Federal Acquisition Regulation: Requirements for DD Form 254, Contract Security Classification Specification, 40061-40064 [2020-12762]

Download as PDF Federal Register / Vol. 85, No. 128 / Thursday, July 2, 2020 / Rules and Regulations Item V—Orders Issued Via Fax or Electronic Commerce (FAR Case 2018– 022) This final rule amends a FAR clause to permit the issuance of task or delivery orders via facsimile or electronic commerce and clarify when an order is considered ‘‘issued’’ when using these methods. As a result, contracting officers will no longer need to include supplemental ordering language in the contract when anticipating the use of fax or electronic commerce to issue task or delivery orders. The authority to issue orders orally must still be separately authorized in the contract. A common understanding of when a task or delivery order is considered issued, in such situations, will be applied Governmentwide. Item VI—Technical Amendments William F. Clark, Director, Office of Government-wide Acquisition Policy, Office of Acquisition Policy, Office of Government-wide Policy. Federal Acquisition Circular (FAC) 2020– 07 is issued under the authority of the Secretary of Defense, the Administrator of General Services, and the Administrator of National Aeronautics and Space Administration. Unless otherwise specified, all Federal Acquisition Regulation (FAR) and other directive material contained in FAC 2020–07 is effective July 2, 2020 except for Items I, III, IV and V, which are effective August 3, 2020, and item II, which is effective August 31, 2020. Kim Herrington, Acting Principal Director, Defense Pricing and Contracting, Department of Defense. Jeffrey A. Koses, Senior Procurement Executive/Deputy CAO, Office of Acquisition Policy, U.S. General Services Administration. William G. Roets, II, Acting Assistant Administrator, Office of Procurement, National Aeronautics and Space Administration. khammond on DSKJM1Z7X2PROD with RULES3 BILLING CODE 6820–EP–P VerDate Sep<11>2014 21:45 Jul 01, 2020 Jkt 250001 GENERAL SERVICES ADMINISTRATION NATIONAL AERONAUTICS AND SPACE ADMINISTRATION 48 CFR Parts 1, 2, 4, 52, and 53 [FAC 2020–07; FAR Case 2015–002; Item I; Docket No. FAR–2015–0002; Sequence No. 1] RIN 9000–AN40 Federal Acquisition Regulation: Requirements for DD Form 254, Contract Security Classification Specification Department of Defense (DoD), General Services Administration (GSA), and National Aeronautics and Space Administration (NASA). ACTION: Final rule. AGENCY: DoD, GSA, and NASA are issuing a final rule amending the Federal Acquisition Regulation (FAR) to require electronic submission of the DD Form 254, Contract Security Classification Specification. DATES: Effective: August 3, 2020. FOR FURTHER INFORMATION CONTACT: Mr. Curtis E. Glover, Sr., Procurement Analyst, at 202–501–1448 or curtis.glover@gsa.gov for clarification of content. For information pertaining to status or publication schedules, contact the Regulatory Secretariat Division at 202–501–4755. Please cite FAR Case 2015–002. SUPPLEMENTARY INFORMATION: SUMMARY: Editorial changes are made at FAR 5.205, 9.109–4, 27.405–3, 52.209–13, and 52.212–5. [FR Doc. 2020–12761 Filed 7–1–20; 8:45 am] DEPARTMENT OF DEFENSE I. Background DoD, GSA, and NASA published a proposed rule in the Federal Register at 84 FR 33201 on July 12, 2019, proposing to amend the FAR to update and clarify the requirements for using the DD Form 254, Contract Security Classification Specification. This rule amends the FAR, in part, to provide procedures for use of the DD Form 254 and the requirement to use the Procurement Integrated Enterprise Environment (PIEE), to— • Streamline the submission process for the existing DD Form 254 and enable businesses to submit an electronic form once, instead of repeated paper submissions; • Require use of the DD Form 254 by nondefense agencies that have industrial security services agreements with DoD, and DoD components, to specify the security classification for a contract involving access to information classified as ‘‘Confidential,’’ ‘‘Secret,’’ or ‘‘Top Secret;’’ PO 00000 Frm 00003 Fmt 4701 Sfmt 4700 40061 • Require agency preparation of the DD Form 254 using the National Industrial Security Program Contracts Classification System module of the PIEE unless a nondefense agency has an existing DD Form 254 information system. Five respondents submitted comments on the proposed rule. II. Discussion and Analysis The Civilian Agency Acquisition Council and the Defense Acquisition Regulations Council (the Councils) reviewed the public comments in the development of the final rule. A discussion of the comments is provided as follows: A. Summary of Significant Changes There were no changes from the proposed rule as a result of the public comments received. There were minor editorial changes made to the proposed rule, see Section C below. B. Analysis of Public Comments 1. Commercial and Government Entity (CAGE) Code Reporting Comment: Two respondents expressed concern regarding the use of ‘‘Unique CAGE code’’; stating that in some instances a facility will have multiple locations with the same CAGE codes. Clarification of the term ‘‘unique’’ CAGE code was requested. Response: In accordance with the National Industrial Security Program Operating Manual (NISPOM) DoD 5220.22–M and FAR 52.204–16(g), each contractor and subcontractor location of performance listed on a DD Form 254 is required to have a unique CAGE code; and registration in the System for Award Management (SAM) is not required for contractor and subcontractor performance locations solely for the purposes of the DD Form 254. FAR 52.204–16, Commercial and Government Entity (CAGE) Code Reporting, as prescribed at FAR 4.1804(a), is amended to add paragraph (g) to require subcontractors requiring access to classified information under a contract to be identified with a CAGE code on the DD Form 254. Contractors shall ensure that a subcontractor requiring access to classified information provide its CAGE code with its name and location address or otherwise include it prominently in the proposal. In addition, each location of subcontractor performance must be listed on the DD Form 254 and is required to reflect a corresponding unique CAGE code for each listed location unless the work is being performed at a Government facility, in E:\FR\FM\02JYR3.SGM 02JYR3 40062 Federal Register / Vol. 85, No. 128 / Thursday, July 2, 2020 / Rules and Regulations which case the agency location code shall be used. The CAGE code must be for that name and location address. The CAGE code is required prior to award. Each listed location must have a unique CAGE code classifying only a single location. Comment: Two respondents opposed the removal of the current CAGE code requirement and stressed the continued need to not increase risk of sharing classified information with an uncleared facility or one where the clearance is no longer active or authorized. Response: The rule does not decrease the security professional’s ability to verify security clearance and safeguarding levels as directed by NISPOM via the National Industrial Security System (NISS). The rule will require electronic submission of the DD Form 254, Contract Security Classification Specification. 