Decree of the National Security Office No. 339 / 1999 Coll.
National Security Office Decree on Object Security
Valid
Order
Effective from 28.12.1999
Text versions:
28.12.1999
339
DECLARATION
National Security Office
of 13 December 1999
on object safety
The National Security Office ("the Office '), pursuant to Articles 49 (2) and 50 (4) of Act No. 148 / 1998 Coll., on the Protection of classified information and amending certain acts, as amended by Act No. 164 / 1999 Coll.:
Subject matter
This decree sets out the means of ensuring the protection of objects, technical means, the use of technical means, the conditions for the deployment of physical surveillance and the regime for the purpose of object security.
For the purposes of this decree:
a) by object - building or other building or other enclosed space in which secure areas are located;
(b) a secure area - a built-in space within the facility where classified information is processed or stored;
(c) the building boundary - the mantle, fencing or other similar boundary of the space,
d) entry into the building - a place intended to enter and exit persons from the building and a place intended to enter and exit means of transport from the building,
(e) means of transport - means of land, underground, air and water transport of persons, objects and materials;
(f) operator of the object - State authority, legal or natural person using the object to carry out his or her activities;
(g) emergency situation - a situation in which there is a imminent risk of tampering with (1) classified information;
(h) threat - the possibility of unauthorised handling of classified information in the event of breach of object security;
(i) risk - the likelihood of a threat occurring;
(j) by an unauthorised person - a natural person who is not intended to have contact with classified information for a specified classification level and a specified field of activity.
Breakdown of secured areas
(1) Secured areas are classified in categories according to the classification level of classified information which occurs there.
(a) "V" if the classified information is classified in the "Reserved,"
(b) "D" if classified information is classified in the "Confidential" level;
(c) "T" if classified information occurs within them in the "Secret" level;
(d) "PT" where classified information is classified in the "Top Secret."
(2) The security areas referred to in paragraph 1 are subdivided into classes:
(a) Class I - the entry into this area is familiar with classified information. All access to and exit from this area is controlled and can only be accessed by designated persons, 2)
(b) Class II - the entry into this area shall not be made familiar with classified information. All access to and exit from the area shall be controlled and the entry of unauthorised persons shall be possible only with an escort determined in accordance with the conditions laid down in the operating rules.
(3) Secured areas, their classification in the relevant category and class are determined by the statutory authority of the operator of the premises.
Object categorisation
(1) Objects are to be classified in categories according to the highest category of secured areas present in them
(a) "V" if a secure category "V" area is present in the building,
(b) "D" if a secure category area "D" is present in the building,
(c) "T" if a secure category area "T" is present in the object;
(d) "PT" if a secure area of the "PT" category is present in the building.
(2) The object boundary and its classification in the relevant category are determined by the statutory authority of the object operator.
Object protection
(1) The protection of the building is ensured by a combination of security measures, which are
(a) physical surveillance of the premises,
(b) technical means; and
(c) regime measures.
(2) The scope, manner and conditions of application of security measures are determined on the basis of risk assessment, taking into account the safety standards of the Office.
(3) Risk assessment is carried out
(a) identifying the species and identifying the quantities of classified information which occur or will occur in the premises, in particular in view of the consequences of unauthorised handling of such information;
(b) a description and assessment of the threats to which such classified information is subject;
(c) description and assessment of the vulnerability of classified information to such threats;
(d) establishing the level of risk, such as "small," "medium" or "large," on the basis of an assessment of threats and vulnerability to classified information.
(4) On the basis of the risk assessment referred to in paragraph 3, it shall be carried out:
(a) the assessment of the state of the security measures referred to in paragraph 1 and the assessment of whether their implementation for a given level of risk complies with this Decree and the safety standards of the Office;
(b) other appropriate precautions where the state of the security measures referred to in (a) is insufficient;
(c) the findings of the risks which remain after the application of the safety measures.
(5) The statutory authority of the building operator shall keep under constant review all circumstances affecting the risk assessment referred to in paragraph 3 and, where necessary, take the appropriate security measures referred to in paragraph 1.
Physical security of the object
(1) Physical surveillance of the premises shall be ensured by trained staff of the operator of the premises, members of the armed forces or armed corps or by staff of the designated security services.
(2) For "V" category objects, physical surveillance of the object is ensured only during working time, unless the statutory authority decides that physical surveillance of the object is also ensured outside working time.
(3) For "D" category objects, physical surveillance of the object is ensured continuously. Physical security of the building is provided by at least 1 physical surveillance worker at the post designated for the continuous performance of the building's security. The site intended for the continuous exercise of physical surveillance of the object may be located outside this object provided that the combination of the security measures referred to in Section 5 allows for a proper rapid intervention. A statement of technical means referred to in Section 7 (2) (c) shall be sent to the post designated for continuous exercise of physical surveillance of the object.
(4) For objects of categories "T" and "PT" the physical surveillance of the object is ensured continuously. Physical surveillance of the building shall be provided by at least 2 physical surveillance personnel at the post designated for continuous exercise of physical surveillance of the building. The length of the access route from the site intended for the continuous exercise of physical surveillance of the object to the entrance to the outermost secured area shall not exceed 500 metres. An output report of the technical means referred to in § 7 (2) (c), (f) and (d) or (e) shall be made to the post designated for the continuous exercise of physical surveillance of the object.
