National Industrial Security Systems : Protecting US government assets held by government contractors

Courtesy of the Underwriters Laboratories Fire & Security Authority
Issue 1 - 2008
by Pete Tallman

Sensitive US government material held by government contractors is subject to a wide variety of potential threats and housed in a range of settings across the US, from major metropolitan areas to isolated locations with limited communication and support resources. In the early 1990s government officials and UL recognized the need for an alarm system verification program flexible enough to be applied in multiple settings, yet consistent enough to allow confidence in the delivery of alarm services. Developing a specialized category of service, a new standard and an Alarm System Certificate became the key for coordinating the variety of features that might be used in a particular setting and the relationship of each service provider. The result of this collaboration between UL and US government officials was the creation of the National Industrial Security System Category (CRZH), which has been designed with enough flexibility to allow protection to be rational, appropriate for the identified threat and cost effective.

Two standards are maintained by UL for this category:

• UL 2050, the Standard for Safety of National Industrial Security Systems, establishes a variety of ways in which installation, monitoring, investigation and repair service can be provided.

• UL 681, the Standard for Safety of Installation and Classification of Burglar Alarm and Holdup Alarm Systems, further defines requirements for installation of equipment and devices comprising an alarm installation in a protected area.

An alarm system certificate ties them together through the Alarm System Certification process; certificates are issued by UL at the request of UL Listed alarm service companies. The use of certification for compliance with the National Industrial Security System Category has increased steadily since its establishment in 1992. Currently, the following US government manuals contain the requirement:

• The National Industrial Security Program Operating Manual, DoD 5220.22-M
• The Physical Security Standards for Sensitive Compartmented Information Facilities, DCID 6/9
• The Manual for Physical Security of Sensitive Conventional Arms, Ammunition, and Explosives, DoD 5100.76-M
• The Physical Security Standards for Special Access Program Facilities, JAFAN 6/9

The applicable manual indicates specifications and techniques that may be required in a given situation. The US government cognizant security office or agency (CSO/CSA) assesses threats (see graphic) and determines system features, but UL 2050 and UL 681 specify the details of system delivery.

For example, if a CSO/CSA stipulates that an investigator must be a private guard and respond to an alarm within 20 minutes, UL 2050 details how to assign an investigator, how to conduct an investigation, how to record activity and follow-up actions. Category CRZH allows an alarm service company to assign the delivery of monitoring and investigation services to other service providers, but keeps full responsibility for compliance of the delivery of all services with the requirements in the standards.

Collaboration allows UL to keep pace with technological changes
Alarm system technology has changed dramatically since the National Industrial Security Systems Category was created. UL staff maintains close, collaborative contact with government organizations, government contractors and alarm service companies to stay abreast of the latest technological advances. These relationships give UL staff a strong view of evolving security issues, actual performance data and the practical impact of new technology. The movement to send signals from alarm systems in the form of packets of data across public and private networks raised concerns about the security of the communication paths. The regular collaboration between all parties allowed UL to publish requirements for the use of this technology by drawing on existing Federal Information Publication Standards and an encryption algorithm certification program from the National Institute of Standards and Testing, resulting the availability of alarm equipment that provides encrypted line security.

Centralization of the monitoring stations operated by government contractors created another new challenge. Data networks enable signals to be sent across widely distributed networks, meaning that a monitoring station can be located hundreds, even thousands, of miles from an alarmed area. CSO/ CSAs and UL quickly recognized the difficulties presented by this challenge, creating the National Industrial Security Monitoring Station Service Category (CRZM). This category allows the UL Listed alarm service company to assign area monitoring to a facility that has been evaluated by UL staff and found to be in compliance with UL 2050; the facility must have an active UL Listing. This relieves the UL Listed alarm service company of the responsibility for maintaining a monitoring facility while retaining the responsibility to ensure that alarm signal processing and monitoring system staff training are in compliance with category requirements.

The National Industrial Security System and the Associated National Industrial Security Monitoring Station Categories are tributes to the value of collaboration between parties with a common interest. A constant focus on the concepts of flexibility and threat appropriate requirements, coupled with a service delivery verification process has benefited government contractors, alarm service companies and officials responsible for protecting assets of the US government.

---

For more technical information about UL 2050, please contact Pete Tallman in Melville, NY at +1.631.546.2415 or at Peter.H.Tallman@us.ul.com.

10 Qualities Your Systems Integrator Should Have

Reprinted from SecurityMagazine.com April 2008 cover story Goodbye Handshake; Hello Contract
by Bill Zalud
April 1, 2008

According to Noelle Britton of Siemens Building Technologies, Inc., you should expect that your integrator will guide you toward a custom solution tailored to meet your needs.

1. Desire to develop long-term partnerships. The strength of an integrator is measured by the ability to develop long-term strategic partnerships with you.
   
   
2. Segment-specific knowledge. It is imperative that your integrator knows your business as well as you do.
   
   
3. Certification. Your integrator should promote a culture of continuing education that focuses on bringing value back to you, the customer. Certification assures you that the integrator’s staff has a deep knowledge of the industry and products/platforms.
   
   
4. IT/IP knowledge. With the convergence of physical security and IT, and the abundance of IP products on the market, your integrator must know how to converge these two silos.
   
