D3-RFS RF Shielding: Where Shielding Helps and How to Test It

Radio energy crosses walls in both directions, so a room or enclosure without shielding can leak signals out and let interference in. MITRE D3FEND names this countermeasure RF Shielding (D3-RFS) and defines it as "Adding physical barriers to a platform to prevent undesired radio interference." It sits under the Harden tactic as a child of Electromagnetic Radiation Hardening. D3FEND's own entry is thin: a definition, two references and a short list of inferred ATT&CK relations, so this card stays short. It covers what shielding does, where organisations actually use it, how to test it and where it fails. It is written for facilities security, secure-site engineers and security architects who already know the basics in the TEMPEST and Electromagnetic Emanations Guide.

Key takeaways

• It is a physical control. RF shielding is conductive material around a device, rack or room that attenuates radio energy; no software setting implements it.
• Most organisations need it only in a few places. Classified facilities, secure meeting rooms, device test labs and evidence storage are the usual cases, decided by a threat assessment, not by default.
• The seams decide the result. Doors, windows, cable and pipe penetrations and ventilation openings are where shielding fails, which is why the US SCIF specification addresses each of them.
• D3FEND's ATT&CK links are inferred. D3FEND relates D3-RFS to keylogging, USB exfiltration and hardware supply chain compromise only through the shared Hardware Device artefact; shielding does not stop those techniques on its own.
• Measure, do not assume. Shielding effectiveness is tested with a standard method such as IEEE 299 at commissioning and after any building work that touches the shield.

D3-RFS at a glance

How it works

A continuous conductive surface around a space reflects and absorbs radio energy, so the field strength on one side is a fraction of that on the other. The reduction is expressed in decibels as shielding effectiveness. The surface can be sheet metal, metal mesh, conductive foil laminated into wall board, or conductive fabric. Every opening in the surface is a potential leak, so practical shielding is mostly about the details:

• Doors: conductive gaskets or finger stock around the frame, which wear and need inspection.
• Windows: conductive film or mesh, or no windows at all.
• Penetrations: metallic pipes and conduits carry energy through the shield unless they are bonded or broken with a dielectric section; power and data lines need filtering, or fibre instead of copper.
• Ventilation: honeycomb panels that act as waveguides keep air moving while blocking the frequencies of concern.
• Grounding and bonding: the shield must be electrically continuous; painted or corroded joints break it.

Shielding works in both directions. It keeps compromising emanations from equipment inside a room from reaching a receiver outside, and it keeps external signals, including jamming and covert command channels, from reaching devices inside. D3FEND's definition stresses interference; for most security teams the outbound leakage case matters as much.

ATT&CK techniques D3FEND relates to D3-RFS

Relationship type: inferred only. D3FEND lists these relations as inferred and experimental, derived because D3-RFS hardens Hardware Device and the techniques act on hardware devices (D3FEND 1.6.0, checked November 2026). Each ID was checked against ATT&CK v20. Shielding is at best a contributing control for these techniques.

The defensive pages for the parent techniques go deeper: MITRE ATT&CK T1056 Input Capture, MITRE ATT&CK T1052 Exfiltration Over Physical Medium and MITRE ATT&CK T1195 Supply Chain Compromise.

Where it is implemented

In the United States the reference for secure facilities is the NCSC technical specification cited by D3FEND (version 1.5, March 2020, for ICD/ICS 705). It places the decision with a Certified TEMPEST Technical Authority, who reviews construction plans and decides whether TEMPEST countermeasures are needed. It describes RF protection for perimeter walls installed at that authority's direction when a facility processes electronically and lacks adequate attenuation, foil-backed wall board or an approved RF foil layer, RF treatment of windows, doors that meet TEMPEST requirements, and dielectric breaks or grounding for metallic penetrations. Other countries have their own national emissions security schemes; private-sector sites borrow the methods without the accreditation.

Implementation steps

1. Decide whether you need it. Write down the threat: compromising emanations from classified or highly sensitive processing, covert radio implants, interference with test work, or remote wiping of seized devices. If none applies, spend the budget elsewhere.
2. Choose the smallest scale that works. A shielded bag or test enclosure is far cheaper and easier to verify than a shielded room.
3. Set the requirement. State the frequency range and the attenuation needed, as an owner decision informed by the threat assessment or by the national authority where one applies.
4. Design the seams first. Specify doors, filters, waveguide vents and fibre connections before wall finishes, and keep copper penetrations to a minimum.
5. Commission with measurement. Test shielding effectiveness against the requirement before the space goes into use and keep the results.
6. Control what goes inside. Pair the shield with a portable electronic device policy and storage outside the room; a phone carried inside defeats much of the purpose.
7. Re-test after change. Any new cable run, door replacement or building work on the shield triggers a re-test.

How to verify it works

• Formal measurement: IEEE 299-2006, Standard Method for Measuring the Effectiveness of Electromagnetic Shielding Enclosures, is the common method. A revision project approved in February 2025 covers 9 kHz to 40 GHz, extendable from 50 Hz to 100 GHz, and leaves test frequencies and pass or fail limits to the enclosure owner.
• Quick functional check: place a phone inside a bag or enclosure and confirm it loses cellular, Wi-Fi and Bluetooth connectivity. This is a smoke test, not a measurement.
• Visual inspection: door gaskets intact and clean, filters in place, no unauthorised cable runs, no gaps at panel joints.
• Spectrum survey: periodic RF surveys inside and outside a shielded room to find unexpected transmitters.

Limits, bypasses and failure patterns

• Insiders carry radios in. A shielded room protects nothing if phones, smart watches or wireless peripherals are used inside it. See the Wireless Peripheral Security Guide.
• Conducted paths: copper power, telephone and network cables carry signals straight through an otherwise good shield unless filtered.
• Degradation after work: a contractor drilling through a wall or replacing a door can break the shield without anyone noticing until the next test.
• Wrong threat: shielding does not stop malware, USB copying or a compromised device that stores data for later collection.
• Over-scoping: shielding an entire office is expensive and blocks legitimate wireless; most risk sits in a few rooms.

Framework mapping

Related countermeasures

• Electromagnetic Radiation Hardening (D3-EMH): the parent. See D3-EMH Electromagnetic Radiation Hardening.
• Physical Enclosure Hardening (D3-PEH): the mechanical protection that often houses the shield. See D3-PEH Physical Enclosure Hardening.
• Limit Hardware Installation (M1034): the ATT&CK mitigation for the device side. See M1034 Limit Hardware Installation.

Practitioner checklist

• Record the threat that justifies shielding for each shielded space.
• Use bags or enclosures before considering a shielded room.
• Write down the frequency range and attenuation requirement.
• Specify doors, filters, vents and fibre links before construction.
• Measure shielding effectiveness at commissioning and keep the report.
• Enforce a portable device policy with storage outside the space.
• Re-test after any work that touches the shield, and on a fixed cycle.
• Inspect door gaskets and penetrations on a schedule.

Standards and references

• MITRE D3FEND: RF Shielding (D3-RFS)
• NCSC: Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities, version 1.5
• IEEE: P299, Standard Method for Measuring the Effectiveness of Electromagnetic Shielding Enclosures
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls (PE-19 Information Leakage)
• MITRE ATT&CK: Keylogging (T1056.001)
• MITRE ATT&CK: Compromise Hardware Supply Chain (T1195.003)

Related NHI Mgmt Group resources: TEMPEST and Electromagnetic Emanations Guide · Physical Layer and Wireless Jamming Guide · Physical Security Guide for Security Teams · MITRE ATT&CK T1200 Hardware Additions · MITRE D3FEND Guide