Governance & Document Hierarchy

Authority chain (ICD 705 §A; ICS 705-1 §A): National Security Act of 1947, as amended → EO 12333, as amended → EO 13526 → ICD 705 → ICS 705-1 and ICS 705-2 → IC Tech Spec.

Parallel and implementing documents:

Related ODNI standards on the same NCSC page, for context only: ICS 706-01 (domestic facility security risk assessments, 18 Jun 2019) and ICS 706-02 (mission-critical facility-related control systems, 23 Dec 2019).

Sources NCSC Security Governance and Regulations · ICD 705 · ICS 705-1 · ICS 705-2 · IC Tech Spec v1.5.1

ICD 705 is short, but every other document traces back to its Section D policy statements.

Sources ICD 705 · ICS 705-1 · NCSC Security Governance and Regulations

ICS 705-1 (17 Sep 2010) is where the "shall" statements for the space itself live. It also directs development of the Tech Spec as its implementation document.

What it covers:

• Perimeter: walls, windows, doors, ceiling and floor.
• Intrusion detection: "IDS shall detect attempted or actual unauthorized human entry into a SCIF." Installation, related components and monitoring stations "shall comply with Underwriters Laboratories (UL) 2050 Extent 3 standards." Response times follow 32 CFR Parts 2001 and 2004 for Top Secret. "Contractor SCIFs shall maintain a current UL certificate of installation and service."
• Access control (§G.2.b): access limited to authorized personnel by AO-approved methods, including "automated access control systems using at least two technologies (badge, PIN, biometric, etc.)." These methods are not approved for securing SCIF entrances when the SCIF is unoccupied.
• RF transmitters (§G.2.a): not introduced "unless evaluated and mitigated to be a low risk to classified information by a competent authority (e.g., CTTA) and approved by the AO."
• Unclassified systems (§G.2.d): evaluated by the CTTA and AO for TSCM and TEMPEST concerns.
• PEDs (§G.2.e): PEDs "pose a risk to SCI"; the Tech Spec provides the restrictions.
• RF shielding: "should be planned for installation during initial construction as costs are significantly higher to retrofit."
• Facility types and roles: open and closed storage, continuous operation, SWA, TSWA, T-SCIF; CSA, AO, SSM, CTTA, CST.
• Waivers: package contents, and the rule that a waiver removes a SCIF from mandatory reciprocal use.

Grandfathering. SCIFs accredited as of ICD 705's effective date "shall continue to be operated in accordance with the physical and technical security requirements applicable at the time of the most recent accreditation or re-accreditation." On re-accreditation, the SCIF must meet current IDS standards unless a waiver is granted. ICS 705-1 and the Tech Spec also allow a SCIF de-accredited but controlled at the SECRET level for less than one year to be re-accredited.

Sources ICS 705-1 · IC Tech Spec v1.5.1 · SAME 2026, Concept to Clearance (practitioner)

ICS 705-2 (22 Dec 2016, signed by the Director, NCSC) governs what happens around the build: how a facility is accredited, kept accredited, shared and closed.

See: Accreditation Lifecycle for how these rules play out step by step.

Sources ICS 705-2 · ICS 705-1 · IC Tech Spec v1.5.1

Full title: IC Tech Spec for ICD/ICS 705: Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities. Current public version 1.5.1, 26 July 2021.

Purpose (Ch. 1.A). The Tech Spec "sets forth the physical and technical security specifications and best practices for meeting standards of" ICS 705-01. "IC Elements shall fully implement this standard within 180 days of its signature." The v1.5.1 transmittal memo, signed by the Acting Director, NCSC, was "effective upon signature."

Applicability to SAPFs (Ch. 1.B.2). SAP language was added in v1.4. When the specifications "have been applied to new construction, renovations, and operation of Special Access Program Facilities (SAPFs), those facilities shall satisfy the standards outlined in ICD 705 to enable uniform use across all IC elements." Accreditation of a SAPF as a SCIF "will be based upon a review of all required SCIF construction documentation." If documentation is incomplete or waivers exist, "the AO is not required to issue SCIF accreditation." A SAPF co-utilized as a SCIF is held to the highest applicable requirement.

Risk management (Ch. 2.A). Coordination with the AO must happen "before construction design, material ordering, or contracts are finalized." And: "Exceeding a standard, even when based upon risk, requires that a waiver be processed and approved in accordance with ICD 705."

Prefabricated products (note added in v1.3). "Advertised claims by manufactures that their product(s), to include mobile platforms, prefabricated structures, containers and modular structures are built to SCIF standards and can be accredited without modification may not be accurate."

