By: Margaret M. Cassidy and Mary Marks
The Pentagon wants to take secure spaces where classified work can be down on the road.
Its new Secure Space Network calls for around fifty mobile Sensitive Compartmented Information Facilities (SCIFs), along with the information systems needed to support classified work. Led by the Department of Defense Office of Industrial Base Growth, the initiative aims to give companies that lack the resources, facilities and expertise to build their own SCIFs a place to do some of the most cutting-edge defense and intel work – that’s classified. That creates real opportunity, but mobility doesn’t diminish the national security obligations that come with performing classified work.
The legislative genesis of the shared-access idea is Section 874 of the FY2025 National Defense Authorization Act. Congress directed DoD to establish a pilot program to expand access to shared classified infrastructure for small businesses and institutions of higher education and to identify and address policies that stand in the way of that access. Section 874 did not specifically mandate mobile SCIFs specifically, it set a broader mandate.
Background: Facility Clearances, the NISPOM, and SCIFs
When a company looks to perform defense or intel work requiring access to classified information, it generally needs a Facility Clearance (FCL). To be eligible for an FCL, the government or a cleared contractor must assert to DoD that the company needs access to classified information to perform a classified contract and must sponsor the company getting a clearance to do that work. For companies under DoD security oversight, the Defense Counterintelligence and Security Agency (DCSA) determines a company’s eligibility and monitors cleared entities.
The National Industrial Security Program Operating Manual (NISPOM) which is written into federal regulations at 32 CFR Part 117, together with applicable agency and program requirements define the FCL process and requirements.
A SCIF is an accredited space for discussing, processing, using or storing sensitive compartmented information (SCI). Not all classified work requires a SCIF, and a contractor does not necessarily need to own one. The SCIF must meet applicable physical and technical security requirements.
With the right facility, personnel security clearances, program authorizations, need to know about classified information and DCSA approval, a cleared contractor can perform classified contracts, hold classified meetings and technical reviews, and collaborate with government customers and cleared industry partners on classified matters.
The Access Barrier
SCIFs take time, money, and security expertise to build and maintain, and non-compliance can cost a company its classified access, its customers’ confidence, and in serious cases, its eligibility for government contracts. Those costs can keep small businesses and new entrants to defense and intel out of classified work that they otherwise have the capability to perform.
A company may have innovative technology, a cleared workforce, and a government sponsor, but if it still lacks access to an accredited SCIF that the contract requires, it cannot participate in classified programs unless it performs the work out of a government SCIF or one managed by a cleared contractor.
The Secure Space Network Program
The idea behind mobile SCIFs is to lower the infrastructure barrier. — Eligible businesses could use approved secure space rather than build their own. Mobile SCIFS will be deployed to military bases (beyond the SCIFS there now), innovation hubs (many are at research universities), and APEX Accelerators (Federal Government funded business centers providing technical assistance around government contracting).
The hardware concept is not new– intelligence community standards already address mobile SCIFs. The challenge is expanding who will be able to use them and where. DoD’s belief is that earlier access to classified challenges will help companies develop defense, intel and national security solutions faster.
National Security Risks
There is, however, a national security concern that this opportunity presents and that DoD’s announcement does not address. Fifty mobile SCIFs multiply the locations where classified information can be accessed, mishandled, or spilled. New entrants may bring exceptional technology skills and innovation capabilities but may not have the institutional experience needed to manage a classified security program. That security capability needs to be in place before their employees begin classified work.
Shared secures spaces present another problem: one company’s authorized access does not authorize it to see another company’s classified work. Conversations, documents, screens and system permissions must remain separated based on who needs to know and compartment restrictions. A scheduling change or a poorly controlled handoff between users could become a security incident.
Mobile SCIFs that DoD says will invite innovation may also invites infiltration, insider compromise, and foreign influence into programs once protected by scarcity itself.
How Would the NISPOM/Regulations Need To Change To Accommodate Mobile SCIFs?
The NISPOM already permits classified visits and work at other approved facilities, so the mobile model does not automatically require a complete rewrite. FY25 NDAA Section 874 does, however, direct policy and regulatory work on sponsorship, accreditation, secure networks and shared-use approvals. Implementing a mobile SCIR requires settling three practical issues:
- Who owns each security function? Operating agreements must clearly allocate responsibilities between the facility operator and contractor, including access, safeguarding, training, insider-threat obligations, and incident reporting. The NISPOM provides the baseline requirements which will direct some of this.
- How does shared IT work? The NISPOM regulations at Section 117.18 require approved arrangements for classified systems, including IT system management, authorized users, information separation, and incident response. Booking space in a a SCIF does not itself authorize a user to access a classified network.
- What happens when the facility moves? Accreditation and shared use also require compliance with intelligence-community requirements, including setting up the requirements in the National Counterintelligence and Security Center Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilitiesrequirements at ICD 705. Deployment procedures must address the approvals and security checks required at each new location. The NISPOM alone does not resolve these issues.
DoD guidance and pilot programs can clarify existing requirements, but that does not address the regulations and the facility requirements in place to secure classified information. Any change to regulatory obligations requires rulemaking and all the other requirements related to accessing classified information – contractor eligibility, FOCI mitigation, and need-to-know controls still exist and not to be followed to secure classified information.
The Opening for Contractors
Access is the advantage.
If the security and operating arrangements are sound, the Secure Space Network could let more companies compete for classified work:
- Compete on capability, not capital. Startups, small firms and non-traditional entrants to defense and intel and with a sponsor, cleared personnel, and controls to meet other requirements for performing classified work could put their resources into technology rather than building or redesigning secure facilities.
- Earlier program access, acerates R&D and prototypes. Earlier exposure to classified problem sets, plus an appropriately equipped place for classified design discussions, technical reviews and development work, could speed solutions and let new entrants help shape programs and bring forward cutting-edge solutions.
- Regional access and collaboration. More locations could bring talent and partnerships into classified work beyond the usual defense hubs. That is the shared secure spaces may shorten the distance between defense and intel customers and industry, turning collaboration efforts that often required a plane ride and hotel into an ongoing working relationship.
The Bottom Line
Mobile SCIFs may break down barriers for many new entrants to the defense industrial base or for those looking to enter it by giving a space to do classified work. With this access comes a sober obligation – securing classified information. Having access to a SCIF is not the only obligation for cleared contractors. Businesses considering the program should prepare for facility-clearance sponsorship, understand and address foreign ownership, control or influence, build security and counterintelligence into their operations, and confirm that the facilities can support their contracts.
The Pentagon can remove the infrastructure barrier. Contractors must still build the security discipline and culture.
The scaled SCIF situation will be valuable as long as the vetting, monitoring, and decision cycles behind can identify and mitigate threats. Speed and accessibility should not outrun national security – broadening the industrial base while weakening national security is not a solution.
