ICS 705-2, explained

Intelligence Community Standard (ICS) 705-02, Standards for the Accreditation and Reciprocal Use of Sensitive Compartmented Information Facilities, is the 4-page standard that says how a Sensitive Compartmented Information Facility (SCIF) becomes accredited, stays accredited, is shared with another program, and is closed. The Director of the National Counterintelligence and Security Center (NCSC) signed it on December 22, 2016, 6 years after ICD 705 ordered standards on accreditation, re-accreditation, and de-accreditation and on reciprocal use. Where ICS 705-1 says what a SCIF must be, ICS 705-2 says how an Accrediting Official decides that it is, and what that decision is worth to everyone else. The directive is covered in ICD 705, explained; this post covers the accreditation standard alone.

What ICS 705-2 says, section by section

The standard has 6 lettered sections. Section A cites the National Security Act of 1947, Executive Order 12333, Executive Order 13526, and ICD 705. Section B states the purpose: criteria for the accreditation of SCIFs "to enable reciprocal use by all Intelligence Community (IC) elements" and to facilitate information sharing to the greatest extent possible. Section C applies the standard to the IC and to any other element designated part of it by the President or jointly by the Director of National Intelligence (DNI) and the department head.

Section D, the longest, is titled Accreditation and has 5 numbered parts: the definition of accreditation and the letter of accreditation, the accreditation process, evaluations, re-accreditation, and de-accreditation. Section E, Reciprocity, has 5 parts of its own: the reciprocity rule, the definition of reciprocity as a condition, co-use and joint use, prevention of unauthorized access to compartmented information, and special access program facility accreditation. Section F makes the standard effective on signature.

Two features of the text matter for anyone applying it. First, the standard reserves a role for NCSC itself: to ensure proper implementation, NCSC "may conduct assessments of SCIFs" in coordination with Accrediting Officials (AO) and Cognizant Security Authorities (CSA). Second, the standard rests on a third document, the Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities, which it cites for the Secret-level control of a de-accredited SCIF, the SCIF Co-Use Request and MOA form, and the compartmented area controls. The Tech Spec, Version 1.5 of March 13, 2020, describes itself as the implementing specification for ICD 705 and both standards.

The accreditation life cycle, stage by stage

ICS 705-2 opens its policy with a sentence that sets the frame: accreditation "is the beginning of a life-cycle process" of continuous monitoring and evaluation, periodic re-evaluations, and documentation reviews to keep a SCIF in an accredited state. Reading the standard with the Tech Spec, the life cycle has 7 stages.

1. Concept approval. ICS 705-1 says all SCIF planning begins with sponsorship by an AO. The Tech Spec, Chapter 3, says the 20-page SCIF Pre-Construction Checklist in Chapter 13 (Chapter 14 since Version 1.5.1 of July 26, 2021) may be completed and sent to the CSA or AO as part of the concept approval process, and the Fixed Facility Checklist later records the concept approval date.
2. Design and construction. The AO approves the design concept, the Construction Security Plan (CSP), and the final design before construction starts, and the Site Security Manager runs the CSP for the life of the project.
3. Inspection and document review. ICS 705-2 Section D.2 requires the AO or designee to inspect the SCIF before final accreditation and to review the Fixed Facility Checklist, standard operating procedures, emergency plans, CSP, and any waiver packages. A Certified TEMPEST Technical Authority (CTTA) verifies countermeasures, and the AO may require a technical surveillance countermeasures (TSCM) inspection for a new SCIF or a significant renovation.
4. Interim or final accreditation. For SCIFs outside the United States, the Tech Spec, Chapters 4 and 5, allows an AO to issue an Interim Accreditation after a successful inspection while documentation is pending, or when documentation is complete while the final inspection is pending. Final accreditation is the letter described in the next section.
5. Operation and continuous monitoring. Tech Spec Chapter 12 puts the SCIF Security Officer in charge of a standard operating procedure reviewed annually, an AO-approved emergency plan, annual self-inspections, and immediate reporting of any change in security posture. The AO may suspend or revoke accreditation when conditions are unsatisfactory, in which case the SCIF closes.
6. Re-evaluation and re-accreditation. Covered below.
7. De-accreditation. ICS 705-2 Section D.5 makes de-accreditation a formal notification to the DNI through the SCIF repository, and sends the AO to the Tech Spec for the procedures to sanitize the space so that nothing is left behind.

