Skip to Content

Rule

Federal Acquisition Regulation: Requirements for DD Form 254, Contract Security Classification Specification

Document Details

Information about this document as published in the Federal Register.

Document Statistics
Document page views are updated periodically throughout the day and are cumulative counts for this document including its time on Public Inspection. Counts are subject to sampling, reprocessing and revision (up or down) throughout the day.
Enhanced Content

Relevant information about this document from Regulations.gov provides additional context. This information is not part of the official Federal Register document.

Published Document

This document has been published in the Federal Register. Use the PDF linked in the document sidebar for the official electronic format.

Start Preamble

AGENCY:

Department of Defense (DoD), General Services Administration (GSA), and National Aeronautics and Space Administration (NASA).

ACTION:

Final rule.

SUMMARY:

DoD, GSA, and NASA are issuing a final rule amending the Federal Acquisition Regulation (FAR) to require electronic submission of the DD Form 254, Contract Security Classification Specification.

DATES:

Effective: August 3, 2020.

Start Further Info

FOR FURTHER INFORMATION CONTACT:

Mr. Curtis E. Glover, Sr., Procurement Analyst, at 202-501-1448 or curtis.glover@gsa.gov for clarification of content. For information pertaining to status or publication schedules, contact the Regulatory Secretariat Division at 202-501-4755. Please cite FAR Case 2015-002.

End Further Info End Preamble Start Supplemental Information

SUPPLEMENTARY INFORMATION:

I. Background

DoD, GSA, and NASA published a proposed rule in the Federal Register at 84 FR 33201 on July 12, 2019, proposing to amend the FAR to update and clarify the requirements for using the DD Form 254, Contract Security Classification Specification. This rule amends the FAR, in part, to provide procedures for use of the DD Form 254 and the requirement to use the Procurement Integrated Enterprise Environment (PIEE), to—

  • Streamline the submission process for the existing DD Form 254 and enable businesses to submit an electronic form once, instead of repeated paper submissions;
  • Require use of the DD Form 254 by nondefense agencies that have industrial security services agreements with DoD, and DoD components, to specify the security classification for a contract involving access to information classified as “Confidential,” “Secret,” or “Top Secret;”
  • Require agency preparation of the DD Form 254 using the National Industrial Security Program Contracts Classification System module of the PIEE unless a nondefense agency has an existing DD Form 254 information system.

Five respondents submitted comments on the proposed rule.

II. Discussion and Analysis

The Civilian Agency Acquisition Council and the Defense Acquisition Regulations Council (the Councils) reviewed the public comments in the development of the final rule. A discussion of the comments is provided as follows:

A. Summary of Significant Changes

There were no changes from the proposed rule as a result of the public comments received. There were minor editorial changes made to the proposed rule, see Section C below.

B. Analysis of Public Comments

1. Commercial and Government Entity (CAGE) Code Reporting

Comment: Two respondents expressed concern regarding the use of “Unique CAGE code”; stating that in some instances a facility will have multiple locations with the same CAGE codes. Clarification of the term “unique” CAGE code was requested.

Response: In accordance with the National Industrial Security Program Operating Manual (NISPOM) DoD 5220.22-M and FAR 52.204-16(g), each contractor and subcontractor location of performance listed on a DD Form 254 is required to have a unique CAGE code; and registration in the System for Award Management (SAM) is not required for contractor and subcontractor performance locations solely for the purposes of the DD Form 254. FAR 52.204-16, Commercial and Government Entity (CAGE) Code Reporting, as prescribed at FAR 4.1804(a), is amended to add paragraph (g) to require subcontractors requiring access to classified information under a contract to be identified with a CAGE code on the DD Form 254. Contractors shall ensure that a subcontractor requiring access to classified information provide its CAGE code with its name and location address or otherwise include it prominently in the proposal. In addition, each location of subcontractor performance must be listed on the DD Form 254 and is required to reflect a corresponding unique CAGE code for each listed location unless the work is being performed at a Government facility, in Start Printed Page 40062which case the agency location code shall be used. The CAGE code must be for that name and location address. The CAGE code is required prior to award. Each listed location must have a unique CAGE code classifying only a single location.

