus Two or more Federal facilities located contiguous to one another and typically sharing some aspects of the environment, such as parking, courtyards, private vehicle access roads, or gates and entrances to connected facilities. A campus may also be referred to as a "Federal Center" or "complex."

Continuity of Government (COG) is the principle of establishing defined procedures that allow a government to continue its essential operations in case of nuclear war or other catastrophic event.

Continuity of Operations (COOP) is a Federal initiative, required by Presidential directive, to ensure that agencies are able to continue performance of essential functions under a broad range of circumstances.

Controlled Unclassified Information (CUI) is information. The CUI Program is being implemented across the Executive Branches of the Government in approximately FY 2016 as mandated by Executive Order 13556, Implement Controlled Unclassified Information (CUI) signed by the President in November 4, 2010. The CUI Program will completely replace the current designation methodology at NASA under Sensitive But Unclassified (SBU) Information.

Designated Official The highest ranking official of the primary tenant agency of a Federal facility or, alternatively, a designee selected by mutual agreement of tenant agency officials. For facilities owned and leased by the U.S. General Services Administration (GSA), the definition appears in Title 41, Section 102-71.20, of the Code of Federal Regulations (41 C.F.R. 102-71.20). For the purposes of NASA, the Center Director will be the Designated Official.

Essential Functions Government functions that enable Federal Executive Branch agencies to provide vital services, exercise civil authority, maintain the safety and well-being of the general populace, and sustain the industrial/economic base in an emergency.

Facility Security Level A categorization based on the analysis of several security-related facility factors, which then serves as the basis for the implementation of certain protective security measures specified in other ISC standards.

Federal Departments and Agencies Those Executive Departments enumerated in 5 U.S.C. §101, and the U.S. Department of Homeland Security (DHS); independent establishments as defined by 5 U.S.C. §104(1); Government corporations as defined by 5 U.S.C. §103(1); and the United States Postal Service.

Federal Facilities Leased and owned buildings and facilities in the United States (inclusive of its territories) occupied by Federal Executive Branch employees for nonmilitary activities.

Mixed Tenant Facility A facility that includes one Federal tenant as well as non-Federal tenants, including commercial and state/local government tenants.

Multitenant Facility A facility that includes tenants from multiple Federal departments and agencies but no non-Federal tenants.

National Essential Functions (NEFs) That subset of essential functions that are necessary to lead and sustain the Nation during a catastrophic emergency and that, therefore, must be supported through the COOP and COG capabilities.

Those essential functions that must be performed to support or implement the performance of NEFs before, during, and in the aftermath of an emergency.

Security Organization The Government agency or an internal agency component responsible for physical security at the specific facility (e.g., the DHS Federal Protective Service and NASA Office of Protective Services).

Single Tenant Facility A facility that only includes one Federal tenant or multiple components of the same Federal department or agency that fall under one "umbrella" for security purposes.

Special-Use Facilities An entire facility or space within a facility that contains environments, equipment, or data normally not housed in typical office, storage, or public access facilities. Examples of special-use facilities include, but are not limited to, high-security laboratories, hospitals, aircraft and spacecraft hangers, or unique storage facilities designed specifically for such things as chemicals and explosives.


Appendix B. Acronyms

CNSI Classified National Security Information
COG Continuity of Government
COOP Continuity of Operations
DoD Department of Defense
DHS Department of Homeland Security
FSL Facility Security Level
HSPD Homeland Security Presidential Directive
ISC Interagency Security Committee
NCIPP NASA Critical Infrastructure Protection Program
NPR NASA Procedural Requirement
OPS Office of Protective Services
PPD Presidential Policy Directive
SBU Sensitive But Unclassified


DISTRIBUTION:
NODIS


This Document is Obsolete and Is No Longer Used.
Check the NODIS Library to access the current version:
http://nodis3.gsfc.nasa.gov