[Introduction 3](#introduction)

[A Note For Smaller Federal Facilities.
4](#a-note-for-smaller-federal-facilities.)

[What Should a Mail Center Security Plan Include?
4](#what-should-a-mail-center-security-plan-include)

[I. Risk Assessment 5](#i.-risk-assessment)

[Components of a Risk Assessment with Definitions of Terms
5](#components-of-a-risk-assessment-with-definitions-of-terms)

[Conducting a Risk Assessment 6](#conducting-a-risk-assessment)

[Step One: Asset and mission identification -- What are you trying to
protect?
6](#step-one-asset-and-mission-identification-what-are-you-trying-to-protect)

[Step Two: Threat Assessment -- What bad things could happen?
7](#step-two-threat-assessment-what-bad-things-could-happen)

[Step Three: Vulnerability Assessment -- What are your weaknesses?
8](#step-three-vulnerability-assessment-what-are-your-weaknesses)

[Step Four: Impact Assessment -- What would happen if your security
measures failed?
8](#step-four-impact-assessment-what-would-happen-if-your-security-measures-failed)

[Step Five: Risk Analysis -- What does it all add up to?
9](#step-five-risk-analysis-what-does-it-all-add-up-to)

[Federal Security Risk Management Chart
10](#federal-security-risk-management-chart)

[II. Mail Center Operating Procedures -- Creating a Safe and Secure
Environment
11](#ii.-mail-center-operating-procedures-creating-a-safe-and-secure-environment)

[Incoming Mail Procedures 11](#incoming-mail-procedures)

[Handling Accountable Mail 11](#handling-accountable-mail)

[Personal Mail 12](#personal-mail)

[Loss Prevention and Cost Avoidance
12](#loss-prevention-and-cost-avoidance)

[Physical Security in a Mail Center/Facility
13](#physical-security-in-a-mail-centerfacility)

[Daily Opening and Closing Procedures
13](#daily-opening-and-closing-procedures)

[**The checklist for opening the mail center should include:**
14](#the-checklist-for-opening-the-mail-center-should-include)

[**The checklist for closing the mail center should include:**
14](#the-checklist-for-closing-the-mail-center-should-include)

[Building Security Committees 14](#building-security-committees)

[Offsite Processing Of Incoming Mail
14](#offsite-processing-of-incoming-mail)

[Personal Protective Equipment 15](#personal-protective-equipment)

[Psychological Effects 15](#psychological-effects)

[Workplace Violence 16](#workplace-violence)

[III. Training, Testing, and Rehearsal
17](#iii.-training-testing-and-rehearsal)

[The importance of testing the plan
17](#the-importance-of-testing-the-plan)

[X-Ray training 17](#x-ray-training)

[Contents of a complete training program
17](#contents-of-a-complete-training-program)

[IV. Managing Threats 18](#iv.-managing-threats)

[Suspicious letters and packages 18](#suspicious-letters-and-packages)

[**Post examples.** 18](#post-examples.)

[**Rehearse**. 18](#rehearse.)

[**Question every suspicious letter or package.**
19](#question-every-suspicious-letter-or-package.)

[Mail Bombs 21](#mail-bombs)

[V. Communications Plan 23](#v.-communications-plan)

[Management 23](#management)

[Customers 23](#customers)

[Mail Center Personnel 23](#mail-center-personnel)

[**Communications During an Emergency.**
23](#communications-during-an-emergency.)

[Relationships with partner organizations (First Responders, Public
Health Authorities, FBI, FPS, Regional USPIS, Fire, Hazmat and Law
Enforcement Officials)
24](#relationships-with-partner-organizations-first-responders-public-health-authorities-fbi-fps-regional-uspis-fire-hazmat-and-law-enforcement-officials)

[VI. Occupant Emergency Plan (OEP) 25](#vi.-occupant-emergency-plan-oep)

[Occupant Emergency Program 25](#occupant-emergency-program)

[Occupant Emergency Organization 25](#occupant-emergency-organization)

[Designated Official 25](#designated-official)

[Occupant Emergency Plan (OEP) 25](#occupant-emergency-plan-oep)

[**Evacuation Plans** 25](#evacuation-plans)

[**Whom to Contact in the Event of an Emergency**
26](#whom-to-contact-in-the-event-of-an-emergency)

[**Building/Occupant Information** 26](#buildingoccupant-information)

[**The Command Center (COMMAND CENTER)**
26](#the-command-center-command-center)

[VII. Continuity of Operations Planning (COOP)
27](#vii.-continuity-of-operations-planning-coop)

[What are the Key Elements of a COOP?
27](#what-are-the-key-elements-of-a-coop)

[What are the Responsibilities of the Mail Manager in a COOP?
27](#what-are-the-responsibilities-of-the-mail-manager-in-a-coop)

[What are the Objectives of a COOP for a mail facility?
27](#what-are-the-objectives-of-a-coop-for-a-mail-facility)

[COOP background documents 27](#coop-background-documents)

[Fly-away kits 28](#fly-away-kits)

[VIII. Review of the Security Plan
29](#viii.-review-of-the-security-plan)

[Initial Review 29](#initial-review)

[Annual Review 29](#annual-review)

[Contractors 29](#contractors)

[Conclusion 30](#conclusion)

[Appendix A -- Risk Analysis Worksheet
31](#appendix-a-risk-analysis-worksheet)

[Appendix B -- On Line Resources For Keeping Your Mail Center Safe
32](#appendix-b-on-line-resources-for-keeping-your-mail-center-safe)

[Appendix C -- Mail Center Security Checklist
34](#appendix-c-mail-center-security-checklist)

#  

# Introduction

Throughout the seven years since the General Services Administration
(GSA) established the Office of Governmentwide Policy (OGP), federal
mail managers have requested training for themselves and their
employees. The OGP Mail Policy Team has fulfilled these requests by
offering quarterly Interagency Mail Policy Council meetings, the Annual
Educational Forums, and a web site full of training resources and other
information.

Mail center security was always a significant part of this training. It
became much more important after the anthrax attacks of October 2001.
The subject of mail center security has always been broader than
biological threats -- it also includes mail bombs and bomb threats,
preventing theft in the mail center, emergency planning, and
comprehensive security management.

We published the First Edition of this Mail Center Security Guide in
December 2001 and the Second Edition in October 2002. We also published
several documents on specific security topics. Most recently, in
December 2003, we published the "National Guidelines for Assessing and
Managing Biological Threats in Federal Mail Facilities." This Third
Edition of the Mail Center Security Guide incorporates new information
that has become available, as this nation's understanding of homeland
security has evolved. Significant additions to this edition include a
step-by-step process for performing a risk assessment, updated
information on managing threats, and information about Occupant
Emergency Plans and Continuity of Operations Plans. The risk assessment
should be performed by a security professional, mail management input is
critical to its success.

This Guide's purpose is to assist federal mail center managers in
keeping mail centers safe and secure. It provides an outline of the
planning and preparation that is appropriate for a federal mail center.
It encourages you to communicate with others in the planning process by
making you more familiar with their process. In particular, this Guide
offers:

-   Elements of a Mail Center Security Plan

-   Descriptions and discussion of those elements

-   Tips for operations, training, and communications

-   A list of on-line resources

-   A security checklist

The mail center security plan has many objectives, including these:

-   Protecting staff and all other employees and building occupants;

-   Avoiding unwarranted, costly and disrupting evacuations;

-   Providing a visible mail screening operation that demonstrates to
    all employees that management is committed to their safety;

-   Supporting employee morale and reducing stress by providing
    reassurance to all employees about the safety of mail;

-   Minimizing the likelihood of litigation, which could arise from
    suggestions that the mail center manager had not taken proper
    measures to keep employees safe while at work.

Throughout this Guide, "you" refers to the mail center manager, and "we"
refers to GSA.

A strong plan for mail center security, supplemented with regular
training, rehearsals, and reviews, helps instill a culture that
emphasizes the importance of security. Involving all members of the team
-- executives, managers, employees, contractors, security managers,
building management personnel, and union representatives \-- during
development and throughout is critical to the security plan's success.

### A Note For Smaller Federal Facilities.

*Many federal agencies have satellite facilities where mail operations
are performed in a small room, one corner of a room, or one corner of a
desk. In these facilities, responsibility for processing mail is divided
among professional and support staff. Security plans for small
facilities are, of course, limited by both the size of the facility and
the resources available to develop and implement plans. Small facilities
will, therefore, adopt those recommendations from this Guide that are
appropriate to them. Nonetheless, every federal facility should have a
security plan that considers each of the elements listed in Figure 1.
For the most part, security policy should be developed at a headquarters
level, with procedures tailored to the smaller location developed and
implemented onsite. Your threats and vulnerabilities will determine the
measures to protect your facility.*

### What Should a Mail Center Security Plan Include?

A complete mail center security plan includes the elements listed in
Figure 1, and every federal mail center manager should make sure that
all of these are included. For most mail centers, each of these elements
should be represented in a written document.

The mail center manager will not be required to prepare all of these
plans. They should participate actively in the development and
implementation of each of these elements, but other parts of the agency
or outside security experts should have the lead on most of them. The
mail center manager must ensure that they have addressed each of these
elements by identifying and working with the appropriate others.

# I. Risk Assessment

The first step in developing a security program is a site-specific risk
assessment for your mail center and its operation, in coordination with
your agency and bureau or department. The objective of a risk assessment
is to determine the likelihood that identifiable threats will harm a
federal agency or its mission. Each site has different threats and risk
levels, and this will lead to different security measures for each site.
A thorough understanding of the risk assessment process will allow you
to be better prepared to meet potential threats and eliminate or
mitigate consequences. A Risk Assessment incorporates the entire process
of asset and mission identification, threat assessment, vulnerability
assessment, impact assessment and risk analysis.

> **All decisions about mail center security must be based in the risk
> assessment.**

***Make sure the risk assessment is documented!***

## [Components of a Risk Assessment with Definitions of Terms]{.underline}

[Asset and mission identification]{.underline}: Identification of the
agency assets and missions that might be damaged by threats that could
come through the mail center.

