KINGDOM OF SAUDI ARABIA

MINISTRY OF INTERIOR
HIGH COMMISSION FOR INDUSTRIAL SECURITY

SECURITY DIRECTIVES
FOR INDUSTRIAL FACILITIES

SEC—11

Identification Cards

:1?
W

Issue Date: 1216/I-43lHI 2610512010

RESTRICTED
All Rights reserved to HCIS. Copying or disuibution prohibited without written permission from HC IS
 .;.r\.~.>:«
Kingdom of Saudi Arabia .
p_,o ‘£32134/Eel!‘
to b

Ministry of Interior E -.
O
__1,-u.u. ;’,Ij,_,

I-hgh Commission for Industrial Security g «>"“" 0”’ W’ “-‘“

Secretariat General ‘M’ "M"
SEC-11 Identification Cards

Table of Contents

1.0. ADMINISTRATION . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..3

1.1. Scope ..................................... .

1.2. APPLICATION . . .. ... . .. ..
‘L3, Comrucrs & DEv|A'r|oNs .................................... ..3

2.0. DEFINITIONS . . .... . . . . . .... .. .. ..4

3.0. REFERENCES ................................... ..4

4.0. GENERAL REQUIREMENTS ................................... ..6

4.1. Osmcnves ........................................................................................................................................... .. 6

4.2. PHYSECAL smucruna... .............................................. .. 6
4.3. Vusum. ELEMENTS.... ..
4_4, MACHINE READABLE ELEMENTS
4.5. Encavvnou ...............................
4.6. BIOMEFRICS......................................................................................................................................... .. 10
4.7. CARD VALIDITY..................................................................................................................................... ..10
4.8. CARD MANAGEMENT ............................................................................................ ..
4.9. COMPLIANCE ................................... .. 11
5.0. APPLICATION OF REQUIREMENTS

Issue Date: l2f6ll43lH I ZISIDSIZOID

RESTRICTED _
All Rights reserved to HCIS. Copying or distribution prohibited without written permissmn from HCIS
Page 2 of 12
 - ‘ - '
- 4'.‘-"H7 ’1”’3 ”/5.
Kingdom of Saudi Arabia
if
Ministry of interior ‘->6 *4-J-‘W’ ‘3‘3J
High Commission for industrial Security g u’°L""'“ #9“ ‘-1""-'-"
Secretariat General 5.4.11 ::u‘:J1

SEC-1] Identification Cards

1.0. Administration

1.1. Scope

This directive provides the minimum requirements for companies, and

establishments, that are subject to the supervision of the High Commission for
Industrial Security (HCIS), Ministry of interior, for identification cards.

1.2. Application

This Directive is applicable to all facilities, including new projects, the expansion of
existing facilities, and upgrades. For application to existing facilities, the Operator
shall assess his facilities against the requirements of these Directives and coordinate
with the General Secretariat of the High Commission for Industrial Security (HCIS)
to comply with the Security, Safety, and Fire Protection requirements according to
these Directives and add to or modify the existing facilities as required. Where the
HCIS has assessed deficiencies in existing facilities during a survey, comparing the
current state of the facilities to the requirements of these Directives, those identified
deficiencies shall be corrected by the Operator.

1.3. Conflicts & Deviations

Where implementation of a requirement is unsuitable or impractical, where other

equivalent company or industry Standards and Codes are followed, or where any
conflict exists between this Directive and other company standards and Codes, the
deviations shall be resolved by the HCIS. Deviation lower than the requirements of
this directive shall be listed and submitted in a report of compliance or non-
compliance, with justification and reason, for each applicable requirement of these
security directives, and approval shall be received from the HCIS prior to
implementation. The documents shall be retained by the company in its permanent
engineering files.

Issue Date: l2l6f143lH I 26."05I20lD

RESTRICTED
All Rights reserved to HCIS. Copying or distribution prohibited without written pennission from HCIS
Page 3 of 12
 Kingdom of Saudi Arabia ,:r:~.~:>:.n::e1p /gem
I
1:.» *5 l’!

