General SCIF perimeters include all walls that outline the SCIF confines, floors, ceilings, doors, windows and penetrations by ductwork, pipes, and conduit. This section describes recommended methods to meet the standards described within ICS 705-1 for SCIF perimeters. Perimeter wall construction specifications vary by the type of SCIF, location, use of SID, and discussion requirements. Closed storage that do not require discussion areas do not have any forced entry or acoustic requirements. Open storage facilities without SID require additional protection against forced and surreptitious entry. When an existing wall is constructed with substantial material (e.g., brick, concrete, cinderblock, etc.) equal to meet the perimeter wall construction standards, the existing wall may be utilized to satisfy the specification. Closed Storage, Secure Working Area (SWA), Continuous Operation, or Open Storage with SID - Use Wall A - Suggested Standard Acoustic Wall (see construction drawing for details). Three layers of ⅝ inch-thick wallboard, one layer on the outside of the SCIF and two on the inside of the SCIF provide adequate rigidity and acoustic protection (Sound Class 3). Wallboard shall be attached to 3 ⅝ inch-wide metal studs or wooden 2 x 4 studs placed a maximum of 24 inches on center. Continuous runners (same gauge as studs) for securing studs shall be anchored to the true floor and true ceiling structures. The interior two layers of wallboard be mounted so that the seams do not align (i.e., stagger joints). Acoustic fill shall be placed between the studs in a manner which prevents slippage. The top and bottom of each wall be sealed with an acoustic sealant where it meets the slab. Wall penetrations shall be treated and sealed with acoustic material. Entire wall assembly shall be finished and painted from true floor to true ceiling. Open Storage without SID -- Use Wall B - Suggested Wall for Expanded or Wall C - Suggested Wall for Plywood. Three layers of ⅝ inch-thick wallboard, one layer on the outside of the SCIF and two on the inside of the SCIF provide adequate rigidity and acoustic protection (Sound Class 3).
TOP SECRET/SCI-indoctrinated U.S. citizens are present on a 24-hour basis in the SCIF or the SCIF can be properly secured and alarmed. Prescribed post security resources are in to monitor the SSA. Construction Security Requirements Prior to awarding a construction contract, a CSP for each project shall be developed by the SSM and approved by DoS/DS and DoS/OBO and the tenant AO. Construction plans and all related documents shall be handled and protected in accordance with the CSP. For SCIF renovation projects, barriers shall be installed to segregate construction workers from operational activities. These barriers will provide protection against unauthorized access and visual observation. Specific guidance shall be contained in the CSP. When expanding existing SCIF space into areas not controlled at the SECRET level, maximum demolition of the new SCIF area is required. For areas controlled at the SECRET level that meet OSPB pre-conditions, or when performing renovations inside existing SCIF space, maximum demolition is not required. All requirements for demolition shall be documented in the CSP. Periodic security inspections be conducted by the SSM or designee for the duration of the project to ensure compliance with construction design and security standards. Citizenship and Clearance Requirements for SCIF Construction Personnel Use of workers from countries identified as critical for Technical or Human Intelligence threat, or listed on the DoS Prohibited Countries Matrix, is prohibited. General construction and finish work is defined by OSPB standards. General construction of SCIFs shall be performed using U.S. citizens and U.S. firms. Use of foreign national citizens or firms to perform general construction of SCIFs may be authorized in accordance with OSPB standards. In this situation, the CSP shall prescribe mitigating strategies to counter security and counterintelligence threats. SCIF finish work shall be accomplished by appropriately cleared personnel as directed by OSPB standards for CAA construction. All non-cleared construction personnel provide the SSM with biographical data (full name, current address, SSN, DPOB, proof of citizenship, etc.), and fingerprint cards as allowed by local laws prior to the start of construction/renovation. Two forms of I-9 identification are required to verify U.S. persons.
