Enclosure 2_N40080RFI24RP00048_ICD ICS DoDM Book Combined47.pdf

Singularity Security Group, LLC.

SCIF/SAPF Construction Series Documents

Intelligence Community Directive (ICD) – 705 Intelligence Community Standard (ICS) – 705-1 Intelligence Community Standard (ICS) – 705-2

IC Tech. Spec. for ICD/ICS-705 Department of Defense Manual (DoDM) 5105.21.v2 Department of Defense Manual (DoDM) 5205.07.v3

This book is intended for use during the ICD-705 SCIF/SAPF Training Program presented by Singularity Security Group, LLC.

ICD/ICS-705 Series Documents

This book is proprietary and confidential. No parts of this book may be copied/replicated without expressed written consent of Singularity Security Group, LLC. Contact Adam.Jones@SingularitySG.com for additional information.

Welcome to the Singularity Security Group, LLC. ICD-705 Overview and SCIF/SAPF design training course. The five (5) day SSG ICD-705 Overview and SCIF/SAPF Design training program is intended for any US citizen associated with ICD-705 construction projects, and/or anyone that needs to better understand the SCIF/SAPF construction lifecycle, security professionals and non-security professionals alike. The following is a general outline of the five

(5) day agenda, subject to change upon request for customized training courses:

∞ Day 1: ICD-705, ICS-705-1, ICS-705-2, ICD/ICS-705 Tech. Spec. Chapters 1-6

∞ Day 2: ICD/ICS-705 Tech. Spec Chapters 7-13 & Additional/In-Depth Focus on Concept

Approval & Pre-Construction Checklist

∞ Day 3: SCIF/SAPF Design Considerations, Process, and overall Approach

∞ Day 4: SCIF/SAPF Design Review Phases, Required Security Involvement, and Process

∞ Day 5: Construction Site Security (CSS) Planning, Requirement Identification, and

Implementation (both operational and cost/funding), with special focus on Construction

Security Plan (CSP) development, timing, and execution.

Common Acronyms & Definitions

The following is a list of common acronyms and definitions that are routinely used on ICD-705 construction projects. This list is intended to identify the most frequently used terms and phrases, but there may be many others on individual projects. All persons working on ICD-705 projects should at least be familiar with the following:

∞ Accreditation – The formal certification by a CSA that a facility, designated area, or information system has met DNI security standards for handling, processing, discussing, disseminating, or storing SCI.

∞ ACF – Access Control Facility. Temporary facility operated by CAGs/CSTs during construction as a point of access control onto and off of the SCS. Primary functions are:

Personnel Inspections, Identity Verifications, and Badge Exchange. Secondary functions are: Storage of controlled items, Security Meeting Point, SSM/CST Lead Office Area, and Security Staff breakroom. Size and operations are project specific.

∞ ACS – Access Control System. Electronic system(s) used to control access to controlled access areas.

∞ AO – Accrediting Official. A U.S. government employee who has been designated by the

CSA to provide security oversight of all aspects of SCIF construction under their security

This book is proprietary and confidential. No parts of this book may be copied/replicated without expressed written consent of Singularity Security Group, LLC. Contact Adam.Jones@SingularitySG.com for additional information.

purview; accredit SCIFs under their cognizance; and review and approve the SCIF design concept, CSP, and final design for each construction project. Operationally oversees

(directly or indirectly) the SSM in relation to SCIF CSS. May delegate substantial authorities to the SSO.

∞ Black. Designation applied to information systems, and to associated areas, circuits, components, and equipment, in which national security information (NSI) in encrypted or is not processed.

∞ BMS – Building Management System, a.k.a. Building Automation System (BAS). A computer-based control system installed in buildings that controls and monitors the building's mechanical and electrical equipment such as ventilation, lighting, power systems, fire systems, and/or security systems.

∞ CA – Compartmented Area. An area, room, or set of rooms within a SCIF that provides controlled separation between control systems, compartments, sub-compartments, or

Controlled Access Programs.

∞ CAG – Cleared American Guard. A Secret or TS cleared U.S. citizen experienced with, and trained in, formal access control and personnel/vehicle inspection procedures/methods to ensure the security integrity of a construction site. Reports operationally to the SSM. Can work in and outside of the US.

∞ CE – Compromising Emanations. Unintentional signals that, if intercepted and analyzed, would disclose the information transmitted, received, handled, or otherwise processed by telecommunications or automated information systems equipment.

∞ CCTV – Closed Circuit Television. A TV system in which signals are not publicly distributed but are monitored, primarily for surveillance and security purposes.

∞ Collateral – All national security information (NSI) classified under the provisions of an executive order for which special community systems of compartmentation (e.g. non-SCI and/or General Service Classified Information) are not formally established.

∞ COM – Chief of Mission. The head of a diplomatic representation, such as an ambassador or chargé d'affaires.

∞ CSA – Cognizant Security Authority or Cognizant Security Agency. The single principal designated by a Senior Official of the Intelligence Community (SOIC) to serve as the

This book is proprietary and confidential. No parts of this book may be copied/replicated without expressed written consent of Singularity Security Group, LLC. Contact Adam.Jones@SingularitySG.com for additional information.

responsible official for all aspects of a security program management concerning the protection of NSI, sources and methods, under SOIC responsibility.

∞ CSP – Construction Security Plan. A plan outlining security protective measures that will be applied to each phase of the construction project. The requirements set forth in this plan provide the baseline for construction security activities and may be supplemented as required but may not be reduced without coordination and approval from the Accrediting

Official (AO). Developed by the SSM, approved by AO. Always project specific.

