The Governing Standards: ICD 705 and the IC Tech Spec

3.1 The document that isn’t the document

There is a persistent misunderstanding, common even among people who have worked in one, that a SCIF is built to “ICD 705.” Strictly speaking, almost nothing in a SCIF is built to ICD 705. The directive itself is a slim policy document — a handful of pages establishing that all Sensitive Compartmented Information Facilities in the Intelligence Community shall meet uniform physical and technical security requirements, and assigning who is responsible for what. It contains no wall sections, no sound-attenuation tables, no lock model numbers. It is the enabling statute, not the building code.

The building code is a separate, much thicker volume with an ungainly name: the IC Tech Spec for ICD/ICS 705 — Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities. That is the document a contractor’s project manager keeps open on a second monitor, dog-eared to the wall-construction figures. Understanding the SCIF as a building system means understanding this two-tier structure — a short directive that delegates authority, and a long specification that the directive points to — because the whole apparatus of reciprocity, accreditation, and TEMPEST review hangs off the seam between them. This volume walks the document stack, names the cast of roles that operate it, and surveys what the Tech Spec actually specifies. The engineering detail lands in Volumes 6 through 10; here the goal is to map the territory and get the citations right.

3.2 The stack: directive, standards, specification

The governing documents form a deliberate hierarchy, and the naming convention encodes the hierarchy. At the top sits ICD 705, Sensitive Compartmented Information Facilities — an Intelligence Community Directive, issued under the authority of the Director of National Intelligence in May 2010. A directive in this system is policy: it states the objective (protect SCI; enable consistent and reciprocal use of SCIFs), declares its scope (all facilities accredited by IC elements where SCI is processed, stored, used, or discussed), and delegates implementation downward. ICD 705 is the document that rescinded its predecessor and reset the entire field, which is why it gets a volume’s worth of attention despite its brevity.

Below the directive come two Intelligence Community Standards. ICS 705-1, Physical and Technical Security Standards for Sensitive Compartmented Information Facilities, translates the directive’s objective into the actual security standards a SCIF must satisfy. ICS 705-2, Standards for the Accreditation and Reciprocal Use of Sensitive Compartmented Information Facilities, governs the other half of the problem — how a facility gets accredited and, crucially, how one IC element’s accreditation is recognized by another. Both standards were issued in 2010, shortly after the directive itself. The split is telling: one standard for how you build it, one standard for how you get it blessed and keep it portable.

At the bottom, where policy finally becomes buildable, is the IC Tech Spec. It is explicitly the implementing specification for ICD 705, ICS 705-1, and ICS 705-2. Its own front matter says as much: apply these technical specifications to new construction and renovation, and the result shall satisfy the standards of ICS 705-1 so as to enable uniform and reciprocal use across all IC elements. That sentence is the entire design philosophy of the modern SCIF compressed into a single clause. The Tech Spec is where the wall types (A through D), the sound groups, the acoustic ratings, the door hardware, the alarm requirements, and the TEMPEST-countermeasure process all live in enough detail to hand to a builder.

The Tech Spec has been revised repeatedly, and getting the version right matters because the requirements move between editions. Version 1.0 carried the date 5 May 2011 and was prepared by the then–National Counterintelligence Executive. Version 1.4 followed in September 2017. Version 1.5 is dated 13 March 2020, by which point authorship had passed to the National Counterintelligence and Security Center (NCSC). The current edition at the time of writing is Version 1.5.1, dated 26 July 2021 — a point-release refinement of 1.5 rather than a wholesale rewrite. Anyone citing “the Tech Spec” without a version and date is quoting a moving target; a wall detail that was compliant under 1.4 is not automatically compliant under 1.5.1.

It is worth noting that this framework is not frozen. In 2025, ODNI issued what the trade press described as the largest revision to SCIF standards in fifteen years, sharpening the treatment of radio-frequency and electromagnetic threats and pushing more facilities toward measurable RF attenuation. The specifics belong to later volumes, but the point for the standards backbone is structural: the directive endures, and the Tech Spec is the layer that absorbs the churn.

