2019-14379. Federal Acquisition Regulation: Requirements for DD Form 254, Contract Security Classification Specification

AGENCY:

Department of Defense (DoD), General Services Administration (GSA), and National Aeronautics and Space Administration (NASA).

ACTION:

Proposed rule.

SUMMARY:

DoD, GSA, and NASA are proposing to amend the Federal Acquisition Regulation (FAR) to require electronic submission of the DD Form 254, Contract Security Classification Specification.

DATES:

Interested parties should submit written comments to the Regulatory Secretariat Division at one of the addresses shown below on or before September 10, 2019 to be considered in the formulation of a final rule.

ADDRESSES:

Submit comments in response to FAR Case 2015-002 by any of the following methods:

• Regulations.gov: http://www.regulations.gov. Submit comments via the Federal eRulemaking portal by searching for “FAR Case 2015-002”. Select the link “Comment Now” that corresponds with “FAR Case 2015-002”. Follow the instructions provided on the screen. Please include your name, company name (if any), and “FAR Case 2015-002” on your attached document.
• Mail: General Services Administration, Regulatory Secretariat Division (MVCB), ATTN: Lois Mandell, 1800 F Street NW, Second Floor, Washington, DC 20405.

Instructions: Please submit comments only and cite “FAR case 2015-002” in all correspondence related to this case. All comments received will be posted, without change, to http://www.regulations.gov,, including any personal and/or business confidential information provided. To confirm receipt of your comment(s), please check www.regulations.gov,, approximately two to three days after submission to verify posting (except allow 30 days for posting of comments submitted by mail).

FOR FURTHER INFORMATION CONTACT:

Mr. Curtis E. Glover, Sr., Procurement Analyst, at [phone] for clarification of content. For information pertaining to status or publication schedules, contact the Regulatory Secretariat Division at [phone]. Please cite “FAR case 2015-002”.

SUPPLEMENTARY INFORMATION:

I. Background

DoD, GSA, and NASA are proposing to amend the FAR to update and clarify the requirements for using the DD Form 254, Contract Security Classification Specification. The Government uses the DD Form 254 to convey security requirements to contractors when contract performance requires access to classified information. Prime contractors also use the DD Form 254 to convey security requirements to subcontractors that require access to classified information to perform on a subcontract. Subcontractors may also use the DD Form 254 if access to classified information is required to convey security requirements to additional subcontractors.

The Defense Security Service has oversight responsibilities for contractors and subcontractors requiring access to classified information under contracts awarded by agencies covered by the National Industrial Security Program, i.e., DoD components, and nondefense agencies that have industrial security services agreements with DoD. The National Industrial Security Program was established under Executive Order (E.O.) 12829 as a single, integrated program across the Executive Branch designed to safeguard classified information released to contractors. As one of five National Industrial Security Program cognizant security agencies, DoD is responsible for providing industrial security oversight services to DoD and those nondefense agencies that have industrial security services agreements with DoD.

The National Industrial Security Program Contracts Classification System is a module within the Procurement Integrated Enterprise Environment (PIEE), (formerly the Wide Area WorkFlow application). The module provides a centralized repository for classified contract security requirements and automates DD Form 254 processes and workflows.

II. Discussion and Analysis

This rule proposes to amend the FAR to provide procedures for use of the DD Form 254 and the requirement to use the PIEE, to—

• Streamline the submission process for the existing DD Form 254 and enable businesses to submit an electronic form once, instead of repeated paper submissions;
• Require use of the DD Form 254 by nondefense agencies that have industrial security services agreements with DoD, and DoD components, to specify the security classification for a contract involving access to information classified as “Confidential,” “Secret,” or “Top Secret;”
• Require agency preparation of the DD Form 254 using the National Industrial Security Program Contracts Classification System module of the PIEE unless a nondefense agency has an existing DD Form 254 information system;
• Clarify that—

○ Each contractor and subcontractor location of performance listed on a DD Form 254 is required to have a unique CAGE code; and

○ Registration in the System for Award Management is not required for contractor and subcontractor performance locations solely for the purposes of the DD Form 254.

