The SCIF accreditation process

Accreditation starts before the first drawing

People new to secure facility work often picture accreditation as a final exam: build the room, call the inspector, pass or fail. In practice it is a process that runs alongside design and construction from the beginning, with written approvals at each stage. A team that understands the sequence can plan the project around it. A team that does not will find out late that something needed approval months ago.

The people

The Accrediting Official. The person with authority to accredit the facility. For a SCIF, the Accrediting Official is designated by the cognizant security authority of the sponsoring Intelligence Community element. For a SAPF, the Department of Defense designates its own official under DoD Manual 5205.07. The Accrediting Official reviews the plans, approves the security documents, inspects the finished space, and grants or withholds accreditation. Nobody else can.

The site security manager or special security officer. The security professional responsible for the facility on the owner's side. This person prepares the documents, coordinates with the Accrediting Official, walks the site during construction, and owns the facility's security after it opens.

The Certified TEMPEST Technical Authority. The specialist who reviews the facility for emanations risk and decides whether countermeasures such as RF shielding are required. Their review feeds into the construction requirements.

The general contractor. Builds exactly what the approved documents say, makes the work available for inspection before it is covered, and delivers the records that prove it.

The documents

The Fixed Facility Checklist. The central record of the facility. It describes the construction, the perimeter, doors, ducts, intrusion detection, acoustic protection, telecommunications, and technical security, with a floor plan attached. The Tech Spec and DoD guidance describe it as a living document: it is started before construction, updated as the project goes, and kept current for the life of the facility. The Accrediting Official uses it during every inspection.

The Construction Security Plan. How the site will be protected while the facility is being built: who can enter, how materials are handled and inspected, what clearances workers need, how the work is monitored, and how deviations are reported. The Accrediting Official approves it before construction starts. The plan governs the job site, and the contractor is bound by it.

The TEMPEST checklist. Completed with the Certified TEMPEST Technical Authority, who reviews the plans and decides what, if any, countermeasures the construction must include.

Inspection records and as-builts. Photographs of concealed work, test results for sound attenuation and intrusion detection, and drawings that match what was built. These are what the Accrediting Official reviews when deciding whether the finished facility matches the approved documents.

The sequence

1. Concept approval. Before design is finalized, the owner's security manager submits the concept: where the facility will be, what it is for, roughly how it will be laid out. The Accrediting Official reviews it and approves in writing or asks for changes. This is where the question of SCIF versus SAPF is settled, where the sound group is assigned, and where the TEMPEST review is requested.

2. Design and pre-construction approval. The design is developed against the Tech Spec and the approved concept. The Construction Security Plan is written. The Fixed Facility Checklist is started. The Accrediting Official reviews the design, the plan, and the checklist and approves them in writing before any construction begins. Any proposed mitigation, where a site condition makes a requirement hard to meet, is documented and approved here, not discovered in the field.

3. Construction with inspections. The contractor builds to the approved documents. The security manager, and sometimes the Accrediting Official, inspect the work at points where it is still visible: framing before gypsum, insulation and penetration seals before the wall is closed, above-ceiling work before the ceiling goes in. Deficiencies are recorded and corrected while the trade is on site. Photographs and records go into the checklist.

4. Acceptance testing. When construction is complete, the facility is tested: sound attenuation at the perimeter, intrusion detection and access control function, door and hardware operation. Results are recorded.

5. Pre-accreditation inspection. The Accrediting Official physically inspects the facility against the Fixed Facility Checklist and the approved documents. Open items are corrected.

6. Accreditation. If the facility matches the approved documents and passes testing, the Accrediting Official accredits it in writing. Only then can classified work begin inside it.

7. After opening. The facility is re-inspected periodically, at a frequency set by the accrediting authority based on threat, changes to the space, and history. Any physical change to the perimeter goes back through approval before it is made.

Where projects go wrong

The most expensive mistakes happen between steps 2 and 3. A contractor who was not involved in design builds to the architect's drawings without reading the Construction Security Plan. A mechanical sub adds a duct penetration that was not on the approved plan. A wall gets closed before the security manager sees it. Each of these is a deviation from approved documents, and each one has to be resolved with the Accrediting Official, often by opening finished work.

The fix is to bring the contractor into step 2, give the security manager a schedule of inspection points before work starts, and treat the approved documents as the contract.

Planning a secure facility in Maryland, Virginia, or Washington, DC? Envision Solutions builds ICD-705 SCIFs and SAPFs and works inside the accreditation process from concept approval forward. Request a quote or call 301-247-7229.