3.3 Why the old system had to go: DCID 6/9

To appreciate why ICD 705 was written the way it was, one has to understand what it replaced. For decades the governing document was DCID 6/9, Physical Security Standards for Sensitive Compartmented Information Facilities, issued under the authority of the Director of Central Intelligence — the pre-2004 arrangement in which the head of the CIA also nominally presided over the broader intelligence community. DCID 6/9 was a competent standard, but it lived in a fragmented world. Individual agencies tailored and interpreted it to suit their own cultures and missions, and there was no single authority whose accreditation everyone was obligated to honor.

The practical consequence was waste and friction. A facility built and accredited by one agency to its reading of DCID 6/9 frequently failed another agency’s review, so an organization moving into space that a sister agency had already certified would often have to re-accredit it — re-inspecting, sometimes re-building, to satisfy a second accreditor who did not trust the first. In an enterprise with hundreds of SCIFs and constant inter-agency movement, that redundancy consumed money and time for no gain in actual security.

The structural fix arrived with the intelligence reorganization that followed the September 11 attacks. The 2004 legislation that stood up the Office of the Director of National Intelligence created, for the first time, a single head of the Intelligence Community with the authority to set community-wide policy. The DNI could do what no DCI ever really could: impose one SCIF standard on everyone and make its accreditations binding across agency lines. ICD 705, issued in 2010, is the exercise of exactly that authority. It rescinded DCID 6/9, folded the physical-security standard into ICS 705-1 and the accreditation-and-reciprocity standard into ICS 705-2, and pointed both at a single implementing Tech Spec. The transition from a directive numbered “6/9” under a Director of Central Intelligence to one numbered “705” under a Director of National Intelligence is not just a change of letterhead — it is the paper trail of the community centralizing an authority it had lacked.

3.4 Reciprocity: the whole point

If one idea deserves to be underlined in this volume, it is reciprocity, because it is simultaneously the central design goal of ICD 705 and the concept most often misunderstood. Reciprocity is the principle that a SCIF properly accredited by one IC element is presumed acceptable to the others, without a fresh, ground-up re-accreditation. It is the direct answer to the DCID 6/9 waste described above, and ICS 705-2 exists specifically to codify it.

The engineering leverage of reciprocity is that it forces standardization upstream. If any accreditor might later have to accept a facility built under another’s oversight, then everyone has a strong incentive to build to the same published specification — the Tech Spec — rather than to house interpretations. Reciprocity and the Tech Spec are two ends of the same lever: uniform construction makes reciprocal acceptance defensible, and the promise of reciprocal acceptance makes uniform construction worth the discipline. This is why the Tech Spec’s own preamble ties compliance directly to “uniform and reciprocal use.” The document is not merely telling a builder how to make a room quiet and hard to break into; it is making that room portable across the community.

Reciprocity is a presumption, not a guarantee. An accreditor receiving a facility can review the accreditation package and can decline to accept residual risk it is unwilling to own — particularly where TEMPEST or a unique threat environment is involved. But the burden has flipped from the DCID 6/9 default. Under the old model, re-accreditation was the norm and acceptance the exception; under ICD 705, acceptance is the presumption and re-accreditation the justified exception. That inversion is the reform.

3.5 The cast: who owns what

A SCIF is operated by a small ensemble of defined roles, and the acronyms are unavoidable. Getting them straight is half of understanding how a facility is actually governed, because authority in this system is carefully partitioned — no single person both sets the standard, approves the design, and runs the room.

The Accrediting Official (AO) is the linchpin. Appointed by the head of an IC element (or designated by the Cognizant Security Authority), the AO is the government authority who approves — accredits — a facility for SCI operations, and who owns the risk decisions along the way, from concept approval through final accreditation. In the older and DoD-flavored literature the same function appears as the Designated Accrediting Authority (DAA) or Designated Approving Authority; the term of art has drifted over the years, but the role is the accreditor. When a facility is granted accreditation, it is the AO’s signature that grants it, and the AO who can withdraw it.

