A review of after-hours security checks and recently issued security
infractions indicate that some Headquarters personnel are not following
correct procedures for closing and securing security containers and
vaults/vault-type-rooms within the Headquarters complex. All security
container users should review the procedures stated within this
Spotlight bulletin to ensure compliance with the proper procedures to
secure security interests. Use of the correct procedures will enhance
the protection of classified matter, ensure compliance with security
regulations and prevent the issuance of security infractions. Particular
emphasis should be placed on ensuring a proper and complete end-of-day
double check is performed. In 100% of the discovered open and unattended
containers/vault-type-rooms, had a proper double check been performed,
there would have been NO potential threat of compromise of classified
matter or any infractionable offenses.

**[Security Container Status]{.underline}**

There are two, and only two, operational modes for a security
container - - open or locked. A container with its drawers closed but
where the combination lock has not been locked is considered to be
**OPEN**. The lock on the container is not considered locked until the
drawers are closed and the XO-series combination lock dial has been
validated to be locked.

**[Opening a Security Container]{.underline}**

To properly open a security container:

-   Visually check for any evidence of tampering.

```{=html}
<!-- -->
```
-   Power-up the XO-series combination lock by rotating the lock dial
    [counterclockwise]{.underline} until the LCD display is visible in
    the dial window. (Note: Six or seven turns are usually required to
    power up the lock. In circumstances where the lock has not been
    opened for an extended period of time, as many as 25 turns could be
    required.)

-   Continue dialing until you arrive at the first combination number.

-   Pause and dial [clockwise]{.underline} until you arrive at the
    second combination number.

-   Pause and dial [counterclockwise]{.underline} until you arrive at
    the third combination number.

-   Pause and dial [clockwise]{.underline} until you feel resistance and
    the dial positively stops. (Note: do not attempt to activate the
    container operating handle until after the combination lock dial
    stops.)

-   Using the container operating handle, open the container.

-   Annotate the SF702 with the date, your initials and time in the
    "opened by" column. (See explanation, below, on SF702.)

**Notes**:

-   If you incorrectly dial any number in the combination series, a
    "lightning bolt" will appear in the dial window. If this occurs, you
    must re-start the opening procedure by
    [counterclockwise]{.underline} dialing until the lightning bolt
    disappears.

-   A security clearance is required to have access to the combination
    and open the safe.

-   The combination may NEVER be revealed to an unauthorized individual.

-   The combination must be protected as classified. Therefore, if it is
    written down, the paper on which it is written must be marked as
    classified and stored in a GSA-approved security container.

-   The names of ALL individuals with access to the combination MUST be
    indicated on the SF700, Record of Security Container Information;
    however, only those designated to be contacted in the event the
    container is found open and unattended need to have their address
    and phone number included on the SF700.

**[Locking a Security Container]{.underline}**

To properly lock a security container:

-   Close all drawers.

-   Rotate the XO-series combination lock dial a [full]{.underline} 360⁰
    turn [counterclockwise]{.underline} (left) to activate the locking
    bolt. (Note: There will be resistance at first to this
    [counterclockwise]{.underline} rotation; however, if the lock dial
    stops and cannot be rotated further, the security container bolt
    mechanism has not fully extended. Ensure all drawers are closed and
    the control drawer is fully closed, and re-attempt to turn the
    locking dial [counterclockwise]{.underline} a full 360⁰.)

-   Validate that the XO-series lock has fully locked. You MUST:

    -   Rotate the combination lock dial [clockwise]{.underline} at
        least 360⁰ to ensure the dial does NOT stop. If the dial does
        stop, the lock is [NOT]{.underline} locked and the closing
        procedure must be repeated.

    -   Attempt to open the container by attempting to activate the
        drawer operating handle.

    -   Test all ancillary drawers to ensure they cannot be opened.

-   Annotate the SF702 in the "closed by" column with your initials and
    time. (See explanation, below, on SF702.) (Note: A security
    clearance is required to "close" the security container.)

-   Obtain an end-of-day double check beginning with the third bullet
    above in this section. The double check individual must annotate the
    SF702 in the "checked by" column with initials and time performed.

![](media/image1.jpeg){width="2.1666666666666665in"
height="2.06875in"}**Notes**:

-   Multi-lock containers (containers having a combination lock on each
    drawer) must have classified combinations on [each]{.underline}
    drawer, and [all]{.underline} drawers must be secured to meet the
    requirements for a locked container.

-   After-hours DOE Protective Force security checks include rotating
    the combination lock dial in an attempt to open a lock that has not
    been properly locked and attempting to open the drawer.

**[CD-XO-Series Vault-Type-Room Doors]{.underline}**

The CD-XO-series lock is generally used on vault-type-rooms specifically
approved for the open storage of classified matter. The CD-XO-series
lock is a basic XO-series combination lock with a built-in extender used
for securing a room door. There are a few extra actions involved in both
the opening and locking of this type device. A premise alarm system and
access control device is also generally a part of the total security
package for vault-type-rooms. The sequential steps involved with the
CD-XO series locks on vault-type-rooms are as follows.

