“We need a SCIF” is one of the most expensive sentences in a project meeting, and a fair number of the projects that begin with it do not need one. The difference between a SCIF and a very well-built locked room is not construction. It is an accreditation — and knowing that early changes the budget, the schedule and sometimes the whole approach.
The approval is the thing
A Sensitive Compartmented Information Facility is an area that a government Accrediting Official has formally accredited for handling Sensitive Compartmented Information. The accreditation is what makes it a SCIF. A room built exactly to the construction criteria but never accredited is not a SCIF; it is an expensive room.
That is the point people miss when they shop for one. The Intelligence Community’s directive on the subject, ICD 705, together with its implementing standards and the IC Tech Spec, describes how such facilities are to be built and evaluated. Those documents are about evidence: the perimeter construction, the doors and locks, the treatment of penetrations, acoustic protection, intrusion detection, access control, telecommunications and the procedures under which the space is run. Producing that evidence is the work. The approval is the outcome.
A direct consequence, and one worth putting in front of any vendor claim you are handed: no product is “ICD 705 certified.” No wall system, no door, no alarm panel, no modular enclosure. The Tech Spec itself cautions that claims a product can be accredited without modification may not be accurate. Facilities are accredited; products are not.
What a secure room is missing
Take a genuinely good secure room — solid construction, a substantial door, good locks, an alarm, card access, and a policy about who goes in. What separates it from an accredited space is not usually one dramatic feature. It is a list:
- A sponsor and an accrediting authority. You cannot self-accredit. There has to be a government sponsor with a mission need and an Accrediting Official who will act on it.
- Construction to a specified standard, documented as it is built. Inspectors cannot see inside a finished wall, which is why the photographic construction record matters as much as the wall does. Take the photographs before the board goes up; there is no way to recover them afterwards.
- Intrusion detection at a prescribed level. For accredited spaces the alarm system is normally installed and serviced under the UL 2050 national industrial security systems certificate service, at Extent 3, by a UL-listed alarm service company — with prescribed alarm response arrangements. That certificate attaches to the installed system and its ongoing service, not to any product you can buy.
- Acoustic protection. Speech must not be intelligible outside the perimeter, and that is demonstrated, not assumed.
- Treatment of everything that passes through the perimeter. Ducts, conduits, pipes, power and communications all get specific attention, including the separation and filtering practices that go under the heading of RED/BLACK.
- Procedures, and evidence that they are followed. Standard operating procedures, emergency plans, a construction security plan, visitor and combination control, end-of-day checks.
Read that list again from a budget perspective. Most of the cost is not exotic materials. It is documentation, testing, specialist alarm service, procedural discipline and time — none of which appears in a per-square-foot construction estimate.
Do you actually need one?
Three questions settle it faster than a design meeting.
What information will actually be handled in the space? Sensitive Compartmented Information drives a SCIF. Special Access Program information drives a SAPF, under its own manual, built to equivalent criteria. Collateral classified information held by a contractor is a different regime entirely and is approved by a different authority. Proprietary or commercially sensitive information — however valuable — is none of the above, and a well-built secure room with good access control and an alarm is a complete and appropriate answer for it.
Who is your sponsor, and have they said so in writing? If nobody can name the government sponsor and the accrediting authority, the project is not yet a SCIF project. It may become one; it is not one today.
Is there an existing accredited space you could use instead? Co-use arrangements and reciprocity exist precisely so that not every programme builds its own. That conversation costs a phone call and occasionally saves an entire construction project.
If all three point the same way, you have a SCIF project. If any of them wobbles, you may have a secure-room project with a SCIF-shaped label on it — and the honest version of that conversation, held early, is worth a great deal.
If the answer is yes
Two pieces of advice that apply to nearly every accredited-space project. First, get the requirements from your Accrediting Official before you design, not after. A meaningful number of decisions in this area are theirs to make, and published documents leave them room to make them; a design based on what a website said is a design that gets revised. Second, plan the evidence, not just the building. Photographs, test results, acceptance records, certificates and plans are the deliverable. Teams that treat them as paperwork at the end lose weeks recovering what they could have captured in an afternoon.
We publish everything we know about this publicly and for free, because the failure mode we see most often is a project team learning the vocabulary too late. Start with Understanding SCIF & SAPF Security for the shape of the whole subject, or go straight to SCIF Answers and ask it a question the way you would ask a colleague on the jobsite. The downloadable primer and project readiness questionnaire are a good way to arrive at the first meeting with your sponsor already knowing what they are going to ask.
One boundary worth stating plainly, because it is ours: we do not accredit anything, we do not install, and we do not perform classified work. Requirements for any facility are set by its Accrediting Official, its Cognizant Security Authority and, where emanations are in question, the Certified TEMPEST Technical Authority. What we can do is make sure your team understands the criteria and arrives with equipment that will not have to come back out.
Who wrote this, and what we sell. LA CCTV Supply provides security consulting and system design, sells the equipment and trains your people. We are not an installing contractor: installation is performed by your licensed contractor, except for small non-permitted work under $1,000 all-inclusive, which we can handle directly.
Nothing above is legal, code or accreditation advice. Requirements for your project are set by your Authority Having Jurisdiction, your engineer of record, your contracting officer or your Accrediting Official — and where a figure depends on your building, we have said so rather than inventing one.