[Threat Assessment]{.underline}: Identification of potential threats to
the mail center, including natural events, criminal acts, accidents, and
acts of terrorism, plus evaluation of the likelihood of each.

[Vulnerability Assessment]{.underline}: Analysis of the extent to which
the mail center is vulnerable to each of the potential threats
identified in the threat assessment.

[Impact Assessment]{.underline}: Determination of the impact on the mail
center, the facility, and/or the agency if a specific asset were damaged
or destroyed, or if a specific mission were impaired or temporarily
halted.

[Risk Analysis]{.underline}: Quantification, based on the impact, threat
and vulnerability assessments, of the likelihood and extent of possible
damage from each identified threat to the mail center, other agency
assets, and agency missions. This may help you to identify your "Risk
Rating Interpretation" in Figure 4.

[Risk Assessment]{.underline}: The entire process, consisting of asset
and mission identification, threat assessment, vulnerability assessment,
impact assessment, and risk analysis. Risk assessment helps answer the
questions in Figure 2.

We should mention that the resources we consulted in developing this
section use these terms in different ways. Even the term for the overall
process differs -- we have chosen to call it "risk assessment." Others
might call it a security assessment, security scan, and so on. We are
using a generally accepted model to make the subject of risk assessment
for a mail center as simple as possible to understand and implement. It
will help guide mail managers learn hoe to review risk assessments for
thoroughness. In the present environment, we must work together to stay
safe.

## Conducting a Risk Assessment

As mail center manager, you should be an active participant in the risk
assessment. However, appropriately trained and experienced security
personnel should have the lead in conducting your risk assessment.
Depending on your situation, your risk assessment should be led by:

-   Your building security office;

-   Base security:

-   Individual agency security service (e.g., Diplomatic Security
    Service);

-   The Federal Protective Service (now part of the Department of
    Homeland Security); or

-   Professional security consultants.

We used three resources in particular to help us develop the Risk
Assessment section of this Guide. They are:

[Risk Management: An Essential Guide to Protecting Critical
Assets]{.underline}, National Infrastructure Protection Center,
Washington DC, November 2002.

[Threat/Vulnerability Assessments and Risk Analysis]{.underline}, Nancy
A. Renfroe and Joseph L. Smith, Applied Research Associates, Inc.,
***2002.***

[Anti Terrorism: Criteria, Tools & Technology]{.underline}, Applied
Research Associates, Inc., Updated February 19, 2003.

The second and third items on this list are copyrighted and are used
here by permission. Additional resources that you may wish to consult
include:

-   Federal Bureau of Investigation, (The lead federal agency for crisis
    management)

> [http://www.fbi.gov](http://www.fbi.gov/)

-   Federal Emergency Management Agency (FEMA) (The lead federal agency
    for consequence

> management) [http://www.fema.gov](http://www.fema.gov/)

-   Workplace Risk Pyramid, OSHA
    http://[www.osha.gov/bioterrorism/anthrax/matrix](http://www.osha.gov/bioterrorism/anthrax/matrix)

-   Vulnerability Assessment of Federal Facilities, published by the US
    Department of Justice, June

> 28, 1995 (need website)

-   Mail Center Security, United States Postal Inspection Service

> <http://www.usps.com/postalinspectors>

-   Federal Protective Service website:
    http://[www.oca.gsa.gov](http://www.oca.gsa.gov/). (After you have
    logged in to this web

> site, (you must have an e-mail account) click on Resources and then
> scroll to the above title.)

### Step One: Asset and mission identification -- What are you trying to protect?

The first step in a risk assessment is identifying the assets and
missions that must be protected. In the asset identification step, the
security specialist with the assistance of the asset owner, identifies
and focuses only on those assets important to the mission or operation.
By identifying and prioritizing these assets, you take the first step
towards focusing resources on what is most important. Assets can be
tangible (e.g., people, facilities, equipment) or intangible (e.g.,
information, processes, reputations). Obvious mail center assets include
personnel, postage meters and other equipment, computers, accountable
mail, high-value shipments, the safe or vault and its contents, stamps,
pre-printed permit stationery, and the mail delivery roster. Your mail
center probably has most of these, and it may have others.

Since the mail center is a vulnerable point of entry for threats, your
risk assessment must also identify the assets and missions of your
customers; that is, the people to whom you deliver mail. Any deliberate
attack may not be directed at your mail center. Rather, it probably will
be directed at your customers and their missions. A worksheet is used to
record the results of the Asset Identification (see Appendix A). The
next step is to identify the threats that may adversely impact the
assets or mission you identified.

### Step Two: Threat Assessment -- What bad things could happen?

The next step in the risk assessment is determination of potential
threats. The threat assessment looks at the full spectrum of threats --
natural, criminal, accidental, or terrorist -- for a given location. The
assessment should examine supporting information to evaluate the
likelihood of occurrence for each threat.

-   For natural threats, you should look at historical data that shows
    the frequency of occurrence for tornadoes, hurricanes, floods,
    fires, and earthquakes in your area.

-   For criminal threats, look at local crime rates and consider whether
    your customers' assets and missions make you or them more attractive
    to criminals.

-   For accidents, look at the layout and machinery in your mail center,
    and also consider your building's mechanical equipment, especially
    plumbing. Also look at your historical accident rate (you should be
    keeping accessible, long-term records of accidents).

-   For terrorist threats, look at the missions performed by your
    customers and the visibility of federal executives located in the
    facilities that you serve.

For each of these, the security analyst should identify the specific
threats that might happen to your mail center or your facility.
Threshold then determines how they might enter the mail center or happen
there, and then estimate how **likely** each threat is. In making these
estimates, the analyst must rely on data and information obtained from
research and interviews, not on intuition.

[Significant threats to a federal mail center include:]{.underline}

-   **Foreign terrorism -** Agencies with high public visibility or
    international missions have a greater risk of being targeted by
    foreign terrorists. Also, agencies located in proximity to
    significant targets may be victims of collateral effects.

-   **Domestic hate groups -** Some citizens are actively involved with
    anti-government and hate groups and have adopted tactics similar to
    foreign terrorists.

-   **Disgruntled employees/workplace violence -** Reorganizations,
    layoffs and terminations may lead to theft, sabotage or violence.
    Additional steps should be taken to protect individual employees who
    are being harassed, stalked or threatened inside or outside the
    workplace.

-   **Accidents** -- such as workplace accidents, vehicle accidents,
    floods from major plumbing leaks, and building fires.

-   **Acts of nature** - such as wildfires, floods, severe weather, or
    earthquakes.

One very important part of this step is simply looking at your mail
stream. Certain agencies, such as the Federal Bureau of Investigation
(FBI), receive threatening mail almost daily; while others have seldom,
if ever, see a threatening mail piece despite careful, routine
inspection.

A threat may be introduced by anyone who sends anything through the mail
with the intent to frighten, disrupt, injure, etc. It could be the
animal rights activist or the environmental radical, the pro-rights or
pro-life extremist, the disgruntled employee, the angry spouse, or
simply a disappointed citizen. It could be anyone. **Remember: you
don\'t have to be a target in order to become a victim.**

A key question that must be answered in a Threat Assessment is: How
visible are your agency, your facility, and any executives who work in
your facility, and to what extent does their visibility make it more or
less likely that a criminal or terrorist might select your facility for
an attack? Some federal agencies are, of course, highly visible, but
many federal agencies and facilities are relatively unknown to the
general public and are, thereby, much less at risk.

The next step is to identify and characterize vulnerabilities related to
specific assets or undesirable events.

### Step Three: Vulnerability Assessment -- What are your weaknesses?

Once the security analyst has identified your assets, missions, and
threats, the next step is to determine how vulnerable your assets and
missions are to the threats. In this step, the security analyst looks
for exploitable situations created by inappropriate design, inadequate
equipment, or deficient security procedures. In the mail center,
examples of typical vulnerabilities (which you might also call points of
weakness) may include:

-   Poor access controls,

-   Lack of x-ray equipment,

-   Inadequate security training or rehearsal,

-   Lack of stringent service contract management, and

-   Unscreened visitors in secure areas

This step requires the security analyst to look at each asset from the
outside inward, as each of the potential adversaries might look at it.
Specifically, the analyst should begin by studying each asset and asking
questions such as: "If I wanted to physically harm this facility, I
would . . .?" Or "If I wanted to attack a specific person?" or "If a
major hurricane struck?" And so on down the list of adversaries and
undesirable events. The significance of each vulnerability depends on
how easily an adversary could exploit it, or on the likelihood of an
accident or natural disaster.

A key component of the vulnerability assessment then considers the
potential impact of loss from a successful event or occurrence. Impact
of loss is the degree of loss to which the mission of the location is
impaired by a successful attack from a given threat. This question looks
at the

> What level of deterrence and/or defense do existing countermeasures
> provide, and how attractive is each of the assets or missions to a
> potential terrorist or criminal?

### Step Four: Impact Assessment -- What would happen if your security measures failed?

Once you have identified each significant asset and mission, next
determine what the impact or consequence would be if that asset were
lost, damaged, or destroyed, or if your agency were temporarily
prevented from performing that mission, or if its ability to perform it
were significantly impaired. The overall value of the asset or mission
is based upon the severity of this effect.

For example, if your mail center were flooded by an overflowing stream
or the building's plumbing, and you could not get back into the mail
center for several days, what would be the impact on your agency's
mission?

Another example: If an improvised explosive (that is, a bomb) passed
through the mail center without being identified, reached its intended
target in your facility, and detonated, what would the consequences be
on the facility and the people who work there -- the intended victim and
everyone else?

**[Part of the impact Assessment]{.underline}** will be a determination
of the impact on the mail center, the facility, and/or the agency if a
specific asset were damaged or destroyed, or if a specific mission were
impaired or temporarily halted.

### Step Five: Risk Analysis -- What does it all add up to?

The final step in the risk assessment process is to combine the four
previous steps; that is, to evaluate, for each asset and each mission,
how the impact, threat, and vulnerability assessments interact. The
product is a statement of the level of risk for each asset and each
mission.

