ICS 705-1, explained

Intelligence Community Standard (ICS) 705-1, Physical and Technical Security Standards for Sensitive Compartmented Information Facilities, is the 9-page standard that tells an Intelligence Community (IC) element what a Sensitive Compartmented Information Facility (SCIF) must achieve before it can be accredited. It took effect on September 17, 2010, under ICD 705, which had ordered a standard on uniform security requirements within 90 days of its own signature on May 26, 2010. ICS 705-1 is written as outcomes rather than measurements: the perimeter "shall provide a physical barrier," and the measurements that satisfy that outcome live in a separate document, the IC Tech Spec. The directive above it is covered in ICD 705, explained, and the facility itself in What is a SCIF.

What ICS 705-1 covers, section by section

The standard runs from Section A to Section K. Section A cites the National Security Act of 1947, Executive Order 12333, Executive Order 13526, and ICD 705. Section B states the purpose: the standards apply to all SCIFs, existing, new, and renovated, for reciprocal use by all IC elements; they protect SCI against compromising emanations, inadvertent observation or overhearing, disclosure by unauthorized persons, forced entry, and the detection of surreptitious and covert entry; and the Assistant Deputy Director of National Intelligence for Security (ADDNI/SEC) shall develop technical specifications to implement them and keep the Tech Spec updated on an ongoing basis.

Section C gives IC elements 180 days to implement the standard. A facility under construction on the effective date of ICD 705 had to meet the new standards or request a waiver, an accredited SCIF keeps operating under the requirements in force at its last accreditation, and a SCIF de-accredited for less than a year but controlled at the Secret level under 32 CFR Parts 2001 and 2004 may be re-accredited once on the old standards.

Section D is a single paragraph on reciprocal use that points to ICS 705-2. Section E covers risk management and security in depth. Section F covers planning, facility types, the Construction Security Plan, and construction security. Section G holds the physical and technical standards: perimeter, RF transmitters, access control, intrusion detection, unclassified telecommunications, portable electronic devices, temporary SCIFs, and overseas SCIFs. Section H covers waivers, Section I operations in one paragraph that points to the Tech Spec, Section J roles, and Section K the effective date. The standard is short because it delegates: reading ICS 705-1 alone gives the rules, and reading it with the Tech Spec gives the numbers.

The roles: AO, CSA, SSM, CTTA, and CST

Section J of ICS 705-1 assigns duties to 7 parties. The table below lists them as the standard does.

Three of these deserve a closer look. The Accrediting Official is the single official that ICD 705 Section D.4 lets an IC element head name to accredit, re-accredit, and de-accredit SCIFs, and ICS 705-1 Section F.1 says all SCIF planning shall begin with sponsorship by an AO. The Site Security Manager is the person on the construction side; Section F.7 requires that one be identified to the AO as responsible for all security aspects of the construction. The Certified TEMPEST Technical Authority is defined in the NIST glossary, drawing on CNSSI 4009, as a technically qualified U.S. Government employee certified under criteria approved by the Committee on National Security Systems and appointed by a department or agency to perform CTTA duties. In ICS 705-1 the CTTA is the only role that decides whether TEMPEST countermeasures are needed. Construction Surveillance Technicians are required only outside the United States when cleared contractors are not used, and the AO may add Cleared American Guards, Top Secret-cleared U.S. citizens as defined in the State Department's 12 FAH-6, when the threat warrants.

SCIF types and what each is accredited for

Section F.2 of ICS 705-1 says that reciprocal use is based on the type of facility and its current use, and defines 6 types.

• A Secure Work Area is accredited for using, handling, discussing, or processing SCI, but SCI is not stored there.
• A Temporary Secure Working Area limits SCI handling to less than 40 hours per month, again with no storage, and the Tech Spec limits its accreditation to 12 months.
• Continuous Operation means the SCIF is staffed and operated 24 hours a day, 7 days a week.
• A Temporary SCIF is needed for a limited time to meet tactical, emergency, or immediate operational requirements.
• Open Storage accreditation allows SCI to be openly stored and processed without General Services Administration (GSA) approved containers.
• Closed Storage accreditation requires all SCI to be in a GSA-approved security container.

