The acoustic protection guidelines listed below are designed to protect classified conversations from being overheard outside a SCIF and not intended to protect against purposeful technical interception of audio communications. A SCIF structure and its ability to retain sound within the perimeter is rated using the Sound Transmission Class (STC).

Sound group ratings are divided into two groups: Sound Group 3 and Sound Group 4. All SCIF perimeters are designed and constructed with meeting the standards of Sound Group 3 or better in mind. Acoustic protection and perimeter construction specifications for Wall A, B, and C can be found in previous articles. 

Sound Group 3 has a STC 45 or better. In this sound group, loud speech from within the SCIF can be faintly heard but not understood outside the SCIF. To the unaided ear, normal speech is unintelligible. Sound Group 4 has a STC 50 or better. In this group, loud sounds within the SCIF can be heard with the human ear faintly or not at all outside the SCIF.

Acoustic Testing

Audio tests must be conducted to verify all acoustic protection standards are met. With approval by the AO, these tests may be instrumental or non-instrumental and the test method used must be noted in detail in the CSP. All non-instrumental tests must be approved by the AO. Only qualified personnel with training on audio testing techniques will be allowed to conduct instrumental acoustic tests.

With all doors closed, all SCIF perimeter walls and openings (air returns, doors, windows, etc.) must be tested along several points to ensure that either Sound Group 3 or 4 is met. All audio test sources must have a variable sound level output with the output frequency range including normal speech. Test speakers must be placed six feet from the test wall and four feet off the floor. As noted by Sound Group 3 and 4 respectively, audio gain of the test source must produce “loud or very loud speech”.

Instrumental testing can be performed to Noise Isolation Class (NIC) standards. These results must comply with NIC 40 for Sound Group 3 and NIC 45 for Sound Group 4.

Sound Transmission Mitigations

In most cases, SCIF perimeter construction and acoustic protection should provide the necessary protection for Sound Group 3. However, when Sound Group 3 or 4 can’t be met within the normal SCIF construction standards, there are supplemental mitigations used to protect classified discussions from being overheard.

These mitigations can include (but aren’t limited to):

1. Structure enhancements can be used to increase the resistance of the perimeter to vibration at audio frequencies.
2. SCIF design can include a perimeter location or stand-off distance. This prevents non-SCI-indoctrinated person(s) from traversing beyond the point where SCI discussions can be intercepted.
3. In conjunction with an amplifier and speakers or transducers, sound masking devices can be used to generate and distribute vibrations/noise.
4. Speakers and transducers must produce sound at a higher level than the voice conversations within the SCIF.
5. Speakers and transducers must be placed close to or mounted on any paths that allow audio to leave the area including doors, windows, walls, vents, etc.
6. Wires and transducers must be, to the greatest extent possible, located within the perimeter of the SCIF.
7. During TSCM evaluations, the sound masking system will be subject to inspection.
8. A speaker may be installed outside the SCIF if the AO determines the risk to be low and meets the following conditions:
   1. Cable exiting the SCIF must be encased within rigid conduit.
   2. Sound masking system must be subject to review during TSCM evaluations.
9. For common walls, speakers/transducers must be placed in a location so the sound optimizes the acoustical protection.
10. For all doors and windows, speakers/transducers must be placed close to the aperture of the window/door. The sound must be projected in a direction facing away from conversations.
11. Once the speakers/transducers are in an optimal location, the system volume must be set and fixed. Volume level is determined and adjusted by listening to conversations outside the area to be protected. The speaker volume will then be adjusted until conversations are unintelligible from outside the SCIF.
12. Sound-source generators must be located within the SCIF.
    1. AM/FM receiver cannot be present on sound-source generators.
    2. If the sound-source generator has the capability to record sound, that function must be disabled.
    3. The following are examples of government-owned/sponsored sound-source generators:
       1. Audio amplifier w/ standalone computer (no network connection)
       2. Audio amplifier w/ a cassette tape player, CD player, or digital audio player, or w/ digital audio tape (DAT) playback unit
       3. Integrated amplifier and playback unit incorporating any of the above music sources
       4. A noise generator or shift noise source generator using either white or pink noise

Does your facility require a SCIF? KL Security offers SCIF Container Solutions with panelized modular systems for scalable modular, portable, & mobile requirements.  We assist in the acquisition of modular facilities for DoD & Government Access Control and ICD705 SCIFs or SAPF facilities. We also assist with special access control planning and commercial business security.

