Ducts, pipes, conduit and sprinklers through the SCIF perimeter; single-point entry, grounding, egress, fire alarm, power, HVAC and low-voltage wiring rules.
Every duct, pipe, conduit, cable and sleeve that crosses the perimeter is a potential path for sound, for forced entry, for covert access and, in some cases, for compromising emanations. The Tech Spec's approach is to have as few as possible and to treat every one.
Rule
Source and wording
Minimize
"All penetrations of perimeter walls shall be kept to a minimum." (Tech Spec 3.G.1)
Metallic penetrations
"may require TEMPEST countermeasures, to include dielectric breaks or grounding, when recommended by the CTTA." (3.G.2)
No pass-through utilities
"Utilities servicing areas other than the SCIF shall not transit the SCIF unless mitigated with AO approval." (3.G.3)
Single point of entry
"Electrical Utilities should enter the SCIF at a single point." (3.G.4) UFC 4-010-05 §3-4.11.1: "Utilities (power and signal) should enter at a single point."
Interior distribution
Surface mounted, in a raceway, or behind an additional wall on acoustically or RF-treated perimeter walls (3.G.5)
Spare conduit
Permissible "provided the expansion conduit is filled with acoustic fill and capped." (3.G.6)
Sealing
"Seal both sides of perimeter penetrations with an acoustical foam or sealant finished to match adjacent wall, floor, or ceiling"; firestop systems may be required in rated assemblies (UFC 3-4.11.3)
Cabling entry
"Cabling must enter the protected area from a single location"; cabling, patch panels, outlets and connectors color-coded by classification (UFC 3-4.19)
Floors and ceilings
"All floor and ceiling penetrations shall be kept to a minimum." (Tech Spec 3.D)
UFC 4-010-05 explains the TEMPEST concern: "All metallic perimeter penetrations present compromising emanations (CE) and pose TEMPEST hazards that must be addressed" through the TEMPEST Countermeasures Review.
Ducts are the largest openings in most SCIF perimeters. Tech Spec §3.G.7 sets a size threshold above which a duct must be physically barred.
The rule.
"All vents or duct openings that penetrate the perimeter walls of a SCIF and exceed 96 square inches shall be protected with permanently affixed bars or grills."
"If one dimension of the penetration measures less than six inches, bars or grills are not required."
UFC 4-010-05 gives the metric equivalents: 96 sq in = 619 cm²; 6 in = 150 mm.
Every duct, regardless of size, must also meet two other requirements:
"All vents and ducts shall be protected to meet the acoustic requirements of the SCIF."
"Walls surrounding duct penetrations shall be finished to eliminate any opening between the duct and the wall."
Worked examples (derived from the rule).
Duct opening
Area
Smallest dimension
Bars or grilles required?
12 in. x 10 in.
120 sq in
10 in.
Yes: exceeds 96 sq in and no dimension under 6 in.
24 in. x 5 in.
120 sq in
5 in.
No: one dimension is under 6 in.
8 in. x 8 in.
64 sq in
8 in.
No: does not exceed 96 sq in
12 in. x 8 in.
96 sq in
8 in.
No: equals but does not exceed 96 sq in
Size exemptions only remove the bars. They never remove the acoustic treatment or the finish around the duct.
When a duct penetration meets the size trigger, Tech Spec §3.G.7 allows bars, one of several grille options, or permanently installed metal baffles.
Protection
Tech Spec / UFC specification
Man-bars
"minimum of 1/2 inch diameter steel, welded vertically and horizontally six inches on center; a deviation of 1/2 inch in vertical and/or horizontal spacing is permissible" (Tech Spec 3.G.7; UFC 3-4.12)
"expanded metal diamond mesh, 1-1/2" #10" (tamperproof)
Welded wire fabric
"welded wire fabric (WWF) 4x4 W2.9xW2.9 (6 gauge smooth steel wire welded vertically and horizontally four inches o.c.)"
Metal baffles in lieu of bars
Bars are not required when "metal sound baffles or wave forms are permanently installed and set no farther apart than six inches"
Coordination points.
Airflow: bars, mesh and baffles all add resistance. Coordinate the selection with the mechanical engineer. UFC 4-010-05 warns that baffle "backpressures … may significantly impact the HVAC system design."
Permanence: bars and grilles must be "permanently affixed." An assembly that can be unbolted or unclipped from the uncontrolled side is unlikely to satisfy an inspector.
