Federal Acquisition Regulation: Requirements for DD Form 254, Contract Security Classification Specification
| Published date | 12 July 2019 |
| Citation | 84 FR 33201 |
| Record Number | 2019-14379 |
| Section | Proposed rules |
| Court | General Services Administration,National Aeronautics And Space Administration |
Federal Register, Volume 84 Issue 134 (Friday, July 12, 2019)
[Federal Register Volume 84, Number 134 (Friday, July 12, 2019)]
[Proposed Rules]
[Pages 33201-33205]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-14379]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF DEFENSE
GENERAL SERVICES ADMINISTRATION
NATIONAL AERONAUTICS AND SPACE ADMINISTRATION
48 CFR Parts 1, 2, 4, 52, and 53
[FAR Case 2015-002; Docket No. 2015-0002, Sequence No. 1]
RIN 9000-AN40
Federal Acquisition Regulation: Requirements for DD Form 254,
Contract Security Classification Specification
AGENCY: Department of Defense (DoD), General Services Administration
(GSA), and National Aeronautics and Space Administration (NASA).
ACTION: Proposed rule.
-----------------------------------------------------------------------
SUMMARY: DoD, GSA, and NASA are proposing to amend the Federal
Acquisition Regulation (FAR) to require electronic submission of the DD
Form 254, Contract Security Classification Specification.
DATES: Interested parties should submit written comments to the
Regulatory Secretariat Division at one of the addresses shown below on
or before September 10, 2019 to be considered in the formulation of a
final rule.
ADDRESSES: Submit comments in response to FAR Case 2015-002 by any of
the following methods:
Regulations.gov: http://www.regulations.gov. Submit
comments via the Federal eRulemaking portal by searching for ``FAR Case
2015-002''. Select the link ``Comment Now'' that corresponds with ``FAR
Case 2015-002''. Follow the instructions provided on the screen. Please
include your name, company name (if any), and ``FAR Case 2015-002'' on
your attached document.
Mail: General Services Administration, Regulatory
Secretariat Division (MVCB), ATTN: Lois Mandell, 1800 F Street NW,
Second Floor, Washington, DC 20405.
Instructions: Please submit comments only and cite ``FAR case 2015-
002'' in all correspondence related to this case. All comments received
will be posted, without change, to http://www.regulations.gov,
including any personal and/or business confidential information
provided. To confirm receipt of your comment(s), please check
www.regulations.gov, approximately two to three days after submission
to verify posting (except allow 30 days for posting of comments
submitted by mail).
FOR FURTHER INFORMATION CONTACT: Mr. Curtis E. Glover, Sr., Procurement
Analyst, at (202) 501-1448 for clarification of content. For
information pertaining to status or publication schedules, contact the
Regulatory Secretariat Division at (202) 501-4755. Please cite ``FAR
case 2015-002''.
SUPPLEMENTARY INFORMATION:
I. Background
DoD, GSA, and NASA are proposing to amend the FAR to update and
clarify the requirements for using the DD Form 254, Contract Security
Classification Specification. The Government uses the DD Form 254 to
convey security requirements to contractors when contract performance
requires access to classified information. Prime contractors also use
the DD Form 254 to convey security requirements to subcontractors that
require access to classified information to perform on a subcontract.
Subcontractors may also use the DD Form 254 if access to classified
information is required to convey security requirements to additional
subcontractors.
The Defense Security Service has oversight responsibilities for
contractors and subcontractors requiring access to classified
information under contracts awarded by agencies covered by the National
Industrial Security Program, i.e., DoD components, and nondefense
agencies that have industrial security services agreements with DoD.
The National Industrial Security Program was established under
Executive Order (E.O.) 12829 as a single, integrated program across the
Executive Branch designed to safeguard classified information released
to contractors. As one of five National Industrial Security Program
cognizant security agencies, DoD is responsible for providing
industrial security oversight services to DoD and those nondefense
agencies that have industrial security services agreements with DoD.