**[Opening a vault-type-room with a CD-XO series lock and an alarm
system and access control]{.underline}:**

-   Visually check for evidence of any tampering.

-   Deactivate the premise alarm system in accordance with established
    instructions for your system.

-   Open the CD-XO-series combination lock in accordance with the
    opening procedures for the XO-series lock described above in
    "opening a security container," stopping short of "activating the
    container operating handle."

-   Annotate the SF702 "opened by" column with your initials, time and
    date.

-   Activate the access control device for your given vault-type-room.
    (Note that this may differ throughout Headquarters and may be a key
    lock, card swipe, card swipe with PIN, mechanical cipher lock, or
    other electronic cipher lock.)

-   ![](media/image2.wmf){width="4.572916666666667in"
    height="3.4375in"}Upon entering the room, push in the life-safety
    switch on the back of the CD-XO-series combination (see diagram
    below). Performing this function will prevent inadvertent,
    accidental, deliberate and unwanted locking of the lock mechanism by
    turning the lock dial on the outside or turning the manual lock
    release on the inside

**[Locking a vault-type-room with a CD-XO series lock and an alarm
system and access control]{.underline}:**

-   Perform a room check in accordance with the items indicated on the
    organizational SF701 (Security Activity Checklist). Annotate the
    SF701.

-   Open the door containing the CD-XO-series locking device.

-   Pull-out the "life safety switch" button until it clicks (about
    3/8").

-   With the door still open, turn the CD-XO-series lock dial
    [counterclockwise]{.underline} at least one full 360º turn. (Note
    that there will be resistance at first.)

-   Close the door (the CD-XO-series lock extender bolt will snap into
    the locked position upon closing).

-   Rotate the combination lock dial [clockwise]{.underline} at least
    360⁰ to ensure the dial does NOT stop. If the dial does stop, the
    lock is [NOT]{.underline} locked and the closing procedure must be
    repeated.

-   Activate the access control lock (cipher lock) in an attempt to
    enter the protected area (this action is a check to ensure the
    CD-XO-series lock has actually secured the door). If the door can be
    opened after the cipher lock is activated, the CD-XO series lock did
    not lock.

-   Annotate the SF702 in the "closed by" column with your initials and
    time. (See explanation, below, on SF702.) (Note: A security
    clearance is required to "close" the vault-type-room.)

-   Obtain a double check beginning with the sixth bullet above in this
    section. The double check individual must annotate the SF702 in the
    "checked by" column with initials and time performed. (Please note
    that the double check must be performed prior to activating the
    premise alarm where a card reader and pin are required for operation
    of the alarm and/or access control lock.)

-   Provided the above two steps were completed successfully and the
    door did not open, activate the premise alarm in accordance with
    established instructions for your system.

**[Security Vaults]{.underline}**

Security Vaults are specially designed and hardened rooms which are
equipped with a commercial type steel vault door with a built-in
combination lock. These locks will vary by age and manufacturer. The
operation of these locks also varies by manufacturer. Most of the
security vault doors in DOE Headquarters contain the older mechanical
locks which are being replaced, as required, by XO-series combination
locks. The security handling of these locks is similar to that of the
security containers as discussed above. However, in that most of these
are solely mechanical locks, the locking requirement is
[four]{.underline} turns of the combination lock dial in the same
direction. Note also that some of the older locks start in the
[clockwise]{.underline} (right) direction to enter the combination and
will open as the dial is turned in the [counterclockwise]{.underline}
(left) direction. Specific familiarization is required to operate these
type vault doors.

**[End of Day Security Check and the SF702]{.underline}**

At the end of each duty day or each day's activities, a "double check"
should be performed on all security containers and should be
accomplished if possible by someone other than the individual who
annotated the "closed by" column of the SF702. The individual performing
the double check must essentially repeat portions of the locking
procedures described in the bullets in the above sections on Locking a
Security Container and Locking a Vault-Type-Room. The responsibility to
obtain a double check rests with the individual who "closed" the
container unless the organization has appointed assigned personnel to
perform this end-of-day function. End-of-day double checks should also
be performed on all containers regardless of whether the container was
opened. This check should be performed on all work days and any non-work
day ![](media/image3.wmf)that the container was opened.

**[End of Day Security Check and the SF701]{.underline}**

![](media/image4.wmf)The Activity Security Checklist (SF701) should be
used for end-of-day security checks of Limited or Exclusion Areas. Each
activity or program office should establish a written end-of-day
security check procedure with assigned security check officials as a
supplement to the use of this form. Personnel working after hours should
assume security check responsibilities beyond that which could not be
accomplished by the designated official. The SF701 should be posted near
the entrance of the facility on the [inside]{.underline} of the Limited
or Exclusion Area. In addition to the requisite checklist of items,
space is provided to add area-specific items for inclusion as part of
the end of day check list. This requisite list includes check columns
for all safes checked, classified matter cleared from desks, classified
waste secured, computers cleared, classified shred bins checked for
particulate standards, etc. Other area-specific checks may include such
actions as lights off, electronic equipment turned off, coffee pots off,
fax machines checked, etc. The SF701 is designed for daily use for one
month.

