So you just learned you need to build a Sensitive Compartmented Information Facility (SCIF, pronounced “skiff”) but aren’t quite sure where to start? It’s not quite as simple as “build it and they will come.” Without the proper pre-construction steps and information in order, your SCIF construction could have costly delays. Ask yourself the questions below to ensure your facility is on the right track to be accredited by the government as a usable SCIF to store and process classified information.
Do you have a sponsor?
You must have a U.S. government sponsor in order to get a SCIF accredited. Your sponsor is the entity that gave you (or is planning to give you) the classified contract and will issue you a DD-254 form with the requirement for a SCIF. The DD-254 form conveys security requirements to contractors and subcontractors when a contract requires access to classified information. (You can read here for more information regarding the form.)
With the issuance of the DD-254, you will be assigned an accrediting official (AO). You must have approval from an AO for your project prior to the start of construction. To proceed with your project without an AO’s approval would be to “build on risk.” If you do not have approval before the start of your SCIF project, the government is under no obligation to accredit your facility, even if built to accepted SCIF standards.
Do you have a current version of the IC Tech Spec for ICD/ICS 705 to follow as you design and build?
This document, referred to within the industry as the Tech Spec, dictates the process and specifications for building SCIFs. It will outline all the rules and guidelines you need to follow. You can find the most current version of the Tech Spec here.
You must follow the most up-to-date requirements and specifications set by the Tech Spec to have your facility approved as a SCIF. Building to previous versions is not acceptable. It is your responsibility to make sure you are always working from the current specifications, which typically get revised every few years.
What is the use of the space?
Before starting your SCIF construction, you will need a clear understanding of how the facility will be used. These details will inform many factors for building a SCIF and will shape the programming phase of your construction project.
For instance, will the space be utilized as a data center, for manufacturing or for storage? This knowledge could greatly influence your heating and cooling needs. Will the space need a certain amount of workstations for full-time or part-time employees, a conference room or any private offices? Knowledge of all these nuances plays a part in how much space is needed and in creating a comfortable and functional facility.
Gather as many details as you can about how the space will be used. When you have a firm grasp on the function of the space, your project will be set up for success from the start and will likely avoid costly changes after construction is underway.
Where will the SCIF be located?
Whether your SCIF will be new construction or a renovated facility, being strategic with where it is located can save you time and money. For instance, picking a location with no windows is always preferable since all windows end up needing security mitigations, which increase project costs. Ideally your facility will be built toward the center of a building, offering the greatest amount of security and protection. However, if you are not using an existing building or don’t have office space that you can renovate, there are secure facilities, such as modular or container SCIFs, that can be set up as standalone structures on a piece of land or inside a warehouse.
If renovating, it is helpful to know which floor of a building is available to you for your SCIF and to have a good working knowledge about the location. Understanding the composition of the floor and roof above is important as this can affect whether mitigations will need to be implemented to increase hardening or acoustic performance. Furthermore, knowing if the building has a concrete pan deck system can be very helpful in saving money since then you could put the facility on a floor other than the top floor and utilize the concrete pan deck as the SCIF perimeter and not need to build a ceiling system.
Another element to consider is if the general public, which could include foreign nationals, could have unescorted access to your location’s perimeter. If so, you would need to increase the physical hardening of the walls, therefore increasing the cost.
Lastly, consider ease of constructability. What will your access and working hours look like? Will you easily be able to move materials around your project? Transporting materials up multiple floors can add a lot of extra work and cost very quickly, so being prepared before construction is always helpful.
Beyond cost and time implications, all of these factors regarding location will play a part in determining the level of high-security features you will need based on security in depth (SID). If SID already exists in your location, be sure to confirm with the Tech Spec if the standards are up to date.
Has a risk assessment been completed?
The risk assessment is the first required element by the Tech Spec to be completed right away, but more importantly, it drives many of the security design features that will be built. The design of a secure facility cannot be finalized and approved by the AO until the findings of the risk assessment are incorporated into the design. Also, after a risk assessment is conducted, management could decide not to build a SCIF at the location at all, or add other features not thought of before the assessment.
Do workers need to be U.S. persons or U.S. citizens?
If U.S. citizens are required, it can likely restrict your bidder pool and potentially be more expensive. It could also take more time to bid your project. This requirement can be driven by the customer or by the AO.
What level of acoustic protection is required?
Since sensitive and classified information will be discussed in your facility, acoustic protection is required to prevent anyone from hearing that information outside of the secure space. Knowing which level of acoustic protection is key and affects a project’s budget.
The STC (Sound Transmission Class) rating required for your facility is determined by whether the facility utilizes amplified sound, e.g., things like video teleconferencing or speaker phones. If there is amplified sound, STC 50 is required. If there will be no amplified sound, a minimum of STC 45 is required. SCIF perimeter walls always need some type of acoustic protection, but you will need to also consider which STC rating your interior walls will need to meet.
What is your timeline?
Ensure you set proper expectations to allow for all the time that is needed for bidding your project, government approval, the permit processing, construction, accreditation, and move-in. In our experience, it is very rare to see even the smallest project complete that process in less than six months.
Are there any specific building considerations to keep in mind?
Are you aware of any weight limits, access issues, heating/cooling or electrical upgrades needed, adversarial neighbors, or adversarial landlords? Are there any special circumstances for your building like any sort of remediation, lead, asbestos, etc.? All of these factors can affect the time and cost of your project.
The key to a successful accreditation for your SCIF construction—and a truly secure facility—lies in the time you take to answer all of these questions. The quicker you can gather the information to answer these, the more efficient you will be as you start your project. If you’re starting on your path to building a SCIF or SAPF and feel overwhelmed or don’t know where to start, check out Adamo’s SCIF/SAPF Planning Worksheet. This worksheet asks the major questions you need to know to make your project a success from the start.
