dd0254-Instructions.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

DD FORM 254 INSTRUCTIONS, APR 2018

INSTRUCTIONS FOR COMPLETING DD FORM 254, DEPARTMENT OF DEFENSE CONTRACT SECURITY CLASSIFICATION SPECIFICATION AEM LiveCycle Designer Page of

NEEDS DD67

DD FORM 254 INSTRUCTIONS, APR 2018

AEM LiveCycle Designer Page of

NEEDS DD67

The purpose of this document is to levy uniform requirements for application of the DD Form 254, “Contract Security Classification Specification," for contracts requiring access to classified information."

Distribution: See Item 18 for instructions.

Records Retention and Disposition Schedule: For U.S. Government agencies, refer to the National Archives and Records Administration General Records Schedule 1.1, Item 010 (Financial Management and Reporting Records) for the disposition of the DD Form 254 with its related contract file.

See www.archives.gov/records-mgmt/grs.html.

Description: A completed DD Form 254, with its attachments and incorporated references, is the principal authorized means for providing security classification guidance and the requirements to the contractor with the associated contract or agreement that requires access to classified information.

a. The DD Form 254 contains 18 items. Each item may have one or more boxes requiring a response.

b. Certain items (e.g., items 7 and 8) allow the user to add or remove rows by selecting the appropriate button. Other items (e.g., items 9, 13, 14 and 15) will automatically expand when the user enters more text. But, the user has to click out of the textbox to allow the form to expand and flow through to the next page. The fillable PDF version of the DD Form 254 will automatically number the extra pages.

c. The contract itself includes the ending period of performance, including delivery or other requirements. The DD Form 254 is an attachment to the contract and does not include the contract expiration date. Putting the schedule or period of performance in two places creates a probability that a change in one place will not be repeated in the other, and thus could create confusion about whether the security requirements for the contract are current with the current schedule or period of performance.

d. If the completed DD Form 254 will contain classified information, the classification marking can be chosen from the drop-down list on the top of the page. If custom text entry to the classification marking is desired, the drop-down list also supports this option. After the custom entry or the selection has been made in the drop-down list, the classification marking will be displayed in the top and bottom of the succeeding pages.

e. There is an optional text box in the top right corner of the DD Form 254 to allow for inclusion of a tracking or serial number for those who use such identifiers in managing their DD Forms 254.

Item 1. Clearance and Safeguarding.

1a. Facility Security Clearance (FCL) Level Required.

(1) Since an FCL is required to perform on a contract or procurement action requiring access to classified information, insert the highest level of FCL required for the contractor to perform in item 1a (i.e., insert the highest level of classified information to which contractor employees require access to perform on this contract/effort).

(2) Only one of three classification levels should be listed in this box: Confidential, Secret, or Top Secret. Do not cite special categories (e.g., such as Restricted Data, Formerly Restricted Data, Communications Security Information (COMSEC), Sensitive Compartmented Information (SCI), or Special Access Program (SAP)).

(3) Correct identification of the required FCL level for contract performance minimizes unnecessary FCL upgrades or unnecessary costs associated with requests for personnel security clearance investigations at a level higher than required for contract performance. The contractor must have an FCL at least as high as the classification level required for the specific contractor to perform on the contract.

(4) If the company does not have an FCL, then the Government Contracting Activity (GCA) or prime contractor for a subcontract must sponsor the company for an FCL at the required FCL level by submitting the FCL request to Defense Security Services (DSS) (see www.dss.mil). A GCA is an element of an agency/component head and delegated broad authority regarding acquisition function.

1a. Facility Security Clearance (FCL) Level Required (continued).

(5) If the contractor already has an FCL, but the FCL is lower than the classification level required to perform on a contract, procurement action or agreement requiring access to classified information, the GCA or prime contractor must sponsor the contractor for an FCL upgrade to DSS.

(6) To verify the contractor’s facility clearance, log on to the DSS website (www.dss.mil), click on Industrial Security Facility Database (ISFD), or its successor, under the Information Systems pull-down menu at the top of the page, use the Facility Verification Request (FVR) function to verify the contractor’s facility clearance (you must submit a system access request (SAR) to access this system), then follow the instructions to either login or request access.

(7) Do not use the DD Form 254 for contracts with foreign contractors, foreign governments or North Atlantic Treaty Organization (NATO) activities that require access to classified information.

1a. Facility Security Clearance (FCL) Level Required (continued).

(a) Foreign contractors will not normally be bound by the requirements of the National Industrial Security Program Operating Manual (NISPOM) (DoD 5220.22-M). See item 1a(7)(a) for instructions on completion of a security aspects letter to the foreign contractor, foreign government, or NATO activity which serves as an equivalent to the DD Form 254.

(b) Issue a separate security aspects letter which serves as the equivalent of a DD Form 254 to provide security classification guidance to a foreign contractor, foreign government, or NATO activity, and also assure that security requirements are included in the contract when access to classified information is required, and, there must be the appropriate foreign disclosure determinations made in accordance with National Disclosure Policy for access to classified information by the foreign contractor, foreign government, or NATO activity.