The rule adds an Alternate I to the provision at FAR 52.204-16, Commercial and Government Entity (CAGE) Code Reporting, to address that prime contractors shall ensure subcontractors under classified solicitations provide the location of subcontractor performance listed on the DD Form 254 to reflect a corresponding unique CAGE code for each listed location unless the work is being performed at a Government facility, in which case the agency location code shall be used. FAR provision 52.204-16 is used when FAR 52.204-6, Unique Entity Identifier, or 52.204-7, System for Award Management, is used. The provision with its Alternate I is used when the clause 52.204-2, Security requirements is included. The rule also adds a new Alternate I to FAR 52.204-18, Commercial and Government Entity Code Maintenance, that requires prime contractors to ensure that subcontractors maintain their CAGE code(s) throughout the life of the contract when the contract may require access to classified information (unless the contracting agency is not covered by the NISP and has prescribed a clause and alternates that are substantially the same as those at 52.204-2, Security Requirements) and if the provision 52.204-16, Commercial and Government Entity Code Reporting, is used with its Alternate I.

The rule also relocates the definition of CAGE code to FAR subpart 2.1, Definitions, from FAR subpart 4.18, since the term is used in multiple FAR sections and clauses.

III. Applicability to Contracts at or Below the Simplified Acquisition Threshold (SAT) and for Commercial Items, Including Commercially Available Off-the-Shelf (COTS) Items

This proposed rule does not create any new provisions or clauses, nor does it change the applicability of any existing provisions or clauses included in solicitations and contracts valued at or below the SAT, or for commercial items, including COTS items.

IV. Executive Order 13771

This rule is not subject to E.O. 13771, Reducing Regulation and Controlling Regulatory Costs, because this rule is not a significant regulatory action under E.O. 12866.

V. Executive Orders 12866 and 13563

E.O.s 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). E.O. 13563 emphasizes the importance of quantifying both costs and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility. This is not a significant regulatory action and, therefore, was not subject to review under section 6(b) of E.O. 12866, Regulatory Planning and Review, dated September 30, 1993. This rule is not a major rule under 5 U.S.C. 804.

VI. Regulatory Flexibility Act

DoD, GSA, and NASA do not expect this rule to have a significant economic impact on a substantial number of small entities within the meaning of the Regulatory Flexibility Act, 5 U.S.C. 601, et seq., because the rule creates minimal requirements. The initial regulatory flexibility analysis (IRFA) has been prepared and is summarized as follows:

DoD, GSA, and NASA are proposing to amend the Federal Acquisition Regulation (FAR) to require electronic submission of the DD Form 254, Contract Security Classification Specification.

The objective of this proposed rule is to revise the FAR to update and clarify the requirements for using the DD Form 254, Contract Security Classification Specification. The Government uses the DD Form 254 to convey security requirements to contractors when contract performance requires access to classified information. Prime contractors also use the DD Form 254 to convey security requirements to subcontractors that require access to classified information to perform on a subcontract. Subcontractors may also use the DD Form 254 if access to classified information is required to convey security requirements to additional subcontractors.

DoD, GSA, and NASA do not expect that this proposed rule will have a significant economic impact on a substantial number of small entities within the meaning of the Regulatory Flexibility Act, 5 U.S.C. 601, et seq. The proposed rule would apply to small businesses awarded contracts or subcontracts by Executive agencies covered by the National Industrial Security Program that require access to classified information. Currently, the Defense Security Service monitors approximately 13,500 contractor facilities that are cleared for access to classified information. Approximately 9,000 facilities are considered less-complex, which includes small businesses and smaller security operations. Subject matter experts estimate that 5,400 (60 percent) of the 9,000 less-complex facilities are small businesses.

The proposed rule does not impose any Paperwork Reduction Act reporting, recordkeeping, or other compliance requirements on any small entities.

The proposed rule does not impose any new reporting, recordkeeping or other compliance requirements. The rule does not duplicate, overlap, or conflict with any other Federal rules.

There are no significant alternatives to the rule which accomplish the stated objectives of applicable statutes and which minimize any significant economic impact of the rule on small entities.

The Regulatory Secretariat Division has submitted a copy of the IRFA to the Chief Counsel for Advocacy of the Small Business Administration. A copy of the IRFA may be obtained from the Regulatory Secretariat Division. DoD, GSA and NASA invite comments from small business concerns and other interested parties on the expected impact of this rule on small entities.

DoD, GSA, and NASA will also consider comments from small entities concerning the existing regulations in subparts affected by this rule consistent with 5 U.S.C. 610. Interested parties must submit such comments separately and should cite 5 U.S.C. 610 (FAR Case 2015-002) in correspondence.

