TBB rooms: handling and use procedure

What a compartment is

ABRO 2026 designates all information, systems, materiel, goods and objects that require protection as a Te Beschermen Belang (TBB). There are four categories, TBB 1 through TBB 4, with TBB 1 the most heavily protected. For classified information these correspond to Staatsgeheim ZEER GEHEIM, Staatsgeheim GEHEIM, Staatsgeheim CONFIDENTIEEL and Departementaal VERTROUWELIJK.

A Compartiment is the physical space in which such an interest is processed or stored. That can be a room, but also a floor, a building, a factory hall or an outdoor site. A compact TBB, such as a laptop, can additionally be stored in a lockable container. The specifications of a compartment are agreed with the NBIV. ABRO 3.2.1–3.2.3

The regulation works with a layered structure and with the need-to-know and need-to-be principles. The premise is not only that compromise is prevented, but also that a compromise or an attempt at one is detected, at a moment when intervention is still possible. ABRO 3.1.5, 3.1.6

Who may enter unaccompanied

• Only authorised staff have unaccompanied access. Authorisation runs through the security officer; staff hold a certificate of conduct or, where required, a valid security clearance at the prescribed level. ABRO 3.1.10, 3.1.11
• Access to a compartment requires multi-factor authentication. ABRO 3.1.9
• Access is registered, with at least the name of the person and the date and time of arrival and departure. Paper registration carries a signature. The record is kept for at least six months and provided to the NBIV on request. ABRO 3.1.7, 3.1.8, 3.1.13
• Inside the compartment the access badge is worn visibly, showing at least the person's name. ABRO 3.1.14
• The security instructions applying to that room are displayed on the outside of the compartment. ABRO 3.1.16

An electronic access control system carries further requirements: detection of access granted under duress, anti-passback, logging retained for six months and checked monthly by the security officer for notable irregularities, and an implementation in which all entrances close or stay closed if the system fails. ABRO 3.3.12–3.3.15

Visitors

Under the ABRO, a visit is an exception with its own procedure. A visitor is someone without authorisation who is given access under escort on the basis of need-to-know and need-to-be. ABRO 3.1.12

• The visit is in the direct interest of the contract concerned.
• The visitor is announced to the security officer in advance and their identity is established beforehand.
• The visitor is registered with at least name, date and time of arrival and departure.
• The visitor is escorted without interruption by an authorised member of staff throughout the visit and wears a clearly recognisable, visible visitor badge.
• At the heavier levels the intended access must additionally have been submitted to the NBIV for approval at least five working days before the visit, using the visitor authorisation form. ABRO 3.1.15

That five working day term is where a use procedure tends to break down in practice. A supplier in a hurry, an engineer arriving earlier than planned, a guest added on the day itself: none of them fit. That is not an administrative obstacle but the substantive point of the provision: whoever enters has been assessed in advance.

Keys, codes and containers

• Physical keys and spare keys giving access to a compartment remain on the premises at all times and are only left in a container designated for the purpose. Spare keys are never kept in the same container as the original. ABRO 3.1.22
• Access means, combinations and certificates are managed by the security officer; when not in use they are kept in a container. ABRO 3.1.23, 3.1.24
• Combinations on container locks are changed at least every six months, and immediately on commissioning a new lock, on withdrawal or change of an authorisation, after maintenance on the lock, and on suspicion or confirmation of compromise. A previously used combination is not chosen again. ABRO 3.1.25
• Loss or theft of a physical access means is handled as a security incident. ABRO 3.1.26

Issuing access means is checked against the correct authorisation, registered, and the register is updated at least annually. ABRO 3.1.17 That last step is the one most often omitted in practice, causing the list of who can enter where to drift slowly away from reality.

What may and may not be brought in

The ABRO is explicit here, and this is the part of the procedure where daily behaviour makes the difference.

• Only electronic equipment strictly necessary for the work is permitted. Approval is based on a risk analysis, and equipment originating from a country with an offensive cyber programme is excluded. The list of equipment and the accompanying risk analysis are approved in advance by the contracting authority in coordination with the NBIV, and included in the security plan. ABRO 3.3.27
• Procedural measures keep electronics that are not strictly necessary outside the compartment. ABRO 3.3.28
• No cameras, smart devices, microphones or other equipment with a recording or communication function are present in a compartment. ABRO 3.3.30
• Equipment for security or building management, including building management systems and IoT devices, counts as a system and is only permitted when secured to the established level. ABRO 3.3.29

A list of permitted equipment is therefore not an inventory taken afterwards but a document approved in advance. Anything outside it does not belong in the room, however briefly or however harmless it may seem.

