§ 159a.37 - Storage and storage equipment.

(a) General Policy. Classified information shall be stored only under conditions adequate to prevent unauthorized persons from gaining access. The requirements specified in this part represent the minimum acceptable security standards. DoD policy concerning the use of force for the protection of property or information is specified in DoD Directive 5210.56 17

(b) Standards for Storage Equipment. The GSA establishes and publishes minimum standards, specifications, and supply schedules for containers, vault doors, alarm systems, and associated security devices suitable for the storage and protection of classified information. Heads of DoD Components may establish additional controls to prevent unauthorized access. Security filing cabinets conforming to Federal specifications bear a Test Certification Label on the locking drawer, attesting to the security capabilities of the container and lock. (On some older cabinets the label was affixed on the inside of the locked drawer compartment). Cabinets manufactured after February 1962 indicate “General Services Administration Approved Security Container” on the outside of the top drawer.

(c) Storage of Classified Information. Classified information that is not under the personal control and observation of an authorized person, will be guarded or stored in a locked security container as prescribed in the following:

(1) Top Secret. Top Secret information shall be stored in:

(i) A safe-type steel file container having a built-in, three-position, dial-type combination lock approved by the GSA or a Class A vault or vault type room that meets the standards established by the head of the DoD Component concerned. When located in buildings, structural enclosures, or other areas not under U.S. Government control, the storage container, vault, or vault-type room must be protected by an alarm system or guarded during nonoperating hours.

(ii) An alarmed area, provided such facilities are adjudged by the local responsible official to afford protection equal to or better than that prescribed in paragraph (c)(1) (i) of this section. When an alarmed area is used for the storage of Top Secret material, the physical barrier must be adequate to prevent:

(A) Surreptitious removal of the material, and

(B) Observation that would result in the compromise of the material. The physical barrier must be such that forcible attack will give evidence of attempted entry into the area. The alarm system must provide immediate notice to a security force of attempted entry. Under field conditions, the field commander will prescribe the measures deemed adequate to meet the storage standards contained in paragraphs (c)(1)(i) and (ii) of this section.

(2) Secret and Confidential. Secret and Confidential information shall be stored in the manner prescribed for Top Secret; or in a Class B vault, or a vault-type room, strong room, or secure storage room that meets the standards prescribed by the head of the DoD Component; or, until phased out, in a steel filing cabinet having a built-in, three-position, dial type combination lock; or, as a last resort, an existing steel filing cabinet equipped with a steel lock bar, provided it is secured by a GSA-approved changeable combination padlock. In this latter instance, the keeper or keepers and staples must be secured to the cabinet by welding, rivets, or peened bolts and DoD Components must prescribe supplementary controls to prevent unauthorized access.

(3) Specialized Security Equipment—(i) Field Safe and One-drawer Container. One-drawer field safes, and GSA approved security containers are used primarily for storage of classified information in the field and in transportable assemblages. Such containers must be securely fastened or guarded to prevent their theft.

(ii) Map and Plan File. A GSA-approved map and plan file has been developed for storage of odd-sized items such as computer cards, maps, and charts.

(4) Other Storage Requirements. Storage areas for bulky material containing classified information, other than Top Secret, shall have access openings secured by GSA-approved changeable combination padlocks (Federal specification FF-P110 series) or key-operated padlocks with high security cylinders (exposed shackle, military specification P-43951 series, or shrouded shackle, military specification P-43607 series).

(i) When combination padlocks are used, the provisions of paragraph (e) of this section apply.

(ii) When key-operated high security padlocks are used, keys shall be controlled as classified information with classification equal to that of the information being protected and:

(A) A key and lock custodian shall be appointed to ensure proper custody and handling of keys and locks;

(B) A key and lock control register shall be maintained to identify keys for each lock and their current location and custody;

(C) Keys and locks shall be audited each month;

(D) Keys shall be inventoried with each change of custodian;

(E) Keys shall not be removed from the premises;

(F) Keys and spare locks shall be protected in a secure container;

(G) Locks shall be changed or rotated at least annually, and shall be replaced upon loss or compromise of their keys; and

(H) Master keying is prohibited.