(1) Security clauses to be included in international contracts are in the NISPOM international section.

(2) Request DSS obtain a facility clearance assurance on the foreign company from the designated security authority of the other government to verify the FCL and storage capability and thus alert the other government that a U.S. classified contract is to be awarded to one of the foreign government's contractors.

Defense Security Service Industrial Policy and Programs International Division 27130 Telegraph Road Quantico, VA 22134-2253 E-mail: iab@dss.mil

1b. Level of Safeguarding for Classified Information/ Material Required at Contractor Facility.

Insert the highest level of classified information/material the contractor will be required to store at its own facility. Safeguarding refers to the ability to store and/or generate classified information/materials at the contractor facility.

(1) The classification level shown in item 1b cannot be higher than the level specified in item 1a.

(2) If no classified material will be stored at the contractor’s site, then “None” should be entered as the contractor will have access elsewhere to classified information or classified material (i.e., at a government location or at another contractor with a valid FCL). This item refers only to the contractor’s requirements to safeguard/protect classified information at its own facility.

(3) Do not cite special categories (e.g., such as Restricted Data, Formerly Restricted Data, COMSEC, SCI or SAP).

Item 2. This Specification is for:

Insert only one “X” into the appropriate box, although information may be entered into both “a” and “b” (i.e., prime contract number and subcontract number).

2a. Prime Contract Number.

Used when a GCA issues guidance to the prime contractor. The GCA enters the contract number.

(1) This item is completed by either the GCA or the prime contractor for a subcontract unless the specification is solely in the solicitation phase by the GCA.

(2) If there are any other contract-related numbers, other than the prime contract between the GCA and the prime contractor, be sure to list those in item 13 with a description or explanation for each one (e.g., General Services Administration (GSA) schedule, basic ordering agreement, basic purchase agreement, task order, etc.).

(3) For prime contractors ONLY when subcontracting, if Item 11e is marked and the services to be performed do not apply to a specific contract (for example guard services or maintenance), enter the term “Multiple Contracts” in item 2a instead of the prime contract number and provide an explanation in item 13.

NOTE: As a reminder, confirm compliance with any (DoD 5220.22-M) NISPOM requirements about security guards.

(4) The applicable GCA determines whether there are any restrictions or pre-approval requirements for subcontracting.

(5) This item will include the applicable prime contract number whenever there are any subcontracts (e.g., first tier subcontractor subcontracts to a second tier subcontractor; second tier subcontractor subcontracts to a third tier subcontractor). An individual DD Form 254 would ordinarily be issued for each subcontract, even when there is a string of subcontracts associated with a prime contract.

2b. Subcontract Number.

Used by the prime contractor when there is a prime/subcontractor relationship. The prime contractor issuing the subcontract enters the subcontract number. The prime contractor’s number must also be entered in item 2a.

(1) The applicable GCA determines whether there are any restrictions or pre-approval requirements for subcontracting.

(2) An individual DD Form 254 would ordinarily be issued for each subcontract, even when there may be a string of subcontracts flowing from a prime contract.

2c. Solicitation or other number.

(1) Used for a Request For Proposal (RFP), Request For Quote (RFQ), Invitation For Bid (IFB), or other solicitation, that will involve access to classified information or material for the contract or agreement performance, regardless of whether or not a contractor will require access to classified information during pre-contract phases of the procurement. Use item 13 to explain if access to classified information is required during pre-contract phases.

(2) The issuing activity, designated by the GCA or a prime contractor for a subcontract, enters the solicitation number and the date by which bids are due.

(3) When the contract is awarded, a new DD Form 254 will be prepared by the contracting officer or authorized representative designated by the GCA or prime contractor for a subcontract and issued with the contract number entered in Item 2a or 2b, as applicable.

Item 3. This Specification Is:

Insert only one "X" into the appropriate box, although information may be entered into both “a” and “b.”

3a. Original.

Used when the original DD Form 254 is issued. The date of issuance is entered by the GCA. The Prime Contractor enters the date for a subcontract. Original date refers to the release/certifying official signature date of the DD Form 254.

(1) When there is a solicitation for a classified contract, whether or not the actual bid package contains classified information, check item 3a and insert the release/certifying official signature date of the DD Form 254. This date will not change and will continue to show on any subsequent revisions of the DD Form 254 for the solicitation.

(2) When there is the award of a prime contract requiring access to classified information, check item 3a and insert the release/certifying official signature date of the DD Form 254. This date may be different from the original date on the DD Form 254 for the associated solicitation. This date will not change and will continue to show on any subsequent revisions of the DD Form 254 for the prime contract.

