What Is CIaaS? SCIF-as-a-Service and Classified Infrastructure-as-a-Service Explained

Classified Infrastructure-as-a-Service (CIaaS) is a subscription to all the infrastructure a company needs to execute on a classified contract. If you've won classified work, or expect to, CIaaS lets you start in a fraction of the time, because you don’t have to build a facility first. This post covers what CIaaS includes, how it differs from SCIF-as-a-Service, which rules still apply to you, and why the Defense Innovation Unit (DIU) made it the first line of effort in its Bridge Program.

It usually goes like this: You want to win a contract with a classified requirement, but you don't have anywhere to perform it. The government won't let you build and accredit a facility until you hold a contract with a classified requirement - a chicken-and-the-egg problem. Once you do, the build takes years.

You may know the idea as SCIF-as-a-Service or Classified Space-as-a-Service, after the Sensitive Compartmented Information Facility (SCIF) most people picture when they think of classified space. CIaaS is similar, but what you receive can differ, because CIaaS is all-inclusive. At Nooks, we pioneered CIaaS - licensed (not leased) authorized use of classified facilities, with the facility security and the classified IT and networks that go with them. Because we provide more than a "SCIF," we wanted a term that describes the product more accurately.

The short version

CIaaS lets a company start classified work without building a facility. One subscription, sized to your program, covers the accredited classified workspace, the facility security, and the classified IT and networks. People also search for it as SCIF-as-a-service.

SCIF-as-a-service usually means the accredited space on a subscription. That subscription doesn't necessarily include the classified networks. CIaaS does, along with the facility security.

CIaaS now has a definition in law. Section 874 of the Fiscal Year 2025 National Defense Authorization Act (NDAA) defines "shared commercial classified infrastructure," and DIU's Bridge Program made CIaaS its first line of effort.

Subscribing skips the build, but it doesn't skip the rules. The government still accredits the space, your company still needs its Facility Clearance (FCL), and your people still need their clearances.

What does CIaaS include?

CIaaS includes three things companies otherwise buy and manage separately: the accredited workspace, the facility security, and the classified IT and networks. Depending on your contract requirements, CIaaS can include Intelligence Community Directive (ICD) 705 space, National Industrial Security Program Operating Manual (NISPOM) space, classified networks, and server space. ICD 705 space is built to the intelligence community's standard for SCIFs, while NISPOM space follows 32 CFR Part 117, the rulebook for cleared contractors.

The workspace is a fully equipped workstation in an accredited, secured suite, with two monitors, a switch for multiple networks, and a secure phone. It comes two ways. Grove is a dedicated workstation in a private secure suite, yours full-time, for a standing team that needs seats every day. Acorn is an on-demand workstation booked by the hour at any of our locations, for short-term, ad hoc, or cross-site needs.

Facility security comes with the space. Cleared, on-site personnel, including Facility Security Officers (FSOs), handle facility compliance and visitor escorting. We also offer security support for your organization on its own, as Managed Security Services.

The classified IT and networks are in place too. That means on-site IT support, plus support for multiple unclassified and classified networks, so a cleared team can start work without waiting on connectivity.

We have live sites in National Landing (the Arlington area) in Virginia, Colorado Springs, and El Segundo, California. Huntsville, Alabama, is now in presale. Six more markets open over the DIU Bridge contract period, so a distributed cleared workforce can often work closer to home.

What SCIF-as-a-service can leave out

SCIF-as-a-service usually covers the room, and the subscription doesn't necessarily include the classified networks. SCIF-as-a-service means you subscribe to seats in a facility that someone else built, accredited, and operates. That solves the room.

CIaaS is all-inclusive. The accredited workspace, its facility security, and the classified IT and networks come on one subscription, so a cleared team can sit down and work. If a provider gives you a room and leaves the networks to you, that's a SCIF subscription. CIaaS includes the networks at the appropriate classification and based on your contract requirements.

You can't build a SCIF until you've won the work

To win classified work, you need approved classified space. But the government won't let you build and accredit your own until you hold the classified contract that requires it. Our founders spent their government careers trying to get non-traditional companies onto classified programs, and they call this a chicken-and-egg problem. You can't get the work without the space.

Two things made that trap worse, and the first is that classified work spread beyond the intelligence agencies. In a 2026 article, advisory firm Plante Moran wrote that the Departments of Defense, Energy, and Homeland Security and the FBI now expect contractor staff to work inside approved classified space. Solicitations assume you already have it, and Plante Moran's summary was "no SCIF, no bid."

The second is that building your own stayed slow and expensive. The same Plante Moran article puts SCIF construction at roughly $500 per square foot for larger facilities and above $1,000 for smaller or more complex ones. Even modest projects reach seven figures, and accreditation adds six to 18 months on top of design and construction. For a company that just won its first classified contract, the work can start long after the award, if the budget survives at all.

There's a scale problem underneath all of this. The rules for classified facilities were written when a few hundred thousand people held clearances, so a model of one company, one contract, and one dedicated facility made sense. Millions hold clearances today, and the facilities haven't kept pace. In our experience, most of that hardened space that is unattainable by small companies sits unused most of the time.