Acoustics: bars do nothing for sound. The same duct still needs silencers, a Z-duct, or other acoustic treatment.
TEMPEST: where the CTTA directs, the duct may also need a nonconductive break inside the perimeter.
Bars and baffles hidden inside ductwork must be inspectable. Otherwise nobody can confirm they are still there.
Access port requirements.
Option
Requirement
Inside the perimeter (preferred)
"an access port shall be installed inside the secure perimeter of the SCIF to allow visual inspection of the bars, grilles, or metal baffles/wave forms" (Tech Spec 3.G.7)
Outside the perimeter
The port "may be installed outside the perimeter of the SCIF and be secured with an AO-approved high-security lock" (Tech Spec 3.G.7)
DoD detail
Access panel "in the bottom within the perimeter" (UFC 4-010-05 §3-4.14)
Design implications:
The access port must be reachable. A port above a hard ceiling or behind a duct silencer is not practically inspectable.
Coordinate ceiling tiles or access panels below each port.
If the port is outside the perimeter, the lock must be AO-approved and high-security, and the lock becomes part of the SCIF's security checks.
Is IDS required on ducts?
The Tech Spec requires bars, grilles or metal baffles for qualifying penetrations. It does not list IDS as a substitute (Tech Spec 3.G.7).
UFC 4-010-05 §3-4.17.3 says motion sensors are not normally required above false ceilings or below false floors in the U.S.
Pipes and conduit are smaller than ducts but far more numerous, and most are metal. The physical rules are simple (minimize, seal, finish). The TEMPEST rules apply only when the CTTA's review calls for countermeasures.
DoD treatment when TEMPEST countermeasures apply (UFC 4-010-05 §3-4.11.2).
Penetration
Treatment
Metal conduit
"a nonconductive union inside the perimeter adjacent to the penetration, or ground the conduit within 6 inch (150 mm) of the perimeter penetration using a no. 4 wire"
Metallic sprinkler (fire suppression) pipe
"ground the pipe within 6 inch (150 mm) of the perimeter penetration using a no. 4 wire (0.2043-diameter copper wire) to the building grounding system"
Refrigerant lines
Grounded within 6 in. of the penetration with No. 4 wire to building ground
HVAC duct
Nonconductive flexible connection on a short section of duct inside the perimeter, adjacent to the penetration
Sprinkler and plumbing mains.
A fire-suppression line that serves the SCIF may enter it.
A main that feeds other tenant areas should not run through the SCIF (Tech Spec 3.G.3) unless mitigated with AO approval.
The same logic applies to domestic water, drain and gas lines serving other spaces.
Fiber vs. copper (practitioner).
Non-conductive fiber optic cable does not create a conductive path across the perimeter, and integrators and TEMPEST designers widely prefer it for signal entry. Metallic cables are subject to CTTA countermeasures. UFC 4-010-05 §3-4.20 adds: "Avoid the use of PDS whenever possible."
A dielectric break is a short, listed non-metallic section that interrupts a metal pipe, conduit, duct or cable tray. Examples are a dielectric union, an insulating flange kit, or a non-conductive duct connector.
Why they exist.
A continuous metal path through the perimeter can carry signals out of the SCIF. Tech Spec §3.G.2 lists "dielectric breaks or grounding" as TEMPEST countermeasures that apply "when recommended by the CTTA." They are not automatic.
Where they go.
Item
Public guidance
Metal conduit
Nonconductive union inside the perimeter, adjacent to the penetration, or grounding instead (UFC 3-4.11.2)
HVAC duct
Nonconductive flex connection on a short section of duct inside the perimeter, adjacent to the penetration (UFC 3-4.11.2)
Sprinkler pipe and refrigerant lines
UFC specifies grounding rather than a break
Any metallic penetration
Whatever the CTTA's TEMPEST Countermeasures Review specifies (Tech Spec 3.G.2)
Break vs. bond.
At an unshielded SCIF perimeter, a dielectric break interrupts the metal path. At an RF-shielded enclosure the logic reverses: metal penetrations are bonded to the shield, and openings are engineered as waveguides. Follow the shield designer and the CTTA.
The single point of entry is one of the most useful design principles in the Tech Spec. It limits penetrations, simplifies TEMPEST treatment, and gives inspectors one place to look.
The requirements.
Tech Spec 3.G.4: "Electrical Utilities should enter the SCIF at a single point."
UFC 4-010-05 §3-4.11.1: "Utilities (power and signal) should enter at a single point. Seal all utility penetrations to mitigate acoustic emanations and covert entry."