2. DD Form 254 Comment: Two respondents recommended submission of the DD Form 254 by company name with an ‘‘option’’ to file by CAGE code and if possible link the form to the website for storage and potential reuse to avoid uploading as part of an application ‘‘process’’ via the contractor’s tools and processes for DD Form 254 submission. Response: The intent of the rule is for use of the DD Form 254 for each specific contractual requirement requiring access to classified information. While the NISS website does not currently link to the DD Form 254 repository, Defense Counterintelligence and Security Agency will evaluate that capability during future assessment of requirements. khammond on DSKJM1Z7X2PROD with RULES3 3. Support for the Rule Comment: Two respondents acknowledged that streamlining the DD Form 254 for electronic submission via the National Industrial Security Program (NISP) Contracts Classification System is beneficial as well as clarification of the SAM requirements. Response: The Government acknowledges the benefits with establishment of the rule to provide streamlined submission process procedures for use of the DD Form 254 through the PIEE, to enable businesses to submit an electronic form once, instead of repeated paper submissions. 4. Paperwork Reduction Act Applicability Comment: One respondent conveyed concerns regarding the Paperwork Reduction Act burdens associated with the use of DD Form 254. VerDate Sep<11>2014 21:45 Jul 01, 2020 Jkt 250001 Response: The Paperwork Reduction Act (44 U.S.C. chapter 35) applies; however, the proposed changes to the FAR do not impose additional information collection requirements to the paperwork burden previously approved under the Office of Management and Budget (OMB) Control Number 0704–0567, entitled ‘‘Department of Defense Contract Security Classification Specification’’. 5. Out of Scope Comment: One respondent commented on a variety of topics unrelated to the rule. Response: Comments are out of scope. C. Other Changes There were minor administrative revisions to the format of the provision FAR 52.204–16, Commercial and Government Entity Code Reporting, and the clause FAR 52.204–18, Commercial and Government Entity Code Maintenance, including deleting use of the alternates at FAR 52.204–16(g) and FAR 52.204–18(f), incorporating the paragraphs at FAR 52.204–16(g) and FAR 52.204–18(f) into the base clause for clarity. Additionally, there were minor clarifying edits to the FAR text at FAR 4.402(d)(1) and (2), FAR 4.403(c)(1), and 52.204–16(b) and (g). As a result of conforming changes, revisions to FAR 4.1804 will no longer be required. III. Applicability to Contracts at or Below the Simplified Acquisition Threshold (SAT) and for Commercial Items, Including Commercially Available Off-the-Shelf (COTS) Items This rule does not create any new provisions or clauses, nor does it change the applicability of any existing provisions or clauses included in solicitations and contracts valued at or below the SAT, or for commercial items, including COTS items. IV. Executive Orders 12866 and 13563 E.O.s 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). E.O. 13563 emphasizes the importance of quantifying both costs and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility. This is not a significant regulatory action and, therefore, was not subject to review under section 6(b) of E.O. 12866, Regulatory Planning and Review, dated September 30, 1993. This PO 00000 Frm 00004 Fmt 4701 Sfmt 4700 rule is not a major rule under 5 U.S.C. 804. V. Executive Order 13771 This rule is not subject to E.O. 13771, Reducing Regulation and Controlling Regulatory Costs, because this rule is not a significant regulatory action under E.O. 12866. VI. Regulatory Flexibility Act DoD, GSA, and NASA have prepared a Final Regulatory Flexibility Analysis (FRFA) consistent with the Regulatory Flexibility Act, 5 U.S.C. 601, et seq. The FRFA is summarized as follows: This final rule is to revise the FAR to update and clarify the requirements for using the DD Form 254, Contract Security Classification Specification. The Government uses the DD Form 254 to convey security requirements to contractors when contract performance requires access to classified information. Prime contractors also use the DD Form 254 to convey security requirements to subcontractors that require access to classified information to perform on a subcontract. Subcontractors may also use the DD Form 254 if access to classified information is required to convey security requirements to additional subcontractors. There were no significant issues raised by the public comments in response to the initial regulatory flexibility analysis. The final rule will apply to small businesses awarded contracts or subcontracts by Executive agencies covered by the National Industrial Security Program that require access to classified information. Currently, the Defense Security Service monitors approximately 13,500 contractor facilities that are cleared for access to classified information. Approximately 9,000 facilities are considered less-complex, which includes small businesses and smaller security operations. Subject matter experts estimate that 5,400 (60 percent) of the 9,000 less-complex facilities are small businesses. The final rule does not impose any Paperwork Reduction Act reporting, recordkeeping, or other compliance requirements on any small entities. The rule does not impose any new reporting, recordkeeping or other compliance requirements. The rule does not duplicate, overlap, or conflict with any other Federal rules. DoD, GSA, and NASA were unable to identify any alternatives to the