Effective Date: October 07, 2015
Expiration Date: October 07, 2024
|| TOC | Change | Preface | Chapter1 | Chapter2 | Chapter3 | Chapter4 | AppendixA | AppendixB | ALL ||
2.1.1 The FSL matrix uses five equally weighted security factors to be evaluated, with corresponding points of 1, 2, 3, or 4 allocated for each factor. The sections that follow provide the criteria to be used in evaluating each factor and assigning points. However, the criteria cannot capture all of the circumstances that could be encountered. Thus, the NPR includes a sixth factor, "intangibles," to allow the assessor to consider other factors unique to the department/Agency's needs or to the facility.
2.1.2 Additionally, although the requirement for assessment specific judgment has been reduced to the extent possible, it may still be necessary. To that end, this NPR includes an explanation of why each factor was included, a description of its intended impact on the score, and examples to allow security professionals encountering conditions that do not clearly match those anticipated here to make informed decisions based on the same rationale used in the development of this process.
2.1.3 To use the FSL matrix, each of the factors will be examined and a point value assigned based on the scoring criteria provided. The points for all factors will then be added together and a preliminary FSL identified, based on the sum. The assessor may then consider any intangibles that may be associated with the facility. A documented adjustment to the FSL may be made accordingly and a final FSL determined.
|Mission Criticality||LOW||MEDIUM||HIGH||VERY HIGH|
|Facility Population||< 100||101-250||251-750||> 750|
|Facility Size||< 10,000 sq. ft.||10,001-100,000 sq. ft.||100,001-250,000 sq. ft.||> 250,000 sq. ft.|
|Threat to Tenant Agencies||LOW||MEDIUM||HIGH||VERY HIGH|
|Sum of above|
|Facility Security Level||I 5-7 Points||II 8-12 Points||III 13-17 Points||IV 18-20 Points||Preliminary FSL|
|Intangible Adjustment||Justification||+ / - 1 FSL|
2.2.1 The value of a facility to NASA is based largely on the mission of the facility, particularly as it may relate to NCIPP and other important business of the Government.
2.2.2 The mission criticality score is based on the criticality of the missions carried out by tenants in the Center/facility. In a multitenant or mixed multitenant facility, the highest rating for any tenant in the facility should be used for this factor. Continuity of Government (COG) and Continuity of Operations (COOP) documents are good sources of information regarding the performance of essential functions.
Table 2 - Criticality Scoring
Communications centers that support national essential NASA functions.
NASA- essential communications equipment necessary for defense or intelligence activities.
NASA individuals necessary to advance American interests with foreign governments.
NASA government officials of foreign nations.
NASA individuals or specialized equipment necessary to identify and analyze threats to homeland security.
Intelligence community facilities, including communications and weapons/munitions storage.
Emergency operations Centers, national response assets (e.g., Nuclear Emergency Support Teams).
CNSI TS/SCI Program, Sensitive Compartmented Information Facility (SCIF), Operations, National Security Programs.
Original, irreplaceable material or information central to the daily conduct of NASA.
Designated as a shelter in the event of an emergency incident. Center or Headquarters policy and management oversight.
Biological/chemical/radiological/medical research or storage of research and development (de minimis) quantities of chemicals, biohazards, explosives, and similar items. COOP facilities for department and agency headquarters. General criminal investigative work.
|Special program area storing CNSI, MEI facility, other very sensitive documents or equipment, Source Evaluation Board (SEB), Mishap Investigation Facility.|
|Medium||2||State-wide service or regulatory operations. COOP facilities for other than national headquarters.||Building program or code has requested accountability controls, access to program area not storing CNSI, no Mission Essential Infrastructure (MEI) Facility|
|Low||1||Administrative, direct service or regulatory activities.||Visitors Center, roadways, cafeterias, gift shop, recreation facilities.|
2.3.1 The symbolism of the facility is based on both its attractiveness as a target and the consequences of an event. The symbolic value is first based on external appearances or well-known/publicized operations within the facility that indicate it is a NASA facility. Domestic criminals may seek to make a statement against NASA for many reasons that range from espionage, vandalism, sabotage, assault, or a number of other criminal acts. It should be recognized that the partnerships that NASA has with foreign governments and various contractors sometimes presents opportunities for these types of crimes to occur and should be considered when evaluating threats.
2.3.2 Symbolism is also important because of the potential negative psychological impact of an undesirable event occurring at a prominent Federal facility. Attacks at certain NASA facilities, particularly those that are perceived to be well protected and central to the safety and well-being of NASA could result in a loss of confidence of NASA and the U.S. Government domestically or internationally.