Comment: Two respondents opposed the removal of the current CAGE code requirement and stressed the continued need to not increase risk of sharing classified information with an uncleared facility or one where the clearance is no longer active or authorized.

Response: The rule does not decrease the security professional's ability to verify security clearance and safeguarding levels as directed by NISPOM via the National Industrial Security System (NISS). The rule will require electronic submission of the DD Form 254, Contract Security Classification Specification.

2. DD Form 254

Comment: Two respondents recommended submission of the DD Form 254 by company name with an “option” to file by CAGE code and if possible link the form to the website for storage and potential reuse to avoid uploading as part of an application “process” via the contractor's tools and processes for DD Form 254 submission.

Response: The intent of the rule is for use of the DD Form 254 for each specific contractual requirement requiring access to classified information. While the NISS website does not currently link to the DD Form 254 repository, Defense Counterintelligence and Security Agency will evaluate that capability during future assessment of requirements.

3. Support for the Rule

Comment: Two respondents acknowledged that streamlining the DD Form 254 for electronic submission via the National Industrial Security Program (NISP) Contracts Classification System is beneficial as well as clarification of the SAM requirements.

Response: The Government acknowledges the benefits with establishment of the rule to provide streamlined submission process procedures for use of the DD Form 254 through the PIEE, to enable businesses to submit an electronic form once, instead of repeated paper submissions.

4. Paperwork Reduction Act Applicability

Comment: One respondent conveyed concerns regarding the Paperwork Reduction Act burdens associated with the use of DD Form 254.

Response: The Paperwork Reduction Act (44 U.S.C. chapter 35) applies; however, the proposed changes to the FAR do not impose additional information collection requirements to the paperwork burden previously approved under the Office of Management and Budget (OMB) Control Number 0704-0567, entitled “Department of Defense Contract Security Classification Specification”.

5. Out of Scope

Comment: One respondent commented on a variety of topics unrelated to the rule.

Response: Comments are out of scope.

C. Other Changes

There were minor administrative revisions to the format of the provision FAR 52.204-16, Commercial and Government Entity Code Reporting, and the clause FAR 52.204-18, Commercial and Government Entity Code Maintenance, including deleting use of the alternates at FAR 52.204-16(g) and FAR 52.204-18(f), incorporating the paragraphs at FAR 52.204-16(g) and FAR 52.204-18(f) into the base clause for clarity. Additionally, there were minor clarifying edits to the FAR text at FAR 4.402(d)(1) and (2), FAR 4.403(c)(1), and 52.204-16(b) and (g). As a result of conforming changes, revisions to FAR 4.1804 will no longer be required.

III. Applicability to Contracts at or Below the Simplified Acquisition Threshold (SAT) and for Commercial Items, Including Commercially Available Off-the-Shelf (COTS) Items

This rule does not create any new provisions or clauses, nor does it change the applicability of any existing provisions or clauses included in solicitations and contracts valued at or below the SAT, or for commercial items, including COTS items.

IV. Executive Orders 12866 and 13563

E.O.s 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). E.O. 13563 emphasizes the importance of quantifying both costs and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility. This is not a significant regulatory action and, therefore, was not subject to review under section 6(b) of E.O. 12866, Regulatory Planning and Review, dated September 30, 1993. This rule is not a major rule under 5 U.S.C. 804.

V. Executive Order 13771

This rule is not subject to E.O. 13771, Reducing Regulation and Controlling Regulatory Costs, because this rule is not a significant regulatory action under E.O. 12866.

VI. Regulatory Flexibility Act

DoD, GSA, and NASA have prepared a Final Regulatory Flexibility Analysis (FRFA) consistent with the Regulatory Flexibility Act, 5 U.S.C. 601, et seq. The FRFA is summarized as follows:

This final rule is to revise the FAR to update and clarify the requirements for using the DD Form 254, Contract Security Classification Specification. The Government uses the DD Form 254 to convey security requirements to contractors when contract performance requires access to classified information. Prime contractors also use the DD Form 254 to convey security requirements to subcontractors that require access to classified information to perform on a subcontract. Subcontractors may also use the DD Form 254 if access to classified information is required to convey security requirements to additional subcontractors.