The standard's own example of why the type matters: a facility accredited for closed storage and non-amplified discussions is not reciprocal for open storage and amplified discussions. A program that moves into a shared SCIF inherits the type on the letter of accreditation.

Risk management sits alongside the types. Section E requires the AO to apply analytical risk management, assessing threats against vulnerabilities to reach protection at acceptable risk and cost, and defines Security in Depth (SID) as the AO's acceptance of layers that raise the probability of detection before penetration. Inside the United States, SID lets a CSA use less stringent construction and longer alarm response times; outside it, SID is mandatory. The Tech Spec, Chapter 2, lists the accepted layers: a military installation or compound with a dedicated U.S. response force, a controlled building, alarmed controlled office areas around the SCIF, or a fenced compound with controlled gates.

Construction security and the Construction Security Plan

Section F of ICS 705-1 turns construction into a security process. Every project has a Construction Security Plan (CSP), whose format and content the AO may set according to the extent of the construction. Construction plans are handled under the CSP, may require classification if a guide says so, and may never be sent or posted on an unprotected information technology system or Internet venue without encryption.

Design and construction are performed by U.S. companies using U.S. persons, defined by reference to 8 U.S.C. 1101(a)(20), lawful permanent residents, and 8 U.S.C. 1324b(a)(3), protected individuals. When non-U.S. citizens are used, the AO ensures mitigations and documents them in the CSP. Section F.6 also requires compliance with the National Fire Protection Association codes NFPA 1 and NFPA 101, the Americans with Disabilities Act regulations at 28 CFR Part 36, and the Uniform Federal Accessibility Standards where applicable.

Renovation of an operating SCIF has its own rules. Construction personnel who must enter it are cleared or escorted by personnel cleared to the level of the SCIF, escorts may be dropped when a barrier separates the work from the SCIF, and site access control must be addressed in the CSP. The Tech Spec, Chapter 3, requires the CSP to be developed by the SSM and approved by the AO before a construction contract is awarded, and lists the site controls it may include: identity verification, random searches, signs listing prohibited items, physical barriers, and vehicle inspections.

Overseas, Section G.4 adds requirements by threat, using the Department of State Security Environment Threat List. U.S. Secret-cleared personnel perform finish work such as closing up walls and painting unless mitigations are documented in the CSP. Open storage in low and medium threat areas is allowed only in a continuously operated SCIF or a host facility staffed around the clock by a cleared U.S. presence; in high and critical threat areas, the IC element head or CSA must certify a mission-essential need case by case.

Perimeter, acoustic, and RF standards

Section G.1 defines the perimeter as all perimeter walls, windows, and doors plus the ceiling and floor, and states the first standard: the perimeter shall provide a physical barrier to forced, covert, and surreptitious entry. Walls, floor, and ceiling are permanently and solidly constructed and attached to each other, raised floors and false ceilings may not anchor wall supports, and everything above a false ceiling or below a raised floor must show visual evidence of unauthorized penetration. The federal rule for open storage areas at 32 CFR 2001.53 uses the same language.

The Tech Spec converts the barrier standard into wall assemblies. The suggested standard acoustic wall, Wall A, is 3 layers of 5/8-inch gypsum wallboard on metal or wood studs placed no less than 16 inches on center with acoustic fill and sealant, finished from true floor to true ceiling, and an existing brick or concrete wall may be used when it equals the standard. Closed storage areas that do not need discussion areas have no forced-entry or acoustic requirement at all, which is why the SCIF type decides the wall.

Acoustic protection is the second standard: a SCIF that requires SCI discussions shall prevent conversations from being inadvertently overheard outside. The Tech Spec, Chapter 9, says this is protection against inadvertent overhearing, not deliberate technical interception, and rates it in Sound Transmission Class. Sound Group 3 is STC 45 or better, where loud speech is faintly heard but not understood. Sound Group 4 is STC 50 or better and is required for amplified areas such as conference centers and video teleconference rooms. Tests may be run to Noise Isolation Class 40 or 45 instead, and when construction alone falls short the Tech Spec allows structural upgrades, stand-off distance, and sound masking.

