2020-12762. Federal Acquisition Regulation: Requirements for DD Form 254, Contract Security Classification Specification

AGENCY:

Department of Defense (DoD), General Services Administration (GSA), and National Aeronautics and Space Administration (NASA).

ACTION:

Final rule.

SUMMARY:

DoD, GSA, and NASA are issuing a final rule amending the Federal Acquisition Regulation (FAR) to require electronic submission of the DD Form 254, Contract Security Classification Specification.

DATES:

Effective: August 3, 2020.

FOR FURTHER INFORMATION CONTACT:

Mr. Curtis E. Glover, Sr., Procurement Analyst, at 202-501-1448 or [e-mail] for clarification of content. For information pertaining to status or publication schedules, contact the Regulatory Secretariat Division at 202-501-4755. Please cite FAR Case 2015-002.

SUPPLEMENTARY INFORMATION:

I. Background

DoD, GSA, and NASA published a proposed rule in the Federal Register at 84 FR 33201 on July 12, 2019, proposing to amend the FAR to update and clarify the requirements for using the DD Form 254, Contract Security Classification Specification. This rule amends the FAR, in part, to provide procedures for use of the DD Form 254 and the requirement to use the Procurement Integrated Enterprise Environment (PIEE), to—

• Streamline the submission process for the existing DD Form 254 and enable businesses to submit an electronic form once, instead of repeated paper submissions;
• Require use of the DD Form 254 by nondefense agencies that have industrial security services agreements with DoD, and DoD components, to specify the security classification for a contract involving access to information classified as “Confidential,” “Secret,” or “Top Secret;”
• Require agency preparation of the DD Form 254 using the National Industrial Security Program Contracts Classification System module of the PIEE unless a nondefense agency has an existing DD Form 254 information system.

Five respondents submitted comments on the proposed rule.

II. Discussion and Analysis

The Civilian Agency Acquisition Council and the Defense Acquisition Regulations Council (the Councils) reviewed the public comments in the development of the final rule. A discussion of the comments is provided as follows:

A. Summary of Significant Changes

There were no changes from the proposed rule as a result of the public comments received. There were minor editorial changes made to the proposed rule, see Section C below.

B. Analysis of Public Comments

1. Commercial and Government Entity (CAGE) Code Reporting

Comment: Two respondents expressed concern regarding the use of “Unique CAGE code”; stating that in some instances a facility will have multiple locations with the same CAGE codes. Clarification of the term “unique” CAGE code was requested.

Response: In accordance with the National Industrial Security Program Operating Manual (NISPOM) DoD 5220.22-M and FAR 52.204-16(g), each contractor and subcontractor location of performance listed on a DD Form 254 is required to have a unique CAGE code; and registration in the System for Award Management (SAM) is not required for contractor and subcontractor performance locations solely for the purposes of the DD Form 254. FAR 52.204-16, Commercial and Government Entity (CAGE) Code Reporting, as prescribed at FAR 4.1804(a), is amended to add paragraph (g) to require subcontractors requiring access to classified information under a contract to be identified with a CAGE code on the DD Form 254. Contractors shall ensure that a subcontractor requiring access to classified information provide its CAGE code with its name and location address or otherwise include it prominently in the proposal. In addition, each location of subcontractor performance must be listed on the DD Form 254 and is required to reflect a corresponding unique CAGE code for each listed location unless the work is being performed at a Government facility, in which case the agency location code shall be used. The CAGE code must be for that name and location address. The CAGE code is required prior to award. Each listed location must have a unique CAGE code classifying only a single location.

Comment: Two respondents opposed the removal of the current CAGE code requirement and stressed the continued need to not increase risk of sharing classified information with an uncleared facility or one where the clearance is no longer active or authorized.

Response: The rule does not decrease the security professional's ability to verify security clearance and safeguarding levels as directed by NISPOM via the National Industrial Security System (NISS). The rule will require electronic submission of the DD Form 254, Contract Security Classification Specification.

2. DD Form 254

Comment: Two respondents recommended submission of the DD Form 254 by company name with an “option” to file by CAGE code and if possible link the form to the website for storage and potential reuse to avoid uploading as part of an application “process” via the contractor's tools and processes for DD Form 254 submission.

Response: The intent of the rule is for use of the DD Form 254 for each specific contractual requirement requiring access to classified information. While the NISS website does not currently link to the DD Form 254 repository, Defense Counterintelligence and Security Agency will evaluate that capability during future assessment of requirements.