Sources IC Tech Spec v1.5.1 (NAVFAC mirror) · IC Tech Spec v1.5.1 (NCSC) · SAME 2026, Concept to Clearance (practitioner)

Sources IC Tech Spec v1.5.1 (NAVFAC mirror) · IC Tech Spec v1.5.1 (NCSC)

All entries in the v1.5.1 change history list the approver as "PTSEWG."

Status as of September 2026. No v1.6 or v2.0 was found on dni.gov. The NCSC regulations page still lists v1.5.1 and the v1.5 checklist set, and a March 2026 practitioner presentation still cites v1.5.1 as current. The v1.5 and v1.5.1 change histories list no Chapter 7 (IDS) changes.

Sources IC Tech Spec v1.5.1 (NAVFAC mirror) · IC Tech Spec v1.5 · NCSC Security Governance and Regulations · SAME 2026, Concept to Clearance (practitioner)

The forms are where the rules become evidence. NCSC also posts the v1.5 forms as stand-alone files.

Handling. The Pre-Construction Checklist says it "is not intended to contain any classified information," but the AO should be consulted before sending it over unclassified channels. A completed FFC "may be CUI or Classified depending on contents" (UFC 4-010-05, 1-19.2). DoDM 5105.21 Vol. 2 requires a SCIF's full address and identity as a SCIF to be protected (now handled as CUI).

Sources SCIF Fixed Facility Checklist v1.5 · Construction Security Plan v1.5 · SCIF Pre-Construction Checklist v1.5 · SCIF TEMPEST Checklist v1.5 · UFC 4-010-05 (2023) · DoDM 5105.21 Vol. 2

What is verified:

• The publicly available IC Tech Spec is v1.5.1 (26 Jul 2021). No successor was found on dni.gov, archive.dni.gov or the NAVFAC DoD Lock Program library as of September 2026.
• A CDSE Fixed Facility Checklist short guide dated April 2025 still refers to the ICD 705 Tech Spec.

What is reported but not publicly verifiable:

Sources SAME 2026, Concept to Clearance (practitioner) · Cushman & Wakefield, ICD 705 POA&M rescission (industry) · PSC Consultant, ICD/ICS 705 in 2026 (practitioner) · Holland & Knight, Leasing SCIF Space (industry) · LVT, ICD 705 construction security (industry) · CDSE FFC short guide · JLL, New era of SCIF construction (industry) · MGAC, New SCIF requirements under ICD 705 (industry)

Title: Sensitive Compartmented Information (SCI) Administrative Security Manual. UFC 4-010-05 (1-6.2): "DoDM 5105.21 (Volumes 1-3) are the primary documents associated with SCIFs for the DoD."

Who it applies to. Vol. 1 "Does not apply to the National Security Agency/Central Security Service (NSA/CSS), National Geospatial-Intelligence Agency (NGA), and the National Reconnaissance Office (NRO)." Those agencies run SCI security under their own IC-element authority.

DIA's role. The Director, DIA shall "Provide centralized physical security and TEMPEST accreditation for the DoD Components and DoD contractors except those under the security cognizance of NSA/CSS, NGA, and NRO" (Vol. 1). Vol. 2: "DAC is the sole accrediting authority for physical and technical (TEMPEST) security for permanent SCI facilities."

What Vol. 2 adds in practice:

• Service CSAs, their designees, or DoD Component Senior Intelligence Officials "validate the need for a SCIF and … grant concept approval."
• An SCI-indoctrinated SSM is designated by the component SSO for each project and develops the CSP.
• The accreditation package: final FFC, IDS specification sheets, UL 2050 certificate, NIST 128-bit certificate for IDS, IDS test results, SAP co-utilization agreement, TSCM reports if applicable, and a catastrophic failure plan.
• The SSO reports all changes affecting a SCIF's security posture to DAC within 24 hours.
• Re-accreditation is required for perimeter changes, storage-mode changes, and changes from continuous operation.
• Waivers are "normally granted for a period of up to 1 year or until such time as the waiver is no longer needed."

Sources DoDM 5105.21 Vol. 1 · DoDM 5105.21 Vol. 2 · DoDM 5105.21 Vol. 3 · UFC 4-010-05 (2023) · CDSE SCI101 Student Guide

Current: DoDM 5205.07, Special Access Program Security Manual, effective 17 January 2025, a single consolidated manual (OPR: OUSD(I&S); cleared for public release).