The National Industrial Security Program Contracts Classification
System is a module within the Procurement Integrated Enterprise
Environment (PIEE), (formerly the Wide Area WorkFlow application). The
module provides a centralized repository for classified contract
security requirements and automates DD Form 254 processes and
workflows.
II. Discussion and Analysis
This rule proposes to amend the FAR to provide procedures for use
of the DD Form 254 and the requirement to use the PIEE, to--
Streamline the submission process for the existing DD Form
254 and enable businesses to submit an electronic form once, instead of
repeated paper submissions;
Require use of the DD Form 254 by nondefense agencies that
have industrial security services agreements with DoD, and DoD
components, to specify the security classification for a contract
involving access to information classified as ``Confidential,''
``Secret,'' or ``Top Secret;''
Require agency preparation of the DD Form 254 using the
National Industrial Security Program Contracts Classification System
module of the PIEE unless a nondefense agency has an existing DD Form
254 information system;
Clarify that--
[[Page 33202]]
[cir] Each contractor and subcontractor location of performance
listed on a DD Form 254 is required to have a unique CAGE code; and
[cir] Registration in the System for Award Management is not
required for contractor and subcontractor performance locations solely
for the purposes of the DD Form 254.
The rule adds an Alternate I to the provision at FAR 52.204-16,
Commercial and Government Entity (CAGE) Code Reporting, to address that
prime contractors shall ensure subcontractors under classified
solicitations provide the location of subcontractor performance listed
on the DD Form 254 to reflect a corresponding unique CAGE code for each
listed location unless the work is being performed at a Government
facility, in which case the agency location code shall be used. FAR
provision 52.204-16 is used when FAR 52.204-6, Unique Entity
Identifier, or 52.204-7, System for Award Management, is used. The
provision with its Alternate I is used when the clause 52.204-2,
Security requirements is included. The rule also adds a new Alternate I
to FAR 52.204-18, Commercial and Government Entity Code Maintenance,
that requires prime contractors to ensure that subcontractors maintain
their CAGE code(s) throughout the life of the contract when the
contract may require access to classified information (unless the
contracting agency is not covered by the NISP and has prescribed a
clause and alternates that are substantially the same as those at
52.204-2, Security Requirements) and if the provision 52.204-16,
Commercial and Government Entity Code Reporting, is used with its
Alternate I.
The rule also relocates the definition of CAGE code to FAR subpart
2.1, Definitions, from FAR subpart 4.18, since the term is used in
multiple FAR sections and clauses.
III. Applicability to Contracts at or Below the Simplified Acquisition
Threshold (SAT) and for Commercial Items, Including Commercially
Available Off-the-Shelf (COTS) Items
This proposed rule does not create any new provisions or clauses,
nor does it change the applicability of any existing provisions or
clauses included in solicitations and contracts valued at or below the
SAT, or for commercial items, including COTS items.
IV. Executive Order 13771
This rule is not subject to E.O. 13771, Reducing Regulation and
Controlling Regulatory Costs, because this rule is not a significant
regulatory action under E.O. 12866.
V. Executive Orders 12866 and 13563
E.O.s 12866 and 13563 direct agencies to assess all costs and
benefits of available regulatory alternatives and, if regulation is
necessary, to select regulatory approaches that maximize net benefits
(including potential economic, environmental, public health and safety
effects, distributive impacts, and equity). E.O. 13563 emphasizes the
importance of quantifying both costs and benefits, of reducing costs,
of harmonizing rules, and of promoting flexibility. This is not a
significant regulatory action and, therefore, was not subject to review
under section 6(b) of E.O. 12866, Regulatory Planning and Review, dated
September 30, 1993. This rule is not a major rule under 5 U.S.C. 804.
VI. Regulatory Flexibility Act
DoD, GSA, and NASA do not expect this rule to have a significant
economic impact on a substantial number of small entities within the
meaning of the Regulatory Flexibility Act, 5 U.S.C. 601, et seq.,
because the rule creates minimal requirements. The initial regulatory
flexibility analysis (IRFA) has been prepared and is summarized as
follows:
DoD, GSA, and NASA are proposing to amend the Federal
Acquisition Regulation (FAR) to require electronic submission of the
DD Form 254, Contract Security Classification Specification.
