[Federal Register Volume 85, Number 128 (Thursday, July 2, 2020)]
[Rules and Regulations]
[Pages 40061-40064]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2020-12762]


-----------------------------------------------------------------------

DEPARTMENT OF DEFENSE

GENERAL SERVICES ADMINISTRATION

NATIONAL AERONAUTICS AND SPACE ADMINISTRATION

48 CFR Parts 1, 2, 4, 52, and 53

[FAC 2020-07; FAR Case 2015-002; Item I; Docket No. FAR-2015-0002; 
Sequence No. 1]
RIN 9000-AN40


Federal Acquisition Regulation: Requirements for DD Form 254, 
Contract Security Classification Specification

AGENCY: Department of Defense (DoD), General Services Administration 
(GSA), and National Aeronautics and Space Administration (NASA).

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: DoD, GSA, and NASA are issuing a final rule amending the 
Federal Acquisition Regulation (FAR) to require electronic submission 
of the DD Form 254, Contract Security Classification Specification.

DATES: Effective: August 3, 2020.

FOR FURTHER INFORMATION CONTACT: Mr. Curtis E. Glover, Sr., Procurement 
Analyst, at 202-501-1448 or [email protected] for clarification of 
content. For information pertaining to status or publication schedules, 
contact the Regulatory Secretariat Division at 202-501-4755. Please 
cite FAR Case 2015-002.

SUPPLEMENTARY INFORMATION:

I. Background

    DoD, GSA, and NASA published a proposed rule in the Federal 
Register at 84 FR 33201 on July 12, 2019, proposing to amend the FAR to 
update and clarify the requirements for using the DD Form 254, Contract 
Security Classification Specification. This rule amends the FAR, in 
part, to provide procedures for use of the DD Form 254 and the 
requirement to use the Procurement Integrated Enterprise Environment 
(PIEE), to--
     Streamline the submission process for the existing DD Form 
254 and enable businesses to submit an electronic form once, instead of 
repeated paper submissions;
     Require use of the DD Form 254 by nondefense agencies that 
have industrial security services agreements with DoD, and DoD 
components, to specify the security classification for a contract 
involving access to information classified as ``Confidential,'' 
``Secret,'' or ``Top Secret;''
     Require agency preparation of the DD Form 254 using the 
National Industrial Security Program Contracts Classification System 
module of the PIEE unless a nondefense agency has an existing DD Form 
254 information system.
    Five respondents submitted comments on the proposed rule.

II. Discussion and Analysis

    The Civilian Agency Acquisition Council and the Defense Acquisition 
Regulations Council (the Councils) reviewed the public comments in the 
development of the final rule. A discussion of the comments is provided 
as follows:

A. Summary of Significant Changes

    There were no changes from the proposed rule as a result of the 
public comments received. There were minor editorial changes made to 
the proposed rule, see Section C below.

B. Analysis of Public Comments

1. Commercial and Government Entity (CAGE) Code Reporting
    Comment: Two respondents expressed concern regarding the use of 
``Unique CAGE code''; stating that in some instances a facility will 
have multiple locations with the same CAGE codes. Clarification of the 
term ``unique'' CAGE code was requested.
    Response: In accordance with the National Industrial Security 
Program Operating Manual (NISPOM) DoD 5220.22-M and FAR 52.204-16(g), 
each contractor and subcontractor location of performance listed on a 
DD Form 254 is required to have a unique CAGE code; and registration in 
the System for Award Management (SAM) is not required for contractor 
and subcontractor performance locations solely for the purposes of the 
DD Form 254. FAR 52.204-16, Commercial and Government Entity (CAGE) 
Code Reporting, as prescribed at FAR 4.1804(a), is amended to add 
paragraph (g) to require subcontractors requiring access to classified 
information under a contract to be identified with a CAGE code on the 
DD Form 254. Contractors shall ensure that a subcontractor requiring 
access to classified information provide its CAGE code with its name 
and location address or otherwise include it prominently in the 
proposal. In addition, each location of subcontractor performance must 
be listed on the DD Form 254 and is required to reflect a corresponding 
unique CAGE code for each listed location unless the work is being 
performed at a Government facility, in

