TEMPEST Shielding: Standards, Requirements, and Certification
TEMPEST is one of the most misunderstood terms in government and defense security. It's not a product you buy or a certification you hang on the wall. It's a discipline — the study and control of unintentional electromagnetic emanations from electronic equipment that could be intercepted and exploited to reconstruct classified or sensitive information.
TEMPEST shielding is the physical layer of that protection. This guide explains what TEMPEST shielding involves, what the applicable standards require, how zones are classified, and what a TEMPEST-compliant facility needs beyond basic RF enclosure construction.
A TEMPEST-compliant facility addresses multiple emanation paths: RF through the enclosure, conductive through power and signal lines, and acoustic through structural paths.
What Is TEMPEST?
TEMPEST stands for Telecommunications Electronics Material Protected From Emanating Spurious Transmissions — though the acronym is less important than the concept. TEMPEST refers to the study and countermeasures addressing unintentional electromagnetic emissions from information-processing equipment.
Any electronic device that processes information also emits electromagnetic signals as a byproduct of its operation. These emanations — from monitors, keyboards, processors, and data lines — can in some cases be intercepted at a distance and analyzed to reconstruct the original information. TEMPEST countermeasures reduce these emissions to levels where interception is not feasible at the threat distance.
What Does TEMPEST Stand For?
TEMPEST is a code name for the government program addressing compromising emanations from classified information systems. The full backronym is Telecommunications Electronics Material Protected From Emanating Spurious Transmissions. NSA and DoD use the term to refer both to the threat (inadvertent electromagnetic disclosure) and the countermeasures against it.
TEMPEST Standards: NSA and DoD Requirements
TEMPEST standards are largely classified — the specific attenuation requirements and testing protocols are not publicly released because publishing them would help adversaries design interception equipment that stays just below the threshold.
What is publicly known:
NSTISSAM TEMPEST/2-95 (NATO AMSG 784)
The most referenced public TEMPEST document. It establishes a zoning approach to TEMPEST protection that defines acceptable emanation levels based on the proximity of the potential attacker to the facility.
TEMPEST Zones
TEMPEST protection is organized around three zones based on threat proximity:
- Zone 0: The most restrictive. Equipment must not emanate beyond specified levels even when the attacker has essentially direct access to the equipment.
- Zone 1: The attacker is assumed to be at controlled perimeter distance — inside the facility compound but not in the immediate area of the equipment.
- Zone 2: The attacker is assumed to be outside the facility perimeter — on a public street, in an adjacent building.
TEMPEST shielding requirements depend on which zone the facility is classified under, which in turn depends on where the facility sits relative to the controlled perimeter and what threat environment is assessed.
NSA TEMPEST Requirements
NSA evaluates and approves TEMPEST countermeasures for classified programs. Equipment used in TEMPEST-sensitive environments must be TEMPEST-endorsed by NSA, and the facilities housing that equipment must meet zone-appropriate construction and shielding standards. The specific NSA TEMPEST requirements are set out in classified documents.
TEMPEST Shielding: What It Involves
TEMPEST shielding is not simply installing a Faraday cage. A complete TEMPEST solution addresses three emanation paths:
1. Radiated Emissions (RF Shielding)
RF energy radiated from equipment passes through air. An RF enclosure — copper or steel shielded room — attenuates these radiated emissions. The enclosure must meet the attenuation specification for the applicable TEMPEST zone.
TEMPEST shielding standards are typically more stringent than commercial RF shielding specifications. A standard MRI room enclosure providing 90 dB may not meet Zone 0 TEMPEST requirements, which can demand 100 dB or more across a broader frequency range.
2. Conducted Emissions (Power Line Filtering)
Electromagnetic signals also travel out of equipment along power lines, signal cables, and ground conductors. TEMPEST power filters — hardened, high-performance RF filters on every power line entering the shielded space — address conducted emissions. TEMPEST power filters are substantially more robust than standard commercial EMI filters.
TEMPEST power filters are installed at every power line penetration of the shielded envelope. These are far more robust than commercial EMI filters.
3. RED/BLACK Separation
TEMPEST practice separates "RED" systems (those carrying classified information) from "BLACK" systems (unclassified) using physical separation, shielding, and filtering. The separation prevents classified signals from coupling onto unclassified infrastructure that exits the controlled space.
RED/BLACK separation requirements affect the facility's wiring layout, power distribution, and equipment placement — and must be integrated into the facility design from the outset, not retrofitted.