The objective of this proposed rule is to revise the FAR to
update and clarify the requirements for using the DD Form 254,
Contract Security Classification Specification. The Government uses
the DD Form 254 to convey security requirements to contractors when
contract performance requires access to classified information.
Prime contractors also use the DD Form 254 to convey security
requirements to subcontractors that require access to classified
information to perform on a subcontract. Subcontractors may also use
the DD Form 254 if access to classified information is required to
convey security requirements to additional subcontractors.
DoD, GSA, and NASA do not expect that this proposed rule will
have a significant economic impact on a substantial number of small
entities within the meaning of the Regulatory Flexibility Act, 5
U.S.C. 601, et seq. The proposed rule would apply to small
businesses awarded contracts or subcontracts by Executive agencies
covered by the National Industrial Security Program that require
access to classified information. Currently, the Defense Security
Service monitors approximately 13,500 contractor facilities that are
cleared for access to classified information. Approximately 9,000
facilities are considered less-complex, which includes small
businesses and smaller security operations. Subject matter experts
estimate that 5,400 (60 percent) of the 9,000 less-complex
facilities are small businesses.
The proposed rule does not impose any Paperwork Reduction Act
reporting, recordkeeping, or other compliance requirements on any
small entities.
The proposed rule does not impose any new reporting,
recordkeeping or other compliance requirements. The rule does not
duplicate, overlap, or conflict with any other Federal rules.
There are no significant alternatives to the rule which
accomplish the stated objectives of applicable statutes and which
minimize any significant economic impact of the rule on small
entities.
The Regulatory Secretariat Division has submitted a copy of the
IRFA to the Chief Counsel for Advocacy of the Small Business
Administration. A copy of the IRFA may be obtained from the Regulatory
Secretariat Division. DoD, GSA and NASA invite comments from small
business concerns and other interested parties on the expected impact
of this rule on small entities.
DoD, GSA, and NASA will also consider comments from small entities
concerning the existing regulations in subparts affected by this rule
consistent with 5 U.S.C. 610. Interested parties must submit such
comments separately and should cite 5 U.S.C. 610 (FAR Case 2015-002) in
correspondence.
VII. Paperwork Reduction Act
The Paperwork Reduction Act (44 U.S.C. chapter 35) applies;
however, the proposed changes to the FAR do not impose additional
information collection requirements to the paperwork burden previously
approved under the Office of Management and Budget (OMB) Control Number
0704-0567, entitled ``Department of Defense Contract Security
Classification Specification''.
The proposed rule also touches but does not impact information
collection requirements concerning the CAGE code. OMB Control Number
9000-0185, Commercial and Government Entity Code was established by OMB
under FAR case 2012-024, but requires final clearance under this case.
This clearance covers the following: Offerors that do not already have
a CAGE code to obtain and provide a CAGE code referred to as North
Atlantic Treaty Organization (NATO) CAGE (NCAGE) code for foreign
entities; offerors to represent whether they are owned or controlled by
another entity, and if so, to provide the CAGE code and name of such
entity; and contractors to communicate any change to the CAGE code to
the contracting officer within 30 days after the change. As a part of
this case, the Regulatory Secretariat has submitted a request for
approval of this information collection requirement to OMB.
[[Page 33203]]
A. Public reporting burden for the collection of information under
OMB Control number 9000-0185 includes the time for reviewing
instructions, searching existing data sources, gathering and
maintaining the data needed, and completing and reviewing the
collection of information. The annual reporting burden is estimated as
follows:
Respondents: 735.
Total annual responses: 11,358.
Total burden hours: 5,616.75.
B. Request for Comments Regarding Paperwork Burden. DoD, GSA and
NASA are soliciting comments from the public in order to:
Evaluate whether this collection of information is
necessary for the proper performance of the functions of the FAR,
including whether the information will have practical utility;
Evaluate the accuracy of the estimate of the burden,
including the validity of the methodology and assumptions used;
Enhance the quality, utility, and clarity of the
information to be collected; and
Minimize the burden of the collection of information on
those who are to respond, including through the use of appropriate
collection techniques or other forms of information technology.