(3) When the prime contractor is awarding a subcontract requiring access to classified information, check item 3a and insert the prime contractor's release/certifying official signature date of the DD Form 254 for the subcontract. This date may be different from the original date on the DD Form 254 for the associated solicitation. This date will not change and will continue to show on any subsequent revisions of the DD Form 254 for the subcontract.

3b. Revised.

Issued when there is a change to classification guidance, security requirements of the contract or change in the location of the contractor facility. Give a sequential number to each revision and enter the date of the revised DD Form 254.

(1) Revised DD Forms 254 must be incorporated into the contract by modification.

(2) Do not issue a revised DD Form 254 when exercising an option year on a contract requiring access to classified information. If an option year is exercised, then there are no changes to any other contract terms, and the initial DD Form 254 for the contract award is still valid.

(3) Conduct review of classification requirements at least biennially.

3c. Final.

Issued only to authorize the contractor additional retention of classified materials received or generated from the end of the contract beyond the automatic two year retention period authorized by the NISPOM (DoD 5220.22-M) provided the GCA does not advise to the contrary. If retention is required beyond the two-year period, the contractor must submit a request and receive retention authority from the GCA. The final DD Form 254 is then an authorization for the contractor to retain the information. In addition, the GCA may grant retention beyond the automatic two year retention period in formal written authorization to the contractor.

(1) Enter the date the final DD Form 254 is issued and always complete Item 5.

(2) Enter the date of the original DD Form 254 in Item 3a.

Item 4. Is this a Follow-On Contract?

DD Form 254 is issued when a GCA or prime contractor awards a follow-on contract to the same contractor or subcontractor for the same item or services as a preceding contract.

(1) When this condition exists, mark “YES” and enter the preceding contract number in the space provided. This item authorizes the contractor or subcontractor to transfer material or information received or generated under the preceding contract to the new contract.

Item 4. Is this a Follow-On Contract? (continued)

(2) The material or information transferred should be reflected in item 13 noting either that all classified material or information associated with this contract is authorized to be transferred to the contract number cited in item 2a or specifying a list of material or information to be transferred.

Item 5. Is this a Final DD Form 254?

ONLY issued and marked if the contract has been completed and the GCA determines, in response to a formal contractor request, that the contractor has a continuing need for the classified information or material beyond the automatic two year period authorized by the NISPOM (DoD 5220.22-M).

(1) If this is not a FINAL DD Form 254, mark “NO.”

(2) If this is a FINAL DD Form 254, mark “YES," enter the date of the contractor’s formal request for retention in accordance with NISPOM (DoD 5220.22-M), and the GCA-authorized period of retention in the spaces provided. Item 13 must contain final disposition instructions for the classified material involved (a final specification is provided to show the retention period and to provide final disposition instructions for the classified material under the contract).

Item 6. Contractor.

Identifies the prime contractor to whom the GCA has awarded the contract or agreement that requires access to classified information. To verify a contractor’s facility security clearance (FCL), see guidance in Item 1a.

6a. Name and address of the contractor.

Enter the name and complete street address of the contractor.

(1) Add the name and complete street address of the contractor in item 6a. If the contractor is already in the National Industrial Security Program (NISP) and has an authorized classified mailing address, confirm that authorized classified mailing address through the DSS authorized information system for such information (i.e., ISFD or its successor) before adding to this item.

(2) Do not use the DD Form 254 for contracts with foreign contractors, foreign governments or NATO activities that require access to classified information. Foreign contractors will not normally be bound by the requirements of the NISPOM (DoD 5220.22-M). See item 1a(7)(a) of these instructions about issuing a security aspects letter instead of a DD Form 254 wnen the agreement requiring access to classified information will be with foreign contractors, foreign governments or NATO activities. Security clauses to be included in international classified contracts are in the NISPOM chapter 10 and in the successor to the DoD 5220.22-R.

6b. The contractor’s Commercial and Government Entity (CAGE) Code.

Add the CAGE Code.

(1) The CAGE Code is a government issued unique identifier used to identify commercial and government entities. See Defense Federal Acquisition Regulation Supplement (DFARS) 204.7202. A CAGE Code can be verified through the Defense Logistics Agency CAGE website at https://cage.dla.mil/.

(2) The CAGE Code can be obtained from DSS or from the Facility Security Officer (FSO) at the contractor facility.

6b. The contractor’s Commercial and Government Entity (CAGE) Code (continued).

(3) It is important to note that not all facilities with CAGE codes are cleared contractor facilities, so the facility security clearance status should be verified (see item 1a).

6c. The appropriate CSO name, address, and phone number.

Enter the DSS Cognizant Security Office (CSO) and its address and phone number.

(1) If the information is in an automated system, it will populate automatically.

(2) Or, if completing item 6c manually, obtain the address of a specific DSS Field Office by:

a. Going to the DSS website at http://www.dss.mil/isp/dss_oper_loc.html to confirm the geographical area in which the contractor identified in item 6c.

b. Then, sending an e-mail from an authorized government or contractor e-mail account to ISFO.Communication.Feedback@dss.mil requesting this information, or

c. Contacting the contractor facility listed in item 6a.