Ministry of Interior Y 1--'-—.1='!«I5* 33"):

High Commission for Industrial Security Q w“‘"j' K5“ W‘ '**-"'
Secretariat General ‘A-3‘ '°'W‘
SEC-ll Identification Cards

2.0. Definitions

HCIS High Commission for Industrial Security.

Operator Company or owner of a facility.
Restricted A Class 1, 2, 3 or 4 industrial facility that requires a plant card for
Facility access. Restricted facilities may have any classification but still
require a plant card for access-
Shall Indicates a mandatory requirement.
Should Indicates a recommendation or that which is advised but not
required.

3.0. References
This directive adopts the latest edition ofthe references listed.
The selection of material and equipment, and the design, construction, maintenance,
operation and repair of equipment and facilities covered by this SD shall comply
with the latest edition ofthe references listed in each SD, unless otherwise noted.

ANSI INCITS 358-2002 The BioAPI Specification

ANSI INCITS 398-2005 Comm on BioMetric Exchange
Formats Framework
FEPS PUB 187 Advanced Encryption Standard (ABS)
(Federal Information Processing Stndards
Publication)
ISOIIEC 10536 Identification cards - Contactless
integrated circuit(s) cards
ISOIIEC 1444-3A Identification cards - Contactless
integrated circuit(s) cards - Proximity
cards
ISOIIEC 15693 Identification cards Contactless

Issue Date: 1216/1431}! 12610512010

RESTRICTED
All Rights reserved to HCIS. Copying or distribution prohibited widamxt written permission from HCIS
Page 4 of 12
 V
Kingdom of Saudi Arabia
if
Ministry of Interior )5-
H'hC
lg
" or n ustna‘ls ecunty
OmII1lSSl0l'I fld
' % 6.9!.-_.,.ll ‘-,.')U L_.1..|I :;,AI

Secretariat General z.L.Ji azwl

SEC-Ii Identification Cards

integrated circuit(s) cards Vicinity

cards
ISOIIEC 781 0 Identification Cards - Physical
Characteristics
NSA Suite B National Security Agency Suite B
Cryptography

Issue Date: 12.'6Il43lH I 2610512010

RESTRICTED
All Rights reserved to HCIS. Copying or distribution prohibited without written permission from I-ICIS
Page 5 of 12
 I. - _/ V J / ’’_Q I ,4
*5 . ' k: l‘: b i‘
. .
Kingdom of Saudi Arabia l
f
Ministry of Interior ‘)6’, "-—'-J-‘"43 5313;
High Commission for Industrial Security
Secretariat General "'*"‘ “W”
SEC-1! Identification Cards

4.0. General Requirements

All identification cards shall comply with the requirements of the standards
referenced in this document.

4.1. Objectives
4.1.1. Identification cards shall be issued to individuals after proper verification of
a persons identity and authorization by proper authority.
4.1.2. The identification card shall only remain valid until its expiration date. A
process to revoke the validity of cards shall be provided.
4.1.3. Identification cards shall be resistant to tampering and/or counterfeiting.

4.2. Physical Structure

4.2.1. The card feedstock shall comply with the requirements of ISO/IEC 7810,
“Identification Cards — Physical Characteristics”. This standard requires a
credit card sized identification card sized approximately 85mm x 54mm. All
card feedstock should be certified to comply with this standard.
4.2.2. The finished card shall have all layers fused together so that removal of any
2
layer shall not be possible without damaging other layers.
4.2.3. Identification cards shall} have all data directly printed on the card.
4.2.4. The card shall be protected against wear and tear by an anti-counterfeiting
film. This layer shall be fused to the card surface so that any attempt at
tampering shall also damage the printed card.
4.2.5. The film shall provide visual cues that will authenticate the integrity of the
printed card.
4.2.6. Examples of such anti-counterfeiting attributes may be a hologram or 3D
imaging that interacts with the base card to produce the anti-counterfeiting
attribute.
4.2.7. Data may be printed on
4.2.3. While there are no restrictions on card feedstock color, it is required that the
base feedstock is blank and all card details shall be printed directly on the
card. -
4.2.9. All data printed on the ID card shall be in Arabic & English.