2.3.3 It is also necessary to recognize that even if there are no external appearances or well-known operations of NASA, a mixed tenant or mixed-multitenant facility may be symbolic to terrorists with other motivations. For example, facilities such as financial institutions, communications centers, transportation hubs, and controversial testing laboratories may be symbolic in the eyes of single-interest radicals and international terrorist organizations, whose leaders have stated that strikes against the American economy are a high priority. The symbolism of non-U.S. Department of Defense (DoD) Federal facilities on a DoD campus should be assessed similarly.
Table 3 - Symbolism
|Very High||4||Popular destination for tourists. A nationally significant historical event has occurred at the facility. Contains significant original historical records or unique artifacts that could not be replaced in the event of their damage or destruction. Executive department headquarters building. Other prominent symbols of U.S. power or authority.||Centers or NASA facilities that meet these criterion.|
|High||3||Well-known, regional U.S. Government facility. Agency/bureau headquarters. Located in a symbolic commercial financial building. Co-located with other nongovernmental but highly symbolic facilities.||Centers or NASA facilities that meet these criterion.|
|Medium||2||Readily identified as a U.S. Government facility based on external features. Readily identified as a U.S. Government facility based on the nature of public contact or other operations (even without external features). Dominant, single Federal facility in a community or rural area. Nongovernmental commercial laboratory or research facility that may be symbolic to single-interest radicals.||Centers or NASA facilities that meet these criterion.|
|Low||1||No external features or public contact readily identifying it as a U.S. Government facility.||Centers or NASA facilities that meet these criterion.|
2.4.1 The infliction of mass casualties is an acknowledged goal of many terrorist organizations. Recovered terrorist pre-operational surveillance reports include considerable details on the times of day that the target population is at its highest and do not distinguish between tenants and visitors. From a consequence perspective, the potential for mass casualties should be a major consideration.
2.4.2 Thus, the facility population factor is based on the peak total number of personnel in Government space, including employees, onsite contract employees, and visitors. This number will not include such transient influxes in population as an occasional conference (or similar event), unless the facility is intended for use in such a manner (such as a conference center) and the population is part of normal business. Transient shifts in population such as the occasional conference should be addressed by contingency security measures.
2.4.3 The number of daily visitors should be determined using the best metrics available to ensure the most accurate population. Ideally, this would be achieved through a review of visitor logs and access control lists; however, it may necessitate an estimate or a short-term sampling of visitor data.
2.4.4 Facilities such as stand-alone parking garages should be considered to have a population of less than 100.
2.4.5 The sensitive nature of childcare centers located in Federal facilities requires every Federal childcare center or facility with a childcare center to receive a facility population score of "very high" and a point value of 4.
2.4.6 If the non-Federal population of a mixed tenant or mixed-multitenant facility contributes to the target attractiveness (e.g., creates a substantial population over and above the Federal population), document the rationale and add 1 point, not to exceed the maximum of 4 points.
Table 4 - Facility Population
|Very High||4||Greater than 750 or facilities with
|High||3||251 to 750|
|Medium||2||101 to 250|
|Low||1||Less than 100|
2.5.1 The facility size factor is based on the square footage of all Federally occupied space in the facility, including cases where an Agency with real property authority controls some other amount of space in the facility. If the entire facility or entire floors are occupied, gross square footage should be used (L x W); if only portions of floors are occupied in a multitenant facility, assignable or rentable square footage should be used.
2.5.2 Size may be directly or indirectly proportional to the facility population. An office facility with a large population will generally have a correspondingly large amount of floor space; while a large warehouse may have a very small population.
2.5.3 For a terrorist, an attack on a large, recognizable facility results in more extensive press (video) coverage. However, it should also be understood that large facilities require a more substantial attack to create catastrophic damage, entailing more planning and preparation by adversaries, which could be a deterrent.
2.5.4 From a consequence perspective, the cost to replace or repair a large facility is a major consideration. The National Infrastructure Protection Plan considers the cost to rebuild a facility in determining the potential economic impact of a successful attack.
2.5.5 If the total size of a mixed tenant or mixed-multitenant facility beyond that occupied by the Federal population contributes to the target attractiveness (e.g., creates a highly recognizable structure based on size alone), document the rationale and add 1 point, not to exceed the maximum of 4 points.
Table 5 - Facility Size
|Very High||4||Greater than 250,000 square feet|
|High||3||100,000 to 250,000 square feet|
|Medium||2||10,000 to 100,000 square feet|
|Low||1||Up to 10,000 square feet|
2.6.1 A campus consists of two or more Federal facilities located contiguous to one another and sharing some aspects of the environment (e.g., parking, courtyards, vehicle access roads, or gates) or security features (e.g., a perimeter fence, guard force, or onsite central alarm/closed circuit television monitoring station). It may also be referred to as a "complex" or "Federal center."