Item 7. Subcontractor(s).

The prime contractor will complete this information based on the security requirements for the subcontract. Used to identify a subcontractor to whom a prime contractor is issuing a specification. Even if a prime contractors lists all the subcontractors in item 7, there would still have to be a separate DD Form 254 issued from the prime contractor to the first subcontractor and then each subsequent subcontractor would have to issue a separate DD Form 254 to the next subcontractor. Also, see item 2b of these instructions.

7a. Name and address of the subcontractor(s).

Add the name and complete street address of the subcontractor.

(1) To verify a contractor’s facility clearance, see guidance in Item 1a.

(2) Do not use the DD Form 254 for contracts with foreign contractors, foreign governments or NATO activities that require access to classified information. Foreign contractors will not normally be bound by the requirements of the NISPOM (DoD 5220.22-M). See item 1(7)(1) of these instructions.

(3) Add the name and complete street address of the contractor in item 7a. If the contractor is already in the NISP and is authorized to use a Post Office Box for classified mailing, please add mailing address in item 13.

7b. The subcontractor’s CAGE Code.

Add the CAGE Code.

(1) The CAGE Code is a government issued unique identifier used to identify commercial and government entities. See DFARS 204.7202. A CAGE Code can be verified through the Defense Logistics Agency CAGE website at https://cage.dla.mil/

(2) The CAGE code can be obtained from DSS or from the FSO at the already cleared contractor facility.

(3) It is important to note that not all facilities with CAGE codes are cleared contractor facilities, so the FCL status should be verified (see item 1a).

7c. The subcontractor’s CSO name, address, and phone number.

Enter the DSS CSO and its address and phone number.

(1) The local DSS CSO and field office locations can be found by going to the DSS website at http://www.dss.mil/isp/dss_oper_loc.html, or from the FSO at the contractor facility.

(2) Do not use the DD Form 254 for contracts with foreign contractors, foreign governments or NATO activities that require access to classified information. Foreign contractors will not normally be bound by the requirements of the NISPOM (DoD 5220.22-M). See item 1(7)(a) of these instructions.

Item 8. Location(s) for actual performance address and phone number.

This item refers to all locations where classified information will be accessed and stored or only accessed (e.g., contractor personnel embedded at a government location).

(1) If the work is to be performed at the locations listed in Item 6a or 7a, the entry should state, or “see Item 7a,” as applicable.

(2) Keep in mind that by identifying an actual performance location, you are limiting all performance under the contract where access to classified information is required to the location(s) identified in Item 8.

(3) List ALL locations where classified performance is required under the contract (i.e. contractor, subcontractor, and government facilities). If the location where classified performance is required will be at a government facility, only complete item 8a. Only complete CAGE code and CSO if the location, where classified performance is required, will be at another prime contractor or subcontractor.

(4) If a location is other than the one specified in Item 6a (or 7a, as appropriate), enter information as described in Items 8a, 8b, and 8c.

8a. Facility name and address.

(1) Add the location(s) (name(s) and full address(es)) where work with classified information will be conducted. The address can be different from the address in Item 6a or 7a.

(2) If all classified work is only at a government facility, list the government facility and its physical location. Use Item 13 if additional space is required.

8b. CAGE code.

Enter the CAGE code of the contractor facility where the work will be performed, only if access to classified information will occur at another prime contractor or subcontractor. See Item 6b or 7b.

8c. The CSO, address, and phone number.

(1) Enter the DSS CSO. The CSO is the DSS Field Office which has industrial security jurisdiction over the geographical area in which the contractor's facility is located - no other activity should be shown in this item. This item is used when all contract performance will occur at another cleared site of the same company or at another prime contractor or subcontractor.

(2) If inspections will be conducted by an organization other than the DSS CSO, complete item 15. Inspections by an agency, other than the DSS CSO, do not change the CSO designation for the oversight of the baseline FCL of the contractor and does not relieve the contracting activity from the responsibility of providing a copy of the DD Form 254 to the DSS CSO.

NOTE: The GCA will determine if completion of item 15 requires classification of the DD Form 254 and will coordinate with DSS to provide the DD Form 254 through appropriate channels.

8c. The CSO, address, and phone number (continued).

(3) If the classified work will take place at the facility identified in Item 6a (or 7a), enter “Same as Item 6a”. If the place of performance is different from 6a (or 7a), enter the applicable DSS field office. If there are more places of performance, identify them in Item 13 or on the continuation page(s). Include the facility name, address, and CAGE code, and send a copy of the DD Form 254 to the appropriate CSO(s).

Item 9. General Unclassified Description of This Procurement.

Enter a short, concise, and unclassified description of the procurement.

(1) Provide enough detail to provide an adequate picture of the project (e.g., research, development, production, study, services, manufacturing).

(2) Do not use classified information such as project names or descriptive information.

