Tips for success when building a Closed Area to house classified information
A Closed Area, now known as an open storage area under 32 CFR Part 117, is a type of facility that falls under the long-standing document, National Industrial Security Program Operating Manual (NISPOM). It’s a Department Of Defense Manual (DoDM) that was created to provide guidance to commercial companies who provide products and services to the U.S. government in a classified capacity. The NISPOM establishes the minimum standards for how to obtain, maintain and protect classified information and sets forth reporting and oversight responsibilities for commercial entities.
A NISPOM Closed Area in particular is a space that is built and accredited to store government Secret and Top-Secret information when the material cannot be stored inside an approved Government Services Administration (GSA) safe. The construction requirements of the area can vary depending on the intended use of the facility. High-security hardware and other access control measures may be necessary for physical security requirements.
How a Closed Area differs from a SCIF or SAPF
Closed Areas typically require less work and time than a Sensitive Compartmented Information Facility (SCIF) or Special Access Program Facility (SAPF) to construct. Since SCI and SAP information can only be stored in SCIFs/SAPFs and require the most protection, SCIFs have more security guidelines to follow and more restrictive measures to implement. Measures such as emanation security, acoustic protections or sometimes even physical hardening are factors that aren’t required in most Closed Area projects.
Another element that is streamlined in Closed Areas as compared to SCIFs/SAPFs is the accreditation process. While a SCIF/SAPF accreditation process can be non-linear and take a lot of time and coordination with multiple people, accrediting a Closed Area typically only involves the Facility Security Officer (FSO) and the Industrial Security Representative (ISR).
With Closed Areas, accreditation requires your FSO working with your company’s Defense Counterintelligence Security Agency (DCSA) ISR to define your policies and procedures for operating in your Closed Area and any physical security mitigations required. The FSO will already be familiar with their ISR, as they would have granted your business its facility clearance (FCL). The DCSA rep maintains ultimate responsibility for the Closed Area, similar to an Accrediting Official (AO) for SCIFs and SAPFs.
A Closed Area also cannot protect SAP Information or SCI, which are types of Secret and Top-Secret information tied to specific programs. Still, the Closed Area is protected through higher personnel adjudication standards as well as other controls like severely limiting the amount of people who have access to the SAP or SCI program information. In short, a SCIF or SAPF are built to a more restrictive set of construction and security standards than a Closed Area.
Now that you have some background on Closed Areas and what they’re used for, let’s dive into the best practices when developing one according to NISPOM standards.
Have an Expert Evaluate the Site and Project
It’s a good idea to hire an expert to come in prior to developing conceptual budgets and timelines because they will give you a good idea on what is and isn’t necessary when it comes to your Closed Area. As stated above, the NISPOM sets the minimum standards on the construction guidelines, but it’s worth it to have someone come in and make sure you’re covering everything you need to, from wall structure to acoustics.
A great security professional uses a risk-based approach and the NISPOM to ensure the minimum requirements are met and that any known vulnerabilities or risks are appropriately mitigated.
Make Sure Your Walls, Windows, Ceilings and Doors Fit the NISPOM Standards
Even though there are no specific rules as to what material to use and the thickness of each of these items, the NISPOM does set a minimum standard for each component of the Closed Area. The specifics are minimal because there is only about one chapter worth of standards in the NISPOM covering Closed Area construction as opposed to the 200-page Tech Spec that details construction for SCIFs/SAPFs.
For example, the NISPOM sets a standard that essentially says the wall needs to be built out of substantial material like plaster, gypsum wallboard, hardwood, or metal panels that must be able to show signs of entry. Put another way, the walls can’t be built in such a way that an element can be removed and/or replaced without anyone knowing. A typical office wall suffices.
However, the wall should meet the ceiling. That seems pretty obvious, but many commercial walls just meet the height of a false or “drop” ceiling. In that area between the false ceiling and true ceiling, a person can crawl around and access other spaces, which is why that ceiling construction is not allowed when building a Closed Area.
The doors need to utilize the appropriate locking hardware and should have heavy gauge hardware, but once again, there is no specific direction outlined in the NISPOM. Windows need to have blinds to prevent visual observation of classified information.
Understand How the Space Will Be Used
Make sure you take a look at the space you are going to use as a Closed Area and make a plan for how the space will be utilized and who will be able to access the area in and around the space. This will begin to give you an idea of what, if any, NISPOM standards you should be worried about.
Sometimes a restricted area is all you need due to the size of space required, the operational necessity, or the nature of the classified information. Restricted areas typically don’t require as strict of security measures as a Closed Area. For example, restricted areas provide security for classified documents during working hours, but they don’t require a physical barrier like a locked door using a deadbolt, metal bar, or a combination/key-operated padlock. Those physical barriers are required when building a Closed Area, and they help protect the classified material during both working and non-working hours.
Sometimes, the desire to build a Closed Area is pursued when it’s not necessary. If all of your materials can fit in a GSA container at the end of the day, then building a Closed Area is not needed. Plus, restricted areas are much easier to create and manage.
A Closed Area might be the right option for you, but before jumping in, make sure you review Chapter 5 in the NISPOM carefully, contact your DCSA rep, and talk to an expert. If you are unsure of what space will best fit your needs, hire a security consultant to help you decide.
SSC705 has developed a standardized approach that allows us to offer a flat-rate price for Closed Area consulting.
Contact us to find out more.