Call 866-867-0306 or email [email protected] to see how the experts at KL Security can assist your facility in security needs.

Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities

SCIF Container Series | Part 1: Site Evaluation

SCIF Container Series | Part 2: Design Planning Checklist

SCIF Container Series | Part 3: Perimeter Wall Construction – Wall A

SCIF Container Series | Part 4: Perimeter Wall Specifications – Wall B

SCIF Container Series | Part 5: Perimeter Wall Specifications – Wall C

SCIF Container Series | Part 6: Vents and Ducts

SCIF Container Series | Part 7: Modular SCIFs

SCIF Container Series | Part 8.1: Intrusion Detection Systems

SCIF Container Series | Part 8.2: Intrusion Detection Systems

Information has been gathered from sources deemed reliable but not guaranteed and is subject to change without notice. The information contained in this site is provided for informational purposes only.

Integrated IDS and Remote Terminal Access

The United States government local area network (LAN) or wide area network (WAN) requires the AO’s CIO to be consulted before connecting an IDS. The IDS hosting system must be issued an Authority to Operate (ATO) by the agency’s CIO, following the FISMA Risk Management Framework that is outlined in NIST SP 800-53.

For IDS that have been already integrated into a networked system (LAN or WAN) the following requirements must be met:

• System software must be installed on a host device that is logically and physically restricted to corporate/government elements cleared to the SCI level.
  • Host devices must be located in a Physically Protected Space. Protected space is defined as a locked room with walls, floor, and ceiling that form a solid physical boundary to which only SCI-cleared personnel have access to.
  • SCI-cleared personnel must escort any uncleared or personnel with less than SCI-clearance that require access to this space.
  • Door will use Commercial Grade 1 hardware fitted with high security key cylinder(s) in compliance with UL 437.
  • Room must be protected by UL Extent 3 burglar alarm system and access control (unless manned 24 hours).
• All transmissions of system information over the LAN/WAN must be encrypted using National institute of Standards and Technology (NIST) FIPS 140-2, VPN, or closed and sealed conveyance. FIPS-197 (AES) can be used with AO approval.
• All host system components and equipment must be isolated in a way that includes (but aren’t limited to):
  • Firewalls
  • Virtual Private Networks (VPNs)
  • Virtual Routing Tables
  • Other Application Level security mechanisms or similar enhancements that allow secure and private data transfers only between the PCU, host computer, remote terminal and monitoring station
• Any components of the IDS are remotely programmable, continuous network monitoring is needed. Network monitoring includes auditing and reporting of all network intrusion detection and prevention systems.
• A secondary communication path may be used to augment an existing data communication link to reduce search of data communication failures of less than five minute duration.
  • Supervision for a secondary communication path must be equivalent to that of a primary communication path
  • Secondary communication path can be wireless only if approved by the AO after consulting with the CTTA and/or the appropriate technical authority
• A unique user ID and password is required for each individual granted access to system host computing devices or remote terminal. Passwords must be a minimum of 12 characters consisting of alpha, numeric, and special characters. The password must be changed every six months or utilize US Government Personal Identity Verification (PIV) Card or Common Access Card (CAC) with two factor certificate authentication.
• Persons with IDS admin access must immediately notify the AO or designee of any unauthorized modifications.

Remote System terminals:

Remote system terminals must utilize AO approved role-based user permissions (e.g. Super User, SO, Guard). All USG installations must prohibit non SCI cleared personnel from modifying the IDS or ACS. Remote system terminals require an independent user ID and password in addition to the host login requirements. Host systems must log and monitor failed login attempts. All remote sessions must be documented and accessible to the AO upon request.