VII. Paperwork Reduction Act

The Paperwork Reduction Act (44 U.S.C. chapter 35) applies; however, the proposed changes to the FAR do not impose additional information collection requirements to the paperwork burden previously approved under the Office of Management and Budget (OMB) Control Number 0704-0567, entitled “Department of Defense Contract Security Classification Specification”.

The proposed rule also touches but does not impact information collection requirements concerning the CAGE code. OMB Control Number 9000-0185, Commercial and Government Entity Code was established by OMB under FAR case 2012-024, but requires final clearance under this case. This clearance covers the following: Offerors that do not already have a CAGE code to obtain and provide a CAGE code referred to as North Atlantic Treaty Organization (NATO) CAGE (NCAGE) code for foreign entities; offerors to represent whether they are owned or controlled by another entity, and if so, to provide the CAGE code and name of such entity; and contractors to communicate any change to the CAGE code to the contracting officer within 30 days after the change. As a part of this case, the Regulatory Secretariat has submitted a request for approval of this information collection requirement to OMB.

A. Public reporting burden for the collection of information under OMB Control number 9000-0185 includes the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. The annual reporting burden is estimated as follows:

Respondents: 735.

Total annual responses: 11,358.

Total burden hours: 5,616.75.

B. Request for Comments Regarding Paperwork Burden. DoD, GSA and NASA are soliciting comments from the public in order to:

• Evaluate whether this collection of information is necessary for the proper performance of the functions of the FAR, including whether the information will have practical utility;
• Evaluate the accuracy of the estimate of the burden, including the validity of the methodology and assumptions used;
• Enhance the quality, utility, and clarity of the information to be collected; and
• Minimize the burden of the collection of information on those who are to respond, including through the use of appropriate collection techniques or other forms of information technology.

Organizations and individuals desiring to submit comments on the information collection requirements should submit comments no later than September 10, 2019 to: FAR Desk Officer, OMB, Room 10102, NEOB, Washington, DC 20503, and a copy GSA. The copy to GSA can be submitted by either of the following methods:

• Federal eRulemaking Portal: This website provides the ability to type short comments directly into the comment field or attach a file for lengthier comments. Go to http://www.regulations.gov and follow the instructions on the site.
• Mail: General Services Administration, Regulatory Secretariat Division (MVCB), 1800 F Street NW, 2nd Floor, Washington, DC 20405. ATTN: Lois Mandell/IC 9000-0185, Commercial and Government Entity Code.

Instructions: All items submitted must cite Information Collection 9000-0185, Commercial and Government Entity Code. Comments received generally will be posted without change to http://www.regulations.gov,, including any personal and/or business confidential information provided. To confirm receipt of your comment(s), please check www.regulations.gov,, approximately two to three days after submission to verify posting (except allow 30 days for posting of comments submitted by mail). Requesters may obtain a copy of the supporting statement from the General Services Administration, Regulatory Secretariat (MVCB), ATTN: Lois Mandell, 1800 F Street NW, 2nd Floor, Washington, DC 20405-0001. Please cite OMB Control Number 9000-0185, Commercial and Government Entity Code, in all correspondence.

List of Subjects in 48 CFR Parts 1, 2, 4, 52, and 53

• Government procurement

William Clark,

Director, Office of Government-Wide Acquisition Policy, Office of Acquisition Policy, Office of Government-Wide Policy.

Therefore, DoD, GSA, and NASA propose amending 48 CFR parts 1, 2, 4, 52, and 53 as set forth below:

1. The authority citation for 48 CFR parts 1, 2, 4, 52, and 53 continues to read as follows:

Authority: 40 U.S.C. 121(c); 10 U.S.C. chapter 137; and 51 U.S.C. 20113.