rule which would reduce the impact on small entities and still meet the requirements of the rule. Interested parties may obtain a copy of the FRFA from the Regulatory Secretariat Division. The Regulatory Secretariat Division has submitted a copy of the FRFA to the Chief Counsel for Advocacy of the Small Business Administration. VII. Paperwork Reduction Act The Paperwork Reduction Act (44 U.S.C. chapter 35) applies; however, the changes to the FAR do not impose E:\FR\FM\02JYR3.SGM 02JYR3 Federal Register / Vol. 85, No. 128 / Thursday, July 2, 2020 / Rules and Regulations additional information collection requirements to the paperwork burden previously approved under the Office of Management and Budget (OMB) Control Number 0704–0567, entitled ‘‘Department of Defense Contract Security Classification Specification’’. The rule addresses use of CAGE codes on the DD Form 254, however, it does not impact information collection requirements concerning the CAGE code, OMB Control Number 9000–0185, Commercial and Government Entity Code. List of Subjects in 48 CFR Parts 1, 2, 4, 52, and 53 Government procurement. William F. Clark, Director, Office of Government-wide Acquisition Policy, Office of Acquisition Policy, Office of Government-wide Policy. Therefore, DoD, GSA, and NASA amend 48 CFR parts 1, 2, 4, 52, and 53 as set forth below: ■ 1. The authority citation for 48 CFR parts 1, 2, 4, 52, and 53 continues to read as follows: Authority: 40 U.S.C. 121(c); 10 U.S.C. chapter 137; and 51 U.S.C. 20113. PART 1—FEDERAL ACQUISITION REGULATIONS SYSTEM 2. In section 1.106 amend the table following by adding an entry for ‘‘DD Form 254’’ at the end of the table to read as follows: 1.106 OMB approval under the Paperwork Reduction Act. * * * DD Form 254 ........................ OMB control No. * * 0706–0567 PART 2—DEFINITIONS OF WORDS AND TERMS 3. In section 2.101, amend paragraph (b) by adding in alphabetical order the defined term ‘‘Commercial and Government Entity (CAGE) code’’ to read as follows: ■ 2.101 Definitions. khammond on DSKJM1Z7X2PROD with RULES3 * * * * * Commercial and Government Entity (CAGE) code means— (1) An identifier assigned to entities located in the United States or its outlying areas by the Defense Logistics Agency (DLA) Commercial and Government Entity (CAGE) Branch to identify a commercial or government entity by unique location; or VerDate Sep<11>2014 21:45 Jul 01, 2020 Jkt 250001 PART 4—ADMINISTRATIVE AND INFORMATION MATTERS 4. Amend section 4.402 by— a. Removing from paragraph (b) introductory text ‘‘and the Director of Central Intelligence,’’ and adding ‘‘the Director of National Intelligence, and the Secretary of Homeland Security’’ in its place; ■ b. Removing from paragraph (b)(2) ‘‘Industrial Security Regulation (DOD 5220.22–R).’’ and adding ‘‘DoD Manual 5220.22, Volume 2, ‘‘National Industrial Security Program: Industrial Security Procedures for Government Activities.’’’’ in its place; and ■ c. Redesignating paragraph (d) as (e), and adding a new paragraph (d) to read as follows: ■ ■ 4.402 ■ FAR segment (2) An identifier assigned by a member of the North Atlantic Treaty Organization (NATO) or by the NATO Support and Procurement Agency (NSPA) to entities located outside the United States and its outlying areas that the DLA Commercial and Government Entity (CAGE) Branch records and maintains in the CAGE master file. This type of code is known as a NATO CAGE (NCAGE) code. * * * * * General. * * * * * (d) Nondefense agencies that have industrial security services agreements with DoD, and DoD components, shall use the DD Form 254, Contract Security Classification Specification, to provide security classification guidance to U.S. contractors, and subcontractors as applicable, requiring access to information classified as ‘‘Confidential’’, ‘‘Secret’’, or ‘‘Top Secret’’. (1) Provided that the data submittal is unclassified, the DD Form 254 shall be completed electronically in the NISP Contract Classification System (NCCS), which is accessible via the Procurement Integrated Enterprise Environment (PIEE) at https://wawf.eb.mil. Nondefense agencies with an existing DD Form 254 information system may use that system. (2)(i) A contractor, or subcontractor (if applicable), requiring access to classified information under a contract shall be identified with a Commercial and Government Entity (CAGE) code on the DD Form 254 (see subpart 4.18 for information on obtaining and validating CAGE codes). (ii) Each location of contractor or subcontractor performance listed on the DD Form 254 is required to reflect a corresponding unique CAGE code for each listed location unless the work is PO 00000 Frm 00005 Fmt 4701 Sfmt 4700 40063 being performed at a Government facility, in which case the agency location code shall be used. Each subcontractor location requiring access to classified information must be listed on the DD Form 254. (iii) Contractor and subcontractor performance locations listed on the DD Form 254 are not required to be separately registered in the System for Award Management (SAM) solely for the purposes of a DD Form 254 (see subpart 4.11 for information on registering in SAM). * * * * * ■ 5. Amend section 4.403 by removing from paragraph (c) introductory text ‘‘contract as follows’’ and adding ‘‘contract as identified in the requirement documentation as follows’’ in its place, and revising paragraph (c)(1) to read as follows: 4.403 Responsibilities of contracting officers. * * * * * (c) * * * (1) Nondefense agencies that have industrial security services agreements with DoD, and DoD components, shall use the Contract Security Classification Specification, DD Form 254. The contracting officer, or authorized agency representative, is the approving official for the DD Form 254 associated with the prime contract and shall ensure the DD Form 254 is properly prepared, distributed by and coordinated with requirements and security personnel in accordance with agency procedures, see 4.402(d)(1). * * * * * 4.1801 [Amended] 6. Amend section 4.1801 by removing the defined term ‘‘Commercial and Government Entity (CAGE) code’’. ■ PART 52—SOLICITATION PROVISIONS AND CONTRACT CLAUSES 7. Amend section 52.204–16 by— a. Revising the date of the provision; b. Removing from the end of paragraph (a)(1) ‘‘entity; or’’ and adding ‘‘entity by unique location; or’’ in its place; ■ c. Revising paragraph (b); ■ d. In paragraph (c)(2) removing the word ‘‘offeror’’ and adding ‘‘Offeror’’ in its places; ■ e. Revising paragraph (e); and ■ f. Adding paragraph (g). The revisions and addition read as follows: ■ ■ ■ 52.204–16 Commercial and Government Entity Code Reporting. * E:\FR\FM\02JYR3.SGM * * 02JYR3 * * 40064 Federal Register / Vol. 85, No. 128 / Thursday, July 2, 2020 / Rules and Regulations Commercial and Government Entity Code Reporting (Aug 2020) contract for each location of contract, including subcontract, performance. * * * DEPARTMENT OF DEFENSE * * GENERAL SERVICES ADMINISTRATION * * * * (b) The Offeror shall provide its CAGE code with its offer with its name and location address or otherwise include it prominently in its proposal. The CAGE code must be for that name and location address. Insert the word ‘‘CAGE’’ before the number. The CAGE code is required prior to award. * * * * * (e) When a CAGE code is required for the immediate owner and/or the highest-level owner by Federal Acquisition Regulation (FAR) 52.204–17 or 52.212–3(p), the Offeror shall obtain the respective CAGE code from that entity to supply the CAGE code to the Government. * * * * * (g) If the solicitation includes FAR clause 52.204–2, Security Requirements, a subcontractor requiring access to classified information under a contract shall be identified with a CAGE code on the DD Form 254. The Contractor shall require a subcontractor requiring access to classified information to provide its CAGE code with its name and location address or otherwise include it prominently in the proposal. Each location of subcontractor performance listed on the DD Form 254 is required to reflect a corresponding unique CAGE code for each listed location unless the work is being performed at a Government facility, in which case the agency location code shall be used. The CAGE code must be for that name and location address. Insert the word ‘‘CAGE’’ before the number. The CAGE code is required prior to award. * * * (End of clause) 10. Amend section 52.204–20 by— ■ a. Revising the date of the provision; and ■ b. Removing from paragraph (a)(1) ‘‘entity; or’’ and adding ‘‘entity by unique location; or’’ in its place. The revision reads as follows: ■ 52.204–20 Predecessor of Offeror. * * * * * Predecessor of Offeror (Aug 2020) * * * * * PART 53—FORMS 11. Amend section 53.204–1 by revising the introductory text to read as follows: ■ 53.204–1 Safeguarding classified information within industry (DD Form 254, DD Form 441). Ownership or Control of Offeror (Aug 2020) * 53.300 ■ ■ ■ ■ 8. Amend section 52.204–17 by revising the title and the date of the provision and removing from paragraph (a)(1) ‘‘entity; or’’ and adding ‘‘entity by unique location; or’’ in its place. The revision reads as follows: ■ 52.204–17 Offeror. Ownership or Control of * * * * * * * * * 9. Amend section 52.204–18 by— a. Revising the date of the clause; b. Removing from paragraph (a)(1) ‘‘entity; or’’ and adding ‘‘entity by unique location; or’’ in its place; ■ c. Revising the first sentence of paragraph (b); and ■ d. Adding paragraph (f). The revisions and addition read as follows: [Amended] Commercial and Government Entity Code Maintenance (Aug 2020) 12. In section 53.300 amend the table in paragraph (b) in the table 53–2 by removing from Form DD 254 url, http:// www.dtic.mil/whs/directives/forms/ eforms/dd0254.pdf and adding https:// www.esd.whs.mil/Portals/54/ Documents/DD/forms/dd/dd0254.pdf; and removing from Form DD 441 url, http://www.dtic.mil/whs/directives/ forms/eforms/dd0441_2017.pdf and adding https://www.esd.whs.mil/ Portals/54/Documents/DD/forms/dd/ dd0441_2020.pdf in their places, respectively. * [FR Doc. 2020–12762 Filed 7–1–20; 8:45 am] 52.204–18 Commercial and Government Entity Code Maintenance. * * * * * * * * * (b) Contractors shall ensure that the CAGE code is maintained throughout the life of the VerDate Sep<11>2014 21:45 Jul 01, 2020 Jkt 250001 BILLING CODE 6820–EP–P PO 00000 Frm 00006 Fmt 4701 Sfmt 4700 NATIONAL AERONAUTICS AND SPACE ADMINISTRATION 48 CFR Parts 2, 3, 9, 13, 16, 22, 25, and 52 [FAC 2020–07; FAR Case 2018–004; Item II; Docket No. FAR–2018–0011; Sequence No. 1] RIN 9000–AN65 Federal Acquisition Regulation: Increased Micro-Purchase and Simplified Acquisition Thresholds Department of Defense (DoD), General Services Administration (GSA), and National Aeronautics and Space Administration (NASA). ACTION: Final rule. AGENCY: DoD, GSA, and NASA are issuing a final rule amending the Federal Acquisition Regulation (FAR) to implement a section of the National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2017 and several sections of the NDAA for FY 2018 that increase the micro-purchase threshold (MPT), increase the simplified acquisition threshold (SAT), and clarify certain procurement terms, as well as align some non-statutory thresholds with the MPT and SAT. DATES: Effective: August 31, 2020. FOR FURTHER INFORMATION CONTACT: Mr. Michael O. Jackson, Procurement Analyst, at 202–208–4949 or michaelo.jackson@gsa.gov for clarification of content. For information pertaining to status or publication schedules, contact the Regulatory Secretariat Division at 202–501–4755. Please cite FAC 2020–07, FAR Case 2018–004. SUPPLEMENTARY INFORMATION: SUMMARY: The following forms, which are prescribed by the Department of Defense, shall be used by DoD components and those nondefense agencies with which DoD has agreements to provide industrial security services for the National Industrial Security Program if contractor access to classified information is required, as specified in subpart 4.4 and the clause at 52.204–2: * * * * * (End of provision) khammond on DSKJM1Z7X2PROD with RULES3 * (f) If the contract includes Federal Acquisition Regulation clause 52.204–2, Security Requirements, the contractor shall ensure that subcontractors maintain their CAGE code(s) throughout the life of the contract. I. Background DoD, GSA, and NASA published a proposed rule on October 2, 2019, at 84 FR 52420, to implement section 217(b) of the NDAA for FY 2017 (Pub. L. 114– 328) and sections 805, 806, and 1702(a) of the NDAA for FY 2018 (Pub. L. 115– 91). Section 217(b) amends 41 U.S.C. 1902 to increase the MPT for acquisitions from institutions of higher education or related or affiliated nonprofit entities, or from nonprofit research organizations or independent research institutes, from $3,500 to $10,000, or a higher amount as determined appropriate by the head of the agency and consistent with clean E:\FR\FM\02JYR3.SGM 02JYR3