3. Support for the Rule

Comment: Two respondents acknowledged that streamlining the DD Form 254 for electronic submission via the National Industrial Security Program (NISP) Contracts Classification System is beneficial as well as clarification of the SAM requirements.

Response: The Government acknowledges the benefits with establishment of the rule to provide streamlined submission process procedures for use of the DD Form 254 through the PIEE, to enable businesses to submit an electronic form once, instead of repeated paper submissions.

4. Paperwork Reduction Act Applicability

Comment: One respondent conveyed concerns regarding the Paperwork Reduction Act burdens associated with the use of DD Form 254.

Response: The Paperwork Reduction Act (44 U.S.C. chapter 35) applies; however, the proposed changes to the FAR do not impose additional information collection requirements to the paperwork burden previously approved under the Office of Management and Budget (OMB) Control Number 0704-0567, entitled “Department of Defense Contract Security Classification Specification”.

5. Out of Scope

Comment: One respondent commented on a variety of topics unrelated to the rule.

Response: Comments are out of scope.

C. Other Changes

There were minor administrative revisions to the format of the provision FAR 52.204-16, Commercial and Government Entity Code Reporting, and the clause FAR 52.204-18, Commercial and Government Entity Code Maintenance, including deleting use of the alternates at FAR 52.204-16(g) and FAR 52.204-18(f), incorporating the paragraphs at FAR 52.204-16(g) and FAR 52.204-18(f) into the base clause for clarity. Additionally, there were minor clarifying edits to the FAR text at FAR 4.402(d)(1) and (2), FAR 4.403(c)(1), and 52.204-16(b) and (g). As a result of conforming changes, revisions to FAR 4.1804 will no longer be required.

III. Applicability to Contracts at or Below the Simplified Acquisition Threshold (SAT) and for Commercial Items, Including Commercially Available Off-the-Shelf (COTS) Items

This rule does not create any new provisions or clauses, nor does it change the applicability of any existing provisions or clauses included in solicitations and contracts valued at or below the SAT, or for commercial items, including COTS items.

IV. Executive Orders 12866 and 13563

E.O.s 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). E.O. 13563 emphasizes the importance of quantifying both costs and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility. This is not a significant regulatory action and, therefore, was not subject to review under section 6(b) of E.O. 12866, Regulatory Planning and Review, dated September 30, 1993. This rule is not a major rule under 5 U.S.C. 804.

V. Executive Order 13771

This rule is not subject to E.O. 13771, Reducing Regulation and Controlling Regulatory Costs, because this rule is not a significant regulatory action under E.O. 12866.

VI. Regulatory Flexibility Act

DoD, GSA, and NASA have prepared a Final Regulatory Flexibility Analysis (FRFA) consistent with the Regulatory Flexibility Act, 5 U.S.C. 601, et seq. The FRFA is summarized as follows:

This final rule is to revise the FAR to update and clarify the requirements for using the DD Form 254, Contract Security Classification Specification. The Government uses the DD Form 254 to convey security requirements to contractors when contract performance requires access to classified information. Prime contractors also use the DD Form 254 to convey security requirements to subcontractors that require access to classified information to perform on a subcontract. Subcontractors may also use the DD Form 254 if access to classified information is required to convey security requirements to additional subcontractors.

There were no significant issues raised by the public comments in response to the initial regulatory flexibility analysis.

The final rule will apply to small businesses awarded contracts or subcontracts by Executive agencies covered by the National Industrial Security Program that require access to classified information. Currently, the Defense Security Service monitors approximately 13,500 contractor facilities that are cleared for access to classified information. Approximately 9,000 facilities are considered less-complex, which includes small businesses and smaller security operations. Subject matter experts estimate that 5,400 (60 percent) of the 9,000 less-complex facilities are small businesses.

The final rule does not impose any Paperwork Reduction Act reporting, recordkeeping, or other compliance requirements on any small entities. The rule does not impose any new reporting, recordkeeping or other compliance requirements. The rule does not duplicate, overlap, or conflict with any other Federal rules.

DoD, GSA, and NASA were unable to identify any alternatives to the rule which would reduce the impact on small entities and still meet the requirements of the rule.

Interested parties may obtain a copy of the FRFA from the Regulatory Secretariat Division. The Regulatory Secretariat Division has submitted a copy of the FRFA to the Chief Counsel for Advocacy of the Small Business Administration.

VII. Paperwork Reduction Act

The Paperwork Reduction Act (44 U.S.C. chapter 35) applies; however, the changes to the FAR do not impose additional information collection requirements to the paperwork burden previously approved under the Office of Management and Budget (OMB) Control Number 0704-0567, entitled “Department of Defense Contract Security Classification Specification”.

