A2 - Attach 18 DD 254.pdf

For the best experience, open this PDF portfolio in

Acrobat X or Adobe Reader X, or later.

Get Adobe Reader Now!

http://www.adobe.com/go/reader

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567

OMB approval expires:

May 31, 2022

The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors

-- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. (See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

9.0.0.2.20120627.2.874785

DD 254, "DoD Contract Security Classification Specification"

CurrentPage:

PageCount:

Select classification from drop-down list.:

SerialNum:

a. Facility clearance level. Select one.: 2

b. Level of safeguarding for classified information/material required at contractor facility. Select one.: 4

Select for "original.": 1

Select for "original.": 1

Enter prime contract number.:

Select for "revised.": 0

Select for "revised.": 0

Enter subcontract number.:

Select for "final.": 0

Select for "final.": 0

Enter solicitation or other number.:

Enter due date in format YYYYMMDD.:

Enter date in format YYYYMMDD.:

Enter revision number.:

Enter date in format YYYYMMDD.:

Enter final specification.:

Enter date in format YYYYMMDD.:

Select for "no.": 1

Select for "no.": 1

Select for "no.": 0

Select for "no.": 0

Select for "yes.": 0

Select for "yes.": 0

Select for "yes.": 0

Select for "yes.": 0

Enter preceding contract number.:

Enter contractor's request date in format YYYYMMDD.:

Enter period.:

Enter typed name of certifying official (last, first, middle initial).: TBD

Enter typed name of certifying official (last, first, middle initial).: TBD

Enter typed name of certifying official (last, first, middle initial).: TBD

Enter CAGE code of the prime contractor.: TBD

Enter CAGE code of the prime contractor.: TBD

Enter CAGE code of the prime contractor.: TBD

Enter CAGE code of the prime contractor.: TBD

Enter cognizant security office(s) (Name, Address, ZIP Code, Telephone required; Email Address optional).: TBD

Enter cognizant security office(s) (Name, Address, ZIP Code, Telephone required; Email Address optional).: TBD

Enter cognizant security office(s) (Name, Address, ZIP Code, Telephone required; Email Address optional).: TBD

Select to add row to locations.:

Select to remove last row from locations.:

Select to delete all signatures.:

Enter location(s).: TBD

Enter general unclassified description of this procurement.: TRAINING AND EDUCATION CONTRACT in support of Office of Personnel Management (OPM) Human Resource Solutions (HRS) USALearning USAL) assisted acquisition services. USAL supports over 100 Federal, DoD and State government acquisitions specifically for training and education systems, integration of training systems, and all associated support These include CONUS and OCONUS and cover a wide range of unclassified and classified requirements.

Select for "a. CONTRACTOR.": 0

Select for "a. CONTRACTOR.": 0

Select for "a. CONTRACTOR.": 1

Select for "f. OTHER AS NECESSARY.": 0

Select for "f. OTHER AS NECESSARY.": 0

Select for "f. OTHER AS NECESSARY.": 0

Select for "b. SUBCONTRACTOR.": 0

Select for "b. SUBCONTRACTOR.": 0

Select for "b. SUBCONTRACTOR.": 0

Select for "g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER.": 0

Select for "g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE TECHNICAL INFORMATION CENTER (DTIC) OR OTHER SECONDARY DISTRIBUTION CENTER.": 0

Select for "c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR.": 0

Select for "c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR.": 0

Select for "c. COGNIZANT SECURITY OFFICE FOR PRIME AND SUBCONTRACTOR.": 0

Select for "h. REQUIRE A COMSEC ACCOUNT.": 0

Select for "h. REQUIRE A COMSEC ACCOUNT.": 0

Select for "d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION.": 0

Select for "d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION.": 0

Select for "d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION.": 0

Select for "i. HAVE A TEMPEST REQUIREMENT.": 0

Select for "i. HAVE A TEMPEST REQUIREMENT.": 0

Select for "e. NATIONAL INTELLIGENCE INFORMATION: - (1) Sensitive Compartmented Information (SCI).": 0

Select for "e. NATIONAL INTELLIGENCE INFORMATION: - (2) Non-SCI.": 0

Select for "j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS.": 1

Select for "j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS.": 0

Select for "k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE.": 0

Select for "k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE.": 0

Enter infomration for "other.":

Select for "e. ADMINISTRATIVE CONTRACTING OFFICER.": 0

Select for "e. ADMINISTRATIVE CONTRACTING OFFICER.": 0

Select for "l. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED INFORMATION (CUI). .": 0

Select for "m.OTHER.": 0

Select for "direct.": 0

Select for ": 0

Enter specification for "through".:

Enter public release authority.:

Select to add signature.:

Select to remove last signature.:

text:

BLOCK 6, 7, 8- TBD based upon awarded contractor BLOCK 10 CUI ACCESS required for IDIQ, other Access requirements would be based upon specific task order requirements BLOCK 11, TBD based upon specific task order requirements.