Issue Date: l2l6lI431H I ZGIDSIZDIO

RESTRICTED
All Rights reserved to FIGS. Copying or distribution prohibited without written permission from I-ICIS
Page 6 of 12
 3
Kingdom of Saudi Arabia T ‘»"’W"l "E
Ministry of Interior )6. ‘—'-‘=“-"‘ 5"»
High Commission for Industrial Security E c-°'~'-‘-" c/3" ‘-9*" ‘*9’
Secretariat General ‘*1-*' ‘*’“"*'l
SE0] 1 Identification Cards

4.3. Visual Elements

4.3.1. Card visual elements shall include, at a minimum, required data fields,
company logo, usage policy statement, photograph and signature. The visual
attributes should be adequate to authenticate the card in tower security
applications.
4.3.2. The data fields that shall be printed on all cards, are as follows:
REQUIRED
4.3.2.1. Card Type Employee, Contractor, Dependent, etc.
4.3.2.2. Last Name
4.3.2.3. Middle Name
4.3.2.4. First Name
4.3.2.5. Employee Identification Number
4.3.2.6. Government ID # Saudi Government ID number
4.3.2.7. Company Name Contractor employees only
4.3.2.8. Seria! Number
4.3.2.9 Expiry Date
4.a.2.1b. Blood Type

OPTIONAL
4.3.2.11. Issue Date
4.3.2.12. Issue Place
4.3.2.13. Date of Birth
4.3.2.14. Nationality
4.3.2.15. Company C.R.# Contractor employees only
4.3.2.16. Access Rights Restricted facility access only

4.3.3. All cards shall have the company logo imprinted on the front of the card. If
required, additional iogo’s for special cases may be imprinted on the card.
4.3.4. Employee and contractorcards shall use clearly distinguishable color in
accordance with the regulations issued by I-ICIS for Industrial Security.
4.3.5. Identification cards in which the card holder has access to restricted facilities
shall have red color in a title box that will identify the card type. Red color
shall not be used in title boxes or backgrounds for any other card type.
4.3.6. Operator may use colored bars or indicators to designate general access
rights for card holders with restricted area access. These general access right
visual indictors may be accompanied by a printed list of all restricted
facilities where access is permitted.-

lssue Date: l2a’&4'l43IH I 261053010

RESTRICTED
All Rights reserved to HCIS. Copying or disuibution prohibited without written permission from HCES
Page 7 of 12
 . . . ' ;- v _z, 1/. g 4 /;
Kingdom ofSaud1Arab1a ‘I: . ':’ i‘_j‘;;::ii,Lg;',ii.i
T
Ministry of Interior X‘ ‘—'=’*'’-'’' ‘J‘3J
High Commission for Industrial Security g ti‘-'~=" 0'9" ‘=‘-’‘ ‘-‘=‘'‘
Secretariat General "W “"4"
SEC-ll Identification Cards

Where the number of restricted facilities is too large to list on the back of the
ID card, the Operator shall use group codes to represent groups of restricted
facilities where access is permitted.
4.3.7. All cards must display the following printed statement on the back of the
card:
This card is the property of <<insert company name>>. Use of this card, by
the cardhoider, or others, for purposes other than authorized by <<insert
company name>> is illegal and may subject the person to criminal
prosecution under the law. If found, please contact <<insen Saudi Arabia
telephone number>> to arrange its return to the company.
4.3.8. The minimum size required for identification card photographs is 40mm x
25mm in size and must allow card holder features to be clearly distinguished.
The Operator must ensure that the pictures are clear and properly exposed.
4.3.9. The photographs must show a full face view with a plain, light colored
background and must be located on the front of the identification card.
Personnel must not be wearing sun glasses for any identification card
photographs.
4.3.10. Where cardholder has access to Restricted facilities the photograph must be
taken without any head gear on. Security or government personnel may use
photographs with their ofiicial head gear on to clearly distinguish them from
non-security or non government personnel.
4.3.11. Photographs must be directly printed on the identification card and also be
retained within the identification card system database.
4.3.12. Applicants shall not wear military uniform for the identification card
photograph if they are not military personnel.
4.3.13. The signature must be printed directly on the identification card and also be
retained within the identification card system database. The signature shall
be the official one used by the card holder within the company.
4.3.14. The card shall use some form of tamper resistance that provides visual
evidence of tampering. This tamper resistance can be provided by using
available technology such as, but not limited to, optical varying structures,
optical varying ink, laser etching & engraving, holograms, holographic
images or watermarks to validate the integrity of the card.