∞ CSS – Construction Site Security. The overall security measures implemented during a

SCIF construction project to ensure complete security. Includes all personnel security

(SSM, CST, CAG, etc.) and physical security (Fence, ACF, IDS, etc.).

∞ CST – Construction Surveillance Technician. A TS cleared (may be SCI based project requirements, or secret with AO approval) US citizen experienced in construction and trained in accordance with the ICD-705 to ensure the security integrity of a construction site. Requires experience/knowledge with both security and construction. Reports operationally to the SSM. Can work in and outside of the US. ***CSTs and security escorts are NOT the same thing and should not be used interchangeably***

∞ CTTA – Certified TEMPEST Technical Authority. A U.S. government employee who has met established certification requirements in accordance with the Committee on

National Security Systems (CNSS).

∞ Facility Accreditation – An official determination of the physical, procedural, and technical security acceptability of a facility that authorizes its use to protect classified national security information.

∞ FFC – Fixed Facility Checklist. A standardized document used in the process of certifying a SCIF. It documents all physical, technical, and procedural security information for the purpose of obtaining an initial or subsequent accreditation. Blank copy found in Chapter 13 of the Tech. Spec. for ICD/ICS-705.

∞ HSS – High Security Switch (formerly Balanced Magnetic Switch – BMS). A two-part sensor that generates an alarm condition when a change in the magnetic field between the parts is detected. Usually mounted on a door and doorframe to detect opening of the door.

∞ IDS – Intrusion Detection System. A technical security system designed to detect an attempted or actual unauthorized entry into a secure facility and alert responders.

This book is proprietary and confidential. No parts of this book may be copied/replicated without expressed written consent of Singularity Security Group, LLC. Contact Adam.Jones@SingularitySG.com for additional information.

∞ ICD 705 – Intelligence Community Directive number 705. Governing directive on SCIF construction, renovation, and management. Applies to all SCIFs.

∞ ICS 705-1 – Intelligence Community Standard number 705-1. Physical and Technical

Security Standards for SCIFs.

∞ ICS 705-2 – Intelligence Community Standard number 705-2. Standards for the

Accreditation and Reciprocal Use of SCI.

∞ IC Tech. Spec. for ICD/ICS – Intelligence Community Technical Specifications for the

ICD/ICS 705. Aka. The ‘Tech. Spec’. Technical Specifications for Construction and

Management of SCIFs.

∞ MNS – Mass Notification System. A system that provides real-time information and instructions to people in a building, area, site, or installation using intelligible voice communications along with visible signals, text, and graphics, and possibly including tactile or other communication methods.

∞ NSI – National Security Information. Any information that has been determined, pursuant to EO 12958 or predecessor, to require protection against unauthorized disclosure and that is so designated.

∞ PDS – Protective Distribution System. Wire line or fiber optic system that includes adequate safeguards and/or countermeasures (e.g. acoustic, electric, electromagnetic, and physical) to permit its use for transmission of unencrypted information through an area of lesser classification or control. Refer to CNSSI No. 7003.

∞ PED – Portable Electronic Device. Electronic devices having the capability to store, record, and/or transmit text, images/video, or audio data.

∞ Random Procurement – Method of acquiring, from existing local off-the-shelf stock, by

TS cleared U.S. citizens, materials for use in the new construction or modification to an existing SCIF or secure work area. Procurement of material will be unannounced, made without referral and immediately transported by the procurer to an SSA.

∞ Random Selection – The process of selecting a portion of building materials from bulk shipment procured for non-specific general construction use.

∞ Reciprocity – Recognition and acceptance, without further processing, of: 1) security background investigations and clearance eligibility determinations; 2) accreditations of

This book is proprietary and confidential. No parts of this book may be copied/replicated without expressed written consent of Singularity Security Group, LLC. Contact Adam.Jones@SingularitySG.com for additional information.

information and systems; and 3) facility accreditations. Reciprocity is obligatory in the IC when there are no waivers, conditions, or deviations to DNI security standards.

∞ Red. Designation applied to an information system, and associated areas, circuits, components, and equipment in which unencrypted national security information (NSI) is being processed.

∞ Red/Black Concept. Separation of electrical and electronic circuits, components, equipment, and systems that handle national security information (NSI) (RED), in electrical form, from those that handle non-NSI (black) in the same form.

∞ Risk – the probability of loss from an attack, or adverse incident. It is a function of threat

(adversaries’ capabilities, intentions, and opportunities) and vulnerability (the inherent susceptibility to attack). Risk may be quantified and expressed in terms such as cost in loss of life, dollars, resources, programmatic impact, etc.

∞ Risk Assessment – The process of evaluating security risks based on analyses of threats, vulnerabilities, and probable adverse consequences to a facility, system, or operation.

∞ Risk Management – The process of selecting and implementing security countermeasures to accept or mitigate the risk of a known or suspected threat to an acceptable level based on cost and effectiveness. The process considers effectiveness, efficiency, and constraints due to laws, directives, policies, or regulations.

∞ SAP – Special Access Program. A program established for a specific class of classified information that imposes safeguarding and access requirements that exceed those normally required for information at the same classification level.

∞ SCIF – Sensitive Compartmented Information Facility. An area, room, group of rooms, buildings, or installation certified and accredited as meeting DNI security standards for the processing, storage, and/or discussion of SCI.