Click on this button to attach a file(s).:

rep:

Enter signature.:

Explain and identify specific areas and government activity responsible for inspections.:

Enter GCA name.: TBD

Enter AAC of the contracting office.:

Enter address (include zip code).: 1900 E. ST NW

WASHINGTON, DC

20415-1000

Enter address (include zip code).: 1900 E. ST NW

WASHINGTON, DC

20415-1000

Enter POC name.: TBD

Enter telephone number (include area code).:

Enter email address.:

Enter title.: TBD

Enter the datesigned in format YYYYMMDD.:

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DD FORM 254 INSTRUCTIONS, APR 2018

INSTRUCTIONS FOR COMPLETING DD FORM 254, DEPARTMENT OF DEFENSE CONTRACT SECURITY CLASSIFICATION SPECIFICATION

AEM LiveCycle Designer

Page of

NEEDS DD67

DD FORM 254 INSTRUCTIONS, APR 2018

AEM LiveCycle Designer

Page of

NEEDS DD67

The purpose of this document is to levy uniform requirements for application of the DD Form 254, “Contract Security Classification Specification," for contracts requiring access to classified information."

Distribution: See Item 18 for instructions.

Records Retention and Disposition Schedule: For U.S. Government agencies, refer to the National Archives and Records Administration General Records Schedule 1.1, Item 010 (Financial Management and Reporting Records) for the disposition of the DD Form 254 with its related contract file.

See www.archives.gov/records-mgmt/grs.html.

Description: A completed DD Form 254, with its attachments and incorporated references, is the principal authorized means for providing security classification guidance and the requirements to the contractor with the associated contract or agreement that requires access to classified information.

a. The DD Form 254 contains 18 items. Each item may have one or more boxes requiring a response.

b. Certain items (e.g., items 7 and 8) allow the user to add or remove rows by selecting the appropriate button. Other items (e.g., items 9, 13, 14 and 15) will automatically expand when the user enters more text. But, the user has to click out of the textbox to allow the form to expand and flow through to the next page. The fillable PDF version of the DD Form 254 will automatically number the extra pages.

c. The contract itself includes the ending period of performance, including delivery or other requirements. The DD Form 254 is an attachment to the contract and does not include the contract expiration date. Putting the schedule or period of performance in two places creates a probability that a change in one place will not be repeated in the other, and thus could create confusion about whether the security requirements for the contract are current with the current schedule or period of performance.

d. If the completed DD Form 254 will contain classified information, the classification marking can be chosen from the drop-down list on the top of the page. If custom text entry to the classification marking is desired, the drop-down list also supports this option. After the custom entry or the selection has been made in the drop-down list, the classification marking will be displayed in the top and bottom of the succeeding pages.

e. There is an optional text box in the top right corner of the DD Form 254 to allow for inclusion of a tracking or serial number for those who use such identifiers in managing their DD Forms 254.

Item 1. Clearance and Safeguarding.

1a. Facility Security Clearance (FCL) Level Required.

(1) Since an FCL is required to perform on a contract or procurement action requiring access to classified information, insert the highest level of FCL required for the contractor to perform in item 1a (i.e., insert the highest level of classified information to which contractor employees require access to perform on this contract/effort).

(2) Only one of three classification levels should be listed in this box: Confidential, Secret, or Top Secret. Do not cite special categories (e.g., such as Restricted Data, Formerly Restricted Data, Communications Security Information (COMSEC), Sensitive Compartmented Information (SCI), or Special Access Program (SAP)).

(3) Correct identification of the required FCL level for contract performance minimizes unnecessary FCL upgrades or unnecessary costs associated with requests for personnel security clearance investigations at a level higher than required for contract performance. The contractor must have an FCL at least as high as the classification level required for the specific contractor to perform on the contract.

(4) If the company does not have an FCL, then the Government Contracting Activity (GCA) or prime contractor for a subcontract must sponsor the company for an FCL at the required FCL level by submitting the FCL request to Defense Security Services (DSS) (see www.dss.mil). A GCA is an element of an agency/component head and delegated broad authority regarding acquisition function.

