84 FR 33201 - Federal Acquisition Regulation: Requirements for DD Form 254, Contract Security Classification Specification

DoD, GSA, and NASA are proposing to amend the Federal Acquisition Regulation (FAR) to require electronic submission of the DD Form 254, Contract Security Classification Specification.

[Federal Register Volume 84, Number 134 (Friday, July 12, 2019)]
[Proposed Rules]
[Pages 33201-33205]
From the Federal Register Online  [www.thefederalregister.org]
[FR Doc No: 2019-14379]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF DEFENSE

GENERAL SERVICES ADMINISTRATION

NATIONAL AERONAUTICS AND SPACE ADMINISTRATION

48 CFR Parts 1, 2, 4, 52, and 53

[FAR Case 2015-002; Docket No. 2015-0002, Sequence No. 1]
RIN 9000-AN40


Federal Acquisition Regulation: Requirements for DD Form 254, 
Contract Security Classification Specification

AGENCY: Department of Defense (DoD), General Services Administration 
(GSA), and National Aeronautics and Space Administration (NASA).

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: DoD, GSA, and NASA are proposing to amend the Federal 
Acquisition Regulation (FAR) to require electronic submission of the DD 
Form 254, Contract Security Classification Specification.

DATES: Interested parties should submit written comments to the 
Regulatory Secretariat Division at one of the addresses shown below on 
or before September 10, 2019 to be considered in the formulation of a 
final rule.

ADDRESSES: Submit comments in response to FAR Case 2015-002 by any of 
the following methods:
     Regulations.gov: http://www.regulations.gov. Submit 
comments via the Federal eRulemaking portal by searching for ``FAR Case 
2015-002''. Select the link ``Comment Now'' that corresponds with ``FAR 
Case 2015-002''. Follow the instructions provided on the screen. Please 
include your name, company name (if any), and ``FAR Case 2015-002'' on 
your attached document.
     Mail: General Services Administration, Regulatory 
Secretariat Division (MVCB), ATTN: Lois Mandell, 1800 F Street NW, 
Second Floor, Washington, DC 20405.
    Instructions: Please submit comments only and cite ``FAR case 2015-
002'' in all correspondence related to this case. All comments received 
will be posted, without change, to http://www.regulations.gov, 
including any personal and/or business confidential information 
provided. To confirm receipt of your comment(s), please check 
www.regulations.gov, approximately two to three days after submission 
to verify posting (except allow 30 days for posting of comments 
submitted by mail).

FOR FURTHER INFORMATION CONTACT: Mr. Curtis E. Glover, Sr., Procurement 
Analyst, at (202) 501-1448 for clarification of content. For 
information pertaining to status or publication schedules, contact the 
Regulatory Secretariat Division at (202) 501-4755. Please cite ``FAR 
case 2015-002''.

SUPPLEMENTARY INFORMATION:

I. Background

    DoD, GSA, and NASA are proposing to amend the FAR to update and 
clarify the requirements for using the DD Form 254, Contract Security 
Classification Specification. The Government uses the DD Form 254 to 
convey security requirements to contractors when contract performance 
requires access to classified information. Prime contractors also use 
the DD Form 254 to convey security requirements to subcontractors that 
require access to classified information to perform on a subcontract. 
Subcontractors may also use the DD Form 254 if access to classified 
information is required to convey security requirements to additional 
subcontractors.
    The Defense Security Service has oversight responsibilities for 
contractors and subcontractors requiring access to classified 
information under contracts awarded by agencies covered by the National 
Industrial Security Program, i.e., DoD components, and nondefense 
agencies that have industrial security services agreements with DoD. 
The National Industrial Security Program was established under 
Executive Order (E.O.) 12829 as a single, integrated program across the 
Executive Branch designed to safeguard classified information released 
to contractors. As one of five National Industrial Security Program 
cognizant security agencies, DoD is responsible for providing 
industrial security oversight services to DoD and those nondefense 
agencies that have industrial security services agreements with DoD.
    The National Industrial Security Program Contracts Classification 
System is a module within the Procurement Integrated Enterprise 
Environment (PIEE), (formerly the Wide Area WorkFlow application). The 
module provides a centralized repository for classified contract 
security requirements and automates DD Form 254 processes and 
workflows.

