UNCLASSIFIED

Department of Defense
Contract Security Classification Specification
DD Form 254 · APR 2018 · OMB 0704-0567 (Exp. Aug 31, 2028) · Tool · DD254 Interactive

The requirements of the National Industrial
Security Program (NISP) apply to all security
aspects of this effort involving classified information.
This tool supports UNCLASSIFIED or CUI entries only. Never enter classified content or upload classified attachments. A classified DD Form 254 must be prepared on an approved system.
Expand the ▶ Instructions panels in each field for detailed conditional rules · Right panel shows live validation
1aFCL Level Required *
Instructions for Item 1a

Insert the highest classification level contractor employees need access to in order to perform this contract.

Only three values are valid: Confidential, Secret, or Top Secret. Do NOT cite special categories (Restricted Data, COMSEC, SCI, SAP) here.
Contractor must hold an FCL at least as high as the level entered here. If they don't, the GCA/prime must sponsor an FCL or FCL upgrade to DCSA.
Do NOT use DD Form 254 for foreign contractors, foreign governments, or NATO activities. Issue a Security Aspects Letter instead.

Verify existing FCL via NISS/NCAISS at dcsa.mil.

Controlling clause: FAR 52.204-2 Security Requirements — required in every contract where contractor must access classified information.

Verify contractor FCL at dcsa.mil via NISS/NCAISS before entering
1bSafeguarding Level at Contractor Facility *
Instructions for Item 1b

Highest level of classified material the contractor must store at their own facility.

Cannot be HIGHER than Item 1a.
If Item 11a is checked (access elsewhere only) → enter None or N/A.
If Item 11b, 11c, or 11d is checked → must be completed at appropriate classification level.

Enter None if no classified material will be stored at contractor's site (access occurs elsewhere).

Do NOT cite special categories (COMSEC, SCI, SAP, RD).
⚠️ REQUIRED VIOLATION: Safeguarding level (1b) cannot exceed FCL level (1a).
⚠️ Item 11b/11c/11d is checked — Item 1b must be completed at the appropriate classification level (not None/N/A).
⚠️ Item 11a is checked — Item 1b should be "None" or "N/A" since no access occurs at contractor facility.
2This Specification Is For: *
Instructions for Item 2
Mark only ONE primary type (2a, 2b, or 2c) — but 2a AND 2b may both have entries when subcontracting (mark the X in 2b and fill both fields).
If 2b (subcontract) is filled → 2a must also be filled with the prime contract number.
If Item 11e is checked AND services don't apply to a specific contract (e.g., guard services across multiple contracts) → enter "Multiple Contracts" in 2a and explain in Item 13.
Any other contract-related numbers (GSA schedule, BOA, task orders) should be listed in Item 13 with descriptions.

2c Solicitation: When contract is awarded, a NEW DD Form 254 must be prepared with the contract number in 2a or 2b.

A separate DD Form 254 must be issued for EACH subcontract, even in a multi-tier chain.
GCA enters when issuing to prime. Prime enters when issuing to sub. Required if 2b is filled.
Not a box on the DD Form 254 — there is no Item 2 field for it. Entering a number writes “This is in support of effort …” at the top of Item 13, which is where the form instructions say these numbers belong. Clearing it removes that line.
When ticked, the exported Block 2a reads <prime contract number> | Task Order <number>. The field above keeps the bare contract number, so the 17-character check and the export filename are unaffected. The Item 13 reference line still appears.
⚠️ REQUIRED: If 2b (subcontract) is filled, 2a (prime contract number) must also be filled.
At award, a NEW DD Form 254 must replace this one with contract number in 2a or 2b.
3This Specification Is: *
Instructions for Item 3
Mark only ONE of 3a, 3b, or 3c.

3a Original: The date entered is the certifying official's signature date. This date never changes on subsequent revisions — it always shows the original issuance date.

3b Revised: Issue when there is a change to classification guidance, security requirements, or contractor location. Give each revision a sequential number.