[[Page 40062]]

which case the agency location code shall be used. The CAGE code must 
be for that name and location address. The CAGE code is required prior 
to award. Each listed location must have a unique CAGE code classifying 
only a single location.
    Comment: Two respondents opposed the removal of the current CAGE 
code requirement and stressed the continued need to not increase risk 
of sharing classified information with an uncleared facility or one 
where the clearance is no longer active or authorized.
    Response: The rule does not decrease the security professional's 
ability to verify security clearance and safeguarding levels as 
directed by NISPOM via the National Industrial Security System (NISS). 
The rule will require electronic submission of the DD Form 254, 
Contract Security Classification Specification.
2. DD Form 254
    Comment: Two respondents recommended submission of the DD Form 254 
by company name with an ``option'' to file by CAGE code and if possible 
link the form to the website for storage and potential reuse to avoid 
uploading as part of an application ``process'' via the contractor's 
tools and processes for DD Form 254 submission.
    Response: The intent of the rule is for use of the DD Form 254 for 
each specific contractual requirement requiring access to classified 
information. While the NISS website does not currently link to the DD 
Form 254 repository, Defense Counterintelligence and Security Agency 
will evaluate that capability during future assessment of requirements.
3. Support for the Rule
    Comment: Two respondents acknowledged that streamlining the DD Form 
254 for electronic submission via the National Industrial Security 
Program (NISP) Contracts Classification System is beneficial as well as 
clarification of the SAM requirements.
    Response: The Government acknowledges the benefits with 
establishment of the rule to provide streamlined submission process 
procedures for use of the DD Form 254 through the PIEE, to enable 
businesses to submit an electronic form once, instead of repeated paper 
submissions.
4. Paperwork Reduction Act Applicability
    Comment: One respondent conveyed concerns regarding the Paperwork 
Reduction Act burdens associated with the use of DD Form 254.
    Response: The Paperwork Reduction Act (44 U.S.C. chapter 35) 
applies; however, the proposed changes to the FAR do not impose 
additional information collection requirements to the paperwork burden 
previously approved under the Office of Management and Budget (OMB) 
Control Number 0704-0567, entitled ``Department of Defense Contract 
Security Classification Specification''.
5. Out of Scope
    Comment: One respondent commented on a variety of topics unrelated 
to the rule.
    Response: Comments are out of scope.

C. Other Changes

    There were minor administrative revisions to the format of the 
provision FAR 52.204-16, Commercial and Government Entity Code 
Reporting, and the clause FAR 52.204-18, Commercial and Government 
Entity Code Maintenance, including deleting use of the alternates at 
FAR 52.204-16(g) and FAR 52.204-18(f), incorporating the paragraphs at 
FAR 52.204-16(g) and FAR 52.204-18(f) into the base clause for clarity. 
Additionally, there were minor clarifying edits to the FAR text at FAR 
4.402(d)(1) and (2), FAR 4.403(c)(1), and 52.204-16(b) and (g). As a 
result of conforming changes, revisions to FAR 4.1804 will no longer be 
required.

III. Applicability to Contracts at or Below the Simplified Acquisition 
Threshold (SAT) and for Commercial Items, Including Commercially 
Available Off-the-Shelf (COTS) Items

    This rule does not create any new provisions or clauses, nor does 
it change the applicability of any existing provisions or clauses 
included in solicitations and contracts valued at or below the SAT, or 
for commercial items, including COTS items.

IV. Executive Orders 12866 and 13563

    E.O.s 12866 and 13563 direct agencies to assess all costs and 
benefits of available regulatory alternatives and, if regulation is 
necessary, to select regulatory approaches that maximize net benefits 
(including potential economic, environmental, public health and safety 
effects, distributive impacts, and equity). E.O. 13563 emphasizes the 
importance of quantifying both costs and benefits, of reducing costs, 
of harmonizing rules, and of promoting flexibility. This is not a 
significant regulatory action and, therefore, was not subject to review 
under section 6(b) of E.O. 12866, Regulatory Planning and Review, dated 
September 30, 1993. This rule is not a major rule under 5 U.S.C. 804.