Organizations and individuals desiring to submit comments on the
information collection requirements should submit comments no later
than September 10, 2019 to: FAR Desk Officer, OMB, Room 10102, NEOB,
Washington, DC 20503, and a copy GSA. The copy to GSA can be submitted
by either of the following methods:
Federal eRulemaking Portal: This website provides the
ability to type short comments directly into the comment field or
attach a file for lengthier comments. Go to http://www.regulations.gov
and follow the instructions on the site.
Mail: General Services Administration, Regulatory
Secretariat Division (MVCB), 1800 F Street NW, 2nd Floor, Washington,
DC 20405. ATTN: Lois Mandell/IC 9000-0185, Commercial and Government
Entity Code.
Instructions: All items submitted must cite Information Collection
9000-0185, Commercial and Government Entity Code. Comments received
generally will be posted without change to http://www.regulations.gov,
including any personal and/or business confidential information
provided. To confirm receipt of your comment(s), please check
www.regulations.gov, approximately two to three days after submission
to verify posting (except allow 30 days for posting of comments
submitted by mail). Requesters may obtain a copy of the supporting
statement from the General Services Administration, Regulatory
Secretariat (MVCB), ATTN: Lois Mandell, 1800 F Street NW, 2nd Floor,
Washington, DC 20405-0001. Please cite OMB Control Number 9000-0185,
Commercial and Government Entity Code, in all correspondence.
List of Subjects in 48 CFR Parts 1, 2, 4, 52, and 53
Government procurement.
William Clark,
Director, Office of Government-Wide Acquisition Policy, Office of
Acquisition Policy, Office of Government-Wide Policy.
Therefore, DoD, GSA, and NASA propose amending 48 CFR parts 1, 2,
4, 52, and 53 as set forth below:
0
1. The authority citation for 48 CFR parts 1, 2, 4, 52, and 53
continues to read as follows:
Authority: 40 U.S.C. 121(c); 10 U.S.C. chapter 137; and 51
U.S.C. 20113.
PART 1--FEDERAL ACQUISITION REGULATIONS SYSTEM
0
2. In section 1.106 amend the table by adding an entry for FAR segment
``DD Form 254'' t read as follows:
------------------------------------------------------------------------
OMB
FAR segment control
No.
------------------------------------------------------------------------
* * * * *
DD Form 254................................................ 0704-0567
------------------------------------------------------------------------
PART 2--DEFINITIONS OF WORDS AND TERMS
0
3. In section 2.101, amend paragraph (b) by adding in alphabetical
order the defined term ``Commercial and Government Entity (CAGE) code''
to read as follows:
* * * * *
(b) * * *
Commercial and Government Entity (CAGE) code means--
(1) An identifier assigned to entities located in the United States
or its outlying areas by the Defense Logistics Agency (DLA) Commercial
and Government Entity (CAGE) Branch to identify a commercial or
government entity by unique location; or
(2) An identifier assigned by a member of the North Atlantic Treaty
Organization (NATO) or by the NATO Support and Procurement Agency
(NSPA) to entities located outside the United States and its outlying
areas that the DLA Commercial and Government Entity (CAGE) Branch
records and maintains in the CAGE master file. This type of code is
known as a NATO CAGE (NCAGE) code.
* * * * *
PART 4--ADMINISTRATIVE MATTERS
0
4. Amend section 4.402 by--
0
a. Removing from paragraph (b) introductory text ``and the Director of
Central Intelligence,'' and adding ``the Director of National
Intelligence, and the Secretary of Homeland Security'' in its place;
0
b. Removing from paragraph (b)(2) ``Industrial Security Regulation (DOD
5220.22-R).'' and adding ``DoD Manual 5220.22, Volume 2, ``National
Industrial Security Program: Industrial Security Procedures for
Government Activities.'' '' in its place; and
0
c. Redesignating paragraph (d) as (e), and adding a new paragraph (d)
to read as follows:
4.402 General.
* * * * *
(d) Nondefense agencies that have industrial security services
agreements with DoD, and DoD components, shall use the DD Form 254,
Contract Security Classification Specification, to provide security
classification guidance to U.S. contractors, and subcontractors as
applicable, requiring access to information classified as
``Confidential'', ``Secret'', or ``Top Secret''.