Agencies

[Federal Register Volume 85, Number 128 (Thursday, July 2, 2020)]
[Rules and Regulations]
[Pages 40061-40064]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2020-12762]


-----------------------------------------------------------------------

DEPARTMENT OF DEFENSE

GENERAL SERVICES ADMINISTRATION

NATIONAL AERONAUTICS AND SPACE ADMINISTRATION

48 CFR Parts 1, 2, 4, 52, and 53

[FAC 2020-07; FAR Case 2015-002; Item I; Docket No. FAR-2015-0002; 
Sequence No. 1]
RIN 9000-AN40


Federal Acquisition Regulation: Requirements for DD Form 254, 
Contract Security Classification Specification

AGENCY: Department of Defense (DoD), General Services Administration 
(GSA), and National Aeronautics and Space Administration (NASA).

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: DoD, GSA, and NASA are issuing a final rule amending the 
Federal Acquisition Regulation (FAR) to require electronic submission 
of the DD Form 254, Contract Security Classification Specification.

DATES: Effective: August 3, 2020.

FOR FURTHER INFORMATION CONTACT: Mr. Curtis E. Glover, Sr., Procurement 
Analyst, at 202-501-1448 or [email protected] for clarification of 
content. For information pertaining to status or publication schedules, 
contact the Regulatory Secretariat Division at 202-501-4755. Please 
cite FAR Case 2015-002.

SUPPLEMENTARY INFORMATION:

I. Background

    DoD, GSA, and NASA published a proposed rule in the Federal 
Register at 84 FR 33201 on July 12, 2019, proposing to amend the FAR to 
update and clarify the requirements for using the DD Form 254, Contract 
Security Classification Specification. This rule amends the FAR, in 
part, to provide procedures for use of the DD Form 254 and the 
requirement to use the Procurement Integrated Enterprise Environment 
(PIEE), to--
     Streamline the submission process for the existing DD Form 
254 and enable businesses to submit an electronic form once, instead of 
repeated paper submissions;
     Require use of the DD Form 254 by nondefense agencies that 
have industrial security services agreements with DoD, and DoD 
components, to specify the security classification for a contract 
involving access to information classified as ``Confidential,'' 
``Secret,'' or ``Top Secret;''
     Require agency preparation of the DD Form 254 using the 
National Industrial Security Program Contracts Classification System 
module of the PIEE unless a nondefense agency has an existing DD Form 
254 information system.
    Five respondents submitted comments on the proposed rule.

II. Discussion and Analysis

    The Civilian Agency Acquisition Council and the Defense Acquisition 
Regulations Council (the Councils) reviewed the public comments in the 
development of the final rule. A discussion of the comments is provided 
as follows:

A. Summary of Significant Changes

    There were no changes from the proposed rule as a result of the 
public comments received. There were minor editorial changes made to 
the proposed rule, see Section C below.

B. Analysis of Public Comments

1. Commercial and Government Entity (CAGE) Code Reporting
    Comment: Two respondents expressed concern regarding the use of 
``Unique CAGE code''; stating that in some instances a facility will 
have multiple locations with the same CAGE codes. Clarification of the 
term ``unique'' CAGE code was requested.
    Response: In accordance with the National Industrial Security 
Program Operating Manual (NISPOM) DoD 5220.22-M and FAR 52.204-16(g), 
each contractor and subcontractor location of performance listed on a 
DD Form 254 is required to have a unique CAGE code; and registration in 
the System for Award Management (SAM) is not required for contractor 
and subcontractor performance locations solely for the purposes of the 
DD Form 254. FAR 52.204-16, Commercial and Government Entity (CAGE) 
Code Reporting, as prescribed at FAR 4.1804(a), is amended to add 
paragraph (g) to require subcontractors requiring access to classified 
information under a contract to be identified with a CAGE code on the 
DD Form 254. Contractors shall ensure that a subcontractor requiring 
access to classified information provide its CAGE code with its name 
and location address or otherwise include it prominently in the 
proposal. In addition, each location of subcontractor performance must 
be listed on the DD Form 254 and is required to reflect a corresponding 
unique CAGE code for each listed location unless the work is being 
performed at a Government facility, in

