Source: https://www.federalregister.gov/documents/2019/07/12/2019-14379/federal-acquisition-regulation-requirements-for-dd-form-254-contract-security-classification
Timestamp: 2019-07-18 10:54:23
Document Index: 692154994

Matched Legal Cases: ['arts 1', 'art 2', 'art 4', 'arts 1', 'arts 1', 'art 4', 'art 4', 'art 4']

Federal Register :: Federal Acquisition Regulation: Requirements for DD Form 254, Contract Security Classification Specification
A Proposed Rule by the Defense Department, the General Services Administration, and the National Aeronautics and Space Administration on 07/12/2019
Interested parties should submit written comments to the Regulatory Secretariat Division at one of the addresses shown below on or before September 10, 2019 to be considered in the formulation of a final rule.
84 FR 33201
33201-33205 (5 pages)
FAR Case 2015-002
Docket No. 2015-0002, Sequence No. 1
9000-AN40
FAR-2015-0002
Federal Acquisition Regulation; Requirements for DD Form 254, Contract Security Classification Specification (FAR Case 2015-002)
List of Subjects in 48 CFR Parts 1, 2, 4, 52, and 53
Commercial and Government Entity Code Reporting ([DATE])
https://www.federalregister.gov/d/2019-14379 https://www.federalregister.gov/d/2019-14379
Submit comments in response to FAR Case 2015-002 by any of the following methods:
Regulations.gov: http://www.regulations.gov. Submit comments via the Federal eRulemaking portal by searching for “FAR Case 2015-002”. Select the link “Comment Now” that corresponds with “FAR Case 2015-002”. Follow the instructions provided on the screen. Please include your name, company name (if any), and “FAR Case 2015-002” on your attached document.
Mail: General Services Administration, Regulatory Secretariat Division (MVCB), ATTN: Lois Mandell, 1800 F Street NW, Second Floor, Washington, DC 20405.
Instructions: Please submit comments only and cite “FAR case 2015-002” in all correspondence related to this case. All comments received will be posted, without change, to http://www.regulations.gov, including any personal and/or business confidential information provided. To confirm receipt of your comment(s), please check www.regulations.gov, approximately two to three days after submission to verify posting (except allow 30 days for posting of comments submitted by mail).
Mr. Curtis E. Glover, Sr., Procurement Analyst, at (202) 501-1448 for clarification of content. For information pertaining to status or publication schedules, contact the Regulatory Secretariat Division at (202) 501-4755. Please cite “FAR case 2015-002”.
DoD, GSA, and NASA are proposing to amend the FAR to update and clarify the requirements for using the DD Form 254, Contract Security Classification Specification. The Government uses the DD Form 254 to convey security requirements to contractors when contract performance requires access to classified information. Prime contractors also use the DD Form 254 to convey security requirements to subcontractors that require access to classified information to perform on a subcontract. Subcontractors may also use the DD Form 254 if access to classified information is required to convey security requirements to additional subcontractors.
The Defense Security Service has oversight responsibilities for contractors and subcontractors requiring access to classified information under contracts awarded by agencies covered by the National Industrial Security Program, i.e., DoD components, and nondefense agencies that have industrial security services agreements with DoD. The National Industrial Security Program was established under Executive Order (E.O.) 12829 as a single, integrated program across the Executive Branch designed to safeguard classified information released to contractors. As one of five National Industrial Security Program cognizant security agencies, DoD is responsible for providing industrial security oversight services to DoD and those nondefense agencies that have industrial security services agreements with DoD.
The National Industrial Security Program Contracts Classification System is a module within the Procurement Integrated Enterprise Environment (PIEE), (formerly the Wide Area WorkFlow application). The module provides a centralized repository for classified contract security requirements and automates DD Form 254 processes and workflows.
This rule proposes to amend the FAR to provide procedures for use of the DD Form 254 and the requirement to use the PIEE, to—
Streamline the submission process for the existing DD Form 254 and enable businesses to submit an electronic form once, instead of repeated paper submissions;
Require use of the DD Form 254 by nondefense agencies that have industrial security services agreements with DoD, and DoD components, to specify the security classification for a contract involving access to information classified as “Confidential,” “Secret,” or “Top Secret;”
Require agency preparation of the DD Form 254 using the National Industrial Security Program Contracts Classification System module of the PIEE unless a nondefense agency has an existing DD Form 254 information system;
Clarify that—Start Printed Page 33202
○ Each contractor and subcontractor location of performance listed on a DD Form 254 is required to have a unique CAGE code; and
○ Registration in the System for Award Management is not required for contractor and subcontractor performance locations solely for the purposes of the DD Form 254.
