Protective design has its own alphabet soup: UFC, ISC, FSL, LOP, ASTM F1642, F2912, GSA-TS01, ASCE 59, API RP 752. If you own, manage or design a building that falls under one of these frameworks, or you just want to understand what a security consultant is talking about, this guide explains what each major US standard does, who it applies to and how they fit together. It is a map, not a substitute for the documents themselves or for a qualified engineer.

The landscape at a glance

UFC 4-010-01: DoD minimum antiterrorism standards

Unified Facilities Criteria (UFC) are DoD's design and construction documents, available publicly through the Whole Building Design Guide UFC library. UFC 4-010-01 establishes minimum antiterrorism standards for DoD inhabited buildings. Its philosophy is important: the measures are intended to reduce injuries and fatalities for a broad range of events at reasonable cost, without requiring a building-by-building threat analysis. The standards address topics such as site layout and standoff, structural design to avoid progressive collapse (referencing UFC 4-023-03 where applicable), building envelope and glazing, overhead mounted architectural features, and mass notification.

Some companion criteria that contain threat-specific design information are distribution-restricted and available only to authorized users. That is normal in this field. Owners outside DoD should not expect, or need, access to restricted documents to benefit from the public criteria.

The ISC Risk Management Process

The Interagency Security Committee was formed on October 19, 1995, by executive order after the Oklahoma City bombing, and is now chaired by the Cybersecurity and Infrastructure Security Agency. Its standards apply to buildings and facilities occupied by federal employees for nonmilitary activities. The core document, The Risk Management Process for Federal Facilities, works in stages:

1. Determine the Facility Security Level (FSL). Facilities are rated from Level I (lowest risk) to Level V (highest) based on factors such as mission criticality, symbolism, facility population, facility size and threat to tenant agencies, with adjustments for intangible factors.
2. Identify the baseline Level of Protection (LOP). Each FSL corresponds to a baseline LOP, ranging from Minimum to Very High, which sets default countermeasure levels.
3. Assess risk and customize. A facility-specific risk assessment may raise or lower countermeasures from the baseline, using the ISC's design-basis threat information.
4. Implement or accept risk. Where the necessary LOP cannot be achieved, the decision to accept residual risk must be documented by the responsible officials.
5. Reassess periodically. FSLs and risk assessments are revisited on a schedule and when conditions change.

The beauty of this structure is that it ties spending to risk. A small leased office and a large headquarters are not treated the same way, and decision makers must sign for the risks they choose to accept.

GSA criteria

The General Services Administration, which owns and leases a large share of civilian federal space, implements ISC requirements through its facility design standards and related guidance. GSA's alternate path guidelines for progressive collapse resistance are widely used alongside UFC 4-023-03. GSA also developed an early glazing test protocol, GSA-TS01, which describes glazing outcomes in terms of numbered performance conditions. Many project specifications still reference those conditions.

ASTM F1642 and F2912: testing and rating glazing

ASTM F1642/F1642M is the standard test method for glazing and glazing systems subject to airblast loadings. The current active version is F1642/F1642M-25. The specifying authority supplies the loading parameters; the method describes how to test glazing, with or without framing, including glass, plastics, laminated products and retrofit systems not directly attached to the glazing such as blast curtains, cables, shades and architectural mesh. The test results are then used to determine a hazard rating under ASTM F2912.

Hazard ratings describe what happens to the glazing and its fragments: from no breakage, through breakage with fragments retained or falling close to the window, to higher-hazard outcomes where fragments travel well into the room. For owners and specifiers, three practical rules follow:

• A rating belongs to a specific tested configuration: glass makeup, size, frame, attachment and load.
• Specifications should state the required hazard rating and the loading criteria provided by the project's security engineer.
• Submittals should include test reports or accepted engineering analysis for the configuration being installed.

For more on how glass behaves and why these ratings matter, see how buildings fail. For retrofit products that are tested under these methods, see our retrofit comparison.

ASCE/SEI 59 and FEMA's building protection series

ASCE/SEI 59, Blast Protection of Buildings, is a consensus standard that covers analysis and design of buildings where blast protection is required, including performance criteria, structural and nonstructural elements, and the building envelope. It gives private-sector projects a recognized engineering basis when a client or authority specifies protection.

FEMA and DHS also published a Building and Infrastructure Protection Series and earlier risk management guides, including FEMA 426 (a reference manual for mitigating risks to buildings), FEMA 427 (a primer for commercial building design) and FEMA 452 (risk assessment). These remain readable introductions for owners and architects.

Industrial and natural hazard standards

Process plants follow API Recommended Practices for siting occupied buildings, covered in our guide to blast-resistant modules and facility siting. NFPA 68 and NFPA 69 address explosion venting and prevention for combustible dusts, gases and vapors within equipment and enclosures. For tornadoes and hurricanes, FEMA P-361 and ICC 500 set criteria for safe rooms and storm shelters, which we cover in our safe room guide.

Which standards apply to your building?