GSA Container Combination Locks.

A. Federal Lock Specifications.

(1) Federal Lock Specification FF-L-2740 replaced UL Group 1R requirements for GSA-approved security containers in 1991 to reduce the inherent security risks associated with conventional technology. Group 1R lock specifications were applicable for GSA-approved security containers from 1962 to 1991.

(2) Currently, only the Mas-Hamilton Group, Model X-07, X-08, and X-09 have received GSA approval. This changeable combination lock is a self-powered microcomputer lock with a liquid crystal display. Any existing Group 1R locks on GSA "red label" containers, i.e., all containers produced after March 1991, should be replaced with locks meeting Federal specifications FF-L-2740 when the locks become unserviceable.

B. UL-Rated Combination Locks. A variety of manufacturers have produced UL-rated changeable combination locks. These locks have been available for many years and continue to be installed on the various containers described above. Combination locks may be of the hand-change or key-change type. These types of locks are classified by UL as Group 1, Group 1R, or Group 2 according to the degree of protection afforded against unauthorized opening.

(1) Group 1. Group 1 combination locks afford a choice of at least 1,000,000 combinations and are highly resistant to expert or professional manipulation for a period of 20 man-hours. Group 1 locks are considered suitable for use of burglary-resistant safes and chests.

(2) Group 1R.

(a) Group 1R combination locks afford a choice of least 1,000,000 combinations and are highly resistant to expert manipulation. In addition to resisting unauthorized opening by expert manipulation for a period of 20 man-hours, these locks are secure against radiological attack for 20 hours, with a radioactive source not exceeding the equivalent of 10 curies of Cobalt 60 at a 30-inch distance. Group 1R locks are considered suitable for use on burglary-resistant safes and vaults. Group 1R locks were specified for GSA-approved security containers from 1962 to 1991.

(b) Locks on previously approved GSA “black label” security containers that require replacement due to age or mechanical failure should be replaced with locks meeting Federal Specification FF-L-2740 (See 7.A(1) and (2)).

(3) Group 2. Group 2 combination locks afford a choice of at least 1,000,000 combinations and are reasonable resistant to unauthorized openings. These combination locks are considered suitable for use on insulated safes, insulated record containers, insulated vault doors, light vault doors, and tamper-resistant doors.

C. Combinations.

(1) Changing Combinations.

(a) Classified Security Containers. The requirements for changing, classifying, recording, and protecting combinations to security containers safeguarding classified National Security Information are contained in Chapter 8, National Security Information Handbook (440-3-H).

(b) Other Containers. Combinations to insulated and burglary-resistant containers should be changed by the responsible individual, the security officer, or by a bonded contractor. Combinations should be changed when the container is placed in use, when an individual knowing the combination no longer requires access to the container, when the combination has been lost or is suspected to have been lost, at least once every 12 months, or when the container is taken out of service. Combinations to containers taken out of service must be reset to the standard factory combination of 50-25-50 prior to removal from the office space.
(c) Methods. Combination locks have either hand-change or key-change capability. A number of combination locks produced by a variety of manufacturers have been approved by GSA. These GSA-approved locks along with the non-approved locks use slightly different operating instructions and unique keys or particular hand change techniques for changing combinations. Often the experience necessary, as well as change keys, operating instructions, and changing procedures are lost with the passing of time. For assistance in changing a safe combination, contact the Security Management Office or a locally bonded locksmith.

(2) Safeguarding Combinations.

(a) Selecting a Combination. When selecting combination numbers avoid multiples of 5, ascending or descending numbers, simple arithmetical series, and personal data such as birth dates and Social Security Numbers. Use numbers that are widely separated. This can be achieved by dividing the dial into three parts and using a number from each third as one of the high-low-high or low-high-low sequences. The same combination should not be used for more than one container in the same office. Carefully follow any manufacturers' instructions in installing combination numbers.

(b) Protecting Combinations.

• Combinations should be known only by those persons whose official duties require access. The written combination should be protected at the highest classification level of material in the container or be protected in a manner commensurate with the value of the protected material.

• Combinations should be memorized. They must not be carried in wallets or concealed on persons or written on calendars, desk pads, etc.

• When opening any kind of combination lock, be sure that no unauthorized person can learn the combination by observing the sequence of numbers being entered or dialed. It may be necessary to position your body so as to block the dial from the view of anyone standing nearby.

(3) Recording Combinations. Each security officer should assure that a record of the combination to each vault, secure room, combination padlock, and security container is recorded showing the location of the container or room, the name, home address, and home telephone number of a person responsible for the container, and the names of all individuals having knowledge of the combination. Standard Form 700, Security Container Information, has been designed for this purpose. A central repository, usually the most secure container, should be designated to hold the sealed SF 700 for use during emergencies. Only appropriately authorized employees should be given access to a combination.