Prose:DMS Officer Changeover Procedure

DMS OFFICER CHANGEOVER PROCEDURE

Notice: The changeover procedure may only be performed while the system is in the disarmed condition. Additionally, the vault blast doors will unlock only in the disarm state.

Steps

1. In the disarmed condition, the incoming officer enters the vault through the blast door airlock after the outgoing officer verifies their identity and permits them access.
2. The outgoing officer briefs the incoming officer on the current state of the system, detailing all relevant items in the shift log, such as perimeter alarms or warhead alarms.
3. Both the incoming and outgoing officer visually and verbally confirm the disarmed state of the system.
   1. IF the disarmed state of the system is not confirmed, a security incident has occurred. The incoming officer MUST immediately leave the vault while the outgoing officer continues to perform their duties.
4. Both the incoming and outgoing officer verbally agree to perform the changeover.
   1. IF both officers cannot agree at this stage, the incoming officer MUST immediately leave the vault while the outgoing officer continues to perform their duties.
5. The incoming officer inserts their changeover key into the COOP INHIBIT lock, turning it and keeping it held against the spring pressure.
6. The present officer releases the dead man’s switch, handing it to the incoming officer who will secure it in their free hand.
7. The incoming officer releases tension on the COOP INHIBIT lock, removes the key, and hands it to the outgoing officer. The changeover key is never within the vault except during changeover.
8. The outgoing officer hands the firing key to the incoming officer, transferring firing authority. The firing key always stays within the vault.
9. The incoming officer and outgoing officer both record their names in the shift log.
10. The outgoing officer leaves the vault.
11. Raven must confirm the changeover has occurred without duress in order for the system to be able to be rearmed. This takes approximately 30-60 minutes.

Note: The only time the firing key would ever be removed from the vault is in a period of dormancy when the bridge laboratory is non operational OR the bridge laboratory is being decommissioned. In these circumstances the enable code biscuit would also be removed from the safe by a Raven cryptographics team (two Crypto Officers + armed escort).

---

As Operator in Command (OIC) or Co-Operator in Command (OICO), you are entrusted with the authority granted to you by your license to operate the bridge generator as and when permitted to do so by the authorised experiment window. You hold one PALIS key, one part of a pair, the other of which is held by your colleague. Both you and your colleague must agree to start the experiment by inserting your keys into the locks and turning them within one second of another. Both you and your colleague must also perform the same action at the end of the experiment to confirm the successful shutdown of the bridge generator. Only once manual confirmation of shutdown has occurred may the FTS be disarmed (with the agreement of both DMS officers).

Key Custody
Key possession is entrusted to the current shift OIC and OICO. During a shift transfer, key handoff occurs, which is observed and recorded by the duty Credential Security Officer. A key must not leave your possession at any time without a formal handoff. Possession follows authority; if you must leave the control deck at any time, you must wait for a relief operator to arrive, take recorded possession of the key, and assume control. AT NO TIME may keys leave the control deck.