A worksheet such as the example in Appendix A makes it much easier to
make this evaluation, by aligning all of the information into a readable
and easily understood format.

The terms used in sample worksheet (high, medium, low) are subjective
and hard to combine. Depending on the audience for the risk assessment,
the security analyst may chose terms such as these, or he or she may
chose a 1 to 10 numerical scale.

A simple equation provides the underpinnings for rating risks:

***Risk = Consequence x Threat x Vulnerability***

Figure 3 above offers a few questions that fit many federal mail
centers. The remainder of this Mail Center Security Guide provides
guidance on countermeasures; that is, on the things that the mail center
manager, security professional, and agency executives can do to protect
the assets identified in the risk assessment. You need to recognize that
most risks cannot be eliminated. You also need to recognize that you can
reduce risk dramatically by preparation, planning, training, rehearsal,
and continuous review. A Risk Assessment is a snapshot in time and needs
to be updated whenever operations change or there are significant
changes in the organization.

## Federal Security Risk Management Chart

The diagram on this page is provided with the permission of the authors
at Applied Research Associates, Inc. A more detailed report on Risk
Assessment containing this report can be found on the GSA Office of the
Chief Architect's web site at http:www.oca.gsa.gov. After logging in,
click on Projects.

![](media/image1.jpeg){width="6.498611111111111in"
height="7.680555555555555in"}

# II. Mail Center Operating Procedures -- Creating a Safe and Secure Environment

## 

Most of the effort in developing a risk assessment, as described in the
preceding section, should be accomplished by security professionals. By
contrast, mail center operating procedures must, necessarily, be
developed locally. Though higher levels in the federal agency will
develop the policy these procedures will be based on work processes at
the local level. Please remember that all decisions about mail center
operating procedures, as well as every other aspect of mail center
security, must be based on the risk assessment.

## Incoming Mail Procedures

If possible, acquire an x-ray machine to scan mail. If mail volume is
too low to justify acquiring an x-ray machine, consider partnering with
another organization to x-ray. All mail, regardless of carrier, should
be x-rayed -- be sure to include couriers and small package carriers.

Once the mail has been x-rayed, inspect the mail for suspicious
characteristics. If possible, do this in an area isolated from the rest
of the mail center. See "Training and Rehearsal" below for information
on inspecting incoming mail, and see "Physical Security in the Mail
Center" for information on isolating the incoming mail processing area.
Mark all packages with a stamp that says "x-ray" to acknowledge that it
has been screened if at all possible.

Limit access for anyone who delivers mail to your center; deal with them
at a counter.

Authorized receptacles for U.S. Mail clearly labeled.

Procedures established for handling unexplained or suspicious packages.

Make personal protection equipment available for all employees,
including gloves and masks. See "Employee Safety" below for additional
information.

Require employees to wear photo identification at all times.

Instruct employees to challenge any unknown person in the facility.

Deliveries for Senior Executives

Give extra care and attention to letters and packages addressed to any
senior official whose names and/or positions give them higher public
visibility. Meet with representatives from the senior management
(Executive Secretariat, Administrator, etc.) to establish procedures for
mail and packages addressed to senior officials. Mark all packages and
envelopes addressed to senior officials after you have screened them;
the best practice is to use a large stamp that says "Inspected by Mail
Services." No letters or packages should be accepted at the Executive
Area unless clearly stamped "Inspected by Mail Services". This includes
both internal and external deliveries.

## Handling Accountable Mail

Establish a closed-loop manifest system for all accountable letters and
packages (e.g., certified mail, UPS, FedEx). Verify the delivery
manifest sheet to ensure that you have received all packages listed.
Accept complete shipments only.

A closed-loop system means that someone signs for each piece of
accountable mail whenever possession changes. For example, the receiving
clerk should require internal couriers to sign for all packages that
they deliver.

Always require a signature for accountable mail at the final point of
delivery. Don't leave any accountable mail at an unoccupied desk or
mailbox. Have someone else in the department sign for the piece, or
leave a note with directions to pick up the piece at the mail center.

Retain copies of all accountable mail manifests.

If possible, install an electronic manifest system to speed up the
process and increase accuracy. An electronic system also makes it easier
to conduct research on past deliveries.

## Personal Mail

In most circumstances, agency and/or facility-level policy should
prohibit handling incoming or outgoing personal mail in a federal mail
center. The existing federal regulation on mail management, 41 CFR,
102-192.125(i), authorizes agencies to adopt this policy, but it also
authorizes federal mail managers, at the facility level, to make
exceptions where appropriate.

All employees should be notified that any mail sent to the office is
considered "delivered" by the United States Postal Service once it is
received in the mail center and therefore can be opened by the agency
mail center.

## Loss Prevention and Cost Avoidance

-   Screen job applicants before hiring them -- do credit and criminal
    checks, and try to talk with references and former employers.

-   Be aware of what may prompt an employee to steal.

```{=html}
<!-- -->
```
-   Integrate accounting procedures for all forms of postage -- meters,
    stamps and permits.

```{=html}
<!-- -->
```
-   Establish procedures to control access of employees, known visitors
    and escorted visitors.

-   Require visitors to sign a log, and if possible, install access
    control equipment. Key control, card readers, or buzz entry are a
    few options.

```{=html}
<!-- -->
```
-   Permit only authorized employees to accept mail.

-   Conduct regular checks of your postage meters to ensure employees
    are not using agency meters for personal mail. Maintain meter logs
    (Postal Service Form 3602-A or electronic logs) carefully, and lock
    meters when not in use. Where feasible, remove the meter from the
    equipment and store it in a locked cabinet during off-hours.

-   Carefully package shipments of valuable materials; send them via
    certified mail, and make sure their outside labeling does not
    identify the contents.

-   Implement inventory controls to ensure proper access and
    accountability for stamps, permit envelopes and labels, and perform
    regular audits of the inventory.

-   No personal mail should be sent using the meter or permit imprints.
    If the agency allows staff to drop personal mail at the Mail Center,
    separate it from official outgoing mail, and insist that staff
    provide their own stamps for personal mail.

-   Review bills from carriers (e.g., FedEx, UPS) regularly to guard
    against unauthorized use.

-   Check periodically to determine if the mail messengers are making
    unauthorized stops or leaving the mail unattended in unlocked
    delivery vehicles.

-   Obtain delivery time listing from express carriers and make sure
    that all appropriate refunds are collected.

## Physical Security in a Mail Center/Facility

-   If possible, make the mail center an enclosed room with defined
    points of entry. If you can't put the mail center in its own room,
    then set aside a defined space that is used only for processing
    mail. Do not have employee lockers within the mail center. If
    possible, locate the mail center near the loading dock. This will
    allow the mail to travel directly to the mail center from outside
    and minimize the impact that any potentially contaminated mail will
    have on the rest of the building.

```{=html}
<!-- -->
```
-   Within the mail center, establish a separate space for processing
    incoming mail. For a small mail center, this might be no more than a
    defined part of a table or desk. In a large mail center, this could
    be a separate room. Be sure to check the ventilation system of the
    area you choose to ensure adequate airflow.

-   Where the risk assessment, the volume of mail and a cost-benefit
    analysis make it appropriate, the mail center should have its own
    air handling and ventilation system. You may also consider
    establishing negative air pressure for the area where you process
    incoming mail or for the entire mail center. Down-draft tables with
    HEPA filters are a good way to limit employee exposure to routine
    dust as well as possible airborne hazards. You may also want to
    consider an isolated room with its own ventilation system and HEPA
    filters.

-   If you regularly see suspicious letters or packages in your mail
    stream, you may want to obtain a glove box or biochemical hood in
    which to open them (a biochemical hood operates with negative air
    pressure). In any event, you should establish a relationship with a
    first responder organization that has a glove box or hood, so that
    they can open suspicious mail.

```{=html}
<!-- -->
```
-   Install alarms at each access point, and monitor them for
    after-hours activity.

-   Install secure areas, such as safes or locked cabinets, for meters,
    express shipments and valuables. Reset combinations and re-key locks
    after significant employee transitions.

-   Provide a separate and secure area for personal items (e.g., coats
    and purses). Consider prohibiting employees from taking personal
    items into the workplace.

-   Where appropriate, use surveillance cameras to monitor the service
    counter and all entrances (Assure your employees that the cameras
    aren't for tracking their movements, but for protecting them from
    potential threats.)

-   Make sure that supervisors and team leaders are clearly visible from
    the floor. Proper supervision is a prerequisite for keeping
    personnel and your mail center safe. Leaders must be easily
    accessible to respond to emergency situations.

-   Post signs around the mail center listing whom to call in the event
    of various emergencies such as fire, theft, suspicious package, etc.
    This is probably the most important step you can take in preparing
    to deal with emergencies or suspicious letters and packages.

## Daily Opening and Closing Procedures

Prepare detailed procedures for opening and closing the mail center.
Make sure that logs and checklists are filled out and signed daily.

####### **The checklist for opening the mail center should include:**

-   Check all locks/entrances

-   Start visitor log

-   Verify contents of safe/vault

-   Take meter readings

####### **The checklist for closing the mail center should include:**

-   Take meter readings

-   Secure meters

-   File visitor log

-   Secure all mail

-   Create safe/vault contents log

-   Check all locks/entrances

Establish daily procedures for cleaning the area and equipment used to
process inbound mail. All flat work areas should be wiped down daily
with disinfectant. All machines should be cleaned with disinfectant
wipes and vacuums equipped with HEPA filters. Do not use pressurized air
to clean equipment and machinery.

## Building Security Committees

The 1995 Department of Justice Vulnerability Assessment of Federal
Facilities recommends that all Federal buildings should have Building
Security Committees (BSC). BSC Membership consists of at least one
representative from each of the Federal agencies occupying the building.
The BSC serves as the principal forum for discussion of the building's
security and emergency planning requirements.

The mail center manager should maintain contact with the building BSC,
and should ensure that the overall building security plan includes
specific consideration of the mail center and its particular
vulnerabilities and needs.

