SCIF, closed area, and restricted area: what each term means

A cleared contractor keeps classified material in one of a few kinds of space, and the names are easy to mix up. A closed area and a restricted area are terms from the National Industrial Security Program Operating Manual (NISPOM), 32 CFR Part 117, and they hold collateral classified information under the eye of the cognizant security agency. A Sensitive Compartmented Information Facility (SCIF) is accredited under Intelligence Community Directive 705 and holds sensitive compartmented information (SCI). A Special Access Program Facility (SAPF) is the special access program counterpart, built to the same specification as a SCIF. Underneath all of them sit the General Services Administration (GSA)-approved security container and the vault. Each has a different approver, construction standard, and storage rule, and software proposed for classified work ends up in one of them.

Closed area vs restricted area under the NISPOM

The two NISPOM terms are defined in 32 CFR 117.3, and the definitions turn on what happens at the end of the working day.

A closed area is an area that meets the rule's requirements for safeguarding classified material that, because of its size, nature, or operational necessity, "cannot be adequately protected by the normal safeguards" or stored during nonworking hours in approved containers. The material stays out. A bay with a classified assembly on the floor or a room of classified servers is a closed area, because neither fits in a safe at 5 p.m.

A restricted area is a controlled access area established to safeguard classified material that, because of its size or nature, cannot be adequately protected during working hours by the usual safeguards, but is capable of being stored during nonworking hours in an approved repository or secured by other methods the cognizant security agency (CSA) approves. The material comes out while people work and goes back into a container at night. The restricted area controls who walks in during the day; the closed area must also protect the material when nobody is there.

The current rule carries these two definitions but sets no construction standard of its own for closed areas. Instead, 32 CFR 117.15(c) directs that classified material be stored in GSA-approved security containers, in vaults built to Federal Standard 832, or in an open storage area constructed in accordance with 32 CFR 2001.53, following 32 CFR 2001.43 for each level. A closed area in NISPOM language is an open storage area in the language of 32 CFR Part 2001. The approval under 117.15(a) comes from the CSA, which for Department of Defense (DoD) contractors acts through the Defense Counterintelligence and Security Agency (DCSA). Section 117.9(a)(3) adds that the determination of a safeguarding capability is separate from the facility clearance itself: a company can be cleared for access and still have no approved place to store anything.

Where the construction rules live: 32 CFR 2001.53

32 CFR Part 2001 is the Information Security Oversight Office's directive implementing Executive Order 13526, and 2001.53 sets the minimum construction standards for open storage areas:

• Perimeter. Walls, floors, and ceiling are permanently constructed and attached to each other, and all construction is done so as to provide "visual evidence of unauthorized penetration."
• Doors. Doors are wood, metal, or other solid material. Entrance doors carry a built-in GSA-approved three-position combination lock; the agency head may authorize other locks for Secret and Confidential storage. Other doors are secured from inside with deadbolt emergency egress hardware, a deadbolt, or a rigid bar across the door.
• Vents and ducts. Any opening over 96 square inches and over 6 inches in its smallest dimension gets bars, expanded metal grills, commercial sound baffles, or coverage by an intrusion detection system.
• Windows. Any window that could afford a view of classified activity is made opaque or covered. Windows within 18 feet of the ground are built from or covered with material that resists forced entry, no stronger than the adjoining wall. Inside a controlled compound, inoperable windows covered by an alarm may satisfy the requirement.

Section 117.15(c) adds that where an open storage area has a false ceiling or raised floor, the contractor writes procedures to ensure their structural integrity, and that the contractor tells its CSA when a building code conflicts with Part 2001.

Supplemental controls, intrusion detection systems, and security in depth

Construction keeps people out; supplemental controls detect the ones who get in. 32 CFR 2001.43(b) sets them by level:

Security in depth is defined in 32 CFR 117.3 as a CSA determination that the contractor's security program consists of layered and complementary controls sufficient to deter and detect unauthorized entry and movement, such as perimeter fences, access controls, an intrusion detection system (IDS), random guard patrols, and closed circuit video. A facility with it earns the longer response times.

