The tension between security requirements and the pace of technical change isn’t new, but the stakes have shifted. When you’re running a search for a VP of Security or a Chief Information Security Officer in the cleared space, you hear the same frustration from both sides—government program offices struggling to keep standards current, and contractors trying to budget for facility upgrades that may cost tens of millions before a single person walks through the door. The gap between threat assessment and implementation has real consequences, and it shows up in how companies staff, where they locate work, and whether they can even compete for certain contracts.
Mitch Lawrence’s commentary cuts to the center of it. He’s spent four decades in this world, and his point is simple: if the technical assumptions underpinning SCIF and TEMPEST standards haven’t kept pace with adversary capabilities, then we’re either over-investing in the wrong countermeasures or under-protecting what matters. The Intelligence Community calls its technical specifications a living document, but living documents still need someone to update them, and that requires a feedback loop between the people who understand emerging surveillance technology and the people writing policy. Right now, that loop is too slow and too narrow.
The cost estimates Lawrence surfaced are worth sitting with. An industry survey for OMB put the private-sector price tag for proposed upgrades somewhere between $20 billion and $40 billion. If you extend similar requirements across government facilities, he estimates the total could exceed a trillion dollars depending on scope and timeline. Those aren’t small numbers, and they force a question that doesn’t get asked enough in the cleared world: what are we actually buying for that investment, and how confident are we in the threat model driving it?
This isn’t an argument against rigor. It’s an argument for evidence. TEMPEST countermeasures exist because electronic equipment emits signals that can, under the right conditions, reveal what’s being processed or displayed. The question is how sophisticated an adversary’s collection capability really is, at what range, and in what environments. If those assessments are based on assumptions that haven’t been tested in years, then the risk calculus breaks down. You end up with requirements that are either too loose or too tight, and neither outcome serves national security.
The challenge Lawrence describes—outdated requirements, inconsistent interpretation, uneven technical expertise—maps directly onto the talent problem. When I’m working a search for a senior security engineer or a TEMPEST specialist, the candidate pool is small and the expertise is unevenly distributed. The people who truly understand this work are often the ones who’ve been doing it for decades, and there aren’t enough of them to go around. If the standards themselves are unclear or inconsistent across agencies, that makes it even harder to build teams that can implement them well. Reciprocity suffers, costs climb, and companies start making tradeoffs that weren’t part of the original security calculus.
Lawrence’s recommendation—bring industry into the process earlier and at the working level—makes sense because industry lives with the technology every day. The firms building and accrediting these facilities see what works, what doesn’t, and where the gaps are. That doesn’t mean handing policy over to contractors, but it does mean creating a structured way for technical expertise to inform requirements before they’re locked in. The alternative is what we have now: standards that lag behind the threat, guidance that varies by agency, and an accreditation process that can take years and still leave questions unanswered.
The broader point is about prioritization. Lawrence recalls a company asking, after being tasked with supporting Ukraine, Israel-Hamas, and Taiwan contingencies, what it should prioritize when also facing a multi-billion-dollar facility upgrade based on a threat assessment it hadn’t seen validated. That’s not a hypothetical. It’s the conversation happening right now in boardrooms across the defense industrial base. If we’re going to ask companies to make those investments, the threat model needs to be defensible and the requirements need to be consistent. Otherwise, you’re asking people to spend against uncertainty, and that’s a hard sell when the mission set is already stretched.
Modernization should mean better-informed standards, not just newer ones. If the Intelligence Community is serious about keeping its technical specifications aligned with evolving threats, then it needs a mechanism to pull in current expertise, test assumptions, and update requirements on a cycle that reflects how fast the technology is actually moving. That’s not a process problem—it’s a leadership problem. The people I place in these roles understand that. They know the difference between security theater and security that works, and they know that rigor depends on accurate information. The question is whether the system they’re working in will give them the tools to act on it.