Issue Date: 12.«'6li43Il-lf26f05.’20l0

RESTRICTED
All Rights reserved to HCIS. Copying or distribution prohibited without written permission from HClS
Page 8 ofl2
 Kingdom of Saudi Arabia
T
Ministry of Interior )6-
High Commission for Industrial Security g o-“'-°" 0'5“ ‘-‘-" “-"’
Secretariat General "“"' 3”‘
SEC-11 Identification Cards

4.4. Machine Readable Elements

4.4.1. The card shall include machine readable elements as a mandatory

requirement.
4.4.2. Machine readability shall be provided, at a minimum, by the inclusion of a
‘smart card’ chip within the card. Operator may optionally place additional
machine readable elements on the card for lower security applications.
4.4.3. Mandatory machine readable elements shall comply with either ISO/IEC
14443A, ISO/IEC 10536 or ISO/IEC 15693.
4.4.4. Data available as machine readable shall include biographic data, access
rights and biometric measurements (if used). This data shall be stored in
encrypted format in the card.
4.4.5. If Operator decides to store access related data or logs on the card, they shall
also be protected by encryption.
4.4.6. Data encrypted on card shall comply with the requirements stated in the
section 4.5.

4.5. Encryption

4.5.1. Data stored in smart cards for compliance with HCIS requirements shall be
protected by encryption.
4.5.2. The data encrypted on the card shall be encrypted in accordance with the
methods stated in FIPS PUB 197 (US Government Federal Information
Processing Standards Publication Advanced Encryption Standard [AES])
and/or NSA Suite B (US Government National Security Agency Suite B
Cryptography). A key aspect of Suite B is its use of elliptic curve
technology instead of classical public key technology. This approach will
permit Suite B to remain current in the foreseeable future.
4.5.3. At a minimum the identification card shall store private keys and public key
certificates and perfonn encryption operations using the privatekey. _
4.5.4. The card shall support elliptic curve key pair generation, elliptic curve
private key operations and importation of digital certificates.
4.5.5. All encryption operations using the card encryption keys shall be performed
on-card.

Issue Date: 1216114311-lI26f05f20l0

RESTRICTED
All Rights reserved to HCIS. Copying or distribution prohibited without wrincn permission from HCIS
Page 9 of12
 Kingdom of Saudi Arabia ‘if if M” iii‘: l,ié'ii.i
T
Ministry of Interior Y =—'—.1»m~ :35,
High Commission for Industrial Security % 8*‘-=4" ax?’ 9”‘ 12*‘
Secretariat General W" “W
SEC-11 Identification Cards

4.5.6. The card encryption keys shall be generated on the identification card. The
card shall not permit export ofthese keys.

4.6. Biometrics

4.6.1. Biometric data used in security systems shall comply with the requirements
of ANSI INCITS 358—2002 (The BioAPI Specification) and ANSI INCITS
398-2005 (Common BioMetric Exchange Formats Framework).
4.6.2. These standards are used to ensure interoperability of security systems by
using the standard BioAPI interface and standard file formats for biometric
data.

4.7. Card Validig

4.7.1. The validity of identification cards shall comply with the instructions
regulating Industrial Security specified by “Regulations for industrial
Security for Petroleum, ‘Industrial, and Service Companies and
Establishments under the supervision of the High Commission for industrial
Security”.
4.7.2. The Operator may elect to have shorter "validity then specified by the
Ministerial Order referenced above.
4.7.3. Cards other than employee I dependent cards must have maximum validity
limited by visa or contract expiry if the validity ofthese documents is shorter
then the maximum validity specified by the Ministerial Order referenced
above.