**[Retention of SF701 and SF702]{.underline}**

SF702 may be used until all rows are full. SF701 is designed for a
month's use. SF701 and SF702 forms must be retained for 90 days
following the date of the last entry on the sheet. (The SF701 and SF702
for security containers and/or security areas involved in an inquiry or
security compromise become part of the official inquiry and new forms
must be initiated.)

**[Frequently Asked Questions (FAQs)]{.underline}**

> Q. What if I cannot get my security container locked at the end of the
> day?
>
> ![](media/image5.wmf){width="1.4895833333333333in"
> height="2.0833333333333335in"}A. You should contact your Headquarters
> Security Officer (HSO) or supervisor who will assist you by getting
> help or, alternatively, will assist you in moving the contents of your
> container to an authorized secure location pending repair of the
> container. You may not leave an open container unattended or store
> your classified matter outside an authorized security container,
> vault, or vault-type-room. If your HSO or supervisor is not available,
> contact the Headquarters Protective Force Central Alarm Station at
> extension 166.
>
> Q. What if I observe an open and unattended security container while
> passing through an area or at the end of the work day?
>
> A. Locate the nearest telephone and call 166 for the DOE Protective
> Force. Explain your location and finding. The Protective Force is
> equipped to handle these situations. Stay with the container, vault,
> or vault-type-room until a cleared Protective Force officer arrives.
> Do not leave the container further unattended. Do not attempt to go
> through the container or office to locate the "owner."
>
> Q. I was told that a container drawer automatically locked when it was
> shut. Is this true?
>
> A. No. Please carefully read the section above on "Locking the
> Security Container."
>
> Q. What if I cannot get my container, vault, or vault-type-room open?
>
> A. Call your Headquarters Security Officer (HSO) who will summon MA
> for assistance. The fee for this service is charged to the requesting
> Element. Do not attempt to force the lock or container or continue to
> dial the combination in excess of what is reasonable.
>
> Q. Do I have to lock my security container when I leave to use the
> restroom or to visit another individual's office?
>
> A. Classified matter must be properly stored at all times or kept
> under constant surveillance by an authorized individual who is in a
> physical position to exercise direct security control over the
> material. A locked vault or vault-type-room certified for open storage
> or a locked security container constitute proper storage within a
> Limited or Exclusion Area.
>
> Q. I heard that combination changes are no longer required. Is this
> true?
>
> A. No. Combination changes are no longer required on an annual basis.
> Combination changes are required when an individual with knowledge of
> the combination departs, no longer needs access, or is otherwise
> relieved of responsibilities concerning stored classified matter;
> there has been an actual or possible compromise (e.g., safe found open
> and unattended); programmatic requirements require a combination
> change; when the container is put into service, or has had maintenance
> performed on it by an uncleared individual; and when the container is
> turned in (50-25-50 factory standard combination is required).
>
> Q. Why do I have to turn the XO-series combination lock dial so many
> times before the numbers appear? Why isn't this lock dialed in the
> older conventional manner? Why isn't it necessary to turn the dial
> four times to ensure the lock is locked?
>
> A. The XO-series combination lock, now on all containers at DOE
> Headquarters Facilities, is an electro-mechanical computerized
> combination lock. It contains a magneto (small generator) to provide
> electric power to the electronic circuits. When you initially turn the
> dial, you are charging the electronic components and this may take a
> few turns. Once charged, the electronics are energized for
> approximately 40 seconds after you have stopped motion of the dial.
> Since the combination of the lock is totally electronic (no mechanical
> settings), conventional (old style) dialing is not indicated. Arrows
> appear on the dial ring display to ensure you dial in the proper
> direction. Locking the XO-series requires only that the bolt action be
> mechanically extended by turning the combination lock dial
> approximately one full turn (360⁰) [counterclockwise]{.underline}.
> Clearing the combination with four full turns is unnecessary since
> there is no mechanical association with the combination memory. As an
> added note:, the back of the XO-series locks should not be removed
> because damage to the tiny computer pins in the back cover may occur
> during removal or replacement and static electricity may discharge
> onto the circuit board rendering the lock nonfunctional. Individuals
> should be specifically trained in XO-series lock combination changing
> before attempting any combination changes.
>
> Security of classified information is a serious matter and is
> everyone's responsibility. You can help to do your part by following
> the above security container, vault, and vault-type-room procedures
> including proper annotation of the SF701 and SF702.
>
> There is no validity to any concept such that "I did everything right
> and the door must have opened itself" when the Headquarters Protective
> Force finds your container or vault/vault-type-room open and
> unattended!
>
> Please refer also to [Section
> 17](http://reportsip.hss.doe.gov/hqfmsp/Section17_Storage.pdf)
> (Storage of Classified Matter) of the Headquarters Facilities Master
> Security Plan for additional details concerning this subject.