1a. Facility Security Clearance (FCL) Level Required (continued).

(5) If the contractor already has an FCL, but the FCL is lower than the classification level required to perform on a contract, procurement action or agreement requiring access to classified information, the GCA or prime contractor must sponsor the contractor for an FCL upgrade to DSS.

(6) To verify the contractor’s facility clearance, log on to the DSS website (www.dss.mil), click on Industrial Security Facility Database (ISFD), or its successor, under the Information Systems pull-down menu at the top of the page, use the Facility Verification Request (FVR) function to verify the contractor’s facility clearance (you must submit a system access request (SAR) to access this system), then follow the instructions to either login or request access.

(7) Do not use the DD Form 254 for contracts with foreign contractors, foreign governments or North Atlantic Treaty Organization (NATO) activities that require access to classified information.

1a. Facility Security Clearance (FCL) Level Required (continued).

(a) Foreign contractors will not normally be bound by the requirements of the National Industrial Security Program Operating Manual (NISPOM) (DoD 5220.22-M). See item 1a(7)(a) for instructions on completion of a security aspects letter to the foreign contractor, foreign government, or NATO activity which serves as an equivalent to the DD Form 254.

(b) Issue a separate security aspects letter which serves as the equivalent of a DD Form 254 to provide security classification guidance to a foreign contractor, foreign government, or NATO activity, and also assure that security requirements are included in the contract when access to classified information is required, and, there must be the appropriate foreign disclosure determinations made in accordance with National Disclosure Policy for access to classified information by the foreign contractor, foreign government, or NATO activity.

(1) Security clauses to be included in international contracts are in the NISPOM international section.

(2) Request DSS obtain a facility clearance assurance on the foreign company from the designated security authority of the other government to verify the FCL and storage capability and thus alert the other government that a U.S. classified contract is to be awarded to one of the foreign government's contractors.

Defense Security Service

Industrial Policy and Programs

International Division

27130 Telegraph Road

Quantico, VA 22134-2253

E-mail: iab@dss.mil

1b. Level of Safeguarding for Classified Information/ Material Required at Contractor Facility.

Insert the highest level of classified information/material the contractor will be required to store at its own facility. Safeguarding refers to the ability to store and/or generate classified information/materials at the contractor facility.

(1) The classification level shown in item 1b cannot be higher than the level specified in item 1a.

(2) If no classified material will be stored at the contractor’s site, then “None” should be entered as the contractor will have access elsewhere to classified information or classified material (i.e., at a government location or at another contractor with a valid FCL). This item refers only to the contractor’s requirements to safeguard/protect classified information at its own facility.

(3) Do not cite special categories (e.g., such as Restricted Data, Formerly Restricted Data, COMSEC, SCI or SAP).

Item 2. This Specification is for:

Insert only one “X” into the appropriate box, although information may be entered into both “a” and “b” (i.e., prime contract number and subcontract number).

2a. Prime Contract Number.

Used when a GCA issues guidance to the prime contractor. The GCA enters the contract number.

(1) This item is completed by either the GCA or the prime contractor for a subcontract unless the specification is solely in the solicitation phase by the GCA.

(2) If there are any other contract-related numbers, other than the prime contract between the GCA and the prime contractor, be sure to list those in item 13 with a description or explanation for each one (e.g., General Services Administration (GSA) schedule, basic ordering agreement, basic purchase agreement, task order, etc.).

(3) For prime contractors ONLY when subcontracting, if Item 11e is marked and the services to be performed do not apply to a specific contract (for example guard services or maintenance), enter the term “Multiple Contracts” in item 2a instead of the prime contract number and provide an explanation in item 13.

NOTE: As a reminder, confirm compliance with any (DoD 5220.22-M) NISPOM requirements about security guards.

(4) The applicable GCA determines whether there are any restrictions or pre-approval requirements for subcontracting.

(5) This item will include the applicable prime contract number whenever there are any subcontracts (e.g., first tier subcontractor subcontracts to a second tier subcontractor; second tier subcontractor subcontracts to a third tier subcontractor). An individual DD Form 254 would ordinarily be issued for each subcontract, even when there is a string of subcontracts associated with a prime contract.

2b. Subcontract Number.

Used by the prime contractor when there is a prime/subcontractor relationship. The prime contractor issuing the subcontract enters the subcontract number. The prime contractor’s number must also be entered in item 2a.

(1) The applicable GCA determines whether there are any restrictions or pre-approval requirements for subcontracting.