All host systems and PCUs must be patched and maintained to implement current firmware and security updates. USG systems must be in compliance with Information Assurance Vulnerability Alert (IAVA) guidance.

Requirements for IDS Systems Software Passwords:

• Passwords must be a minimum of 12 characters consisting of alpha, numeric, and special characters
• The password must be changed every six months or utilize US Government Personal Identity Verification (PIV) Card or Common Access Card (CAC) with two-factor certificate authentication

IDS Modes of Operation

The IDS must operate in two modes: armed or disarmed. With this system there must not be any remote capability for changing the two modes by a non-SCI cleared personnel. Changing the arming or disarming status must be limited to just SCI-indoctrinated persons.

When the system is in disarmed mode, normal entry into the SCIF, following all security procedures, will not cause an alarm to sound. A record must always be maintained of who is responsible for disarming the IDS. However, tamper circuits and emergency exit door circuits must remain in armed mode. The PCU must have the ability to allow certain alarm points to remain armed while other points are in disarmed status.

The IDS is placed into armed mode when the last person leaves the SCIF. A record must also be kept identifying the person who armed the system. When in armed mode, any unauthorized entry into the SCIF will cause an alarm to be immediately transmitted to the monitoring station.

Each failure of arming or disarming the system must be reported to the SCIF Security Manager. Records of these events will be kept for two years.

Maintenance Requirements and Zone Shunting/Masking Modes

If maintenance is performed on the system, the monitoring station must be notified and a log must be kept. All maintenance periods must be archived in the system. System maintenance can only be done by an SCI cleared IDS administrator of SCIF Security Officer (SO). When a point is shunted or masked for reasons other than system maintenance, it must be displayed as such at the monitoring station throughout the period the condition exists.

Any sensor that has been shunted must be reactivated upon the next change in status from armed to disarmed. A PIN is required, for maintenance purposes, to be established and controlled by the SCI cleared IDS administrator or SCIF SO. All procedures must be documented in the SCIF SOP. PEDs (portable electronic devices) are only allowed attachment to the system equipment for the purpose of system maintenance, repair and reporting. The PED attachment can either be temporary or permanent depending on system needs. The stand-alone PED must meet the following requirements:

• Must be kept under control of SCI-cleared personnel
• PED, when not in use, must be maintained in a Physically Protected Space
• Mass storage devices containing SCIF alarm equipment details, configurations, or event data will be protected at an AO-approved appropriate level.

Capability for remote diagnostics, maintenance, or programming of IDE must be accomplished only by SCI-cleared personnel and must be logged/recorded. In the event of a power failure, the system will automatically transfer emergency electrical power sources without causing alarm activation. 24 hours of uninterrupted backup power is required and must be provided by batteries, an UPS (uninterruptible power supply), generators, or any combination. An audible or visual indicator at the PCU shall provide an indication of the primary or backup power source in use. Equipment at the monitoring station will visibly and audibly indicate a failure in a power source or a change in power source. As directed by the AO, the individual system that failed will be indicated at the PCU or monitoring station.

Monitoring Stations

In accordance with UL 2050, monitoring stations must be government-managed or one of the following:

• AO-operated monitoring station
• Government contractor monitoring station
• National industrial monitoring station
• Cleared commercial central station

All monitoring station employees must be eligible to hold a U.S. SECRET clearance. Operators must be trained in system theory and operation in order to effectively interpret certain system incidents and take appropriate actions.

Operations and Maintenance of IDS

Alarm Response

All alarm activations must be considered an unauthorized entry until it’s resolved. Response force will take appropriate steps to protect the SCIF, as permitted by a written support agreement, until SCI-indoctrinated individual(s) arrive to take control of the situation. The SCI-indoctrinated individual(s) must arrive in 60 minutes (in accordance with UL 2050) or a response time approved by the AO.

