What is a SAPF?

A SAPF, a Special Access Program Facility, is the room, suite, or building where special access program information is allowed to exist. The National Institute of Standards and Technology (NIST) glossary, citing Volume 4 of the earlier Department of Defense (DoD) SAP security manual series, defines it as a physical space that the cognizant program security officer has formally accredited in writing as meeting the requirements for creating, protecting, handling, discussing, and storing classified or unclassified program information, hardware, and materials. The current rules are in DoD Manual 5205.07, the Special Access Program Security Manual, effective January 17, 2025. For anyone proposing software or hardware for one, the facts that matter are that the walls are built to the SCIF standard, that the accreditor answers to the program rather than to the Intelligence Community, and that devices that store, record, or transmit are generally kept out.

What a special access program is

A SAPF exists because of the information it holds. Executive Order 13526, signed December 29, 2009, defines a special access program (SAP) in Section 6.1 as a program established for a specific class of classified information that imposes safeguarding and access requirements "that exceed those normally required" for information at the same classification level. The NIST glossary entry for SAP, drawing on Intelligence Community Standard 700-1, uses the same words.

Section 4.3 of the order limits who may create one. Unless the President authorizes otherwise, only the Secretaries of State, Defense, Energy, and Homeland Security, the Attorney General, and the Director of National Intelligence, or each one's principal deputy, may do so, and the Director of National Intelligence exercises the function for intelligence sources, methods, and activities. A SAP may be created only when a statute requires it or on a specific finding that the vulnerability of, or threat to, the information is exceptional and that normal eligibility criteria for the classification level are not sufficient to protect it. The order tells those officials to keep the number of programs to an absolute minimum, to limit each one to a reasonably small number of people, to keep an accounting system, and to review every SAP annually.

So a SAP is not a classification level. The information in one is Confidential, Secret, or Top Secret like any other, and Section 1.2 of the order says no other terms shall be used to identify classified information. What the SAP adds is a smaller circle of people and stricter handling, and the SAPF is the physical half of that handling.

SAPF vs SCIF

The most common search question about SAPFs is how they differ from a SCIF, a Sensitive Compartmented Information Facility. The short answer is that the building is the same and the paperwork is different.

DoD Manual 5205.07 says in Section 15.3 that the physical security safeguards in the National Counterintelligence and Security Center (NCSC) Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities, which it calls the NCSC SCIF Specifications, and the Intelligence Community Directive (ICD) 705 series "are the physical standards for protection of SAP information." Construction of every type of SAP area must conform to the equivalent facility in the version of the specifications in effect when the area is first accredited. The post on SCIFs walks through what those specifications require, from wall assemblies to alarm response times.

The Intelligence Community says the same thing from its side. Intelligence Community Standard (ICS) 705-02, dated December 22, 2016, states in Section E.5 that when the IC Tech Specs have been applied to the construction, renovation, and operation of SAPFs, those facilities satisfy ICD 705, ICS 705-01, and ICS 705-02, which enables them to be accredited as SCIFs. Chapter 1 of the IC Tech Spec, Version 1.5, dated March 13, 2020, describes how: the Accrediting Official reviews the SAPF documentation, issues SCIF accreditation if all of it is available and correct, and is not required to if it is not or if waivers were authorized. A facility kept as a SAPF and co-utilized as a SCIF is held to the higher requirement of the two.

What differs is listed below.

SAPF requirements: who accredits and who runs it

Section 15.1 of DoD Manual 5205.07 sets the basic rule. Other than the narrow SCIF exception described below, SAP information and materials may only be processed, handled, discussed, or stored in a SAPF. Systems containing SAP components may be employed and tested in open-air facilities that are not accredited when that is part of their intended purpose, under administrative procedures approved by the cognizant authority SAP central office (CA SAPCO).

SAPFs are accredited by SAPF accrediting officials, written SAPF-AO in the manual, who are designated by the CA SAPCOs. The glossary defines the SAPF-AO as an official authorized to accredit DoD SAPFs according to standards in ICD 705 and any supplemental CA SAPCO procedures. A program security manager (PSM) or program security officer (PSO) may also serve as the SAPF-AO if the CA SAPCO designates one. Day-to-day operation belongs to the government SAP security officer (GSSO) or contractor SAP security officer (CSSO), who must tell the SAPF-AO about anything that affects, or could affect, the accreditation.