∞ SETL – Security Environment Threat List. A classified list of countries produced by the

Department of State that is updated semi-annually. The listed threat categories are:

transnational terrorism, indigenous terrorism, political violence, human intelligence, technical threats, and criminal threat. Ratings are either: Critical, High, Medium, or Low.

∞ SSM – Site Security Manager. A U.S. citizen, cleared at the TS level and approved for

SCI, responsible for security where a SCIF is under construction (ICS-700). Reports operationally to the AO/SSO. The SSM shall NOT work for the construction contractor

This book is proprietary and confidential. No parts of this book may be copied/replicated without expressed written consent of Singularity Security Group, LLC. Contact Adam.Jones@SingularitySG.com for additional information.

(Reference Tech. Spec. Ch. 13 Pre-Construction Checklist 3.1.2 & DoDM 5105.21 v2, Enc. 2-2b). The AO may provide an exception to this in very specific situations.

∞ STC – Sound Transmission Class. An integer rating of how well a building partition attenuates airborne sound. The ability of a SCIF structure to retain sound within the perimeter is rated using a descriptive value. (also used commercially)

∞ SSA – Secure Storage Area. A room or area where materials intended for use in constructing a SCIF are securely stored until their needed use in construction.

∞ SID – Security In-Depth. A concept of security calling for layered and complementary controls sufficient to detect and deter infiltration and exploitation of an organization, its information systems, and facilities.

∞ SCIF Accreditation – Formal acceptance of SCIF as meeting DNI security standards and formal authorization to process, store, and/or discuss SCI.

∞ Sound Masking System – An electronic system used to create background noise to mask conversation and counter audio-surveillance threats.

∞ SWA – Secure Working Area. Accredited facilities used for discussing, handling, and/or processing SCI, but where SCI will not be stored.

∞ TSCM – Technical Surveillance Counter-Measures. Physical, electronic, and visual techniques used to detect and counter technical surveillance devices, technical security hazards, and related physical security deficiencies.

∞ TEMPEST – An unclassified term that refers to the investigation and study of compromising emanations. (not an acronym)

∞ Threat – The intention and capability of an adversary to undertake actions that would be detrimental to the interests of the U.S.

∞ Vulnerability – The quality or state of being exposed to the possibility of being attacked or harmed. A weakness or gap in security that could be exploited by a threat.

∞ VTC – Video Tele-Conference. Video conference is a live, visual connection between two or more people residing in separate locations for communication. Primary location for amplified sound.

This book is proprietary and confidential. No parts of this book may be copied/replicated without expressed written consent of Singularity Security Group, LLC. Contact Adam.Jones@SingularitySG.com for additional information.

References

The following is a list of the main US government directives, standards, policies, and regulations that apply to SCIF/SAPF construction projects. Some of these references apply to all projects, e.g. ICD/ICS series documents, and some may or may not apply depending on your End User, sponsoring agency, and/or CSA, but are still good references, e.g. DoD specific references. If you are unsure which documents apply to you and your project, ask your AO/SSO as soon as possible. Do not assume anything does or does not apply because assuming incorrectly can have substantial impacts to your project. While all references might not apply to all projects, it is still recommended to be familiar with them. In a very loose order of priority, persons involved in the planning & design of ICD-705 projects should be familiar with the following:

∞ Intelligence Community Directive (ICD) 705, “Sensitive Compartmented Information

Facilities (SCIFs),” 26 May 2010.

∞ Intelligence Community Standard (ICS) 705-1.1, “Technical Specifications for

Construction and Management for Sensitive Compartmented Information Facilities,” 31

October 2011.

∞ Intelligence Community Standard 705-2, “Standards for the Accreditation and Reciprocal

Use of Sensitive Compartmented Information Facilities,” 17 September 2010.

∞ IC. Tech. Spec. for ICD-ICS 705, v1.5, “Technical Specifications for Construction and

Management of Sensitive Compartmented Information Facilities, Version 1.5” 13 March

2020. (This is the current version but also verify if a new version has been released.

Updates are typically released approximately every 2 years)

∞ DoDm 5105.21, Volume 2, “Sensitive Compartmented Information (SCI) Administrative

Security Manual: Administration of Physical Security, Visitor Control, and Technical

Security” 5 April 2018

∞ DoDm 5205.07 Volume 3, “DoD Special Access Program (SAP) Security Manual:

Physical Security” 21 September 2015

∞ UFC 4-010-05 “Sensitive Compartmented Information Facilities Planning, Design, and

Construction” 1 October 2013

∞ Best Practices Guideline for Architectural Radio Frequency Shielding, March 2010

∞ CNSSAM TEMPEST/1-13 “RED/BLACK Installation Guidance” 17 January 2014

∞ CNSSI No. 7003 “Protected Distribution Systems (PDS)”, September 2015

This book is proprietary and confidential. No parts of this book may be copied/replicated without expressed written consent of Singularity Security Group, LLC. Contact Adam.Jones@SingularitySG.com for additional information.