(3) In those rare instances where the GCA determines that there is absolutely no unclassified description for the procurement, then the GCA may provide a classified description in a separate, classified attachment to the DD Form 254 and enter the words "See attachment # (insert identifier, e.g., number of attachment) for description provided under separate cover, if unable to provide an unclassified description."

Item 10. Contractor Will Require Access To:

(1) Check all that apply. Provide details in blocks 13 or 14 as set forth in the instructions. These are access requirements for the contractor and their employees as determined by the GCA. It does not refer to safeguarding.

(2) Fill this out regardless of where the access will occur (contractor’s facility, a government facility). An explanation of each item follows.

10a. Communications Security (COMSEC) Information.

Check this box only if the contractor requires access to COMSEC information which includes accountable or non-accountable COMSEC information and controlled cryptographic items (CCI).

(1) If the contractor does not require access to COMSEC information, do not check this box.

(2) If COMSEC Material Control System (CMCS) accountable material is procured or produced by the contractor, or provided to the contractor as government furnished material, the contractor must have a COMSEC account. This box would be checked and item 11h would also be checked. Accountable COMSEC material includes hard copy or electronic storage or transmittal of such material, Secure Telephone Equipment (STE) and other COMSEC devices utilizing National Security Agency (NSA)-approved cryptographic key. EXCEPTION: When accountable COMSEC material is provided to the contractor on loan by a Government COMSEC account under the terms of the contract, and the contractor is established as a Local Element/Hand Receipt Holder of the Government account, item 10a will be checked, but the contractor is not required to establish a COMSEC account, and item 11h will not be checked.

10a. Communications Security (COMSEC) Information (continued).

(3) If a contractor manufactures accountable COMSEC material, they must have a COMSEC account to identify the material as "New Material" and use an official SF-153 COMSEC Material Report (Form) to officially transfer the material out of their COMSEC account/facility to a COMSEC account.

10a. Communications Security (COMSEC) Information (continued).

(4) As a general rule, the ONLY time Item 10a is checked and Item 11h is not checked is when COMSEC access is at a location other than the contractor’s location. COMSEC accounts are not required at the contractor facility when COMSEC is accessed solely at the government facility. The government’s facility COMSEC account will provide support.

(5) Prior approval from the GCA is required in order for a Prime Contractor to grant COMSEC access to a subcontractor.

(6) If accountable COMSEC material used under the contract requires transmission via the Defense Courier Service, Item 11k must also be checked.

(7) If this box is checked, the GCA should provide the following additional or similar guidance in Item 13. Reference Item 10a: If the contractor is authorized to receive Government furnished cryptographic equipment, the guidance will state that fact. Access to classified COMSEC information requires a final U.S. Government clearance at the appropriate level. Further disclosure of COMSEC information by a contractor, to include subcontracting, requires prior approval of the GCA. Non-accountable COMSEC information, though not tracked in the COMSEC material control system, may still require a level of control within a document control system. Refer to NSA/CSS Manual 3-16, "Control of Communications Security Material," and the Committee on National Security Systems Instruction (CNSSI) 4001, "Controlled Cryptographic Items," for guidance. If access to COMSEC information is required at Government facilities, contractor personnel will follow the security requirements of the host government activity.

10b. Restricted Data.

(1) Check this box if access to RESTRICTED DATA information is required under the contract. Item 10b will always be checked if Item 10c is checked.

(2) If this box is checked, the GCA should provide the following additional or similar guidance in Item 13. Reference 10b: Access to RESTRICTED DATA requires a final U.S. Government clearance at the appropriate level.

10c. Critical Nuclear Weapon Design Information (CNWDI).

(1) Check this box if access to CNWDI is required under the contract. If CNWDI access is required, then also check Item 10b for RESTRICTED DATA.

(2) If this box is checked, the GCA should provide the following additional or similar guidance in Item 13: GCA approval is required prior to granting CNWDI access to a subcontractor. Special briefings and procedures are also required. Access to CNWDI requires a final U.S. Government clearance at the appropriate level.

10d. Formerly Restricted Data (FRD).

Check this box if access to FRD is required under this contract.

10e. National Intelligence Information:

The Director of National Intelligence (DNI) has jurisdiction and control over National Intelligence Information.

(1) Sensitive Compartmented Information: check this item ONLY if the contractor requires access to SCI to perform. List specific SCI caveats in Items 13 or 14, as appropriate, keeping in mind that the DD Form 254 may need to be classified at the appropriate level. If SCI must be accessed, the GCA is responsible for ensuring that the additional security requirements outlined in applicable DNI and DCI Directives are incorporated in the guidance provided to the contractor.

(2) Non-SCI. Check this item ONLY if the contractor requires access to non-SCI intelligence information. Cite the applicable requirements for protection of the non-SCI intelligence information in Items 13 or 14, as appropriate.

(3) The DSS CSO does not conduct security reviews for SCI; but is still responsible for oversight of the standard contractor FCL, which may include access to non-SCI, depending upon the requirements in the DD Form 254.