For contractors, the manual adds a gate. A DoD contractor under the National Industrial Security Program must hold a facility security clearance (FCL), validated by the PSM or PSO, before a SAPF-AO may accredit a SAPF in its facility. The classification level of SAP information in that SAPF cannot exceed the lower of the FCL classification level and the FCL safeguarding level. Once accredited, any U.S.-accredited SAPF may be used for any DoD SAP up to the level for which it is accredited.

The types of SAP-accredited areas

Section 15.3 names 4 subtypes of SAPF, each with different capabilities and limits.

• Temporary SAPF (T-SAPF). SAP information may be processed, handled, discussed, and stored. A T-SAPF may be accredited for a maximum of 12 months from initial accreditation to de-accreditation, and the clock does not stop when the space is idle. It may not be de-accredited and re-accredited to get around the limit, and it may not be set up in a space that was a T-SAPF or SAP temporary secure working area for more than 6 months in the past 2 years.
• SAP compartmented area (SAPCA). Required when different compartmented programs share one SAPF, or when SAP information is processed in a SCIF and not all personnel are cross-briefed. The SAPF-AO must concur with the visual, acoustic, and access control measures.
• SAP working area (SAPWA). The glossary defines it as an accredited area where discussion and non-persistent processing of SAP information is authorized and no storage is authorized.
• SAP temporary secure working area (SAPTSWA). Processing, handling, and discussion without storage, for a maximum of 40 hours per month, under the same 12-month and 6-months-in-2-years limits as a T-SAPF. Re-accreditation as a SAPTSWA requires a new physical inspection.

How a SAPF is built and accredited

The process in Sections 15.5 through 15.7 of the manual mirrors the SCIF process, with the SAPF-AO in the Accrediting Official's chair.

Before construction, the SAPF-AO reviews the physical security preconstruction plan for compliance with the NCSC SCIF Specifications, documents any mitigation and security-in-depth, and approves or disapproves in writing. The requester submits the appropriate checklists from the specifications, including the Fixed Facility Checklist (FFC), classified according to the program's security classification guide. A TEMPEST countermeasure review by a Certified TEMPEST Technical Authority (CTTA) is required for all SAPFs, and a technical surveillance countermeasures (TSCM) review of the plan is recommended. A major renovation, as determined by the SAPF-AO, pulls the space onto the version of the specifications in effect at the time of the renovation rather than the version it was built to.

During construction, the SAPF-AO approves the design concept, the construction security plan, and the final design before work starts. Photographs are taken during all phases to document compliance and become part of the accreditation packet; the manual says they should be kept for the life of the facility. A site security manager develops the construction security plan with the SAPF-AO, inspects the site during construction, and reports violations and deviations within 24 hours. The PSM or PSO physically inspects the finished SAPF against ICD 705 standards and sends a final report to the SAPF-AO once every deficiency is corrected.

After accreditation, Section 15.7 requires periodic re-inspections based on threat, physical modifications, sensitivity of the programs, and past security performance, "no less frequently than every 3 years," with announced or unannounced inspections possible at any time. Every SAPF must keep on site its current FFC and construction photographs, its physical, TEMPEST, and information system accreditation documents, any waivers granted by the CA SAPCO, TSCM reports for the entire period of accreditation, and its operating procedures, co-utilization agreements, appointment letters, and emergency action plans.

Where full compliance is not possible, Section 15.4 lets the SAPF-AO recommend mitigations under the analytical risk management process in the specifications, but any waiver must include a risk mitigation plan approved in writing by the CA SAPCO, with copies to DoD SAPCO. One consequence is spelled out: a SAPF accredited with such a waiver is not eligible for the discussion or handling of SCI, under a Director of National Intelligence memorandum of November 30, 2023.

TEMPEST in a SAPF

Section 15.13 of the manual covers TEMPEST, the control of compromising emanations from equipment. A CTTA must conduct or validate every TEMPEST countermeasure review in accordance with the NCSC SCIF Specifications and Committee on National Security Systems Instruction 7000. If the review finds that countermeasures are required, the CTTA recommends the most cost-effective one that will contain compromising emanations within the inspectable space.