UFC 4-010-05 §3-4.19: "Cabling must enter the protected area from a single location," with cabling, patch panels, outlets and connectors color-coded by classification.
Tech Spec 3.G.6: spare conduit for future expansion is permissible "provided the expansion conduit is filled with acoustic fill and capped."
How to plan it.
List every system that will cross the boundary: power, lighting, fire alarm, sprinkler, HVAC and building automation controls, plumbing, IDS, access control, cameras at entrances, public address, telephone, data and fiber.
Group power and signal entries at one location on the perimeter, usually near the telecom room or electrical panel serving the SCIF.
Size spare sleeves for future growth at that same location, then fill and cap them.
Show the entry point on the Fixed Facility Checklist floor plan and in the penetration schedule.
On RF-shielded rooms, practitioners group filters, waveguides and signal entries on a single penetration panel for the same reasons: simpler bonding, inspection and testing.
Grounding is the other TEMPEST countermeasure named in Tech Spec §3.G.2. Like dielectric breaks, it is applied when the CTTA recommends it.
DoD grounding details (UFC 4-010-05 §3-4.11.2).
Penetration
Grounding detail
Metal conduit (alternative to a nonconductive union)
Ground within 6 in. (150 mm) of the perimeter penetration using a No. 4 wire
Metallic sprinkler pipe
Ground within 6 in. (150 mm) of the penetration using No. 4 copper wire to the building grounding system
Refrigerant lines
Ground within 6 in. of the penetration with No. 4 wire to building ground
What the build team should know.
The CTTA decides. Do not add grounding or breaks without a TEMPEST Countermeasures Review recommendation, and do not skip them when the review calls for them.
Grounding is to the building grounding system. A bond to a nearby piece of metal that is not part of the grounding system does not meet the detail.
Redundant utilities must be "two separate utilities that are not routed together" (UFC 3-4.21.1). That affects how grounding and entry points are laid out for redundant feeds.
Shielded enclosures have their own grounding and bonding design, which differs from penetration grounding at an unshielded perimeter.
Inspectability: leave ground connections accessible and labeled where possible, and photograph them before ceilings close.
A SCIF must satisfy two authorities that do not report to each other. The AO approves security. The Authority Having Jurisdiction (AHJ), usually the fire marshal and building official, approves life safety. Neither can waive the other's requirements.
What the documents say.
Tech Spec 3.E.5: every perimeter door must "comply with applicable building code, safety, accessibility standards" as determined by the AHJ. Secondary and emergency egress doors are established per building code, safety and accessibility with AO approval (3.E.3–3.E.4).
UFC 4-010-05 §1-9: comply with UFC 1-200-01 (the DoD building code), which brings in NFPA 101.
UFC 4-010-05 §3-4.1: details taken from the Tech Spec must be made to comply with the building code.
UFC 4-010-05 §3-3.3.2: "Egress paths from the lower security areas must not pass through a higher security area." Communicating stairs between secure areas need access control at each level "without compromising safe egress to grade."
FF-L-2890C: SCIF door hardware is engineered for IBC, NFPA 80, NFPA 101, ADA/UFAS and fire-door listings.
Practitioner points.
An industry hardware source describes FF-L-2890B (2012) as the change that required lock extensions on normally occupied rooms to meet the model codes: free egress with one hand, with "no key, tool, special knowledge or effort."
A SCIF door hardware practitioner notes that life-safety requirements apply to doors in the means of egress regardless of a SCIF's grandfathered status.
Getting people out quickly and keeping intruders out are reconciled at the door hardware. The FF-L-2890C device types were written with that conflict in mind.
Topic
Guidance
Source
Egress-only doors
FF-L-2890 exit-only device; no exterior hardware; alarmed 24/7 with a local audible annunciator
Tech Spec 3.E.4; UFC 3-4.6.10
Delayed egress
"Delayed-egress is recommended with NFPA 101 compliance." Only allowed where the AHJ and code permit it
UFC 3-4.6.10
Panic hardware
FF-L-2890C Types III, IV, VIII and X have fire-rated panic hardware; use where occupancy or occupant load requires panic hardware
FF-L-2890C
Electric strikes
Must be UL 1034 listed; DoD requires positive engagement and fail-secure. Free egress stays mechanical from inside through the FF-L-2890 lever or panic device
FF-L-2890C; UFC 3-4.6.5
Fire-rated openings
Acoustic door assemblies on rated corridors must also carry the fire label
UFC 3-4.11.3 context; practitioner
Life safety types
Per the DoD Lock Program, Types I–IV and VII–X meet life safety requirements; Types V and VI are for rooms not regularly occupied
DoD Lock Program
How the pieces fit.