(2) An individual DD Form 254 would ordinarily be issued for each subcontract, even when there may be a string of subcontracts flowing from a prime contract.

2c. Solicitation or other number.

(1) Used for a Request For Proposal (RFP), Request For Quote (RFQ), Invitation For Bid (IFB), or other solicitation, that will involve access to classified information or material for the contract or agreement performance, regardless of whether or not a contractor will require access to classified information during pre-contract phases of the procurement. Use item 13 to explain if access to classified information is required during pre-contract phases.

(2) The issuing activity, designated by the GCA or a prime contractor for a subcontract, enters the solicitation number and the date by which bids are due.

(3) When the contract is awarded, a new DD Form 254 will be prepared by the contracting officer or authorized representative designated by the GCA or prime contractor for a subcontract and issued with the contract number entered in Item 2a or 2b, as applicable.

Item 3. This Specification Is:

Insert only one "X" into the appropriate box, although information may be entered into both “a” and “b.”

3a. Original.

Used when the original DD Form 254 is issued. The date of issuance is entered by the GCA. The Prime Contractor enters the date for a subcontract. Original date refers to the release/certifying official signature date of the DD Form 254.

(1) When there is a solicitation for a classified contract, whether or not the actual bid package contains classified information, check item 3a and insert the release/certifying official signature date of the DD Form 254. This date will not change and will continue to show on any subsequent revisions of the DD Form 254 for the solicitation.

(2) When there is the award of a prime contract requiring access to classified information, check item 3a and insert the release/certifying official signature date of the DD Form 254. This date may be different from the original date on the DD Form 254 for the associated solicitation. This date will not change and will continue to show on any subsequent revisions of the DD Form 254 for the prime contract.

(3) When the prime contractor is awarding a subcontract requiring access to classified information, check item 3a and insert the prime contractor's release/certifying official signature date of the DD Form 254 for the subcontract. This date may be different from the original date on the DD Form 254 for the associated solicitation. This date will not change and will continue to show on any subsequent revisions of the DD Form 254 for the subcontract.

3b. Revised.

Issued when there is a change to classification guidance, security requirements of the contract or change in the location of the contractor facility. Give a sequential number to each revision and enter the date of the revised DD Form 254.

(1) Revised DD Forms 254 must be incorporated into the contract by modification.

(2) Do not issue a revised DD Form 254 when exercising an option year on a contract requiring access to classified information. If an option year is exercised, then there are no changes to any other contract terms, and the initial DD Form 254 for the contract award is still valid.

(3) Conduct review of classification requirements at least biennially.

3c. Final.

Issued only to authorize the contractor additional retention of classified materials received or generated from the end of the contract beyond the automatic two year retention period authorized by the NISPOM (DoD 5220.22-M) provided the GCA does not advise to the contrary. If retention is required beyond the two-year period, the contractor must submit a request and receive retention authority from the GCA. The final DD Form 254 is then an authorization for the contractor to retain the information. In addition, the GCA may grant retention beyond the automatic two year retention period in formal written authorization to the contractor.

(1) Enter the date the final DD Form 254 is issued and always complete Item 5.

(2) Enter the date of the original DD Form 254 in Item 3a.

Item 4. Is this a Follow-On Contract?

DD Form 254 is issued when a GCA or prime contractor awards a follow-on contract to the same contractor or subcontractor for the same item or services as a preceding contract.

(1) When this condition exists, mark “YES” and enter the preceding contract number in the space provided. This item authorizes the contractor or subcontractor to transfer material or information received or generated under the preceding contract to the new contract.

Item 4. Is this a Follow-On Contract? (continued)

(2) The material or information transferred should be reflected in item 13 noting either that all classified material or information associated with this contract is authorized to be transferred to the contract number cited in item 2a or specifying a list of material or information to be transferred.

Item 5. Is this a Final DD Form 254?

ONLY issued and marked if the contract has been completed and the GCA determines, in response to a formal contractor request, that the contractor has a continuing need for the classified information or material beyond the automatic two year period authorized by the NISPOM (DoD 5220.22-M).

(1) If this is not a FINAL DD Form 254, mark “NO.”

(2) If this is a FINAL DD Form 254, mark “YES," enter the date of the contractor’s formal request for retention in accordance with NISPOM (DoD 5220.22-M), and the GCA-authorized period of retention in the spaces provided. Item 13 must contain final disposition instructions for the classified material involved (a final specification is provided to show the retention period and to provide final disposition instructions for the classified material under the contract).

Item 6. Contractor.