II. Discussion and Analysis

    This rule proposes to amend the FAR to provide procedures for use 
of the DD Form 254 and the requirement to use the PIEE, to--
     Streamline the submission process for the existing DD Form 
254 and enable businesses to submit an electronic form once, instead of 
repeated paper submissions;
     Require use of the DD Form 254 by nondefense agencies that 
have industrial security services agreements with DoD, and DoD 
components, to specify the security classification for a contract 
involving access to information classified as ``Confidential,'' 
``Secret,'' or ``Top Secret;''
     Require agency preparation of the DD Form 254 using the 
National Industrial Security Program Contracts Classification System 
module of the PIEE unless a nondefense agency has an existing DD Form 
254 information system;
     Clarify that--

[[Page 33202]]

    [cir] Each contractor and subcontractor location of performance 
listed on a DD Form 254 is required to have a unique CAGE code; and
    [cir] Registration in the System for Award Management is not 
required for contractor and subcontractor performance locations solely 
for the purposes of the DD Form 254.
    The rule adds an Alternate I to the provision at FAR 52.204-16, 
Commercial and Government Entity (CAGE) Code Reporting, to address that 
prime contractors shall ensure subcontractors under classified 
solicitations provide the location of subcontractor performance listed 
on the DD Form 254 to reflect a corresponding unique CAGE code for each 
listed location unless the work is being performed at a Government 
facility, in which case the agency location code shall be used. FAR 
provision 52.204-16 is used when FAR 52.204-6, Unique Entity 
Identifier, or 52.204-7, System for Award Management, is used. The 
provision with its Alternate I is used when the clause 52.204-2, 
Security requirements is included. The rule also adds a new Alternate I 
to FAR 52.204-18, Commercial and Government Entity Code Maintenance, 
that requires prime contractors to ensure that subcontractors maintain 
their CAGE code(s) throughout the life of the contract when the 
contract may require access to classified information (unless the 
contracting agency is not covered by the NISP and has prescribed a 
clause and alternates that are substantially the same as those at 
52.204-2, Security Requirements) and if the provision 52.204-16, 
Commercial and Government Entity Code Reporting, is used with its 
Alternate I.
    The rule also relocates the definition of CAGE code to FAR subpart 
2.1, Definitions, from FAR subpart 4.18, since the term is used in 
multiple FAR sections and clauses.

III. Applicability to Contracts at or Below the Simplified Acquisition 
Threshold (SAT) and for Commercial Items, Including Commercially 
Available Off-the-Shelf (COTS) Items

    This proposed rule does not create any new provisions or clauses, 
nor does it change the applicability of any existing provisions or 
clauses included in solicitations and contracts valued at or below the 
SAT, or for commercial items, including COTS items.

IV. Executive Order 13771

    This rule is not subject to E.O. 13771, Reducing Regulation and 
Controlling Regulatory Costs, because this rule is not a significant 
regulatory action under E.O. 12866.

V. Executive Orders 12866 and 13563

    E.O.s 12866 and 13563 direct agencies to assess all costs and 
benefits of available regulatory alternatives and, if regulation is 
necessary, to select regulatory approaches that maximize net benefits 
(including potential economic, environmental, public health and safety 
effects, distributive impacts, and equity). E.O. 13563 emphasizes the 
importance of quantifying both costs and benefits, of reducing costs, 
of harmonizing rules, and of promoting flexibility. This is not a 
significant regulatory action and, therefore, was not subject to review 
under section 6(b) of E.O. 12866, Regulatory Planning and Review, dated 
September 30, 1993. This rule is not a major rule under 5 U.S.C. 804.