(4) A GCA must provide prior approval before a subcontract involving access to intelligence information (be it SCI or non-SCI) can be issued.

10f. Special Access Program (SAP) Information.

Check this box only if access to SAP information is required under this contract. When this item is checked, Item 14 is marked “YES”, and Item 15 is completed as appropriate.

(1) SAPs impose requirements on the contractor that exceed theNISPOM. A “carve-out” is a classified contract awarded by the GCA in connection with a SAP for which DSS has been relieved of security and/or oversight responsibility by the Secretary or Deputy Secretary of Defense (DoDD 5205.07, "Special Access Program (SAP) Policy").

(2) The applicable GCA’s SAP office is responsible for providing the contractor with the additional security requirements needed to supplement the NISPOM (DoD 5220.22-M) requirements and ensure adequate protection of the SAP information involved. These GCA requirements could be included in the contract document itself or under separate cover, but will be referenced in Item 14.

(3) Approval from the GCA is required prior to subcontracting.

(4) Check block 15 “Yes” if the contract is performed at the contractor facility and DSS will be relieved of security cognizance (a carve-out), and identify the CSO for the SAP as it is responsible for inspection of the SAP. NOTE: DSS does retain oversight responsibility for the baseline FCL at which there is an approved carve-out.

(5) If the contract is performed at the contractor facility and DSS retains security cognizance of the SAP, annotate Item 13 to note that DSS maintains cognizance over the SAP. The inspecting Industrial Security Representative must be briefed into the SAP by the government program manager or designated representative prior to access to the SAP material.

10g. NATO Information.

Check this box only if the contract requires access to classified information or documents belonging to NATO, or containing NATO classified information.

(1) If there are specific levels of NATO, list the specific levels required for performance on the contract in items 13 or 14, as appropriate.

(2) Access to NATO information requires a final U.S. Government clearance at the appropriate level and a NATO access briefing/debriefing. Special briefings are required for access to NATO, and item 13 should be annotated to reflect that requirement.

(3) Prior approval of the contracting activity is required for subcontracting to impose NATO requirements or grant NATO access to a subcontractor.

(4) If the contractor does not require access to NATO information; but does require access to the SIPRNET, do not check this box. Annotate item 13 to indicate that actual knowledge of, generation, or production of NATO information is not required for performance on the contract. But, also annotate item 13 to require a NATO awareness briefing to the appropriate contractor personnel since SIPRNET access is required for contract performance.

10h. Foreign Government Information (FGI).

Check this box if the contractor will require access to FGI during contract performance.

(1) This item includes any FGI except NATO.

(2) Prior approval of the GCA is required prior to subcontracting.

(3) FGI is information provided to the U.S. by a foreign government or governments, an international organization of governments, or any element thereof with the expectation, expressed or implied, that the information, the source of the information or both, are to be held in confidence; or produced by the U.S. pursuant to, or as a result of, a joint arrangement with a foreign government or governments, an international organization of governments, or any element thereof, requiring that the information, the arrangement, or both are to be held in confidence.

(4) Determine whether access to classified FGI, if item 10h is checked, requires a final U.S. Government clearance at the appropriate level.

10i. Alternative Compensatory Control Measures (ACCM) Information.

(1) Check this item only if applicable. Marking this item does not make the DD Form 254 a classified document. The GCA will provide appropriate classification guidance separate from the DD Form 254.

(2) Care must be taken to ensure identification of the security plan does not disclose ACCM-protected data. See DoDM 5200.2, Volume 3, "DoD Information Security Program: Protection of Classified Information," available at: http://www.esd.whs.mil/DD/DoD-Issuances/.

10j. Controlled Unclassified Information (CUI).

Do not select this item, unless the contract requiring access to classified information also includes a requirement for access to CUI, in accordance with GCA specific classification guidance, safeguards, and procedures necessary for the protection of any CUI required in the performance of this specific classified contract. The NISPOM, DoD 5220.22-M, does not provide guidance concerning CUI so the GCA must provide guidance on protection procedures in Item 13.

(1) DoD Components: refer to DoDM 5200.01, Volume 4, "DoDInformation Security Program: Controlled Unclassified Information (CUI)," available at http://www.esd.whs.mil/DD/DoD-Issuances/, when considering protection for CUI.

(2) Non-DoD Components must consult with their Component-specific information security policy office to determine if they have any existing authority by law, government-wide policy or government-wide regulation to impose this requirement.

10k. Other.

Check this item for any required access (i.e., required for contract performance) that is not covered by items 10a through 10j. Specify the type of information and include any additional remarks as needed in item 13. Also determine if item 11m, "Other," should be marked.

(1) Common access requirements: The access requirements listed at items 10a through 10j are included because they represent common situations that may occur with contracts requiring access to classified information.