[[Page 40062]]

which case the agency location code shall be used. The CAGE code must 
be for that name and location address. The CAGE code is required prior 
to award. Each listed location must have a unique CAGE code classifying 
only a single location.
    Comment: Two respondents opposed the removal of the current CAGE 
code requirement and stressed the continued need to not increase risk 
of sharing classified information with an uncleared facility or one 
where the clearance is no longer active or authorized.
    Response: The rule does not decrease the security professional's 
ability to verify security clearance and safeguarding levels as 
directed by NISPOM via the National Industrial Security System (NISS). 
The rule will require electronic submission of the DD Form 254, 
Contract Security Classification Specification.
2. DD Form 254
    Comment: Two respondents recommended submission of the DD Form 254 
by company name with an ``option'' to file by CAGE code and if possible 
link the form to the website for storage and potential reuse to avoid 
uploading as part of an application ``process'' via the contractor's 
tools and processes for DD Form 254 submission.
    Response: The intent of the rule is for use of the DD Form 254 for 
each specific contractual requirement requiring access to classified 
information. While the NISS website does not currently link to the DD 
Form 254 repository, Defense Counterintelligence and Security Agency 
will evaluate that capability during future assessment of requirements.
3. Support for the Rule
    Comment: Two respondents acknowledged that streamlining the DD Form 
254 for electronic submission via the National Industrial Security 
Program (NISP) Contracts Classification System is beneficial as well as 
clarification of the SAM requirements.
    Response: The Government acknowledges the benefits with 
establishment of the rule to provide streamlined submission process 
procedures for use of the DD Form 254 through the PIEE, to enable 
businesses to submit an electronic form once, instead of repeated paper 
submissions.
4. Paperwork Reduction Act Applicability
    Comment: One respondent conveyed concerns regarding the Paperwork 
Reduction Act burdens associated with the use of DD Form 254.
    Response: The Paperwork Reduction Act (44 U.S.C. chapter 35) 
applies; however, the proposed changes to the FAR do not impose 
additional information collection requirements to the paperwork burden 
previously approved under the Office of Management and Budget (OMB) 
Control Number 0704-0567, entitled ``Department of Defense Contract 
Security Classification Specification''.
5. Out of Scope
    Comment: One respondent commented on a variety of topics unrelated 
to the rule.
    Response: Comments are out of scope.

C. Other Changes

    There were minor administrative revisions to the format of the 
provision FAR 52.204-16, Commercial and Government Entity Code 
Reporting, and the clause FAR 52.204-18, Commercial and Government 
Entity Code Maintenance, including deleting use of the alternates at 
FAR 52.204-16(g) and FAR 52.204-18(f), incorporating the paragraphs at 
FAR 52.204-16(g) and FAR 52.204-18(f) into the base clause for clarity. 
Additionally, there were minor clarifying edits to the FAR text at FAR 
4.402(d)(1) and (2), FAR 4.403(c)(1), and 52.204-16(b) and (g). As a 
result of conforming changes, revisions to FAR 4.1804 will no longer be 
required.

III. Applicability to Contracts at or Below the Simplified Acquisition 
Threshold (SAT) and for Commercial Items, Including Commercially 
Available Off-the-Shelf (COTS) Items

    This rule does not create any new provisions or clauses, nor does 
it change the applicability of any existing provisions or clauses 
included in solicitations and contracts valued at or below the SAT, or 
for commercial items, including COTS items.

IV. Executive Orders 12866 and 13563

    E.O.s 12866 and 13563 direct agencies to assess all costs and 
benefits of available regulatory alternatives and, if regulation is 
necessary, to select regulatory approaches that maximize net benefits 
(including potential economic, environmental, public health and safety 
effects, distributive impacts, and equity). E.O. 13563 emphasizes the 
importance of quantifying both costs and benefits, of reducing costs, 
of harmonizing rules, and of promoting flexibility. This is not a 
significant regulatory action and, therefore, was not subject to review 
under section 6(b) of E.O. 12866, Regulatory Planning and Review, dated 
September 30, 1993. This rule is not a major rule under 5 U.S.C. 804.

V. Executive Order 13771

    This rule is not subject to E.O. 13771, Reducing Regulation and 
Controlling Regulatory Costs, because this rule is not a significant 
regulatory action under E.O. 12866.

VI. Regulatory Flexibility Act

    DoD, GSA, and NASA have prepared a Final Regulatory Flexibility 
Analysis (FRFA) consistent with the Regulatory Flexibility Act, 5 
U.S.C. 601, et seq. The FRFA is summarized as follows:

    This final rule is to revise the FAR to update and clarify the 
requirements for using the DD Form 254, Contract Security 
Classification Specification. The Government uses the DD Form 254 to 
convey security requirements to contractors when contract 
performance requires access to classified information. Prime 
contractors also use the DD Form 254 to convey security requirements 
to subcontractors that require access to classified information to 
perform on a subcontract. Subcontractors may also use the DD Form 
254 if access to classified information is required to convey 
security requirements to additional subcontractors.
    There were no significant issues raised by the public comments 
in response to the initial regulatory flexibility analysis.
    The final rule will apply to small businesses awarded contracts 
or subcontracts by Executive agencies covered by the National 
Industrial Security Program that require access to classified 
information. Currently, the Defense Security Service monitors 
approximately 13,500 contractor facilities that are cleared for 
access to classified information. Approximately 9,000 facilities are 
considered less-complex, which includes small businesses and smaller 
security operations. Subject matter experts estimate that 5,400 (60 
percent) of the 9,000 less-complex facilities are small businesses.
    The final rule does not impose any Paperwork Reduction Act 
reporting, recordkeeping, or other compliance requirements on any 
small entities. The rule does not impose any new reporting, 
recordkeeping or other compliance requirements. The rule does not 
duplicate, overlap, or conflict with any other Federal rules.
    DoD, GSA, and NASA were unable to identify any alternatives to 
the rule which would reduce the impact on small entities and still 
meet the requirements of the rule.