The Cognizant Security Authority (CSA) sits above the AO in the sense that it is the responsible IC element authority that designates AOs and carries overall responsibility for the SCI security program in its domain. One usefully thinks of the CSA as the institution and the AO as the accountable individual acting under it.

Running the facility day to day is the province of the Special Security Officer (SSO) and, in the site-management framing the Tech Spec uses, the Site Security Manager (SSM). The SSM is the person designated by the AO who is responsible for all aspects of a SCIF’s construction and operational security — the person who owns the checklists, the operating procedures, and the paperwork. Beneath the SSO, the Special Security Representative (SSR) performs delegated SSO duties for subordinate facilities. The distinction that matters for an engineer is the split between the AO, who accredits, and the SSO/SSM, who operates and maintains — the accreditor is deliberately not the operator.

Then there is the role that turns a SCIF from a physical-security problem into an electromagnetic one: the Certified TEMPEST Technical Authority (CTTA). The CTTA is a U.S. Government employee who has met formal qualification requirements to make TEMPEST determinations — the specialist who decides, for a given facility in a given threat environment, what emanation countermeasures are actually required. The critical structural fact is that TEMPEST authority rests with the AO, informed by the CTTA. The AO holds the responsibility to have a TEMPEST countermeasures review performed and to accredit accordingly; the CTTA supplies the technical judgment that the AO acts on. Only the countermeasures the CTTA identifies are the ones that get implemented — the process is deliberately not “apply everything,” because TEMPEST hardening is expensive and the required level depends on classified inputs. This is also the boundary where public documentation stops: the framework (an AO responsible for TEMPEST, advised by a CTTA, applying zoning and RED/BLACK concepts) is unclassified and described in Volume 8, while the numeric limits and zone distances are not public and are not invented here.

Within the Department of Defense, cognizance has a specific home. DIA — the Defense Intelligence Agency — is the DoD’s cognizant authority for SCI and SCIFs, exercising that role through the Under Secretary of Defense for Intelligence’s issuances (the DoD Manual 5105.21 family). In practice this means that for DoD SCIFs, DIA is the authority that can direct corrective action when a deficiency affects the physical or TEMPEST accreditation of the facility. Where Special Access Programs are concerned, the parallel authority is the SAP Central Office (SAPCO) and, at the working level, the Program Security Officer, with the cognizant-authority SAPCO holding oversight of SAP facilities.

3.6 What the Tech Spec actually specifies

With the ownership settled, the Tech Spec becomes legible as a lifecycle document. It walks a facility from an idea to an accredited, operating room, and it is organized more or less in that order.

Pre-construction comes first, and it is mostly paperwork with teeth. Before a shovel moves, the project needs concept approval from the AO — sign-off that the proposed facility, in its proposed location, is worth building at all. From there the security-relevant planning artifacts accumulate. The Construction Security Plan (CSP) governs how the construction itself is protected: who the cleared and uncleared workers are, how materials are controlled, how the site is secured while the SCIF is a hole in the ground with its guts exposed — because a facility is never more vulnerable to a hostile implant than during construction. The Fixed Facility Checklist (FFC) is the master descriptive document for the facility: a standardized form capturing the SCIF’s construction, location, alarms, access control, and acoustic treatment in the form the AO reviews for accreditation. Where TEMPEST is in play, a TEMPEST Addendum (the TEMPEST checklist) accompanies the FFC, feeding the CTTA’s countermeasures review. These documents are not bureaucratic ornament; they are the accreditation package in embryo, and an error in them is an error the AO accredits against.