Examination on commissioning and on change

ABRO requirement 3.3.31 states that before a compartment is taken into use and on the addition or alteration of equipment, an electronic security survey and a sound attenuation measurement have been carried out in coordination with the NBIV. Any measures are agreed with the NBIV before implementation. According to the ABRO table this requirement applies at TBB 2 and TBB 1. Requirement 3.3.32 does the same for TEMPEST measures; the instructions for those can be requested from the NBIV.

For central government the same line runs through VIRBI 2025. That decree requires a TSCM or electronic security examination before a working space or other secured zone is taken into use, and additionally periodically and on every structural alteration or addition of new items. As examples of such items the decree names ICT equipment, furniture, paintings and corporate gifts. Both provisions apply from Staatsgeheim CONFIDENTIEEL upwards. VIRBI 2025, table 5.1 J–K

For the use procedure this means that the question ‘has anything changed here?’ is part of day-to-day management. A new display, a different table, a gift on the wall: each is a moment at which the previous statement about the room loses its shelf life. See also the national TSCM/EVO policy advice.

Detection during and outside use

• A TBB is under the detection of an intruder detection and signalling system (IDSS). That can be installed on the compartment, the container or the interest itself. ABRO 3.3.17
• The compartment is included in the IDSS as a separate zone. That zone is active as soon as no authorised member of staff is in the room; the system is always armed unless authorised staff are present. ABRO 3.3.19, 3.3.20
• Deactivation is possible only by a designated person, using multi-factor authentication. ABRO 3.3.21
• The IDSS has a power supply that guarantees operation for at least the maximum intervention time. Loss of power is signalled and recorded, and a power failure is handled as if it were an alarm. ABRO 3.3.25, 3.3.26

Access doors have a door closer on the inside and an electronic and acoustic alarm that sounds when a door stands open longer than necessary. Emergency doors open outwards only, are sealed and raise an alarm when opened. ABRO 3.2.5, 3.2.6

The closing round

When the last member of staff leaves the compartment, a closing round is made. The ABRO prescribes what is checked as a minimum:The ABRO prescribes what is checked as a minimum. ABRO 3.1.31

• whether the container, the compartment and where possible the floor and the building are locked;
• whether windows and doors are closed;
• whether no persons remain;
• whether the seals on emergency doors are intact;
• whether the security measures are armed, such as the IDSS.

The closing round is the cheapest measure in the whole system and at the same time the only one that has to be carried out again every day. A room that meets every structural requirement stands open the moment the last person forgets to check that it does not.

Management, maintenance and incidents

Physical equipment, security components and security systems are managed and maintained so that they keep working. Security systems are installed in accordance with the standards in the ABRO annex, and maintenance and inspection take place at least annually by a certified company. ABRO 3.1.27, 3.3.2

A security system is not connected to a central building management system or any other facility allowing it to be managed remotely. Wireless connectivity is disabled and the systems are connected only through a dedicated, segregated management network. ABRO 3.3.5, 3.3.6, 3.3.7 At the heavier levels the use of cloud solutions for management and maintenance is excluded; where it is permitted, the supplier must be registered with the NBIV as a subcontractor. ABRO 3.1.28, 3.1.29

VIRBI 2025 adds provisions on repair and maintenance for central government: external repair is bound by procedures established by the departmental security officer, repair takes place on site unless the classified information has been removed using approved means, maintenance is performed by persons holding an appropriate security clearance, and external staff work only under escort by the organisation's own staff. VIRBI 2025, table 5.1 U–X

What this means in practice

The security of a room is a state that is confirmed or undermined again every day. The structural layer rarely changes; the handling changes constantly.

For organisations outside the ABRO and VIRBI, this system is usable as reference rather than obligation. The parts that transfer most easily are the pre-approved equipment list, the escorted visitor procedure, the management of keys and codes, the closing round, and recording every change in the room. In practice those five determine most of the result, and none of them requires measurement equipment.

What technical examination adds is establishing whether the assumption holds. What such an examination can and cannot demonstrate is set out in what a sweep can and cannot establish.