∞ Intelligence Community Standard (ICS) 700-1 “GLOSSARY OF SECURITY TERMS, DEFINITIONS, AND ACRONYMS” 4 April 2008

∞ CNSSI No. 4009, “Committee On National Security Systems (CNSS) Glossary”, 6 April

∞ NSTISS No 7000 “TEMPEST Countermeasures for Facilities” 29 November 1993

∞ NSA 73-2A, “Specification for Foil RF Shielded Enclosure”, 15 November 1972

∞ NSA 94-106, “Specification for Shielded Enclosures”, 24 October 1994

∞ Intelligence Community Standard (ICS) 706, “Security Standards for Protecting

Domestic IC Facilities” 16 June 2016

∞ Intelligence Community Standard (ICS) 706-1, “Domestic Facility Security Risk

Assessments Standards” 18 June 2019

∞ ASTM E336 “Standard Test Method for Measurement of Airborne Sound Attenuation between Rooms in Buildings”, November 2017

∞ Intelligence Community Directive (ICD) 731, “Supply Chain Risk Management” 7

December 2013

∞ DoD 5200.08-R, ‘Physical Security Program”, 19 October 2020

∞ UFC 4-022-03 “Secure Fences and Gates” 1 October 2013

∞ MIL-STD-220, “Method of Insertion Loss Measurement for Radio Frequency Filters”, 14

May 2009

∞ MIL-HDBK-1250, “Department of Defense Handbook Corrosion Prevention and

Deterioration Control in Electronic Components and Assemblies”, 18 August 1995

∞ Intelligence Community Directive (ICD) 801, “Acquisition”, 15 August 2006.

∞ CNSS Instruction No. 5000, “Guidelines for Voice Over Internet Protocol (VoIP)

Computer Telephony”, April 2007

∞ Ask your CSA/AO/SSO for any additional applicable documents as there are plenty others specific to individual organizations, agencies, and offices.

This book is proprietary and confidential. No parts of this book may be copied/replicated without expressed written consent of Singularity Security Group, LLC. Contact Adam.Jones@SingularitySG.com for additional information.

Student Notebook

This book is proprietary and confidential. No parts of this book may be copied/replicated without expressed written consent of Singularity Security Group, LLC. Contact Adam.Jones@SingularitySG.com for additional information.

This book is proprietary and confidential. No parts of this book may be copied/replicated without expressed written consent of Singularity Security Group, LLC. Contact Adam.Jones@SingularitySG.com for additional information.

This book is proprietary and confidential. No parts of this book may be copied/replicated without expressed written consent of Singularity Security Group, LLC. Contact Adam.Jones@SingularitySG.com for additional information.

This book is proprietary and confidential. No parts of this book may be copied/replicated without expressed written consent of Singularity Security Group, LLC. Contact Adam.Jones@SingularitySG.com for additional information.

INTELLIGENCE COMMUNITY DIRECTIVE

NUMBER 705

SENSITIVE COMPARTMENTED INFORMATION FACILITIES

(EFFECTNE: 26 MAY ZOI~)

ICD 705

A. AUTHORITY : The National Security Act of 1947, as amended; Executive Order 12333, as amended; Executive Order 13526 ; and other applicable provisions of law .

B. PURPOSE

1 . This Directive establishes that all Intelligence Community (IC) Sensitive Compartmented Information Facilities (SCIF) shall comply with uniform IC physical and technical security requirements (hereinafter "uniform security requirements") . This Directive is designed to ensure the protection of Sensitive Compartmented Information (SCI) and foster efficient, consistent, and reciprocal use of SCIFs in the IC . This Directive applies to all facilities accredited by IC elements where SCI is processed, stored, used, or discussed .

2. This. Directive rescinds Director of Central Intelligence Directive (DCID) 6/9, Physical Security Standards for Sensitive Compartmented Information Facilities, including the Manual for Physical Security Standards for Sensitive Compartmented Information Facilities, and all DCID 6/9 Annexes . This Directive also rescinds IC Policy Memorandum (ICPM) 2005-700-1, Intelligence Community Update to Director of Central Intelligence (DCID) 6/9, Physical Security Standards for Sensitive Compartmented Information Facilities (SCIFs) ; ICPM 2006- 700-7, Intelligence Community Modifications to DCID 6/9, "Physical Security Standards for Sensitive Compartmented Information Facilities (SCIFs) " ; and ICPM 2007-700-2, Intelligence Community Modifications to Annex C of Director of Central Intelligence Directive 6/9, "Physical Security Standards for Sensitive Compartmented Information Facilities (SCIFs) . "

C. APPLICABILITY: This Directive applies to the IC, as defined by the National Security Act of 1947, as amended ; and such other elements of any other department or agency as may be designated by the President, or designated jointly by the Director of National Intelligence and the head of the department or agency concerned, as an element of the IC .

D. POLICY

1 . All SCI must be processed, stored, used, or discussed in an accredited SCIF .

2 . All SCIFs shall comply with uniform security requirements . The Deputy Director of National Intelligence for Policy, Plans, and Requirements (DDNUPPR) shall issue an IC Standards) establishing these requirements no later than 90 days after the effective date of this Directive . The IC Standards) shall include, but is not limited to, risk mitigation factors, and specific categories and uses of SCIFs .

3 . All SCIFs shall be accredited prior to being used for the processing, storage, use, or discussion of SCI. IC elements may continue to operate SCIFs accredited as of the effective date of this Directive in accordance with physical and technical security requirements applicable at the time of the most recent accreditation or re-accreditation of a given SCIF . IC elements shall ensure that upon re-accreditation a given SCIF is compliant with the current uniform security requirements, unless the IC element head grants a waiver in accordance with section D .5 of this Directive. The DDNUPPR shall issue an 1C Standard(s) on SCIF accreditation, re-accreditation, and de-accreditation no later than 90 days after the effective date of this Directive .

4. The IC element head may accredit, re-accredit, and de-accredit SCIFs . This authority may be delegated by the IC element head to a single named official, who shall serve as the Accrediting Official . In accordance with mission need, the Accrediting Official may further delegate decision authority for the accreditation, re-accreditation, and de-accreditation of specific SCIFs while retaining overall responsibility for all such decisions .