V. Executive Order 13771

    This rule is not subject to E.O. 13771, Reducing Regulation and 
Controlling Regulatory Costs, because this rule is not a significant 
regulatory action under E.O. 12866.

VI. Regulatory Flexibility Act

    DoD, GSA, and NASA have prepared a Final Regulatory Flexibility 
Analysis (FRFA) consistent with the Regulatory Flexibility Act, 5 
U.S.C. 601, et seq. The FRFA is summarized as follows:

    This final rule is to revise the FAR to update and clarify the 
requirements for using the DD Form 254, Contract Security 
Classification Specification. The Government uses the DD Form 254 to 
convey security requirements to contractors when contract 
performance requires access to classified information. Prime 
contractors also use the DD Form 254 to convey security requirements 
to subcontractors that require access to classified information to 
perform on a subcontract. Subcontractors may also use the DD Form 
254 if access to classified information is required to convey 
security requirements to additional subcontractors.
    There were no significant issues raised by the public comments 
in response to the initial regulatory flexibility analysis.
    The final rule will apply to small businesses awarded contracts 
or subcontracts by Executive agencies covered by the National 
Industrial Security Program that require access to classified 
information. Currently, the Defense Security Service monitors 
approximately 13,500 contractor facilities that are cleared for 
access to classified information. Approximately 9,000 facilities are 
considered less-complex, which includes small businesses and smaller 
security operations. Subject matter experts estimate that 5,400 (60 
percent) of the 9,000 less-complex facilities are small businesses.
    The final rule does not impose any Paperwork Reduction Act 
reporting, recordkeeping, or other compliance requirements on any 
small entities. The rule does not impose any new reporting, 
recordkeeping or other compliance requirements. The rule does not 
duplicate, overlap, or conflict with any other Federal rules.
    DoD, GSA, and NASA were unable to identify any alternatives to 
the rule which would reduce the impact on small entities and still 
meet the requirements of the rule.

Interested parties may obtain a copy of the FRFA from the Regulatory 
Secretariat Division. The Regulatory Secretariat Division has submitted 
a copy of the FRFA to the Chief Counsel for Advocacy of the Small 
Business Administration.

VII. Paperwork Reduction Act

    The Paperwork Reduction Act (44 U.S.C. chapter 35) applies; 
however, the changes to the FAR do not impose

[[Page 40063]]

additional information collection requirements to the paperwork burden 
previously approved under the Office of Management and Budget (OMB) 
Control Number 0704-0567, entitled ``Department of Defense Contract 
Security Classification Specification''.
    The rule addresses use of CAGE codes on the DD Form 254, however, 
it does not impact information collection requirements concerning the 
CAGE code, OMB Control Number 9000-0185, Commercial and Government 
Entity Code.

List of Subjects in 48 CFR Parts 1, 2, 4, 52, and 53

    Government procurement.

William F. Clark,
Director, Office of Government-wide Acquisition Policy, Office of 
Acquisition Policy, Office of Government-wide Policy.

    Therefore, DoD, GSA, and NASA amend 48 CFR parts 1, 2, 4, 52, and 
53 as set forth below:

0
1. The authority citation for 48 CFR parts 1, 2, 4, 52, and 53 
continues to read as follows:

    Authority:  40 U.S.C. 121(c); 10 U.S.C. chapter 137; and 51 
U.S.C. 20113.

PART 1--FEDERAL ACQUISITION REGULATIONS SYSTEM

0
2. In section 1.106 amend the table following by adding an entry for 
``DD Form 254'' at the end of the table to read as follows:


1.106  OMB approval under the Paperwork Reduction Act.

------------------------------------------------------------------------
                                                           OMB  control
                       FAR segment                              No.
------------------------------------------------------------------------
 
                                * * * * *
DD Form 254.............................................       0706-0567
------------------------------------------------------------------------

PART 2--DEFINITIONS OF WORDS AND TERMS

0
3. In section 2.101, amend paragraph (b) by adding in alphabetical 
order the defined term ``Commercial and Government Entity (CAGE) code'' 
to read as follows:


