How to Make Sure Your SCIF Gets Accredited
Working with an experienced team and familiarizing yourself with the SCIF accreditation process can help you avoid making costly mistakes.
Many of the most costly errors in SCIF accreditation come early on in the project, before or during the design phase. Photo credit: Canva Photos
Building a Sensitive Compartmented Information Facility (SCIF) costs time and money—and if it isn’t done correctly, there is no guarantee that those investments will result in an accredited facility. A SCIF must get accredited before it can become operational.
The path to SCIF accreditation is spelled out in the Intelligence Community Directive (ICD) 705, a government document that identifies the construction and security qualifications a SCIF must meet. Since SCIFs are so different from typical construction projects—and are built relatively infrequently—it can be easy to make mistakes.
In some cases, accreditation errors occur in the rush to win a government contract. A lack of awareness about updates to accreditation requirements can also pose challenges.
“When you're building a secure facility, there's a lot that goes on,” said Phil Chance, a managing partner at Precision Security Consulting who consults on SCIF accreditation. “There are key things where, if you don’t do them, you’re going to be off track.”
Before you embark on a new project, familiarize yourself with the top five errors made in the SCIF accreditation process—and find out how to avoid them.
SCIF Accreditation Error 1: Lacking Justification for a Facility
It starts at the beginning: You need a reason to build a SCIF. That reason can’t be the anticipation of a government contract; in most cases, the contract must be secured before you can begin.
Once a defense contractor wins a project, they will receive a Department of Defense Contract Security Classification Specification (aka DD Form 254), which will enable them to be assigned an accreditation official (AO) to help guide them through the SCIF accreditation process.
Some clients make this major error because they know they’ll need a SCIF quickly if they land a contract—and it takes at least several months to build a new one. “You’re going to want it as soon as possible, and you're going to want to just do it before you have an accrediting official,” Chance said. “But you can’t appropriately get one accredited unless you first have proper justification and an accrediting official.”
Starting to build a SCIF before receiving a DD Form 254 is one of the two most common mistakes clients make, Chance noted.
SCIF Accreditation Error 2: Starting Without an Accrediting Official
The other most common mistake is starting a SCIF design before knowing who the AO will be. The AO, who should be assigned at the beginning of a construction project—even before design starts—is responsible for providing the accreditation and ensuring compliance with the ICD 705 all the way through the process.
The AO should be brought into the process “as soon as the need for a SCIF or SAPF (Special Access Program Facility) is known,” Chance said.
A Site Security Manager (SSM) will often join the project first to start gathering documentation for the AO to review. Both the AO and SSM should be on board to iron out a Construction Security Plan (CSP) before the design process can begin.
“In the ideal situation, you have the AO right away and have had initial conversations about your concepts and project before you even start concept development,” Chance said.
SCIF Accreditation Error 3: Assembling a Lackluster Project Team
Building a SCIF isn’t like building a typical construction project—and you need a team that understands the differences. Picking an experienced SSM helps.
The ideal SSM is someone with a working knowledge of construction who also has security and ICD 705 expertise. As a communicator, they need to be strong, dependable, and capable of keeping the AO updated on the SCIF’s path toward accreditation.
“Not having a qualified SSM would be a huge mistake,” Chance said. It’s best to find your SSM as early as possible so that they can flag potential accreditation errors from the start, he added.
If you don’t have an expert SSM, you’ll need to make up for it by employing consultants and ensuring the rest of your team does have experience building SCIFs. For example, you should carefully review qualifications and references when selecting a contractor to make sure each candidate has a high-quality construction background. When picking an architect, you should make sure that your top candidate has experience with SCIF design and understands the nuances between ICD 705 and typical commercial design and construction.
The architect selection in particular is “an instance where I would always recommend a consultant come in and make sure that everything's working,” Chance said.
Having a less experienced SSM, contractor, architect, or other team member can cause problems, he explained. “Usually those don’t lead to not getting accredited, but it delays the project—and then it’s more expensive.”
SCIF Accreditation Error 4: Overlooking the TCR
TEMPEST (the term used in reference to the investigation, research, and control of potentially compromising emanations that come from electronic devices) requirements differ from one SCIF to the next. Forgetting to ask what those requirements are before the design phase can lead to significant delays and added costs.
Every project needs a TEMPEST Countermeasures Review (TCR), a document that spells out which radio frequency (RF) shielding level the SCIF will need. A Certified TEMPEST Technical Authority (CTTA) will give the TCR to your assigned AO, who will in turn share it with your SSM.
Knowing what your project’s RF shielding requirements are is particularly important, as these security mitigations dictate what materials your SCIF needs and how it must be designed and built.
“A lot of people miss that step,” Chance said, noting that starting without a TCR can cause costly accreditation delays “until they make those improvements.”
“If you find out late, and then you have to order something, and then it takes half of a year to get it—that’s going to be a problem for you.”
SCIF Accreditation Error 5: Lacking Familiarity With the Accreditation Process
Another reason to pick an experienced SSM? They’ll know what accreditation involves, and how to document the build to ensure that your SCIF checks all the boxes.
Over the course of the project, the SSM needs to obtain several documents—including the CSP, Fixed Facility Checklist (FFC), TCR, and more—and follow the directions outlined within each. The SSM also needs to make sure that every step of the process is meticulously documented.
“That's why it's key to have a good SSM: They need to know what those documents are at the beginning so that they can capture what they need to the whole time,” Chance said. That way, when the SSM submits all materials to the AO for accreditation consideration, “they have everything they need that proves, ‘We did it the right way.’”
Ready to get started? Contact Universal Modular, Inc., who has extensive experience in SCIF/SAPF construction and guarantees your SCIF will be accredited.