Current policy for classified material protection and control (CMPC) requires mandatory changes of combinations on safes and vault-type rooms in every instance where: (1) an individual is reassigned, transferred, or terminated; (2) an individual having access has their security clearance downgraded; and, (3) a person with access no longer has a need-to-know or appropriate access authorization. However, this policy does not appear to assign an appropriate risk measure in those instances where safes or vault-type rooms are located inside limited areas or controlled areas where the likelihood of an uncleared individual or an individual who has been transferred, reassigned, or terminated will have further access to either the safe or vault-type room. Classified material must be protected, and access to it must be controlled to preclude damage to national security; however, with multiple physical layers of protection at perhaps thousands of controlled and limited areas across the federal government, and given the resource factors for CMPC Points-of-Contact and Organizational Users to change safe and VTR combinations at high frequencies driven by reassignments, transfers, or terminations, government could introduce higher levels of productivity and efficiency while realizing cost avoidances by revising the current policy and procedure to factor in the risk/probability of compromise of classified information that has multiple physical barriers, including armed guards or badge swipe/card reader systems, to protect it. For example, when an individual is reassigned, transferred, or terminated, his or her badge is cancelled/access is terminated immediately, and the badge must be turned in. Therefore, this individual has absolutely no access to a security container or VTR inside a limited area with badge swipe/card reader or a guard at the gates to a facility. It would be virtually impossible for me to quantify the increases in productivity, efficiency, or the costs avoided across all of the government that would be realized by updating or re-evaluating the current CMPC policy, but intuitively the idea just makes sense.
Idea No. 2510