The individual(s), upon arrival, will conduct an internal inspection of the SCIF, attempt to determine the cause of the alarm activation, and reset the IDS prior to the departure of the response force.

System Maintenance

All maintenance and repair personnel that aren’t TOP SECRET-cleared and indoctrinated for SCIF access must be escorted during system repairs/maintenance. Repairs must be initiated by a service tech within four hours of the receipt of a request for service or trouble signal. Until repairs are completed or AO-approved alternate documented procedures are started, the SCIF will be continuously manned on a 24-hour basis by SCI-indoctrinated personnel.

Emergency-power battery maintenance should follow the manufacturer’s periodic maintenance schedule and procedures. Battery maintenance will be documented in the system’s maintenance logs and kept for two years. If a generator is used to provide emergency power, it must also be tested per the manufacturers recommended testing procedures. If the communications path is through a network, the network’s power source must also be tested.

Network Maintenance

The system administrators must maintain configuration control, make sure the latest operating security patches have been applied, and configure the system to provide a high level of security. Inside the United States, all network maintenance personnel within the SCIF shall be a U.S. person and be escorted by cleared SCIF individuals. Outside the U.S., network maintenance personnel must be U.S. TOP SECRET-cleared or U.S. SECRET-cleared and be escorted by SCIF personnel.

Installation and Testing of the IDS

All IDS installation and testing within the U.S must be performed by U.S. companies using U.S. citizens. Outside the U.S., installation and testing must be performed by personnel who are U.S. TOP-SECRET-cleared or U.S. SECRET-cleared and escorted by SCIF personnel. All IDS system components and elements must be installed in accordance with the IDS requirements listed in Part I and Part II, UL 2050, and the manufacturer’s instructions and standards.

Prior to operational use, acceptance testing must be conducted on all systems to provide assurance that they meet all requirements prior to SCIF accreditation. Semi-annual IDS testing must be conducted to ensure continued system performance. All records of testing and test performance must be maintained in accordance with documentation requirements.

All motion detection sensors must be tested to ensure proper activation of the sensor at a minimum of four steps (“trial”) at a rate of one step per second (30 inches ± 3 inches or 760 mm ± 80 mm per second). This test must be conducted by taking a four-step trial, stopping for three to five seconds and then taking another four-step trial. These trials must be repeated throughout the SCIF and from different directions. An alarm must activate at least three out of every four consecutive trials made by moving through the SCIF.

All HSS devices must also be tested to ensure that an alarm signal activates before the non-hinged side of the door opens beyond the thickness of the door. For example, a 1 ¾ inch thick door will activate an alarm signal before the door opens 1 ¾ inches. Each IDS equipment cover will be individually removed or opened to ensure there’s an alarm activation at the PCU or monitoring station in both secure and access modes. Tamper detection devices only need to be tested when installed. However, the AO may require more frequent testing of tamper circuits if needed. 

Does your facility require a SCIF? KL Security offers SCIF Container Solutions with panelized modular systems for scalable modular, portable, & mobile requirements.  We assist in the acquisition of modular facilities for DoD & Government Access Control and ICD705 SCIFs or SAPF facilities. We also assist with special access control planning and commercial business security.

Call 866-867-0306 or email [email protected] to see how the experts at KL Security can assist your facility in security needs.

Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities

SCIF Container Series | Part 1: Site Evaluation

SCIF Container Series | Part 2: Design Planning Checklist

SCIF Container Series | Part 3: Perimeter Wall Construction – Wall A

SCIF Container Series | Part 4: Perimeter Wall Specifications – Wall B

SCIF Container Series | Part 5: Perimeter Wall Specifications – Wall C

SCIF Container Series | Part 6: Vents and Ducts

SCIF Container Series | Part 7: Modular SCIFs

SCIF Container Series | Part 8.1: Intrusion Detection Systems

Information has been gathered from sources deemed reliable but not guaranteed and is subject to change without notice. The information contained in this site is provided for informational purposes only.

