SCIF / TEMPEST / GOVERNMENT
Ethernet and Signal Line EMI Filters for
Ethernet and Signal Line EMI Filters for
SCIF and TEMPEST Installations
New ICD-705 requirements are in effect. All signal line wires, including Ethernet lines and CAT cables, that cross the SCIF boundary must now be filtered. DJM ACTIV and Pasif filters exceed ICD-705 shielding requirements and install on the shield wall using your existing network infrastructure (e.g., CAT5e, CAT6, CAT6A, CAT7, CAT7A). 100dB. RJ-45 on both sides. Up to 10Gbps full throughput. No fiber media converters required.
Why DJM Filters
Five Reasons to Choose DJM EMI Filters
- The filter simply works. The ACTIV 10G provides 100dB shielding effectiveness from 10kHz to 40GHz, performance that exceeds the minimum requirements in IC Tech Spec v1.5.1 for Ethernet penetrations. Install it, plug it in, and you're passing data.
- Easier than fiber. Fiber media converters require SFP modules, waveguides, mounting spaces, fiber patch cables, power supplies, and AC outlets on both sides of the shield. The ACTIV 10G installs through one hole in the shield wall. Existing CAT cables are used on both sides.
- Better than waveguides. Waveguide penetrations are limited by their physical diameter. A 1″ diameter waveguide starts to fail above 7GHz. Smaller diameters cut off at higher frequencies but cannot pass a standard media converter fiber connector. The ACTIV 10G delivers better than 100dB shielding effectiveness from 10kHz to 40GHz, with no waveguide required and no compromise at the frequencies that matter most for modern EMSEC.
- Copper on both sides of the shield. Every SCIF already has copper network infrastructure. Our filters use it. The unprotected network connects via RJ-45 on standard CAT cable. The protected network connects via RJ-45 on standard CAT cable. No adapters, no fiber infrastructure, no re-terminations.
- Made in the USA. Every DJM filter is built in the United States and ships fully tested. We are the manufacturer, not a distributor. TAA compliant, Buy American eligible, and Section 889 clean. Full supply chain documentation is available upon request for federal procurement.
Comparison
DJM Filters vs Media Converter Comparison
Feature
Fiber Media
Converter
Converter
DJM ACTIV 10G
Single unit installs through a single hole in the shield wall
No new fiber optic runs. Uses existing CAT cable infrastructure.
No separate waveguide required
No SFP modules or fiber patch cables required
Single power feed outside the shield only
No equipment inside the shielded space to troubleshoot
Performance exceeds NSA 94-106 requirements through 40GHz
Supports 10Mbps to 10Gbps with auto-negotiation
Our SCIF Lineup
Four DJM filters cover the vast majority of SCIF signal-line requirements. All four are stocked and ship from San Diego. For hardwired variants, HDMI filtering, EMP-hardened installations, USB 2.0 and AC power filtering, we also build special-order configurations. Contact engineering for custom specifications.
DJM-A10G
10G
The flagship DJM filter for primary SCIF network drops. 100dB shielding effectiveness from 10kHz to 40GHz on standard CAT6A cabling. DSP-based signal reconstruction delivers clean 10GBase-T through the shield wall with no internal emissions. One ACTIV 10G at the wall can feed a switch inside the SCIF for multiple drops, with a separate filter per data enclave for Red/Black separation.
View Details →
DJM-APOE
POE
Active Ethernet filter with integrated PoE injection. Generates and filters Power over Ethernet at the shield boundary, delivering up to 60W downstream to SCIF-interior devices including IP cameras, VoIP phones, access control and environmental sensors. Eliminates the need for a separate PoE injector inside the secure space.
View Details →
DJM-AUSB3
USB 3.1
Active USB 3.1 Gen 2 filter with DSP signal reconstruction for SCIF workstations and peripherals crossing the shield boundary. 10Gbps SuperSpeed+ throughput plus USB Power Delivery up to 60W. The first filter most integrators reach for when a SCIF user needs a keyboard, mouse, external drive, camera or test instrument on the secure side.
View Details →
DJM-P01G
1G
Passive filter delivering 80dB installed shielding effectiveness for Gigabit Ethernet and equally effective for any non-Ethernet signal running on CAT cable. Fire alarm systems, HVAC controls, thermostats, building automation, access control, intercom and more. No external power required. RJ-45 on both sides or eight bare-wire lines through a DJM RJ-45 to terminal block adapter.