(5) The implementation of physical surveillance of the premises is regulated by the safety standards of the Office.
Technical means
(1) A technical device is a safety component the use of which prevents, makes it difficult or notifies a breach of the protection of an object or a secure area.
(2) The technical means are in particular:
(a) mechanical means of defence, which are storage objects, (3) locks, doors, bars, foil, safety frames and glass;
(b) electrical lock installations and systems for securing access to buildings and secure areas, equipment and systems for electronic demonstrating the legitimacy and identity of persons, including audit where appropriate;
(c) electrical signalling equipment for detecting and evaluating unauthorised entry;
(d) special television systems for scanning, transmitting and displaying the movement of persons and means of transport in objects;
(e) emergency systems, in particular distress detectors, which function as part of an electrical alarm system;
(f) electrical fire alarm equipment;
(g) detectors of substances or equipment primarily used for the detection of metals;
(h) physical destruction equipment for information media;
(i) equipment against passive and active eavesdropping of classified information from places outside the premises.
Scheme measures
The framework measures are:
(a) the entry and exit regime for persons and for entry and exit of means of transport, which provides for:
1. authorization of persons and means of transport to enter and enter the building, exit and exit from the building and method of control; and
2. the conditions and manner of checking the discharge and balance of classified information from the premises;
(b) the arrangements for the movement of persons, means of transport and classified information in the premises and parts thereof on working and non-working hours;
(c) the system of key handling, identification devices and media used for the input security systems referred to in Article 7 (2) (b) (hereinafter referred to as "keys"), specifying in particular the system and the way in which the keys are marked, assigned and surrendered, their storage and registration, the storage of duplicates and their use;
(d) the mode of handling and use of technical equipment.
Entrance permission
(1) The list of persons authorised to enter the premises (hereinafter referred to as authorised persons) and the list of the means of transport authorised to enter the premises are laid down in the rules laid down in Section 14 (1) (d).
(2) An entry and entry authorisation is issued by the statutory authority of the operator of the object or by a person authorised by him.
(3) The right of entry of persons or entry of means of transport into the premises shall be demonstrated in the manner laid down in the rules laid down in Paragraph 14 (1) (d), which allows them to be clearly identified.
(4) The statutory authority of the operator of the premises shall lay down in the operating rules measures to prevent visits from becoming aware of classified information. The person accompanying the visit shall be responsible for compliance with the measures provided for.
(5) In the "D," "T" and "PT" categories, visitors are allowed to move in accompanied areas outside the security areas of Class I.
Control measures when entering an object
(1) The physical surveillance of the premises or of the person responsible for the operator of the premises shall be carried out by the person responsible for checking the authenticity of entry of persons and entry of means of transport into the premises in the manner laid down in the rules laid down in Article 14 (1) (d).
(2) When checking the entry of persons into the "PT 'category object, the certified technical means referred to in § 7 (2) (g) are used.
External object protection
(1) The external protection of the object is provided by a set of security measures referred to in § 5 (1) to ensure the protection of the object's boundary, access to the object and protection of emergency routes and other passable and passable openings to the object.
(2) The technical means referred to in Section 7 (2) (a) are used to protect the boundary of the "V" category object, taking into account the nature of the boundary.
(3) The technical means referred to in Article 7 (2) (a) and (c) are used to protect the boundaries of objects of categories "D" and "T" respectively.
(4) The technical means referred to in § 7 (2) (a), (c) and (d) are used to protect the boundary of an object of category "PT".
(5) If the boundary of the building is also the boundary of the secured area, certified technical means are used according to the requirements and categorisation of the secured areas.
(6) During working hours, certain security measures used to protect the building border may be disabled under operating conditions. In such cases, however, measures shall always be taken to prevent the unauthorised person from becoming familiar with the classified information.
(7) In the out-of-work period, the entire border of the building is continuously secured by the security measures provided for in Section 5.
(8) The entrance to the building shall be secured in the manner specified in Section 5 at a time when it is not used. For "V 'category objects, the technical means referred to in § 7 (2) (a) shall be used, for" D' and "T 'category objects, the technical means referred to in § 7 (2) (a) and (c) and for" PT' category objects, the technical means referred to in § 7 (2) (a), (c) and (d).
(9) Emergency routes and other passages and passages are secured at the point where they intersect the boundaries of the "V" category object, by the technical means referred to in § 7 (2) (a) and by the points where they intersect the objects of categories "D," "T" and "PT" by the technical means referred to in § 7 (2) (a) and (c).
Internal object protection
(1) The internal protection of the object is provided by a set of security measures referred to in Section 5 (1) to ensure secure areas.
(2) The scope and conditions of the internal protection of the object shall be determined by the statutory authority of the building operator in accordance with the documentation of the object security.