5. The IC element head may grant a waiver of the uniform security requirements for a given SCIF, pursuant to a documented mission need . The IC element head may grant a waiver for exceptional circumstances where there is a documented mission need to exceed the uniform security requirements . The IC element head may, in exceptional circumstances, exempt SCIFs from reciprocal use by IC elements, as described in section D .7 of this Directive . The authorities established in this section may be delegated by the IC element head to a single named senior official, who could be the Cognizant Security Authority, and may not be further delegated . In no case may this official be the same person as the Accrediting Official identified pursuant to section D.4 of this Directive .

6. When the Accrediting Official believes that a waiver of the uniform security requirements for a given SCIF is warranted, he or she shall submit a written request for waiver to the IC element head, or the official to whom this role has been delegated per section D .S . The waiver request shall include a detailed statement of the mission need and the specific deviations from the uniform security requirements . All approved waivers shall be reported to the DDNUPPR immediately, but no later than 30 days after the IC element head's decision .

7. All SCIFs shall be constructed, operated, and maintained for reciprocal use by IC elements. SCIFs accredited without a waiver of the uniform security requirements shall be available for reciprocal use . When requesting a waiver of the uniform security requirements for a given SCIF, in accordance with section D .6 of this Directive, the Accrediting Official shall include in the request a recommendation on reciprocal use of the SCIF . The DDNUPPR shall

ICD 705

issue an IC Standards) on the reciprocal use of SCIFs . The IC Standards) shall include, but is not limited to, provisions for exemptions based on mission need .

8 . For SCIFs that fall under Chief of Mission authority, IC elements shall comply with Overseas Security Policy Board (OSPB) standards, as defined in Department of State Foreign Affairs Handbook 12 FAH-6. IC elements shall submit all requests for waivers to OSPB standards to the Bureau of Diplomatic Security, Department of State, for approval . Waivers to OSPB standards must be received and approved prior to the commencement of any construction, renovation, or operations in the SCIF . IC elements shall conduct any activities subject to this section consistent with IC Directive 707, Center for Security Evaluation .

9 . The DDNUPPR shall manage an inventory of information on all SCIFs subject to this Directive, the scope, form, and format of which shall be established in consultation with IC elements. IC elements are responsible for providing to the DDNUPPR current information on all SCIFs, as soon as possible but no later than 180 days after the effective date of this Directive, and no later than 30 days thereafter in the case of updated or new information .

E. EFFECTIVE DATE: This Directive becomes effective on the date of signature .

Director of National Intelligence

Date

ICD 705

INTELLIGENCE COMMUNITY STANDARD

NUMBER 705-1

ICS 705- 1

PHYSICAL AND TECHNICAL SECURITY STANDARDS FOR SENSITIVE

COMPARTMENTED INFORMATION FACILITIES

(EFFK'TlVE: 17 SEPTEMBER 2010)

A. AUTHORITY: The National Security Act of 1947, as amended; Executive Order 12333, as amended; Executive Order 13526; Intelligence Community Directive (leD) 705, Sensitive Compartmented Information Facilities; and other applicable provisions of law.

B_ PURPOSE

I. This Intelligence Community Standard sets forth the physical and technical security standards that apply to all sensitive compartmented information facilities (SelF), including existing and new construction, and renovation of SerFs for reciprocal use by all Intelligence Community (Ie) elements and to enalble information sharing to the greatest extent possible.

2. The standards contained herein facilitate the protection of sensitive compartmented infonnation (SCI), including protection against compromising emanations, inadvertent observation or overhearing, disclosure by unauthorized persons, forced entry, and the detection of surreptitious and covert entry.

3. The Assistant Deputy Director of National Intelligence for Security (ADDNlISEC) shall , in consultation with IC elements, develop and establish technical specifications to implement SClF standards that include descriptions of best practices. The ADDNIISEC shall, in consultation with Ie elements, review and update the Technical Specifications/or Construction and Management a/Sensitive Compartmented Information Facilities (hereinafter "Ie Tech Spec ") on an ongoing basis.

c. ApPLICABILITY

1. This Standard applies to the Ie, as defined by the National Security Act of 1947, as amended; and such other elements of any other department or agency as may be designated by the President, or designated jointly by the Director of National Intelligence and the head of the department of agency concerned, as an element of the Ie.

ICS 705·\

2. Ie elements shall fully implement this Standard within 180 days of its effective date.

a. Facilities under construction or renovation as of the effective date of reD 705 shall be required to meet these standards or request a waiver to the standards.

b. SCIFs accredited as of the effective date ofICD 705 shall continue to be operated in accordance with the physical and teclmical security requirements applicable at the time of the most recent accreditation or re-accreditation.

c. SerFs that have been de-accredited for less than one year but continuously controlled at least at the Secret level (in accordance with 32 CfR Parts 2001 and 2004) may be re-accredited one time, based upon the standards used for the previous accreditation.

D. RECIPROCAL USE

These standards are designed to ensure the protection of SCI and provide a secure environment for infonnation sharing and reciprocal use ofSCIFs. Any SCIF that has been accredited by one IC element head or designee shall be reciprocally accepted by all IC elements when there are no waivers to these sumdards. Standards for reciprocal use are detailed in IC Standard 705-2, Standards for the Accreditation and Reciprocal Use of Sensitive Compartmented Information Facilities. A waiver may be necessary only in extraordinary circumstances when these standards cannot be met. Waive:rs are detailed in section H of this Standard.