View Details →
Signal Line Filtering
Pasif 1G: Filtering More Than Just Ethernet
The Pasif 1G is a passive filter built for Gigabit Ethernet, delivering 80dB installed shielding effectiveness with no external power required. What most SCIF specifiers discover after their first install is that the same 8-line architecture filters any low-voltage signal running on CAT cable. Fire alarm, HVAC, thermostat, access control, building automation, intercom, sound masking. Almost every non-Ethernet signal in a modern SCIF runs on CAT somewhere. The Pasif 1G filters all of it.
Non-Ethernet Applications- Fire alarm control panels
- HVAC controls and building management
- Thermostat wiring
- Access control (card readers, door controllers)
- Building automation (BACnet, LonWorks)
- Intercom and nurse call systems
- Sound masking systems
- Lighting controls
- CCTV control lines (non-video)
- RS-232, RS-422, RS-485 serial on CAT
- Dry contact sensing and control
- Low-voltage DC power distribution
Specify the Pasif 1G for every non-Ethernet penetration in the SCIF. One filter, any signal, no power needed. That's the Pasif 1G advantage.
Electrical Specifications
- 8 filtered lines (4 differential pairs or 8 independent single-ended)
- Maximum current: 500 mA per line
- Maximum voltage: 57 VDC or 40 VAC per line
- “Installed SE”: >80dB from 1MHz to 40GHz
- No external power required
- RJ-45 input, RJ-45 output
- 8 independent lines available through DJM RJ-45 to terminal block adapter
Installation
Drop-In Installation With the Universal Mounting System
Every DJM filter installs through a single hole in the shield wall. The Universal Mounting System uses a threaded hub on the filter body that mates to an interchangeable threaded penetration pipe. One drill, one filter, one flange nut. No filter plate, no connector plate, no intermediate hardware. The same filter installs through sheet metal, modular panels, acoustical panels and poured concrete.
- One hole per filter, one filter per penetration. Drill a 1-3/8″ circular hole, insert the filter, tighten the flange nut on the inside of the shield. No filter plate, no connector plate, no intermediate hardware. The filter IS the wall-mount.
- Fits any wall thickness. Standard penetration pipes of 1″, 3″, 9″ and 12″ handle the vast majority of SCIF wall constructions, from sheet metal to 11-inch poured concrete. Custom lengths available for any thickness.
- Swap the pipe, not the filter. Changing wall thickness later? Loosen the penetration pipe with a wrench, thread on a different length, reinstall. The filter body, flange nut, gasket and hole all stay in place.
- Built for the installer. 1″ NPS threaded pipe, 1-20 UNEF-2A filter hub, aluminum with electroless-nickel plating. The hardware is familiar, the installation is fast and the result is an RF-tight seal on the first try.
- Works with any DJM filter. The Universal Mounting System is standard across the ACTIV and Pasif product lines. Specify once, install everywhere.
Common Questions
Frequently Asked Questions
Why does the ACTIV 10G need to be plugged in?
A:The ACTIV 10G uses DSP-based signal reconstruction to deliver 100dB shielding effectiveness through 40GHz while passing 10GBase-T at full line rate. The DSP reconstructs your network data clean on the other side of the filter, stripped of EMI and unwanted signals. That's what makes 10Gbps across a compliance-grade filter possible. The filter draws 5W from a standard outlet on the unsecured side of the wall, no power needed inside the SCIF.
Do I need a waveguide to bring network traffic into a SCIF?
A:No. Waveguides were the historical approach for fiber runs into shielded spaces, and they come with a physics problem most specifiers never calculate: a waveguide only functions below its cutoff frequency. A waveguide sized to admit an SC fiber connector (roughly 1″ inside diameter) has a TE11 cutoff of about 7GHz. Above 7GHz, RF passes through. NSA 94-106 requires shielding effectiveness through 10GHz minimum, and modern EMSEC installations require performance to 18GHz or 40GHz. The waveguide approach fails its own compliance test. The ACTIV 10G delivers >100dB shielding through 40GHz, outperforming a waveguide at the frequencies that matter most. No waveguide required, because the filter does the shielding job better.
Do I need an RJ-45 filter, a CAT 6 filter, or an Ethernet filter? Which DJM product do I need?