Vents, ducts, and similar openings with a cross-sectional measurement greater than 96 inches shall be protected by a fixed barrier or security grill. (This requirement is not applicable to through-ducts that do not open into the SCIF.) Grills shall be fabricated of steel or aluminum grating or bars with a thickness equal to the perimeter barrier. If a grating is used, bridge center-to-center measurements will not exceed 1.5 inches by 4 inches. Bars be mounted in a grid pattern, six-inches on center. The grating or bars shall be welded into place. Construction of the SCIF perimeter shall afford adequate sound attenuation. Air handling units and ducts may require baffles if SCIF discussions can be overhead in adjacent areas. The SCIF shall be equipped with an AO-approved intrusion detection system (IDS) or other countermeasures if SCI-indoctrinated personnel cannot continuously occupy the area. Passing scuttles and windows should not be installed between the SCIF and any other space on the ship. If installed, they shall be secured on the inside of the SCIF. All SCI cryptographic and processing equipment shall be located within the SCIF. Unclassified telecommunications meet the requirements outlined in Chapter 11, to the greatest extent practical. telephones will not be permitted in the SCIF without additional mitigations determined by the AO. If a deviation is granted, sound-powered telephones located within the SCIF and connecting to locations outside the SCIF shall comply with the following: Telephone cables shall not break out to jack-boxes, switchboards, or telephone sets other than at designated stations. Cables shall not be shared with any circuit other than call or signal systems associated with the SCIF circuit. Telephone cables shall be equipped with a selector switch located at the controlling station and shall be capable of disconnecting all stations, selecting any one station, and disconnecting the remaining stations. telephones not equipped with a selector switch shall have a positive disconnect device attached to the telephone circuit. Within any SCIF, sound-powered telephones not used for passing SCI information shall have a warning sign prominently affixed indicating the restriction.
General Requirements for T-SCIFs SCIFs on sub-surface vessels shall be accredited as T-SCIFs. T-SCIFs aboard a vessel include portable platforms or containers temporarily placed within ship space such as embarked Portable Shipboard Collection Vans. T-SCIFs shall be occupied by an SCI-indoctrinated person at all times unless the facility is protected by a GSA-approved lock, an approved intrusion detection system, and a response capability or other countermeasures approved by the AO. Security Requirements for T-SCIFs Overall T-SCIF construction standards shall be the same as those used for permanent shipboard SCIFs. Vents, ducts, and similar openings shall be constructed to the same standards as those used for a shipboard SCIF. SCI materials shall be destroyed by means approved by the AO when no longer needed. AO-approved emergency destruction shall be rehearsed periodically by all personnel assigned to the T-SCIF and the rehearsals documented. Unclassified telecommunications shall meet the requirements for a shipboard SCIF, to the greatest extent practical. When the T-SCIF is no longer required, the responsible SCI security official shall conduct a closing inspection of the T-SCIF to ensure all SCI material has been removed. The CTTA shall conduct a TEMPEST countermeasures inspection and shall recommend safeguards to limit compromising emanations. TEMPEST safeguards should be pre-engineered into platforms to the greatest extent possible. Additional Security Standards for Mobile Platforms or Containers Construction of the perimeter must be of sufficient strength to reveal evidence of physical penetration (except for required antenna cables and power lines). must fit securely and be equipped with a locking device that can be locked from the inside and outside. SCI Storage and Destruction SCI material shall be stored in a GSA-approved security container that is welded or otherwise permanently secured to the structural deck. When no longer needed, SCI materials shall be destroyed by means approved by the AO.
[Date] [Address] SCIF Fixed Facility Checklist CLASSIFY ACCORDING TO FACILITY SPONSOR CLASSIFICATION GUIDANCE Applicable blocks □ Domestic □ Overseas Not COM [ ] Overseas COM □ Pre-construction, Complete Sections as Required by A/O □ FFC Accreditation □ Update/Page Change Checklist Contents Section A: General information
e. Has or will CSA requested any waivers? □ Yes □ No □ N/A If yes, attach a copy of approved waiver Construction/Modification (Ref: Chapter 3B) Is construction or modification complete? □ Yes □ No □ N/A If no, enter the expected date of completion Was all construction completed in accordance with the CSP? □ Yes □ No □ N/A If not, explain changes. 7. Inspections (Ref: Chapter 12G) Has a TSCM Inspection been performed □ Yes □ No If yes, provide the following a. TSCM Service completed by On ________________ (Attach a copy of report) Were deficiencies corrected? □ Yes □ No □ N/A If no, explain b. Last physical security inspection by On ________________ (Attach a copy of report) Were deficiencies corrected? □ Yes □ No □ N/A If no, explain c. Last Staff Assistance Visit by: On ________________ (Attach a copy of report)