Interested parties may obtain a copy of the FRFA from the Regulatory 
Secretariat Division. The Regulatory Secretariat Division has submitted 
a copy of the FRFA to the Chief Counsel for Advocacy of the Small 
Business Administration.

VII. Paperwork Reduction Act

    The Paperwork Reduction Act (44 U.S.C. chapter 35) applies; 
however, the changes to the FAR do not impose

[[Page 40063]]

additional information collection requirements to the paperwork burden 
previously approved under the Office of Management and Budget (OMB) 
Control Number 0704-0567, entitled ``Department of Defense Contract 
Security Classification Specification''.
    The rule addresses use of CAGE codes on the DD Form 254, however, 
it does not impact information collection requirements concerning the 
CAGE code, OMB Control Number 9000-0185, Commercial and Government 
Entity Code.

List of Subjects in 48 CFR Parts 1, 2, 4, 52, and 53

    Government procurement.

William F. Clark,
Director, Office of Government-wide Acquisition Policy, Office of 
Acquisition Policy, Office of Government-wide Policy.

    Therefore, DoD, GSA, and NASA amend 48 CFR parts 1, 2, 4, 52, and 
53 as set forth below:

0
1. The authority citation for 48 CFR parts 1, 2, 4, 52, and 53 
continues to read as follows:

    Authority:  40 U.S.C. 121(c); 10 U.S.C. chapter 137; and 51 
U.S.C. 20113.

PART 1--FEDERAL ACQUISITION REGULATIONS SYSTEM

0
2. In section 1.106 amend the table following by adding an entry for 
``DD Form 254'' at the end of the table to read as follows:


1.106  OMB approval under the Paperwork Reduction Act.

------------------------------------------------------------------------
                                                           OMB  control
                       FAR segment                              No.
------------------------------------------------------------------------
 
                                * * * * *
DD Form 254.............................................       0706-0567
------------------------------------------------------------------------

PART 2--DEFINITIONS OF WORDS AND TERMS

0
3. In section 2.101, amend paragraph (b) by adding in alphabetical 
order the defined term ``Commercial and Government Entity (CAGE) code'' 
to read as follows:


2.101  Definitions.

* * * * *
    Commercial and Government Entity (CAGE) code means--
    (1) An identifier assigned to entities located in the United States 
or its outlying areas by the Defense Logistics Agency (DLA) Commercial 
and Government Entity (CAGE) Branch to identify a commercial or 
government entity by unique location; or
    (2) An identifier assigned by a member of the North Atlantic Treaty 
Organization (NATO) or by the NATO Support and Procurement Agency 
(NSPA) to entities located outside the United States and its outlying 
areas that the DLA Commercial and Government Entity (CAGE) Branch 
records and maintains in the CAGE master file. This type of code is 
known as a NATO CAGE (NCAGE) code.
* * * * *

PART 4--ADMINISTRATIVE AND INFORMATION MATTERS

0
4. Amend section 4.402 by--
0
a. Removing from paragraph (b) introductory text ``and the Director of 
Central Intelligence,'' and adding ``the Director of National 
Intelligence, and the Secretary of Homeland Security'' in its place;
0
b. Removing from paragraph (b)(2) ``Industrial Security Regulation (DOD 
5220.22-R).'' and adding ``DoD Manual 5220.22, Volume 2, ``National 
Industrial Security Program: Industrial Security Procedures for 
Government Activities.'''' in its place; and
0
c. Redesignating paragraph (d) as (e), and adding a new paragraph (d) 
to read as follows:


4.402  General.

* * * * *
    (d) Nondefense agencies that have industrial security services 
agreements with DoD, and DoD components, shall use the DD Form 254, 
Contract Security Classification Specification, to provide security 
classification guidance to U.S. contractors, and subcontractors as 
applicable, requiring access to information classified as 
``Confidential'', ``Secret'', or ``Top Secret''.
    (1) Provided that the data submittal is unclassified, the DD Form 
254 shall be completed electronically in the NISP Contract 
Classification System (NCCS), which is accessible via the Procurement 
Integrated Enterprise Environment (PIEE) at https://wawf.eb.mil. 
Nondefense agencies with an existing DD Form 254 information system may 
use that system.
    (2)(i) A contractor, or subcontractor (if applicable), requiring 
access to classified information under a contract shall be identified 
with a Commercial and Government Entity (CAGE) code on the DD Form 254 
(see subpart 4.18 for information on obtaining and validating CAGE 
codes).
    (ii) Each location of contractor or subcontractor performance 
listed on the DD Form 254 is required to reflect a corresponding unique 
CAGE code for each listed location unless the work is being performed 
at a Government facility, in which case the agency location code shall 
be used. Each subcontractor location requiring access to classified 
information must be listed on the DD Form 254.
    (iii) Contractor and subcontractor performance locations listed on 
the DD Form 254 are not required to be separately registered in the 
System for Award Management (SAM) solely for the purposes of a DD Form 
254 (see subpart 4.11 for information on registering in SAM).
* * * * *