(1) Provided that the data submittal is unclassified, the DD Form
254 shall be completed electronically in the NISP Contract
Classification System (NCCS), which is accessible via the Procurement
Integrated Enterprise Environment (PIEE) at https://wawf.eb.mil unless
a nondefense agency has an existing DD Form 254 information system.
(2)(i) A contractor, or subcontractor (if applicable), requiring
access to classified information under a contract shall be identified
with a Commercial and Government Entity (CAGE) code on the DD Form 254
(see subpart 4.18 for information on obtaining and validating CAGE
codes).
(ii) Each location of contractor or subcontractor performance
listed on the DD Form 254 is required to reflect a corresponding unique
CAGE code for each listed location unless the work is being performed
at a Government facility, in which case the agency location code shall
be used.
(iii) Contractor and subcontractor performance locations listed on
the DD Form 254 are not required to be separately registered in the
System for Award Management (SAM) solely for
[[Page 33204]]
the purposes of a DD Form 254 (see subpart 4.11 for information on
registering in SAM).
* * * * *
0
5. Amend section 4.403 by removing from paragraph (c) introductory text
``contract as follows'' and adding ``contract as identified in the
requirement documentation as follows'' in its place, and revising
paragraph (c)(1) to read as follows:
4.403 Responsibilities of contracting officers.
* * * * *
(c) * * *
(1) Nondefense agencies that have industrial security services
agreements with DoD, and DoD components, shall use the Contract
Security Classification Specification, DD Form 254. The contracting
officer, or authorized representative, is the approving official for
the DD Form 254 associated with the prime contract and shall--
(i) Ensure the DD Form 254 is properly prepared and distributed;
and
(ii) Coordinate with requirements and security personnel in
accordance with agency procedures to complete the DD Form 254,
including when completed in the NCCS accessible via the Procurement
Integrated Enterprise Environment (PIEE) at https://wawf.eb.mil unless
a nondefense agency has an existing DD Form 254 information system.
* * * * *
4.1801 [Amended]
0
6. Amend section 4.1801 by removing the term ``Commercial and
Government Entity (CAGE) code''.
0
7. Amend section 4.1802 by revising the paragraph (a) introductory text
to read as follows:
4.1802 Policy
(a) Commercial and Government Entity (CAGE) code. * * *
* * * * *
0
8. Amend section 4.1804 by revising paragraphs (a) and (c) to read as
follows:
4.1804 Solicitation provisions and contract clause.
(a)(1) Insert the provision at 52.204-16, Commercial and Government
Entity Code Reporting, in all solicitations that include--
(i) 52.204-6, Unique Entity Identifier; or
(ii) 52.204-7, System for Award Management.
(2) Use the provision with its Alternate I when the clause 52.204-
2, Security Requirements, is used.
* * * * *
(c) (1) Insert the clause at 52.204-18, Commercial and Government
Entity Code Maintenance in all solicitations and contracts when the
solicitation contains the provision at 52.204-16, Commercial and
Government Entity Code Reporting.
(2) Use the clause with its Alternate I when the provision 52.204-
16, Commercial and Government Entity Code Reporting, is used with its
Alternate I.
* * * * *
PART 52--SOLICITATION PROVISIONS AND CONTRACT CLAUSES
0
9. Amend section 52.204-16 by--
0
a. Revising the date of the provision;
0
b. Removing from the end of paragraph (a)(1) ``entity; or'' and adding
``entity by unique location; or'' in its place;
0
c. Revising paragraph (b) and (c)(1);
0
d. Removing from paragraph (c)(2) ``offeror'' twice and adding
``Offeror'' in their places, respectively;
0
e. Removing from paragraph (c)(3) ``NSPA'' and adding ``NATO Support
and Procurement Agency (NSPA)'' in its place;
0
f. Removing from paragraph (e) ``Code'' three times and adding ``code''
in their places, respectively; and
0
g. Adding an Alternate I.
