CNSSI 7003 Made Practical: Alarmed Carrier PDS Explained

Todd Taskerud, RCDD, breaks down how CNSSI No. 7003 Alarmed Carrier Protected Distribution Systems work in practice—and how modern acoustic-sensing technology is making compliance faster and more defensible than ever.
By Todd Taskerud, AWS CCP, RCDD/NTS/OSP/WD, LEED GA
5 min read
CNSSI 7003 Made Practical: Alarmed Carrier PDS Explained

Why PDS Still Matters in a World of Encryption

If your organization transmits unencrypted classified information over copper or fiber cabling—even across a short campus run—you are operating in Protected Distribution System (PDS) territory. The governing authority is the Committee on National Security Systems, and the controlling directive is CNSSI No. 7003 (2015), which superseded the older NSTISSI No. 7003 from 1996. As an RCDD who has worked through a fair number of secure-facility designs, I want to cut through the abstraction and talk about what PDS compliance actually demands on the ground—and where technology is finally catching up to the policy.

What CNSSI No. 7003 Actually Requires

CNSSI No. 7003 defines a Protected Distribution System as a wireline or fiber-optic telecommunications system that carries unencrypted National Security Information through an area of lesser classification or control. The standard establishes a framework of physical and electromagnetic safeguards intended to deny an adversary the opportunity to access that information in transit.

Three PDS categories exist under the directive:

  • Hardened Distribution System (HDS): The most rigorous physical construction—typically continuous metallic conduit, carrier pipe, or equivalent hardened pathway that defeats penetration and provides measurable acoustic or vibrational resistance.
  • Simple Carrier PDS: A conduit- or tray-based system with periodic inspections (a defined Periodic Visual Inspection, or PVI, schedule) but without continuous monitoring. The inspection burden can be substantial in large facilities.
  • Alarmed Carrier PDS: A conduit-based system augmented with a continuous intrusion-detection mechanism. When properly implemented, the alarmed approach can reduce or replace the labor-intensive PVI schedule required under Simple Carrier, because the system is actively watching the pathway rather than relying on periodic human inspection.

A critical point that trips up many designers: PDS is about physical line protection, not emanations security. TEMPEST—the discipline addressing compromising electromagnetic emanations from equipment—is a separate, parallel concern governed by its own classified standards. A PDS does not substitute for TEMPEST controls, and TEMPEST controls do not substitute for a PDS. They address different attack vectors.

The Alarmed Carrier Approach: How It Works

The core concept of an Alarmed Carrier PDS is straightforward: you install a sensing mechanism inside or alongside the conduit that carries the classified cable, and that sensor produces an alarm if the conduit is disturbed, opened, or penetrated. The challenge has historically been implementation—early systems were complicated, prone to nuisance alarms, and difficult to document in a way that satisfies the Cognizant Security Authority (CSA) during an inspection or accreditation review.

Acoustic-sensing fiber technology has changed that calculus significantly. Our partner CyberSecure IPS produces an Alarmed Carrier PDS solution that routes an optical sensing fiber within the conduit alongside the classified transmission medium. The sensing fiber responds to acoustic and vibrational signatures consistent with physical intrusion—drilling, cutting, or forced access—and triggers an alarm event in real time.

What distinguishes this approach for CNSSI No. 7003 compliance specifically is the documentation and automation layer. The system automates PVI scheduling and testing records, generating the audit trail that accreditors actually want to see. This is where many DIY alarmed-carrier attempts fall short: the hardware works, but the paperwork doesn't survive scrutiny. Automated logging closes that gap.

Cabling Infrastructure Inside a PDS

The conduit and pathway requirements of a PDS don't exist in isolation—you still have to design and install a functional cabling system inside that protected pathway. That means the usual standards still apply and must be reconciled with the security overlay.

For copper balanced twisted-pair inside a PDS, ANSI/TIA-568.2-D governs media selection and performance. Depending on bandwidth requirements, Cat 6A is typically the workhorse for 10GBASE-T applications. Pathway fill, bend radius, and separation requirements from ANSI/TIA-569 apply to the conduit runs themselves. Bonding and grounding of the metallic conduit system must follow ANSI/TIA-607, including proper termination to the Telecommunications Grounding Busbar (TGB) and, where applicable, the Telecommunications Main Grounding Busbar (TMGB). NEC/NFPA 70 wiring methods govern the conduit installation itself, including material selection and fill calculations.

For fiber runs within a PDS—common where long distances or immunity to electromagnetic interference is required—ANSI/TIA-568.3-D governs optical-fiber cabling and components. Singlemode OS2 fiber is the typical choice for longer campus or inter-building runs, with connector polish (UPC vs. APC) selected based on reflectance requirements and the passive component budget. The sensing fiber in a CyberSecure IPS installation is a separate optical element dedicated to the intrusion-detection function; it is not the same strand carrying classified traffic.

Administration and labeling under ANSI/TIA-606 takes on added importance in a PDS environment. Every segment, every termination point, and every access location should be recorded with enough precision to support both routine maintenance and the documentation demands of a CSA inspection.

Designing for the Accreditation Review

In my experience, the most common failure mode for PDS projects is not the hardware—it's the accreditation package. CSAs reviewing an Alarmed Carrier PDS installation will look for clear documentation of the sensing technology, evidence that alarm thresholds are appropriate and tested, a defined response procedure for alarm events, and a maintenance and testing log that demonstrates the system has remained functional since installation.

A well-implemented automated system addresses all of these. When the alarm log, PVI records, and test results are generated systematically rather than manually, the accreditation conversation becomes considerably more straightforward. That is the practical value of pairing a policy-compliant physical design with purpose-built compliance automation.

Putting It Together

CNSSI No. 7003 is a real operational requirement for any facility transmitting unencrypted classified information, and the Alarmed Carrier category offers the best balance of security rigor and operational manageability when implemented correctly. The combination of acoustic-sensing fiber intrusion detection with automated PVI and testing documentation represents the current state of the art for making that compliance practical and defensible.

At Heather Technologies, we work with CyberSecure IPS and apply established cabling standards—TIA-568.2-D for copper, TIA-568.3-D for fiber, TIA-569 for pathways, TIA-607 for grounding, and TIA-606 for administration—to design PDS installations that pass accreditation and stay compliant over the life of the system. If you are working through a PDS requirement, reach out. This is exactly the kind of project where getting the design right from the beginning saves significant pain later.

About the author — Todd Taskerud, AWS CCP, RCDD/NTS/OSP/WD, LEED GA, is a BICSI-credentialed communications distribution designer at Heather Technologies, specializing in fiber, copper, and data-center network infrastructure.