Physical construction standards form the bulk of the document. The Tech Spec defines a small menu of standardized perimeter wall constructions — Wall Types A through D — each a specific assembly of studs, gypsum board, insulation, and, in the hardened variants, expanded metal, chosen to meet a required combination of acoustic and intrusion-resistance performance. It specifies the perimeter as a true floor-to-true-ceiling boundary, the treatment of the deck above a suspended ceiling, doors and their hardware, the intrusion-detection system, and access control. The figures in the Tech Spec are genuinely useful engineering drawings: a builder can lay out a compliant wall from them.

Acoustic protection is its own chapter, and it is one an EE reader will appreciate, because it is a clean transmission-loss problem dressed in security language. The Tech Spec rates a perimeter’s ability to contain sound using Sound Transmission Class (STC) and organizes requirements into Sound Groups. The two that dominate SCIF practice are Sound Group 3, corresponding to STC 45 or better, described as the condition in which loud speech within the SCIF can be faintly heard but not understood outside it — normal conversation being unintelligible to the unaided ear at the perimeter — and Sound Group 4, corresponding to STC 50 or better, the higher standard applied where amplified audio is present (a briefing with speakers, a video-teleconference at volume). The Tech Spec draws the operational line between “normal” speech and “amplified” speech precisely because the second case is a harder containment problem: an STC-45 wall that comfortably defeats a conversation can be defeated by a loudspeaker. These are published, unclassified numbers, and they are cited here as such — but the useful takeaway is conceptual, not a recipe. A wall’s job is to drop intelligible speech below the level at which it can be reconstructed at the perimeter, and the Sound Group is shorthand for how hard that wall has to work.

The TEMPEST countermeasures review is a process, not a spec sheet. Where the acoustic requirement can be printed as an STC number, the emanation-security requirement cannot, because the thresholds are classified. What the Tech Spec documents is the procedure: the AO, using the TEMPEST Addendum, obtains a CTTA determination of what countermeasures — shielding, filtering, RED/BLACK separation, zoning — are required for this facility, and those countermeasures then flow back into the construction. This is the mechanism by which a wall drawing sprouts a note reading “foil-backed gypsum board where required by CTTA,” as the Wall A figure does. Volume 8 takes up emanation security in earnest; the point here is only that the standard handles TEMPEST by delegating a judgment, not by publishing a limit.

The accreditation package closes the loop. When construction and countermeasures are complete, the assembled documentation — the completed FFC, the TEMPEST addendum and CTTA determination, alarm and access-control certifications, acoustic test results where required — goes to the AO for accreditation. Accreditation is the AO’s formal decision that the facility may be used for SCI, and it is the artifact that reciprocity acts upon: a clean accreditation package built to the Tech Spec is precisely what makes another IC element willing to accept the facility without starting over.

[FIGURE SLOT — a GSA-approved combination lock (Kaba Mas X-09/X-10) on a Class 5 vault door or security container, illustrating the FF-L-2740 hardware the Tech Spec points to. No license-clean photograph located; a bench photo of the actual hardware would fill this slot.]

3.7 The standards it points to

One of the more useful mental models for the Tech Spec is that it is a hub that references a constellation of other standards rather than restating them. Knowing the spokes is what lets an engineer read a SCIF drawing without getting lost.

For intrusion detection, the Tech Spec leans on UL 2050, the Underwriters Laboratories Standard for National Industrial Security Systems — the standard developed with federal security agencies that governs the alarm systems protecting classified material. A UL 2050 CRZH certificate, issued by an authorized alarm-service company, is the artifact that attests a SCIF’s intrusion-detection system was installed and is monitored to the required extent of protection within a defined response radius. When a SCIF’s IDS is described as “UL 2050 certified,” this is the standard in play.

For locks and containers, the references are federal specifications and GSA approvals. High-security combination locks meet Federal Specification FF-L-2740 — the specification satisfied by the Kaba Mas X-09 and X-10 electromechanical locks that sit on GSA-approved vault doors and security containers. A primary SCIF entrance built as a vault typically carries a GSA-approved Class 5 vault door, and pedestrian door hardware meets the companion specification FF-L-2890. GSA-approved security containers — the familiar Class 5 and Class 6 filing cabinets and safes — carry their own approvals for the storage of classified material inside the SCIF. The Tech Spec does not re-derive any of this; it cites the GSA and federal-specification pedigree and moves on.