Identifies the prime contractor to whom the GCA has awarded the contract or agreement that requires access to classified information. To verify a contractor’s facility security clearance (FCL), see guidance in Item 1a.

6a. Name and address of the contractor.

Enter the name and complete street address of the contractor.

(1) Add the name and complete street address of the contractor in item 6a. If the contractor is already in the National Industrial Security Program (NISP) and has an authorized classified mailing address, confirm that authorized classified mailing address through the DSS authorized information system for such information (i.e., ISFD or its successor) before adding to this item.

(2) Do not use the DD Form 254 for contracts with foreign contractors, foreign governments or NATO activities that require access to classified information. Foreign contractors will not normally be bound by the requirements of the NISPOM (DoD 5220.22-M). See item 1a(7)(a) of these instructions about issuing a security aspects letter instead of a DD Form 254 wnen the agreement requiring access to classified information will be with foreign contractors, foreign governments or NATO activities. Security clauses to be included in international classified contracts are in the NISPOM chapter 10 and in the successor to the DoD 5220.22-R.

6b. The contractor’s Commercial and Government Entity

(CAGE) Code.

Add the CAGE Code.

(1) The CAGE Code is a government issued unique identifier used to identify commercial and government entities. See Defense Federal Acquisition Regulation Supplement (DFARS) 204.7202. A CAGE Code can be verified through the Defense Logistics Agency CAGE website at https://cage.dla.mil/.

(2) The CAGE Code can be obtained from DSS or from the

Facility Security Officer (FSO) at the contractor facility.

6b. The contractor’s Commercial and Government Entity

(CAGE) Code (continued).

(3) It is important to note that not all facilities with CAGE codes are cleared contractor facilities, so the facility security clearance status should be verified (see item 1a).

6c. The appropriate CSO name, address, and phone number.

Enter the DSS Cognizant Security Office (CSO) and its address and phone number.

(1) If the information is in an automated system, it will populate automatically.

(2) Or, if completing item 6c manually, obtain the address of a specific DSS Field Office by:

a. Going to the DSS website at http://www.dss.mil/isp/dss_oper_loc.html to confirm the geographical area in which the contractor identified in item 6c.

b. Then, sending an e-mail from an authorized government or contractor e-mail account to ISFO.Communication.Feedback@dss.mil requesting this information, or

c. Contacting the contractor facility listed in item 6a.

Item 7. Subcontractor(s).

The prime contractor will complete this information based on the security requirements for the subcontract. Used to identify a subcontractor to whom a prime contractor is issuing a specification. Even if a prime contractors lists all the subcontractors in item 7, there would still have to be a separate DD Form 254 issued from the prime contractor to the first subcontractor and then each subsequent subcontractor would have to issue a separate DD Form 254 to the next subcontractor. Also, see item 2b of these instructions.

7a. Name and address of the subcontractor(s).

Add the name and complete street address of the subcontractor.

(1) To verify a contractor’s facility clearance, see guidance in

Item 1a.

(2) Do not use the DD Form 254 for contracts with foreign contractors, foreign governments or NATO activities that require access to classified information. Foreign contractors will not normally be bound by the requirements of the NISPOM (DoD 5220.22-M). See item 1(7)(1) of these instructions.

(3) Add the name and complete street address of the contractor in item 7a. If the contractor is already in the NISP and is authorized to use a Post Office Box for classified mailing, please add mailing address in item 13.

7b. The subcontractor’s CAGE Code.

Add the CAGE Code.

(1) The CAGE Code is a government issued unique identifier used to identify commercial and government entities. See DFARS 204.7202. A CAGE Code can be verified through the Defense Logistics Agency CAGE website at https://cage.dla.mil/

(2) The CAGE code can be obtained from DSS or from the FSO at the already cleared contractor facility.

(3) It is important to note that not all facilities with CAGE codes are cleared contractor facilities, so the FCL status should be verified (see item 1a).

7c. The subcontractor’s CSO name, address, and phone number.

Enter the DSS CSO and its address and phone number.

(1) The local DSS CSO and field office locations can be found by going to the DSS website at http://www.dss.mil/isp/dss_oper_loc.html, or from the FSO at the contractor facility.

(2) Do not use the DD Form 254 for contracts with foreign contractors, foreign governments or NATO activities that require access to classified information. Foreign contractors will not normally be bound by the requirements of the NISPOM (DoD 5220.22-M). See item 1(7)(a) of these instructions.

Item 8. Location(s) for actual performance address and phone number.

