At Bill Barr's talk today, one of the other attorney's recommended using 2-factor authentication. That used to be done with a keyfob. You pressed a button to see the number, and keyed it in. But nowadays folks use a smartphone app.
And that is exactly what screwed them in Des Moines. They designed the computer system to require 2-factor auth, but banned the phones which had the 2-factor app on them. And you can't just write down the number either because they expire after 15-30 seconds. You must have that 2-factor device with you beside the keyboard.
I you need SCIF style security then don't use a mobile phone app and do use a keyfob that will be allowed into the SCIF.