   
5. Exceptional customer service. It is not enough for your integrator to simply design and install your security system.
   
   
6. Broad organizational capabilities. Your integrator should have the capabilities to deliver a solution on a global, national level and a local level. Integrators with such breadth can share best demonstrated practices between staff and across regions and markets.
   
   
7. Best-in-breed portfolio. Security integrators need to have a robust portfolio of best-in-breed products that can accommodate different customers.
   
   
8. ESP. While no one can predict the future, your integrator should keep a watchful eye on how your business grows and evolves so that your security solution adapts with it.
   
   
9. Financial stability. You are increasingly making purchasing decisions based on a longer-term perspective. To that end, you should take into account the stability of an integrator.
   
   
10. Industry knowledge. It seems obvious, but you’d be surprised at the number of integrators who don’t have an extensive knowledge of the industry.

Hackett Security Receives Top UL Listing

SecurityInfoWatch.com features our Top UL 2050 Certificate in the following article:

Hackett Security Receives Top UL Listing

St. Louis-based security dealer lands first UL 2050 certificate

Hackett Security

ST. LOUIS, MO -- October 25, 2007 -- Hackett Security, the St. Louis area’s leading security systems company, today announced the firm has received one of the highest designations possible from Underwriters Laboratories. The firm is the first in the nation to receive the prestigious 2050 National Industrial Security System monitoring certificate.

The certificate is part of a new category established by Underwriters Laboratories. It is designed to cover facilities operated by government contractors and others engaged in monitoring security systems for which a National Industrial Security System certificate has been issued. Entities eligible for this listing include monitoring stations not only operated by government contractors but also by commercial central stations.

“This new listing enables Hackett Security to provide security monitoring, products and services to businesses, defense contractors, and government entities at the highest levels,” said Michael J. Hackett, CEO & President. “It will help us expand the firm into different areas as we continue to increase market penetration on a regional and national basis.”

Underwriter Laboratories Inc. is the leading third party certification agency for security and signaling products and systems. A UL certification provides the quickest and surest route to product acceptance by regulatory authorities, insurers, law enforcement organizations, government, retailers and consumers. The new standard is based on several requirements for central monitoring stations to include sound engineering principles, research, records of test and field experience, and an appreciation of the problems of installation, operation, maintenance, and use derived from consultation with and information obtained from system operators, users and others having specialized experience.

Hackett Security, Inc. has been installing and monitoring burglar and fire alarm systems in the greater St. Louis and Southwestern Illinois areas since 1977. The firm has evolved into a total security systems integrator with expertise in card access, gaming, CCTV, high-def photo ID badging, and the latest digital video recording and transmitting technologies. Hackett’s home office is a 24/7 UL listed central station located in St. Louis, MO. The firm operates branch offices in Southern Missouri, Alton, IL and Chicago, IL. For additional information contact Hackett Security online, www.hackettsecurity.com, or call 314-432-4200.

- The Hackett Security Team

AMPS Sundown Impact On Certificated Alarm Systems

In UL 2007 Issue 3 Steve Schmit has a interesting article on the impact of AMPS Sundown on Certificated Alarm Systems.

In a Memorandum Opinion and Order released June 15, the Federal Communications Commission (FCC) denied a Petition for Rulemaking filed by the Alarm Industry Communications Committee.

The petition sought to extend the 2/18/08 “sundown” date on the requirement that cellular licensees provide analog service to subscribers whose equipment conforms to the Advanced Mobile Phone Service (AMPS) standard. This effectively means that analog cell phone service in the US will begin to disappear on 2/18/08.

The alarm industry petitioned for an extension because there are a large number of installed alarm systems that employ analog cellular technology as either the primary or secondary backup communication method. Sourcing replacement equipment and retrofitting installed bases will be a challenge for the industry.

This fall, UL will be working with alarm companies that have issued Alarm System Certificates for systems using cellular technology as a required means of communication. An Alarm System Certificate is the issuing alarm service company’s declaration of ongoing conformity with the appropriate Code or Standard. UL’s audit services for systems covered by a Certificate provide an increased level of conformity confidence for alarm system owners, insurance carriers, security managers, fire code authorities and others with a concern for alarm protection.

In order to be in conformity, off-premise reporting systems have to maintain their ability to communicate with a monitoring station at all times. UL will help Listed alarm companies identify Certificated installations that employ cellular technologies and seek their declaration of continued compliance past the 2/18/08 AMPS sundown date. In cases where ongoing conformity cannot be assured, UL will assist alarm companies with the task of canceling the Certificates involved. During the 2008 Certificate Service audit cycle, UL will put an increased focus on Certificated accounts where cellular technology is declared to validate conformity.

UL will work diligently with the alarm industry to maintain uninterrupted certification coverage for alarm systems covered by a UL Certificate. At the same time, UL recognizes the value of the conformity confidence brought by Certificate coverage. We will take appropriate actions to assure that systems covered by a Certificate do indeed comply with the applicable Code or Standard.

By Steve Schmit
For questions regarding Alarm System
Certificates, please contact Steve Schmit
In Northbrook, Ill. at +847-664-2128 or at
Steven.A.Schmit@us.ul.com

- The Hackett Security Team