Classified Processing

In addition to the requirements for protecting unclassified data, the following are applicable for all systems handling classified data:

a. For PCs and microcomputers: PCs and microcomputers that contain internal hard disks will not be used to process, handle or store classified information unless they are physically protected to the highest level of information ever handled by the system. This level of protection must continue throughout the system's life. This protection must continue when relocating the equipment outside its secured room and during maintenance. No medium that has ever contained classified data may leave NRL until it has been declassified by one of the two approved methods. Therefore, for most applications, the use of removable media is necessary.

b. For minicomputers and mainframes: The philosophy is much the same as that prescribed for PCs- Either a secured facility, providing the same physical protection as an equivalent level security container, or all media must be removable and stored in a security container when not under the supervision of a cleared person.

c. TEMPEST requirements must be strictly adhered to. TVARs are required.

d. When the requirement exists to operate a system that cannot have removable media or that operates without the direct supervision of security personnel, a secured facility must be created to house and protect the system and information from unauthorized access, disclosure and modification.