NASA Procedures and Guidelines
This Document is Obsolete and Is No Longer Used. Check the NODIS Library to access the current version: http://nodis3.gsfc.nasa.gov
NPR 1620.2A Eff. Date: October 07, 2015 Cancellation Date:	Facility Security Assessments (Revalidated on December 13, 2019)
| TOC | Change | Preface | Chapter1 | Chapter2 | Chapter3 | Chapter4 | AppendixA | AppendixB | ALL |

Chapter 2. Scoring Factors of the Determination Matrix

2.1 FSL Matrix (NASA Form 1805)

2.1.1 The FSL matrix uses five equally weighted security factors to be evaluated, with corresponding points of 1, 2, 3, or 4 allocated for each factor. The sections that follow provide the criteria to be used in evaluating each factor and assigning points. However, the criteria cannot capture all of the circumstances that could be encountered. Thus, the NPR includes a sixth factor, "intangibles," to allow the assessor to consider other factors unique to the department/Agency's needs or to the facility.

2.1.2 Additionally, although the requirement for assessment specific judgment has been reduced to the extent possible, it may still be necessary. To that end, this NPR includes an explanation of why each factor was included, a description of its intended impact on the score, and examples to allow security professionals encountering conditions that do not clearly match those anticipated here to make informed decisions based on the same rationale used in the development of this process.

2.1.3 To use the FSL matrix, each of the factors will be examined and a point value assigned based on the scoring criteria provided. The points for all factors will then be added together and a preliminary FSL identified, based on the sum. The assessor may then consider any intangibles that may be associated with the facility. A documented adjustment to the FSL may be made accordingly and a final FSL determined.

2.2 Mission Criticality

2.2.1 The value of a facility to NASA is based largely on the mission of the facility, particularly as it may relate to NCIPP and other important business of the Government.

2.2.2 The mission criticality score is based on the criticality of the missions carried out by tenants in the Center/facility. In a multitenant or mixed multitenant facility, the highest rating for any tenant in the facility should be used for this factor. Continuity of Government (COG) and Continuity of Operations (COOP) documents are good sources of information regarding the performance of essential functions.

Table 2 - Criticality Scoring

2.3 Symbolism

2.3.1 The symbolism of the facility is based on both its attractiveness as a target and the consequences of an event. The symbolic value is first based on external appearances or well-known/publicized operations within the facility that indicate it is a NASA facility. Domestic criminals may seek to make a statement against NASA for many reasons that range from espionage, vandalism, sabotage, assault, or a number of other criminal acts. It should be recognized that the partnerships that NASA has with foreign governments and various contractors sometimes presents opportunities for these types of crimes to occur and should be considered when evaluating threats.

2.3.2 Symbolism is also important because of the potential negative psychological impact of an undesirable event occurring at a prominent Federal facility. Attacks at certain NASA facilities, particularly those that are perceived to be well protected and central to the safety and well-being of NASA could result in a loss of confidence of NASA and the U.S. Government domestically or internationally.

2.3.3 It is also necessary to recognize that even if there are no external appearances or well-known operations of NASA, a mixed tenant or mixed-multitenant facility may be symbolic to terrorists with other motivations. For example, facilities such as financial institutions, communications centers, transportation hubs, and controversial testing laboratories may be symbolic in the eyes of single-interest radicals and international terrorist organizations, whose leaders have stated that strikes against the American economy are a high priority. The symbolism of non-U.S. Department of Defense (DoD) Federal facilities on a DoD campus should be assessed similarly.

Table 3 - Symbolism

2.4 Facility Population

2.4.1 The infliction of mass casualties is an acknowledged goal of many terrorist organizations. Recovered terrorist pre-operational surveillance reports include considerable details on the times of day that the target population is at its highest and do not distinguish between tenants and visitors. From a consequence perspective, the potential for mass casualties should be a major consideration.

2.4.2 Thus, the facility population factor is based on the peak total number of personnel in Government space, including employees, onsite contract employees, and visitors. This number will not include such transient influxes in population as an occasional conference (or similar event), unless the facility is intended for use in such a manner (such as a conference center) and the population is part of normal business. Transient shifts in population such as the occasional conference should be addressed by contingency security measures.

2.4.3 The number of daily visitors should be determined using the best metrics available to ensure the most accurate population. Ideally, this would be achieved through a review of visitor logs and access control lists; however, it may necessitate an estimate or a short-term sampling of visitor data.

2.4.4 Facilities such as stand-alone parking garages should be considered to have a population of less than 100.

2.4.5 The sensitive nature of childcare centers located in Federal facilities requires every Federal childcare center or facility with a childcare center to receive a facility population score of "very high" and a point value of 4.

2.4.6 If the non-Federal population of a mixed tenant or mixed-multitenant facility contributes to the target attractiveness (e.g., creates a substantial population over and above the Federal population), document the rationale and add 1 point, not to exceed the maximum of 4 points.

Table 4 - Facility Population

2.5 Facility Size

2.5.1 The facility size factor is based on the square footage of all Federally occupied space in the facility, including cases where an Agency with real property authority controls some other amount of space in the facility. If the entire facility or entire floors are occupied, gross square footage should be used (L x W); if only portions of floors are occupied in a multitenant facility, assignable or rentable square footage should be used.