The rule adds an Alternate I to the provision at FAR 52.204-16, Commercial and Government Entity (CAGE) Code Reporting, to address that prime contractors shall ensure subcontractors under classified solicitations provide the location of subcontractor performance listed on the DD Form 254 to reflect a corresponding unique CAGE code for each listed location unless the work is being performed at a Government facility, in which case the agency location code shall be used. FAR provision 52.204-16 is used when FAR 52.204-6, Unique Entity Identifier, or 52.204-7, System for Award Management, is used. The provision with its Alternate I is used when the clause 52.204-2, Security requirements is included. The rule also adds a new Alternate I to FAR 52.204-18, Commercial and Government Entity Code Maintenance, that requires prime contractors to ensure that subcontractors maintain their CAGE code(s) throughout the life of the contract when the contract may require access to classified information (unless the contracting agency is not covered by the NISP and has prescribed a clause and alternates that are substantially the same as those at 52.204-2, Security Requirements) and if the provision 52.204-16, Commercial and Government Entity Code Reporting, is used with its Alternate I.
The rule also relocates the definition of CAGE code to FAR subpart 2.1, Definitions, from FAR subpart 4.18, since the term is used in multiple FAR sections and clauses.
This proposed rule does not create any new provisions or clauses, nor does it change the applicability of any existing provisions or clauses included in solicitations and contracts valued at or below the SAT, or for commercial items, including COTS items.
DoD, GSA, and NASA do not expect this rule to have a significant economic impact on a substantial number of small entities within the meaning of the Regulatory Flexibility Act, 5 U.S.C. 601, et seq., because the rule creates minimal requirements. The initial regulatory flexibility analysis (IRFA) has been prepared and is summarized as follows:
The objective of this proposed rule is to revise the FAR to update and clarify the requirements for using the DD Form 254, Contract Security Classification Specification. The Government uses the DD Form 254 to convey security requirements to contractors when contract performance requires access to classified information. Prime contractors also use the DD Form 254 to convey security requirements to subcontractors that require access to classified information to perform on a subcontract. Subcontractors may also use the DD Form 254 if access to classified information is required to convey security requirements to additional subcontractors.
DoD, GSA, and NASA do not expect that this proposed rule will have a significant economic impact on a substantial number of small entities within the meaning of the Regulatory Flexibility Act, 5 U.S.C. 601, et seq. The proposed rule would apply to small businesses awarded contracts or subcontracts by Executive agencies covered by the National Industrial Security Program that require access to classified information. Currently, the Defense Security Service monitors approximately 13,500 contractor facilities that are cleared for access to classified information. Approximately 9,000 facilities are considered less-complex, which includes small businesses and smaller security operations. Subject matter experts estimate that 5,400 (60 percent) of the 9,000 less-complex facilities are small businesses.
The proposed rule does not impose any Paperwork Reduction Act reporting, recordkeeping, or other compliance requirements on any small entities.
The proposed rule does not impose any new reporting, recordkeeping or other compliance requirements. The rule does not duplicate, overlap, or conflict with any other Federal rules.
There are no significant alternatives to the rule which accomplish the stated objectives of applicable statutes and which minimize any significant economic impact of the rule on small entities.
DoD, GSA, and NASA will also consider comments from small entities concerning the existing regulations in subparts affected by this rule consistent with 5 U.S.C. 610. Interested parties must submit such comments separately and should cite 5 U.S.C. 610 (FAR Case 2015-002) in correspondence.
The Paperwork Reduction Act (44 U.S.C. chapter 35) applies; however, the proposed changes to the FAR do not impose additional information collection requirements to the paperwork burden previously approved under the Office of Management and Budget (OMB) Control Number 0704-0567, entitled “Department of Defense Contract Security Classification Specification”.
The proposed rule also touches but does not impact information collection requirements concerning the CAGE code. OMB Control Number 9000-0185, Commercial and Government Entity Code was established by OMB under FAR case 2012-024, but requires final clearance under this case. This clearance covers the following: Offerors that do not already have a CAGE code to obtain and provide a CAGE code referred to as North Atlantic Treaty Organization (NATO) CAGE (NCAGE) code for foreign entities; offerors to represent whether they are owned or controlled by another entity, and if so, to provide the CAGE code and name of such entity; and contractors to communicate any change to the CAGE code to the contracting officer within 30 days after the change. As a part of this case, the Regulatory Secretariat has submitted a request for approval of this information collection requirement to OMB.Start Printed Page 33203
A. Public reporting burden for the collection of information under OMB Control number 9000-0185 includes the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. The annual reporting burden is estimated as follows:
Respondents: 735.
Total annual responses: 11,358.
Total burden hours: 5,616.75.