(d) Procurement and Phase-In of New Storage Equipment—(1) Preliminary Survey. DoD activities shall not procure new storage equipment until:

(i) A current survey has been made of on-hand security storage equipment and classified records; and

(ii) Based upon the survey, it has been determined that it is not feasible to use available equipment or to retire, return, declassify or destroy enough records on hand to make the needed security storage space available.

(2) Purchase of New Storage Equipment. New security storage equipment shall be procured from those items listed on the GSA Federal Supply Schedule. Exceptions may be made by heads of DoD Components, with notification to the DUSD(P).

(3) Nothing in this subpart shall be construed to modify existing Federal Supply Class Management Assignments made under DoD Directive 5030.47.18

(e) Designations and Combinations—(1) Numbering and Designating Storage Facilities. There shall be no external mark as to the level of classified information authorized to be stored therein. For identification purposes each vault or container shall bear externally an assigned number or symbol.

(2) Combinations to Containers—(i) Changing. Combinations to security containers shall be changed only by individuals having that responsibility and an appropriate security clearance. Combinations shall be changed:

(A) When placed in use;

(B) Whenever an individual knowing the combination no longer requires access;

(C) When the combination has been subject to possible compromise;

(D) At least annually; or

(E) When taken out of service. Built-in combination locks shall be reset to the standard combination 50-25-50; combination padlocks shall be reset to the standard combination 10-20-30.

(ii) Classifying Combinations. The combination of a vault or container used for the storage of classified information shall be assigned a security classification equal to the highest category of the classified information authorized to be stored therein.

(iii) Recording Storage Facility Data. A record shall be maintained for each vault, secure room, or container used for storing classified information, showing location of the container, the names, home addresses, and home telephone numbers of the individuals having knowledge of the combination. Standard Form 700, “Security Container Information” shall be used for this purpose. (Use of this Standard Form is required when existing supplies of similar purpose forms are exhausted or by September 30, 1986, whichever occurs earlier).

(iv) Dissemination. Access to the combination of a vault or container used for the storage of classified information shall be granted only to those individuals who are authorized access to the classified information stored therein.

(3) Electrically Actuated Locks. Electricially actuated locks (for example, cypher and magnetic strip card locks) do not afford the required degree of protection of classified information and may not be used as a substitute for the locks prescribed in paragraph (c) of this section.

(f) Repair of Damaged Security Containers. Neutralization of lock-outs or repair of any damage that affects the integrity of a security container approved for storage of classified information shall be accomplished only by authorized persons who are cleared or continuously escorted while so engaged.

(1) A GSA-approved security container is considered to have been restored to its original state of security integrity if:

(i) All damaged or altered parts (for example, locking drawer, and drawer head) are replaced; or

(ii) When a container has been drilled immediately adjacent to or through the dial ring to neutralize a lock-out, the replacement lock is equal to the original equipment, and the drilled hole is repaired with a tapered, hardened tool-steel pin, or a steel dowel, drill bit, or bearing with a diameter slightly larger than the hole and of such length that when driven into the hole there shall remain at each end of the rod a shallow recess not less than 1/8 inch nor more than 3/16 inch deep to permit the acceptance of substantial welds, and the rod is welded both on the inside and outside surfaces. The outside of the drawer head shall then be puttied, sanded, and repainted in such a way that no visible evidence of the hole or its repair remains on the outer surface after replacement of the damaged parts (for example, new lock).

(2) GSA-approved containers that have been drilled in a location or repaired in a manner other than as described in paragraph (f)(1) of this section, will not be considered to have been restored to their original state of security integrity. The Test Certification Label on the inside of the locking drawer and the “General Services Administration Approved Security Container” label, if any, on the outside of the top drawer shall be removed from such containers.

(3) If damage to a GSA-approved security container is repaired with welds, rivets, or bolts that cannot be removed and replaced without leaving evidence of entry, the cabinet is limited thereafter to the storage of Secret and Confidential material.

(4) If the damage is repaired using methods other than those permitted in paragraphs (f) (1) and (3) of this section, use of the container will be limited to unclassified material and a notice to this effect will be permanently marked on the front of the container.