© 2011 Underwriters Laboratories Inc.
National Industrial Security Systems (UL 2050) 5th
Edition November 5, 2010
JSAC April 2017
The Origin of the Program
• Purpose• Partnership• Flexibility of Application
– Rational – Cost Effective– Threat Appropriate
Documents Defining Security
National Industrial Security Systems ,UL 2050National Industrial Security Systems ProgramOperating Manual (NISPOM)Director of Central Intelligence Directive 6/9 (DICD 6/9) (Now ICS 705-1)Manual for Physical Security of SensitiveConventional Arms, Ammunition, and Explosives
(DoD 5100.76-M)Joint Air Force Army Navy Physical Security
Manual 6/9 (JAFAN 6/9)
3
US Government Representatives
Cognizant Security Office
•Applies when areas being protected are controlled by the Defense Security Service
Cognizant Security Agency
•Applies when areas being protected are controlled by other US Government organizations such as the intelligence community (soon to be known as Accrediting Official-see ICD-705)
4
Role of the CSO/CSA
• Define the Minimum Features of the IDS• Provide Prior Approval of Variables• Approve Security in Depth (SID) where
applicable• Confirm Clearances where Required• Coordinate with Contractor and Alarm Company
on non-technical IDS issues• Coordinate with UL Representatives
5
Role of the UL Auditor
National Industrial Security Systems (CRZH)
• To Audit ASC’s that have requested UL Certificates for Compliance with UL 681 & UL 2050
National Industrial Monitoring Station (CRZM)
• To Audit Government Contractors or Central Stations that have established a Listing for Compliance with UL 2050
6
UL 2050
How Standards are Created
• UL Staff Designated as Primary Engineer
• Work with Key Stakeholders
• Consider Proposed Requirements
How Standards are Maintained
• Input from Key Stakeholders
• UL Develop Proposed Revisions
• Consider Proposals
7
National Industrial Security Systems(CRZH)
8
Who Is Responsible
9
• 4.3 of UL 2050• ASC may assign monitoring &
investigation but retain responsibility• ASC may assign installation & service
provided they supervise & verify correctness
• ASC may assign maintenance, but only to personnel that work exclusively for the ASC Service Center
Assigning Elements of Service
10
Alarm Service CompanyCorrectness of Installation
Service & MaintenanceTraining & Performance of
Monitor & Investigator
MonitoringGovernment Contractor
Monitoring Station (GCMS)or
National IndustrialMonitoring Station
or UL Central Station
orLaw Enforcement
InvestigationGovernment Contractor Investigator
orPrivate Guard &
Government Contractor Rep.or
Law Enforcement & Government Contractor Rep.
orGovernment Contractor Rep.
Impact of Security In Depth
Reduces electrical supervision of remote equipment rooms when a GCMS is used
(Does Not Apply When Areas Housing AA&E Are Monitored or DCID applies)Reduces standby power requirements when a GCMS is used
(except SCIF’s and SAPF’s)
Allows the use of an Extent 5 design of protection in closed areas(Does Not Apply to Areas Housing AA&E or When DCID applies)
11
Features Requiring Prior Approval
Use of Extent 5* vs. Extent 3• *Extent 5 only applies to the NISPOM
Non Line Security Transmission Use of Data NetworksOnly Monitoring Alarm & Trouble SignalsMonitoring in a Law Enforcement AgencyInvestigator Response PersonnelResponse Times beyond 5 or 15 Minutes
12
Government Contractor Monitoring StationPurpose - to monitor industrial security systems
that are installed in the following areas:
• Areas occupied by the government contractor that operates the GCMS
• Areas occupied by a subcontractor
• Areas occupied by other government contractors
The station is verified & receivers are maintained by the ASC
13
National Industrial Monitoring StationPurpose - to monitor industrial security systems
installed in the following areas that are more than 4 hours away from the monitoring station:
–Areas occupied by the government contractor that operates the NIMS
–Areas occupied by a subcontractor
–Areas occupied by other government contractors
14
Commercial UL Central Stations ProvideMonitoring of Alarm System
• (operators & station may have to be cleared)Processing of Signals & Creation of RecordsDispatching InvestigatorsPeriodic Testing of Communication Links to Investigators
15
Signal Processing in GCMS, NIMS, or a Central Station
Record each of the following types of signals
• Openings & Closings
• Alarms
• Troubles
Maintain current lists of the following
• Authorized operators of the system
• Personnel to be notified of an alarm
• The FSO/SSO
• Service department personnel in the alarm service company that maintains the system
16
Law-Enforcement Agency or Public Emergency Center
Requires Prior Approval by CSO/CSA
Monitors System for Alarms & Trouble Conditions
Dispatches Investigators
Receivers are maintained by a UL Listed Alarm Service Company
17
Alarms & Unauthorized Openings (Sec 12)
Contact-alarmed areaVerification-speak to authorized user
•Late or None- During business hours CALL FSO/SSO
- After business hours DISPATCH
•Timely Verification- During business hours CALL FSO/SSO
- After business hours REPORT TO FSO/SSO
18
Follow UP to Alarm Signal
If the system resets in 1 minute• Dispatch a single investigator who has access to the
exterior of alarmed area
• Technician inspects area within 4 hours of facility opening for business
After verification• When open for business, report to FSO/SSO by voice
and in writing
• When closed for business, report to FSO/SSO in writing
19
Investigators
Government contractor investigators cleared & with unescorted access
Private guards without unescorted access and a representative of the government contractor
On-duty law-enforcement officer and a representative of the government contractor
A representative of the government contractor having authorized access
20
*
*
*Requires Prior Approval by CSO/CSA
Details
If Government Contractor Representatives are used
•3 people shall be on call
•The name & phone number of the FSO/SSO shall be maintained
•The phone numbers shall be verified in writing every 90 days
21
Response Teams & Times
22
Primary Investigator Secondary Investigator
Response Times
Government Contractor Investigator
None 5, 15, 20, or 30*
Private Guard (without unescorted
access)
Government Contractor
Representative
5, 15, 20, or 30 (Primary), 60 min for
Representative Law Enforcement Government
Contractor Representative
No Time Stated for Primary,
60 Min for Representative
Government Contractor Representative
None 60 Minutes
*Requires prior approval by CSO/CSA
Auditing Alarm Records
Records are held at ASC office or at the Government Contractor officeReview is conducted on responses to each individual alarm systemThe calculation of the percentage of overruns starts at the fifth alarmNo arrival results in a cause analysis
23
Communication Channel Failures
Attempted Compromise (See Sec 13)
• Treated as an Alarm if System is Armed
• Treated as a Trouble if System is Disarmed
Disruption of Channel (See Sec 14)
• Applies when Channel Serves More that 1 System
- Contact Communication Provider
- Contact FSO/SSO
24
Upon Arrival and Beyond
No Cause Was Found -
• Test and Reset by Investigator
- Checked by service technician within 4 hours of opening of the facility.