## Offsite Processing Of Incoming Mail

Offsite processing is an option that you should consider if the security
assessment identifies a high level of risk or if mail volumes are large
enough to justify the cost. However, there are also advantages,
primarily in terms of timely processing and readily available customer
service, to placing the mail center on site.

Consideration of offsite processing probably will give rise to
additional questions, such as:

-   Which specific aspects of mail processing can be accomplished with a
    higher level of security offsite?

-   What is the difference in cost to build, maintain and operate the
    offsite facility versus a comparable facility onsite?

-   Will you also maintain a customer service counter onsite?

-   How much longer will it take to deliver mail if it is processed
    offsite, and would the additional time be critical to part of your
    agency's operations?

-   Will a contractor operate the offsite facility and, if so, what
    security and performance standards will you establish in the
    contract?

-   Would it be cost-effective to scan, store, and deliver some portion
    of the incoming mail electronically?

## Personal Protective Equipment

GSA does not recommend *mandatory* use of personal protective equipment
(PPE) if the risk analysis does not support it. This includes gloves,
aprons, and respirators ("respirator" is the correct term, rather than
"mask"). On the other hand, GSA does recommend making PPE available for
any mail center personnel who chose to use it. This equipment can cause
problems, so any employee who chooses to use it must be trained.
Removing gloves the wrong way can spread contamination, for example, and
respirators can induce respiratory problems in some people. Respirators
must be fitted by a trained expert to provide any useful level of
protection. Managers must ensure that all equipment is kept clean and
properly serviced.

The Centers for Disease Control (CDC) provide guidance on selecting PPE
to protect against bioterrorism, and the Occupational Safety and Health
Administration (OSHA) provides guidance on using PPE in workplaces. For
the most current information, refer to the Centers for Disease Control
website: www.bt.cdc.gov and the OSHA website at www.osha-slc.gov/.

If some employees chose to use PPE, you should establish a log that
lists when each employee completed equipment training.

## Psychological Effects

More deeply than most of realize or are willing to admit, we have been
profoundly affected by the attacks on the United States and the specter
of a prolonged war against terrorism. We need to support each other and
listen well with our ears and our hearts. For many reasons, this
elevated need for good listeners will linger for a long time. In
addition, the on-going hoaxes generated keep our emotions high in
anticipation of another attack.

Feel and observe what is going on around you. Listen to what is being
said and to what is not being said. Watch the attitudes, moods and body
language of co-workers, friends and others with whom you interact. Do
you sense that unspoken fears are troubling a co-worker? Does he/she
seem unusually quiet, sad troubled or edgy? Trust your instincts and
intuitions. Don't hesitate to strike up a conversation. When you really
care and when you are willing to take time to be with another you may be
surprised at how readily people will open up and share their feelings
with you. Create an atmosphere that welcomes sharing, while also being
respectful of individuals who have little to say or prefer to remain
silent.

For more information on coping with terrorism, visit the following web
sites:

> The American Psychological Association \-- Coping with Terrorism, Tips
> for helping you cope after a terrorist attack, and reassurance that it
> is okay to feel fear and uncertainty about the future
> <http://www.helping.apa.org/daily/terrorism.html>
>
> American Medical Association -- Fear and anxiety are normal human
> reactions to a perceived threat or danger. Uncertainty is manageable
> if people keep the threat of fear in perspective. "Knowledge and
> information based on fact can help us manage our anxieties", says
> Richard K. Harding, M.D., and APA President Read more at:
> <http://www.psych.org/disaster/copingnationaltragedy-main92501.cfm>
>
> American Psychiatric Association -- Psychosocial, Post Traumatic
> Stress Resources, as well as resources for helping children
>
> <http://www.psych.org/disaster/copingnationaltragedy-main92501.cfm>
>
> The Red Cross also has information available on how citizens can
> prepare for a terrorist attack
> [www.redcross.org/services/disaster/keepsafe/unexpected.html](http://www.redcross.org/services/disaster/keepsafe/unexpected.html)

The attitudes and feelings of employees are critical to the success of
your mail center during normal operations, and even more so in light of
the attacks. It is important to recognize that some of your employees
will have concerns about their personal safety. Managers need to be
prepared to help employees carry out their jobs in these challenging
times.

The U.S. Office of Personnel Management has prepared an excellent
website with quick access to practical, timely resources:
<http://www.opm.gov/ehs/terrorism.htm>. Topics there include:

-   Coping with violence, disaster, and stress

-   Hazardous duty pay

-   Leave administration

-   Responding to telephone threats

Every federal agency has an Employee Assistance Program (EAP) to help
restore employees to full productivity. The EAP provides free,
confidential short term counseling to identify the employee's problem
and when appropriate, make a referral to an outside organization,
facility or program to assist the employee in resolving their problem.
Counselors are available to help manage fears. Mail managers should know
how to avail themselves and employees of these services if they are
needed. To locate the EAP serving your federal agency, call your human
resource office and ask for the telephone number. For additional
information about EAP, download ***[Your Federal Employee Assistance
Program: A Question and Answer Guide for Federal
Employees]{.underline}*** at http://[www.opm.gov](http://www.opm.gov/).

A traumatic event in the workplace may impact an organizations ability
to perform. Guidance for agency managers can be found in the Handling
Traumatic Events: A Manager's Handbook, which describes steps managers
can take to provide effective leadership after a traumatic event. This
is at [http://www.opm.gov](http://www.opm.gov/).

## Workplace Violence

Employees who are being harassed, stalked or threatened inside or
outside the workplace should inform their managers, and supervisors.
Managers have a responsibility to be sensitive to the realities of
workplace violence and the effects on employees from abuse outside the
workplace. Some employees may be involved in domestic disputes that have
the potential to erupt and spill over into the workplace. Every effort
must be made to protect these employees and anyone else who may become
an innocent victim.

Building security should be notified, and additional steps should be
actions taken to protect these employees. If there appears to be an
immediate threat, notify the law enforcement resource that can most
readily provide security in the situation. This resource may be a local
police officer, an Inspector, a Special Agent, or a Federal Protective
Service Officer. Everyone in the office should know who the responsible
law enforcement resources are and how to contact them. Establishing
these contacts prior to a crisis can help in the event they are needed
in an emergency. More information is available on workplace violence at
the OPM website at [http://www.opm.gov](http://www.opm.gov/) and using
the search tool type in workplace violence.

# III. Training, Testing, and Rehearsal

The actions you take ***during*** a threat have an immediate impact on
the safety of everyone in your mail center. The actions you take
***before*** a threat have a lasting impact on the safety of everyone in
your agency. Preparing your mail center and your employees to handle a
threat is an obligation you must meet every day.

Education and awareness are the essential ingredients to preparedness.
Employees need to remain aware of their surroundings and the packages
they handle. You must carefully design and vigorously monitor your
security program to reduce the risk for all.

Through training, you can develop a culture of security awareness in
your operation. Through rehearsal, you can ensure that critical lessons
have been learned and retained. A union representative or other employee
representative will ensure employee confidence in their safety in
developing and giving training. Managers should consider security
training and rehearsal a critical element of their job.

In addition to educating the employees who work for you, you should
educate the employees who work for your agency. Employee awareness of
the measures you've taken leads to confidence in the safety of the
packages that are delivered to their desktops.

## The importance of testing the plan

One key to performance during an emergency is testing of the plan in
advance. Test contingency plans in a way that does not alarm employees
but follows the steps to take if there is an event. The dress rehearsals
reinforce the training and in the event of an emergency can more easily
be followed.

## X-Ray training

Training is necessary to qualify someone to inspect letters and packages
by x-ray. You should ensure that all of your personnel and any
contractors who staff the x-ray machine have sufficient training, and
that they keep their training current.

## Contents of a complete training program

-   Basic security procedures

-   How to recognize and report suspicious packages

-   Inspecting letters and packages by x-ray

-   Proper use of personal protective equipment (PPE)

-   How to respond to a biological threat

-   How to respond to a bomb threat

-   Continuity of Operations Plan (COOP)

-   Occupant Emergency Plan (OEP)

# IV. Managing Threats

# 

## Suspicious letters and packages

> Because the mail center is a first line of defense for your agency,
> you should examine every piece of mail before you do anything else
> with it. You should inspect it with an x-ray machine, and look for
> suspicious characteristics. Figure 5 is a standard list of
> characteristics that you and your staff should be looking for.

Train employees**.** Mail Center employees should be trained to
recognize and report suspicious packages. Characteristics of a
suspicious package or letter vary, depending upon the types of mail that
your operation routinely processes. That is, what is suspicious in one
mail center is not necessarily suspicious in another. However, anything
from the following list that is unusual, in terms or your normal mail,
or multiple items from this list, should draw the attention of your
employees.

####### **Post examples.** 

Copies of a "suspicious letter" poster should be displayed in every mail
center. These posters are available from the Federal Bureau of
Investigation (FBI) and the USPS. We have worked with the FBI, USPIS,
and other authorities to develop the standard list shown in Figure 5.
Phone numbers of who to call should be filled in.

####### **Rehearse**. 

Rehearse scenarios and test contingency plans with employees to ensure
that, in the event of emergency, they will know how to respond. Do this
in a way that does not alarm employees. These rehearsals will help
ensure that the lines of communication function as planned and that
everyone knows their role. Hold post-test meetings to address problems,
and resolve them before the next test.

####### **Question every suspicious letter or package.** 

If you can stabilize an unopened suspicious letter or package, with some
confidence that it presents little immediate threat, try to determine
whether the addressee or sender can identify and explain the contents.
The following is quoted from GSA National Guidelines:

Whenever a mail center worker identifies an [unopened]{.underline}
package or letter as "suspicious", a mail center supervisor or specially
trained employee should examine the mail piece to confirm that it meets
the criteria established for the location. If confirmed, *do not open
it.* A supervisor or designated mail center worker who is trained to
confirm the identification must be available during all working hours.

Next, determine if the mail piece is addressed to a person who actually
works in the facility. If so, and if the addressee can be located in a
reasonable period of time, contact the addressee and ask him or her to
identify the package. If the addressee recognizes the package and is
certain it is not threatening, deliver it. If the addressee does not
recognize the package, or if you cannot locate the addressee, attempt to
contact the individual listed on the return address to verify the
contents of the package. If you successfully contact the sender of the
package, ask them to provide a description of the contents, intended
addressee, and the reason it was mailed to your location. Provide this
information to the addressee for further verification.