E. RISK MANAGEMENT

1. Analytical risk management is the process of assessing threats against vulnerabilities and implementing security enhancements to achieve the protection of information and resources at an acceptable level of risk, and within acceptable cost. The Accrediting Official (AD) must ensure the application of analytical risk management in the SelF planning, design and construction process.

2. Security in Depth

a. Security in Depth (SID) is the acceptance of the AO of external and/or internal SelF factors that enhance the probability of detection before actual penetration to the SelF occurs by the existence of a layer or layers of s(xurity that offer mitigations for risks.

b. To qualify for SID, at least one layer identified in the IC Tech Spec shall be applied.

c. SID inside the United States will allow Cognizant Security Authorities (CSA) to use less stringent construction techniques, and increase the alarm response times.

d. SID is mandatory for SClFs located outside the United States due to increased threat.

F . SelF PLANNING AND DESIGN

1. selF security begins with the planning and design phase. To ensure security oversight is applied throughout development and accreditation, all SCIF planning shall begin with sponsorship by an AO.

2. Facility Types. Detennining where the SCIF will be located and how it will be used is necessary in determining what security enhancements may be necessary. Reciprocal use of the SClF shall be based upon the type of facility and its current use. (For example, a facility

ICS 705-1

accredited for closed storage and non-amplified discussions is not reciprocal for open storage and amplified discussions.)

a. Secure Work Area is an area accredited for use, handling, discussing, and/or processing of SCI but where SCI is not stored.

h. Temporary Secure Working Area is a fac ility where the handling, discussing, and/or processing of SCI is limited to less than 40 hours per month but where SCI is not stored.

c. Continuous Operation is a SelF that is staffed and operated 24 hours a day, seven days a week.

d. Temporary SelF is a facility determined to be necessary for a limited time to meet tactical, emergency, or immediate operational requirements.

c. Open Storage accreditation allows SCI to be openly stored and processed within the SelF without using Govenunent Services Administration (GSA) approved storage containers.

f. Closed Storage accreditation requires all SCI material to be stored in a GSA approved security container in an accredited facility

3. For each SCIF construction project, a Construction Security Plan (CSP) shall be developed to address the application of security to the SCrF planning, design, and construction efforts . The specific format and content of the CSP may be developed by the AO based upon the extent of the SCIF construction and security concerns related to the SCIF.

4. Construction plans and all related documents shall be handled and protected in accordance with the CSP. rfclassification guides dictate, plans and related documents may require classification. Under no circumstances should plans, diagrams, etc. that are identified for a SCIF be sent or posted on unprotected information technology systems or Internet venue without encryption.

5. Construction and design ofSCIFs shall be performed by U.S. companies using U.S.

persons (an individual who has been lawfully admitted for permanent residence as defined in 8 U.S.C. 1101(a)(20) or who is a protected individual as defined by 8 U.S.C. 1324b(a)(3)). The AO shall ensure mitigations are impkmentcd when using non-U.S . citizens. These mitigations shall be documented in the CSP. See additional guidance in the Ie Tech Spec for overseas SCIFs built within facilities under Chief of Mission (COM) authority.

6. SCIF design and construction shall be compliant with Fire code National Fire Protection Association 1, Life safety code NFPA 101, The Americans with Disabilities Act 28 CFR Part 36, and the Uniform Federal Accessibilities Standard where applicable.

7. SCIF Construction Security:

a. A Site Security Manager (SSM) shall be identified to the AO as the single point of contact regarding SCIF security and the individual responsible for all security aspects of the SCrF construction.

b. Construction Surveillance Teclmicians (CSn shall only be required outside the United States when cleared contractors are not used.

c. Cleared American Guards (as defined by Department of State Foreign Affairs Handbook 12 FAH 6, as Top Secret-cleared u.S. citizens who are selected, professionally

ICS 705·1

trained, and assigned to a project for the purpose of ensuring the security integrity of a site, building, and/or material/items) may be required when the threat warrants as dctcnnined by the AO. See additional guidance in the Ie Tech Spec for overseas SeIFs built within facilities under COM authority.

d. When SelF renovations require that construction personnel enter an operational SelF, they shall be cleared or be escorted by personnel cleared to the level of the SelF. See additional guidance in the Ie Tech Spec for ove:rseas SerFs built within fac ilities under COM authority.

c. SCI indoctrinated escorts may not be required when a barrier has been constructed to protect the SelF from the areas identified for construction.

f. Access control to the construction site is required and shall be addressed in the CSP.

G. PHYSICAL AND TECHNICAL SECURITY STANDARDS

I. Physical Security for SCIFs

a. Perimeter

(1) The perimeter of the SCIF includes all perimeter walls, windows and doors as well as the ceiling and floor.

(2) The perimeter of the SCIF shall provide a physical barrier to forced, covert and surreptitious entry.

(3) Walls, floor and ceiling shall be permanently and solidly constructed and attached to each other. Raised floors and false: ceilings shall not be used to anchor wall support materials.

All construction, to include above the: false ceiling and below a raised floor, shall be constructed to provide visual evidence of unauthorized penetration.

(4) When RF shielding is required by Certified TEMPEST Technical Authority (CIT A) evaluation, it should be planned for installation during initial construction as costs are significantly higher to retrofit after construction is complete.

(5) SCIFs that require disl;:ussions of SCI shall provide acoustic protection to prevent conversations from being inadvertently overheard outside ofthe SClF.

(6) Details for the construction of the perimeter to meet standards shall be provided within the Ie Tech Spec for SCIFs.