Do NOT issue a revised DD Form 254 solely to exercise an option year — the original remains valid. Do NOT revise solely to update POC information.
Revised DD Forms 254 must be incorporated into the contract by modification.
Applies to 3b only: Conduct a review of classification requirements at least biennially (DD Form 254 Instructions, Item 3b(3)). This bullet appears under 3b (Revised) in the DoD form instructions — there is no equivalent biennial requirement under 3a (Original) or 3c (Final). The separate biennial obligation in DoDM 5220.32 Vol. 1, §6.3g falls on the GCA, not the contractor.

3c Final: Used for authorized continued security requirements after completion, including extended retention under 32 CFR 117.13(d)(5) and applicable SAP continuation under DoDM 5205.07 section 10.5. Coordinate the basis and disposition instructions with the GCA.

If 3c is checked → you MUST complete Item 5 AND enter the original date in 3a.
3a. Original
Original date (YYYYMMDD):
Date never changes on revisions or the Final.
3b. Revised
Numbered 1, 2, 3… in sequence. Keep the original date in 3a. Must be incorporated by contract modification.
3c. Final
Must complete Item 5 with retention dates Must enter original date in Item 3a For authorized post-contract retention or applicable program continuation
🔴 REQUIRED: 3c (Final) is selected — enter the original date in Item 3a and disposition guidance in Item 13. Complete Item 5 for authorized retention; coordinate SAP continuation with the GCA and PSM/PSO.
4Is This a Follow-On Contract? *
Instructions for Item 4

Mark YES if this is a new contract to the same contractor for the same items/services as a preceding contract. This authorizes transfer of classified material from the old contract.

If YES → enter preceding contract number AND note in Item 13 which classified material is authorized to transfer (either "all classified material" or a specific list).
🔴 REQUIRED: Note in Item 13 which classified material is authorized to transfer to this follow-on contract.
5Is This a Final DD Form 254? *
Instructions for Item 5

Mark YES for a documented post-contract retention request and its GCA-authorized period. The general two-year provision is conditional and applies to copies; SAP retention needs specific written GCA authorization.

If YES → enter the date of the contractor's formal retention request AND the GCA-authorized retention period.
If YES → Item 13 MUST contain final disposition instructions for all classified material under the contract.
If Item 3c is checked → this MUST be YES.

If this is not a Final DD Form 254 → mark NO.

🔴 REQUIRED: Item 13 must contain final disposition instructions for all classified material.
Contractor / Subcontractor Information
6Contractor *
Instructions for Item 6
Verify the contractor's FCL via NISS/NCAISS before completing — not all CAGE codes are cleared facilities.
If contractor is in NISP and has an authorized classified mailing address, confirm that address through NISS before entering it here.
Do NOT use this form for foreign contractors, foreign governments, or NATO activities. Issue a Security Aspects Letter instead.

6b CAGE Code: Verify at cage.dla.mil. A CAGE code alone does not confirm a facility clearance.

6c CSO: Always enter DCSA as the CSO. Find the appropriate field office at dcsa.mil/mc/ctp/locations/

Verify at cage.dla.mil — CAGE ≠ cleared facility
FSO Contractor FSO e-mail (optional)
Workflow only — never printed on the DD Form 254. Feeds the FSO send list and the distribution record.
CSO is always DCSA. Find field office: dcsa.mil/mc/ctp/locations/
7Subcontractor(s)
Instructions for Item 7
Even if you list subcontractors here, a separate DD Form 254 must be issued from the prime to each subcontractor. Listing them here does NOT replace that requirement.
Each tier in a subcontract chain requires its own DD Form 254 (prime→sub1, sub1→sub2, etc.).
Do NOT use DD Form 254 for foreign contractors/NATO activities — use a Security Aspects Letter.

If subcontractor has an authorized PO Box for classified mailing, note that in Item 13 (not in 7a).