A:These are three common names that don't all describe the same thing. RJ-45 is a connector. CAT cable is a physical transport. Ethernet is a protocol. Our filters address each of these differently depending on what is actually on the wire. The ACTIV 10G handles Ethernet on CAT cables that use RJ-45 connectors, including 10GBase-T. If your CAT cable is carrying something other than Ethernet (power, dry-contact signaling, RS-232, RS-485, or other low-voltage signals), the ACTIV 10G is the wrong filter. The Pasif 1G may be suitable for a broader range of low-voltage signals on CAT cables, on RJ-45 connectors, or on bare wires through a terminal block adapter, depending on the specific signal. Contact engineering with the signal details and we'll spec the right filter.
Do DJM filters work for fire alarm systems, HVAC controls, and other non-Ethernet signals on CAT cable?
A:The Pasif 1G may be suitable for these applications, depending on the signal. Many fire alarm, HVAC, and building automation systems run low-voltage signaling on CAT cable that falls within the Pasif 1G's 8 filtered lines, 500mA per line at up to 57VDC or 40VAC. Some systems use higher voltages, different protocols, or specialized wiring that requires a different filter or a custom configuration. Contact our engineering team with the system specs and we'll confirm whether the Pasif 1G is the right fit or whether a special-order filter would serve better.
How do I choose the right DJM filter for my SCIF?
A:Start with the signal type. For 10Gbps Ethernet, specify the ACTIV 10G. For PoE-powered devices inside the SCIF, specify the ACTIV POE. For USB peripherals on the secure side, specify the ACTIV USB 3.1. For Gigabit Ethernet or any non-Ethernet signal on CAT cable, specify the Pasif 1G. For hardwired configurations, HDMI, EMP-hardened installations or USB 2.0, contact engineering for a special-order configuration.
What type of cable works with DJM filters?
A:Any standard CAT cable. CAT 3, CAT 5, CAT 5e, CAT 6, CAT 6A, CAT 7. The filter passes the signal on the cable in front of it. If your existing SCIF has older CAT 5 runs, DJM filters work with them. If you're building new with CAT 6A, DJM filters work with that. The cable you have is the cable we support.
Do I need shielded CAT cabling?
A:It depends on the filter. The ACTIV 10G delivers 100dB shielding effectiveness regardless of whether your CAT cable is shielded (S/FTP, F/UTP) or unshielded. The DSP reconstruction reads and rewrites the signal cleanly either way. For the Pasif 1G, shielded CAT meaningfully improves installed system shielding effectiveness above 1MHz because the cable shield complements the filter at frequencies where passive filter insertion loss is already rolling off. For high-security passive installations or long cable runs, shielded CAT is worth specifying. For the ACTIV series, use whatever cable is already in the wall.
How do I bring Power over Ethernet into the SCIF? What are the advantages of Power over Ethernet?
A:Use the ACTIV POE. It generates and filters Power over Ethernet in a single filter at the shield boundary, delivering up to 60W to PoE devices inside the SCIF over the same CAT cable as the network data. PoE simplifies the SCIF interior: one cable to each IP camera, VoIP phone, access control reader, environmental sensor or wireless access point. No separate power runs to each device, no transformer plates inside the secure space, no additional penetrations for power. One cable, one filter, every PoE device powered.
Do you have a filter for USB? USB-C?
A:Yes. The ACTIV USB 3.1 is a stocked active filter for USB 3.1 Gen 2 connections at 10Gbps with USB Power Delivery up to 60W and USB-C connectors on the protected side. For USB 2.0 applications we build a Pasif USB 2.0 on special order. Contact engineering for USB 2.0 configurations.
Does the ACTIV POE pass Power over Ethernet through the SCIF shield boundary?
A:The ACTIV POE generates PoE. The filter is the injector, producing up to 60W of IEEE 802.3 Power over Ethernet inside the shielded space from a data-only feed on the unprotected side. The ACTIV 10G does not pass or generate PoE. The Pasif 1G passes PoE transparently when a PoE switch feeds it from the outside, which works for lighter loads and simpler installations. Pick the filter based on where the PoE is being generated.
Can one DJM filter feed multiple network drops inside a SCIF?
A:Yes. One ACTIV 10G at the shield wall can feed a network switch inside the SCIF, and the switch distributes to as many drops as the SCIF requires. The filter handles the full 10Gbps backbone through the wall, and the interior switch handles the rest. For Red/Black separation, specify one filter per data enclave, with a dedicated penetration for each.