Are office areas adjacent to the SCIF controlled and alarmed? If yes, describe adjacent areas and types of alarm systems. □ Yes □ No Controlled by SCIF Owner? If controlled by Bldg owner, alarm activation reported to SCIF owner by agreement? □ Yes □ No □ Yes □ No 4. Security In-Depth What external security attributes and/or features should the AO consider before determining whether or not this facility has Security In-Depth? Please identify/explain all factors: Section C: SCIF Security 1. How is access to the SCIF controlled (Ref: Chapter 8) a. By Force □ Yes □ No If yes, what is their minimum security clearance level? b. Is Guard Force Armed? □ Yes □ No □ N/A c. By assigned personnel? □ Yes □ No If yes, do personnel have visual control of SCIF entrance door? d. By access control device? □ Yes □ No If yes, what kind? □ Automated access control system □ Non-Automated If Non-Automated
1. Is there a by-pass key? □ Yes □ No □ N/A If yes, how is the by-pass key protected? 2. Manufacturer: Model: (Attach sheet if additional space is required for this information) If Automated 1. Is there a by-pass key? □ Yes □ No □ N/A If yes, how is the by-pass key protected? 2. Manufacturer: Model: (Attach sheet if additional space is required for this information) 3. Are access control transmission lines protected by 128-bit encryption/FIBS 140? □ Yes □ No If no, explain the physical protection provided. 4. Is automated access control system located within a SCIF or an alarmed area controlled at the SECRET □ Yes □ No 5. Is the access control system encoded and is ID data and PINs restricted to SCI-indoctrinated personnel? □ Yes □ No 6. Does external access control outside SCIF have tamper protection? □ Yes □ No 7. Is the access control device integrated with IDS □ Yes □ No □ N/A 8. Is the access control device integrated with a LAN/WAN System? □ Yes □ No □ N/A 2. Does the SCIF have windows? (Ref: Chapter 3F) a. Are they acoustically protected? □ Yes □ No □ N/A If yes, how? Please explain
d. Is a door sweep/thresholds installed? □ Yes □ No If no, please explain e. Is an acoustical/astragal strip installed? □ Yes □ No If no, please explain 2. Describe number and type of used for SCIF emergency exits and other perimeter doors including day access (show on floor plan) a. Do the doors and doorframes meet sound attenuation requirements? □ Yes □ No If no, have acoustical countermeasures been employed? □ Yes □ No b. Has exterior hardware been removed? □ Yes □ No c. Has local enunciator been installed? □ Yes □ No Describe how the door hinges exterior to the SCIF are secured against removal (if in an uncontrolled area). 3. Locking Devices a. Is the primary entrance door equipped with a GSA-approved pedestrian door deadbolt meeting Federal Specification FF-L-2890 including lock meeting FF-L-2740A □ Yes □ No b. List combination lock manufacturer, model number and group rating Manufacturer: Model Number: c. Does the entrance door stand open into an uncontrolled area? □ Yes □ No If yes, please describe tamper protection. d. Emergency exits and other perimeter doors: Describe (locks, metal strip/bar, deadbolts, local annunciation, and panic hardware).
Section F: Telecommunication Systems and Equipment Baseline 1. Is the facility declared a “No Classified Discussion Area”? (Ref: Chapter 11A) □ Yes □ No If yes, then the audio protection questions within this section may be identified as N/A If the facility is declared a “No Classified Discussion Area”, are warning notices posted prominently within the facility? □ Yes □ No □ N/A 2. Does the facility have any unclassified telephones that are connected to the commercial public switch telephone network (PSTN)? □ Yes □ No What is the method of on-hook protection? 1) CNSSI 5006 (TSG-6) approved telephone or instrument □ Yes □ No □ N/A (Please identify all telephone equipment/stations and/or instruments being used either below or as an attachment) Manufacturer Model Number TSG Number (if applicable) 2) CNSSI 5006 (TSG-6) approved disconnect device? □ Yes □ No □ N/A a. Line disconnect? □ Yes □ No □ N/A b. Ringer protection? □ Yes □ No □ N/A Manufacturer Model Number TSG Number (if applicable) 3) CNSSI 5002 (TSG-2) configured computerized telephone system (CTS)? □ Yes □ No □ N/A a. If yes, please provide the following information about the CTS Manufacturer Model b. If yes, please provide specific location of the CTS