VI. Regulatory Flexibility Act

    DoD, GSA, and NASA do not expect this rule to have a significant 
economic impact on a substantial number of small entities within the 
meaning of the Regulatory Flexibility Act, 5 U.S.C. 601, et seq., 
because the rule creates minimal requirements. The initial regulatory 
flexibility analysis (IRFA) has been prepared and is summarized as 
follows:

    DoD, GSA, and NASA are proposing to amend the Federal 
Acquisition Regulation (FAR) to require electronic submission of the 
DD Form 254, Contract Security Classification Specification.
    The objective of this proposed rule is to revise the FAR to 
update and clarify the requirements for using the DD Form 254, 
Contract Security Classification Specification. The Government uses 
the DD Form 254 to convey security requirements to contractors when 
contract performance requires access to classified information. 
Prime contractors also use the DD Form 254 to convey security 
requirements to subcontractors that require access to classified 
information to perform on a subcontract. Subcontractors may also use 
the DD Form 254 if access to classified information is required to 
convey security requirements to additional subcontractors.
    DoD, GSA, and NASA do not expect that this proposed rule will 
have a significant economic impact on a substantial number of small 
entities within the meaning of the Regulatory Flexibility Act, 5 
U.S.C. 601, et seq. The proposed rule would apply to small 
businesses awarded contracts or subcontracts by Executive agencies 
covered by the National Industrial Security Program that require 
access to classified information. Currently, the Defense Security 
Service monitors approximately 13,500 contractor facilities that are 
cleared for access to classified information. Approximately 9,000 
facilities are considered less-complex, which includes small 
businesses and smaller security operations. Subject matter experts 
estimate that 5,400 (60 percent) of the 9,000 less-complex 
facilities are small businesses.
    The proposed rule does not impose any Paperwork Reduction Act 
reporting, recordkeeping, or other compliance requirements on any 
small entities.
    The proposed rule does not impose any new reporting, 
recordkeeping or other compliance requirements. The rule does not 
duplicate, overlap, or conflict with any other Federal rules.
    There are no significant alternatives to the rule which 
accomplish the stated objectives of applicable statutes and which 
minimize any significant economic impact of the rule on small 
entities.

    The Regulatory Secretariat Division has submitted a copy of the 
IRFA to the Chief Counsel for Advocacy of the Small Business 
Administration. A copy of the IRFA may be obtained from the Regulatory 
Secretariat Division. DoD, GSA and NASA invite comments from small 
business concerns and other interested parties on the expected impact 
of this rule on small entities.
    DoD, GSA, and NASA will also consider comments from small entities 
concerning the existing regulations in subparts affected by this rule 
consistent with 5 U.S.C. 610. Interested parties must submit such 
comments separately and should cite 5 U.S.C. 610 (FAR Case 2015-002) in 
correspondence.

VII. Paperwork Reduction Act

    The Paperwork Reduction Act (44 U.S.C. chapter 35) applies; 
however, the proposed changes to the FAR do not impose additional 
information collection requirements to the paperwork burden previously 
approved under the Office of Management and Budget (OMB) Control Number 
0704-0567, entitled ``Department of Defense Contract Security 
Classification Specification''.
    The proposed rule also touches but does not impact information 
collection requirements concerning the CAGE code. OMB Control Number 
9000-0185, Commercial and Government Entity Code was established by OMB 
under FAR case 2012-024, but requires final clearance under this case. 
This clearance covers the following: Offerors that do not already have 
a CAGE code to obtain and provide a CAGE code referred to as North 
Atlantic Treaty Organization (NATO) CAGE (NCAGE) code for foreign 
entities; offerors to represent whether they are owned or controlled by 
another entity, and if so, to provide the CAGE code and name of such 
entity; and contractors to communicate any change to the CAGE code to 
the contracting officer within 30 days after the change. As a part of 
this case, the Regulatory Secretariat has submitted a request for 
approval of this information collection requirement to OMB.

[[Page 33203]]