SCIFs, when not occupied, must be protected by Intrusion Detection Systems (IDS). This includes walls that are not at the SCI level. The AO will ultimately determine what security programs will be needed to protect these areas of a SCIF from unauthorized entry and movement. Doors that don’t have access control systems and/or not under visual surveillance must be monitored by the IDS. In the event of a power failure or other event that makes the IDS inoperable, SCI-indoctrinated personnel must occupy areas of the SCIF until the IDS system resumes normal operation. The SCIF emergency plan will address IDS failures.

All system plans must be approved by the AO. As a part of the SCIF accreditation package, a final system acceptance testing will be conducted.

IDS System Requirements

All IDS installation of monitoring stations and related components must comply with:

• Underwriters Laboratories (UL) Standard for National Industrial Security Systems for the Protection of Classified Materials, UL 2050
  • Installation must comply with Extent 3 installation noted in UL 2050. This includes systems developed and used by the USG. These systems don’t need UL certification but should comply with Extent 3 installation.

Areas, as mentioned above, that do not need protection at the SCI level will be protected by IDS that includes UL 639 listed motion sensors and UL 634 listed High Security Switches (HSS) that meet UL Level II requirements and/or other AO-approved sensors. New SCIF accreditations must use UL Level II HSS. Until IDS modifications and upgrades are made, existing UL Level I HSS are authorized.

All cabling that extends beyond the SCIF perimeter must use Encrypted Line Security or be installed in a closed sealed metal conveyance (pipe, tube, or something constructed of Electrical Metallic Tubing (EMT), pipe conduit or rigid sheet metal ducting). All joints and connections on the closed metal conveyance must be permanently sealed around all surfaced by welding, epoxy, fusion, etc. Set screws cannot be used to seal the surface. This seal will provide a continuous bond between all components of the conveyance. If a service or pull box must be used, it must be approved with GSA approved combination padlock or an AO approved key lock.

SCIFs that share a common perimeter or have an established Co-Use Agreement (CUA) and support the same IC Element, may have the PCU (Premise Control Unit) programmed into multiple units or partitions. This allows each SCIF to function as individual control units for the IDS installed in several different areas or rooms that are independent of one another. Compliance conditions apply to the PCU, IDS, and partitions of the PCU equally. However, the PCU must be independent of IDS safeguarding non-UL 2050 certified areas.

For a monitoring station that is in charge of more than one IDS, there must be both audible and visible annunciation for each IDS. Fire, smoke, radon, water, and other systems must be independent of the IDS. If IDS incorporates an access control system (ACS), the ACS notifications must be subordinate in priority to IDS alarms. Without the application of specific countermeasures and the approval of the AO, systems cannot include audio or video monitoring. If monitoring systems contain auto-reset features, those features must be disabled.

All system key items and passwords must be protected and restricted to U.S. SCI-indoctrinated personnel. Alarm activations must be displayed locally until cleared by an authorized SCI-cleared individual. Determined by the AO, all IDS technical drawings, installation instructions, specifications, etc. will be restricted and documented in the CSP.

IDS False Alarms

An IDS false alarm is defined as any alarm signal transmitted in the absence of a confirmed intrusion that is caused by changes in the environment, equipment malfunction, or electrical disturbances. If false alarms exceed this requirement, a technical evaluation of the system must be conducted to determine the cause. Once evaluation is complete and the system is repaired or resolved, it must be documented. False alarms cannot exceed one alarm per 30-day period per IDS partition.