The letter of accreditation and what it must contain

Section D.1.a of ICS 705-2 defines the letter of accreditation as a formal statement on behalf of the IC element head that a facility has been designed, constructed, inspected, and certified for the protection of all SCI compartments, programs, or special activities under ICD 705. The authority comes from ICD 705 Section D.4, which lets the IC element head delegate accreditation to a single named official, the AO.

The letter has 5 required elements. It identifies the SCIF by unique identifier, location, or both. It states the SCIF type in 2 dimensions: open or closed storage, and the acoustic requirement, which the standard gives as discussion or non-discussion and amplified or non-amplified. It gives the effective date. It states that the SCIF meets all physical, TEMPEST, and technical security standards in place. And it lists approved waivers, including the standards not met and when they are scheduled to be met, or the standards exceeded.

The type statement is what makes the letter portable. ICS 705-1 says reciprocal use is based on the type of facility and gives the example that a SCIF accredited for closed storage and non-amplified discussion is not reciprocal for open storage and amplified discussion. ICS 705-2 Section E.3.e then says the tenant accepts the host's accreditation as it stands, and if a different type is needed, the tenant pays for the modification unless the parties agree otherwise.

ICD 703, Protection of Classified National Intelligence, Including Sensitive Compartmented Information, adds who signs for the branches of government that have no AO of their own. Section F.6 says the Director of the Central Intelligence Agency provides SCIF accreditation for the legislative and judicial branches and for executive agencies outside the IC with no designated CSA, and may delegate that responsibility in writing.

The Fixed Facility Checklist and the accreditation package

The Fixed Facility Checklist (FFC) heads the list of documents ICS 705-2 requires the AO to review. The form is in Chapter 13 of Tech Spec Version 1.5, renumbered Chapter 14 by Version 1.5.1. Version 1.5 runs 21 pages, is marked "UNCLASSIFIED (Until Filled In)," and begins with 2 rows of check boxes: domestic, overseas not under Chief of Mission, or overseas under Chief of Mission; and pre-construction, final accreditation, or update and page change. The same form therefore serves at the start of the project and at every later change, and Tech Spec Chapter 12 lists it among the accreditation documents the Security Officer must keep.

The 9 sections are general information, security in depth, SCIF security, doors, intrusion detection systems, telecommunication systems and equipment baseline, acoustical protection, classified destruction methods, and information systems, TEMPEST, and technical security. Section A asks for the accrediting agency, organization, SCIF identification number, contract number and expiration date where one applies, and the concept approval date. Section I asks whether electronic processing occurs and, if so, directs the preparer to the separate TEMPEST Checklist.

The rest of the accreditation package is listed in Tech Spec Chapter 12. The Security Officer keeps the accreditation, the FFC, the CSP, the CTTA evaluation, the information system accreditation, the standard operating procedures, the final acceptance test of the alarm installation, and the emergency plan, plus, as applicable, TSCM reports, co-utilization agreements, self-inspection reports, the Compartmented Area Checklist, the UL 2050 certificate, and the Pre-Construction Checklist.

Re-evaluation, re-accreditation, and de-accreditation

ICS 705-2 keeps 2 clocks. The evaluation clock, Section D.3, requires the CSA to ensure regular re-evaluations of the SCIF's continued security, including TEMPEST, physical, and technical security, based on the sensitivity of programs, threat, facility modifications, and past security performance, "or at least every five years." Tech Spec Chapter 12 states the same 5-year floor for the AO's inspections and adds that properly cleared inspectors and their TEMPEST and TSCM test equipment are admitted without delay.

The re-accreditation clock, Section D.4, is event-driven. All SCIFs are re-accredited to current standards when there are major modifications, changes to the sensitivity of programs, or changes to the threat, and SCIFs holding waivers issued under previous standards are re-accredited using the most current standards. The CSA reports every re-accreditation to NCSC through the SCIF repository within 30 days. One carve-out protects existing accreditations: creating a Compartmented Area inside a SCIF accredited under an earlier standard does not require re-accrediting the parent SCIF.

