Correction, August 17, 2026 — we withdraw the “2025 ICD 705 overhaul” claim entirely. From June 2026 until today this article opened by describing a 2025 overhaul of the SCIF/SAPF construction standard, called it the first major update since 2010, and stated that it raised minimum RF attenuation to “typically 60 dB, structurally integrated.” None of that is supportable and we should not have published it.
Checked against the primary documents: ICD 705 is dated May 26, 2010, with one technical amendment. Its implementing IC Technical Specifications, maintained by ODNI’s National Counterintelligence and Security Center, are at version 1.5.1, dated July 26, 2021, and that document’s own change history records revisions at 1.2 (2012), 1.3 (2015), 1.4 (2017), 1.5 (2019) and 1.5.1 (2021). We can find no primary evidence of a revision after 1.5.1 — so there was no 2025 overhaul to report, and even if there had been, it could not have been the first since 2010.
The RF figure is worse than unsupported; it is wrong in kind. The IC Tech Specs contain no decibel figure at all, and RF protection is not a baseline requirement. Version 1.5.1, Chapter 3, Section C, item 4: “RF protection shall be installed at the direction of the CTTA when a SCIF utilizes electronic processing and does not provide adequate RF attenuation at the inspectable space boundary.” The call belongs to the Certified TEMPEST Technical Authority, per facility. The only numeric attenuation ratings in the document are acoustic Sound Group ratings (STC 45, STC 50) — a different physical quantity, and the likely source of the confusion.
We are leaving this correction in place rather than deleting the paragraph, because the wrong version was live for two months and a specific number is exactly the kind of thing that gets quoted onward. Two per-square-foot construction figures and a 36-month accreditation estimate went with it: both were sourced to unattributed “practitioner commentary” and neither survives the same test, so they are cut rather than re-guessed. The sequencing guidance in the body below does not depend on any of it and stands unchanged. What does change: do not budget an RF treatment, or size a renovation, against a decibel figure from any source that is not your CTTA and your Accrediting Official. Confirm the governing Tech Spec revision with the AO at project initiation. Our Q2 2026 compliance landscape briefing carries the same correction alongside the rest of the quarter’s changes.
Building and accrediting a Sensitive Compartmented Information Facility or Special Access Program Facility is a program, not a project. The facility has to be designed, constructed, inspected, and operationally accredited, and those four steps touch different stakeholders on different timelines, with handoffs that routinely slip by months. Organizations building their first SCIF or SAPF underestimate how much of the work happens before the first drywall goes up, and how much of the post-construction phase is dictated by the sponsor’s availability rather than the contractor’s schedule.
This playbook is for the organization approaching its first SCIF or SAPF build: typically a defense contractor or program office supporting a specific program, typically under an accelerated delivery timeline, typically without dedicated in-house facility-engineering experience. The intent is to sketch the full arc so the early decisions, the ones that are cheap to change now and expensive to change later, are informed.
What distinguishes a SCIF from a SAPF
A SCIF is a facility accredited for processing, storing, and discussing Sensitive Compartmented Information (SCI), intelligence data derived from sensitive sources and methods. The accrediting authority is typically an Intelligence Community element; the operational doctrine is ICD 705 (Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities).
A SAPF is a facility accredited for Special Access Program (SAP) data, a separate compartmentation regime used by DoD for particularly sensitive programs. SAP doctrine is articulated in DoD Manual 5205.07 and associated policy. SAPFs often share construction standards with SCIFs (ICD 705 is the benchmark) but the program office and accrediting authority are different. A facility can be dual-accredited as both a SCIF and SAPF; the access controls and compartmentation procedures differ by program.
For a practitioner, the relevant distinction is who approves the accreditation and which program’s Security Officer is the counterpart. Design specifications are largely common.
Framework stack — what standards apply
A SCIF or SAPF accreditation draws from several overlapping standards. Understanding which one dictates which requirement saves time during documentation drafting.
- ICD 705 — the primary physical and technical construction standard. Specifies wall construction, intrusion detection, acoustic attenuation, emanation protection, and alarm response timing.
- IC Tech Specs for ICD 705 — detailed technical specifications implementing ICD 705. This is where wall types, door specifications, TEMPEST requirements, and cabling rules live.
- CNSSI 1253 — Committee on National Security Systems Instruction, the security categorization and control baseline for National Security Systems. A SCIF’s information systems are categorized and controlled per CNSSI 1253 (which extends NIST 800-53 with NSS-specific overlays).