    A. Public reporting burden for the collection of information under 
OMB Control number 9000-0185 includes the time for reviewing 
instructions, searching existing data sources, gathering and 
maintaining the data needed, and completing and reviewing the 
collection of information. The annual reporting burden is estimated as 
follows:
    Respondents: 735.
    Total annual responses: 11,358.
    Total burden hours: 5,616.75.
    B. Request for Comments Regarding Paperwork Burden. DoD, GSA and 
NASA are soliciting comments from the public in order to:
     Evaluate whether this collection of information is 
necessary for the proper performance of the functions of the FAR, 
including whether the information will have practical utility;
     Evaluate the accuracy of the estimate of the burden, 
including the validity of the methodology and assumptions used;
     Enhance the quality, utility, and clarity of the 
information to be collected; and
     Minimize the burden of the collection of information on 
those who are to respond, including through the use of appropriate 
collection techniques or other forms of information technology.
    Organizations and individuals desiring to submit comments on the 
information collection requirements should submit comments no later 
than September 10, 2019 to: FAR Desk Officer, OMB, Room 10102, NEOB, 
Washington, DC 20503, and a copy GSA. The copy to GSA can be submitted 
by either of the following methods:
     Federal eRulemaking Portal: This website provides the 
ability to type short comments directly into the comment field or 
attach a file for lengthier comments. Go to http://www.regulations.gov 
and follow the instructions on the site.
     Mail: General Services Administration, Regulatory 
Secretariat Division (MVCB), 1800 F Street NW, 2nd Floor, Washington, 
DC 20405. ATTN: Lois Mandell/IC 9000-0185, Commercial and Government 
Entity Code.
    Instructions: All items submitted must cite Information Collection 
9000-0185, Commercial and Government Entity Code. Comments received 
generally will be posted without change to http://www.regulations.gov, 
including any personal and/or business confidential information 
provided. To confirm receipt of your comment(s), please check 
www.regulations.gov, approximately two to three days after submission 
to verify posting (except allow 30 days for posting of comments 
submitted by mail). Requesters may obtain a copy of the supporting 
statement from the General Services Administration, Regulatory 
Secretariat (MVCB), ATTN: Lois Mandell, 1800 F Street NW, 2nd Floor, 
Washington, DC 20405-0001. Please cite OMB Control Number 9000-0185, 
Commercial and Government Entity Code, in all correspondence.

List of Subjects in 48 CFR Parts 1, 2, 4, 52, and 53

    Government procurement.

William Clark,
Director, Office of Government-Wide Acquisition Policy, Office of 
Acquisition Policy, Office of Government-Wide Policy.

    Therefore, DoD, GSA, and NASA propose amending 48 CFR parts 1, 2, 
4, 52, and 53 as set forth below:

0
1. The authority citation for 48 CFR parts 1, 2, 4, 52, and 53 
continues to read as follows:

    Authority:  40 U.S.C. 121(c); 10 U.S.C. chapter 137; and 51 
U.S.C. 20113.

PART 1--FEDERAL ACQUISITION REGULATIONS SYSTEM

0
2. In section 1.106 amend the table by adding an entry for FAR segment 
``DD Form 254'' t read as follows:

------------------------------------------------------------------------
                                                                 OMB
                        FAR segment                            control
                                                                 No.
------------------------------------------------------------------------
 
                                * * * * *
DD Form 254................................................   0704-0567
------------------------------------------------------------------------

PART 2--DEFINITIONS OF WORDS AND TERMS

0
3. In section 2.101, amend paragraph (b) by adding in alphabetical 
order the defined term ``Commercial and Government Entity (CAGE) code'' 
to read as follows:
* * * * *
    (b) * * *
    Commercial and Government Entity (CAGE) code means--
    (1) An identifier assigned to entities located in the United States 
or its outlying areas by the Defense Logistics Agency (DLA) Commercial 
and Government Entity (CAGE) Branch to identify a commercial or 
government entity by unique location; or
    (2) An identifier assigned by a member of the North Atlantic Treaty 
Organization (NATO) or by the NATO Support and Procurement Agency 
(NSPA) to entities located outside the United States and its outlying 
areas that the DLA Commercial and Government Entity (CAGE) Branch 
records and maintains in the CAGE master file. This type of code is 
known as a NATO CAGE (NCAGE) code.
* * * * *

PART 4--ADMINISTRATIVE MATTERS

0
4. Amend section 4.402 by--
0
a. Removing from paragraph (b) introductory text ``and the Director of 
Central Intelligence,'' and adding ``the Director of National 
Intelligence, and the Secretary of Homeland Security'' in its place;
0
b. Removing from paragraph (b)(2) ``Industrial Security Regulation (DOD 
5220.22-R).'' and adding ``DoD Manual 5220.22, Volume 2, ``National 
Industrial Security Program: Industrial Security Procedures for 
Government Activities.'' '' in its place; and
0
c. Redesignating paragraph (d) as (e), and adding a new paragraph (d) 
to read as follows:


4.402  General.

* * * * *
    (d) Nondefense agencies that have industrial security services 
agreements with DoD, and DoD components, shall use the DD Form 254, 
Contract Security Classification Specification, to provide security 
classification guidance to U.S. contractors, and subcontractors as 
applicable, requiring access to information classified as 
``Confidential'', ``Secret'', or ``Top Secret''.
    (1) Provided that the data submittal is unclassified, the DD Form 
254 shall be completed electronically in the NISP Contract 
Classification System (NCCS), which is accessible via the Procurement 
Integrated Enterprise Environment (PIEE) at https://wawf.eb.mil unless 
a nondefense agency has an existing DD Form 254 information system.
    (2)(i) A contractor, or subcontractor (if applicable), requiring 
access to classified information under a contract shall be identified 
with a Commercial and Government Entity (CAGE) code on the DD Form 254 
(see subpart 4.18 for information on obtaining and validating CAGE 
codes).
    (ii) Each location of contractor or subcontractor performance 
listed on the DD Form 254 is required to reflect a corresponding unique 
CAGE code for each listed location unless the work is being performed 
at a Government facility, in which case the agency location code shall 
be used.
    (iii) Contractor and subcontractor performance locations listed on 
the DD Form 254 are not required to be separately registered in the 
System for Award Management (SAM) solely for

[[Page 33204]]

the purposes of a DD Form 254 (see subpart 4.11 for information on 
registering in SAM).
* * * * *
0
5. Amend section 4.403 by removing from paragraph (c) introductory text 
``contract as follows'' and adding ``contract as identified in the 
requirement documentation as follows'' in its place, and revising 
paragraph (c)(1) to read as follows:


4.403  Responsibilities of contracting officers.

* * * * *
    (c) * * *
    (1) Nondefense agencies that have industrial security services 
agreements with DoD, and DoD components, shall use the Contract 
Security Classification Specification, DD Form 254. The contracting 
officer, or authorized representative, is the approving official for 
the DD Form 254 associated with the prime contract and shall--
    (i) Ensure the DD Form 254 is properly prepared and distributed; 
and
    (ii) Coordinate with requirements and security personnel in 
accordance with agency procedures to complete the DD Form 254, 
including when completed in the NCCS accessible via the Procurement 
Integrated Enterprise Environment (PIEE) at https://wawf.eb.mil unless 
a nondefense agency has an existing DD Form 254 information system.
* * * * *


4.1801   [Amended]

0
6. Amend section 4.1801 by removing the term ``Commercial and 
Government Entity (CAGE) code''.
0
7. Amend section 4.1802 by revising the paragraph (a) introductory text 
to read as follows:


4.1802  Policy

    (a) Commercial and Government Entity (CAGE) code. * * *
* * * * *
0
8. Amend section 4.1804 by revising paragraphs (a) and (c) to read as 
follows:


4.1804  Solicitation provisions and contract clause.

    (a)(1) Insert the provision at 52.204-16, Commercial and Government 
Entity Code Reporting, in all solicitations that include--
    (i) 52.204-6, Unique Entity Identifier; or
    (ii) 52.204-7, System for Award Management.
    (2) Use the provision with its Alternate I when the clause 52.204-
2, Security Requirements, is used.
* * * * *
    (c) (1) Insert the clause at 52.204-18, Commercial and Government 
Entity Code Maintenance in all solicitations and contracts when the 
solicitation contains the provision at 52.204-16, Commercial and 
Government Entity Code Reporting.
    (2) Use the clause with its Alternate I when the provision 52.204-
16, Commercial and Government Entity Code Reporting, is used with its 
Alternate I.
* * * * *

PART 52--SOLICITATION PROVISIONS AND CONTRACT CLAUSES

0
9. Amend section 52.204-16 by--
0
a. Revising the date of the provision;
0
b. Removing from the end of paragraph (a)(1) ``entity; or'' and adding 
``entity by unique location; or'' in its place;
0
c. Revising paragraph (b) and (c)(1);
0
d. Removing from paragraph (c)(2) ``offeror'' twice and adding 
``Offeror'' in their places, respectively;
0
e. Removing from paragraph (c)(3) ``NSPA'' and adding ``NATO Support 
and Procurement Agency (NSPA)'' in its place;
0
f. Removing from paragraph (e) ``Code'' three times and adding ``code'' 
in their places, respectively; and
0
g. Adding an Alternate I.
    The revisions and addition read as follows:


52.204-16  Commercial and Government Entity Code Reporting.