Section 117.15(d) writes the alarm rules for contractors. CSA approval is required before an IDS is installed, and the CSA bases that approval on ICD 705 and Intelligence Community standards, Underwriters Laboratories Standard 2050, or written CSA-specific standards. Installation is by an alarm company certified by a nationally recognized testing laboratory (NRTL), and a current NRTL certificate, issued through that company, is the evidence of compliance. The central monitoring station is supervised continuously by a U.S. citizen eligible for Secret, the IDS is activated at the close of business whenever cleared personnel are not present, records of every alarm are kept for 12 months, and 80 percent of responses must fall within the time limit. Where traffic or distance makes the Top Secret times impossible, the CSA may authorize up to 30 minutes. One detail catches people: under Federal Standard 809, no IDS sensors are installed on GSA-approved containers themselves; the alarm protects the room, not the safe.

GSA-approved container: classes, labels, and how to buy one

32 CFR 117.3 defines an approved security container as a GSA-approved container originally procured through the Federal Supply System that bears the GSA approval label on its front face, showing it met the federal specification and has been maintained under Federal Standard 809. The authority is 32 CFR 2001.42(a), which has the GSA Administrator publish uniform standards, specifications, and qualified products lists for classified storage equipment.

ISOO Notice 2026-06, dated August 31, 2026, consolidates the current guidance. GSA coordinates with agencies through the Interagency Advisory Committee on Security Equipment, which maintains the specifications and qualified products lists. Containers and vault doors must be bought through GSA Global Supply by national stock number. All storage equipment for classified information "shall have the GSA approval label," the label cannot be reproduced, and a container reconditioned, refurbished, or remanufactured outside the GSA procurement process, including one sold to a private party through reutilization, may not hold classified information. Since October 1, 2012, under 32 CFR 2001.43(b), non-GSA-approved containers are out unless otherwise authorized under 32 CFR 2001.40(b). The notice's table of current specifications lists FF-L-2740 and FF-L-2938 electromechanical combination locks, FF-L-2890 lock extensions for pedestrian doors, AA-F-358 filing cabinets, AA-C-2786 information processing system cabinets, AA-C-363 map and plan cabinets, and AA-D-600 vault doors in Classes 5V and 5B.

The GSA purchasing guide, published June 2026, describes the equipment:

Both classes use locks meeting FF-L-2740. New file cabinets and vault doors carry a red approval label, information processing system cabinets a blue one, and black labels mark equipment made before 1990 that is being phased out. The ISOO notice sets the end-of-service dates: October 1, 2028 for black-label Class 5 and Class 6 cabinets, and October 1, 2035 for black-label vault doors. Effective April 1, 2026, GSA moved the program to brand-name national stock numbers. GSA's ordering page repeats the October 1, 2012 rule and says any classified material still in a non-approved container must be moved immediately.

Vault requirements for classified information

Both 32 CFR 2001.43(b) and 32 CFR 117.15(c) accept a vault built to Federal Standard 832 as storage for any level, and 117.3 defines an approved vault as one built to that standard and approved by the CSA. A vault's advantage shows in the supplemental control table: Secret in a FED-STD 832 vault needs no supplemental control, while Secret in an open storage area needs security in depth plus patrols or an alarm. Repairs to vault doors, like repairs to containers, follow Federal Standard 809 under 2001.43(e).

The Intelligence Community's Technical Specifications for Construction and Management of SCIFs, Version 1.5 of March 13, 2020, spells out what a vault looks like in Chapter 3. Walls, floor, and ceiling are at least 8 inches of reinforced concrete with a compressive strength of at least 2,500 pounds per square inch, reinforced with steel rods at least 5/8 inch in diameter on 6 inch centers, tied or welded at the intersections and anchored into the ceiling and floor. Where a concrete vault cannot be built, 1/4 inch welded steel plate may substitute, and a GSA-approved modular vault meeting Federal Specification AA-V-2737 is also acceptable. Every vault gets a GSA-approved Class 5 vault door, which is not used to control day access.