This item refers to all locations where classified information will be accessed and stored or only accessed (e.g., contractor personnel embedded at a government location).

(1) If the work is to be performed at the locations listed in Item

6a or 7a, the entry should state, or “see Item 7a,” as applicable.

(2) Keep in mind that by identifying an actual performance location, you are limiting all performance under the contract where access to classified information is required to the location(s) identified in Item 8.

(3) List ALL locations where classified performance is required under the contract (i.e. contractor, subcontractor, and government facilities). If the location where classified performance is required will be at a government facility, only complete item 8a. Only complete CAGE code and CSO if the location, where classified performance is required, will be at another prime contractor or subcontractor.

(4) If a location is other than the one specified in Item 6a (or 7a, as appropriate), enter information as described in Items 8a, 8b, and 8c.

8a. Facility name and address.

(1) Add the location(s) (name(s) and full address(es)) where work with classified information will be conducted. The address can be different from the address in Item 6a or 7a.

(2) If all classified work is only at a government facility, list the government facility and its physical location. Use Item 13 if additional space is required.

8b. CAGE code.

Enter the CAGE code of the contractor facility where the work will be performed, only if access to classified information will occur at another prime contractor or subcontractor. See Item 6b or 7b.

8c. The CSO, address, and phone number.

(1) Enter the DSS CSO. The CSO is the DSS Field Office which has industrial security jurisdiction over the geographical area in which the contractor's facility is located - no other activity should be shown in this item. This item is used when all contract performance will occur at another cleared site of the same company or at another prime contractor or subcontractor.

(2) If inspections will be conducted by an organization other than the DSS CSO, complete item 15. Inspections by an agency, other than the DSS CSO, do not change the CSO designation for the oversight of the baseline FCL of the contractor and does not relieve the contracting activity from the responsibility of providing a copy of the DD Form 254 to the DSS CSO.

NOTE: The GCA will determine if completion of item 15 requires classification of the DD Form 254 and will coordinate with DSS to provide the DD Form 254 through appropriate channels.

8c. The CSO, address, and phone number (continued).

(3) If the classified work will take place at the facility identified in

Item 6a (or 7a), enter “Same as Item 6a”. If the place of performance is different from 6a (or 7a), enter the applicable DSS field office. If there are more places of performance, identify them in Item 13 or on the continuation page(s). Include the facility name, address, and CAGE code, and send a copy of the DD Form 254 to the appropriate CSO(s).

Item 9. General Unclassified Description of This

Procurement.

Enter a short, concise, and unclassified description of the procurement.

(1) Provide enough detail to provide an adequate picture of the project (e.g., research, development, production, study, services, manufacturing).

(2) Do not use classified information such as project names or descriptive information.

(3) In those rare instances where the GCA determines that there is absolutely no unclassified description for the procurement, then the GCA may provide a classified description in a separate, classified attachment to the DD Form 254 and enter the words "See attachment # (insert identifier, e.g., number of attachment) for description provided under separate cover, if unable to provide an unclassified description."

Item 10. Contractor Will Require Access To:

(1) Check all that apply. Provide details in blocks 13 or 14 as set forth in the instructions. These are access requirements for the contractor and their employees as determined by the GCA. It does not refer to safeguarding.

(2) Fill this out regardless of where the access will occur

(contractor’s facility, a government facility). An explanation of each item follows.

10a. Communications Security (COMSEC) Information.

Check this box only if the contractor requires access to COMSEC information which includes accountable or non-accountable COMSEC information and controlled cryptographic items (CCI).

(1) If the contractor does not require access to COMSEC information, do not check this box.

(2) If COMSEC Material Control System (CMCS) accountable material is procured or produced by the contractor, or provided to the contractor as government furnished material, the contractor must have a COMSEC account. This box would be checked and item 11h would also be checked. Accountable COMSEC material includes hard copy or electronic storage or transmittal of such material, Secure Telephone Equipment (STE) and other COMSEC devices utilizing National Security Agency (NSA)-approved cryptographic key. EXCEPTION: When accountable COMSEC material is provided to the contractor on loan by a Government COMSEC account under the terms of the contract, and the contractor is established as a Local Element/Hand Receipt Holder of the Government account, item 10a will be checked, but the contractor is not required to establish a COMSEC account, and item 11h will not be checked.

10a. Communications Security (COMSEC) Information (continued).

(3) If a contractor manufactures accountable COMSEC material, they must have a COMSEC account to identify the material as "New Material" and use an official SF-153 COMSEC

Material Report (Form) to officially transfer the material out of their COMSEC account/facility to a COMSEC account.

