Updated June 2026 — The 2025 ICD 705 overhaul — the first major update to the SCIF/SAPF construction standard since 2010 — raised minimum RF attenuation requirements (typically 60 dB, structurally integrated), tightened acoustic controls, and enhanced TEMPEST countermeasures. Most existing SCIFs are now architecturally non-compliant with the updated technical specifications. 2026 is the year accrediting authorities stop accepting “planning grace period” framing. AOs now demand earlier documentation and tighter alignment across design, construction, and accreditation phases. Practitioner commentary cites SCIF construction costs of $350-$1,000 per square foot and accreditation timelines up to 36 months for first-time projects. Most existing SCIFs need either significant renovation or new construction on a 4-5 year horizon. The sequencing guidance below remains correct; the construction budget and timeline assumptions need to be adjusted upward for the updated standard. Our Q2 2026 compliance landscape briefing has the full picture with June 5 mid-Q2 update.
Building and accrediting a Sensitive Compartmented Information Facility or Special Access Program Facility is a program, not a project. The facility has to be designed, constructed, inspected, and operationally accredited — and those four steps touch different stakeholders on different timelines, with handoffs that routinely slip by months. Organizations building their first SCIF or SAPF underestimate how much of the work happens before the first drywall goes up, and how much of the post-construction phase is dictated by the sponsor’s availability rather than the contractor’s schedule.
This playbook is for the organization approaching its first SCIF or SAPF build — typically a defense contractor or program office supporting a specific program, typically under an accelerated delivery timeline, typically without dedicated in-house facility-engineering experience. The intent is to sketch the full arc so the early decisions — the ones that are cheap to change now and expensive to change later — are informed.
What distinguishes a SCIF from a SAPF
A SCIF is a facility accredited for processing, storing, and discussing Sensitive Compartmented Information (SCI) — intelligence data derived from sensitive sources and methods. The accrediting authority is typically an Intelligence Community element; the operational doctrine is ICD 705 (Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities).
A SAPF is a facility accredited for Special Access Program (SAP) data — a separate compartmentation regime used by DoD for particularly sensitive programs. SAP doctrine is articulated in DoD Manual 5205.07 and associated policy. SAPFs often share construction standards with SCIFs (ICD 705 is the benchmark) but the program office and accrediting authority are different. A facility can be dual-accredited as both a SCIF and SAPF; the access controls and compartmentation procedures differ by program.
For a practitioner, the relevant distinction is who approves the accreditation and which program’s Security Officer is the counterpart. Design specifications are largely common.
Framework stack — what standards apply
A SCIF or SAPF accreditation draws from several overlapping standards. Understanding which one dictates which requirement saves time during documentation drafting.
- ICD 705 — the primary physical and technical construction standard. Specifies wall construction, intrusion detection, acoustic attenuation, emanation protection, and alarm response timing.
- IC Tech Specs for ICD 705 — detailed technical specifications implementing ICD 705. This is where wall types, door specifications, TEMPEST requirements, and cabling rules live.
- CNSSI 1253 — Committee on National Security Systems Instruction, the security categorization and control baseline for National Security Systems. A SCIF’s information systems are categorized and controlled per CNSSI 1253 (which extends NIST 800-53 with NSS-specific overlays).
- NISPOM — National Industrial Security Program Operating Manual. Governs how contractors handle classified information and operate classified facilities. For a contractor-owned SAPF, NISPOM compliance is table stakes.
- RMF (NIST 800-37) — Risk Management Framework. The process by which information systems within the SCIF achieve Authority to Operate (ATO).
- Program-specific directives — many programs have their own supplemental security requirements that layer on top. Treat each new program as a potential additional layer of requirements.
The documentation package submitted to the accrediting authority maps design decisions against these standards. A practical tip: start the crosswalk document during design, not after construction. Reviewers appreciate explicit mappings, and gaps are easier to close at the design stage.
