[Code of Federal Regulations]
[Title 32, Volume 6]
[Revised as of July 1, 2004]
From the U.S. Government Printing Office via GPO Access
[CITE: 32CFR2001.43]

[Page 484-485]
 
                        TITLE 32-NATIONAL DEFENSE
 
CHAPTER XX--INFORMATION SECURITY OVERSIGHT OFFICE, NATIONAL ARCHIVES AND 
                         RECORDS ADMINISTRATION
 
PART 2001_CLASSIFIED NATIONAL SECURITY INFORMATION--Table of Contents
 
                         Subpart D_Safeguarding
 
Sec. 2001.43  Storage [4.1].

    (a) General. Classified information shall be stored only under 
conditions designed to deter and detect unauthorized access to the 
information. Storage at overseas locations shall be at U.S. Government 
controlled facilities unless otherwise stipulated in treaties or 
international agreements. Overseas storage standards for facilities 
under a Chief of Mission are promulgated under the authority of the 
Overseas Security Policy Board.
    (b) Requirements for physical protection. (1) Top Secret. Top Secret 
information shall be stored by one of the following methods:
    (i) In a GSA-approved security container with one of the following 
supplemental controls:
    (A) Continuous protection by cleared guard or duty personnel;
    (B) Inspection of the security container every two hours by cleared 
guard or duty personnel;
    (C) An Intrusion Detection System (IDS) with the personnel 
responding to the alarm arriving within 15 minutes of the alarm 
annunciation [Acceptability of Intrusion Detection Equipment (IDE): All 
IDE must be UL-listed (or equivalent as defined by the agency head) and 
approved by the agency head. Government and proprietary installed, 
maintained, or furnished systems are subject to approval only by the 
agency head.]; or
    (D) Security-In-Depth conditions, provided the GSA-approved 
container is equipped with a lock meeting Federal Specification FF-L-
2740.
    (ii) An open storage area constructed in accordance with Sec. 
2001.43, which is equipped with an IDS with the personnel responding to 
the alarm arriving within 15 minutes of the alarm annunciation if the 
area is covered by Security-In-Depth or a five minute alarm response if 
it is not.

[[Page 485]]

    (iii) An IDS-equipped vault with the personnel responding to the 
alarm arriving within 15 minutes of the alarm annunciation.
    (2) Secret. Secret information shall be stored by one of the 
following methods:
    (i) In the same manner as prescribed for Top Secret information;
    (ii) In a GSA-approved security container or vault without 
supplemental controls; or
    (iii) In either of the following:
    (A) Until October 1, 2012, in a non-GSA-approved container having a 
built-in combination lock or in a non-GSA-approved container secured 
with a rigid metal lockbar and an agency head approved padlock; or
    (B) An open storage area. In either case, one of the following 
supplemental controls is required:
    (1) The location that houses the container or open storage area 
shall be subject to continuous protection by cleared guard or duty 
personnel;
    (2) Cleared guard or duty personnel shall inspect the security 
container or open storage area once every four hours; or
    (3) An IDS (per paragraph (b)(1)(i)(C) of this section) with the 
personnel responding to the alarm arriving within 30 minutes of the 
alarm annunciation. [In addition to one of these supplemental controls 
specified in paragraphs (b)(2)(iii)(B)(1) through (3), security-in-depth 
as determined by the agency head is required as part of the supplemental 
controls for a non-GSA-approved container or open storage area storing 
Secret information.]
    (3) Confidential. Confidential information shall be stored in the 
same manner as prescribed for Top Secret or Secret information except 
that supplemental controls are not required.
    (c) Combinations. Use and maintenance of dial-type locks and other 
changeable combination locks.
    (1) Equipment in service. The classification of the combination 
shall be the same as the highest level of classified information that is 
protected by the lock. Combinations to dial-type locks shall be changed 
only by persons having a favorable determination of eligibility for 
access to classified information and authorized access to the level of 
information protected unless other sufficient controls exist to prevent 
access to the lock or knowledge of the combination. Combinations shall 
be changed under the following conditions:
    (i) Whenever such equipment is placed into use;
    (ii) Whenever a person knowing the combination no longer requires 
access to it unless other sufficient controls exist to prevent access to 
the lock; or
    (iii) Whenever a combination has been subject to possible 
unauthorized disclosure.
    (2) Equipment out of service. When security equipment is taken out 
of service, it shall be inspected to ensure that no classified 
information remains and the built-in combination lock shall be reset to 
a standard combination.
    (d) Key operated locks. When special circumstances exist, an agency 
head may approve the use of key operated locks for the storage of Secret 
and Confidential information. Whenever such locks are used, 
administrative procedures for the control and accounting of keys and 
locks shall be established.