10a. Communications Security (COMSEC) Information

(continued).

(4) As a general rule, the ONLY time Item 10a is checked and

Item 11h is not checked is when COMSEC access is at a location other than the contractor’s location. COMSEC accounts are not required at the contractor facility when COMSEC is accessed solely at the government facility. The government’s facility COMSEC account will provide support.

(5) Prior approval from the GCA is required in order for a Prime

Contractor to grant COMSEC access to a subcontractor.

(6) If accountable COMSEC material used under the contract requires transmission via the Defense Courier Service, Item 11k must also be checked.

(7) If this box is checked, the GCA should provide the following additional or similar guidance in Item 13. Reference Item 10a: If the contractor is authorized to receive Government furnished cryptographic equipment, the guidance will state that fact. Access to classified COMSEC information requires a final U.S. Government clearance at the appropriate level. Further disclosure of COMSEC information by a contractor, to include subcontracting, requires prior approval of the GCA. Non-accountable COMSEC information, though not tracked in the COMSEC material control system, may still require a level of control within a document control system. Refer to NSA/CSS Manual 3-16, "Control of Communications Security Material," and the Committee on National Security Systems Instruction (CNSSI) 4001, "Controlled Cryptographic Items," for guidance. If access to COMSEC information is required at Government facilities, contractor personnel will follow the security requirements of the host government activity.

10b. Restricted Data.

(1) Check this box if access to RESTRICTED DATA information is required under the contract. Item 10b will always be checked if Item 10c is checked.

(2) If this box is checked, the GCA should provide the following additional or similar guidance in Item 13. Reference 10b: Access to RESTRICTED DATA requires a final U.S. Government clearance at the appropriate level.

10c. Critical Nuclear Weapon Design Information (CNWDI).

(1) Check this box if access to CNWDI is required under the contract. If CNWDI access is required, then also check

Item 10b for RESTRICTED DATA.

(2) If this box is checked, the GCA should provide the following additional or similar guidance in Item 13: GCA approval is required prior to granting CNWDI access to a subcontractor. Special briefings and procedures are also required. Access to CNWDI requires a final U.S. Government clearance at the appropriate level.

10d. Formerly Restricted Data (FRD).

Check this box if access to FRD is required under this contract.

10e. National Intelligence Information:

The Director of National Intelligence (DNI) has jurisdiction and control over National Intelligence Information.

(1) Sensitive Compartmented Information: check this item ONLY if the contractor requires access to SCI to perform. List specific SCI caveats in Items 13 or 14, as appropriate, keeping in mind that the DD Form 254 may need to be classified at the appropriate level. If SCI must be accessed, the GCA is responsible for ensuring that the additional security requirements outlined in applicable DNI and DCI Directives are incorporated in the guidance provided to the contractor.

(2) Non-SCI. Check this item ONLY if the contractor requires access to non-SCI intelligence information. Cite the applicable requirements for protection of the non-SCI intelligence information in Items 13 or 14, as appropriate.

(3) The DSS CSO does not conduct security reviews for SCI; but is still responsible for oversight of the standard contractor FCL, which may include access to non-SCI, depending upon the requirements in the DD Form 254.

(4) A GCA must provide prior approval before a subcontract involving access to intelligence information (be it SCI or non-SCI) can be issued.

10f. Special Access Program (SAP) Information.

Check this box only if access to SAP information is required under this contract. When this item is checked, Item 14 is marked “YES”, and Item 15 is completed as appropriate.

(1) SAPs impose requirements on the contractor that exceed theNISPOM. A “carve-out” is a classified contract awarded by the GCA in connection with a SAP for which DSS has been relieved of security and/or oversight responsibility by the Secretary or Deputy Secretary of Defense (DoDD 5205.07, "Special Access Program (SAP) Policy").

(2) The applicable GCA’s SAP office is responsible for providing the contractor with the additional security requirements needed to supplement the NISPOM (DoD 5220.22-M) requirements and ensure adequate protection of the SAP information involved. These GCA requirements could be included in the contract document itself or under separate cover, but will be referenced in Item 14.

(3) Approval from the GCA is required prior to subcontracting.

(4) Check block 15 “Yes” if the contract is performed at the contractor facility and DSS will be relieved of security cognizance (a carve-out), and identify the CSO for the SAP as it is responsible for inspection of the SAP. NOTE: DSS does retain oversight responsibility for the baseline FCL at which there is an approved carve-out.