2. Technical Security Standards for SCIFs

a. RF transmitters shall not be introduced into a SCIF unless evaluated and mitigated to be a low risk to classified information by a competent authority (e.g., CTTA) and approved by the

AO.

b. Access Control Systems

(1) Access to SerFs is restricted to authorized personnel. Access control methods shall be approved by the AO.

(2) Access control methods may include anyone of the following but are not approved for securing SelF entrances when the SelF is unoccupied:

(a) Automated access control systems using at least two technologies (badge, PIN, biometric, etc.)

(b) Electromechanical, mechanical or personal recognition (in small facilities and/or where there is a single monitored entrance)

c. Intrusion Detection System

(1) Intrusion Detection System (IDS) shall detect attempted or actual unauthorized human entry into a SelF.

(2) IDS installation, relat~:d components, and monitoring stations shall comply with Underwriters Laboratories CUL) 2050 Extent 3 standards. Systems developed and used exclusively by the U.S. Government do not require UL certification but shall comply with UL 2050 Extent 3 standards for installation.

(3) Contractor SeIFs shall maintain a current UL certificate of installation and service. Any changes to the IDS after the certificate is issued shall require renewal of the certificate.

(4) SCrFs accredited prior to the effective date ofICD 705 are not required to upgrade to current IDS standards. IC elements shall ensure that upon re-accreditation the SCIF is compliant with current IDS standards, unless a waiver is granted in accordance with ICD 705 . .

(5) Response times for IDS shall meet 32 CFR Parts 2001 and 2004 for protecting Top Secret information.

(6) For SCIF construction. under COM authority, IDS installations shall be coordinated with the Department of State (DoS), Overseas Building Operations and the Bureau of Diplomatic Security.

d. Unclassified Telecommunkations Systems

(I) Any unclassified telecommunications system introduced into the SCrF shall be evaluated by the CIT A and AO for tiechnical surveillance countermeasures and TEMPEST concerns.

(2) Unclassified telephone systems introduced within the SelF shall meet National Telephone Security Working Group requirements for security. See Ie Tech Spec for details .

e. Portable Electronic Devices

(1) Portable Electronic Devices pose a risk to SCI since they often include capabilities to interact with other information systems and can enable hostile attacks targeting classified infonnation in SelFs.

(2) The Ie Tech Spec provides details and guidance for PED restrictions within SCIFs.

3. Temporary SelF Standards: Toemporary SCIFs that are required for emergency, tactical or other immediate operational needs often require additional security considerations including OPSEC. These facilities are addresst!d as a separate topic in the Ie Tech Spec.

4. Overseas SCIFs

a. Overseas SClFs may be:

lCS 705-1

(1) SelFs constructed within facilities under COM authority, or

(2) SCIFs under Department of Defense (DoD) authorities and the construction of which may be affected by Status of F orees Agreements.

b. SCIFs that fall under COM authority shall comply with Overseas Security Policy Board (OSPS) standards as well as the standards herein. When a conflict occurs between asps and these standards, the more restrictive standard shall apply. for overseas SerFs built within fac ilities under COM authority, see additional guidance [or standards in the Ie Tech Spec.

c. The DoS's Security Environment Threat List (SETL) shall be used in the selection of appropriate construction security critl:!ria based on technical threat ratings.

d. Whenever the SETL does not have threat infonnation for the city of construction, the SETL technical threat rating for the dosest city within a given country shall apply. When only the capital is noted, it will represent the threat for all SCIF construction within that country.

e. All new facilities housing a SCIF shall be in compliance with DoD antiterrorism guidelines for military installations OJ aSPs standards for facilities under COM authority.

f. U.S. citizens and U.S. firms. shall be used to the greatest extent practical for construction and oversight.

g. U.S. Secret cleared persoIUlel shall perfonn finish work (work that includes closing up wall structures; installing, floating, taping and sealing wallboards, installing trim, chair rail, molding, floorboards; painting; etc.) unless escorted or other mitigations are applied and documented in the CSP.

h. CSTs shall be used as described in the Ie Tech Spec.

i. The procedures for securely procuring, shipping, storing or inspecting construction material (see Ie Tech Spec for details) shall be detailed within the CSP.

j. Open Storage

(1) In low and medium threat areas, shall only be allowed when the SCIF is under continuous operation or in which the host facility is staffed 24 hours per day by a cleared U.s.

presence.

(2) In high and critical thr·eat areas, the head of the IC element or CSA shall certify mission essential need, and approve open storage on case-by-ease basis.

H. WAIVERS

1. A waiver shall only be considered under exceptional circumstances (i.e., only when the standards cannot be met or mitigated), or when there is a documented risk-based mission need to exceed the standards. A waiver for standards that cannot be met removes a SCIF from mandatory reciprocal use.

2. The AO shall request waiver approval of the Ie element head or designee, pursuant to lCD 705.

a. A waiver request submitted when a standard carmot be met shall include the following:

(1) The standard that cannot be met rcs 705-1

(2) The mitigation techniques considered that are not sufficient to meet the standard

(3) Justification for the waiver

(4) A statement of residual risk

(5) Guidelines, policies andlor procedures that will be implemented to reduce risk caused by the waiver

(6) Time expectation when the standard will be met and the waiver will no longer be required .