B. Request for Comments Regarding Paperwork Burden. DoD, GSA and NASA are soliciting comments from the public in order to:
Evaluate whether this collection of information is necessary for the proper performance of the functions of the FAR, including whether the information will have practical utility;
Evaluate the accuracy of the estimate of the burden, including the validity of the methodology and assumptions used;
Minimize the burden of the collection of information on those who are to respond, including through the use of appropriate collection techniques or other forms of information technology.
Organizations and individuals desiring to submit comments on the information collection requirements should submit comments no later than September 10, 2019 to: FAR Desk Officer, OMB, Room 10102, NEOB, Washington, DC 20503, and a copy GSA. The copy to GSA can be submitted by either of the following methods:
Mail: General Services Administration, Regulatory Secretariat Division (MVCB), 1800 F Street NW, 2nd Floor, Washington, DC 20405. ATTN: Lois Mandell/IC 9000-0185, Commercial and Government Entity Code.
Instructions: All items submitted must cite Information Collection 9000-0185, Commercial and Government Entity Code. Comments received generally will be posted without change to http://www.regulations.gov, including any personal and/or business confidential information provided. To confirm receipt of your comment(s), please check www.regulations.gov, approximately two to three days after submission to verify posting (except allow 30 days for posting of comments submitted by mail). Requesters may obtain a copy of the supporting statement from the General Services Administration, Regulatory Secretariat (MVCB), ATTN: Lois Mandell, 1800 F Street NW, 2nd Floor, Washington, DC 20405-0001. Please cite OMB Control Number 9000-0185, Commercial and Government Entity Code, in all correspondence.
Therefore, DoD, GSA, and NASA propose amending 48 CFR parts 1, 2, 4, 52, and 53 as set forth below:
1. The authority citation for 48 CFR parts 1, 2, 4, 52, and 53 continues to read as follows:
2. In section 1.106 amend the table by adding an entry for FAR segment “DD Form 254” t read as follows:
DD Form 254 0704-0567
3. In section 2.101, amend paragraph (b) by adding in alphabetical order the defined term “Commercial and Government Entity (CAGE) code” to read as follows:
(1) An identifier assigned to entities located in the United States or its outlying areas by the Defense Logistics Agency (DLA) Commercial and Government Entity (CAGE) Branch to identify a commercial or government entity by unique location; or
4. Amend section 4.402 by—
a. Removing from paragraph (b) introductory text “and the Director of Central Intelligence,” and adding “the Director of National Intelligence, and the Secretary of Homeland Security” in its place;
b. Removing from paragraph (b)(2) “Industrial Security Regulation (DOD 5220.22-R).” and adding “DoD Manual 5220.22, Volume 2, “National Industrial Security Program: Industrial Security Procedures for Government Activities.” ” in its place; and
c. Redesignating paragraph (d) as (e), and adding a new paragraph (d) to read as follows:
(d) Nondefense agencies that have industrial security services agreements with DoD, and DoD components, shall use the DD Form 254, Contract Security Classification Specification, to provide security classification guidance to U.S. contractors, and subcontractors as applicable, requiring access to information classified as “Confidential”, “Secret”, or “Top Secret”.
(1) Provided that the data submittal is unclassified, the DD Form 254 shall be completed electronically in the NISP Contract Classification System (NCCS), which is accessible via the Procurement Integrated Enterprise Environment (PIEE) at https://wawf.eb.mil unless a nondefense agency has an existing DD Form 254 information system.
(2)(i) A contractor, or subcontractor (if applicable), requiring access to classified information under a contract shall be identified with a Commercial and Government Entity (CAGE) code on the DD Form 254 (see subpart 4.18 for information on obtaining and validating CAGE codes).
(ii) Each location of contractor or subcontractor performance listed on the DD Form 254 is required to reflect a corresponding unique CAGE code for each listed location unless the work is being performed at a Government facility, in which case the agency location code shall be used.
(iii) Contractor and subcontractor performance locations listed on the DD Form 254 are not required to be separately registered in the System for Award Management (SAM) solely for Start Printed Page 33204the purposes of a DD Form 254 (see subpart 4.11 for information on registering in SAM).
5. Amend section 4.403 by removing from paragraph (c) introductory text “contract as follows” and adding “contract as identified in the requirement documentation as follows” in its place, and revising paragraph (c)(1) to read as follows:
(1) Nondefense agencies that have industrial security services agreements with DoD, and DoD components, shall use the Contract Security Classification Specification, DD Form 254. The contracting officer, or authorized representative, is the approving official for the DD Form 254 associated with the prime contract and shall—
(i) Ensure the DD Form 254 is properly prepared and distributed; and
(ii) Coordinate with requirements and security personnel in accordance with agency procedures to complete the DD Form 254, including when completed in the NCCS accessible via the Procurement Integrated Enterprise Environment (PIEE) at https://wawf.eb.mil unless a nondefense agency has an existing DD Form 254 information system.
