ICD 705 and tablets: what's actually allowed in a SCIF

This is not legal advice. ICD 705 and its Technical Specifications (the “Tech Spec”) are ODNI policy and the accrediting authority on your program is the people who say yes or no. What follows is how the policy text tends to be applied to tablets in practice, and what tablet configurations get an easy yes.

What ICD 705 actually says about devices

ICD 705 is the directive that governs the physical and technical security of SCIFs. The portion that matters for tablets is the prohibition on personally owned and portable electronic devices (PEDs) capable of recording or transmitting inside the SCIF perimeter. The Tech Spec elaborates: cameras, microphones, cellular radios, Wi-Fi, Bluetooth, and GPS are all controlled. A device that can do any of them is, by default, not coming in.

The accreditor can grant exceptions for mission-essential devices. In practice the exception requires either: (a) the capability is verifiably disabled at the hardware level, or (b) the device is government-furnished and managed under a specific approval. Software disablement is usually not sufficient on its own.

Why “turned off in MDM” rarely clears the bar

An accreditor’s job is to assume bad outcomes. A configuration profile can be edited, a supervision channel can drop, an OS update can change API semantics. None of those scenarios are likely on any given Tuesday, and all of them are easier to explain than a recording incident inside a SCIF. Hardware redaction collapses the question: the camera is not on the board, so there is no scenario in which the camera records.

A tablet configuration that tends to clear ICD 705 review

We aren’t a SCIF accreditor and your accreditor will have the final word. That said, the configuration that customers most often deploy under ICD 705 review is:

• All cameras physically removed (front, rear, accessory). Apertures sealed and refinished.
• All microphones physically removed. Acoustic ports sealed.
• Cellular modem removed (LTE / 5G). Cellular SIM tray sealed.
• GPS removed.
• Wi-Fi and Bluetooth: removed or retained based on whether your SCIF allows a controlled WLAN. If not, both go.
• Speakers: program preference. Some accreditors require silent operation; others allow speaker output.
• Documentation: a serial-numbered Certificate of Redaction and an evidence packet of per-stage photography, retained for the life of the program.

What the accreditor is going to ask

1. Where was the work performed, and by whom.
2. What is the chain of custody from purchase to deployment.
3. What is the visual indicator that this is a redacted unit, not an unmodified one.
4. How will you re-verify inert state during periodic inspections.
5. What is the procedure if a device is lost, stolen, or returned for repair.

None of these are trick questions. They’re the same questions every accreditor asks about every PED. A redaction vendor that can’t answer them on the spot is the wrong vendor.

One more thing about Apple

Apple does not certify or authorize hardware redaction. Neither does Samsung or Google. CBR Labs is an independent service provider. The redaction voids the remaining manufacturer warranty. We disclose this on every quote because the accreditor will ask and procurement will need to see it acknowledged.