Radio frequency is the third. ICS 705-1 says RF shielding is required only when a CTTA evaluation requires it, and then it should be planned during initial construction because retrofit costs are significantly higher. Section G.2.a bars RF transmitters from a SCIF unless a competent authority such as the CTTA has rated them low risk and the AO has approved them, and Section G.2.e calls portable electronic devices a risk and sends the reader to the Tech Spec, whose Chapter 10 covers portable electronic devices.

Access control and intrusion detection

Section G.2.b states the access control rule in 2 sentences: access is restricted to authorized personnel, and the AO approves the method. The approved methods are an automated system using at least 2 technologies, such as badge, PIN, or biometric, or electromechanical, mechanical, or personal recognition in small facilities or where there is a single monitored entrance. None of them is approved for securing the entrance when the SCIF is unoccupied.

The Tech Spec, Chapter 8, fills in the numbers. Visual recognition by an SCI-indoctrinated person at the door is called the ideal control. Otherwise the automated system verifies identity with 2 of 3 technologies, a badge or card, a PIN of 4 or more random digits, or a biometric, and must hold the probability of admitting an unauthorized person to no more than 1 in 10,000 and of rejecting an authorized one to no more than 1 in 1,000, certified in writing by the manufacturer. Readers outside the SCIF are tamper-protected, their data travels on FIPS AES encrypted lines, and when unoccupied the SCIF is alarmed and secured with a GSA FF-L-2740A combination lock.

Section G.2.c covers the intrusion detection system (IDS). It shall detect attempted or actual unauthorized human entry, and its installation, components, and monitoring stations shall comply with UL 2050, the Underwriters Laboratories standard for national industrial security systems, at Extent 3. Government-only systems need no UL certification but must meet the Extent 3 installation standard. A contractor SCIF keeps a current UL certificate of installation and service and renews it after any change. SCIFs accredited before ICD 705 need not upgrade until re-accreditation.

Response time is set by reference. ICS 705-1 says response times for the IDS shall meet 32 CFR Parts 2001 and 2004 for protecting Top Secret information. 32 CFR 2001.43 gives the figures: 15 minutes from alarm annunciation for an open storage area covered by security in depth, 5 minutes without it. The Tech Spec, Chapter 3, repeats them for SCIFs inside the United States, and Chapter 7 adds the component rules: UL 639 listed motion sensors, UL 634 Level II high security switches on perimeter doors, premise control units inside the SCIF, encrypted line security or sealed ferrous conduit for any cable that leaves the perimeter, and no more than 1 false alarm per 30 days per partition.

When a TEMPEST review is triggered

ICS 705-1 never requires TEMPEST countermeasures outright. It requires a decision, and it assigns the decision to the CTTA. Three provisions set the trigger. Section J.6 says the CTTA shall review SCIF construction or renovation plans to determine if TEMPEST countermeasures are required, so every new SCIF and every renovation goes to the CTTA at the plan stage. Section G.2.d says any unclassified telecommunications system introduced into the SCIF shall be evaluated by the CTTA and the AO for technical surveillance and TEMPEST concerns, so a new phone system reopens the question. Section G.2.a makes the CTTA the example of a competent authority who can rate an RF transmitter low risk. The subject itself is covered in What is TEMPEST.

The Tech Spec shows what the review touches. Chapter 3 says perimeter doors shall meet TEMPEST requirements per CTTA guidance and that metallic penetrations may require dielectric breaks or grounding when the CTTA recommends them. Chapter 11 says unclassified telephone systems shall be physically isolated from classified systems in accordance with DNI and CNSS TEMPEST guidance. The forms in Chapter 13 include a TEMPEST Checklist that accompanies the Fixed Facility Checklist when electronic processing occurs, and the Pre-Construction Checklist asks whether one will be submitted to the CTTA through the AO.

ICS 705-2 closes the loop: a TEMPEST review and verification of countermeasures by a CTTA is a necessary part of the accreditation process, and the letter of accreditation states that the SCIF meets all physical, TEMPEST, and technical security standards. ICS 705-2 says a TEMPEST review may be included in the accreditation documentation if the AO requires it, and then calls CTTA review and verification a necessary part of accreditation.