(2) Access requirements other than those identified at items 10a through 10j: Check item 10k, "Other" and ensure accesses (including any that will have to be included in the DoD personnel security system of record for an individual performing on the contract) are identified, as stated in the Statement of Work or Addendums, in items 13 or 14, as appropriate.

(3) Handling caveats or dissemination controls: Check item 10k, "Other," if there are handling caveats or dissemination controls that are not covered by items 10a through 10j (e.g., additional security requirements outlined in applicable DNI or DCI Directives). Provide applicable information with the DD Form 254 in item 13 or with applicable security classification guidance.

(4) Limited Distribution (LIMDIS) is described in DoD-M 5200.01, Volume 4,"DoD Information Security Program: Controlled Unclassified Information (CUI)” available at: http://www.esd.whs.mil/DD/DoD-Issuances/.

Item 11. Requirements Needed for Performance of the Contract.

(1) The GCA or the prime contractor for the subcontract will complete item 11. There are certain sub-items for item 11 that should not be selected for the same agreement or contract that requires access to classified information. Those sub-items for item 11 will be clearly stated to explain which items should not be checked together because they would provide contradictory security classification guidance to the contractor and could be in disagreement with other requirements of the agreement or contract that requires access to classified information. The GCA or prime contractor for a subcontract must comply with the instructions where it states that certain items should not be checked together.

Item 11. Requirements Needed for Performance of the Contract (continued).

(2) Also, item 11 instructions do include recommendations about responses that should or should not be checked together for consistency in providing security classification guidance to the contractor and clarity for DSS in exercising oversight of the contractor.

(3) If the GCA or the prime contractor for the subcontract chooses NOT to follow the recommended responses as set forth in these instructions, then the GCA or prime contractor MUST explain why in item 13 to assure clarity for DSS oversignt and the contractor's compliance with security requirements for performance.

(4) The GCA will determine the required access based on the security requirements for the contract.

11a. Have access to classified information only at another contractor’s facility or at a government activity:

Applicable, if there is no access or safeguarding (storage) required at contractor facility. "ONLY" is the key word.

(1) REQUIRED: If item 11a is checked, then: item 1b should be marked "N/A" or "None." NOTE: If no classified work is to be done at the contractor's facility then they will not be receiving, generating, or fabricating anything classified at that location. The contractor will not have access to classified information at its own contractor facility, but will have that "access elsewhere" at another contractor's facility or at a government activity.

(2) REQUIRED: When item 11a is checked, identify the actual work/performance location(s) in item 8a at which the contractor will have access. Provide clarifying information, as applicable, in item 13 to explain whether access at that actual work/performance location will include the generation of classified information while working at that actual work/performance location. When the actual work/performance location is a cleared contractor site, items 8b and 8c must also be completed. NOTE: Item 8a, actual performance location, may be either a cleared contractor or a government location.

(3) REQUIRED: If item 11a is checked, then do not check items 11b, 11c, 11d, 11h, 11i, or 11k. Only check item 11g if the contractor, although "access elsewhere," will require authorized access to the unclassified services of the Defense Technical Information Center (DTIC).

(4) RECOMMENDATIONS: These instructions recommend:

If item 11a is checked and the GCA or prime contractor for a subcontract has also checked item 11e, then there should be an explanation in item 13 why item 11e is also checked.

11b. Receive and store classified documents only.

(1) “ONLY” is the key word. REQUIRED: This item will be checked when the contractor will only receive classified documents for reference purposes. By checking this item, there will be no generation or derivative classification of classified material at the contractor facility.

(2) REQUIRED: if item 11b is checked, then Item 1b would be completed at the appropriate level, and, do not check items 11a, 11c, 11d, 11h, 11i, or 11k.

(3) RECOMMENDATIONS: These instructions recommend: if item 11b is checked, then item 11e should NOT be checked. However, if item 11e is checked with item 11b, there must be an explanation in item 13 why, with the instructions for item 11b and 11e, there must be an explanation in item 13, as to why a determination has been made to check both items 11b and 11e on the same DD Form 254.

11b. Receive and store classified documents only (continued).

(4) If the volume or configuration of the documents is such that specialized storage requirements are necessary, contact the DSS, as the CSO to verify storage capacity at the contractor's facility (see item 1a in these instructions).

11c. Receive, store, and generate classified information or material.

REQUIRED: Check this item when the contractor facility will receive classified information and/or derivatively classify information. The contractor will require security classification guidance from the GCA or applicable prime contractor for contract performance. If item 11c is checked, the contractor is also authorized to have access to classified information at another contractor's cleared facility or a government activity. If said access at another contractor's location or government activity is a contract performance requirement, identify the actual work/performance location(s) in item 8a, as applicable. Item 8a does not have to be completed if such access at another contractor's cleared facility or at a government activity is solely for an authorized visit requiring access to classified information. Provide clarifying information in item 13, as appropriate.