If the addressee does not recognize the package, or if you cannot locate
the addressee, ***do not open it.*** The supervisor or designated mail
center worker should call the previously designated first responder
(that is, the organization you have identified as the right one for the
specific threat in hand). This first responder will be responsible for
opening the package in a controlled environment and following the
appropriate protocol for evaluation of the threat. A "controlled
environment" may be a glove box, hood with negative airflow and HEPA
filters on the exhaust airflow, or a similar device. When identifying
the first responder who will open suspicious letters or packages, make
sure they have such a device available.

**[Mail that contains an unidentified secondary
container]{.underline}**: If x-ray inspection shows a secondary
container that may contain an unknown material, or if you open a letter
or package and discover such a container, *do not open or otherwise
disturb the secondary container*. Treat the secondary container as
suspicious, unopened mail. As above, first call the addressee and see if
they can identify the container. If he or she cannot be located, then
call in the first responder designated to open suspicious mail.

The procedures for examining letters and packages, identifying
suspicious ones, and calling in an expert to when necessary are part of
managing threats. GSA and other authorities have developed and refined
procedures for mail centers to follow if you decide that a package or
letter is suspicious. The initial triage, or sorting and allocation of
treatment to individuals according to a system of priorities for any
threat situation must consider ***all* hazards**.

The first responder should assess for the presence of radiological
threats, explosive devices, dangerous chemicals, or biological threats.
Many different threats can be sent through the mail. The initial triage,
or sorting and allocation of treatment to individuals according to a
system of priorities for any threat situation, must consider all
hazards.

In the event that a trained first responder, after reviewing the
situation, determines that a possible threat may be present, the first
responder should take steps to determine the nature of the threat. A
radiological, bomb, or dangerous chemical threat is immediate and
requires swift, crisis-level responses. A biological agent is any
biological material capable of causing:

-   Death, disease, or other biological malfunction in a human, an
    animal, a plant, or another living organism;

-   Deterioration of food, water, equipment, supplies or material of any
    kind;

-   Harmful alteration of the environment.

Dirty bombs are regular explosives that have been combined with either
radiation-causing material or chemical weapons. While most news reports
talk about radiological dirty bombs, chemical agents may be used as
well. A blast from this type of weapon normally looks like a regular
explosion and the contamination spread is not often immediately
noticeable. When it is safe to do so, seek shelter inside a building,
putting as much shelter between you and the potential contaminant as
possible. Limit the amount of exposure by leaving the area when it is
safe to do so, or wait for the directions of first responding
organizations.

In chemical attacks, a toxic gas or liquid is used to contaminate people
or the environment. The prevalent symptoms are tightness in the chest,
difficulty breathing, blurred vision, stinging of the eyes, or loss of
coordination. If you witness a suspected chemical attack outdoors, move
upwind and away from the area as quickly as possible. If this is not
possible, move to a safe location inside a building and
shelter-in-place. If you suffer any of the symptoms mentioned above, try
to remove any clothing you can and wash your body with soap and water.
Do not scrub the area, as this may wash the chemical into the skin. Seek
medical advice as soon as possible. If the release is inside the
building, leave as soon as possible and go outside moving upwind and
away from the area as soon as possible.

Some significant differences exist between biological and other threats,
as exemplified by the following table:

+---------------+--------------------------+---------------------------+
|               | **BIOLOGICAL**           | **CHEMICAL**              |
+---------------+--------------------------+---------------------------+
| **Release     | Difficult to identify,   | Quickly discovered,       |
| Site of       | possible time delay in   | possible to cordon off    |
| Weapon**      | defining area of attack  | contaminated attack       |
|               | unless overt             | area(s)                   |
+---------------+--------------------------+---------------------------+
| **            | Delayed, usually days to | Rapid onset, usually      |
| Manifestation | weeks after an attack    | minutes to hours after an |
| of Symptoms** | (except toxins)          | attack                    |
+---------------+--------------------------+---------------------------+
| *             | Widely and rapidly       | Downwind area near point  |
| *Distribution | spread; contagious       | of release                |
| of Affected   | versus non-contagious    |                           |
| Patients**    |                          |                           |
+---------------+--------------------------+---------------------------+
| *             | Typically no             | Easily observed (colored  |
| *Signatures** | characteristic           | residue, dead foliage,    |
|               | signatures immediately   | pungent odor, dead        |
|               | after an attack          | insects or animal life)   |
+---------------+--------------------------+---------------------------+
| **Medical     | Antimicrobial            | Chemical antidotes for    |
| Coun          | treatments, vaccines or  | some agents               |
| termeasures** | immunoglobulins for some |                           |
|               | agents                   |                           |
+---------------+--------------------------+---------------------------+
| **Casualty    | Patient isolation and/or | After decon, no further   |
| Management    | quarantine crucial if    | need of protective        |
| &**           | communicable disease is  | measures or risk of       |
|               | involved                 | further contamination     |
| **Co          |                          |                           |
| ntamination** |                          |                           |
+---------------+--------------------------+---------------------------+

As opposed to chemical and radiological agents, biological agents are
not as immediately recognizable and consequence management may be
delayed, for example by therapy or vaccination, not traditionally
performed by first responders. However, effective countermeasures are
available against many of the bacteria, viruses, and toxins that might
be used. If we develop a solid understanding of the biological threats
we face and how to respond to them, many effects may be prevented or
minimized.

Additional information on dealing with the other types of threats may be
obtained from sources listed in Appendix B. This document may be used to
help develop a better understanding of the biological threats we face
and the steps to take if a biological agent is suspected. As the anthrax
bio-terrorism events in 2001 illustrated, mail supervisors sometimes
need to make judgments about mail that relate to their security in
receiving it.

The most important thing to remember when dealing with a letter bomb,
biological or chemical agent threat is: don't panic. Rash actions can
lead to even more harmful consequences. Biological agents, for example,
can spread more rapidly when improperly handled.

The United States Postal Inspection Service uses the acronym "SAFE":

-   **S**afety comes first.

-   **A**ssess the situation before taking action.

-   **F**ocus your efforts on the hazard, avoiding contact and access.

-   **E**valuate the situation and notify authorities.

## Mail Bombs

Motives for mail bombs are often revenge, extortion, terrorism or
business disputes. The likelihood of ever receiving a mail bomb in the
mail is very remote. However, mail bombs must be taken seriously, as
they can kill and seriously injure.

Mail bombs can be enclosed in either a letter or a parcel. Its outward
appearance is limited only by the imagination of the sender. Mail bombs
may or may not have one or more characteristics as listed in the
Suspicious Letters and Packages List. For more information on mail
Bombs, check with your local Postal Inspector or visit the USPS web site
at: <http://www.usps.com/postalinspectors/bombs.htm>.

The critical lesson about mail bombs is that virtually all of them can
be detected by skilled x-ray inspection of letters and packages. To
ensure that x-ray inspectors are paying close attention, consider using
software that randomly inserts an image of a suspicious package among
the images of actual letters and packages being scanned.

# V. Communications Plan

The mail center should develop a communications plan to be executed when
responding to a threat. This plan should cover how to acquire and
distribute information. Prepare a list of trusted resources to acquire
timely and accurate information (e.g., GSA, USPS, CDC, etc.). Organize
protocols for the approval and distribution of information on the status
of the mail operation. For more information, also see the section on the
Occupant Emergency Plan and GSA's National Guidelines for Assessing and
Managing Biological Threats in Federal Mail Facilities. Good
communications are part of any successful mail operation and are
critical for security issues. You have at least three audiences: mail
center personnel, customers, and management. All these audiences rely on
relationships.

## Management

Schedule regular meetings with a representative from the senior
management of your agency (Executive Secretariat, Administrator, etc.),
regional office, or facility. Review the steps you've taken to secure
the mail, and address any outstanding issues. Begin with more frequent
meetings, perhaps monthly. As events dictate, you may be able to change
the frequency to quarterly or semi-annually. However, do not let six
months pass without a meeting.

## Customers

The aspects of your security plans that will affect customers directly
should be developed with cooperation and assistance from customer
representatives. And then, highlights of your plans should be
communicated regularly to all customers. These two steps will assure
customer cooperation and understanding in the event of an emergency.
Consider marketing your plan by annual or semi-annual fairs or expos.

## Mail Center Personnel

Mail center personnel should be thoroughly involved in developing and
implementing your security plans. Once they have been developed, the
most important part of communicating those plans is training, as
discussed in Section VI above. We also suggest that you set aside time
in every meeting with mail center personnel to discuss security.
Enhanced security procedures and vigilance must become a way of life for
those involved.

As part of your security procedures, you should establish a call tree
for employees and managers. The call tree list should include, as a
minimum:

-   Names

-   Addresses

-   Work phone numbers

-   Home phone numbers

-   Beeper numbers

-   Cellular phone numbers

-   Name of person to contact in an emergency

***[This call tree should be tested and updated
regularly.]{.underline}***

####### **Communications During an Emergency.** 

Clear, consistent, and factual communications are critical in any
emergency. The anthrax attacks demonstrated once again that the morale
and performance of everyone involved in an emergency could be very
seriously affected by inconsistent, vague, and opinionated information.
Anyone in authority must be very careful to check their facts, to know
who the designated official spokesperson is for every aspect of the
emergency, and to coordinate any messages thoroughly.

Occupational Safety and Health Administration (OSHA) standards require
employers to make health and safety information available to any
employee who requests it. All information relevant to apparent and
credible biological threats should be provided to employees as quickly
as possible, preferably without waiting for a request. Health and Safety
Plans, also required by OSHA regulations, must include provisions for
sharing health and safety information.

Every federal agency must provide a safe working environment for all
employees, including those with special needs. Security procedures
should specifically address communications with individuals who may need
assistance during an emergency. Care should be taken to be sure all
employees are aware of those with special needs. Additional information
on emergency preparedness for disabled employees can be found at the
National Organization of the Disabled at
[www.nod.com](http://www.nod.com/).