The rule addresses use of CAGE codes on the DD Form 254, however, it does not impact information collection requirements concerning the CAGE code, OMB Control Number 9000-0185, Commercial and Government Entity Code.

List of Subjects in 48 CFR Parts 1, 2, 4, 52, and 53

• Government procurement

William F. Clark,

Director, Office of Government-wide Acquisition Policy, Office of Acquisition Policy, Office of Government-wide Policy.

Therefore, DoD, GSA, and NASA amend 48 CFR parts 1, 2, 4, 52, and 53 as set forth below:

1. The authority citation for 48 CFR parts 1, 2, 4, 52, and 53 continues to read as follows:

Authority: 40 U.S.C. 121(c); 10 U.S.C. chapter 137; and 51 U.S.C. 20113.

PART 1—FEDERAL ACQUISITION REGULATIONS SYSTEM

2. In section 1.106 amend the table following by adding an entry for “DD Form 254” at the end of the table to read as follows:

1.106

OMB approval under the Paperwork Reduction Act.

FAR segment	OMB control No.
*    *    *    *    *
DD Form 254	0706-0567

PART 2—DEFINITIONS OF WORDS AND TERMS

3. In section 2.101, amend paragraph (b) by adding in alphabetical order the defined term “Commercial and Government Entity (CAGE) code” to read as follows:

2.101

Definitions.

* * * * *

Commercial and Government Entity (CAGE) code means—

(1) An identifier assigned to entities located in the United States or its outlying areas by the Defense Logistics Agency (DLA) Commercial and Government Entity (CAGE) Branch to identify a commercial or government entity by unique location; or

(2) An identifier assigned by a member of the North Atlantic Treaty Organization (NATO) or by the NATO Support and Procurement Agency (NSPA) to entities located outside the United States and its outlying areas that the DLA Commercial and Government Entity (CAGE) Branch records and maintains in the CAGE master file. This type of code is known as a NATO CAGE (NCAGE) code.

* * * * *

PART 4—ADMINISTRATIVE AND INFORMATION MATTERS

4. Amend section 4.402 by—

a. Removing from paragraph (b) introductory text “and the Director of Central Intelligence,” and adding “the Director of National Intelligence, and the Secretary of Homeland Security” in its place;

b. Removing from paragraph (b)(2) “Industrial Security Regulation (DOD 5220.22-R).” and adding “DoD Manual 5220.22, Volume 2, “National Industrial Security Program: Industrial Security Procedures for Government Activities.”” in its place; and

c. Redesignating paragraph (d) as (e), and adding a new paragraph (d) to read as follows:

4.402

General.

* * * * *

(d) Nondefense agencies that have industrial security services agreements with DoD, and DoD components, shall use the DD Form 254, Contract Security Classification Specification, to provide security classification guidance to U.S. contractors, and subcontractors as applicable, requiring access to information classified as “Confidential”, “Secret”, or “Top Secret”.

(1) Provided that the data submittal is unclassified, the DD Form 254 shall be completed electronically in the NISP Contract Classification System (NCCS), which is accessible via the Procurement Integrated Enterprise Environment (PIEE) at https://wawf.eb.mil. Nondefense agencies with an existing DD Form 254 information system may use that system.

(2)(i) A contractor, or subcontractor (if applicable), requiring access to classified information under a contract shall be identified with a Commercial and Government Entity (CAGE) code on the DD Form 254 (see subpart 4.18 for information on obtaining and validating CAGE codes).

(ii) Each location of contractor or subcontractor performance listed on the DD Form 254 is required to reflect a corresponding unique CAGE code for each listed location unless the work is being performed at a Government facility, in which case the agency location code shall be used. Each subcontractor location requiring access to classified information must be listed on the DD Form 254.

(iii) Contractor and subcontractor performance locations listed on the DD Form 254 are not required to be separately registered in the System for Award Management (SAM) solely for the purposes of a DD Form 254 (see subpart 4.11 for information on registering in SAM).

* * * * *

5. Amend section 4.403 by removing from paragraph (c) introductory text “contract as follows” and adding “contract as identified in the requirement documentation as follows” in its place, and revising paragraph (c)(1) to read as follows:

4.403

Responsibilities of contracting officers.

* * * * *

(c ) * * *

(1) Nondefense agencies that have industrial security services agreements with DoD, and DoD components, shall use the Contract Security Classification Specification, DD Form 254. The contracting officer, or authorized agency representative, is the approving official for the DD Form 254 associated with the prime contract and shall ensure the DD Form 254 is properly prepared, distributed by and coordinated with requirements and security personnel in accordance with agency procedures, see 4.402(d)(1).