There were no significant issues raised by the public comments in response to the initial regulatory flexibility analysis.

The final rule will apply to small businesses awarded contracts or subcontracts by Executive agencies covered by the National Industrial Security Program that require access to classified information. Currently, the Defense Security Service monitors approximately 13,500 contractor facilities that are cleared for access to classified information. Approximately 9,000 facilities are considered less-complex, which includes small businesses and smaller security operations. Subject matter experts estimate that 5,400 (60 percent) of the 9,000 less-complex facilities are small businesses.

The final rule does not impose any Paperwork Reduction Act reporting, recordkeeping, or other compliance requirements on any small entities. The rule does not impose any new reporting, recordkeeping or other compliance requirements. The rule does not duplicate, overlap, or conflict with any other Federal rules.

DoD, GSA, and NASA were unable to identify any alternatives to the rule which would reduce the impact on small entities and still meet the requirements of the rule.

Interested parties may obtain a copy of the FRFA from the Regulatory Secretariat Division. The Regulatory Secretariat Division has submitted a copy of the FRFA to the Chief Counsel for Advocacy of the Small Business Administration.

VII. Paperwork Reduction Act

The Paperwork Reduction Act (44 U.S.C. chapter 35) applies; however, the changes to the FAR do not impose Start Printed Page 40063additional information collection requirements to the paperwork burden previously approved under the Office of Management and Budget (OMB) Control Number 0704-0567, entitled “Department of Defense Contract Security Classification Specification”.

The rule addresses use of CAGE codes on the DD Form 254, however, it does not impact information collection requirements concerning the CAGE code, OMB Control Number 9000-0185, Commercial and Government Entity Code.

Start List of Subjects

List of Subjects in 48 CFR Parts 1, 2, 4, 52, and 53

  • Government procurement
End List of Subjects Start Signature

William F. Clark,

Director, Office of Government-wide Acquisition Policy, Office of Acquisition Policy, Office of Government-wide Policy.

End Signature

Therefore, DoD, GSA, and NASA amend 48 CFR parts 1, 2, 4, 52, and 53 as set forth below:

Start Amendment Part

1. The authority citation for 48 CFR parts 1, 2, 4, 52, and 53 continues to read as follows:

End Amendment Part Start Authority

Authority: 40 U.S.C. 121(c); 10 U.S.C. chapter 137; and 51 U.S.C. 20113.

End Authority Start Part

PART 1—FEDERAL ACQUISITION REGULATIONS SYSTEM

End Part Start Amendment Part

2. In section 1.106 amend the table following by adding an entry for “DD Form 254” at the end of the table to read as follows:

End Amendment Part
OMB approval under the Paperwork Reduction Act.
FAR segmentOMB control No.
*    *    *    *    *
DD Form 2540706-0567
Start Part

PART 2—DEFINITIONS OF WORDS AND TERMS

End Part Start Amendment Part

3. In section 2.101, amend paragraph (b) by adding in alphabetical order the defined term “Commercial and Government Entity (CAGE) code” to read as follows:

End Amendment Part
Definitions.
* * * * *

Commercial and Government Entity (CAGE) code means—

(1) An identifier assigned to entities located in the United States or its outlying areas by the Defense Logistics Agency (DLA) Commercial and Government Entity (CAGE) Branch to identify a commercial or government entity by unique location; or

(2) An identifier assigned by a member of the North Atlantic Treaty Organization (NATO) or by the NATO Support and Procurement Agency (NSPA) to entities located outside the United States and its outlying areas that the DLA Commercial and Government Entity (CAGE) Branch records and maintains in the CAGE master file. This type of code is known as a NATO CAGE (NCAGE) code.