If yes, what kind? □ Volatile (information in memory clears/erases when powered off) □ Non-volatile (information in memory that remains when powered off) d. Does the M-FOM have a digital hard drive? □ Yes □ No □ N/A e. Have maintenance and disposition procedures been established? □ Yes □ No □ N/A f. Does the M-FOM have voice transmission capability and/or a telephone handset? □ Yes □ No □ N/A If yes, how is this feature protected? Please describe 5. Are there any video teleconference (VTC) systems installed? □ Yes □ No If yes, what of information is the VTC system processing? Which room(s) contain VTC systems? 6. Are there any commercial television receivers installed? □ Yes □ No If yes, provide a separate annotated floor plan of the commercial television system 7. Does the SCIF have any automated environmental infrastructure systems? □ Yes □ No If yes, describe what countermeasures have been taken to provide against malicious activity, intrusion, and exploitation. (Example: premise management systems, environmental control systems, lighting and power control units, uninterrupted power sources) 8. REMARKS: Section G: Acoustical Protection 1. Do all areas of the SCIF meet AO required acoustical protection standards”? (Ref: Chapter 9A) □ Yes □ No
Describe procedures to secure the CA at the end of day. 3. CAs with a requirement for discussions of compartmented information– Type 2: Are all individuals within the CA briefed to the compartment? □ Yes □ No If No, describe procedures to prevent inadvertent disclosure of compartmented information. Is the CA constructed to meet ICS 705-1 acoustic standards? □ Yes □ No If Yes, describe acoustic protection method used. Is secure teleconferencing equipment to be used? □ Yes □ No Describe the procedures for controlling access during program discussions and control of meeting material used (if applicable) during and after the discussions. 4. CAs with a requirement for strict accountability of compartmented information– Type 3: Are all personnel who have unescorted access to the CA briefed to the compartmented program? □ Yes □ No Does the CA meet ICS standard for acoustic protection? (if applicable) □ Yes □ No If Yes, describe acoustic protection method used. Are storage containers GSA approved? □ Yes □ No Are all equipment (computers, copiers, printers, scanners, fax, etc.) used to process compartmented information approved or a system security plan (SSP) submitted for approval? □ Yes □ No 5.
Describe the procedures for controlling access during program discussions and control of meeting material used (if applicable) during and after the discussions. In addition, include any remarks to assist in the approval process. 6. Additional security measures alarms, dedicated reading rooms, etc.) are considers waivers (above) to the standards and require approval of the IC Element Head. Identify any additional security requirements requested: Section C: Compartmented Area Type Descriptions 1. Compartmented Area Type I: A workstation environment that is used to view and process compartmented information. Type I comprises open bays, open spaces, or a set of rooms with multiple cubicles in an accredited SCIF where compartmented information may be securely viewed and/or processed, i.e., via an approved computer workstation by authorized personnel. Workstations in these environments may include computers with single or multiple monitors. Polarized privacy screens may be used on a computer monitor to prevent persons other than the authorized user to view the material, i.e., shoulder surfing, or when a monitor faces a primary door or common work area. In addition to processing compartmented information on approved computer workstations, Type I CAs may include the use of printers, copiers, and scanners with prior approval.
Commercial Telephone Secure Telephone 5. Accreditation Data a. Category/Compartments of SCI Requested: 1) Indicate storage requirement: □ Open □ Closed □ Continuous Operation □ None 2) Indicate the facility type □ Permanent □ Temporary Secure Working Area □ Secure Working Area □ Tactical b. Existing Accreditation Information (if applicable) 1) SCIF accesses required 2) Accreditation granted by: On: 3) Waivers: 4) Co-Use Agreements □ Yes □ No If yes, provide sponsor/compartment: c. SAP(s) co-located within SCIF □ Yes □ No If yes, identify SAP Classification level (check all that apply) □ SCI □ Top Secret □ Secret □ Confidential d. SCIF duty hours to hours) days per week e. Total square footage that the SCIF occupies f. Has CSA requested any waivers? □ Yes □ No □ N/A If yes, attach a copy of the approved waiver 6. Construction/Modification Is construction or modification complete? □ Yes □ No □ N/A If no, enter the expected date of completion 7. Inspections a. TSCM Service completed by On ______________ (Attach a copy of report) b. Were deficiencies corrected? □ Yes □ No □ N/A If no, explain