A de-accredited SCIF is not lost at once. Section D.4.c says a SCIF that has been de-accredited and controlled at the Secret level, as the Tech Spec defines that in Chapter 1, for less than 1 year may be re-accredited with the AO's approval. The Tech Spec defines that control by reference to 32 CFR Parts 2001 and 2004, and the federal storage requirements for Secret are in 32 CFR 2001.43.

De-accreditation itself is a 9-step closeout in Tech Spec Chapter 12: inspect every area and container and remove anything classified, sensitive, or proprietary; reset safe combinations to 50-25-50 and certify each container empty with a signed and dated note; decertify or dispose of reproduction equipment and SCI computer equipment as the AO approves; request revocation of the information system accreditation, then of the SCIF accreditation; and transfer or discontinue alarm service and account for all keys. ICS 705-2 then records the result as a formal notice in the repository.

Reciprocity, co-use, and joint use

Section E.1 states the rule that gives the standard its name: any SCIF accredited by an IC element AO or designee "shall be reciprocally accepted" for use as accredited by all IC elements when there are no waivers to ICS 705-1, ICS 705-2, and the Tech Spec. Section E.2 defines reciprocity as a condition rather than a status: it occurs when there is a requirement to share an accredited SCIF, or part of one, with a compartment, program, or special activity sponsored by an IC element or organization other than the SCIF's current CSA.

Sharing runs through a co-use agreement. Section E.3 and Tech Spec Chapter 12, Section N, set the rules, which the table summarizes.

Contractors have 2 more rules. A contractor that wants to respond to a white paper or solicitation for an agency other than the host CSA must obtain a government sponsor and a co-use request approved by both CSAs. And the National Industrial Security Program rule at 32 CFR 117.23 says contractors will follow IC directives, standards, and specifications for classified national intelligence and SCI, which brings ICS 705-2 into the contract.

Section E.4 covers what happens inside a shared SCIF. Where personnel are not briefed into all programs, the host and tenant CSAs institute procedures to prevent unauthorized physical, visual, and acoustic access to compartmented information, using the Compartmented Area controls in Tech Spec Chapter 2, Section C: Type I for workstations with no storage or discussion, Type II for discussion rooms with no storage, and Type III for restricted areas that store accountable compartmented information. The parent SCIF's physical, TEMPEST, telephone, and TSCM requirements apply to the Compartmented Area as well.

Waivers and what they do to reciprocity

A waiver can switch reciprocity off, and ICD 705 also lets an IC element head exempt a SCIF from reciprocal use. ICS 705-2 conditions reciprocal acceptance on the absence of waivers, and ICS 705-1 Section H says outright that a waiver for a standard that cannot be met "removes a SCIF from mandatory reciprocal use." The letter of accreditation must list every approved waiver so that a prospective tenant can see the condition before signing a co-use agreement.

ICD 705 sets the procedure. Section D.5 lets the IC element head grant a waiver for a documented mission need and exempt a SCIF from reciprocal use in exceptional circumstances. That authority may be delegated once, to a single named senior official who may be the CSA, and the directive says that "in no case may this official be the same person" as the AO. Section D.6 requires the AO's written request to state the mission need and the specific deviations, Section D.7 requires a recommendation on reciprocal use, and approved waivers are reported to the Director of NCSC within 30 days.

The Tech Spec draws the line between a waiver and a mitigation. Chapter 2 says a mitigation is a verifiable, non-standard method the AO approves as at least equal to the standard's protection level. A mitigation keeps the SCIF inside the standards and therefore inside reciprocity; exceeding a standard, even on a risk basis, requires a waiver. The practical test is whether the shortfall appears on the letter of accreditation as a waiver or in the CSP and FFC as an AO-approved mitigation.

The SCIF inventory and SAPF acceptance

ICD 705 Section D.9 requires the Director of NCSC to manage an inventory of information on all SCIFs, with updates within 30 days of any change. ICS 705-2 uses that repository for re-accreditation results, de-accreditation notices, and, through ICS 705-1, waiver reports. Tech Spec Chapter 12, Section B, lists what each record holds: the SCIF and AO identifiers, location and whether under Chief of Mission authority, type, security in depth, initial accreditation, re-accreditation, and review dates, and for each waiver the approval date, authority, whether a standard is exceeded or not met, and the expiration date. The repository is how an AO in one element learns the accredited type and waiver status of a SCIF in another before agreeing to co-use.