System Components

Sensors

• All system sensors must be located within the SCIF
  • Exception: The AO can approve external sensors on the SCIF perimeter so long as they are installed in a closed sealed metal conveyance (pipe, tube, or something constructed of Electrical Metallic Tubing (EMT), pipe conduit or rigid sheet metal ducting). All joints and connections on the closed metal conveyance must be permanently sealed around all surfaced by welding, epoxy, fusion, etc. Set screws cannot be used to seal the surface. If a service or pull box must be used, it must be approved with GSA approved combination padlock or an AO approved key lock.
• SCIF perimeter doors must be protected by an HSS and a motion detection sensor
• Emergency exit doors will be alarmed and monitored 24 hours per day
• When primary entrance door has a delay to allow changing the system mode of access, this delay must not exceed 30 seconds
• Dual technology sensors are authorized when each technology transmits alarm conditions that are independent of the other technology.
• Areas not protected at the SCI level will have a sufficient number of motion detection sensors or be approved by the AO. Sensors will consist of UL 639 listed motion sensors and UL 634 listed HSS that meet UL Level II requirements and/or other AO-approved equivalent sensors.
  • Note: For facilities outside the U.S. and in Category I and II countries, motion detection sensors above false ceilings or below false floors may be required by the AO.
• Failed sensors will cause immediate and continuous alarm activation until this failure is investigated and corrected following procedures documented in the SCIF SOP/Emergency Action Plan.

Premise Control Units (PCUs)

Premise control Units (PCUs) must be located within a SCIF and access modes can only be started by SCIF personnel only. The access/secure switch will be restricted by a device or procedure that confirms authorized use. Within the SCIF, the cabling between sensors and the PCU must be dedicated to the system and comply with both national and local electrical codes and Committee for National Security Systems (CNSS) standards. However if the wiring can’t be contained within the SCIF, the wiring must meet the requirements in the External Transmissions Line Security section below.

At the PCU and/or monitoring station, alarm status must be continuously displayed with an alphanumeric display. Every effort must be made to install the alarm-monitoring panel in a location that prevents observation by unauthorized personnel. The PCU/monitoring station must identify and display all activated sensors. A change in power status (AC or backup) will also be indicated locally and at the monitoring station/PCU. All auto-alarm reset features of the IDS must be disabled.

Alarm notifications must be immediate and continuous for the following situations:

• Intrusion Detection
• Failed Sensor
• Tamper Detection
• Maintenance Mode
• IDS Sensor Points masked or shunted during maintenance mode

In the events noted above, only SCI-indoctrinated personnel can reset the PCU and only after inspection and determination for the cause of the alarm. IDS transmission lines going from the SCIF to the monitoring station must meet the National Institute of Standards and Technology, Federal Information Processing Standards (FIPS) for certified encrypted lines. The FIPS standards employed must be noted in the UL 2050/CRZH Certificate or other certificate. PCUs that are certified under UL 1610 have to meet FIPS 197 or FIPS 140-2 encryption certification and method.

For PCUs certified under UL1076, only FIPS 140-2 will be the accepted encryption certification and method. The AO can approve alternative methods but must be noted in the IDS Certificate. IDS Admin that are SCI cleared must maintain and change all default profiles, PINs, or passcodes to a unique PIN/passcode.

More IDS specifications will be explored in the next installment: Part 8.2.

Does your facility require a SCIF? KL Security offers SCIF Container Solutions with panelized modular systems for scalable modular, portable, & mobile requirements.  We assist in the acquisition of modular facilities for DoD & Government Access Control and ICD705 SCIFs or SAPF facilities. We also assist with special access control planning and commercial business security.

Call 866-867-0306 or email [email protected] to see how the experts at KL Security can assist your facility in security needs.

Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities

SCIF Container Series | Part 1: Site Evaluation

SCIF Container Series | Part 2: Design Planning Checklist

SCIF Container Series | Part 3: Perimeter Wall Construction – Wall A

SCIF Container Series | Part 4: Perimeter Wall Specifications – Wall B

SCIF Container Series | Part 5: Perimeter Wall Specifications – Wall C

SCIF Container Series | Part 6: Vents and Ducts

SCIF Container Series | Part 7: Modular SCIFs

Information has been gathered from sources deemed reliable but not guaranteed and is subject to change without notice. The information contained in this site is provided for informational purposes only.