Subscription models close that gap the way cloud computing did for servers. Cleared teams draw on shared infrastructure that's already accredited, and they pay for what they use. A company can begin in weeks, so the capital project becomes a predictable operating cost.

Congress defined the model. DIU made CIaaS its first line of effort.

The category is now defined in law. Section 874 of the FY2025 NDAA, signed in December 2024, directed the Department of Defense to pilot a path for small businesses and universities into "shared commercial classified infrastructure." The statute defines that term as fully managed, shared, classified infrastructure and services operated by a private third party. The pilot runs through September 30, 2030, and we wrote about the NDAA pilot when the law passed.

Then DIU adopted the model. The Defense Innovation Unit unveiled its Bridge Program in August 2026 to clear the barriers that stall commercial companies after a defense award: clearances, classified space, accreditation, and testing. DIU's Bridge Program page lists "Classified Infrastructure as-a-Service (CIaaS)" as the program's first line of effort. DIU describes CIaaS as a "co-work model for on-demand classified sites, systems, and services in over a dozen cities across the country."

On September 10, 2026, we announced a four-year contract supporting the Bridge Program. The award funds two things. The first is expansion: the activation of our sites in six new markets (Austin, Boston, Chicago, New York, the San Francisco Bay Area, and Honolulu). Those sites open over the contract period and operate like our current sites, for the defense community at large.

The second is FSO-as-a-Service for up to 100 selected DIU portfolio companies. We deliver FSO-as-a-Service through our existing Managed Security Services, and we'll keep offering those services outside the contract as well.

Does subscribing skip the rules? No.

Every security officer asks this. Subscribing changes who does the accreditation work, but it doesn't remove the work or your own prerequisites. The company performing the classified contract still needs its own Facility Clearance (FCL), and each person still needs their own security clearance.

What CIaaS removes is the build: the construction, accreditation, and staffing of a facility that would otherwise sit between the award and the work. If you don't have an FCL yet, our Managed Security Services can help you get one.

The government approves classified space before anyone works in it, whatever label the space carries. For SCIFs, that means ICD 705 and its technical specifications. An Accrediting Official reviews the facility against detailed physical and technical requirements, and the accreditation doesn't issue if the documentation isn't complete and correct. Shared classified space goes through the same kind of review, and the provider carries the construction and the ongoing compliance.

ICD 705 is built around consistent standards and reciprocal use of accredited SCIFs across the government. Shared and subscription models work along similar lines. A space is accredited once, and more than one cleared organization can then use it, within whatever its accreditation and each program's sponsor allow.

Frequently asked questions

What does CIaaS stand for?

CIaaS stands for Classified Infrastructure-as-a-Service. CIaaS is accredited classified workspace on a subscription, with the facility security and the classified IT and networks included. At Nooks, we pioneered the model, and the Defense Innovation Unit uses the same name for the first line of effort of its Bridge Program.

Is SCIF-as-a-service the same as CIaaS?

Not always. SCIF-as-a-service usually means accredited classified space on a subscription, and that subscription doesn't necessarily include the classified networks. CIaaS is all-inclusive, so the accredited workspace, its facility security, and the classified IT and networks come on one subscription.

Do I still need a facility clearance?

Yes. The company performing the classified contract still holds its own Facility Clearance (FCL), and its people hold their own clearances. If you don't have an FCL yet, our managed security services can help you get one.

Can more than one company use the same SCIF?

It can. Shared and subscription models exist so that more than one cleared organization can use the same accredited classified space. Whether a particular space can host your program depends on its accreditation and your sponsor's requirements, so ask the provider early.

Does CIaaS support TS/SCI work?

At Nooks, we support multiple unclassified and classified networks all the way to the TEMPEST and ICD 705 standards. Confirm the specific networks and levels for your program with us.

Get classified space without the build

At Nooks, we provide Classified Infrastructure-as-a-Service: accredited classified workspace, facility security, and classified networks on one subscription, so a cleared team can settle in and start working within weeks. If you've won classified work, or expect to, see current locations and availability.

See locations and availability

Sources

• Plante Moran, "No SCIF, no bid: Why classified space is now essential for federal contractors" (2026): https://www.plantemoran.com/explore-our-thinking/insight/2026/05/why-classified-space-is-now-essential-for-federal-contractors
• Intelligence Community Directive 705 (ICD 705), Office of the Director of National Intelligence: https://www.intelligence.gov/assets/documents/intelligence-community-directives/ICD_705.pdf
• Public Law 118-159, National Defense Authorization Act for Fiscal Year 2025, Section 874: https://www.congress.gov/118/plaws/publ159/PLAW-118publ159.pdf
• Defense Innovation Unit, Bridge Program: https://www.diu.mil/bridge-program
• Nooks press release, "Nooks Awarded Defense Innovation Unit Contract to Expand Classified Infrastructure-as-a-Service Nationwide," September 10, 2026: https://nooks.works/news/nooks-awarded-diu-bridge-program
• Office of the Director of National Intelligence, Fiscal Year 2019 Annual Report on Security Clearance Determinations, as reported by ClearanceJobs, "How Many People Have a Security Clearance?" (2021): https://news.clearancejobs.com/2021/02/09/how-many-people-have-a-security-clearance/