2.101  Definitions.

* * * * *
    Commercial and Government Entity (CAGE) code means--
    (1) An identifier assigned to entities located in the United States 
or its outlying areas by the Defense Logistics Agency (DLA) Commercial 
and Government Entity (CAGE) Branch to identify a commercial or 
government entity by unique location; or
    (2) An identifier assigned by a member of the North Atlantic Treaty 
Organization (NATO) or by the NATO Support and Procurement Agency 
(NSPA) to entities located outside the United States and its outlying 
areas that the DLA Commercial and Government Entity (CAGE) Branch 
records and maintains in the CAGE master file. This type of code is 
known as a NATO CAGE (NCAGE) code.
* * * * *

PART 4--ADMINISTRATIVE AND INFORMATION MATTERS

0
4. Amend section 4.402 by--
0
a. Removing from paragraph (b) introductory text ``and the Director of 
Central Intelligence,'' and adding ``the Director of National 
Intelligence, and the Secretary of Homeland Security'' in its place;
0
b. Removing from paragraph (b)(2) ``Industrial Security Regulation (DOD 
5220.22-R).'' and adding ``DoD Manual 5220.22, Volume 2, ``National 
Industrial Security Program: Industrial Security Procedures for 
Government Activities.'''' in its place; and
0
c. Redesignating paragraph (d) as (e), and adding a new paragraph (d) 
to read as follows:


4.402  General.

* * * * *
    (d) Nondefense agencies that have industrial security services 
agreements with DoD, and DoD components, shall use the DD Form 254, 
Contract Security Classification Specification, to provide security 
classification guidance to U.S. contractors, and subcontractors as 
applicable, requiring access to information classified as 
``Confidential'', ``Secret'', or ``Top Secret''.
    (1) Provided that the data submittal is unclassified, the DD Form 
254 shall be completed electronically in the NISP Contract 
Classification System (NCCS), which is accessible via the Procurement 
Integrated Enterprise Environment (PIEE) at https://wawf.eb.mil. 
Nondefense agencies with an existing DD Form 254 information system may 
use that system.
    (2)(i) A contractor, or subcontractor (if applicable), requiring 
access to classified information under a contract shall be identified 
with a Commercial and Government Entity (CAGE) code on the DD Form 254 
(see subpart 4.18 for information on obtaining and validating CAGE 
codes).
    (ii) Each location of contractor or subcontractor performance 
listed on the DD Form 254 is required to reflect a corresponding unique 
CAGE code for each listed location unless the work is being performed 
at a Government facility, in which case the agency location code shall 
be used. Each subcontractor location requiring access to classified 
information must be listed on the DD Form 254.
    (iii) Contractor and subcontractor performance locations listed on 
the DD Form 254 are not required to be separately registered in the 
System for Award Management (SAM) solely for the purposes of a DD Form 
254 (see subpart 4.11 for information on registering in SAM).
* * * * *

0
5. Amend section 4.403 by removing from paragraph (c) introductory text 
``contract as follows'' and adding ``contract as identified in the 
requirement documentation as follows'' in its place, and revising 
paragraph (c)(1) to read as follows:


4.403  Responsibilities of contracting officers.

* * * * *
    (c) * * *
    (1) Nondefense agencies that have industrial security services 
agreements with DoD, and DoD components, shall use the Contract 
Security Classification Specification, DD Form 254. The contracting 
officer, or authorized agency representative, is the approving official 
for the DD Form 254 associated with the prime contract and shall ensure 
the DD Form 254 is properly prepared, distributed by and coordinated 
with requirements and security personnel in accordance with agency 
procedures, see 4.402(d)(1).
* * * * *


4.1801  [Amended]

0
6. Amend section 4.1801 by removing the defined term ``Commercial and 
Government Entity (CAGE) code''.

PART 52--SOLICITATION PROVISIONS AND CONTRACT CLAUSES

0
7. Amend section 52.204-16 by--
0
a. Revising the date of the provision;
0
b. Removing from the end of paragraph (a)(1) ``entity; or'' and adding 
``entity by unique location; or'' in its place;
0
c. Revising paragraph (b);
0
d. In paragraph (c)(2) removing the word ``offeror'' and adding 
``Offeror'' in its places;
0
e. Revising paragraph (e); and
0
f. Adding paragraph (g).
    The revisions and addition read as follows:


52.204-16  Commercial and Government Entity Code Reporting.

