United States (federal) · other
SCIF / Air-Gap Posture: what it requires, and the records to keep
ICD 705 sets the requirement that SCI be handled only in accredited SCIFs built and operated to Intelligence Community physical and technical security standards. Classified information systems, typically air-gapped from unclassified networks, must be authorized before use, under ICD 503 for the IC and 32 CFR 117.18 (applying the NIST RMF) for cleared contractors, so any AI system used on classified data must be accredited inside that boundary.
01 / What it requires
What SCIF / Air-Gap Posture requires
Intelligence Community elements, DoD components and cleared contractors that store, process or discuss Sensitive Compartmented Information (SCI) or operate classified information systems.
- 01Process, store and discuss SCI only in a SCIF accredited by the cognizant security authority.
- 02Build and operate SCIFs to the ICD/ICS 705 Technical Specifications, including intrusion detection approved by the CSA.
- 03Obtain CSA authorization before any contractor system processes classified information (32 CFR 117.18).
- 04Appoint an Information System Security Manager and follow the RMF steps, system security plan and continuous monitoring.
- 05Keep classified systems separated from unclassified networks; cross-domain transfers need approved solutions.
02 / AI work
Where it touches AI work
AI models, data and tooling used on classified data must run on authorized classified systems inside accredited spaces; commercial internet-connected AI services cannot be used, and model updates or data imports cross the air gap only through approved transfer processes.
03 / Dates
The dates that matter
ICD 503 on IC information system risk management issued
ICD 705 on SCIFs effective
32 CFR part 117 (NISPOM) rule published
32 CFR part 117 takes effect, requiring RMF for classified contractor systems
04 / Enforcement
Who enforces it
Cognizant security authorities (e.g., DCSA for most contractors; IC elements for SCI) through accreditation withdrawal, facility clearance actions and contract remedies; unauthorized disclosure can bring criminal prosecution.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01SCIF accreditation documentation and fixed facility checklist
- 02Classified system authorization (ATO) from the CSA
- 03System security plan and ISSM certifications
- 04Self-inspection and continuous monitoring records
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
Can I run a compliance audit on an air-gapped or SCIF AI system?+
Yes, if the audit tooling runs entirely inside the accredited boundary and is approved for the classified system. Under 32 CFR 117.18, a cleared contractor's classified system must be authorized by the cognizant security authority, and security-relevant changes can require reauthorization, so audit tools go through the same change control as any other software. The tooling must not need a network connection. Any output moved off the system must be reviewed for classification and transferred only through approved procedures. Read the full answer
How do I deploy AI evidence collection at IL5/IL6 without network egress?+
Keep everything that touches the data inside the authorized boundary: the model, test data, evaluation tooling and logs. At IL5 that is a DoD-authorized cloud environment reached through a Boundary Cloud Access Point; at IL6 it is a classified environment with no internet connection. Add the tooling to the system's authorization package and change control, store results inside the boundary, and move out only material that has been reviewed and approved for release through the program's transfer process. The enclave's accreditation remains the program's responsibility. Read the full answer
Can a third party recompute my evidence record without my model?+
Yes, for integrity but not for results. If the record contains cryptographic digests, for example SHA-256 hashes combined in a Merkle tree, anyone holding the record can recompute them and confirm nothing in it was altered, without access to the model or data. Reproducing the measurements themselves requires the model and test inputs, which stay inside your boundary. In a classified setting, the record itself can be shared only after classification review and release through approved procedures. Read the full answer
SOURCES
Go back to the source
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: SCIF / Air-Gap Posture for defense AI workflows · NIST AI RMF · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4