The manual is careful about what the review implies. Processing classified information, or submitting a facility for review, "does not imply a requirement to implement TEMPEST countermeasures." Only countermeasures the CTTA recommends and the government program manager or government SCI contracting official authorizes should be installed. The list the CTTA may draw from includes shielded sections or architectural shielding, equipment with TEMPEST profiles or zones that match the inspectable space, and RED and BLACK separation of classified and unclassified lines under CNSS Advisory Memorandum TEMPEST/01-13. Telephone line filters, power filters, and non-conductive disconnects are not required for TEMPEST purposes unless a CTTA recommends them. When a recommended countermeasure is not implemented, the CA SAPCO or a designee must accept the risk in writing.

Access, devices, and daily operation

Sections 15.9 through 15.12 describe life inside the space.

Only assigned SAP-indoctrinated personnel have unescorted access to a SAPF, and the manual says GSSOs and CSSOs should keep access rosters where practicable. The PSM or PSO may require a badge system when the people inside cannot personally identify everyone with access, which the manual says normally happens above 25 people. When unoccupied, a SAPF is alarmed in secure mode and locked with a General Services Administration FF-L-2740A combination lock meeting Federal Specification FF-L-2740B. Entrance door combinations are recorded on Standard Form 700 and stored in a different SAPF accredited at the same or higher level, and a lock taken out of service is reset to 50-25-50. Each SAPF also has procedures for inspecting personal belongings and vehicles at entry and exit, which legal counsel must review before implementation.

On devices, Section 15.12 says unclassified portable electronic devices (PEDs) that store, record, or transmit information "are generally prohibited in SAPFs." Devices that do none of those things, such as calculators, receive-only pagers, and radios, are authorized. So are devices with minimal transmission, such as car key fobs, that have no user-accessible storage and no camera, microphone, cellular, Bluetooth, or Wi-Fi capability, and personal fitness devices such as step counters and health rings that have no user-accessible storage and no microphone, camera, cellular, or Wi-Fi capability. Anything else requires review and approval by the SAPF-AO and the information system security manager before it comes in. A table in the manual adds that privately owned and wireless headsets, microphones, and webcams are prohibited and that built-in microphones and webcams are prohibited on unclassified computers.

Co-use, co-accreditation, and SAP work inside a SCIF

Two sections cover sharing. Section 15.2 lets a CA SAPCO accept an existing SCIF accreditation, instead of a separate SAPF accreditation and without the co-utilization agreement otherwise required, and authorize discussion, handling, and processing of SAP information in private offices and conference rooms of that SCIF. The conditions are specific: everyone present must be accessed to the SAP and must be a U.S. citizen or an SCI-indoctrinated citizen of Australia, Canada, New Zealand, or the United Kingdom; at least one person must be indoctrinated into the SCI compartments in use and tied to the SCIF; someone must coordinate with the special security officer in advance; and non-indoctrinated participants are escorted. Standalone SAP laptops, tablets, and read books that need no network connection may be brought in with special security officer and PSM or PSO approval. SAP material may not be printed or stored in the SCIF unless the space is itself accredited as a SAPF.

Section 15.8 defines the two sharing arrangements. Co-utilization is a SAPF used for SAP information under the cognizance of 2 or more CA SAPCOs. Co-accreditation is a space accredited as both a SAPF and a SCIF, so that SAP and SCI can be processed, handled, discussed, and stored in the same facility. A co-utilization agreement (CUA) documents authorities and responsibilities between the organizations sharing a SAPF; the first organization in the space is the host unless agreed otherwise, the tenant initiates the agreement, and both PSMs or PSOs and each organization's government or contractor activity manager, unit commander, or appropriate industry official approve it before the new SAP arrives. A CUA between a contractor and the government ends at the end of the period of performance for either party. A tenant accepts the host's accreditation if the SAPF was accredited without waiver, and the host must tell tenants about every waiver and compensating measure for the life of the agreement. A space used for both SCI and SAP must be accredited as a SAPF under the manual and as a SCIF under ICD 705, with a CUA in place before occupancy so each accreditor knows about the other's use.