* * * * *
Commercial and Government Entity Code Reporting ([DATE])
* * * * *
    (b) The Offeror shall provide its CAGE code with its offer with its 
name and address or otherwise include it prominently in its proposal. 
The CAGE code must be for that name and address. Insert the word 
``CAGE'' before the number. The CAGE code is required prior to award.
    (c) * * *
    (1) Registration in the System for Award Management (SAM) at 
www.sam.gov. If the Offeror is located in the United States or its 
outlying areas and does not already have a CAGE code assigned, the 
Defense Logistics Agency (DLA) Commercial and Government Entity (CAGE) 
Branch will assign a CAGE code as a part of the SAM registration 
process. SAM registrants located outside the United States and its 
outlying areas shall obtain a North Atlantic Treaty Organization (NATO) 
CAGE (NCAGE) code prior to registration in SAM (see paragraph (c)(3) of 
this provision).
* * * * *
    Alternate I ([DATE]). As prescribed at 4.1804(a), add the following 
additional paragraph (g).
    (g) A subcontractor requiring access to classified information 
under a contract shall be identified with a Commercial and Government 
Entity (CAGE) code on the DD Form 254. A subcontractor requiring access 
to classified information shall provide its CAGE code with its name and 
address or otherwise include it prominently in the proposal. Each 
location of subcontractor performance listed on the DD Form 254 is 
required to reflect a corresponding unique CAGE code for each listed 
location unless the work is being performed at a Government facility, 
in which case the agency location code shall be used. The CAGE code 
must be for that name and address. Insert the word ``CAGE'' before the 
number. The CAGE code is required prior to award.
* * * * *
0
10. Amend section 52.204-17 by revising the provision title and date 
and removing from paragraph (a)(1) ``entity; or'' and adding ``entity 
by unique location; or'' in its place.
    The revision reads as follows:


52.204-17  Ownership or Control of Offeror.

* * * * *
    Ownership or Control of Offeror ([DATE])
* * * * *
0
11. Amend section 52.204-18 by--
0
a. Revising the date of the clause;
0
b. Removing from paragraph (a)(1) ``entity; or'' and adding ``entity by 
unique location; or'' in its place;
0
c. Removing from paragraph (b) ``DLA'' and adding ``Defense Logistics 
Agency (DLA'' in its place, and removing from paragraph (d) ``NSPA'' 
and adding ``North Atlantic Treaty Organization (NATO) Support and 
Procurement Agency (NSPA)'' in its place; and
0
d. Adding Alternate I.
    The revision and addition read as follows:


52.204-18  Commercial and Government Entity Code Maintenance.

* * * * *
    Commercial and Government Entity Code Maintenance ([DATE])
* * * * *
    Alternate I ([DATE]). As prescribed at 4.1804(c), add the following 
additional paragraph (f).
    (f) Contractors shall ensure that subcontractors maintain their 
CAGE code(s) throughout the life of the contract.
0
12. Amend section 52.204-20 by revising the date of the provision and

[[Page 33205]]

removing from paragraph (a)(1) ``entity; or'' and adding ``entity by 
unique location; or'' in its place.
    The revision reads as follows:


52.204-20  Predecessor of Offeror.

* * * * *
    Predecessor of Offeror ([DATE])
* * * * *

PART 53--FORMS

    13. Amend section 53.204-1 by revising the introductory text to 
read as follows:


53.204-1  Safeguarding classified information within industry (DD Form 
254, DD Form 441).

    The following forms, which are prescribed by the Department of 
Defense, shall be used by DoD components and those nondefense agencies 
with which DoD has agreements to provide industrial security services 
for the National Industrial Security Program if contractor access to 
classified information is required, as specified in subpart 4.4 and the 
clause at 52.204-2:
* * * * *
[FR Doc. 2019-14379 Filed 7-11-19; 8:45 am]
 BILLING CODE 6820-EP-P