* * * * *
Start Part

PART 4—ADMINISTRATIVE AND INFORMATION MATTERS

End Part Start Amendment Part

4. Amend section 4.402 by—

End Amendment Part Start Amendment Part

a. Removing from paragraph (b) introductory text “and the Director of Central Intelligence,” and adding “the Director of National Intelligence, and the Secretary of Homeland Security” in its place;

End Amendment Part Start Amendment Part

b. Removing from paragraph (b)(2) “Industrial Security Regulation (DOD 5220.22-R).” and adding “DoD Manual 5220.22, Volume 2, “National Industrial Security Program: Industrial Security Procedures for Government Activities.”” in its place; and

End Amendment Part Start Amendment Part

c. Redesignating paragraph (d) as (e), and adding a new paragraph (d) to read as follows:

End Amendment Part
General.
* * * * *

(d) Nondefense agencies that have industrial security services agreements with DoD, and DoD components, shall use the DD Form 254, Contract Security Classification Specification, to provide security classification guidance to U.S. contractors, and subcontractors as applicable, requiring access to information classified as “Confidential”, “Secret”, or “Top Secret”.

(1) Provided that the data submittal is unclassified, the DD Form 254 shall be completed electronically in the NISP Contract Classification System (NCCS), which is accessible via the Procurement Integrated Enterprise Environment (PIEE) at https://wawf.eb.mil. Nondefense agencies with an existing DD Form 254 information system may use that system.

(2)(i) A contractor, or subcontractor (if applicable), requiring access to classified information under a contract shall be identified with a Commercial and Government Entity (CAGE) code on the DD Form 254 (see subpart 4.18 for information on obtaining and validating CAGE codes).

(ii) Each location of contractor or subcontractor performance listed on the DD Form 254 is required to reflect a corresponding unique CAGE code for each listed location unless the work is being performed at a Government facility, in which case the agency location code shall be used. Each subcontractor location requiring access to classified information must be listed on the DD Form 254.

(iii) Contractor and subcontractor performance locations listed on the DD Form 254 are not required to be separately registered in the System for Award Management (SAM) solely for the purposes of a DD Form 254 (see subpart 4.11 for information on registering in SAM).

* * * * *
Start Amendment Part

5. Amend section 4.403 by removing from paragraph (c) introductory text “contract as follows” and adding “contract as identified in the requirement documentation as follows” in its place, and revising paragraph (c)(1) to read as follows:

End Amendment Part
Responsibilities of contracting officers.
* * * * *

(c ) * * *

(1) Nondefense agencies that have industrial security services agreements with DoD, and DoD components, shall use the Contract Security Classification Specification, DD Form 254. The contracting officer, or authorized agency representative, is the approving official for the DD Form 254 associated with the prime contract and shall ensure the DD Form 254 is properly prepared, distributed by and coordinated with requirements and security personnel in accordance with agency procedures, see 4.402(d)(1).

* * * * *
[Amended]
Start Amendment Part

6. Amend section 4.1801 by removing the defined term “Commercial and Government Entity (CAGE) code”.

End Amendment Part Start Part

PART 52—SOLICITATION PROVISIONS AND CONTRACT CLAUSES

End Part Start Amendment Part

7. Amend section 52.204-16 by—

End Amendment Part Start Amendment Part

a. Revising the date of the provision;

End Amendment Part Start Amendment Part

b. Removing from the end of paragraph (a)(1) “entity; or” and adding “entity by unique location; or” in its place;

End Amendment Part Start Amendment Part

c. Revising paragraph (b);

End Amendment Part Start Amendment Part

d. In paragraph (c)(2) removing the word “offeror” and adding “Offeror” in its places;

End Amendment Part Start Amendment Part

e. Revising paragraph (e); and

End Amendment Part Start Amendment Part

f. Adding paragraph (g).

End Amendment Part

The revisions and addition read as follows:

Commercial and Government Entity Code Reporting.
* * * * *
Start Printed Page 40064

Commercial and Government Entity Code Reporting (Aug 2020)

* * * * *

(b) The Offeror shall provide its CAGE code with its offer with its name and location address or otherwise include it prominently in its proposal. The CAGE code must be for that name and location address. Insert the word “CAGE” before the number. The CAGE code is required prior to award.