2.6.2 In the case of a campus that houses a single tenant, such as some of NASA's Centers, an overall FSL will be established for the Center and for each facility within the Center. Single tenant in this scenario will consist of all NASA and NASA contractor's physical space. If this Center is shared with a DoD entity, the perimeter of the facility where the demarcation point(s) are located will be considered the NASA Center. If the NASA facility sits within another property footprint, this NASA facility will be considered a single tenant facility and will require its own assessment unless the organization that has real property authority is consistent with Inter-Agency Security (ISC) criteria and meets this NPR. In multitenant campuses, all individual facilities in the campus will either be assigned an FSL in accordance with this NPR or all tenants may agree to determine an overall FSL for the entire campus with the approval of the AA of OPS treating the entire campus as though it were a multitenant facility (using the highest rating of any tenant in the facility for each factor). All NASA facilities that are being leased through NASA or the General Service Administration (GSA) will follow this NPR.
2.7.1 Unlike the criticality of mission criterion, which is considered in terms of consequences, the threat to tenant agencies criterion is considered from a perspective of target attractiveness. The facility should be viewed in terms of whether the nature of public contact required in or resulting from the conduct of business is adversarial, whether there is a history of adversarial acts committed at the facility, against facility tenants, or against the tenant agencies elsewhere. To determine undesirable events, inquires to the OPS Counter-Intelligence division should be made as well as reading the ISC's Design Basis Threat Update document.
2.7.2 The highest score applicable to any tenant in a multitenant facility will be considered when determining the FSL, even though it may be possible to limit the implementation of countermeasures for that threat to a specific tenant's space or part of the facility.
2.7.3 As with the impact of commercial tenants on the facility's symbolism score, the potential threat to non-Federal tenants in a mixed tenant or mixed-multitenant facility could result in a collateral risk to Federal tenants. Thus, in considering the criteria, the threat to all tenants in a facility, including non-Federal tenants, should be considered and the highest score used for the rating.
Table 6 - Undesirable Events
|Very High||4||Tenant mission and interaction with certain segments of the public is adversarial in nature. Tenant mission is controversial in nature and routinely draws the attention of organized protest groups. Located in a high-crime area. Significant history of violence directed at or occurring in the facility. More than 10 incidents per year requiring law enforcement/security response for unruly or threatening persons on site.||Centers or facilities that meet this criterion.|
|High||3||Public contact is occasionally adversarial based on the nature of business conducted at the facility. History of demonstrations at the facility. Located in a moderate-crime area. History of violence directed at the facility or the occupants; 5-10 incidents per year requiring law enforcement/security response for unruly or threatening persons on site.||Centers or facilities that meet this criterion.|
|Medium||2||Generally non-adversarial public contact based on the nature of business conducted at the facility. History of demonstrations against the tenant agency (not at the facility). Located in a low-crime area. History of violence directed at tenant agencies/companies (not at the facility).||Centers or facilities that meet this criterion.|
|Low||1||Generally little-to-no public contact. No history of demonstrations at the facility. No history of violence directed at the facility or the occupants.||Centers or facilities that meet this criterion.|
2.8.1 It is not possible for this criterion to take into account all the conditions that may affect the FSL decision for all the different NASA Centers/facilities. Certain factors, such as a short duration of occupancy, may reduce the value of the facility in terms of investment or mission, which could justify a reduction of the FSL. Such factors are in essence indicative of a reduced value of the facility itself and a corresponding reduction in the consequences of its loss.
2.8.2 Other factors may suggest an increase in the FSL, such as the potential for cascading effects or downstream impacts on interdependent infrastructure or costs associated with the reconstitution of the facility.
2.8.3 Accordingly, the FSL may be raised or lowered one level at the discretion of the Associate Administrator by a written request of the Center Security Chief and the concurrence of the Center Director, based on intangible factors. However, the intangible factor should not be used to raise or lower the FSL in response to a particular threat act. The FSL characterizes the entire facility; concerns about specific threats should be addressed with specific countermeasures, even if they are over and above those required as the baseline for a particular security level.
2.8.4 Short-term events could also temporarily affect the factors evaluated here. Unless these events happen on a recurring basis, they should not affect the FSL determination. Instead, contingency plans should be developed to implement temporary measures until the event has passed. For example, a weeklong conference may increase the population of a facility substantially during the conference, but it should not be considered in the FSL determination. On the other hand, if the facility is a conference center that normally holds such gatherings, the population during those conferences should be factored into the FSL.
2.8.5 Like all risk-management decisions, it is important to document these intangible factors and the resulting adjustments made to the FSL score. The decision-making authority should document any intangible factors and the associated adjustment and retain this information as part of the official facility security records.
| TOC | Change | Preface | Chapter1 | Chapter2 | Chapter3 | Chapter4 | AppendixA | AppendixB | ALL |
|| NODIS Library | Organization and Administration(1000s) | Search ||
This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.