PART 1—FEDERAL ACQUISITION REGULATIONS SYSTEM

2. In section 1.106 amend the table by adding an entry for FAR segment “DD Form 254” t read as follows:

FAR segment	OMB control No.
*    *    *    *    *
DD Form 254	0704-0567

PART 2—DEFINITIONS OF WORDS AND TERMS

3. In section 2.101, amend paragraph (b) by adding in alphabetical order the defined term “Commercial and Government Entity (CAGE) code” to read as follows:

* * * * *

(b) * * *

Commercial and Government Entity (CAGE) code means—

(1) An identifier assigned to entities located in the United States or its outlying areas by the Defense Logistics Agency (DLA) Commercial and Government Entity (CAGE) Branch to identify a commercial or government entity by unique location; or

(2) An identifier assigned by a member of the North Atlantic Treaty Organization (NATO) or by the NATO Support and Procurement Agency (NSPA) to entities located outside the United States and its outlying areas that the DLA Commercial and Government Entity (CAGE) Branch records and maintains in the CAGE master file. This type of code is known as a NATO CAGE (NCAGE) code.

* * * * *

PART 4—ADMINISTRATIVE MATTERS

4. Amend section 4.402 by—

a. Removing from paragraph (b) introductory text “and the Director of Central Intelligence,” and adding “the Director of National Intelligence, and the Secretary of Homeland Security” in its place;

b. Removing from paragraph (b)(2) “Industrial Security Regulation (DOD 5220.22-R).” and adding “DoD Manual 5220.22, Volume 2, “National Industrial Security Program: Industrial Security Procedures for Government Activities.” ” in its place; and

c. Redesignating paragraph (d) as (e), and adding a new paragraph (d) to read as follows:

4.402

General.

* * * * *

(d) Nondefense agencies that have industrial security services agreements with DoD, and DoD components, shall use the DD Form 254, Contract Security Classification Specification, to provide security classification guidance to U.S. contractors, and subcontractors as applicable, requiring access to information classified as “Confidential”, “Secret”, or “Top Secret”.

(1) Provided that the data submittal is unclassified, the DD Form 254 shall be completed electronically in the NISP Contract Classification System (NCCS), which is accessible via the Procurement Integrated Enterprise Environment (PIEE) at https://wawf.eb.mil unless a nondefense agency has an existing DD Form 254 information system.

(2)(i) A contractor, or subcontractor (if applicable), requiring access to classified information under a contract shall be identified with a Commercial and Government Entity (CAGE) code on the DD Form 254 (see subpart 4.18 for information on obtaining and validating CAGE codes).

(ii) Each location of contractor or subcontractor performance listed on the DD Form 254 is required to reflect a corresponding unique CAGE code for each listed location unless the work is being performed at a Government facility, in which case the agency location code shall be used.

(iii) Contractor and subcontractor performance locations listed on the DD Form 254 are not required to be separately registered in the System for Award Management (SAM) solely for the purposes of a DD Form 254 (see subpart 4.11 for information on registering in SAM).

* * * * *

5. Amend section 4.403 by removing from paragraph (c) introductory text “contract as follows” and adding “contract as identified in the requirement documentation as follows” in its place, and revising paragraph (c)(1) to read as follows:

4.403

Responsibilities of contracting officers.

* * * * *

(c) * * *

(1) Nondefense agencies that have industrial security services agreements with DoD, and DoD components, shall use the Contract Security Classification Specification, DD Form 254. The contracting officer, or authorized representative, is the approving official for the DD Form 254 associated with the prime contract and shall—

(i) Ensure the DD Form 254 is properly prepared and distributed; and

(ii) Coordinate with requirements and security personnel in accordance with agency procedures to complete the DD Form 254, including when completed in the NCCS accessible via the Procurement Integrated Enterprise Environment (PIEE) at https://wawf.eb.mil unless a nondefense agency has an existing DD Form 254 information system.

* * * * *

4.1801

[Amended]

6. Amend section 4.1801 by removing the term “Commercial and Government Entity (CAGE) code”.

7. Amend section 4.1802 by revising the paragraph (a) introductory text to read as follows:

4.1802

Policy

(a) Commercial and Government Entity (CAGE) code. * * *

* * * * *

8. Amend section 4.1804 by revising paragraphs (a) and (c) to read as follows:

4.1804

Solicitation provisions and contract clause.

(a)(1) Insert the provision at 52.204-16, Commercial and Government Entity Code Reporting, in all solicitations that include—

(i) 52.204-6, Unique Entity Identifier; or

(ii) 52.204-7, System for Award Management.

(2) Use the provision with its Alternate I when the clause 52.204-2, Security Requirements, is used.

* * * * *

(c) (1) Insert the clause at 52.204-18, Commercial and Government Entity Code Maintenance in all solicitations and contracts when the solicitation contains the provision at 52.204-16, Commercial and Government Entity Code Reporting.

