Physical Security Systems Assessment Guide, Dec 2016

1 PSS-1 Physical Security Systems Assessment GUIDE December 2016 Table of Contents Acronyms .. PSS-1 Section 1: PSS-2 Section 2: Intrusion Detection and Assessment .. PSS-15 Section 3: Entry and Search Control .. PSS-25 Section 4: Badging .. PSS-34 Section 5: Barriers, Locks, and Keys .. PSS-42 Section 6: Communications .. PSS-56 Section 7: Testing and Maintenance .. PSS-61 Section 8: Support Systems .. PSS-67 Section 9: Systems Management .. PSS-70 Section 10: Interfaces .. PSS-79 Section 11: Analyzing Data and Interpreting Results .. PSS-82 Appendix A: Intrusion Detection System Performance Tests .. PSS-87 Appendix B: Access Control System Performance Tests .. PSS-189 Appendix C: Communications Equipment Performance Tests.

2 PSS-258 Appendix D: Support System Performance Tests .. PSS-269 Appendix E: Personnel and Procedure Performance Tests .. PSS-289 Acronyms AC Alternating Current ACD Access Control Device ANSI American National Standards Institute BMS Balanced Magnetic Switch CAS Central Alarm Station CCTV Closed Circuit Television CFR Code of Federal Regulations DOE Department of Energy EA Office of Enterprise Assessments ECS Entry Control System EOC Emergency Operations Center GSA General Services Administration HSPD-12 Homeland Security Presidential Directive 12 IDS Intrusion Detection System ISSM Integrated Safeguards and Security Management LA Limited Area LLEA Local Law Enforcement Agency LSSO Local Site Specific Only MAA Material Access Area MC&A Material Control and Accountability ODSA Officially Designated Security Authority PA

3 Protected Area PIDAS Perimeter Intrusion Detection and Assessment System PIN Personal Identification Number PPA Property Protection Area PSS Physical Security Systems PTZ Pan-tilt-zoom QA Quality Assurance RF Radio Frequency S&SP Safeguards and Security Program SAS Secondary Alarm Station SCIF Sensitive Compartmented Information Facility SNM Special Nuclear Material SPO Security Police Officer SRT Special Response Team SSSP Site Safeguards and Security Plan TID Tamper-Indicating Device UPS Uninterruptible Power Supply VA Vulnerability Assessment VMD Video Motion Detector Physical Security Systems Assessment Guide December 2016 PSS-2 Purpose The Physical Security Systems (PSS) Assessment Guide provides Assessment personnel with a detailed methodology that can be used to plan, conduct, and closeout an Assessment of PSS.

4 This methodology serves to promote consistency, ensure thoroughness, and enhance the quality of the Assessment process. The guide is intended to be useful for all assessors regardless of their experience. For the experienced assessor, information is organized to allow easy reference and to serve as a reminder when conducting Assessment activities. For the new assessor, this guide can serve as a valuable training tool. With the assistance of an experienced assessor, the new assessor should be able to use the guide to collect and interpret data more efficiently and effectively. Organization This introductory section (Section 1) describes Assessment methods and outlines their use.

5 Sections 2 through 9 provide detailed guidance for assessing each major PSS subtopic: Section 2 Intrusion Detection and Assessment Section 3 Entry and Search Control Section 4 Badging Section 5 Barriers, Locks, and Keys Section 6 Communications Section 7 Testing and Maintenance Section 8 Support Systems Section 9 Systems Management. Section 10 (Interfaces) contains guidelines to help assessors coordinate their activities within subtopics and with other topic teams. Information is provided on the integration process, which allows topic teams to align their efforts and benefit from the knowledge and experience of other topic teams. The section provides some common areas of interface for the PSS team and explains how the integration effort greatly contributes to the quality and validity of Assessment results.

6 Section 11 (Analyzing Data and Interpreting Results) contains guidelines on how to organize and analyze data collected during Assessment activities. These guidelines include possible impacts of specific information on other topics or subtopics, and some experience-based information on the interpretation of potential deficiencies. Appendix A (Intrusion Detection System Performance Tests) provides procedures for testing the various Systems and items of equipment that are commonly used in Department of Energy (DOE) facilities, with guidelines for evaluating test results. This appendix includes performance tests that are useful for evaluating a variety of intrusion detection Systems (IDSs), such as: Exterior Perimeter Sensors Interior Sensors Perimeter Closed Circuit Television (CCTV) Interior CCTV Alarm Processing and Display.

7 Section 1: Introduction Physical Security Systems Assessment Guide December 2016 PSS-3 Appendix B (Access Control System Performance Tests) contains effectiveness tests on entry control and detection equipment. Appendix C (Communications Equipment Performance Tests) contains performance tests on radio equipment and duress alarms. Appendix D (Support System Performance Tests) addresses the testing of equipment associated with power sources and tamper protection. Appendix E (Personnel and Procedure Performance Tests) provides guidelines for designing and conducting site-specific tests of personnel and procedures. Candidate procedures and sample test scenarios are included. General Considerations While this guide covers a broad spectrum of Assessment activities, it cannot address all Security Systems and variations used at DOE facilities.

8 The methods that are described may have to be modified or adapted to meet Assessment -specific needs, and assessors may have to design new methods to collect information not specifically addressed in this guide. Information in this guide is intended to complement DOE orders by providing practical guidance for planning, collecting, and analyzing Assessment data. Assessors should refer to this guide, as well as DOE orders and other guidance, during all stages of the Assessment process. Using the Topic-Specific Methods Sections 2 through 9 provide topic-specific information intended to help assessors collect and analyze Assessment data. Each subtopic section is further divided into the following standard format: General Information Common Deficiencies/Potential Concerns Planning Activities Performance Tests (if applicable) Data Collection Activities.

9 Note that DOE Order , Protection Program Operations, applies to the subtopics, in addition to other documents that may be relevant, such as: Executive Orders Site Safeguards and Security Plans (SSSPs) Implementation memoranda Memoranda of agreement Procedural guides. These references are used as the basis for evaluating the assessed program and for assigning findings. It is useful to refer to the applicable references, particularly DOE guidance, during interviews and tours to ensure that all relevant information is covered. General Information The General Information section defines the scope of the subtopic. It includes background information, guidelines, and commonly used terms to help assessors focus on the unique features and problems associated Physical Security Systems Assessment Guide December 2016 PSS-4 with the subtopic.

10 It identifies the different approaches that a facility might use to accomplish an objective and provides typical examples. Common Deficiencies/Potential Concerns This section addresses common deficiencies and concerns associated with the subtopical area, along with a short discussion that provides additional detail. Information in this section is intended to help the assessor further refine Assessment activities. Where appropriate, general guidelines are provided to indicate where a particular deficiency is likely to occur. Planning Activities This section identifies activities normally conducted during Assessment planning. If applicable, specific activities or information available to assessors is identified for all planning phases.