Occupants inside always leave with one motion on a lever or panic bar. That is mechanical and does not depend on power.
The combination-lock deadbolt on the primary door is thrown only when the SCIF is empty and locked for the night.
An emergency exit has nothing on the outside, sounds a local alarm when opened, and reports to the IDS 24/7.
Delayed egress, where the AHJ allows it, gives staff a short window to respond before the door releases. Its conditions (such as sprinkler and fire alarm release requirements and signage) come from the code, not from the Tech Spec.
Accessibility requirements apply to SCIFs like any other occupied space. DoD design criteria reference the Architectural Barriers Act (ABA), and FF-L-2890C hardware is written to ADA and UFAS operating requirements. The AHJ confirms which accessibility standard governs the project.
Where accessibility meets SCIF hardware.
Element
Requirement or issue
Source
Pedestrian door hardware
FF-L-2890C devices are one-hand operable and "should not require tight grasping, tight pinching, or twisting of the wrist"
FF-L-2890C
Hardware mounting height
An industry hardware source notes FF-L-2890 hardware mounted 34 in. to 48 in. above finished floor
Practitioner (I Dig Hardware)
Vault doors
Specify a "GSA-approved Class 5 vault door equipped to meet Architectural Barriers Act (ABA) Standards"
UFC 4-010-05 §3-4.6.11
RF-shielded doors
UFC Figure 3-16 labels an "ABA Non-Compliant RF Door"; raised thresholds on shielded doors can conflict with accessibility and must be resolved in design
UFC 4-010-05
Access control devices
Card readers and keypads must be reachable and usable
ADA Standards
Design questions to settle early.
Does every accessible route into the SCIF pass through a door with compliant hardware and threshold?
Do acoustic door drop seals and thresholds meet threshold height limits?
Does the vestibule provide the maneuvering clearance needed on both sides of both doors?
Can a person using a wheelchair operate the combination lock dial and the lock extension?
Fire alarm and emergency notification appliances are required for life safety, and they end up inside the SCIF. They also create audio and conductive paths across the perimeter, so they need deliberate design.
What the public documents establish.
Fixed Facility Checklist, Acoustics section: public address, music or emergency notification systems must use "fiber isolation, self-amplified speakers, other method to ensure no audio back feed from the system." Systems originating outside the SCIF need special design and approval.
Tech Spec Chapter 11 includes a section titled "Emergency Notification Systems" (11.G).
Tech Spec 7.A.2.h: "IDS's shall be separate from, and independent of, fire, smoke, radon, water, and other systems." A fire panel and the SCIF intrusion panel must not be the same system.
UFC 4-010-05 §3-4.4.8: recessed fire extinguisher cabinets are prohibited on perimeter walls. Use surface-mounted cabinets.
UFC 4-010-05 §3-3.3.2: "Utilities and general building support spaces should remain outside of the secure areas."
Why speakers are a concern.
A speaker is a transducer. It can act as a microphone, and the wire pair back to the building panel is an audio path out of the SCIF. That is why the checklist asks about audio back feed.
Power design for a SCIF has two separate questions: what the facility needs to keep operating, and what the intrusion detection system needs to stay armed.
Topic
Requirement or guidance
Source
Electrical entry
Single point of entry
Tech Spec 3.G.4; UFC 3-4.11.1
Facility standby power
When a standby power system is required, "provide a standby engine-driven generator sized for essential and uninterruptible loads"
UFC 2-10.2.1
UPS
"provide UPS for the uninterruptible loads to filter commercial power"
UFC 2-10.2.2
IDS backup power
"Twenty-four hours of uninterruptible backup power is required and shall be provided by batteries, an uninterruptible power supply (UPS), generators, or any combination"
Tech Spec 7.B.5
IDS with generator (DoD)
"When an engine-generator is available for standby power, provide batteries for IDS that provide a minimum of four hours"
UFC 3-4.17.3.7
Power transfer
On primary power failure, the IDS transfers automatically to emergency power without causing an alarm; power source changes are indicated locally and at the monitoring station
Tech Spec 7.B.5, 7.A.3.b(8)
Redundancy
Redundant utilities "must be two separate utilities that are not routed together"
UFC 3-4.21.1
Power line filtering
Applied when recommended by the CTTA
Tech Spec 3.G.2 context
Battery sizing for IDS.