The SAP security manual and where contractors fit

The document behind all of this changed in 2025. DoD Manual 5205.07 reissues the former Volume 1 of June 18, 2015 and, under Section 1.2, incorporates and cancels Volume 2 on personnel vetting of November 24, 2015, Volume 3 on physical security of April 23, 2015, a September 28, 2022 memorandum that made enrollment in continuous evaluation or continuous vetting a prerequisite for SAP access, and a November 21, 2023 memorandum on SAP work in accredited SCIFs.

For contractors, the National Industrial Security Program Operating Manual rule at 32 CFR 117.23 says contractors will implement the security requirements for SAPs codified in SAP-related policy "when established by contract," and that contractors on SAP contracts issued by non-DoD agencies implement the requirements their contracts impose. The manual itself devotes Section 10 to contracting and Section 12 to the people. A SAP that protects information up to Secret requires a final Secret eligibility based on a Tier 3 or equivalent investigation, and a SAP that protects Top Secret information requires a final Top Secret eligibility based on a Tier 5 or equivalent investigation. Nominees meet the eligibility requirements when enrolled in a DoD continuous vetting program or the Office of the Director of National Intelligence continuous evaluation system, and a nominee who is not enrolled needs additional justification. Under Section 13, the SAP nomination process checks 3 things: a final clearance based on a favorable adjudication, demonstrated need-to-know, and access eligibility.

None of these documents is about software. One consequence still follows directly from the rules above. A system inside a SAPF sits behind a perimeter where devices that store, record, or transmit are generally prohibited, and that treats a standalone laptop as the normal way to bring computing into a shared room. A program that calls a vendor's cloud for inference, licensing, updates, or telemetry has nowhere to call from. A program that makes no outside calls needs no such path.

What to check

• Which document governs the space: DoD Manual 5205.07 for a DoD SAPF, or the requirements a non-DoD agency wrote into the contract under 32 CFR 117.23.
• Which version of the NCSC SCIF Specifications the area was accredited to, and whether a planned renovation will pull it onto the current version.
• Whether the SAPF was accredited with a waiver, which bars SCI discussion and handling there and must be disclosed to every tenant.
• Whether the software needs to connect to anything outside the room, and whether it still works when it cannot.
• Whether the work will happen in a SAPF, a SAPCA inside a SCIF, or a SCIF conference room under an accepted accreditation, since printing and storage are allowed only in the first 2.
• Whether a co-utilization agreement exists, who the host is, and when it ends.

Azcuna's BABEL reads, translates, and searches foreign-language documents entirely on-device, with no cloud and no connection, and keeps every claim tied to the passage it came from.

Questions people ask

What is a SAPF?

A SAPF is a special access program facility. The NIST glossary, citing Volume 4 of the earlier DoD Manual 5205.07 series, defines it as a physical space that the cognizant program security officer has formally accredited in writing as meeting the requirements for creating, protecting, handling, discussing, and storing classified or unclassified program information, hardware, and materials. The current manual, effective January 17, 2025, says SAP information may be processed, handled, discussed, or stored only in a SAPF, with narrow exceptions for open-air testing and accredited SCIFs.

What is the difference between a SAPF and a SCIF?

The construction is the same. DoD Manual 5205.07 says the NCSC SCIF specifications and the ICD 705 series are the physical standards for SAP information. The differences are in what is protected and who runs the space. A SCIF holds sensitive compartmented information under Director of National Intelligence policy and an Intelligence Community accrediting official. A SAPF holds special access program information under a SAPF accrediting official appointed by the program's central office, with re-inspection at least every 3 years rather than 5.

Who accredits a SAPF?

DoD Manual 5205.07 says SAPFs are accredited by SAPF accrediting officials designated by the cognizant authority SAP central office, called the CA SAPCO. The accrediting official reviews preconstruction plans, inspects the space before accreditation, and may withdraw accreditation. A program security officer may also serve as the accrediting official if the CA SAPCO designates one. A contractor must hold a facility security clearance, validated by the program security officer, before a SAPF in its building can be accredited.

Does a SAPF require TEMPEST?