## Relationships with partner organizations (First Responders, Public Health Authorities, FBI, FPS, Regional USPIS, Fire, Hazmat and Law Enforcement Officials)

# 

Many other aspects of security also require that you develop and
maintain relationships with key partners. Your first task in this regard
is to establish and maintain relationships with:

-   Local first responders to federal mail centers (fire, hazmat, and
    law enforcement);

-   Local public health authorities (disease control and laboratory).

-   Regional Federal Bureau of Investigation Weapons of Mass Destruction
    (WMD) coordinators; and

-   Regional US Postal Inspection Service inspectors.

A "first responder" is an emergency worker who responds to an incident
within a set amount of time. They also provide trained people to respond
to emergency situations. Usually this first responder label is specific
to Fire, Law Enforcement and Emergency Medical Service (EMS) immediately
arriving assets. You may need to establish relationships with several
different first responder organizations, depending on the personnel and
capabilities that they can provide. First responders to federal mail
facilities may be federal, state, and/or local organizations, depending
on your specific circumstances.

**[Once you have identified your first responder(s), then]{.underline}**

1.  Determine who will be responsible for opening unopened suspicious
    letters and packages, and establish a relationship with them (this
    may be a specially trained federal personnel or other first
    responders).

2.  Establish relationships and protocols with the local Federal Bureau
    of Investigation (FBI) WMD Coordinator concerning suspicious powders
    and liquids, or make sure that your first responders have done so.

3.  Ensure that the first responder organization(s) are ready, willing,
    and able to follow the established protocols, including GSA's
    National Guidelines for Assessing and Managing Biological Threats in
    Federal Mail Facilities, and that they have relationships with the
    other key partners.

Many of the above preparedness activities and local government contacts
can be initiated through and coordinated with the Local Emergency
Planning Committee (LEPC) responsible for the mail center's geographic
location. LEPC contact information can be found at
http://www.epa.gov/ceppo/lepclist.htm.

# VI. Occupant Emergency Plan (OEP)

The Occupant Emergency Plan (OEP) is a set of procedures to protect life
and property under defined emergency conditions. The Mail Center Manager
should be actively involved in the Occupant Emergency Program and in
development of the OEP.

An occupant emergency is an event that may require you to be evacuated
from your occupied space or relocated to a safer area. The emergency may
include a fire, explosion, discovery of an explosive device, severe
weather, earthquakes, chemical or biological exposure or threat, hostage
takeover, or physical threat to building occupants or visitors. In the
event of an emergency, the mail center manager must protect the people
who work there and ensure their exit from the situation to a safe place.

Chapter 101 of the Federal Property Management Regulations (FPMR),
Subchapter D, Part 101-20, spells out details of an Occupant Emergency
Program. The FPMR defines an OEP as ..."a short-term emergency response
program that established procedures for safeguarding lives and property
during emergencies in particular facilities."

## Occupant Emergency Program

The Occupant Emergency Program establishes a process for safeguarding
lives and property in and around the facility during emergencies. The
first component of an Occupant Emergency Program is development of a
plan, which is the OPE, to protect life and property under certain
specified emergency conditions. The second component is the formation of
an Occupant Emergency Organization.

## Occupant Emergency Organization

The Occupant Emergency Organization is a group of employees from the
agency who carry out the emergency program. It is comprised of a
designated official and other employees designated to undertake certain
responsibilities and perform the specific tasks outlined in their OEP.

## Designated Official

The Designated Official establishes, develops, applies and maintains the
plan. The Designated Official is the highest-ranking official in a
Federal facility or may be another person agreed on by all tenant
agencies. In the absence of a Designated Official, an alternate may be
selected to carry out responsibilities.

## Occupant Emergency Plan (OEP)

The critical elements of the OEP are:

####### **[Evacuation Plans]{.underline}**

> Be sure to specify where the mail center's employees should gather
> immediately after an evacuation, so that the supervisor on duty can
> take a head count. In some circumstances employees may be instructed
> to Shelter-in-Place. Depending on the circumstances and nature of the
> emergency, the first important decision is whether to stay put or get
> away. It is critical to understand and plan for either option. In some
> circumstances, staying put and creating a barrier between yourself and
> potentially contaminated air outside, a process known as
> shelter-in-place, is a matter of survival. Make sure employees know
> how to listen for instructions on where to go and when to evacuate.
> They must know the exact route that authorities specify. It is
> important to follow instructions and do not take any shortcuts as
> lives are dependent on following instructions. For more information on
> sheltering-in-place visit

####### **[Whom to Contact in the Event of an Emergency]{.underline}**

> All personnel should know whom to contact in case of emergency. A list
> of all emergency phone numbers should be available to everyone and
> updated as assignments change. The list should be published with the
> OEP for the facility. This list should be included in the Go-Kit.

####### **[Building/Occupant Information]{.underline}**

> The OEP should contain specific information about the building's
> construction and its occupants in narrative form or on a Building
> Information Sheet and Occupant Information Sheet. Floor plans should
> be included, with evacuation plans clearly marked.

####### **[The Command Center (COMMAND CENTER)]{.underline}**

> Emergency operations are directed from a command center. The command
> center should be centrally located and easily accessible for effective
> communication and control. The command center should have good
> communications capability, including at least two telephones and, if
> possible, portable radios and pagers.

More information on OEP\'s is available on the web at
[http://www.gsa.gov](http://www.gsa.gov/) and in the search tool type in
OEP or go to the url at:
<http://www.gsa.gov/Portal/gsa/ep/contentView.do?contentId=13413&contentType=GSA_BASIC>

For more information contact your local FPS Physical Security Specialist
or Law Enforcement Security Officer (LESO) can provide further
assistance or go to <http://www.dhs.gov/dhspublic/> and type in Law
Enforcement in the search tool.

# VII. Continuity of Operations Planning (COOP)

The Continuity of Operations Plan (COOP) is intended to ensure
continuance of essential Federal functions across a wide range of
potential emergencies. Essential functions are those that enable federal
agencies to provide vital services, exercise civil authority, maintain
the safety and well being of the general populace, and sustain the
industrial/economic base in an emergency. The COOP deals with
maintaining essential work once the safety of your personnel has been
assured.

The anthrax attacks demonstrated that hard-copy mail is not essential
for every federal office, but mail remains a critical function for many
federal programs. The mail manager should be thoroughly involved in the
COOP process in any case. The actual steps that are included in the COOP
plan, to keep incoming and outgoing mail flowing in the event of an
emergency, depend on the degree to which mail is essential to agency
operations.

## 

## What are the Key Elements of a COOP?

-   Outline essential functions.

-   Plan decision process for implementation.

-   Establish a roster of authorized personnel.

-   Provide advisories, alerts and COOP activation, and associate
    instructions.

-   Provide an easy reference guide for emergency response

-   Establish accountability.

-   Provide for attaining operational capability within 12 hours.

-   Establish procedures to acquire additional resources.

## What are the Responsibilities of the Mail Manager in a COOP?

The following are key suggested questions that the COOP should address
for mail:

-   Should an alternate facility will be planned for incoming and/or
    outgoing mail.

-   How quickly should the alternate facility be ready to operate?

-   How much of the original operation will be reconstituted in the
    alternate facility?

## What are the Objectives of a COOP for a mail facility?

-   Ensure the safety of associates during an emergency.

-   Ensure the continuous performance of essential functions/operations
    during an emergency.

-   Reduce or mitigate disruptions to operations.

-   Protect essential facilities, equipment, records, and other assets.

-   Reduce loss of life and minimize damage and losses.

-   Facilitate decision-making during an emergency.

-   Achieve orderly recovery from emergency situations across wide range
    of potential emergencies or threats, including acts of nature,
    accidents, technological, and attack-related emergencies.

-   Mitigate risks.

## COOP background documents

COOP is a good business practice, and part of the fundamental mission of
agencies as responsible and reliable public institutions. Since 1988, a
number of documents have built the foundation for COOP in federal
agencies:

-   Executive Order 12656 assigned responsibility for national security
    emergency preparedness to Federal departments and agencies.

-   Presidential Decision Directives 39, 62, and 63 addressed
    counter-terrorism, terrorism, and critical infrastructure.

-   Presidential Decision Directive 67 specifically addressed COOP in
    1998.

These documents are available for download at:
<http://www.fema.gov/library>.

## Fly-away kits 

To be prepared for various types of breaches of security or different
types of emergencies, each mail center should have a "fly-away kit." At
a minimum, this should consist of COOP checklists (see Section XII
below, key contact lists, diskettes or CDs with critical files, any
specialized tools that are routinely used, maps to alternate sites
records, and any other information and equipment related to an emergency
operation. A "fly-away kit" should contain those items considered
essential to supporting contingency operations at an alternate site. You
should designate a key official and one or more alternates to pick up
the kit in an emergency. You should also keep a duplicate fly-away kit
at your backup facility.

#   {#section-5 .unnumbered}

# VIII. Review of the Security Plan

## Initial Review

An excellent method of ensuring that your plan is complete is to have it
reviewed by external resources. Examples include consultants, the
Federal Protective Service, agency security service, and a peer review.

As a minimum, the plan review should provide a written report that
covers:

-   Location(s) surveyed

-   A critique of the formal plan

-   Training audit

-   Analysis to determine if employees are following established
    procedures

-   Background of the organization conducting the review

If you desire, the GSA Mail Communications Policy office will coordinate
a peer review of your operation, employing senior members of the
Interagency Mail Policy Council. These reviews will only be conducted if
requested by the agency or mail center manager. All results from the
review will be held confidential, with all copies being handed over to
the requesting official.

If you would like GSA to coordinate a review, please send a written or
e-mail request to the Director, GSA Mail Communications Policy. In your
request, please include the desired dates of the survey, an alternate
start date, identification of the organization to be surveyed, and the
point-of-contact name and phone number.