6. Amend section 4.1801 by removing the term “Commercial and Government Entity (CAGE) code”.
7. Amend section 4.1802 by revising the paragraph (a) introductory text to read as follows:
(a) Commercial and Government Entity (CAGE) code. * * *
8. Amend section 4.1804 by revising paragraphs (a) and (c) to read as follows:
(a)(1) Insert the provision at 52.204-16, Commercial and Government Entity Code Reporting, in all solicitations that include—
(i) 52.204-6, Unique Entity Identifier; or
(ii) 52.204-7, System for Award Management.
(2) Use the provision with its Alternate I when the clause 52.204-2, Security Requirements, is used.
(c) (1) Insert the clause at 52.204-18, Commercial and Government Entity Code Maintenance in all solicitations and contracts when the solicitation contains the provision at 52.204-16, Commercial and Government Entity Code Reporting.
(2) Use the clause with its Alternate I when the provision 52.204-16, Commercial and Government Entity Code Reporting, is used with its Alternate I.
9. Amend section 52.204-16 by—
b. Removing from the end of paragraph (a)(1) “entity; or” and adding “entity by unique location; or” in its place;
c. Revising paragraph (b) and (c)(1);
d. Removing from paragraph (c)(2) “offeror” twice and adding “Offeror” in their places, respectively;
e. Removing from paragraph (c)(3) “NSPA” and adding “NATO Support and Procurement Agency (NSPA)” in its place;
f. Removing from paragraph (e) “Code” three times and adding “code” in their places, respectively; and
g. Adding an Alternate I.
52.204-16
Commercial and Government Entity Code Reporting.
(b) The Offeror shall provide its CAGE code with its offer with its name and address or otherwise include it prominently in its proposal. The CAGE code must be for that name and address. Insert the word “CAGE” before the number. The CAGE code is required prior to award.
(1) Registration in the System for Award Management (SAM) at www.sam.gov. If the Offeror is located in the United States or its outlying areas and does not already have a CAGE code assigned, the Defense Logistics Agency (DLA) Commercial and Government Entity (CAGE) Branch will assign a CAGE code as a part of the SAM registration process. SAM registrants located outside the United States and its outlying areas shall obtain a North Atlantic Treaty Organization (NATO) CAGE (NCAGE) code prior to registration in SAM (see paragraph (c)(3) of this provision).
Alternate I ([DATE]). As prescribed at 4.1804(a), add the following additional paragraph (g).
(g) A subcontractor requiring access to classified information under a contract shall be identified with a Commercial and Government Entity (CAGE) code on the DD Form 254. A subcontractor requiring access to classified information shall provide its CAGE code with its name and address or otherwise include it prominently in the proposal. Each location of subcontractor performance listed on the DD Form 254 is required to reflect a corresponding unique CAGE code for each listed location unless the work is being performed at a Government facility, in which case the agency location code shall be used. The CAGE code must be for that name and address. Insert the word “CAGE” before the number. The CAGE code is required prior to award.
10. Amend section 52.204-17 by revising the provision title and date and removing from paragraph (a)(1) “entity; or” and adding “entity by unique location; or” in its place.
52.204-17
Ownership or Control of Offeror.
Ownership or Control of Offeror ([DATE])
11. Amend section 52.204-18 by—
b. Removing from paragraph (a)(1) “entity; or” and adding “entity by unique location; or” in its place;
c. Removing from paragraph (b) “DLA” and adding “Defense Logistics Agency (DLA” in its place, and removing from paragraph (d) “NSPA” and adding “North Atlantic Treaty Organization (NATO) Support and Procurement Agency (NSPA)” in its place; and
d. Adding Alternate I.
52.204-18
Commercial and Government Entity Code Maintenance.
Commercial and Government Entity Code Maintenance ([DATE])
Alternate I ([DATE]). As prescribed at 4.1804(c), add the following additional paragraph (f).
(f) Contractors shall ensure that subcontractors maintain their CAGE code(s) throughout the life of the contract.
12. Amend section 52.204-20 by revising the date of the provision and Start Printed Page 33205removing from paragraph (a)(1) “entity; or” and adding “entity by unique location; or” in its place.
Predecessor of Offeror ([DATE])
13. Amend section 53.204-1 by revising the introductory text to read as follows:
53.204-1
Safeguarding classified information within industry (DD Form 254, DD Form 441).
The following forms, which are prescribed by the Department of Defense, shall be used by DoD components and those nondefense agencies with which DoD has agreements to provide industrial security services for the National Industrial Security Program if contractor access to classified information is required, as specified in subpart 4.4 and the clause at 52.204-2:
[FR Doc. 2019-14379 Filed 7-11-19; 8:45 am]