I'm retrofitting a SCIF that has unfiltered CAT running through the shield wall. Can DJM filters work?
A:Yes. This is common. Older SCIFs frequently have unfiltered CAT penetrations that do not meet current ICD-705 or NSA 94-106 requirements, and that's increasingly a finding during re-accreditation. DJM filters are designed for retrofit. The Universal Mounting System fits existing penetrations in most cases with minor wall modification. Custom penetration lengths accommodate unusual wall thicknesses. Contact engineering with wall photos and we'll spec the retrofit.
Does DJM support SAPF installations?
A:Yes. Special Access Program Facilities follow the same RF shielding, penetration and filter requirements as SCIFs when accredited for SCI-equivalent use. DJM filters meet or exceed these requirements. The same product line serves both SCIF and SAPF installations.
Are your filters made in the USA?
A:Yes. Every DJM filter is built in the United States and ships fully tested. We are the manufacturer, not a distributor. The vast majority of components and value are US-sourced. TAA compliance documentation is available upon request for federal procurement.
Resources
Relevant Articles and Documents
Universal Mounting System
Field-replaceable penetration lengths for ACTIV and Pasif filters. Change the wall thickness in three minutes instead of three months.
Read Application Note →Cables, Connectors and Protocols... Oh My!
A practical guide to understanding the relationship between cable quality, connector types, and protocol performance in high-speed shielded installations.
Coming Soon
Reference Material
SCIF Relevant Standards and References
ICD-705
Intelligence Community Directive 705. The foundational directive governing the physical and technical security of Sensitive Compartmented Information Facilities (SCIFs) and Special Access Program Facilities (SAPFs). Establishes the framework for how classified spaces must be built.
IC Tech Spec v1.5.1
The implementing technical specification for ICD-705, detailing how SCIFs and SAPFs must be constructed, including signal line penetrations, RF shielding, filtering and bonding requirements. This is the document your accrediting official cites during inspections.
NSA 94-106
The National Security Agency specification defining RF shielding performance for secure enclosures, measured against IEEE 299 test methodology. Defines the actual shielding effectiveness numbers a high-security installation must demonstrate. The actual specification is not officially hosted publicly; the discussion article below provides authoritative context.
Specification archive at Cryptome (you didn't see this link here)
CNSSAM TEMPEST/01-13
Committee on National Security Systems Advisory Memorandum on TEMPEST and emissions security. Governs Red/Black separation and installation practices for equipment handling classified information.
(this is as close as we could get — the document itself is FOUO and not publicly downloadable)
Industry overview: BICSI presentation on Classified Facility Communications Cabling
IEEE 299-2006
IEEE Standard for measuring the shielding effectiveness of electromagnetic shielded enclosures. The test methodology referenced by NSA 94-106 and used to characterize SCIF RF performance.
Methodology explainer: IEEE 299 and 299.1 on Measuring the Shielding Effectiveness of Enclosures (EMC United)
MIL-STD-220
Military standard for measuring the insertion loss of EMI filters. Referenced in federal filter specifications for SCIF and TEMPEST applications. The current revision is MIL-STD-220C (May 2009), which supersedes MIL-STD-220B.
(current as of May 31, 2026)
Methodology explainer: Improving the Way We Measure Insertion Loss (Interference Technology)
TEMPEST
TEMPEST is the NSA's classified program for emissions security. The actual NSA TEMPEST standards (NSTISSAM TEMPEST/1-92, /2-92, /1-93, NACSIM 5000, and similar documents) remain classified, as does the NATO equivalent SDIP-27. What's publicly available is general background — the history, the threat model, and basic countermeasure concepts. The specific emanation limits, test procedures, and equipment certification details are not. The Crypto Museum overview is the closest authoritative public reference we could find.
General background: TEMPEST (codename) on Wikipedia
NACSIM 5000: the redacted TEMPEST primer — archived at Cryptome (you didn't see this link here)
Ready to Specify Your SCIF Network?
Talk to our engineering team about ACTIV 10G, ACTIV POE, ACTIV USB 3.1 or Pasif 1G for your SCIF, TEMPEST or SAPF installation. Hardwired variants, HDMI, EMP-hardened filters, Pasif USB 2.0 and Pasif AC10 are available as special-order configurations.