A SCIF under ICD 705

Intelligence Community Directive 705, signed May 26, 2010 and later amended to name the National Counterintelligence and Security Center (NCSC), states the rule in one sentence: "All SCI must be processed, stored, used, or discussed in an accredited SCIF." Every SCIF must be accredited before use, the head of an Intelligence Community element accredits, re-accredits, and de-accredits SCIFs or delegates that authority to a single named Accrediting Official (AO), and the element head may waive the uniform requirements on a documented mission need. The directive replaced Director of Central Intelligence Directive 6/9. The longer post on what a SCIF is covers the directive, the standards, and the facility rules in depth.

Two documents below the directive matter for the comparison here. ICS 705-02, dated December 22, 2016, says a letter of accreditation is a formal statement on behalf of the element head that a facility has been "designed, constructed, inspected, and certified" for SCI, and that the letter states the SCIF type: open or closed storage, and discussion or non-discussion, with any waivers. Re-evaluation happens at least every 5 years. A co-use agreement is required for each contracting effort performed in an accredited contractor SCIF, the tenant accepts the host's accreditation, and if the tenant needs a different type, say open storage where the host built closed storage, the tenant pays for the modification.

The IC Tech Spec turns the type into construction. Chapter 3 says closed storage areas that do not require discussion "do not have any forced entry or acoustic requirements," while open storage without security in depth needs added protection against forced and surreptitious entry. Closed storage, secure working areas, continuous operation, and open storage with security in depth use Wall A, three layers of 5/8 inch gypsum wallboard on 16 gauge metal or wooden 2 x 4 studs that the Tech Spec places no less than 16 inches on center, with acoustic fill, finished from true floor to true ceiling. Open storage without security in depth uses Wall B or Wall C, which add 3/4 inch mesh expanded metal or 1/2 inch plywood inside the wall. The one primary door carries a GSA-approved deadbolt meeting FF-L-2890, a combination lock meeting FF-L-2740, and an access control device. Alarm response for SCIFs in the United States follows 32 CFR Parts 2001 and 2004: 15 minutes for closed storage, and for open storage 15 minutes with security in depth or 5 minutes without. Two lesser spaces exist inside the same framework: a secure working area, accredited for discussing, handling, and processing SCI but not storing it, and a temporary secure working area, limited to less than 40 hours of SCI use per month and 12 months of accreditation, with no special construction and no storage.

On the contractor side, 32 CFR 117.23(b) says contractors follow Intelligence Community directives, standards, and specifications for SCI, and 117.23(a) makes acceptance of those contract security measures a prerequisite to an SCI facility accreditation. Section 117.15(d) even borrows ICD 705 as one basis for approving a collateral alarm system.

A SAPF

A special access program (SAP) is defined in Executive Order 13526, Section 6.1(oo), as a program for a specific class of classified information that imposes safeguarding and access requirements that "exceed those normally required for information at the same classification level." Section 4.3 lets only a few cabinet officials, the Director of National Intelligence, or their principal deputies create one, and only when a statute requires it or on a finding that the vulnerability of, or threat to, the information is exceptional and normal access criteria are not sufficient.

A SAPF is the facility for such a program. The NISPOM treats SAPs the way it treats SCI: 32 CFR 117.23(d) says contractors implement the SAP security requirements codified in SAP policy when a contract imposes them, and 117.23(a) names the SAP facility accreditation as one of the area accreditations that depend on accepting those terms. The construction standard is shared. Chapter 1 of the IC Tech Spec says that when the specification has been applied to construction, renovation, and operation of a SAPF, the facility satisfies ICD 705 and may be accredited by an Intelligence Community element as a SCIF, once the AO reviews the construction documentation. ICS 705-02, Section E.5, says the same. A facility maintained as a SAPF and co-utilized as a SCIF takes the higher of the two postures; the Tech Spec gives the examples of a 5-minute rather than 15-minute response and closed rather than open storage. What the DoD SAP manual adds on top of that, such as who the SAPF accrediting official is, comes through the contract and the program security officer rather than the NISPOM.