Phase 1: sponsor coordination and requirements (8-16 weeks)
The single most common point of failure in first-time builds is attempting to proceed with construction before the sponsor is fully aligned on requirements. “Sponsor” here means the customer program office or Intelligence Community element that will eventually accredit the facility. Their Security Officer — referred to as a Special Security Officer (SSO) for SCIFs or Program Security Officer (PSO) for SAPs — is the counterpart your facility team coordinates with.
Before design begins, a set of questions needs clear sponsor-approved answers:
- What is the accrediting authority? Who is the specific SSO or PSO? What is their availability for consultation and reviews?
- What classification levels and compartments will the facility support? A facility designed for Top Secret with one compartment costs and documents differently than one supporting three overlapping compartments.
- What is the operational mission? Discussion-only? Processing? Storage? Each implies different construction and IT requirements.
- How many personnel will be cleared to work in the facility at peak capacity? Personnel counts drive square footage, alarm and access control design, and per-person hygiene plans.
- Are government-furnished equipment (GFE) components expected? If so, when and by what procurement path?
- What networks must the facility support? JWICS, SIPRNet, program-specific networks? Each imposes its own physical and logical separation requirements.
Documentation at this stage: a Concept of Operations (CONOPS) document, a draft Facility Fixed Security Plan (FFSP, the ICD 705 equivalent of a facility security plan), and a confirmed sponsor-signoff on CONOPS before design starts. Without sponsor signoff on CONOPS, design is speculative.
Phase 2: design and engineering (12-20 weeks)
With CONOPS approved, design begins. For a SCIF or SAPF, this is not typical commercial facility design. Three specialist disciplines overlap:
- Architectural/construction — walls, doors, acoustic treatment, mechanical and electrical penetrations. Standard construction firms usually do not have SCIF experience; specialized SCIF construction contractors or architecture firms with ICD 705 track records are the right choice.
- Classified network engineering — the IT infrastructure inside the facility. Multi-network configurations (JWICS, SIPRNet, program networks) require physical separation, cable management, and rack layouts that reflect accreditation requirements. Separate networks mean separate racks, separate cable pathways, often separate power circuits and ground planes.
- Emanation and TEMPEST — electromagnetic emanation security, if applicable. Required for certain classifications and operational modes. TEMPEST planning influences cable shielding, power distribution, filtered power supplies, and sometimes room shielding. A TEMPEST plan is a separate document requiring its own sponsor review.
The design phase produces: architectural drawings, network architecture diagrams, cabling plans, rack elevations, alarm and access control design, and draft security plans including the FFSP and Information System Security Plan (ISSP). These documents are the core of the accreditation package.
Two recurring sponsor-coordination touch points during design: a pre-construction review (often called a “DD Form 254 review” or equivalent program-specific review) where the sponsor signs off on the design before construction begins, and ongoing TEMPEST and emanation coordination where TEMPEST-related decisions require explicit sponsor approval.
Phase 3: construction (16-28 weeks, variable)
Construction timelines are driven by facility size, build-out complexity, and contractor availability. The build phase is also when long-lead procurement items become timing-critical — GSA-approved safes, specialized security doors, IDS/ACS systems, and anything requiring GFE approval.
Three construction-phase pitfalls to plan around:
Long-lead items. Approved doors, specialized IDS panels, GSA-approved containers, and network hardware often have 12-20 week lead times. Procure early; waiting for final design to order long-lead items is the most common schedule slip.
Sequencing of TEMPEST and inspection milestones. Certain TEMPEST-related work (shielded conduit, filtered power outlets, room shielding if required) cannot be easily remediated after drywall closes. If the TEMPEST plan is still being finalized when construction begins, construction will need to pause pending plan approval. Better: approve the TEMPEST plan before walls close.
Sponsor site visits. The accrediting authority will physically inspect the facility before accreditation. These inspections are scheduled at specific points — typically a pre-inspection during construction and a final accreditation inspection after substantial completion. Sponsor travel schedules constrain these dates. Build the construction schedule around sponsor availability, not vice versa.