Special access program facilities (SAPF) enter the system through ICS 705-2 Section E.5. When the Tech Spec has been applied to the construction, renovation, and operation of a SAPF, the facility satisfies ICD 705, ICS 705-1, and ICS 705-2 and may be accredited by an IC element as a SCIF. Tech Spec Chapter 1 gives the method: the AO reviews all SAPF documentation, issues SCIF accreditation if it is complete and correct, and is not required to if any is missing or waivers have been authorized. A facility kept as a SAPF and co-utilized as a SCIF runs to the higher of the 2 requirements, and the AO may issue a more restrictive accreditation, for example a 5-minute alarm response instead of 15.

A SCIF in the NIST glossary, citing ICS 700-1, is an area accredited as meeting DNI security standards. ICS 705-2 defines that accreditation and the terms on which it is shared.

What to check

• Whether the host's letter of accreditation states the type the program needs, open or closed storage and discussion or non-discussion, amplified or non-amplified, since the tenant accepts the accreditation as written and pays for any change.
• Whether the letter lists any waiver, which under ICS 705-2 and ICS 705-1 removes the SCIF from mandatory reciprocal use, and whether the shortfall is instead an AO-approved mitigation recorded in the CSP and FFC.
• Whether the work is sponsored by an element other than the host CSA, which requires a co-use agreement on the current form through both Co-Use Coordinators, and whether the tenant will use the host's information system, which makes it joint use and adds the Authorizing Official.
• For a contractor SCIF, whether a co-use agreement exists for this specific contract or proposal, what end date it carries, and whether a government sponsor has been obtained for any proposal to an agency other than the host CSA.
• When the SCIF was last re-evaluated against the 5-year clock, and whether any major modification, sensitivity change, or threat change since then triggers re-accreditation.
• Whether the Fixed Facility Checklist on file reflects the current telecommunications baseline, doors, and alarm configuration.

Azcuna's BABEL reads, translates, and searches foreign-language documents entirely on-device, with no cloud and no connection, and keeps every claim tied to the passage it came from.

Questions people ask

What is ICS 705-2?

Intelligence Community Standard 705-02, Standards for the Accreditation and Reciprocal Use of Sensitive Compartmented Information Facilities, is a 4-page standard signed by the Director of the National Counterintelligence and Security Center on December 22, 2016. It sets the criteria for accrediting a SCIF so that every Intelligence Community element can use it reciprocally. It covers the letter of accreditation, the accreditation process, periodic evaluations, re-accreditation, de-accreditation, reciprocity, co-use and joint use, compartmented areas, and acceptance of special access program facilities.

How does SCIF accreditation work?

ICS 705-2 says the Accrediting Official or a designee inspects and evaluates the SCIF before final accreditation and reviews the design, construction, and operations documents: the Fixed Facility Checklist, standard operating procedures, emergency plans, the Construction Security Plan, and any waiver packages. A Certified TEMPEST Technical Authority verifies countermeasures, and the AO may require a technical surveillance countermeasures inspection. The letter of accreditation then states the SCIF identity, type, effective date, and approved waivers.

What is a SCIF letter of accreditation?

ICS 705-2 defines it as a formal statement on behalf of the IC element head that a facility has been designed, constructed, inspected, and certified to protect all SCI compartments, programs, or special activities under ICD 705. It must include the SCIF identity, the SCIF type covering open or closed storage and acoustic requirements such as discussion or non-discussion and amplified or non-amplified, the effective date, a statement that the SCIF meets all physical, TEMPEST, and technical standards, and any approved waivers.

How often does a SCIF have to be re-accredited?

ICS 705-2 separates evaluation from re-accreditation. The Cognizant Security Authority must have the SCIF re-evaluated based on program sensitivity, threat, facility modifications, and past security performance, or at least every 5 years. Re-accreditation to current standards is required when there are major modifications, a change in program sensitivity, or a change in threat, and for SCIFs holding waivers issued under previous standards. Results of every re-accreditation go to NCSC through the SCIF repository within 30 days.

What is SCIF reciprocity?