* * * * *

[[Page 40064]]

Commercial and Government Entity Code Reporting (Aug 2020)

* * * * *
    (b) The Offeror shall provide its CAGE code with its offer with 
its name and location address or otherwise include it prominently in 
its proposal. The CAGE code must be for that name and location 
address. Insert the word ``CAGE'' before the number. The CAGE code 
is required prior to award.
* * * * *
    (e) When a CAGE code is required for the immediate owner and/or 
the highest-level owner by Federal Acquisition Regulation (FAR) 
52.204-17 or 52.212-3(p), the Offeror shall obtain the respective 
CAGE code from that entity to supply the CAGE code to the 
Government.
* * * * *
    (g) If the solicitation includes FAR clause 52.204-2, Security 
Requirements, a subcontractor requiring access to classified 
information under a contract shall be identified with a CAGE code on 
the DD Form 254. The Contractor shall require a subcontractor 
requiring access to classified information to provide its CAGE code 
with its name and location address or otherwise include it 
prominently in the proposal. Each location of subcontractor 
performance listed on the DD Form 254 is required to reflect a 
corresponding unique CAGE code for each listed location unless the 
work is being performed at a Government facility, in which case the 
agency location code shall be used. The CAGE code must be for that 
name and location address. Insert the word ``CAGE'' before the 
number. The CAGE code is required prior to award.
(End of provision)

0
8. Amend section 52.204-17 by revising the title and the date of the 
provision and removing from paragraph (a)(1) ``entity; or'' and adding 
``entity by unique location; or'' in its place.
    The revision reads as follows:


52.204-17  Ownership or Control of Offeror.

* * * * *

Ownership or Control of Offeror (Aug 2020)

* * * * *

0
9. Amend section 52.204-18 by--
0
a. Revising the date of the clause;
0
b. Removing from paragraph (a)(1) ``entity; or'' and adding ``entity by 
unique location; or'' in its place;
0
c. Revising the first sentence of paragraph (b); and
0
d. Adding paragraph (f).
    The revisions and addition read as follows:


52.204-18  Commercial and Government Entity Code Maintenance.

* * * * *

Commercial and Government Entity Code Maintenance (Aug 2020)

* * * * *
    (b) Contractors shall ensure that the CAGE code is maintained 
throughout the life of the contract for each location of contract, 
including subcontract, performance. * * *
* * * * *
    (f) If the contract includes Federal Acquisition Regulation 
clause 52.204-2, Security Requirements, the contractor shall ensure 
that subcontractors maintain their CAGE code(s) throughout the life 
of the contract.
(End of clause)

0
10. Amend section 52.204-20 by--
0
a. Revising the date of the provision; and
0
b. Removing from paragraph (a)(1) ``entity; or'' and adding ``entity by 
unique location; or'' in its place.
    The revision reads as follows:


52.204-20  Predecessor of Offeror.

* * * * *

Predecessor of Offeror (Aug 2020)

* * * * *

PART 53--FORMS

0
11. Amend section 53.204-1 by revising the introductory text to read as 
follows:


53.204-1  Safeguarding classified information within industry (DD Form 
254, DD Form 441).

    The following forms, which are prescribed by the Department of 
Defense, shall be used by DoD components and those nondefense agencies 
with which DoD has agreements to provide industrial security services 
for the National Industrial Security Program if contractor access to 
classified information is required, as specified in subpart 4.4 and the 
clause at 52.204-2:
* * * * *


53.300  [Amended]

0
12. In section 53.300 amend the table in paragraph (b) in the table 53-
2 by removing from Form DD 254 url, http://www.dtic.mil/whs/directives/forms/eforms/dd0254.pdf and adding https://www.esd.whs.mil/Portals/54/Documents/DD/forms/dd/dd0254.pdf; and removing from Form DD 441 url, 
http://www.dtic.mil/whs/directives/forms/eforms/dd0441_2017.pdf and 
adding https://www.esd.whs.mil/Portals/54/Documents/DD/forms/dd/dd0441_2020.pdf in their places, respectively.

[FR Doc. 2020-12762 Filed 7-1-20; 8:45 am]
BILLING CODE 6820-EP-P