What steps are involved in decommissioning a SCIF?

• A. Transferring SCI to another facility without logs
• B. A quarterly audit only
• C. Shutting down power and leaving devices as-is
• D. Secure disposal of SCI materials, removal of access capability, and documentation of decommissioning actions

Answer: (D)

Decommissioning a SCIF involves three tightly connected actions to protect SCI: securely disposing of all SCI materials, removing every means to access SCI, and documenting every step taken.

Secure disposal means ensuring any SCI in paper, electronic, or other media is destroyed or sanitized according to approved methods, with verification and a proper disposal record. This stops residual data from being recovered and provides evidence for audits and oversight.

Removing access capability means taking away every route that could allow continued access to SCI. This includes revoking credentials, deactivating accounts, turning off or isolating access controls, disconnecting networks or devices that could store or transmit SCI, and reclaiming or safely repurposing equipment. The goal is to prevent any future entry or data leakage from the former SCIF.

Documentation ties it all together. You need a formal decommissioning plan, an inventory of all SCI materials, records of when and by whom actions were completed, sign-offs, and retention of those records for the required period. This provides accountability and traceability, demonstrating that the facility no longer handles SCI and that proper procedures were followed.

Transferring SCI to another facility without logs, or performing only a quarterly audit, or simply shutting down power and leaving devices as-is would fail to remove risk, fail to establish control, and fail to provide the necessary evidence of proper decommissioning.