- NISPOM — National Industrial Security Program Operating Manual. Governs how contractors handle classified information and operate classified facilities. For a contractor-owned SAPF, NISPOM compliance is table stakes.
- RMF (NIST 800-37) — Risk Management Framework. The process by which information systems within the SCIF achieve Authority to Operate (ATO).
- Program-specific directives — many programs have their own supplemental security requirements that layer on top. Treat each new program as a potential additional layer of requirements.
The documentation package submitted to the accrediting authority maps design decisions against these standards. A practical tip: start the crosswalk document during design, not after construction. Reviewers appreciate explicit mappings, and gaps are easier to close at the design stage.
Phase 1: sponsor coordination and requirements (8-16 weeks)
The relationship to establish first is with the Cognizant Security Authority (CSA) — the government element with authority over accreditation for your program — and with the Program Security Officer. Everything downstream, including which standards you are judged against and who signs the accreditation, follows from that.
The single most common point of failure in first-time builds is attempting to proceed with construction before the sponsor is fully aligned on requirements. “Sponsor” here means the customer program office or Intelligence Community element that will eventually accredit the facility. Their Security Officer, referred to as a Special Security Officer (SSO) for SCIFs or Program Security Officer (PSO) for SAPs, is the counterpart your facility team coordinates with.
Before design begins, a set of questions needs clear sponsor-approved answers:
- What is the accrediting authority? Who is the specific SSO or PSO? What is their availability for consultation and reviews?
- What classification levels and compartments will the facility support? A facility designed for Top Secret with one compartment costs and documents differently than one supporting three overlapping compartments.
- What is the operational mission? Discussion-only? Processing? Storage? Each implies different construction and IT requirements.
- How many personnel will be cleared to work in the facility at peak capacity? Personnel counts drive square footage, alarm and access control design, and per-person hygiene plans.
- Are government-furnished equipment (GFE) components expected? If so, when and by what procurement path?
- What networks must the facility support? JWICS, SIPRNet, program-specific networks? Each imposes its own physical and logical separation requirements.
Documentation at this stage: a Concept of Operations (CONOPS) document, a draft Facility Fixed Security Plan (FFSP, the ICD 705 equivalent of a facility security plan), and a confirmed sponsor-signoff on CONOPS before design starts. Without sponsor signoff on CONOPS, design is speculative.
Phase 2: design and engineering (12-20 weeks)
With CONOPS approved, design begins. For a SCIF or SAPF, this is not typical commercial facility design. Three specialist disciplines overlap:
- Architectural/construction — walls, doors, acoustic treatment, mechanical and electrical penetrations. Standard construction firms usually do not have SCIF experience; specialized SCIF construction contractors or architecture firms with ICD 705 track records are the right choice.
- Classified network engineering — the IT infrastructure inside the facility. Multi-network configurations (JWICS, SIPRNet, program networks) require physical separation, cable management, and rack layouts that reflect accreditation requirements. Separate networks mean separate racks, separate cable pathways, often separate power circuits and ground planes.
- Emanation and TEMPEST — electromagnetic emanation security, if applicable. Required for certain classifications and operational modes. TEMPEST planning influences cable shielding, power distribution, filtered power supplies, and sometimes room shielding. A TEMPEST plan is a separate document requiring its own sponsor review.
The design phase produces: architectural drawings, network architecture diagrams, cabling plans, rack elevations, alarm and access control design, and draft security plans including the FFSP and Information System Security Plan (ISSP). These documents are the core of the accreditation package.
Two recurring sponsor-coordination touch points during design: a pre-construction review (often called a “DD Form 254 review” or equivalent program-specific review) where the sponsor signs off on the design before construction begins, and ongoing TEMPEST and emanation coordination where TEMPEST-related decisions require explicit sponsor approval.
Phase 3: construction (16-28 weeks, variable)
Construction timelines are driven by facility size, build-out complexity, and contractor availability. The build phase is also when long-lead procurement items become timing-critical: GSA-approved safes, specialized security doors, IDS/ACS systems, and anything requiring GFE approval.
Three construction-phase pitfalls to plan around:
Long-lead items. Approved doors, specialized IDS panels, GSA-approved containers, and network hardware often have 12-20 week lead times. Procure early; waiting for final design to order long-lead items is the most common schedule slip.
Sequencing of TEMPEST and inspection milestones. Certain TEMPEST-related work (shielded conduit, filtered power outlets, room shielding if required) cannot be easily remediated after drywall closes. If the TEMPEST plan is still being finalized when construction begins, construction will need to pause pending plan approval. Better: approve the TEMPEST plan before walls close.
