Collateral Classified vs. SCIF/SAPF: What Does Your Program Actually Need?
A practical guide for defense contractors evaluating classified workspace requirements.
Not every classified program needs a SCIF.
When a defense contractor receives work involving classified information, one of the first facility questions is often:
“Do we need a SCIF?”
Sometimes the answer is yes. Sometimes the requirement is a SAPF. And sometimes the work involves collateral classified information that does not require either.
Understanding that distinction matters because the different requirements can lead to very different decisions about space, cost, schedule and long-term commitment.
Start with the information—not the room
A secure facility should be driven by the information and program it is intended to support.
Before deciding what type of space to build or lease, a contractor needs to understand several things:
What information will be handled?
Is the requirement collateral Secret or Top Secret, Sensitive Compartmented Information (SCI), Special Access Program (SAP) information, or some combination?
Where may the work be performed?
Does the contract allow work in a contractor-controlled facility, or must it occur at a government or customer location?
What safeguarding or accreditation is required?
The answer can significantly change the physical-security requirements.
How much capacity is actually needed?
A ten-person program team has a very different real-estate problem from a 100-person organization.
How long will the requirement exist?
The economics of a three-year program can look very different from those of a permanent corporate capability.
Collateral classified requirements
For purposes of this discussion, collateral classified information refers to classified information at the Confidential, Secret, or Top Secret level that is not subject to additional controls such as SCI or SAP requirements.
That does not mean ordinary commercial office space can simply be labeled “secure.”
Under the National Industrial Security Program, contractors are responsible for safeguarding classified information in their custody, and storage of classified information requires approval from the applicable Cognizant Security Agency. NISPOM provides for approved methods including GSA-approved security containers, qualifying vaults and approved open-storage areas.
Depending on the actual requirement, a contractor may therefore need significantly less specialized physical space than would be required for SCI or SAP work.
That distinction can matter enormously when evaluating a new program.
What is a SCIF?
A Sensitive Compartmented Information Facility (SCIF) is an accredited facility used to protect Sensitive Compartmented Information.
SCIF physical and technical security requirements are governed through the Intelligence Community's ICD/ICS 705 framework and associated technical specifications. Those standards address issues such as physical protection, unauthorized observation or overhearing, forced entry and other security threats.
An important distinction:
Building a room to SCIF construction standards does not, by itself, make it an accredited SCIF.
Accreditation involves the applicable government authority and the particular facility, mission and intended use.
What is a SAPF?
A Special Access Program Facility (SAPF) is an accredited area used to protect information associated with Special Access Programs.
For DoD SAPs, current policy establishes specific SAPF physical-security and accreditation requirements. Contractor SAPFs also require the contractor to possess an appropriate Facility Clearance before the SAPF can be accredited.
SAPF and SCIF requirements can overlap significantly, particularly from a physical-security perspective, but the terms are not interchangeable.
A SAPF does not automatically become a SCIF, and a SCIF does not automatically satisfy every SAP requirement.
The applicable program and accrediting authority ultimately determine what is required.
So what space does a contractor actually need?
A useful way to frame the decision is:
COLLATERAL SECRET OR TOP SECRET
What safeguarding configuration will the CSA approve?
SCI REQUIREMENT
Is an accredited SCIF required?
SAP REQUIREMENT
What SAPF requirements does the program impose?
MULTIPLE PROGRAMS
Can requirements coexist, or is separation necessary?
CUSTOMER-SITE WORK
Is contractor-controlled space even permitted?
NEW OR UNCERTAIN PROGRAM
Does permanent construction make economic sense?
This is why “How many square feet of SCIF do you need?” may be the wrong first question.
The better question is:
“What secure environment does this program actually require?”
Build, modify, deploy—or lease?
Once the requirement is understood, there are several ways to satisfy it.
A contractor might:
use existing secure capacity;
modify an existing corporate facility;
construct permanent dedicated space;
install a modular or deployable secure facility;
work at a government or customer site;
use a prime contractor or teammate's facility; or
lease contractor-controlled secure workspace where an appropriate solution is available.
None of these is universally better.
Permanent construction can make excellent sense for a predictable, long-duration workload.
But a different equation may apply to a new contract, temporary surge, small cleared team, new compartment, uncertain follow-on, or rapidly approaching program start date.
In those situations, the ability to obtain only the amount of secure capacity actually needed can become valuable.
Where AeroSCIF fits
AeroSCIF is developing flexible, contractor-controlled secure workspace in central Oklahoma for aerospace and defense organizations that need classified capacity without necessarily developing an entire secure facility themselves.
The concept is being developed around two broad types of workspace:
Collateral Secure
Dedicated workspace intended to support eligible collateral classified requirements, subject to the tenant's contract, security authorization and applicable government approval.
High-Security Suites
Flexible secure environments intended to be designed around higher-security physical requirements and capable of supporting the pursuit of program-specific SAPF or SCIF accreditation.
The objective is not to assume every classified program needs the same solution.
It is to provide organizations with the right type and amount of secure space for the requirement they actually have.
OFFICIAL REFERENCES:
HELP SHAPE OKLAHOMA'S SECURE WORKSPACE
AeroSCIF is currently gathering input from organizations across Oklahoma's aerospace and defense community.
If your organization currently performs—or expects to perform—classified work, your perspective can help shape the types and sizes of secure workspace being evaluated.
Secure environments for classified programs
PROTECT
Flexible & purpose-built space for cleared teams
CONNECT
Accelerating the path to mission readiness
DELIVER
Strategically located in a growing defense ecosystem
POSITIONED