Phase 4: system accreditation and operational readiness (6-12 weeks)
With construction substantially complete, the focus shifts from the facility itself to the information systems inside it. This is the RMF-driven ATO phase for each network enclave.
Typical work in this phase:
- System Security Plan (SSP) finalization per network enclave — JWICS SSP, SIPRNet SSP, program network SSP. Each is a document referenced to NIST 800-53 / CNSSI 1253 controls and tailored to the specific system scope.
- Security Assessment Plan (SAP) — not the Special Access Program — this is the NIST 800-53A test plan for each system.
- Security Assessment Report (SAR) — documents the assessment findings.
- POA&M for any residual findings with associated remediation plans.
- Authorization package submission to the Authorizing Official (AO).
- AO review, typically iterative with clarifications and additional documentation.
- ATO issuance — Authority to Operate.
Simultaneously, the facility itself needs final physical accreditation under ICD 705 — an inspection by the SSO or designee confirming the facility meets specifications, alarm and access control systems are tested, and the FFSP is signed. A SCIF accreditation letter from the SSO, or SAPF approval from the PSO, completes the facility-side work.
Only after both the facility is accredited (SCIF/SAPF status granted) and the systems have ATOs does the facility become operationally usable. Attempts to operate prior to this — “we’re just testing” — are program violations.
Phase 5: ongoing accreditation maintenance
A SCIF or SAPF accreditation is not one-and-done. Re-accreditation cycles (typically every 3 years but program-dependent), continuous monitoring of systems under RMF, personnel access reviews, periodic TEMPEST re-evaluations, and physical recertifications all happen throughout the facility lifecycle. Building the operational cadence for ongoing accreditation during initial build-out is easier than retrofitting it after accreditation is granted.
Where first-time builders lose six months
Five patterns we see repeatedly:
Unclear sponsor roles. When the sponsor SSO is ambiguous, or rotates mid-program, decisions sit waiting for approval. Lock the sponsor relationship early; confirm in writing who approves what.
Design starts before CONOPS is approved. Leads to rework mid-design. CONOPS approval is a real gate; treat it that way.
TEMPEST plan finalizes late. Causes construction pauses or expensive post-construction retrofits. Finalize TEMPEST concurrent with wall design, not after.
Long-lead items procured late. GSA-approved containers, security doors, IDS panels ordered at the last minute extend schedule. Procure on the design timeline, not the construction timeline.
System ATO work starts after facility accreditation. Leaves a gap between physical accreditation and operational use. Run the system ATO work in parallel with construction’s later phases.
The practical sequence
- Weeks 0-16: CONOPS development, sponsor coordination, initial design concepts, long-lead procurement initiated.
- Weeks 12-32: Detailed design, TEMPEST plan, pre-construction review, construction begins.
- Weeks 24-52: Construction proceeds, system SSPs drafted, pre-inspection by sponsor.
- Weeks 48-64: Construction completion, final inspection, facility accreditation, system ATOs issued.
- Week 64+: Operational use, ongoing maintenance.
Accelerated timelines compress these phases but cannot eliminate them — sponsor review gates, physical construction time, and inspection availability are not controllable by the contractor.
When to engage outside support
Organizations building their first SCIF or SAPF almost universally benefit from specialized advisory support, particularly during Phases 1-2 where sponsor coordination and design decisions shape everything downstream. The facility-engineering expertise required is specialized and rarely in-house even at large contractors. Our advisory engagements typically span the first three phases and hand off to the client’s own security operations team for ongoing accreditation maintenance.
For programs approaching a facility build, the most consequential first conversation is often a scoping call that walks through CONOPS development, sponsor identification, and early design decisions — the ones that make everything else possible.
Our Classified Networks practice is built around this sequencing. If you are a venture-backed startup facing your first SCIF rather than a prime with an established accreditation pipeline, see the playbook for first-time SCIFs at startups — different constraints, different guidance.