2.5.2 Size may be directly or indirectly proportional to the facility population. An office facility with a large population will generally have a correspondingly large amount of floor space; while a large warehouse may have a very small population.

2.5.3 For a terrorist, an attack on a large, recognizable facility results in more extensive press (video) coverage. However, it should also be understood that large facilities require a more substantial attack to create catastrophic damage, entailing more planning and preparation by adversaries, which could be a deterrent.

2.5.4 From a consequence perspective, the cost to replace or repair a large facility is a major consideration. The National Infrastructure Protection Plan considers the cost to rebuild a facility in determining the potential economic impact of a successful attack.

2.5.5 If the total size of a mixed tenant or mixed-multitenant facility beyond that occupied by the Federal population contributes to the target attractiveness (e.g., creates a highly recognizable structure based on size alone), document the rationale and add 1 point, not to exceed the maximum of 4 points.

Table 5 - Facility Size

2.6 Campuses, Complexes, and Federal Centers

2.6.1 A campus consists of two or more Federal facilities located contiguous to one another and sharing some aspects of the environment (e.g., parking, courtyards, vehicle access roads, or gates) or security features (e.g., a perimeter fence, guard force, or onsite central alarm/closed circuit television monitoring station). It may also be referred to as a "complex" or "Federal center."

2.6.2 In the case of a campus that houses a single tenant, such as some of NASA's Centers, an overall FSL will be established for the Center and for each facility within the Center. Single tenant in this scenario will consist of all NASA and NASA contractor's physical space. If this Center is shared with a DoD entity, the perimeter of the facility where the demarcation point(s) are located will be considered the NASA Center. If the NASA facility sits within another property footprint, this NASA facility will be considered a single tenant facility and will require its own assessment unless the organization that has real property authority is consistent with Inter-Agency Security (ISC) criteria and meets this NPR. In multitenant campuses, all individual facilities in the campus will either be assigned an FSL in accordance with this NPR or all tenants may agree to determine an overall FSL for the entire campus with the approval of the AA of OPS treating the entire campus as though it were a multitenant facility (using the highest rating of any tenant in the facility for each factor). All NASA facilities that are being leased through NASA or the General Service Administration (GSA) will follow this NPR.

2.7 Undesirable Events to NASA Centers/Facilities

2.7.1 Unlike the criticality of mission criterion, which is considered in terms of consequences, the threat to tenant agencies criterion is considered from a perspective of target attractiveness. The facility should be viewed in terms of whether the nature of public contact required in or resulting from the conduct of business is adversarial, whether there is a history of adversarial acts committed at the facility, against facility tenants, or against the tenant agencies elsewhere. To determine undesirable events, inquires to the OPS Counter-Intelligence division should be made as well as reading the ISC's Design Basis Threat Update document.

2.7.2 The highest score applicable to any tenant in a multitenant facility will be considered when determining the FSL, even though it may be possible to limit the implementation of countermeasures for that threat to a specific tenant's space or part of the facility.

2.7.3 As with the impact of commercial tenants on the facility's symbolism score, the potential threat to non-Federal tenants in a mixed tenant or mixed-multitenant facility could result in a collateral risk to Federal tenants. Thus, in considering the criteria, the threat to all tenants in a facility, including non-Federal tenants, should be considered and the highest score used for the rating.

Table 6 - Undesirable Events

2.8 Intangible Factors

2.8.1 It is not possible for this criterion to take into account all the conditions that may affect the FSL decision for all the different NASA Centers/facilities. Certain factors, such as a short duration of occupancy, may reduce the value of the facility in terms of investment or mission, which could justify a reduction of the FSL. Such factors are in essence indicative of a reduced value of the facility itself and a corresponding reduction in the consequences of its loss.

2.8.2 Other factors may suggest an increase in the FSL, such as the potential for cascading effects or downstream impacts on interdependent infrastructure or costs associated with the reconstitution of the facility.

2.8.3 Accordingly, the FSL may be raised or lowered one level at the discretion of the Associate Administrator by a written request of the Center Security Chief and the concurrence of the Center Director, based on intangible factors. However, the intangible factor should not be used to raise or lower the FSL in response to a particular threat act. The FSL characterizes the entire facility; concerns about specific threats should be addressed with specific countermeasures, even if they are over and above those required as the baseline for a particular security level.

2.8.4 Short-term events could also temporarily affect the factors evaluated here. Unless these events happen on a recurring basis, they should not affect the FSL determination. Instead, contingency plans should be developed to implement temporary measures until the event has passed. For example, a weeklong conference may increase the population of a facility substantially during the conference, but it should not be considered in the FSL determination. On the other hand, if the facility is a conference center that normally holds such gatherings, the population during those conferences should be factored into the FSL.

2.8.5 Like all risk-management decisions, it is important to document these intangible factors and the resulting adjustments made to the FSL score. The decision-making authority should document any intangible factors and the associated adjustment and retain this information as part of the official facility security records.

DISTRIBUTION:
NODIS