§ 117.17 - Subcontracting.

§ 117.17 Subcontracting.

(a) Prime contractor responsibilities -

(1) Responsibilities. Before a prime contractor may release or disclose classified information to a subcontractor, or cause classified information to be generated by a subcontractor, a determination that access to classified information will be required and such access serves a legitimate USG requirement for the performance of a “classified contract” in accordance with § 117.9(a) must be made. Prime contractors are responsible for communicating the appropriate security requirements to all subcontractors.

(i) A “security requirements clause” and a “Contract Security Classification Specification,” or equivalent, will be incorporated in the solicitation and in the subcontract. (See the “security requirements clause” in the prime contract.)

(ii) The subcontractor must possess an appropriate entity eligibility determination and a classified information safeguarding capability if possession of classified information will be required.

(A) If access to classified information will not be required in the pre-award phase, prospective subcontractors are not required to possess an entity eligibility determination to receive or bid on the solicitation.

(B) If a prospective subcontractor requires access to classified information during the pre-award phase and does not have the appropriate entity eligibility determination or a classified information safeguarding capability, the prime contractor will request the CSA of the subcontractor to initiate the necessary action.

(iii) If access to classified information will not be required, the contract is not a classified contract within the meaning of this rule. If the prime contract contains requirements for release or disclosure of protected information that is not classified, such as CUI, the requirements will be incorporated in the solicitation and the subcontract and are not covered by this rule.

(2) Prospective subcontractors entity eligibility determinations.

(i) The prime contractor will verify whether the prospective subcontractors have the appropriate entity eligibility determination and also a classified information safeguarding capability, if a subcontract requirement. This determination can be made if there is an existing contractual relationship between the parties involving classified information of the same or higher category, and must be verified by accessing the CSA-designated database, or by contacting the CSA.

(ii) If a prospective subcontractor does not have the appropriate entity eligibility determination or a classified information safeguarding capability, the prime contractor will request that the CSA of the subcontractor initiate the necessary action.

(A) Requests will include, at a minimum, the full name, address, and contact information for the requester; the full name, address, and contact information for a contact at the facility to be processed for an entity eligibility determination; the level of clearance and the required classified information safeguarding capability; and full justification for the request.

(B) Requests for safeguarding capability will include a description, quantity, end-item, and classification of the information related to the proposed subcontract.

(C) Other factors necessary to help the CSA determine if the prospective subcontractor meets the requirements of this rule will be identified, such as any special access requirements.

(3) Lead time for entity eligibility determination when awarding to an uncleared subcontractor. Requesting contractors will allow sufficient lead time in connection with the award of a classified subcontract to enable an uncleared bidder to be processed for the necessary entity eligibility determination. When the entity eligibility determination cannot be granted in sufficient time to qualify the prospective subcontractor for participation in the current procurement action, the CSA will continue the entity eligibility determination processing action to qualify the prospective subcontractor for future contract consideration provided:

(i) The delay in processing the entity eligibility determination was not caused by a lack of cooperation on the part of the prospective subcontractor.

(ii) Future classified negotiations may occur within 12 months.

(iii) There is reasonable likelihood the subcontractor may be awarded a classified subcontract.

(iv) Subcontracting that involves access to FGI.

(A) A U.S. contractor may award a subcontract that involves access to FGI to another U.S. contractor after verifying with the CSA that the prospective subcontractor has the appropriate entity eligibility determination and a classified information storage capability, and review of the prime contract to determine if there are any contractual limitations for approval before awarding a subcontract. The contractor awarding a subcontract will provide appropriate security classification guidance and incorporate the pertinent security provisions in the subcontract.

(B) The contractor cannot award subcontracts involving FGI to a contractor in a third country or to a U.S. entity with a limited entity eligibility determination based on third-country FOCI without the express written consent of the originating foreign government. The CSA will coordinate with the appropriate foreign government authorities.

(b) Security classification guidance.

(1) Prime contractors will ensure that a Contract Security Classification Specification, or equivalent, is incorporated in each classified subcontract.

(i) When preparing classification guidance for a subcontract, the prime contractor may extract pertinent information from:

(A) The Contract Security Classification Specification, or equivalent, issued with the prime contract.

(B) Security classification guides issued with the prime contract.

(C) Any security guides that provide guidance for the classified information furnished to, or that will be generated by, the subcontractor.

(ii) The Contract Security Classification Specification, or equivalent, prepared by the prime contractor will be certified by a designated official of the contractor.

(iii) In the absence of exceptional circumstances, the classification specification will not contain any classified information. If classified supplements are required as part of the Contract Security Classification Specification, or equivalent, they will be identified and forwarded to the subcontractor by separate correspondence.

(2) An original Contract Security Classification Specification, or equivalent, will be included with each RFQ, RFP, IFB, or other solicitation to ensure that the prospective subcontractor is aware of the security requirements of the subcontract and can plan accordingly. An original Contract Security Classification Specification, or equivalent, will also be included in the subcontract awarded to the successful bidder.

(3) A revised Contract Security Classification Specification, or equivalent, will be issued as necessary during the lifetime of the subcontract when the security requirements change.

(4) Requests for public release by a subcontractor will be forwarded through the prime contractor to the GCA.

(c) Responsibilities upon completion of the subcontracts.

(1) Upon completion of the subcontract, the subcontractor may retain classified material received or generated under the subcontract for a two-year period, in accordance with the provisions in § 117.13(d)(5).

(2) If retention is required beyond the two-year period, the subcontractor must request written retention authority through the prime contractor to the GCA, including the information required by § 117.15(j).

(3) If retention authority is approved by the GCA, the prime contractor will issue a final Contract Security Classification Specification, or equivalent, annotated to provide the retention period and final disposition instructions.

(d) Notification of invalidation, marginal, or unsatisfactory conditions. The prime contractor will be notified if the CSA discovers marginal or unsatisfactory conditions at the subcontractor's facility or if the CSA invalidates the subcontractor's facility clearance. Once notified, the prime contractor will follow the instructions received on what action, if any, should be taken in order to safeguard classified material relating to the subcontract.