(7) A statement of acceptance of reciprocal use.

b. A waiver request submitted when a standard will be exceeded shall include the following:

(I) The standard that will be exceeded

(2) A statement of documented risk that justifies the need to exceed standards

(3) Time expectation that the waiver will no longer be required

(4) A statement of acceptance of reciprocal use

3. Within 30 days of approval, w.aivers shall be reported to the Assistant Director of National Intelligence for Policy, Plans, and Requirements (ADNIIPPR) via the Ie selF repository.

I. OPERATIONS AND MANAGEMENT

Once accredited and operational, the operations and management of a SelF provides a continuous security posture. The Ie Tech Spec provides standards for operational and management efforts that enable continuing security.

J . ROLES AND RESPONSIBILITIES

1. The ADDNI/SEC shall:

a. Develop and establish teclmical specifications to implement this Ie Standard.

b. Provide programmatic oversight of the implementation of this Ie Standard.

c. Resolve disputes between and among selF stakeholders with this Ie Standard.

d. Identify and incorporate Ie best practices into the Ie Tech Spec established pursuant to section 8.3 of this Ie Standard.

e. Develop training to ensure a common understanding of these standards and mitigations.

f. Recommend, in consultation with Ie elements, to the ADNIIPPR substantive or technical amendments to this Ie Standard, as appropriate.

2. Heads of IC Elements shall:

a. Implement the provisions of this Standard.

b. Approve waivers to this St.andard, as appropriate.

3. CSAs shall:

lCS 705-1

a. Provide oversight of the SelF construction and accreditation program under their security purview.

b. Ensure the timely input of :required SelF data to the Ie selF repository.

4. AOs shall:

a. Provide security oversight of all aspects of SelF construction under their security purview.

b. Review and approve the de:sign concept, esp, and final design for each construction project prior to the start of construction.

c. Depending on the magnitude of the project, detennine if the SSM perfonns duties on a full-time, principal basis, or as an additional duty to on-site persOImcl.

d. Accredit SCIFs under their cognizance.

e. Prepare waiver requests foJ[' the Ie element head or designee.

f. Provide the timely input of all required SelF data to the Ie selF repository.

g. Consider S[D on U.S. Government or U.S. Government sponsored contractor facilities to substitute for standards herein. SID shall be documented in the CSP and the Fixed Facility Checklist.

5. SSMs shall:

a. Ensure the requirements herein are implemented and advise the AO of compliance or vanances.

b. In consultation with the AO, develop a CSP regarding implementation of the standards herein. This document shall include actions required to document the project from start to finish.

c. Conduct periodic security inspections for the duration of the project to ensure compliance with the CSP.

d. Document security violations or deviations from the CSP and notify the AO within 3 business days.

e . Ensure procedures to control site access are implemented.

6. CTTAs shall:

a. Review SCIF construction or renovation plans to determine if TEMPEST countermeasures are required and recommend solutions. To the maximum extent practicable, TEMPEST mitigation requirements shall be incorporated into the SCIF design.

b. Provide the CSA and AO with documented results of review with recommendations.

7. CSTs shall:

a. Supplement site access controls, implement screening and inspection procedures, as well as monitor construction and personnel, when required by the CSP.

b. In low and medium technical threat countries, begin surveillance of non-cleared workers at the start of SCIF construction or the installation of major utilities, whichever comes first.

c. In high and critical technical threat countries, begin surveillance of non-cleared workers at the start of: construction of public access or administrative areas adjacent to the SelF;

selF construction; or the installation of major utilities, whichever comes first.

K. EFFECTIVE DATE: This Standard becomes effective on the date of signature.

Assistant Director of Nat Intelligence for Date I 1'1 ?o{ O

Pol icy. Plans, and Requirements

INTELLIGENCE COMMUNITY STANDARD

NUMBER 705-2

ICS 705-2

STANDARDS FOR THE ACCREDIT A TION AND RECIPROCAL USE OF SENSITIVE

COMPARTMENTED INFORMATION

(EFFECTIVE: 17 SEPTEMBER 2010)

A. AUTHORITY: The National Security Act of 1947, as amended; Executive Order 12333 , as amended; Executive Order 13526; Intelligence Community Directive (JeD) 705, Sensitive Compartmented Information Facilities; and other applicable provisions of law.

B. PURPOSE: This Intelligence Community Standard sets forth the criteria that apply to the accreditation of sensitive compartmeJt1ted information facilities (SelF) to enable reciprocal use by all Intelligence Community (Ie) elements and to facilitate information sharing to the greatest extent possible.

C. ApPLICABILITY: This Standard applies to the Ie, as defined by the National Security Act of 1947, as amended; and such other elements of any other department or agency as may be designated by the President, or designated jointly by the Director of National Intelligence (DNI) and the head of the department or agency concerned, as an element of the IC.

D. ACCREDITATION

I. Accreditation is the beginning of a life·cycle process of continuous monitoring and evaluation, periodic re·evaluations and documentation reviews to ensure the SCIF is maintained in an accredited state. To ensure proper implementation of these standards, the Assistant Deputy Director of National Intelligence for Security (ADDNIISEC) may conduct assessments ofSCIFs in coordination with Accrediting Offi,cials (AO) and Cognizant Security Authorities (CSA).

a. A letter of accreditation is a fonnal statement on behalf of the IC element head that a facility has been designed, constructed, inspected, and certified for the protection of all Sensitive Compartmented Infonnation (SCI) compartments, programs or special activities in accordance with the provisions ofICD 705. Letters of accreditation shall include:

(l) SCIF identity (number and or location)

ICS 705-2

(2) SCIF Type (e.g., open storage, closed storage, etc.)

(1) Acoustic requirements (e.g., discussion or…