For the ordinary business of putting up a building, the Tech Spec coexists with the building and fire codes — NFPA and the applicable local code — which is a genuine source of engineering tension: an emergency exit that fire code demands be openable from the inside is, to a physical-security officer, a hole in the perimeter, and the standard’s emergency-exit provisions (deadlocking panic hardware, no exterior hardware, alarmed and acoustically matched to the adjacent wall) are the negotiated truce between the two disciplines. Volume 7 returns to this where it bites hardest, at the door.

For contractors, the connecting tissue is the NISPOM — the National Industrial Security Program Operating Manual — which since a 2020 rulemaking has been codified as federal regulation at 32 CFR Part 117, effective February 2021. A cleared defense contractor building or operating a SCIF does so within the NISPOM’s industrial-security framework while meeting the same ICD 705 construction standards; the NISPOM is the “who is cleared and how is the company overseen” layer wrapped around the “how is the room built” layer.

For emanation security, the referenced family is the CNSS/NSTISSAM TEMPEST documents — the National Security Telecommunications and Information Systems Security Advisory Memoranda now under the Committee on National Security Systems. NSTISSAM TEMPEST/1-92, Compromising Emanations Laboratory Test Requirements, Electromagnetics, is a real, named document in this family, but its substantive content — the actual limits — is classified. The Tech Spec’s relationship to the TEMPEST family is therefore the same as its relationship to the CTTA: it invokes an authority and a process rather than reproducing numbers that are not public.

3.8 SAPFs: the same room, a different sponsor

A recurring point of confusion is the relationship between a SCIF and a SAPF — a Special Access Program Facility. The short answer is that they are close cousins built to overlapping standards. SCI and SAP are different classification-control regimes: SCI is intelligence-derived compartmented information under the DNI’s authority, while a SAP is a program with access controls beyond the normal collateral system, frequently under DoD authority. But the physical and technical protections a facility needs are largely the same problem, and so SAPFs are commonly built to the same IC Tech Spec — its own figures and guidance repeatedly address SCIFs and SAPFs together, and SAP physical-security requirements reference the same ICS 705-1 standards. The differences that matter are in governance and oversight — a SAPF answers to a SAP cognizant authority and its Program Security Officer rather than to an IC-element AO in the SCI chain — more than in the wall section. For an engineer, the reassuring simplification is that the construction discipline is portable: the acoustic, intrusion, and emanation problems do not care which control regime named the room.

3.9 What the standards define, and what they do not

The value of pulling this stack apart is seeing where the seams fall, because the seams are where the engineering decisions actually get made. ICD 705 defines the authority and the objective. ICS 705-1 and 705-2 define the security standard and the accreditation-and-reciprocity regime. The IC Tech Spec defines the buildable requirements — walls, sound groups, doors, alarms, and the process for TEMPEST — and hands off the specialized pieces to GSA specifications, UL 2050, the building codes, the NISPOM, and the CNSS TEMPEST family. The roles — AO, CSA, SSO/SSM, SSR, CTTA, and the DoD and SAP cognizant authorities — define who decides.

What none of these documents do, in the public record, is publish the numbers that would let someone reverse-engineer the emanation-security posture of a real facility: the TEMPEST limits and zoning distances remain classified, and the standards handle them by delegation to a CTTA and an AO rather than by disclosure. That boundary is honored throughout this deep dive.

The standards, in other words, answer what and who and how portable. They are the reference backbone the rest of the dive is built on. What they conspicuously do not do is show the reader how a wall actually gets stood up, how a duct crosses the perimeter without becoming a leak, how power and data get into a shielded volume without carrying a signal back out, and how the whole assembly gets alarmed, tested, and accredited. That is the province of Volumes 6 through 10, which take the requirements catalogued here and turn them into an engineered building. The standards define what; the construction volumes show how.