TEMPEST Filters: What They Are and Why They Matter
TEMPEST filters are specifically engineered, NSA-evaluated components that attenuate conducted RF emissions on power and signal lines to TEMPEST-specified levels. They differ from commercial EMI filters in:
- Higher attenuation at the critical frequencies of concern
- Evaluation and endorsement by NSA rather than commercial testing laboratories
- Physical construction designed to prevent bypass paths
- Documentation and traceability required for TEMPEST programs
TEMPEST power filters are installed at the penetration panel where power lines enter the shielded space. TEMPEST filters for data lines may also be required depending on zone classification and the sensitivity of the information processed.
The Difference Between TEMPEST Shielding and Standard RF Shielding
Standard RF shielding (for MRI, EMC testing, or basic SCIF construction) and TEMPEST shielding share the same fundamental technology — conductive enclosures, gasketed doors, filtered penetrations — but differ in specification rigor:
| Characteristic | Standard RF Shielding | TEMPEST Shielding |
|---|---|---|
| Governing standard | IEEE 299, scanner manufacturer spec | Classified NSA/DoD specifications |
| Attenuation requirement | Application-specific (typically 80–100 dB) | Zone-dependent, typically more stringent |
| Power line treatment | Commercial EMI filters | NSA-evaluated TEMPEST filters |
| Testing authority | Commercial laboratory or installer | NSA-endorsed testing |
| Documentation | IEEE 299 test report | Classified test documentation |
TEMPEST Certification: What It Means
TEMPEST certification — more accurately, TEMPEST endorsement — refers to NSA's evaluation and approval of specific equipment or facilities for use in TEMPEST-sensitive programs. NSA maintains lists of endorsed products (the NSA Evaluated Products List) and evaluates facility shielding against classified zone requirements.
TEMPEST-certified equipment means the device has been evaluated by NSA and found to emanate within acceptable levels for the applicable zone. TEMPEST-compliant facility construction means the facility's shielding and filtering have been evaluated against zone requirements.
How National Shielding Supports TEMPEST Requirements
National Shielding has designed and constructed RF shielded facilities for government and defense programs with TEMPEST requirements. We understand the technical specifications that govern TEMPEST shielding, the construction standards that apply, and the coordination required with the program's security authority. We work within the cleared construction ecosystem and can coordinate TEMPEST testing requirements with the appropriate authorities.
Frequently Asked Questions
What is TEMPEST shielding?
TEMPEST shielding is the combination of physical measures — RF enclosures, power line filters, signal line filtering, and RED/BLACK separation — used to reduce electromagnetic emanations from information-processing equipment to levels specified by NSA TEMPEST standards. It addresses radiated emissions (through air), conducted emissions (through power and signal lines), and cross-coupling between RED and BLACK systems.
What does TEMPEST stand for?
TEMPEST is a code name for the government program addressing compromising electromagnetic emanations. The backronym is Telecommunications Electronics Material Protected From Emanating Spurious Transmissions. It refers both to the threat of inadvertent electromagnetic disclosure of classified information and the countermeasures against it.
What are TEMPEST requirements?
TEMPEST requirements are defined by classified NSA and DoD specifications that establish acceptable emanation levels for equipment and facilities based on zone classification. Zone 0 is the most restrictive (attacker with near-direct access); Zone 2 assumes the attacker is outside the facility perimeter. Publicly available guidance (NSTISSAM TEMPEST/2-95) outlines the zoning framework.
What is a TEMPEST filter?
A TEMPEST filter is a power line or signal line filter that has been evaluated and endorsed by NSA to attenuate conducted electromagnetic emissions to TEMPEST-specified levels. TEMPEST filters are substantially more capable than commercial EMI filters and must be installed at every power and data line penetration of a TEMPEST-shielded space.
What is TEMPEST security?
TEMPEST security is the practice of protecting classified or sensitive information from inadvertent disclosure through electromagnetic emanations. It encompasses equipment evaluation, facility shielding, wiring practices, RED/BLACK separation, and operational procedures. TEMPEST security is overseen by NSA for U.S. government programs.
How does TEMPEST shielding differ from a standard RF enclosure?
TEMPEST shielding uses the same basic technology as commercial RF enclosures — conductive panels, gasketed doors, filtered penetrations — but must meet more stringent NSA specifications. TEMPEST power filters are more capable than commercial filters, testing must be conducted against classified zone requirements, and documentation requirements are more rigorous.