* * * * *

(e) When a CAGE code is required for the immediate owner and/or the highest-level owner by Federal Acquisition Regulation (FAR) 52.204-17 or 52.212-3(p), the Offeror shall obtain the respective CAGE code from that entity to supply the CAGE code to the Government.

* * * * *

(g) If the solicitation includes FAR clause 52.204-2, Security Requirements, a subcontractor requiring access to classified information under a contract shall be identified with a CAGE code on the DD Form 254. The Contractor shall require a subcontractor requiring access to classified information to provide its CAGE code with its name and location address or otherwise include it prominently in the proposal. Each location of subcontractor performance listed on the DD Form 254 is required to reflect a corresponding unique CAGE code for each listed location unless the work is being performed at a Government facility, in which case the agency location code shall be used. The CAGE code must be for that name and location address. Insert the word “CAGE” before the number. The CAGE code is required prior to award.

(End of provision)

Start Amendment Part

8. Amend section 52.204-17 by revising the title and the date of the provision and removing from paragraph (a)(1) “entity; or” and adding “entity by unique location; or” in its place.

End Amendment Part

The revision reads as follows:

Ownership or Control of Offeror.
* * * * *

Ownership or Control of Offeror (Aug 2020)

* * * * *
Start Amendment Part

9. Amend section 52.204-18 by—

End Amendment Part Start Amendment Part

a. Revising the date of the clause;

End Amendment Part Start Amendment Part

b. Removing from paragraph (a)(1) “entity; or” and adding “entity by unique location; or” in its place;

End Amendment Part Start Amendment Part

c. Revising the first sentence of paragraph (b); and

End Amendment Part Start Amendment Part

d. Adding paragraph (f).

End Amendment Part

The revisions and addition read as follows:

Commercial and Government Entity Code Maintenance.
* * * * *

Commercial and Government Entity Code Maintenance (Aug 2020)

* * * * *

(b) Contractors shall ensure that the CAGE code is maintained throughout the life of the contract for each location of contract, including subcontract, performance. * * *

* * * * *

(f) If the contract includes Federal Acquisition Regulation clause 52.204-2, Security Requirements, the contractor shall ensure that subcontractors maintain their CAGE code(s) throughout the life of the contract.

(End of clause)

Start Amendment Part

10. Amend section 52.204-20 by—

End Amendment Part Start Amendment Part

a. Revising the date of the provision; and

End Amendment Part Start Amendment Part

b. Removing from paragraph (a)(1) “entity; or” and adding “entity by unique location; or” in its place.

End Amendment Part

The revision reads as follows:

Predecessor of Offeror.
* * * * *

Predecessor of Offeror (Aug 2020)

* * * * *
Start Part

PART 53—FORMS

End Part Start Amendment Part

11. Amend section 53.204-1 by revising the introductory text to read as follows:

End Amendment Part
Safeguarding classified information within industry (DD Form 254, DD Form 441).

The following forms, which are prescribed by the Department of Defense, shall be used by DoD components and those nondefense agencies with which DoD has agreements to provide industrial security services for the National Industrial Security Program if contractor access to classified information is required, as specified in subpart 4.4 and the clause at 52.204-2:

* * * * *
[Amended]
Start Amendment Part

12. In section 53.300 amend the table in paragraph (b) in the table 53-2 by removing from Form DD 254 url, http://www.dtic.mil/​whs/​directives/​forms/​eforms/​dd0254.pdf and adding https://www.esd.whs.mil/​Portals/​54/​Documents/​DD/​forms/​dd/​dd0254.pdf;​ and removing from Form DD 441 url, http://www.dtic.mil/​whs/​directives/​forms/​eforms/​dd0441_​2017.pdf and adding https://www.esd.whs.mil/​Portals/​54/​Documents/​DD/​forms/​dd/​dd0441_​2020.pdf in their places, respectively.

End Amendment Part End Supplemental Information

[FR Doc. 2020-12762 Filed 7-1-20; 8:45 am]

BILLING CODE 6820-EP-P