ICS 705-2 says any SCIF accredited by an IC element Accrediting Official shall be reciprocally accepted for use as accredited by all IC elements when there are no waivers to ICS 705-1, ICS 705-2, and the IC Tech Spec. Reciprocity is the condition that arises when an accredited SCIF or part of one must be shared with a compartment, program, or special activity sponsored by an IC element or organization other than the SCIF's current Cognizant Security Authority. It requires a co-use agreement.

What is the difference between co-use and joint use of a SCIF?

Under ICS 705-2, co-use is the sharing of an accredited SCIF with a tenant from another IC element or organization under a co-use agreement signed by both Accrediting Officials. Co-use becomes joint use when the proposed tenant wants to use the host's information system, which adds approval by the host's information system Authorizing Official. The agreement is also coordinated with both elements' information system security representatives when the tenant brings its own system into the SCIF. Both use the SCIF Co-Use Request and MOA form in the IC Tech Spec.

Does a waiver affect SCIF reciprocity?

Yes. ICS 705-2 conditions reciprocal acceptance on there being no waivers to ICS 705-1, ICS 705-2, and the IC Tech Spec, and ICS 705-1 says a waiver for a standard that cannot be met removes a SCIF from mandatory reciprocal use. ICD 705 adds that the IC element head may delegate waiver authority to a senior official who may not be the Accrediting Official, that the AO's waiver request must include a recommendation on reciprocal use, and that approved waivers are reported to the Director of NCSC within 30 days.

What is the Fixed Facility Checklist?

The Fixed Facility Checklist is the form in the IC Tech Spec, in Chapter 13 of Version 1.5 and Chapter 14 since Version 1.5.1, that documents a SCIF for accreditation. ICS 705-2 lists it first among the documents the Accrediting Official reviews. Version 1.5 runs 21 pages and is checked as domestic or overseas and as pre-construction, final accreditation, or update. The 9 sections cover general information, security in depth, SCIF security, doors, intrusion detection, telecommunications baseline, acoustics, destruction methods, and information systems, TEMPEST, and technical security.

Can a SAPF be accredited as a SCIF?

ICS 705-2 Section E.5 says that when the IC Tech Spec has been applied to the construction, renovation, and operation of a special access program facility, that facility satisfies ICD 705, ICS 705-1, and ICS 705-2 and can be accredited by IC elements as a SCIF. The Tech Spec, Chapter 1, adds the conditions: the Accrediting Official reviews all SAPF documentation, issues SCIF accreditation if it is complete and correct, and is not required to if documentation is missing or waivers were authorized.

Who keeps the inventory of SCIFs?

ICD 705 Section D.9 makes the Director of the National Counterintelligence and Security Center responsible for an inventory of information on all SCIFs, with IC elements reporting new or updated information within 30 days. The IC Tech Spec, Chapter 12, lists the reportable fields: SCIF and AO identifiers, location, type, security in depth, initial and re-accreditation dates, review date, and each waiver with its approval date, authority, the standard exceeded or not met, and expiration. ICS 705-2 routes re-accreditation and de-accreditation notices through the same repository.

Sources

1. 1Intelligence Community Standard 705-02, Standards for the Accreditation and Reciprocal Use of Sensitive Compartmented Information Facilities · National Counterintelligence and Security Center
2. 2Intelligence Community Directive 705, Sensitive Compartmented Information Facilities · Office of the Director of National Intelligence
3. 3Intelligence Community Standard 705-1, Physical and Technical Security Standards for Sensitive Compartmented Information Facilities · Office of the Director of National Intelligence
4. 4Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities, Version 1.5 · National Counterintelligence and Security Center
5. 5Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities, Version 1.5.1 · National Counterintelligence and Security Center
6. 6Intelligence Community Directive 703, Protection of Classified National Intelligence, Including Sensitive Compartmented Information · Office of the Director of National Intelligence
7. 732 CFR 117.23, Supplement to this rule: Security Requirements for ACCM, SAPs, SCI, RD, FRD, TFNI, and NNPI · Electronic Code of Federal Regulations
8. 832 CFR Part 2001, Classified National Security Information · Electronic Code of Federal Regulations
9. 9Sensitive compartmented information facility (glossary entry) · National Institute of Standards and Technology

Where this shows up in our work

• ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.
• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.