The mailing address is:

General Services Administration

Mail Communications Policy Program (MTM)

1800 F Street NW Suite 1221

Washington DC 20405-0002

The e-mail address: <federal.mail@gsa.gov>

## Annual Review

Once a year or if there are any changes, you should review all aspects
of your security plan. Pull them out, read through them, and consider
carefully whether any aspect should be updated. Circumstances change,
and the information on protecting your mail center and your agency
continue to evolve as we travel together in this new world of homeland
security. Re-evaluate your last rehearsal to determine any training
needs that might have emerged as a result. Train your personnel and
rehearse your plan.

# Contractors

Many agencies use contractors to process their mail, either as outsource
providers that manage mail centers or as letter shops that consolidate
and/or presort outgoing mail. It is important to remember that mail
center security remains the responsibility of the agency, even when a
contractor takes over part of the process. Contracts should specify
security procedures that the contractor and contract personnel must
follow.

Consider addressing the following as part of the process of contracting
for mail services:

Process -- The vendor should provide copies of all written procedures on
how mail is handled.

Timeliness standards \-- These will reduce opportunities for
mishandling.

Security -- The contract should specify the steps the vendor will take
to provide the best possible security, including hiring practices and
employee screening checks.

Technology -- Evaluate the technology that the vendor will deploy to
process your mail. Request presentations on electronic manifests for
inbound mail, Coding Address Accuracy System (CASS) certification, etc.

Discount sharing -- If you are using a vendor to prepare and presort
your mail, conduct on-site audits to ensure that you are being charged
correctly and receiving the appropriate discounts.

Scanning/electronic imaging -- Ask for vendor briefings on preparing and
storing digital images. Ask your agency information technology
department for assistance with this review. The briefing should cover
the strategy for the long-term storage of electronic documents,
retrieval from long-term storage, and how original documents will be
prepared and indexed for storage.

**[Performance-based service]{.underline}**: Develop a performance-based
service contract that focuses on three critical elements:

**[A performance work statement]{.underline}**: The performance work
statement defines the Government's requirements in terms of the
objective and measurable outputs. It should provide the vendor with
answers to five basic questions: what, when, where, how many, and how
well. It is important to answer these questions well, to allow the
vendor the opportunity to accurately assess resources required and risks
involved.

**[A quality assurance plan]{.underline}**: The quality assurance plan
gives the Government flexibility in measuring performance and serves as
a tool to assure consistent and uniform assessment of the contractor's
performance. A good quality assurance plan should include a surveillance
schedule and clearly state the surveillance methods to be used in
monitoring contractor performance.

**[Appropriate incentives]{.underline}:** Incentives should be used when
they will encourage better quality performance and may be either
positive or negative or a combination of both. They do not need to be
present in every performance-based contract. Positive incentives are
actions to take if work exceeds the standards. Standards should be
challenging, yet reasonable attainable. Negative incentives are actions
to take if work does not meet the standards.

Conduct periodic reviews separate from the acquisition process. Also,
tour the shop to see that the procedures are being followed. Confirm
that all mail is being processed in a timely manner and that all other
performance standards are being met.

More information on Performance -- Based Contracting can be found at:
[http://www.gsa.gov](http://www.gsa.gov/) and type ARNET, using the
search tool. This will ensure you the latest information.

# Conclusion

Although the mail center operates as the focal point for federal
agencies, security policies and procedures for the mail center are often
overlooked. Security is critical to mail center operations -- large and
small. This Mail Center Security Guide was prepared by GSA with a team
of experts to help you, as a mail center manager, and your coworkers
keep your mail center safe and secure. Prevention is the key for keeping
your mail center secure.

# Appendix A -- Risk Analysis Worksheet

+---------+----------+------+--------+---------+--------+-----------+
| *       | **Undes  | **Lo | **Thr  | **V     | **Coun | **Overall |
| *Assets | irable** | ss** | eats** | ulnerab | ter-** | Risk**    |
| and     |          |      |        | ility** |        |           |
| Mis     | **       | **   | (exa   |         | **mea  | **Eva     |
| sions** | Events** | Effe | mples) | (ex     | sure** | luation** |
|         |          | ct** |        | amples) |        |           |
| (ex     | (e       |      |        |         | **Opt  | (         |
| amples) | xamples) | (e   |        |         | ions** | examples) |
|         |          | xamp |        |         |        |           |
|         |          | les) |        |         | (exa   |           |
|         |          |      |        |         | mples) |           |
+---------+----------+------+--------+---------+--------+-----------+
| Postage | Fr       | Me   | Mail   | Medium  | Aut    | Medium    |
| meters  | audulent | dium | center |         | omated |           |
|         | use      |      | per    |         | p      |           |
|         |          |      | sonnel |         | ostage |           |
|         |          |      |        |         | tr     |           |
|         |          |      |        |         | acking |           |
+---------+----------+------+--------+---------+--------+-----------+
| Mail    | Injury   | High | Wor    | High    | Im     | Medium    |
| center  |          |      | kplace |         | proved |           |
| pe      |          |      | in     |         | mail   |           |
| rsonnel |          |      | juries |         | center |           |
|         |          |      |        |         | layout |           |
+---------+----------+------+--------+---------+--------+-----------+
| Mail    | Loss     | High | Fire   | Low     | Eff    | Low       |
| d       |          |      |        |         | ective |           |
| elivery |          |      |        |         | OEP    |           |
| roster  |          |      |        |         |        |           |
+---------+----------+------+--------+---------+--------+-----------+
| Agency  | Tem      | Crit | Flood  | Low     | Pl     | Low       |
| m       | porarily | ical |        |         | umbing |           |
| issions | disabled |      |        |         | maint  |           |
|         |          |      |        |         | enance |           |
+---------+----------+------+--------+---------+--------+-----------+
| Agency  | Injury   | Crit | Impr   | Low     | X-ray  | Low       |
| exe     | or death | ical | ovised |         | insp   |           |
| cutives |          |      | exp    |         | ection |           |
|         |          |      | losive |         | of     |           |
|         |          |      |        |         | pa     |           |
|         |          |      |        |         | ckages |           |
+---------+----------+------+--------+---------+--------+-----------+

#  

# Appendix B -- On Line Resources For Keeping Your Mail Center Safe

Excellent resources for additional information include:

U.S. Department of Labor (DOL), Occupational Safety and Health
Administration (OSHA) -- http://www.osha.gov

Workplace Risk Pyramid, OSHA --
http://[www.osha.gov/bioterrorism/anthrax/matrix](http://www.osha.gov/bioterrorism/anthrax/matrix)

Centers for Disease Control (CDC) -
http://[www.bt.cdc.gov](http://www.cdc.gov/)

Office of Personnel Management - publishes questions and answers on
federal employees personnel issues, etc. - http://www.opm.gov

Federal Bureau of Investigation (FBI) --
http://[www.fbi.gov](http://www.fbi.gov/)

Federal Emergency Management Agency (FEMA) --
http://[www.fema.gov](http://www.fema.gov/)

Bureau of Alcohol, Tobacco and Firearms (BATF) --
http://[www.atf.treas.gov](http://www.atf.treas.gov/)

DA PAM 25-52, [Mail Facility Security and Handling Suspicious
Mail]{.underline} --

http://[www.usapa.army.mil/pdffiles/p25_52.pdf](http://www.usapa.army.mil/pdffiles/p25_52.pdf)

Council on Foreign Relations - Homeland Security Questions and Answers
on Biological Attacks - http://www.terrorismanswers.com/security

General Services Administration (GSA) --
http://[www.gsa.gov](http://www.gsa.gov/)

GSA Mail Communications Policy Office - http://www.gsa.gov/mailpolicy

Suspicious Letters and Packages Identifiers - Now part of the National
Guidelines on the GSA Mail Policy web site. Choose Mail Center Security
and then Choose the National Guidelines. You will find ta printable
version under appendix c.
[http://www.gsa.govmailpolicy](http://www.gsa.govmailpolicy/)

GSA Federal Protective Service - <http://www.dhs.gov/dhspublic/> and
type in Law Enforcement in the search tool.

Security Assessment -- http://[www.oca.gsa.gov](http://www.oca.gsa.gov/)
(Note -- you will need to obtain a password to use the resources on this
site)

US Postal Service (USPS) -- [www.usps.com](http://www.usps.com/)

USPS Suspicious Mail Alert Poster (downloadable) -
http[://www.usps.com/news/2001/press/mailsecurity/security.htm]{.underline}

USPS and FBI Reward Poster -
[www.usps.com/news/\_pdf/25m_poster.pdf]{.underline}

USPS Postal Inspection Service - www.usps.com/postalinspectors

Best Practices for Mail Center Security -

[www.usps.com/news/2001/press/mailsecurity/pr01_isbestprac.htm](http://www.usps.com/news/2001/press/mailsecurity/pr01_isbestprac.htm)

The following publications are available from the US Postal Inspection
Service:

Identify Theft Brochure - (Publication 280) -

Www. new.usps.com/cpim/ftp/posters/pos265.pdf

Misleading Advertisements - Media Guidelines (Publication 257) -
www.usps.com/cpim/ftp/pubs/pub257.pdf

[Consumer & Business Guide to Preventing Mail
Fraud](http://new.usps.com/cpim/ftp/pubs/pub300a.pdf) Publication 300A -
www.usps.com/cpim/ftp/pubs/pub300a.pdf

Bombs by Mail (Notice 71) -
[www.new.usps.com/cpim/ftp/notices/not71.pdf\
]{.underline}

Drugs by Mail (Poster 265) -
www.new.usps.com/cpim/ftp/posters/pos265.pdf

Notice of Reward (Poster 296) -
[www.new.usps.com/cpim/ftp/posters/pos5.pdf]{.underline}

Some Things Were Never Meant to Be Mailed (Poster 76) -
[www.usps.com/postalinspectors/is-pubs.htm]{.underline}

Warning! Reusing Postage (Poster 5) -
www.new.usps.com/cpim/ftp/posters/pos5.pdf

# Appendix C -- Mail Center Security Checklist

This checklist was first developed in 2002 to assist federal agencies
develop and determine the requirements for their security plans. Back by
popular demand, this tool is provided to assist Mail Center Managers
with the preparation of their security plans, and to aid in determining
the security requirements for their mail center/facilities.

