(b) Requirements for physical protection—(1) Top Secret. Top Secret information shall be stored in a GSA-approved security container, a vault built to Federal Standard (FED STD) 832, or an open storage area constructed in accordance with § 2001.53. In addition, supplemental controls are required as follows:

1. (i) For GSA-approved containers, one of the following supplemental controls:

   1. (A) Inspection of the container every two hours by an employee cleared at least to the Secret level;
   2. (B) An Intrusion Detection System (IDS) with the personnel responding to the alarm arriving within 15 minutes of the alarm annunciation. Acceptability of Intrusion Detection Equipment (IDE): All IDE must be in accordance with standards approved by ISOO. Government and proprietary installed, maintained, or furnished systems are subject to approval only by the agency head; or
   3. (C) Security-In-Depth coverage of the area in which the container is located, provided the container is equipped with a lock meeting Federal Specification FF-L-2740.
2. (ii) For open storage areas covered by Security-In-Depth, an IDS with the personnel responding to the alarm arriving within 15 minutes of the alarm annunciation.
3. (iii) For open storage areas not covered by Security-In-Depth, personnel responding to the alarm shall arrive within five minutes of the alarm annunciation.

4. (2) Secret. Secret information shall be stored in the same manner as Top Secret information or, until October 1, 2012, in a non-GSA-approved container having a built-in combination lock or in a non-GSA-approved container secured with a rigid metal lockbar and an agency head approved padlock. Security-In-Depth is required in areas in which a non-GSA-approved container or open storage area is located. Except for storage in a GSA-approved container or a vault built to FED STD 832, one of the following supplemental controls is required:

   1. (i) Inspection of the container or open storage area every four hours by an employee cleared at least to the Secret level; or
   2. (ii) An IDS with the personnel responding to the alarm arriving within 30 minutes of the alarm annunciation.
5. (3) Confidential. Confidential information shall be stored in the same manner as prescribed for Top Secret or Secret information except that supplemental controls are not required.

(c) Combinations. Use and maintenance of dial-type locks and other changeable combination locks.

1. (1) Equipment in service. Combinations to dial-type locks shall be changed only by persons authorized access to the level of information protected unless other sufficient controls exist to prevent access to the lock or knowledge of the combination. Combinations shall be changed under the following conditions:

   1. (i) Whenever such equipment is placed into use;
   2. (ii) Whenever a person knowing the combination no longer requires access to it unless other sufficient controls exist to prevent access to the lock; or
   3. (iii) Whenever a combination has been subject to possible unauthorized disclosure.
2. (2) Equipment out of service. When security equipment is taken out of service, it shall be inspected to ensure that no classified information remains and the combination lock should be reset to a standard combination of 50-25-50 for built-in combination locks or 10-20-30 for combination padlocks.