• Not Reset by Investigator
- Area check by investigator and service technician dispatched
25
Trouble Signals & Service Calls
Occupied or Checked AreasInitiate repairs within 4 hours after facility opens if
- Area is occupied by a person with authorized access OR
- Area is checked by cleared personnel based on NISPOM
Not Occupied or Checked Areas• Initiate repairs within 4 hours
26
ContractsWhen monitoring and/or investigation is assigned(See 18.1 & 18.2)30 Day cancellation clauseDD254 is required if monitoring or investigation isassigned to a central station AND the NISPOMapplies (See 18.3)Contracts do not relieve the Alarm ServiceCompany from keeping the alarm and monitoringsystems in compliance (see 18.4)Failure to uphold the contracts – Cancel Certificate(See 18.6)
27
Training
The ASC is responsible to arrange for and/or verifyTraining
Training shall be conducted annually or whenthere is a change
The ASC shall keep a record of the specifictraining and the name of who was trained.
28
Conducting a Service Test
During business hours
•Trip a signal at an unoccupied area- Verification
- Dispatch
After business hours (rarely done)
•Trip a signal with FSO/SSO
• Initiate a telephone test- Dispatch
29
Security of Communication Channels
Communication paths from the alarmed area to the monitoring center are as important as the installation
Line Security -The supervision against compromise using 2 way communicationMay be either Standard or Encrypted
Non-Line Security - (Requires prior approval by CSO/CSA)
The supervision of a single fault condition on the communication path
Exists when there is 1 way communication30
Security of Communication Channels
Transmission methods that provide Line Security -2 Way Radio FrequencyData Networks
Transmission methods that do not provide Line Security -
Digital CommunicatorsCellular Transmitters* (Some do provide line
security-check the Listing)1 Way Radio Frequency
31
Requirements for Encryption
Certified by NIST
• At least 128 Bit Encryption
• Complying with FIPS 140-2 OR FIPS-197
Listed by UL as Line Security Equipment
Generally Required by the CSO/CSA When Data Networks are used
32
Degraded Network
If the network becomes degraded or inoperative, the areas have to be watched or occupied
Service response times and notification in accordance with Sec 14 of UL 2050
33
Alarm Installations
Installed in Closed Areas, SCIF’s or SAPF’s
• Extent 5 (Only Applies to Closed Areas under the NISPOM)
• Extent 3
Installed in Vaults or on Container
• Extent Complete
34
Extent of Protection #3
Area B
contact on exterior door4 step motion
Area A contact on exterior door4 step motion
Movable Windows
A
B
Using Motion Detection
Extent of Protection #3
Area B contact on exterior doorcontact 1 windowmotion to cover door & windowglass break on 2 windows
Area A contact on exterior doormotion to cover doorglass break on 3 windows
Movable Windows
A
B
Using Perimeter Protection
Protection of Containers & Vaults
Extent Partial consists of a contact that is Listed for safe & vault applications on each door. One contact may be used on GSA approved containers.
Extent Complete consists of a contact that is Listed for safe & vault applications on each door. One contact may be used on GSA approved containers. In addition all exterior surfaces of the vault or container is protected with vibration sensors or proximity detectors.
37
National Industrial Monitoring Stations (CRZM)
38
Origin of Category
To develop a means of determining the qualification of a monitoring location that is distant from the protected property
To clarify the responsibility for the continued compliance of the monitoring facility
39
A Listing is Required When -
The station is not within the 4 hour service territory of the ASC service center to which the certificate was provided
The station is maintained by another ASC service center
40
Auditing a National Industrial Monitoring Station
41
The Purpose
An NIMS has been evaluated for compliance with Section 6 & 7 of UL 2050 (when operated by a government contractor) or UL 827 as a Central Station (when operated by an ASC)
The Audit is to verify
• The facility continues to comply
• The staff performs the required tests
• The staff is trained in their duties
42
The UL Alarm System Description Form
43
44
45
46
47
48
UL Certificate Service Territories forAlarm Systems and Services
ND
MO
AR
#
NY
AK
HI
WA
CA
NV
OR ID
MT
WY
UT
AZ NM
TX
OK
KS
NE
SD
MN
IA
WI
IL
LA
MS AL GA
FL
SC
NCTN
KY
IN
MI
OH
VA
WV DE
MD
NJ
CTMA
VT
NH
ME
CO
Puerto Rico
US Virgin Islands
East
West
Midwest
Washington, D.C.
PA
Regional ContactsMid West: Joe Weller 847 664 2368East Coast Pete Tallman 631 546 2415
Additional Contact for Texas area is Nick Mirus 972-509-1294