You've Lived Through Six Years of RF Whiplash. Here's What You Know Now.
Here's a moment you've probably had. Someone new on your project, maybe a PM or a program manager from another office, asks what sounds like a simple question: "So how much RF shielding do we actually need?" And you pause. Not because you don't know.
If you've worked on SCIFs or SAPFs for a while, you've lived through every turn of this story. Whether you sit in a government security office, draw the perimeter details, run the CSP, or price the work, you've had to make real decisions while the guidance kept moving.
You remember when foil was enough
If you're an architect, you've detailed it. If you're a GC, you've installed it. If you're a security officer, you've signed off on it: architectural foil in the perimeter walls, no RF door, no waveguides at the ducts, nothing at the floor or ceiling. It met the line item.
And somewhere along the way you probably suspected what RF engineers have said publicly for years: shielded doors, filters, and treated penetrations add little real value unless they're part of a continuous six-sided enclosure. RF finds the gap. A shielded wall with an open duct is a bucket with the bottom cut out. If that ever made you uneasy, you were right.
You heard the rumors before the paperwork
Around 2018 and 2019, the people closest to the work started hearing that some CSAs would ask for real shielding performance, with numbers in the 60 to 80 dB range coming up in conversation. Nothing was published. But if you were paying attention, you knew where this was heading before the documents caught up.
Then, around 2020, one large DoD CSA directed that its spaces be treated on all six sides, and walked it back almost as quickly, most likely over cost. What stuck with some, was the message that came with the walk-back: plan for six sides anyway, or expect reciprocity problems later. If you took that advice, you're ahead of a lot of portfolios right now.
You've also seen what came next. ICD 705 exists so that a SCIF accredited by one IC element can be used by the others. As agencies answered the RF threat with their own requirements, you started running into spaces that worked for one customer and not the next. You've watched reciprocity fray from the inside.
You're working from a 2021 document
The IC Tech Spec you open on every project is Version 1.5.1, from 2021, and it's still the governing baseline. The directive behind it dates to 2010. Before 1.5.1, the Tech Spec moved every couple of years. Five-plus years without a revision is new territory.
And if a colleague tells you a new ICD 705 came out in 2025, you can save them some trouble. It didn't. Version 1.5.1 is still what your space is built and accredited to.
You got a deadline, then you lost it
In January 2025, ODNI gave you dates: review your SCIFs and identify required upgrades by the end of 2025, and complete those upgrades by the end of 2028. The focus was legacy spaces, grandfathered DCID 6/9 and DCID 1/21 facilities among them, brought up to current ICD 705. If you're a government security manager or a contractor's FSO, there's a good chance you spent a big part of 2025 on inventories, risk assessments, and POA&Ms.
Then, on May 4, 2026, NCSC rescinded the POA&M requirement. It also said plainly that a revised standard is coming and that currently accredited facilities won't be insulated from it.
You can probably read that the same way we do. The government doesn't want you spending millions toward a target that's about to move. Guess low and you rebuild. Guess high and you've overspent on a space that would have accredited for less. That's reasonable. It also leaves you holding a budget, a schedule, and a leadership team asking what changed.
You know the clock better than anyone
If you build these spaces, you know a typical SCIF or SAPF construction contract runs six months to a year depending on size, and that's after design and before accreditation. Industry estimates put the full planning, construction, and accreditation cycle at 12 to 24 months or longer. If you're on the government side, you know major upgrades and new facilities move through programming, funding, design, and construction over five to ten years.
So you already see the problem. In May, the revised standard was described as coming as soon as possible. It's now late October. Every month it stays unpublished is a month you can't spend designing toward it.
What you can do this quarter
You don't have to wait to make progress. Whatever your role, a few moves will pay off no matter what the next revision says:
If you own or manage the space: baseline it now. What standard was it accredited under, when was it built, and what RF treatment is actually in the walls, not just on the drawings?
If you're the security lead: start the conversation with your AO and CTTA about where they see RF and TEMPEST heading for your mission. A space on an installation with strong Security in Depth will get a different answer than a leased suite downtown.
If you're the architect or engineer: design space considering all six sides now. Think about slab and ceiling access, how ducts and piping cross the perimeter, and door frames that can accept RF hardware.
If you're the GC or estimator: price a range and show your client why. That alone makes you one of the most useful people at the table.
Whatever your role: ask what any RF treatment is actually buying. If it doesn't close all the paths, you've earned the right to question it.
If you want to go deeper, our April post ICD 705 Is About to Change More Than You Think covers what we expect the revision to address, and The New RF Shielding Requirements shares a field view of what's showing up in the project pipeline.
The people who will handle the next revision best aren't the ones waiting for it. They're the ones who already understand how we got here. After reading this, that's you.
If you're weighing a specific space and want someone to think it through with, we're glad to.
Talk to an Expert and tell us what you're working through.
Comments