4.8. Card Management

4.8.1. When personnel depart on vacation, short leave or terminate their
employment Operator shall disable their access to restricted facilities.
4.8.2. Operator shall provide electronic authentication card readers at all restricted
facilities to verify card integrity. While access control systems provide this
capability, facilities without access control shall still use card rcader(s) to
electronically authenticate the card locally or centrally.
4.8.3. If authentication card readers are not available at all restricted facilities then
the Operator shall ‘retrieve cards with restricted area access when the card
holder goes on vacation or short leave. In this case, all ID cards for

Issne Date: l2I'6l143lI-I I 26ffl5:'2D1lJ

RESTRICTED
All Rights reserved to H018. Copying or distribution prohibited without written permission from HCIS
Page 10 of 12
 . - . . r V {V 2/4 4 /,1
Kingdom of Saud1Arab1a
T '
Ministry of Interior Y ‘—I-‘*'‘-‘’* 5'3:
High Commission for Industrial Security
Secretariat General W‘ “"5"
SEC-11 Identification Cards

restricted access shall have a list of all access rights printed on the card to
allow visual authentication.
4.8.4. Operator shall recover penalties for lost cards as specified in instructions
regulating Industrial Security contained in “Regulations for Industrial
Security for Petroleum, Industrial, and Service Companies and
Establishments under the supervision of the High Commission for Industrial
Security”.
4.8.5. All identification cards allowing restricted access shall be recovered from the
cardholder upon termination of employment.
4.8.6. Operator shall design and issue new ID cards once within every 4 year cycle.
These new ID cards shall comply with the requirements stated in this
security directive.
The new card designs shall be clearly different from the old card designs.
4.8.7. Retrieved ID cards shall be destroyed as specified in instructions regulating
Industrial Security contained in “Regulations for Industrial Security for
Petroleum, Industrial, and Service Companies and Establishments under the
supervision of the High Commission for Industrial Security”.
4.8.8. Operators shall put procedures in—place to ensure that all identification cards
provided to contractors are retrieved prior to certifying completion of a
contract.

4.8.9. The holder of an identification card shall be responsiblefor it’s safekeeping

and shall return it prior to its expiry date or when leaving the Kingdom of
Saudi Arabia. The holder shall be issued with a unique personal
identification number (PIN) which will allow entry to restricted areas.
4.8.10. The Operator shall implement procedures to notify all posts where electronic
access authentication is not available that a card, or cards, have been lost or
stolen.

4.9. Compliance
Operator shall provide documented proof of compliance with these requirements.

Issue Date: 12l6i’1431I‘I I 2610512010

RESTRICTED
All Rights reserved to HCIS. Copying or distribution prohibited without written permission from HCIS
Page 1 I of 12
 .' . . rv/,9 kc; 4/; '
Kingdom of Saudi Arabia ‘5 . ' b: i‘_‘_‘ 9
T
Ministry of Interior X ‘‘—‘--*’''''°' ‘355
High Commission for industrial Security V «.s"""‘ 0'9‘ 9”‘ “-*"'
‘M “W
Secretariat General
SEC-11 Identification Cards

5.0. Application of Requirements

This section lists how the elements of this security directive apply to facilities depending on
their classification using the criteria stated in section 4.2 of SEC-01.

1 APPLICATEON
ELEMENT C|ass1 C|ass2 Ciass3 { Class 4*
Physical Structure \/ J \/ /

Visuai Elements / V’ 1/ \/
Machine Readable Elements 1/ \/ w/ /
Encryption / \/ 1/ \/

Biometrics

Card Validity I v’ 1/ «’
Card Management \/ J \/ /

Issue Date: 121611431!-U 26f05I2.0l0

RESTRICTED
All Rights reserved to HCIS. Copying or distribution prohibited without written permission from I-ICIS
Page 12 of 12