(2) Use the clause with its Alternate I when the provision 52.204-16, Commercial and Government Entity Code Reporting, is used with its Alternate I.

* * * * *

PART 52—SOLICITATION PROVISIONS AND CONTRACT CLAUSES

9. Amend section 52.204-16 by—

a. Revising the date of the provision;

b. Removing from the end of paragraph (a)(1) “entity; or” and adding “entity by unique location; or” in its place;

c. Revising paragraph (b) and (c)(1);

d. Removing from paragraph (c)(2) “offeror” twice and adding “Offeror” in their places, respectively;

e. Removing from paragraph (c)(3) “NSPA” and adding “NATO Support and Procurement Agency (NSPA)” in its place;

f. Removing from paragraph (e) “Code” three times and adding “code” in their places, respectively; and

g. Adding an Alternate I.

The revisions and addition read as follows:

52.204-16

Commercial and Government Entity Code Reporting.

* * * * *

Commercial and Government Entity Code Reporting ([DATE])

* * * * *

(b) The Offeror shall provide its CAGE code with its offer with its name and address or otherwise include it prominently in its proposal. The CAGE code must be for that name and address. Insert the word “CAGE” before the number. The CAGE code is required prior to award.

(c) * * *

(1) Registration in the System for Award Management (SAM) at www.sam.gov. If the Offeror is located in the United States or its outlying areas and does not already have a CAGE code assigned, the Defense Logistics Agency (DLA) Commercial and Government Entity (CAGE) Branch will assign a CAGE code as a part of the SAM registration process. SAM registrants located outside the United States and its outlying areas shall obtain a North Atlantic Treaty Organization (NATO) CAGE (NCAGE) code prior to registration in SAM (see paragraph (c)(3) of this provision).

* * * * *

Alternate I ([DATE]). As prescribed at 4.1804(a), add the following additional paragraph (g).

(g) A subcontractor requiring access to classified information under a contract shall be identified with a Commercial and Government Entity (CAGE) code on the DD Form 254. A subcontractor requiring access to classified information shall provide its CAGE code with its name and address or otherwise include it prominently in the proposal. Each location of subcontractor performance listed on the DD Form 254 is required to reflect a corresponding unique CAGE code for each listed location unless the work is being performed at a Government facility, in which case the agency location code shall be used. The CAGE code must be for that name and address. Insert the word “CAGE” before the number. The CAGE code is required prior to award.

* * * * *

10. Amend section 52.204-17 by revising the provision title and date and removing from paragraph (a)(1) “entity; or” and adding “entity by unique location; or” in its place.

The revision reads as follows:

52.204-17

Ownership or Control of Offeror.

* * * * *

Ownership or Control of Offeror ([DATE])

* * * * *

11. Amend section 52.204-18 by—

a. Revising the date of the clause;

b. Removing from paragraph (a)(1) “entity; or” and adding “entity by unique location; or” in its place;

c. Removing from paragraph (b) “DLA” and adding “Defense Logistics Agency (DLA” in its place, and removing from paragraph (d) “NSPA” and adding “North Atlantic Treaty Organization (NATO) Support and Procurement Agency (NSPA)” in its place; and

d. Adding Alternate I.

The revision and addition read as follows:

52.204-18

Commercial and Government Entity Code Maintenance.

* * * * *

Commercial and Government Entity Code Maintenance ([DATE])

* * * * *

Alternate I ([DATE]). As prescribed at 4.1804(c), add the following additional paragraph (f).

(f) Contractors shall ensure that subcontractors maintain their CAGE code(s) throughout the life of the contract.

12. Amend section 52.204-20 by revising the date of the provision and removing from paragraph (a)(1) “entity; or” and adding “entity by unique location; or” in its place.

The revision reads as follows:

52.204-20

Predecessor of Offeror.

* * * * *

Predecessor of Offeror ([DATE])

* * * * *

PART 53—FORMS

13. Amend section 53.204-1 by revising the introductory text to read as follows:

53.204-1

Safeguarding classified information within industry (DD Form 254, DD Form 441).

The following forms, which are prescribed by the Department of Defense, shall be used by DoD components and those nondefense agencies with which DoD has agreements to provide industrial security services for the National Industrial Security Program if contractor access to classified information is required, as specified in subpart 4.4 and the clause at 52.204-2:

* * * * *