How ICS 705-1 relates to the IC Tech Spec

The relationship is stated in both documents. ICS 705-1 Section B.3 orders the ADDNI/SEC to develop technical specifications that implement the SCIF standards and to update them on an ongoing basis. The Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities, Version 1.5, issued by the National Counterintelligence and Security Center on March 13, 2020, answers in Chapter 1: it "sets forth the physical and technical security specifications and best practices" for meeting ICS 705-1, and when applied to new construction and renovation it satisfies the standard and enables reciprocal use.

Two distinctions follow. First, a mitigation is not a waiver. The Tech Spec, Chapter 2, defines mitigations as verifiable, non-standard methods the AO approves as at least equal to the standard's protection level, and says most standards can be mitigated, except those that rest on tested equipment such as a combination lock meeting Federal Specification FF-L-2740. Second, a product is not a facility. The Tech Spec warns that advertised claims that prefabricated structures, containers, and modular structures can be accredited without modification "may not be accurate," and that AOs remain responsible for the ICD/ICS 705 controls before accreditation. A SCIF, in the NIST glossary definition drawn from ICS 700-1, is an area accredited as meeting DNI standards, and accreditation is an act of the AO.

Section H of ICS 705-1 governs what happens when the standard cannot be met even with mitigation. A waiver is considered only in exceptional circumstances and removes the SCIF from mandatory reciprocal use. The request lists the standard, the mitigations considered, the justification, residual risk, compensating procedures, when the standard will be met, and acceptance of reciprocal use, and approved waivers are reported within 30 days through the IC SCIF repository.

What to check

• Which type the SCIF is accredited for, open or closed storage and discussion or non-discussion, since reciprocity follows the type and amplified discussion needs Sound Group 4.
• Whether the CTTA has reviewed the current plans and whether any unclassified telecommunications system or RF transmitter added since then has been evaluated by the CTTA and AO.
• Whether a contractor SCIF holds a current UL 2050 Extent 3 certificate, renewed after the last change, and whether the monitoring agreement's response time matches 15 or 5 minutes for the storage type and SID.
• Whether the Construction Security Plan was approved by the AO before contract award, who the named Site Security Manager is, and whether any non-U.S. citizen labor is documented with mitigations.
• Whether any shortfall against ICS 705-1 is an AO-approved mitigation, which keeps reciprocity, or a waiver, which removes it.

Azcuna's BABEL reads, translates, and searches foreign-language documents entirely on-device, with no cloud and no connection, and keeps every claim tied to the passage it came from.

Questions people ask

What is ICS 705-1?

Intelligence Community Standard 705-1, Physical and Technical Security Standards for Sensitive Compartmented Information Facilities, is the 9-page standard issued under ICD 705 and effective September 17, 2010. It sets the physical and technical security standards that apply to all SCIFs, existing and new, for reciprocal use by every Intelligence Community element. It is written as outcomes and directs the measurements to the Technical Specifications for Construction and Management of SCIFs, the IC Tech Spec.

What is the difference between ICS 705-1 and ICS 705-2?

ICS 705-1 covers the facility: planning, construction security, perimeter, acoustics, RF transmitters, access control, intrusion detection, telecommunications, overseas rules, and waivers. ICS 705-2, dated December 22, 2016, covers the paperwork and the life cycle: the letter of accreditation, the accreditation process, 5-year re-evaluation, re-accreditation, de-accreditation, reciprocity, co-use, and joint use. ICS 705-1 Section D points to ICS 705-2 for the reciprocal use rules.

What are the roles in ICS 705-1?

Section J of ICS 705-1 assigns duties to the Assistant Deputy Director of National Intelligence for Security, heads of IC elements, Cognizant Security Authorities, Accrediting Officials, Site Security Managers, Certified TEMPEST Technical Authorities, and Construction Surveillance Technicians. The Accrediting Official approves the design concept, Construction Security Plan, and final design and accredits the SCIF. The Site Security Manager is the single point of contact for construction security and reports deviations within 3 business days.

What does ICS 705-1 require for intrusion detection?