Yes, a review is always required. DoD Manual 5205.07 says a TEMPEST countermeasure review is required for all SAPFs and must be provided by a Certified TEMPEST Technical Authority. The review does not always lead to countermeasures. The manual says processing classified information does not by itself imply a requirement to implement them, and only countermeasures the CTTA recommends and the government program manager authorizes should be installed. When a recommended countermeasure is not implemented, the CA SAPCO must accept the risk in writing.

Can you bring a phone into a SAPF?

Generally no. DoD Manual 5205.07 says unclassified portable electronic devices that store, record, or transmit information are generally prohibited in SAPFs. Devices that do none of those things, such as calculators and receive-only pagers, are authorized, as are key fobs with minimal transmission and no storage, camera, microphone, cellular, Bluetooth, or Wi-Fi. Fitness devices with no storage, microphone, camera, cellular, or Wi-Fi are also allowed. Anything else needs review and approval by the SAPF accrediting official and the information system security manager before it enters.

What is a SAPCA?

A SAPCA is a SAP compartmented area, one of the subtypes of SAPF in DoD Manual 5205.07. The manual requires one when different compartmented programs share the same SAPF, or when SAP information is processed in a SCIF and not all personnel are cross-briefed. The SAPF accrediting official must concur with the visual, acoustic, and access control measures. Spin-dial combination locks are prohibited on SAPCA doors, and the area uses a zone of the parent alarm system rather than its own.

What is a temporary SAPF?

A T-SAPF is a temporary SAPF. DoD Manual 5205.07 allows one to be accredited for a maximum of 12 months from initial accreditation to de-accreditation, regardless of how much of that time it is used. The space may not be de-accredited and re-accredited to get around the limit, and it may not be set up in a space that was a T-SAPF or a SAP temporary secure working area for more than 6 months in the past 2 years. Extensions go to the CA SAPCO.

Can SAP work be done inside a SCIF?

Yes, within limits. DoD Manual 5205.07 lets the CA SAPCO accept an existing SCIF accreditation and authorize SAP discussion in private offices and conference rooms of the SCIF. Everyone present must be accessed to the SAP and be a U.S. citizen or an SCI-indoctrinated citizen of Australia, Canada, New Zealand, or the United Kingdom. Standalone SAP laptops may be brought in with approval, but SAP material may not be printed or stored in the SCIF unless the space is itself accredited as a SAPF.

What is the SAP security manual?

DoD Manual 5205.07, the Special Access Program Security Manual, is the Department of Defense procedures document for SAP security. The edition effective January 17, 2025 reissues the former Volume 1 on general procedures and incorporates and cancels Volume 2 on personnel vetting and Volume 3 on physical security, so one document now covers both people and facilities. Section 15 holds the physical security procedures for SAPFs, and Section 12 holds the personnel vetting rules for SAP access.

What clearance do you need for SAP access?

A final clearance at the level of the program, plus program approval. DoD Manual 5205.07 says a SAP protecting information up to Secret requires a final Secret eligibility based on a Tier 3 or equivalent investigation, and a SAP protecting Top Secret information requires a final Top Secret eligibility based on a Tier 5 or equivalent investigation. Nominees not enrolled in continuous vetting need added justification, and the SAP nomination process checks a final clearance, demonstrated need-to-know, and access eligibility.

Sources

1. 1DoD Manual 5205.07, Special Access Program Security Manual · Department of Defense
2. 2Executive Order 13526, Classified National Security Information · National Archives and Records Administration
3. 3Intelligence Community Directive 705, Sensitive Compartmented Information Facilities · Office of the Director of National Intelligence
4. 4Intelligence Community Standard 705-02, Standards for the Accreditation and Reciprocal Use of Sensitive Compartmented Information Facilities · National Counterintelligence and Security Center
5. 5Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities, Version 1.5 · National Counterintelligence and Security Center
6. 632 CFR 117.23, Supplement to this rule: Security Requirements for ACCM, SAPs, SCI, RD, FRD, TFNI, and NNPI · Electronic Code of Federal Regulations
7. 7Special access program facility (glossary entry) · National Institute of Standards and Technology
8. 8Special access program (glossary entry) · National Institute of Standards and Technology

Where this shows up in our work

• ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.
• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.