(5) If the contract is performed at the contractor facility and

DSS retains security cognizance of the SAP, annotate Item 13 to note that DSS maintains cognizance over the SAP. The inspecting Industrial Security Representative must be briefed into the SAP by the government program manager or designated representative prior to access to the SAP material.

10g. NATO Information.

Check this box only if the contract requires access to classified information or documents belonging to NATO, or containing NATO classified information.

(1) If there are specific levels of NATO, list the specific levels required for performance on the contract in items 13 or 14, as appropriate.

(2) Access to NATO information requires a final U.S. Government clearance at the appropriate level and a NATO access briefing/debriefing. Special briefings are required for access to NATO, and item 13 should be annotated to reflect that requirement.

(3) Prior approval of the contracting activity is required for subcontracting to impose NATO requirements or grant NATO access to a subcontractor.

(4) If the contractor does not require access to NATO information; but does require access to the SIPRNET, do not check this box. Annotate item 13 to indicate that actual knowledge of, generation, or production of NATO information is not required for performance on the contract. But, also annotate item 13 to require a NATO awareness briefing to the appropriate contractor personnel since SIPRNET access is required for contract performance.

10h. Foreign Government Information (FGI).

Check this box if the contractor will require access to FGI during contract performance.

(1) This item includes any FGI except NATO.

(2) Prior approval of the GCA is required prior to subcontracting.

(3) FGI is information provided to the U.S. by a foreign government or governments, an international organization of governments, or any element thereof with the expectation, expressed or implied, that the information, the source of the information or both, are to be held in confidence; or produced by the U.S. pursuant to, or as a result of, a joint arrangement with a foreign government or governments, an international organization of governments, or any element thereof, requiring that the information, the arrangement, or both are to be held in confidence.

(4) Determine whether access to classified FGI, if item 10h is checked, requires a final U.S. Government clearance at the appropriate level.

10i. Alternative Compensatory Control Measures (ACCM)

Information.

(1) Check this item only if applicable. Marking this item does not make the DD Form 254 a classified document. The GCA will provide appropriate classification guidance separate from the DD Form 254.

(2) Care must be taken to ensure identification of the security plan does not disclose ACCM-protected data. See DoDM 5200.2, Volume 3, "DoD Information Security Program: Protection of Classified Information," available at: http://www.esd.whs.mil/DD/DoD-Issuances/.

10j. Controlled Unclassified Information (CUI).

Do not select this item, unless the contract requiring access to classified information also includes a requirement for access to CUI, in accordance with GCA specific classification guidance, safeguards, and procedures necessary for the protection of any CUI required in the performance of this specific classified contract. The NISPOM, DoD 5220.22-M, does not provide guidance concerning CUI so the GCA must provide guidance on protection procedures in Item 13.

(1) DoD Components: refer to DoDM 5200.01, Volume 4, "DoDInformation Security Program: Controlled Unclassified Information (CUI)," available at http://www.esd.whs.mil/DD/DoD-Issuances/, when considering protection for CUI.

(2) Non-DoD Components must consult with their Component-specific information security policy office to determine if they have any existing authority by law, government-wide policy or government-wide regulation to impose this requirement.

10k. Other.

Check this item for any required access (i.e., required for contract performance) that is not covered by items 10a through 10j. Specify the type of information and include any additional remarks as needed in item 13. Also determine if item 11m, "Other," should be marked.

(1) Common access requirements: The access requirements listed at items 10a through 10j are included because they represent common situations that may occur with contracts requiring access to classified information.

(2) Access requirements other than those identified at items 10a through 10j: Check item 10k, "Other" and ensure accesses (including any that will have to be included in the DoD personnel security system of record for an individual performing on the contract) are identified, as stated in the Statement of Work or Addendums, in items 13 or 14, as appropriate.

(3) Handling caveats or dissemination controls: Check item 10k, "Other," if there are handling caveats or dissemination controls that are not covered by items 10a through 10j (e.g., additional security requirements outlined in applicable DNI or DCI Directives). Provide applicable information with the DD Form 254 in item 13 or with applicable security classification guidance.

(4) Limited Distribution (LIMDIS) is described in DoD-M 5200.01, Volume 4,"DoD Information Security Program: Controlled Unclassified Information (CUI)” available at: http://www.esd.whs.mil/DD/DoD-Issuances/.

Item 11. Requirements Needed for Performance of the Contract.

(1) The GCA or the prime contractor for the subcontract will complete item 11. There are certain sub-items for item 11 that should not be selected for the same agreement or contract that requires access to classified information.