From:

Code of Federal Regulations

Title 32-NATIONAL DEFENSE

Subtitle B-Other Regulations Relating to National Defense

Chapter XX-Information Security Oversight Office, National Archives and Records Administration

Part 2001-Classified National Security Information

Part 2003-Interagency Security Classification Appeals Panel (ISCAP) Bylaws, Rules and Appeal Procedures

As quoted in the Search Warrant issued by the Magistrate Judge for the Mar-A-Lago search on August 8, 2022,

“32 C.F.R. Parts 2001 and 2003 regulate the handling of classified information.

Specifically,32 C.F.R. § 2001.43, titled Storage, regulates the physical protection of classified information. This section prescribes that Secret and Top Secret information shall be stored in a General Services Administration – approved security container, a vault built to Federal Standard (FHD STD) 832, or an open storage area constructed in accordance with 2001.53. It also requires periodic inspection of the container and the use of an Intrusion Detection System, among other things.”

Rule 2001.43

(a) General. Classified information shall be stored only under conditions designed to deter and detect unauthorized access to the information. Storage at overseas locations shall be at U.S. Government-controlled facilities unless otherwise stipulated in treaties or international agreements. Overseas storage standards for facilities under a Chief of Mission are promulgated under the authority of the Overseas Security Policy Board.

(b) Requirements for physical protection –

(1) Top Secret. Top Secret information shall be stored in a GSA-approved security container, a vault built to Federal Standard (FED STD) 832, or an open storage area constructed in accordance with § 2001.53. In addition, supplemental controls are required as follows:

(i) For GSA-approved containers, one of the following supplemental controls:

(A) Inspection of the container every two hours by an employee cleared at least to the Secret level;

(B) An Intrusion Detection System (IDS) with the personnel responding to the alarm arriving within 15 minutes of the alarm annunciation. Acceptability of Intrusion Detection Equipment (IDE): All IDE must be in accordance with standards approved by ISOO. Government and proprietary installed, maintained, or furnished systems are subject to approval only by the agency head; or

(C) Security-In-Depth coverage of the area in which the container is located, provided the container is equipped with a lock meeting Federal Specification FF-L-2740.

(ii) For open storage areas covered by Security-In-Depth, an IDS with the personnel responding to the alarm arriving within 15 minutes of the alarm annunciation.

(iii) For open storage areas not covered by Security-In-Depth, personnel responding to the alarm shall arrive within five minutes of the alarm annunciation.

(2) Secret. Secret information shall be stored in the same manner as Top Secret information or, until October 1, 2012, in a non-GSA-approved container having a built-in combination lock or in a non-GSA-approved container secured with a rigid metal lockbar and an agency head approved padlock. Security-In-Depth is required in areas in which a non-GSA-approved container or open storage area is located. Except for storage in a GSA-approved container or a vault built to FED STD 832, one of the following supplemental controls is required:

(i) Inspection of the container or open storage area every four hours by an employee cleared at least to the Secret level; or

(ii) An IDS with the personnel responding to the alarm arriving within 30 minutes of the alarm annunciation.

(3) Confidential. Confidential information shall be stored in the same manner as prescribed for Top Secret or Secret information except that supplemental controls are not required.

(c) Combinations. Use and maintenance of dial-type locks and other changeable combination locks.

(1) Equipment in service. Combinations to dial-type locks shall be changed only by persons authorized access to the level of information protected unless other sufficient controls exist to prevent access to the lock or knowledge of the combination. Combinations shall be changed under the following conditions:

(i) Whenever such equipment is placed into use;

(ii) Whenever a person knowing the combination no longer requires access to it unless other sufficient controls exist to prevent access to the lock; or

(iii) Whenever a combination has been subject to possible unauthorized disclosure.

(2) Equipment out of service. When security equipment is taken out of service, it shall be inspected to ensure that no classified information remains and the combination lock should be reset to a standard combination of 50-25-50 for built-in combination locks or 10-20-30 for combination padlocks.

(d) Key operated locks. When special circumstances exist, an agency head may approve the use of key operated locks for the storage of Secret and Confidential information. Whenever such locks are used, administrative procedures for the control and accounting of keys and locks shall be included in implementing regulations required under section 5.4(d)(2) of the Order.

(e) Repairs. The neutralization and repair of GSA-approved security containers and vault doors will be in accordance with FED STD 809.

§ 2003.1 Purpose (Article I).

The Interagency Security Classification Appeals Panel (hereafter “ISCAP” or “the Panel”) advises and assists the President in the discharge of his constitutional and discretionary authority to protect the national security of the United States.

§ 2003.2 Authority (Article II).

ISCAP was established by, and receives its authority from, Executive Order 13526 “Classified National Security Information” (hereafter the “Order”), December 29, 2009, section 5.3(a)(1), and the Order’s implementing directives. Section 5.3(c) of the Order directs ISCAP to issue bylaws, rules, and procedures and to publish them in the Federal Register.

§ 2003.3 Functions (Article III).

In carrying out its purpose, the Panel:

(a) Decides appeals by people who have filed classification challenges under section 1.8 of the Order;

(b) Approves, denies, or amends agency exemptions from automatic declassification under section 3.3 of the Order;

(c) Decides appeals by people or entities who have filed requests for mandatory declassification review under section 3.5 of the Order; and

(d) Informs senior agency officials and the public, as appropriate, of final Panel decisions on appeals under sections 1.8 and 3.5 of the Order.

§ 2003.9 Reports to the President (Article IX).

ISOO includes pertinent information and data about the activities of the Panel in ISOO’s reports to the President of the United States. The Panel also includes such information in any reports it may make to the President. The Chair, in coordination with the other members of the ISCAP and the Executive Secretary, determines what information and data to include in each report.

§ 2003.14 Dissemination of ISCAP decisions.

The Executive Secretary informs senior agency officials and the public of final ISCAP decisions on appeals under sections 1.8 and 3.5 of the Order.

[End]