Type Manufacturer Model Remarks 10. Commercial Interconnection Equipment Are any commercial intercommunications equipment installed within the SCIF? □ Yes □ No Remarks 11. Pneumatic Tube Systems Are there any pneumatic tube systems installed in the SCIF? □ Yes □ No Are they installed IAWICS 705-1, Section E?? □ Yes □ No Remarks Section E: Classified Destruction Methods 1. Destruction methods Describe the method and equipment used for destruction of classified/sensitive material (if more than one method or device, use Remarks to describe. (If more than one device, use remarks to list all manufacturer and Method Device Manufacturer Is a secondary method of destruction available? □ Yes □ No Describe the location of destruction site(s) in relation to the secure facility: Describe method or procedure used for handling non-soluble classified/sensitive material at this facility: Do you have a written Emergency Action Plan (EAP) approved by CSA (if required)? □ Yes □ No □ N/A Remarks Section F: TEMPEST/Technical Security 1. Does the facility electronically process classified information? □ Yes □ No
b. Is Guard Force Armed? □ Yes □ No c. By Assigned Personnel: □ Yes □ No If Yes, do personnel have visual control of the entrance door? □ Yes □ No □ N/A d. When processing SCI, are all personnel aboard the aircraft cleared for all the SCI compartments that the aircraft is accredited for? □ Yes □ No If not, what are the procedures for segregating/protecting SCI compartments from unauthorized disclosure? 3. Hatches and Doors Leading Inside the Aircraft: a. Are doors equipped with GSA approved locks? □ Yes □ No Manufacturer Model b. Are tamper serialized seals used when aircraft is unoccupied? □ Yes □ No If yes, are seals installed and a log book maintained by SCI cleared personnel? □ Yes □ No c. Remarks 4. Acoustical Isolation a. Is a physical perimeter established around the aircraft at a distance so as to prevent inadvertent disclosure of SCI discussions or briefings from within the aircraft □ Yes □ No b. In instances where the physical perimeter barrier is not sufficient to control voices or sounds, are sound countermeasure devices or sound generating devices used? □ Yes □ No c. Remarks 5. Visual Isolation a. Are doors or other openings in the aircraft through which the interior may be viewed screened or curtained? □ Yes □ Yes b. Remarks 6. Procedures For Protecting SCI When The Aircraft Is Parked In Friendly/Unfriendly Territories
Make Model Manufacturer Function k. Does the IDS extend beyond the SCIF perimeter? □ Yes □ No Can the status of PCU be changed from outside IDS protection? □ Yes □ No If yes, is an audit conducted daily? □ Yes □ No Has the IDS configuration been approved by the CSA? □ Yes □ No l. Do any intrusion detection equipment components have audio or video capabilities? □ Yes □ No If yes, please explain: Has the CSA mitigated this capability? □ Yes □ No m. IDS Administrator SCI indoctrinated? □ Yes □ No n. External Transmission Line Security: What is the method of line security? Meets NIST; FIPS AES Encryption? □ Yes □ No If yes, has the encryption been certified by National Institute of Standards and Technology (NIST) or another independent testing laboratory? □ Yes □ No If not NIST FIPS AES, is there an alternate? □ Yes □ No If yes, please explain: Does the alternate line utilize any cellular or other Radio Frequency (RF) capability? □ Yes □ No If yes, provide manufacturer and Manufacturer Model o. Does any part of the IDS use a local or Wide Are Network? □ Yes □ No □ N/A (1) Is the Network Intrusion Detection Software (NIDS) administrator at least Top Secret (collateral) cleared? □ Yes □ No □ N/A (2) Is the host computer dedicated solely for security purposes? □ Yes □ No □ N/A (3) Is the host computer secured within an alarmed area controlled at the Secret or higher level? □ Yes □ No □ N/A
(4) Is the host computer protected through firewalls or similar devices? □ Yes □ No □ N/A Are the firewalls/devices configured to only data transfers between IDS components? □ Yes □ No □ N/A (5) Is the password for the host computer unique for each user and at least 8 characters long? □ Yes □ No □ N/A (6) Is the password changed semi-annually? □ Yes □ No (7) Are remote security terminals protected the same of the host computer? □ Yes □ No □ N/A If no, please explain: p. Was the IDS installed by U.S. citizens: □ Yes □ No □ N/A If no, please explain: q. Is emergency available for the IDS? □ Yes □ No □ N/A What type? Generator □ Yes □ No If yes, how many hours? _______ What type? Battery □ Yes □ No If yes, how many hours? _______ r. If applicable, describe the method of ventilation and duct work protection: s. Where is the IDS Alarm Monitor Station located? t. Does the Monitor Station have any remote capabilities (i.e., resetting alarms, issuing PINs, accessing/securing alarms, etc)? □ Yes □ No □ N/A If yes, please explain: u. Does the IDS have any automatic features (i.e., timed auto-secure, auto-access capabilities)? □ Yes □ No □ N/A v. Does the PCU/keypad have dial out capabilities? □ Yes □ No w. IDS Response Personnel (1) Who provides initial response? (2) Does the response force have a security clearance? □ Yes □ No If yes, what is the clearance level: (3) Do you have a written agreement for external response force? □ Yes □ No (4) Emergency procedures documented? □ Yes □ No