The revisions and addition read as follows:
52.204-16 Commercial and Government Entity Code Reporting.
* * * * *
Commercial and Government Entity Code Reporting ([DATE])
* * * * *
(b) The Offeror shall provide its CAGE code with its offer with its
name and address or otherwise include it prominently in its proposal.
The CAGE code must be for that name and address. Insert the word
``CAGE'' before the number. The CAGE code is required prior to award.
(c) * * *
(1) Registration in the System for Award Management (SAM) at
www.sam.gov. If the Offeror is located in the United States or its
outlying areas and does not already have a CAGE code assigned, the
Defense Logistics Agency (DLA) Commercial and Government Entity (CAGE)
Branch will assign a CAGE code as a part of the SAM registration
process. SAM registrants located outside the United States and its
outlying areas shall obtain a North Atlantic Treaty Organization (NATO)
CAGE (NCAGE) code prior to registration in SAM (see paragraph (c)(3) of
this provision).
* * * * *
Alternate I ([DATE]). As prescribed at 4.1804(a), add the following
additional paragraph (g).
(g) A subcontractor requiring access to classified information
under a contract shall be identified with a Commercial and Government
Entity (CAGE) code on the DD Form 254. A subcontractor requiring access
to classified information shall provide its CAGE code with its name and
address or otherwise include it prominently in the proposal. Each
location of subcontractor performance listed on the DD Form 254 is
required to reflect a corresponding unique CAGE code for each listed
location unless the work is being performed at a Government facility,
in which case the agency location code shall be used. The CAGE code
must be for that name and address. Insert the word ``CAGE'' before the
number. The CAGE code is required prior to award.
* * * * *
0
10. Amend section 52.204-17 by revising the provision title and date
and removing from paragraph (a)(1) ``entity; or'' and adding ``entity
by unique location; or'' in its place.
The revision reads as follows:
52.204-17 Ownership or Control of Offeror.
* * * * *
Ownership or Control of Offeror ([DATE])
* * * * *
0
11. Amend section 52.204-18 by--
0
a. Revising the date of the clause;
0
b. Removing from paragraph (a)(1) ``entity; or'' and adding ``entity by
unique location; or'' in its place;
0
c. Removing from paragraph (b) ``DLA'' and adding ``Defense Logistics
Agency (DLA'' in its place, and removing from paragraph (d) ``NSPA''
and adding ``North Atlantic Treaty Organization (NATO) Support and
Procurement Agency (NSPA)'' in its place; and
0
d. Adding Alternate I.
The revision and addition read as follows:
52.204-18 Commercial and Government Entity Code Maintenance.
* * * * *
Commercial and Government Entity Code Maintenance ([DATE])
* * * * *
Alternate I ([DATE]). As prescribed at 4.1804(c), add the following
additional paragraph (f).
(f) Contractors shall ensure that subcontractors maintain their
CAGE code(s) throughout the life of the contract.
0
12. Amend section 52.204-20 by revising the date of the provision and
[[Page 33205]]
removing from paragraph (a)(1) ``entity; or'' and adding ``entity by
unique location; or'' in its place.
The revision reads as follows:
52.204-20 Predecessor of Offeror.
* * * * *
Predecessor of Offeror ([DATE])
* * * * *
PART 53--FORMS
13. Amend section 53.204-1 by revising the introductory text to
read as follows:
53.204-1 Safeguarding classified information within industry (DD Form
254, DD Form 441).
The following forms, which are prescribed by the Department of
Defense, shall be used by DoD components and those nondefense agencies
with which DoD has agreements to provide industrial security services
for the National Industrial Security Program if contractor access to
classified information is required, as specified in subpart 4.4 and the
clause at 52.204-2:
* * * * *
[FR Doc. 2019-14379 Filed 7-11-19; 8:45 am]
BILLING CODE 6820-EP-P