What it cancels. It "incorporates and cancels" Vol. 1 (General Procedures, 18 Jun 2015), Vol. 2 (Personnel Vetting, 24 Nov 2015) and Vol. 3 (Physical Security, 23 Apr 2015). It also incorporates the USD(I&S) memo "SAP Discussion in Accredited SCIFs" (21 Nov 2023). Vol. 4 (Marking) is still posted separately.

Where physical security lives now. Section 15, Physical Security Procedures, with subsections including SAP discussion, handling and processing in an accredited SCIF; risk management; preconstruction review and approval; construction procedures; co-use and co-accreditation; and TEMPEST requirements.

Who accredits. "The CA SAPCO, or their designee in writing, will appoint in writing an individual to serve as SAPF-AO." The SAPF-AO "is responsible for reviewing and approving or disapproving physical security preconstruction plans for, and physically inspecting and accrediting, reaccrediting, and de-accrediting, a SAPF."

How SAPFs use the Tech Spec. The cancelled Vol. 3 said SAPFs, T-SAPFs, SAPCAs, SAPWAs and SAPTSWAs "will conform to the equivalent" SCIF, T-SCIF, CA, SWA and TSWA criteria in the Tech Spec. DCSA's January 2026 SAP compliance checklist cites Tech Spec Chapter 7 paragraphs throughout for SAPF IDS.

Sources DoDM 5205.07 (2025) · DoDM 5205.07 Vol. 3 (cancelled; mirror) · DoDM 5205.07 Vol. 4 · DCSA SAP Compliance Checklist (Jan 2026) · UFC 4-010-05 (2023) · CDSE SA501 Student Guide

32 CFR Part 117, the NISPOM rule, governs cleared contractors' protection of collateral classified information. It replaced DoD 5220.22-M on 24 Feb 2021. 32 CFR Part 2001 is the ISOO implementing directive that sets storage and supplemental controls.

Sources 32 CFR Part 117 · 32 CFR 117.3 · 32 CFR 117.15 · 32 CFR 117.23 · 32 CFR 2001.43 · 32 CFR 2001.53 · DCSA Form 147 Guide

The Defense Counterintelligence and Security Agency (DCSA) is central to cleared industry, which is why project teams often assume it accredits SCIFs. It does not.

Scheduled change. DoDM 5205.07 (2025) §2.3 states that DCSA's SAP industrial-security compliance oversight responsibility "No later than July 31, 2029 … will transfer to the CA responsible for the program."

Sources DoDM 5205.07 (2025) · DoDM 5105.21 Vol. 1 · DCSA NISP Oversight · DCSA Form 147 Guide · CDSE SA501 Student Guide

ICS 705-1 says CSAs "oversee construction and accreditation programs and ensure timely data input to the IC SCIF repository." Who fills that role depends on who sponsors the SCI.

Co-use coordination in DoD. DoD Component CSAs coordinate Co-Use Agreements with other DoD agencies, with a courtesy copy to DIA's accreditation office, which coordinates agreements involving NRO, NGA and NSA (DoDM 5105.21 Vol. 2).

Sources ICS 705-1 · DoDM 5105.21 Vol. 1 · DoDM 5105.21 Vol. 2 · 12 FAM 710 · ICD 705 · UFC 4-010-05 (2023)

Title: Sensitive Compartmented Information Facilities (SCIF) / Special Access Program Facilities (SAPF) Planning, Design, and Construction. Dated 26 May 2023, superseding the 2013 edition with Change 1.

What it contributes:

Relationship to the Tech Spec. UFC 4-010-05 implements, and does not override, the Tech Spec. UFC 3-4.1 requires Tech Spec details to be made to comply with the building code, and 1-9 invokes UFC 1-200-01, which brings in NFPA 101.

Sources UFC 4-010-05 (NAVFAC mirror) · UFC 4-010-05 (WBDG) · IC Tech Spec v1.5.1

Reciprocity is the principle that a SCIF accredited by one IC element, with no waivers, is accepted as accredited by all IC elements (ICS 705-2). It is why ICD 705 insists on uniform standards: a compliant SCIF is an asset any agency can use through a Co-Use Agreement.

Waivers are the formal exception. ICS 705-1 limits them to "exceptional circumstances (i.e., only when the standards cannot be met or mitigated), or when there is a documented risk-based mission need to exceed the standards."

Package contents (ICS 705-1): the standard affected; mitigations considered; justification; residual risk assessment; procedures to reduce risk; timeline for compliance; and a statement accepting loss of mandatory reciprocal use.

See: Accreditation Lifecycle for how waivers fit into the package.

Sources ICD 705 · ICS 705-1 · ICS 705-2 · IC Tech Spec v1.5.1 · DoDM 5105.21 Vol. 2