Sponsor site visits. The accrediting authority will physically inspect the facility before accreditation. These inspections are scheduled at specific points — typically a pre-inspection during construction and a final accreditation inspection after substantial completion. Sponsor travel schedules constrain these dates. Build the construction schedule around sponsor availability, not vice versa.
Phase 4: system accreditation and operational readiness (6-12 weeks)
With construction substantially complete, the focus shifts from the facility itself to the information systems inside it. This is the RMF-driven ATO phase for each network enclave.
Typical work in this phase:
- System Security Plan (SSP) finalization per network enclave: JWICS SSP, SIPRNet SSP, program network SSP. Each is a document referenced to NIST 800-53 / CNSSI 1253 controls and tailored to the specific system scope.
- Security Assessment Plan (SAP), not the Special Access Program: this is the NIST 800-53A test plan for each system.
- Security Assessment Report (SAR) — documents the assessment findings.
- POA&M for any residual findings with associated remediation plans.
- Authorization package submission to the Authorizing Official (AO).
- AO review, typically iterative with clarifications and additional documentation.
- ATO issuance — Authority to Operate.
The facility-side paperwork runs in parallel and is a distinct artifact set from the system ATOs above: the Fixed Facility Checklist (FFC), the Construction Security Checklist (CSC), and the TEMPEST test report. Pre-coordinate the FFC during design rather than assembling it at the end — it is the document the accrediting authority reads first, and it references decisions made months earlier.
Simultaneously, the facility itself needs final physical accreditation under ICD 705: an inspection by the SSO or designee confirming the facility meets specifications, alarm and access control systems are tested, and the FFSP is signed. A SCIF accreditation letter from the SSO, or SAPF approval from the PSO, completes the facility-side work.
Only after both the facility is accredited (SCIF/SAPF status granted) and the systems have ATOs does the facility become operationally usable. Attempts to operate prior to this (“we’re just testing”) are program violations.
Phase 5: ongoing accreditation maintenance
A SCIF or SAPF accreditation is not one-and-done. Re-accreditation cycles (typically every 3 years but program-dependent), continuous monitoring of systems under RMF, personnel access reviews, periodic TEMPEST re-evaluations, and physical recertifications all happen throughout the facility lifecycle. Building the operational cadence for ongoing accreditation during initial build-out is easier than retrofitting it after accreditation is granted.
Where first-time builders lose six months
Five patterns we see repeatedly:
Unclear sponsor roles. When the sponsor SSO is ambiguous, or rotates mid-program, decisions sit waiting for approval. Lock the sponsor relationship early; confirm in writing who approves what.
Design starts before CONOPS is approved. Leads to rework mid-design. CONOPS approval is a real gate; treat it that way.
TEMPEST plan finalizes late. Causes construction pauses or expensive post-construction retrofits. Finalize TEMPEST concurrent with wall design, not after.
Long-lead items procured late. GSA-approved containers, security doors, IDS panels ordered at the last minute extend schedule. Procure on the design timeline, not the construction timeline.
System ATO work starts after facility accreditation. Leaves a gap between physical accreditation and operational use. Run the system ATO work in parallel with construction’s later phases.
The practical sequence
- Weeks 0-16: CONOPS development, sponsor coordination, initial design concepts, long-lead procurement initiated.
- Weeks 12-32: Detailed design, TEMPEST plan, pre-construction review, construction begins.
- Weeks 24-52: Construction proceeds, system SSPs drafted, pre-inspection by sponsor.
- Weeks 48-64: Construction completion, final inspection, facility accreditation, system ATOs issued.
- Week 64+: Operational use, ongoing maintenance.
Accelerated timelines compress these phases but cannot eliminate them. Sponsor review gates, physical construction time, and inspection availability are not controllable by the contractor.
When to engage outside support
Organizations building their first SCIF or SAPF almost universally benefit from specialized advisory support, particularly during Phases 1-2 where sponsor coordination and design decisions shape everything downstream. The facility-engineering expertise required is specialized and rarely in-house even at large contractors. Our advisory engagements typically span the first three phases and hand off to the client’s own security operations team for ongoing accreditation maintenance.
For programs approaching a facility build, the most consequential first conversation is often a scoping call that walks through CONOPS development, sponsor identification, and early design decisions, the ones that make everything else possible.
Our Classified Networks practice is built around this sequencing. If you are a venture-backed startup facing your first SCIF rather than a prime with an established accreditation pipeline, see the playbook for first-time SCIFs at startups: different constraints, different guidance.