Sources

• Office of the Director of National Intelligence, Intelligence Community Directive 705, Sensitive Compartmented Information Facilities (26 May 2010). Federation of American Scientists mirror: https://irp.fas.org/dni/icd/icd-705.pdf ; ODNI: https://www.dni.gov/files/documents/ICD/ICD-705-SCIFs.pdf
• ODNI / National Counterintelligence and Security Center, IC Tech Spec for ICD/ICS 705 — Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities, Version 1.0 (5 May 2011), Version 1.5 (13 March 2020), and Version 1.5.1 (26 July 2021). Cover and construction figures reproduced from the v1.0 and v1.5 editions. NCSC: https://www.dni.gov/files/NCSC/documents/Regulations/IC_Technical_Specifications_for_Construction_and_Management_of_Sensitive_Compartmented_Information_Facilities_v151_PDF.pdf
• Intelligence Community Standard (ICS) 705-1, Physical and Technical Security Standards for Sensitive Compartmented Information Facilities (17 September 2010); ICS 705-2, Standards for the Accreditation and Reciprocal Use of Sensitive Compartmented Information Facilities (17 September 2010). https://www.dni.gov/files/NCSC/documents/Regulations/ICS_705-2_Standards_for_Accreditation_Reciprocal_Use_of_SCIFs.pdf
• Director of Central Intelligence Directive (DCID) 6/9, Physical Security Standards for Sensitive Compartmented Information Facilities (rescinded by ICD 705). https://irp.fas.org/offdocs/dcid6-9.doc
• Department of Defense Manual 5105.21, Volumes 1–3, Sensitive Compartmented Information (SCI) Administrative Security Manual (19 October 2012) — DIA as DoD SCI/SCIF cognizant authority. https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/510521m_vol2.pdf
• DoD Directive 5205.07 and DoD Manual 5205.07, DoD Special Access Program (SAP) Security Manual — SAP/SAPF governance, SAPCO and Program Security Officer roles. https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/520507m1.PDF
• 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM) (final rule 21 December 2020, effective 24 February 2021). https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-D/part-117
• UL Solutions / Intertek, UL 2050 — National Industrial Security Systems for the Protection of Classified Materials (CRZH certification). https://www.ul.com/services/national-industrial-security-system-certification ; https://www.intertek.com/life-safety-security/standards/ul-2050/
• Kaba Mas, X-09 / X-10 High Security Lock product documentation (FF-L-2740 combination locks for GSA-approved containers and vault doors). https://www.kabamas.com/x-09-high-security-lock/
• NSTISSAM TEMPEST/1-92, Compromising Emanations Laboratory Test Requirements, Electromagnetics (named document; substantive limits classified). Reference discussion: https://en.wikipedia.org/wiki/Tempest_(codename)
• On the DCID 6/9 → ICD 705 transition and reciprocity: PSC Consultant Group, “The History of SCIF Construction — From War Rooms to ICD 705.” https://www.psc-consultant.com/post/the-history-of-scif-construction-from-war-rooms-to-icd-705
• On the 2025 ICD 705 revision (RF/electromagnetic emphasis): Holland & Knight, “Leasing SCIF Space: How the New ICD-705 Affects Leases” (October 2025). https://www.hklaw.com/en/insights/publications/2025/10/leasing-scif-space-how-the-new-icd-705-affects-leases
• On roles (AO, CSA, SSM, SSR, CTTA): PSC Consultant Group / SCIF Guide, “Key Roles in SCIF Construction.” https://www.psc-consultant.com/post/key-roles-in-scif-construction
• On acoustic Sound Groups and STC as framed by the Tech Spec: SPG Secure, “STC — Deciphering ICD 705 Acoustic Requirements.” https://www.spgsecure.com/post/stc-deciphering-icd-705-acoustic-requirements-and-when-testing-is-required-part-i