ICS 705-1 Section G says the intrusion detection system shall detect attempted or actual unauthorized human entry and that installation, components, and monitoring stations shall comply with UL 2050 Extent 3. Government-only systems need no UL certificate but must meet the Extent 3 installation standard. Contractor SCIFs keep a current UL certificate of installation and service, renewed after any change. Response times follow 32 CFR Parts 2001 and 2004 for Top Secret information.

What access control does a SCIF need under ICS 705-1?

ICS 705-1 says access is restricted to authorized personnel and the Accrediting Official approves the method. Automated systems use at least 2 technologies, such as badge, PIN, or biometric. Electromechanical, mechanical, or personal recognition is allowed in small facilities or where there is a single monitored entrance. None of these methods may secure the entrance when the SCIF is unoccupied; the IC Tech Spec says an unoccupied SCIF is alarmed and locked with a GSA FF-L-2740A combination lock.

Does ICS 705-1 require RF shielding?

Not by default. ICS 705-1 says that when radio frequency shielding is required by a Certified TEMPEST Technical Authority evaluation, it should be planned during initial construction because retrofitting costs significantly more. The decision belongs to the CTTA, who reviews the construction or renovation plans to determine whether TEMPEST countermeasures are required and gives the Cognizant Security Authority and Accrediting Official documented results with recommendations.

What triggers a TEMPEST review for a SCIF?

Under ICS 705-1, every SCIF construction or renovation plan goes to the Certified TEMPEST Technical Authority, who decides whether countermeasures are required. Any unclassified telecommunications system brought into the SCIF is evaluated by the CTTA and Accrediting Official for TEMPEST and technical surveillance concerns, and an RF transmitter may enter only after a competent authority such as the CTTA rates it low risk. ICS 705-2 adds that CTTA verification of countermeasures is a necessary part of accreditation.

What acoustic protection does ICS 705-1 require?

ICS 705-1 states the outcome: a SCIF used for SCI discussions shall provide acoustic protection so conversations are not inadvertently overheard outside. The IC Tech Spec, Chapter 9, gives the ratings. Sound Group 3 is Sound Transmission Class 45 or better, where loud speech is faintly heard but not understood. Sound Group 4 is STC 50 or better and is required for amplified areas such as conference and video teleconference rooms. Tests may also be run to Noise Isolation Class 40 or 45.

Is ICS 705-1 the same as the IC Tech Spec?

No. ICS 705-1 is the standard; the Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities is the specification that implements it. ICS 705-1 Section B.3 directs the ODNI security office to develop and keep updating the Tech Spec. The Tech Spec, Version 1.5 of March 13, 2020, says that applying its specifications to new construction and renovation satisfies ICS 705-1 and enables reciprocal use. The standard says what; the specification says how.

What happens if a SCIF cannot meet an ICS 705-1 standard?

Section H of ICS 705-1 allows a waiver only in exceptional circumstances, when the standard cannot be met or mitigated, or when a documented risk-based need exists to exceed it. A waiver for a standard that cannot be met removes the SCIF from mandatory reciprocal use. The request lists the standard, the mitigations tried, the justification, residual risk, compensating procedures, when the standard will be met, and acceptance of reciprocal use, and an approved waiver is reported within 30 days of approval through the IC SCIF repository.

Sources

1. 1Intelligence Community Standard 705-1, Physical and Technical Security Standards for Sensitive Compartmented Information Facilities · Office of the Director of National Intelligence
2. 2Intelligence Community Directive 705, Sensitive Compartmented Information Facilities · Office of the Director of National Intelligence
3. 3Intelligence Community Standard 705-02, Standards for the Accreditation and Reciprocal Use of Sensitive Compartmented Information Facilities · National Counterintelligence and Security Center
4. 4Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities, Version 1.5 · National Counterintelligence and Security Center
5. 532 CFR Part 2001, Classified National Security Information · Electronic Code of Federal Regulations
6. 6Certified TEMPEST Technical Authority (glossary entry) · National Institute of Standards and Technology
7. 7Sensitive compartmented information facility (glossary entry) · National Institute of Standards and Technology
8. 8UL 2050, National Industrial Security Systems · UL Standards and Engagement

Where this shows up in our work

• ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.
• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.