Who approves each space and what it may hold

Two rules cut across the table. Under 32 CFR 2001.45(a)(1), repeated in 117.15(e)(4), combinations to vaults, open storage areas, and containers are protected at the level of the highest classified information inside. And under 32 CFR 2001.44, once a facility is authorized or accredited for classified use at a level, other agencies accept that approval without added requirements, provided no waiver was granted.

What to check

• Which term the site uses, and which document defines it. A "closed area" is approved by the CSA under 32 CFR 117; a "SCIF" is accredited by an Intelligence Community element under ICD 705.
• Whether the facility clearance comes with an approved safeguarding capability under 32 CFR 117.15, and at what level. Access eligibility and storage approval are separate determinations under 117.9(a)(3).
• Whether the space is open or closed storage, and whether security in depth has been determined. Those two facts set the alarm response time and the wall.
• Whether every container carries a red or blue GSA approval label, and whether any black-label cabinets or vault doors are approaching the October 1, 2028 and October 1, 2035 end-of-service dates.
• Whether the alarm certificate from the NRTL-listed company is current, and whether the CSA approved the system before installation.
• For SCI or SAP work, what the accreditation letter or co-use agreement says the space is approved for, and when the agreement ends.

Azcuna's BABEL reads, translates, and searches foreign-language documents entirely on-device, with no cloud and no connection, and keeps every claim tied to the passage it came from.

Questions people ask

What is a closed area under the NISPOM?

32 CFR 117.3 defines a closed area as an area that meets the rule's safeguarding requirements for classified material that, because of its size, nature, or operational necessity, cannot be adequately protected by the normal safeguards or stored during nonworking hours in approved containers. In practice it is a room or bay where classified material stays out when nobody is there, so the room itself, rather than a container, becomes the storage. 32 CFR 117.15(c) sends contractors to 32 CFR 2001.53 for how such an open storage area is built.

What is the difference between a restricted area and a closed area?

Both are defined in 32 CFR 117.3. A restricted area is a controlled access area for classified material that cannot be adequately protected during working hours by the usual safeguards, but can be stored during nonworking hours in an approved repository or secured by another method the cognizant security agency approves. A closed area is for material that cannot be put away at the end of the day. The restricted area controls access while people work; the closed area also has to protect the material overnight.

What is an open storage area?

An open storage area is a room approved to hold classified material outside a container. 32 CFR 2001.43(b) lists it as one of three places Top Secret may be stored, alongside a GSA-approved container and a vault built to Federal Standard 832. 32 CFR 2001.53 sets the minimum construction: walls, floors, and ceiling permanently constructed and attached, built to show visual evidence of penetration, solid doors with a GSA-approved three-position combination lock, protected vents over 96 square inches, and windows made opaque and hardened within 18 feet of the ground.

What are the supplemental controls for a closed area?

32 CFR 2001.43(b) sets them by level. For Top Secret in an open storage area covered by security in depth, an intrusion detection system with responders arriving within 15 minutes; without security in depth, within 5 minutes. For Secret, security in depth is required where an open storage area is used, plus either an inspection every 4 hours by an employee cleared at least to Secret or an intrusion detection system with a 30-minute response. Confidential needs no supplemental controls. 32 CFR 117.15(d) sets the alarm standards contractors follow.

What is the difference between a SCIF and a closed area?

A closed area is a NISPOM term from 32 CFR 117.3 for a space, approved by the cognizant security agency, where collateral classified material is protected in the open. A SCIF is a facility accredited under Intelligence Community Directive 705 for sensitive compartmented information. ICD 705 says all SCI must be processed, stored, used, or discussed in an accredited SCIF, and 32 CFR 117.23 tells contractors to follow Intelligence Community directives and specifications for SCI. A closed area therefore cannot hold SCI.