0
5. Amend section 4.403 by removing from paragraph (c) introductory text 
``contract as follows'' and adding ``contract as identified in the 
requirement documentation as follows'' in its place, and revising 
paragraph (c)(1) to read as follows:


4.403  Responsibilities of contracting officers.

* * * * *
    (c) * * *
    (1) Nondefense agencies that have industrial security services 
agreements with DoD, and DoD components, shall use the Contract 
Security Classification Specification, DD Form 254. The contracting 
officer, or authorized agency representative, is the approving official 
for the DD Form 254 associated with the prime contract and shall ensure 
the DD Form 254 is properly prepared, distributed by and coordinated 
with requirements and security personnel in accordance with agency 
procedures, see 4.402(d)(1).
* * * * *


4.1801  [Amended]

0
6. Amend section 4.1801 by removing the defined term ``Commercial and 
Government Entity (CAGE) code''.

PART 52--SOLICITATION PROVISIONS AND CONTRACT CLAUSES

0
7. Amend section 52.204-16 by--
0
a. Revising the date of the provision;
0
b. Removing from the end of paragraph (a)(1) ``entity; or'' and adding 
``entity by unique location; or'' in its place;
0
c. Revising paragraph (b);
0
d. In paragraph (c)(2) removing the word ``offeror'' and adding 
``Offeror'' in its places;
0
e. Revising paragraph (e); and
0
f. Adding paragraph (g).
    The revisions and addition read as follows:


52.204-16  Commercial and Government Entity Code Reporting.

* * * * *

[[Page 40064]]

Commercial and Government Entity Code Reporting (Aug 2020)

* * * * *
    (b) The Offeror shall provide its CAGE code with its offer with 
its name and location address or otherwise include it prominently in 
its proposal. The CAGE code must be for that name and location 
address. Insert the word ``CAGE'' before the number. The CAGE code 
is required prior to award.
* * * * *
    (e) When a CAGE code is required for the immediate owner and/or 
the highest-level owner by Federal Acquisition Regulation (FAR) 
52.204-17 or 52.212-3(p), the Offeror shall obtain the respective 
CAGE code from that entity to supply the CAGE code to the 
Government.
* * * * *
    (g) If the solicitation includes FAR clause 52.204-2, Security 
Requirements, a subcontractor requiring access to classified 
information under a contract shall be identified with a CAGE code on 
the DD Form 254. The Contractor shall require a subcontractor 
requiring access to classified information to provide its CAGE code 
with its name and location address or otherwise include it 
prominently in the proposal. Each location of subcontractor 
performance listed on the DD Form 254 is required to reflect a 
corresponding unique CAGE code for each listed location unless the 
work is being performed at a Government facility, in which case the 
agency location code shall be used. The CAGE code must be for that 
name and location address. Insert the word ``CAGE'' before the 
number. The CAGE code is required prior to award.
(End of provision)

0
8. Amend section 52.204-17 by revising the title and the date of the 
provision and removing from paragraph (a)(1) ``entity; or'' and adding 
``entity by unique location; or'' in its place.
    The revision reads as follows:


52.204-17  Ownership or Control of Offeror.

* * * * *

Ownership or Control of Offeror (Aug 2020)

* * * * *

0
9. Amend section 52.204-18 by--
0
a. Revising the date of the clause;
0
b. Removing from paragraph (a)(1) ``entity; or'' and adding ``entity by 
unique location; or'' in its place;
0
c. Revising the first sentence of paragraph (b); and
0
d. Adding paragraph (f).
    The revisions and addition read as follows:


52.204-18  Commercial and Government Entity Code Maintenance.

* * * * *

Commercial and Government Entity Code Maintenance (Aug 2020)

* * * * *
    (b) Contractors shall ensure that the CAGE code is maintained 
throughout the life of the contract for each location of contract, 
including subcontract, performance. * * *
* * * * *
    (f) If the contract includes Federal Acquisition Regulation 
clause 52.204-2, Security Requirements, the contractor shall ensure 
that subcontractors maintain their CAGE code(s) throughout the life 
of the contract.
(End of clause)

0
10. Amend section 52.204-20 by--
0
a. Revising the date of the provision; and
0
b. Removing from paragraph (a)(1) ``entity; or'' and adding ``entity by 
unique location; or'' in its place.
    The revision reads as follows:


52.204-20  Predecessor of Offeror.

* * * * *

Predecessor of Offeror (Aug 2020)

* * * * *

PART 53--FORMS

0
11. Amend section 53.204-1 by revising the introductory text to read as 
follows:


53.204-1  Safeguarding classified information within industry (DD Form 
254, DD Form 441).

    The following forms, which are prescribed by the Department of 
Defense, shall be used by DoD components and those nondefense agencies 
with which DoD has agreements to provide industrial security services 
for the National Industrial Security Program if contractor access to 
classified information is required, as specified in subpart 4.4 and the 
clause at 52.204-2:
* * * * *


53.300  [Amended]

0
12. In section 53.300 amend the table in paragraph (b) in the table 53-
2 by removing from Form DD 254 url, http://www.dtic.mil/whs/directives/forms/eforms/dd0254.pdf and adding https://www.esd.whs.mil/Portals/54/Documents/DD/forms/dd/dd0254.pdf; and removing from Form DD 441 url, 
http://www.dtic.mil/whs/directives/forms/eforms/dd0441_2017.pdf and 
adding https://www.esd.whs.mil/Portals/54/Documents/DD/forms/dd/dd0441_2020.pdf in their places, respectively.

[FR Doc. 2020-12762 Filed 7-1-20; 8:45 am]
BILLING CODE 6820-EP-P