(3) In order to ensure the protection of secure areas, certified technical means of the relevant categories are used. 4) Uncertified technical means may be used only if they do not reduce the level of protection required for the classification level. Individual variants of the construction design of the border of the secured area, depending on the safety measures used referred to in Section 5, are listed in the Office's safety standards.
(4) The protected areas are as follows:
(a) the security area of category "V" in particular by the technical means referred to in Article 7 (2) (a) and (h), category "V" or more;
(b) a secure area of categories "D" in particular by the technical means referred to in Article 7 (2) (a), (c) and (h), category "D" or more. The technical means of the lower categories may only be used if the safety standards of the Authority are met,
(c) a secure area of categories "T" and "PT" in particular by the technical means referred to in § 7 (2) (a), (b), (c), (d), (f) and (h), category "T" or more. The technical means referred to in Article 7 (2) (d) may be replaced by those referred to in Article 7 (2) (e). The technical means of the lower categories may only be used if the Authority's safety standards are met.
(5) Secured areas of the categories "T" and "PT" in which classified information is regularly discussed with the classification grades "Secret" and "Top Secret" are protected by the certified technical means referred to in § 7 (2) (i) wherever these circumstances have been identified as threats within the meaning of § 5 (3) (b). The storage facility shall be equipped with such secure areas only if classified information is stored in them.
(6) Secured areas of category "D" and above, in which the permanent presence of workers is ensured, are protected in particular by the technical means of the relevant category referred to in Article 7 (2) (a) and (e). The technical means of the lower categories may only be used if the Authority's safety standards are met. The storage facility shall be equipped with such secure areas only if classified information is stored in them, the storage facility being located in such a way as to ensure the continued direct supervision of the persons present. When these secured areas simultaneously fulfil the role of habitats intended for the permanent exercise of physical surveillance of the object, they need not be equipped with the technical means referred to in Section 7 (2) (e).
(7) The classified facts of the classification levels "Reserved," "Confidential" and "Confidential" may be processed in premises of an object outside a secure area if the unauthorised handling of these facts is prevented.
(8) The statutory authority of the premises operator shall determine the method of carrying out the control of the protection of secure areas, in particular when leaving the workplace.
When emergency situations arise, the protection of the object shall be carried out according to the emergency plan of the object referred to in Section 14 (1) (e).
Object security documentation
(1) In order to ensure and implement the object security, the statutory body of the operator of the building shall process and maintain the documentation of the object security which it constitutes
(a) the risk assessment referred to in Article 5 (3);
(b) a security project for the protection of the object, including in particular the location of the secure areas in the object, including their class and category, and the use of security measures for the external and internal protection of the object;
(c) technical documentation of the object security, containing technical data, instructions and rules for the use of technical means, the layout of the technical means in the object and, for technical means certified by the Office of Certificates or copies thereof,
(d) operating rules, specifying in particular the mode of movement of persons and means of transport in the object, the mode of movement of classified information in the object, the mode of handling keys and the rules for exercising physical surveillance of the object, including the mode of entry and exit of persons and of entry and exit of means of transport from the object, and other instructions for the operation of physical surveillance of the object,
(e) an object protection emergency plan containing instructions for the protection of classified information in the event of an emergency.
(2) The documentation of the object security shall be filed with the statutory authority of the operator of the object or of the authorised person. The statutory authority of the premises operator shall be responsible for the compliance of the documentation with the actual state of security of the security measures corresponding to the risks assessed. Compliance with the documentation referred to in paragraph 1 shall be checked by the statutory body of the operator of the premises
(a) for objects of category "V" at least every 24 months;
(b) for "D" category objects at least every 12 months;
(c) for objects of categories "T" and "PT" at least every 6 months.
Transitional provision
Where this Decree imposes the use of certified technical means, non-certified technical means for protecting classified information may be used
(a) "T" and "PT" until 31 December 2000,
(b) "V" and "D" until 31 December 2001.
Repeal
Decree No. 258 / 1998 Coll., on Object Security, is hereby repealed.
Efficacy
This decree shall take effect on the day of its publication.
Director:
Kadlec v. r.
1) Article 2 (5) of Act No. 148 / 1998 Coll., on the Protection of classified information and on the amendment of certain laws, as amended by Act No. 164 / 1999 Coll.
2) Paragraph 17 (1) of Act No. 148 / 1998 Coll., as amended by Act No. 164 / 1999 Coll.
3) Article 7 of Decree No. 244 / 1998 Coll., on details of the determination and marking of the classification level and procedures for the creation, registration, transfer, transport, lending, storage, other handling and shredding of classified documents, as amended by Decree No. 338 / 1999 Coll.
4) Article 5 of Decree No. 12 / 1999 Coll., on ensuring the technical security of classified information and certification of technical means, as amended by Decree No. 337 / 1999 Coll.
Sign in for notes, favorites and notifications
Regulation Information
| Citation | National Security Office Decree No. 339 / 1999 Coll., on Object Security |
|---|---|
| Regulation Type | Order |
| Author | - |
| Collection | Code of Laws |
| Date of Promulgation | 28.12.1999 |
|---|---|
| Effective from | 28.12.1999 |
| Effective until | - |
| Status | Valid |
The regulation text is for informational purposes only.
Comments 0