What is a GSA-approved container?

32 CFR 117.3 defines an approved security container as a GSA-approved container originally procured through the Federal Supply System that bears the GSA approval label on its front face, showing it met the federal specification and has been maintained under Federal Standard 809. The General Services Administration's June 2026 purchasing guide says two classes are made today, Class 5 and Class 6, both approved for Confidential, Secret, and Top Secret documents, and both using combination locks meeting Federal Specification FF-L-2740. Since October 1, 2012, non-GSA-approved containers may not hold classified information.

What is the difference between a Class 5 and a Class 6 container?

The GSA purchasing guide published in June 2026 gives the ratings. Both classes protect against 30 man-minutes of covert entry and 20 man-hours of surreptitious entry and are approved for Secret, Top Secret, and Confidential information. Class 5 adds 10 man-minutes of forced entry protection and may also hold funds, weapons, controlled substances, and information processing equipment. Class 6 has no forced entry requirement and is used for documents, maps, drawings, and plans. Vault doors are Class 5 only, under Federal Specification AA-D-600.

What are the vault requirements for classified information?

32 CFR 2001.43(b) and 32 CFR 117.15(c) require a vault to be built to Federal Standard 832, and 32 CFR 117.3 adds that an approved vault is one the cognizant security agency has approved. For SCIF vaults, Chapter 3 of the IC Tech Spec gives the dimensions: walls, floor, and ceiling of at least 8 inches of reinforced concrete rated at 2,500 pounds per square inch, with 5/8 inch steel reinforcing rods on 6 inch centers, or a GSA-approved modular vault meeting Federal Specification AA-V-2737. Every vault gets a GSA-approved Class 5 vault door.

Who approves a closed area, a SCIF, and a SAPF?

Different officials. Under 32 CFR 117.15(a), a contractor stores classified material only with approval from its cognizant security agency, which for Department of Defense contractors acts through DCSA, and 117.15(d) requires CSA approval before an alarm system is installed. Under ICD 705, the head of an Intelligence Community element accredits SCIFs or delegates that to a single named Accrediting Official. Under 32 CFR 117.23, special access program facility requirements and the SAP facility accreditation come through the contract and SAP policy rather than the NISPOM baseline.

Can a SAPF be used as a SCIF?

Yes, if it was built to the SCIF specification. Chapter 1 of the IC Tech Spec says a SAPF built, maintained, and operated to the specification satisfies ICD 705 and may be accredited by an Intelligence Community element as a SCIF after the Accrediting Official reviews the construction documentation. ICS 705-02 says the same. If a facility is kept as a SAPF and co-utilized as a SCIF, its security posture goes to the higher of the two requirements, for example a 5-minute rather than 15-minute alarm response, or closed rather than open storage.

Sources

1. 132 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM) · U.S. Government Publishing Office, GovInfo
2. 232 CFR Part 2001, Classified National Security Information · U.S. Government Publishing Office, GovInfo
3. 3Intelligence Community Directive 705, Sensitive Compartmented Information Facilities · Office of the Director of National Intelligence
4. 4Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities, Version 1.5 · National Counterintelligence and Security Center
5. 5Intelligence Community Standard 705-02, Standards for the Accreditation and Reciprocal Use of Sensitive Compartmented Information Facilities · National Counterintelligence and Security Center
6. 6Executive Order 13526, Classified National Security Information · National Archives and Records Administration, Information Security Oversight Office
7. 7ISOO Notice 2026-06: Standards for GSA Approved Security Equipment · Information Security Oversight Office
8. 8GSA-Approved Security Container and Vault Door Program: Program Information and Purchasing Guide, June 2026 · General Services Administration
9. 9Ordering security containers · General Services Administration

Where this shows up in our work

• ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.
• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.