**[I. Inbound Mail Procedures]{.underline}**

[YES]{.underline} [NO]{.underline}

  Written [Policies and Procedures]{.underline} are available on how
incoming mail is processed.

  All mail is x-rayed before it comes into the mail center.

  Incoming mail is isolated in an area where it can be inspected.

  Delivery personnel have limited access to the mail center and are
received at a

> Controlled area outside the mail center where possible.

  Letters/packages for senior Agency officials are given extra
attention and inspected

> closely.

  A system is in place for accountable letters and packages (i.e.
certified mail, UPS,

> FedEx, etc). Delivery is verified and only complete shipments are
> accepted.

  Accountable mail is signed for (whenever possession changes) and is
never left at an

> unoccupied desk or mailbox.

  Incoming personal mail is not handled by the mail center (unless the
exemption for

> your agency applies).

**[II. Security Training]{.underline}**

[YES]{.underline} [NO]{.underline}

  Basic security procedures have been developed and training has been
provided.

  Employees have been trained on how to recognize and handle
suspicious

> packages/letters.

  Procedures are posted on how to recognize suspicious
packages/letters and

> staff trained.

  Employees have been trained on the proper use of personal protection
equipment,

> if it is being used.

  Employees are trained on the Occupant Emergency Plan and are
regularly tested.

  Training is regularly provided by the Facility Mail Managers through
seminars,

> conference calls, and/or web based training.

  Facility Mail Managers are aware of training available through other
sources such as

> the General Services Administration and the U. S. Postal Service.

  Mail centers rehearse various evacuation plans and/or scenarios.

**[III. Physical Security]{.underline}**

[YES]{.underline} [NO]{.underline}

  The mail center is an enclosed room with defined points of entry or
a defined

> space that is used only for processing mail.

  Access to the mail center is limited to those employees who work in
the mail center,

> or who have immediate need for access.

  Employees wear photo identification at all times.

  Visitors to the mail center sign a log and are escorted at all
times.

The checklist for opening the mail center includes

[YES]{.underline} [NO]{.underline}

  A check of all locks/entrances.

  Visitors log.

  Verification of contents of safes/vaults.

  Open meter readings.

The checklist for closing the mail center includes

[YES]{.underline} [NO]{.underline}

  Close meter readings.

  Secure meters.

  File the visitors log.

  Secure all mail.

  Log out of all safes/vaults.

  Check all locks/entrances.

[YES]{.underline} [NO]{.underline}

  Employee parking is separated from the loading dock area (where
possible).

  Contract delivery services are screened and or x-rayed (where
possible).

  Unnecessary stops by delivery vehicles are eliminated.

  Procedures are established for handling unexplained packages.

  The Mail Manger keeps in regular contact with the Building Security
Committee.

**[IV. Mail Is Transported In A Safe Manner]{.underline}**

[YES]{.underline} [NO]{.underline}

  Authorized receptacles for US mail are clearly labeled.

  High value items are secured overnight.

  Labels are securely fastened to mail items.

  Postage meter strips overlap labels.

  Labels and cartons do not identify valuable contents.

  Containers and sacks are used when possible.

  Outgoing mail is sealed shortly after the most valuable item is
placed inside.

  Sender or addressee can identify the value of the contents.

  Lost and rifled mail are reported to the postal service.

  Parcels prepared to withstand transit.

  Contract delivery services screened.

  Outgoing mail delivered to postal custody inside the facility.

  Unnecessary stops by delivery vehicles are eliminated.

  X-raying of mail occurs where appropriate.

V. Security Assessment

[YES]{.underline} [NO]{.underline}

  Alternatives for processing mail have been identified in the event
of a mail center

> or building being closed.

  Annual inspections of the mail center are done with building
operations and security

> personnel focusing on potential vulnerabilities.

  A written contingency plan for continuing mail operations has been
developed in

> the event that the mail center or building is closed.

  Important mail has been identified and mechanisms established for
its delivery in

> case of a shutdown.

  Regular safety drills are conducted for mail center staff.

  A written emergency evacuation plan has been developed and employees
have

> been trained on the applicable protocols.

  Precautions have been taken to ensure the safety and well being of
mail center staff.

  Safety/Security training for mail center staff is provided on a
regular basis.

  Mail/facility managers participate regularly in building security
committees.

  Written procedures are in place to handle suspicious mail.

  Only authorized individuals have access to the mail center.

  Mechanisms are in place to ensure against theft, mis-use or
destruction of

> equipment within the mail center.

**VI. Communication**

[YES]{.underline} [NO]{.underline}

  The Mail Manager keeps in contact with facility center management

> through regularly scheduled meetings.

  Regular meetings are held with appropriate agency personnel
concerning mail

> safety and all personnel are advised of outcomes/new procedures.

  Mail center management is involved in developing and implementing
security plans.

  A call tree has been established and is continually updated for mail
center

> managers and employees that include: Names, addresses, work phone
>
> numbers, home phone numbers, beeper numbers, and cellular phone
> numbers.

**[A communications plan has been developed for use during an
emergency]{.underline}**

[YES]{.underline} [NO]{.underline}

  All available information is communicated in a timely manner.

  Everyone is sending the same message.

  All facts have been confirmed with competent authorities.

  Designated officials also have designated backups.

  Local union officials are involved.

  Messages are crafted so that all personnel can easily understand the
information.

  Every effort is made to communicate the existing level of risk, and
what actions

> are being taken.

**[VII. Employee Safety]{.underline}**

[YES]{.underline} [NO]{.underline}

  Personal protection equipment is available for all mail center
personnel

and employees who have been trained on the proper use of equipment and

> safety gear; a log entry is made when each employee has completed
> training.

  Signs are posted in the mail center listing whom to call in the
event of

> emergencies such as fire, theft, suspicious packages, etc.

  Daily procedures have been established for cleaning the area and
equipment used

> to process inbound mail.

  Staff is instructed to wash hands frequently, especially before
eating.

  Employees are instructed to make supervisors aware of unknown
persons in the

> mail center.

  Evacuation procedures are established and staff routinely trained in
the event of

> a potential threat. Practice, train and rehearse!

  Provide a separate and secure area for personal items (e.g. coats,
and purses).

**[VII. Loss Prevention and Cost Avoidance]{.underline}**

[YES]{.underline} [NO]{.underline}

  Have a check and balance system in place to validate procedures for
all forms of

> postage -- meters, stamps and permits.

  Conduct regular checks to ensure employees are not using agency
meters for personal

mail.

  Have controls in place to ensure proper access and accountability
for permit envelopes

> And labels.

  Ensure regular inventory counts are logged properly.

  Regular audits should be performed for inventory as well.

  Bills from other carriers (e.g., FedEx, UPS) should be reviewed
regularly to guard against

> unauthorized use and to ensure that appropriate refunds are collected.

  Personnel should be screened before employment (if appropriate,
background checks

could be performed).

  Only authorized employees should be assigned to accept mail.

  Review and ensure that the designed physical layout of your mail
center serves

> as a tool in helping to prevent loss.

  Call the U.S. Postal Inspection Service to report mail losses. Refer
to their web

> site for more information <http://www.usps.com/postalinspectors>.

**IX. Contractors**

Consider addressing the following in the contract; the specifics will
depend on the scope of the contract:

[YES]{.underline} [NO]{.underline}

  The contractor should provide copies of all written procedures on
how mail is handled.

  Develop a performance work statement that defines the Federal Mail
Center

> requirements in terms of the objective and measurable outputs.

  Identify security steps the contractor will take to provide the best
possible security,

> including hiring practices and employee screening checks.

  Evaluate what technology the contractor will deploy to process your
mail. Request

> presentations on electronic manifests for inbound mail, Coding Address
> Accuracy
>
> System (CASS) certification, etc.

  Conduct on-site audits to ensure that you are being charged
correctly and receiving

> the appropriate discounts, if you are using a contract service to
> prepare and presort
>
> your mail.

  Conduct periodic reviews separate from the contract process.

  Do an impromptu tour to see that the procedures are being followed,
confirm that

> the mail is being processed and that performance standards are being
> met.

More information on Performance -- Based Contracting can be found on the
web at [http://www.gsa.gov](http://www.gsa.gov/) and in the search tool
type in ARNET.

**[X. Occupant Emergency Plan (OEP)]{.underline}**

[YES]{.underline} [NO]{.underline}

  Are procedures established for handling serious illness, injury, or
mechanical

entrapment.

  Have all occupants been told how to get first aid/CPR fast?

  Are floor plans and occupant information readily available for use
by police, fire,

> bomb search squads, and other emergency personnel?

  Do occupants know what to do if an emergency is announced?

  Are evacuation procedures established and are employees familiar
with

> the procedures?

  Have special procedures been established for evacuation of the
handicapped?

  Have drills and training been adequate to ensure a workable
emergency plan?

  Are emergency telephone numbers displayed and/or published where
they are

> readily available?

  Are they reviewed and updated frequently?

  Did an advisory committee of appropriate officials (Building
Manager, Federal Protective

> Service, Security Force or Security Protection Official, etc) assist
> in developing the plan
>
> for you mail center?

**XI. Continuity of Operations Planning (COOP)**

[YES]{.underline} [NO]{.underline}

  Has an alternate facility been planned for incoming and/or outgoing
mail?

  Are employees aware of a line of succession and delegation of
authorities in the

event of an emergency?

  Provide for personnel accountability throughout the duration of the
emergency?

  Establish reliable processes and procedures to acquire resources
necessary to

> continue essential functions and sustain operations for up to 30 days?

  Have documents been identified and prioritized as critical,
important or routine?

  Have standards been developed and procedures identified that enable
your organization

> to process all critical documents during an emergency? (Plan the steps
> needed to begin processing the documents and mail designated as
> important, and then those designated as standard).

  Has a plan been developed to work with the USPS and all other
carriers as to what

> to do with the mail for alternate operations?

  Has your facility created a "fly-away kit" for the center and then
designate a key

> official and one or more alternates to pick up the kit in an
> emergency?