Required capacity is the total standby current of everything that must stay up for an alarm to reach the monitoring station, multiplied by 24 hours, plus alarm-state load, then derated per the manufacturer. That includes the premise control unit, sensors, keypads, communicators, encryption modules and any network equipment in the signal path. Document the calculation for the Fixed Facility Checklist, which records generator hours and battery hours separately.
Mechanical systems cause more perimeter penetrations, acoustic problems and schedule surprises than any other trade. Most of the issues are settled by where equipment sits and how ducts cross the wall.
Location.
"Utilities and general building support spaces should remain outside of the secure areas" (UFC 4-010-05 §3-3.3.2). Air handlers, mechanical rooms and electrical rooms normally sit outside the SCIF, which keeps maintenance workers out of the secure space.
Ducts at the perimeter.
Issue
Requirement
Size trigger for bars
Over 96 sq in and no dimension under 6 in. (Tech Spec 3.G.7)
Inspection
Access port inside the perimeter, or outside with an AO-approved high-security lock
Acoustics
"Provide sound baffles (duct silencers) or (Z) Duct Penetrations"; "In lieu of acoustical duct liner, provide double wall acoustic duct" (UFC 3-4.13)
Space
"Acoustic Z-Ducts can increase the above ceiling space requirement" (UFC 3-4.2)
System impact
Baffle "backpressures … may significantly impact the HVAC system design" (UFC 3-4.13)
TEMPEST
Nonconductive flex connection inside the perimeter when the CTTA directs (UFC 3-4.11.2)
Returns.
Ducted returns with acoustic treatment are preferable to open-plenum returns that cross the perimeter. That practitioner preference follows from the rule that "all vents and ducts shall be protected to meet the acoustic requirements."
Telecom rooms.
"Design air-conditioning systems for year-round cooling with very high cooling intensity"; high-powered computer room air conditioners need at least a 10 ft x 3 ft footprint (UFC 3-4.18.2).
The standard 10 ft x 8 ft telecom room "may be inadequate if the TR contains equipment racks for multiple networks" (UFC 2-9).
Controls.
Automated environmental infrastructure systems (building automation and HVAC controls) are declared on the Fixed Facility Checklist, with countermeasures against "malicious activity, intrusion, and exploitation."
Low-voltage systems are where integrators most often create perimeter findings. The rules below are the ones that decide cable routing and panel location.
Topic
Requirement
Source
IDS standard
Installation, components and monitoring stations comply with UL 2050, Extent 3 installation
Tech Spec 7.A.2.a–b; UFC 3-4.17.3.1
Who installs IDS
U.S. companies using U.S. citizens
UFC 1-18.1
IDS cabling
Between sensors and the premise control unit (PCU): dedicated to the system, contained within the SCIF, and compliant with electrical codes and CNSS standards
Tech Spec 7.A.3.b(3); UFC 3-4.17.3.4
Cabling outside the perimeter
Encrypted line security, or ferrous conduit (EMT or rigid) with permanently sealed joints (no set screws); service and junction boxes secured with GSA-approved locks
Tech Spec 7.A.2.e
PCU location
"PCUs shall be located within a SCIF and only SCIF personnel may initiate changes in access modes"
Tech Spec 7.A.3.b(1); UFC 3-4.17.3.5
Door contacts
UL 634 High Security Switch, Level II
Tech Spec 7.A.2.d; UFC 3-4.17.3.3
IDS independence
Separate from fire, smoke, radon, water and other systems
Tech Spec 7.A.2.h
IDS backup power
24 hours; minimum 4 hours of batteries when a generator is part of the solution (DoD)
Tech Spec 7.B.5; UFC 3-4.17.3.7
ACS head end
Equipment holding access control software within the SCIF or a SECRET-controlled area
FFC access control section; UFC
ACS lines leaving protection
FIPS-validated encryption
FFC access control section; UFC
Cable entry
Single location; color-coded by classification
UFC 3-4.19
Telecom room
"Locate telecommunication spaces that contain the encryption equipment within or adjacent (shared wall) to the secure area to enhance security and minimize or eliminate Protected Distribution System (PDS) requirements"
UFC 3-3.3.2
PDS
Per CNSSI 7003 when unencrypted national security information passes through lesser areas; "Avoid the use of PDS whenever possible"