(1) REQUIRED: If item 11c is checked, then item 1b would be completed at the appropriate level since the contractor will require safeguarding capability for classified information or material at his cleared facility. If item 11c is checked, complete item 8 if actual performance locations of divisions or branch offices of the contractor awarded the classified contract (identified in item 6a as prime contractor or item 7a as subcontractor, as applicable) will also be required to receive, store, or generate classified information or material and at what classification level.

(2) REQUIRED: When item 11c is checked, do not check items 11a or 11b. And, ONLY check item 11d if the contractor also must store classified hardware or material that could not be stored in a conventional two drawer GSA approved container at the cleared facility. (See instructions for item 11d.)

(3) INFORMATION SYSTEMS: If item 11c or 11d is checked, the contractor has justification to use information systems to process classified information with the appropriate government approval authority (e.g., DSS or another government approval authority, if applicable). Details should be provided in item 13 or 14, as applicable.

(4) SIPRNET ACCESS, JWICS ACCESS, SCI ACCESS, OR

OTHER: If the GCA requires the prime contractor to have SIPRNET, JWICS, or other information system/network specific connections for contract performance, item 11c or 11d would be checked as applicable. Details of those contract specific performance requirements should be provided in item 13 including identification of the applicable government approval authority for the contractor to have an information system or network approved for such access. Any additional requirements may also be provided in item 14.

(5) RECOMMENDATION: These instructions recommend that item 11e NOT be checked if item 11c is checked since item 11e is for SERVICES ONLY - with "ONLY" being the key term. If the contractor must also provide services when item 11c is checked, then these instructions recommend that item 11m, "Other," be checked and annotated to reflect that the contractor will also be providing services. If item 11e is checked with item 11c, then there must be an explanation in item 13 explaining why both are checked on the same DD Form 254.

11c. Receive, store and generate classified information or material (continued).

(6) Detailed guidance is usually contained in a security classification guide. The guidance may be included in Item 13, attached to the DD Form 254, forwarded under separate cover or contained in the contract document or a combination of these alternatives.

(7) Item 13 may be used to direct the contractor to the security classification guidance, for example: Reference 11c: Contractor will reference the appropriate security classification guidance when generating or deriving classified material or hardware. All classified information received or generated will be properly stored and handled according to the markings on the material. All classified information received or generated is the property of the U.S. Government. At the termination or expiration of this contract, the U.S. Government will be contacted for proper disposition instructions. Contractor will abide by the following security classification guidance: (List unclassified titles or identities and provide class guide(s) either in the contract package or under separate cover. If under separate cover, add “Provided under separate cover” following the listed class guide(s).)

(8) If the volume or configuration of the classified material is such that specialized storage requirements are necessary, contact the DSS CSO to verify storage capacity at the contracting facility (see item 1a of these instructions).

11d. Fabricate, modify, or store classified hardware.

REQUIRED: Check this item if the contractor is expected to fabricate or use hardware containing classified material at the contractor's own cleared facility. Complete item 8 if actual performance locations of divisions or branch offices of the contractor awarded the classified contract (identified in item 6a as the prime contractor or item 7a as subcontractor, as applicable) will also be required to fabricate, modify, or store classified hardware.

(1) REQUIRED: If item 11d is checked, item 1b would be completed at the appropriate level since the contractor will require safeguarding capability for classified hardware or material. NOTE: Contact the DSS CSO to verify the appropriate mailing or shipping address to transmit any classified hardware and to verify the approved classified storage capacity at the contractor facility and any other contractor actual performance locations (e.g., divisions or branch offices of the contractor awarded the classified contract). (See item 1a of these instructions).

(2) REQUIRED: If Item 11d is checked, then Items 11a and 11b are not checked. Include as much information as possible (additional information can be added in Item 13) to describe the nature and extent of the storage that will be required. Will Restricted or Closed Areas, as specified in the NISPOM, be required? Is hardware involved? If so, how much hardware is involved? How large is the hardware? Will there be a separate requirement for open storage of classified documents?

(3) INFORMATION SYSTEMS: If item 11c or 11d is checked, the contractor has justification to use information systems to process classified information with the appropriate government approval authority (e.g., DSS or another government approval authority, if applicable). Details should be provided in item 13 or item 14, as applicable.

11d. Fabricate, modify, or store classified hardware (continued).

(4) SIPRNET ACCESS, JWICS ACCESS, SCI ACCESS, OR

OTHER: If the GCA requires the prime contractor to have SIPRNET, JWICS, or other information system/network specific connections for contract performance, item 11c or 11d would be checked, as applicable. Details of those contract specific performance requirements should be provided in item 13 including identification of the applicable government approval authority for the contractor to have an information system or network approved for such access. Any additional requirements may also be provided in item 14.

(5) RECOMMENDATIONS: These instructions recommend that item 11e NOT be checked if item 11d is checked, since item 11e is for SERVICES ONLY - with "ONLY" being the key term. If the contractor must also provide services when item 11d is checked, then these instructions recommend that item 11m, "Other," be checked and annotated to reflect that the contractor will also be providing services.