GSA-Approved Security Containers (Security Containers) are primarily used to store Classified National Security Information (CNSI). Security Containers may be used to store other items; however, when they are used to store CNSI in any drawer, no drawers should contain anything other than CNSI. Security Containers are most easily identifiable as being approved for use by a Certification Label located on the top left of the container or the drawer with the lock. CNSI may not be stored in a Security Container unless a metallic Certification Label is affixed to the container. The most common authorized color for Security Containers is red; however, blue, green, and black are currently authorized for the storage of CNSI.  

All Security Containers are assigned a Container Custodian. Container Custodians are responsible for:

1. Ensuring that Security Containers and vault doors are maintained in a serviceable condition.
2. Ensuring the inspection, preventive maintenance, servicing, opening, or repair of security equipment is accomplished only by qualified personnel who have been the subject of a favorable suitability determination for access to CNSI or who are continuously escorted.
3. Performing a basic visual and operational inspection each time the lock combination is changed, upon reassignment of the container, or upon change of the custodian. Custodians must immediately report any signs of forced or covert entry, or other signs of a breach of any security equipment.
4. Ensuring that combinations and access to Security Containers or vaults are permitted only to personnel with a valid need-to-know. Custodians must also verify that personnel possess the proper Personal Security Clearance (PSC) at the level commensurate to the level of materials held within the Security Container or vault prior to granting access.
5. Being present if the Security Container is relocated, during forced opening, or when repair procedures are taking place on any Security Container or vault door under their responsibility or control.
6. Ensuring an accurate inventory is maintained and verified annually at a minimum.

Figure 1: GSA Certification Labels

If any lock on a Security Container must be replaced, only a lock that meets FF-L-2740B may be installed. Currently, this is the Kaba-Mas CD-10 or CDX-10. Only a GSA-certified locksmith may perform any maintenance or repair to a lock on a Security Container. A list of such locksmiths is available at KabaMas, Lockmasters Security Institute, or MBA USA. This does not include combination changes. Contact your Field Servicing Security Officer to coordinate a combination change. 

In accordance with 207-1-103 Information Security Manual, combinations shall be changed in any of the following situations: 

1. When a container is placed in use.
2. When an individual knowing the combination no longer requires access to the container.
3. When the combination is subject to a known or possible compromise. When a container is taken out of service. Built-in combination locks shall be reset to the standard combination of "50–25–50" ("10–20–30" for padlocks) prior to removal from office space.
4. Annually, if protecting NATO classified information.
5. Every two years, if none of the above conditions have been applied.

Figure 2: GSA-Approved Security Containers

In accordance with department Memorandum GSA-Approved Security Container Transfer and Repair Guidance, July 15 2024, prior to the transfer of any Security Container to another program, another person within the same program, or to excess, a Transfer of Security Container Form shall be executed by the Field Servicing Security Office. Additionally, all maintenance and repairs are to be recorded on a Security Container Verification Form.

When an employee is separating from the Department, prior to debriefing and other measures, they must first reassign any CNSI and/or Security Containers. Furthermore, once an employee has separated, the former supervisor or the Security Container’s new custodian must submit a request to the Security Service Center or nearest field office to have their Security Container’s combination changed and a new SF-700 Security Container Information form completed. SF-700s are to be consolidated by facility with the Field Servicing Security Officer.

Figure 3: Black GSA Certification Label

The Information Security Oversight Office (ISOO) and the GSA determined that departments and agencies must phase out the use of all Security Containers manufactured from 1954 through 1989 or “black labels” for the storage of CNSI. 

Figure 4: Black Label Phase-Out Plan Chart

*ISOO Notice 2022-03 states the phase-out of all black label vault doors has been extended until 1 October 2035

Offices with Security Containers subject to the phase-out determination must decide how to remove and replace them. New Security Containers may only be acquired through GSA Global Supply. Instructions for ordering a new Security Container are available on GSA's Ordering Security Containers website.

"Phase Out" stickers are to replace the black GSA Approval Label on Security Containers that are phased out in accordance with the Black Label Phase-Out Plan Chart below. These stickers are offered free of charge and should be placed where the original GSA Certification black label was removed.  You do not need these stickers if you plan to dispose of your black label container.  Click on this Phase Out Sticker request form link or the sticker image below to order your stickers. 

Figure 5: Black Label Phase Out Sticker

Please review ISOO Notice 2021-01 dated 29 June 2021 with the subject of "rescinding approval of pre-1989 GSA-approved containers." This notice details the phase-out of plan for all GSA-approved security containers and vault doors manufactured prior to 1989 (commonly known as black label containers and vault doors). Please note that black label containers cannot be recertified or relabeled.

Security Container Identification:

To determine whether a Security Container was manufactured between 1954-1970, check the manufactured date on the data plate located on the side of the control drawer when opened. If assistance is needed to identify the location of the data plate, contact your Field Servicing Security Office (FSSO).

Recommendations for operating units and departmental offices:

• Ensure a plan is in place for transferring CNSI to a red label Security Container. The Security Container custodian or qualified personnel with an active security clearance equal to or higher than the contents of the container must be on site to direct any movement of CNSI from one Security Container to another.
• Review CNSI holdings in accordance with records retention policy, declassification, destruction, or retention requirements.
• Avoid printing CNSI to minimize the national security impact of transfers from one Security Container to another.
• When ordering new Security Containers, allow a minimum of 90 days for arrival to account for any shipping delays due to demand or supply chain issues.
• Contact your FSSO for assistance.

For questions regarding Security Containers or Vault Doors, please contact [email protected] or your Field Servicing Security Office (FSSO).