* * * * *

4.1801

[Amended]

6. Amend section 4.1801 by removing the defined term “Commercial and Government Entity (CAGE) code”.

PART 52—SOLICITATION PROVISIONS AND CONTRACT CLAUSES

7. Amend section 52.204-16 by—

a. Revising the date of the provision;

b. Removing from the end of paragraph (a)(1) “entity; or” and adding “entity by unique location; or” in its place;

c. Revising paragraph (b);

d. In paragraph (c)(2) removing the word “offeror” and adding “Offeror” in its places;

e. Revising paragraph (e); and

f. Adding paragraph (g).

The revisions and addition read as follows:

52.204-16

Commercial and Government Entity Code Reporting.

* * * * *

Commercial and Government Entity Code Reporting (Aug 2020)

* * * * *

(b) The Offeror shall provide its CAGE code with its offer with its name and location address or otherwise include it prominently in its proposal. The CAGE code must be for that name and location address. Insert the word “CAGE” before the number. The CAGE code is required prior to award.

* * * * *

(e) When a CAGE code is required for the immediate owner and/or the highest-level owner by Federal Acquisition Regulation (FAR) 52.204-17 or 52.212-3(p), the Offeror shall obtain the respective CAGE code from that entity to supply the CAGE code to the Government.

* * * * *

(g) If the solicitation includes FAR clause 52.204-2, Security Requirements, a subcontractor requiring access to classified information under a contract shall be identified with a CAGE code on the DD Form 254. The Contractor shall require a subcontractor requiring access to classified information to provide its CAGE code with its name and location address or otherwise include it prominently in the proposal. Each location of subcontractor performance listed on the DD Form 254 is required to reflect a corresponding unique CAGE code for each listed location unless the work is being performed at a Government facility, in which case the agency location code shall be used. The CAGE code must be for that name and location address. Insert the word “CAGE” before the number. The CAGE code is required prior to award.

(End of provision)

8. Amend section 52.204-17 by revising the title and the date of the provision and removing from paragraph (a)(1) “entity; or” and adding “entity by unique location; or” in its place.

The revision reads as follows:

52.204-17

Ownership or Control of Offeror.

* * * * *

Ownership or Control of Offeror (Aug 2020)

* * * * *

9. Amend section 52.204-18 by—

a. Revising the date of the clause;

b. Removing from paragraph (a)(1) “entity; or” and adding “entity by unique location; or” in its place;

c. Revising the first sentence of paragraph (b); and

d. Adding paragraph (f).

The revisions and addition read as follows:

52.204-18

Commercial and Government Entity Code Maintenance.

* * * * *

Commercial and Government Entity Code Maintenance (Aug 2020)

* * * * *

(b) Contractors shall ensure that the CAGE code is maintained throughout the life of the contract for each location of contract, including subcontract, performance. * * *

* * * * *

(f) If the contract includes Federal Acquisition Regulation clause 52.204-2, Security Requirements, the contractor shall ensure that subcontractors maintain their CAGE code(s) throughout the life of the contract.

(End of clause)

10. Amend section 52.204-20 by—

a. Revising the date of the provision; and

b. Removing from paragraph (a)(1) “entity; or” and adding “entity by unique location; or” in its place.

The revision reads as follows:

52.204-20

Predecessor of Offeror.

* * * * *

Predecessor of Offeror (Aug 2020)

* * * * *

PART 53—FORMS

11. Amend section 53.204-1 by revising the introductory text to read as follows:

53.204-1

Safeguarding classified information within industry (DD Form 254, DD Form 441).

The following forms, which are prescribed by the Department of Defense, shall be used by DoD components and those nondefense agencies with which DoD has agreements to provide industrial security services for the National Industrial Security Program if contractor access to classified information is required, as specified in subpart 4.4 and the clause at 52.204-2:

* * * * *

53.300

[Amended]

12. In section 53.300 amend the table in paragraph (b) in the table 53-2 by removing from Form DD 254 url, http://www.dtic.mil/​whs/​directives/​forms/​eforms/​dd0254.pdf and adding https://www.esd.whs.mil/​Portals/​54/​Documents/​DD/​forms/​dd/​dd0254.pdf;​; and removing from Form DD 441 url, http://www.dtic.mil/​whs/​directives/​forms/​eforms/​dd0441_​2017.pdf and adding https://www.esd.whs.mil/​Portals/​54/​Documents/​DD/​forms/​dd/​dd0441_​2020.pdf in their places, respectively.