⚖️ Subcontract Clause Review (Prime → Sub):
For a subcontract involving classified access, FAR 52.204-2 requires terms that conform substantially to the clause. When subcontract performance involves covered defense information or operationally critical support, DFARS 252.204-7012 flows down without alteration except to identify the parties.
Confirm applicability in the subcontract instrument. DD Form 254 selections convey classification guidance; they do not independently prescribe the complete clause set.
🔴 ONE SUBCONTRACTOR PER DD FORM 254. Each subcontractor requires its own separate DD Form 254 issued directly from the prime contractor to that subcontractor. This form covers the one subcontractor identified below. To add a second subcontractor, prepare a separate DD Form 254.
🔴 CONFIRM: Pulled from a saved template. Verify the address, CAGE and FSO name / e-mail against NISS before issuing — staff and addresses change.
Verify at cage.dla.mil — CAGE ≠ cleared facility
FSO Subcontractor FSO e-mail *
Workflow only — never printed on the DD Form 254. Feeds the FSO send list and the distribution record.
CMA Classified mailing address (optional)
Optional. Only if the contractor holds a separate classified mailing address. Appears at the bottom of Item 13.
🔴 REQUIRED: A subcontractor is identified, so the subcontractor FSO e-mail must be recorded — the DD Form 254 has to reach them.
ℹ️ Listing this subcontractor here does not replace the requirement to issue them a separate DD Form 254. This entry is informational only.
8Actual Performance Location(s)
Instructions for Item 8

List ALL locations where classified information will be accessed or stored, including contractor, subcontractor, and government facilities.

If Item 11a is checked → Item 8a is REQUIRED. Identify where contractor will have access. If the performance location is a cleared contractor site → 8b and 8c must also be completed.
If classified work is at the location in Item 6a, enter "See Item 6a" rather than repeating the address.
Listing a location in Item 8 limits all classified performance to the listed locations. List every location.

8b CAGE code: Only required if performance is at another prime contractor or subcontractor (not for government facilities).

8c CSO: Enter "Same as Item 6a" if performance is at 6a's location. Otherwise enter the appropriate DCSA field office.

If inspections will be conducted by someone other than the DCSA CSO → complete Item 15.
🔴 REQUIRED (Item 11a): Identify the actual location(s) where contractor will access classified information.
Add several at once
Each code is filled in from your Performance/Sub templates. A code that is not in the templates still gets a block, carrying the code alone, and validation flags it as incomplete. Codes already on the form are skipped.
Each entry limits classified performance to the location(s) listed — include every location.
9General Unclassified Description of This Procurement *
Instructions for Item 9

Short, concise, UNCLASSIFIED description. Enough detail to understand the nature of the work.

Do NOT use classified project names, code words, or descriptive information that itself is classified.

Include the type of effort: research, development, production, study, services, manufacturing, etc.

In the rare case where NO unclassified description is possible, GCA may attach a classified description and enter here: "See Attachment [#] for description provided under separate cover."

Item 10 — Access Requirements
10Contractor Will Require Access To: (X all that apply) *
Overall Instructions for Item 10

These are access requirements, not safeguarding. Check all that apply regardless of where access occurs. Provide details in Item 13 or 14.

10c (CNWDI) checked → 10b (Restricted Data) MUST also be checked.
10f (SAP) checked → Item 14 MUST be YES and Item 15 must be completed.
10e(1) SCI checked → Item 15 must identify the Senior Intelligence Officer responsible.
10a COMSEC + accountable material stored at contractor → also check 11h. COMSEC accessed ONLY at government facility → do NOT check 11h.
10j CUI: Do NOT check unless this classified contract ALSO has CUI requirements. Do NOT use for CUI-only contracts.
10a. COMSEC Information
Accountable/non-accountable COMSEC and CCI
If accountable COMSEC will be stored at contractor facility → also check 11h If COMSEC accessed ONLY at govt facility → check 10a but NOT 11h If accountable COMSEC needs Defense Courier → also check 11k Subcontracting COMSEC requires prior GCA approval Add Item 13 guidance: clearance level required, disclosure restrictions, NSA/CSS Manual 3-16 reference
10b. Restricted Data
Access to Restricted Data (RD) required
MUST be checked if 10c (CNWDI) is checked Add Item 13: "Access to RESTRICTED DATA requires a final U.S. Government clearance at the appropriate level."
10c. Critical Nuclear Weapon Design Information (CNWDI)
CNWDI access required — automatically requires 10b
10b (Restricted Data) is AUTOMATICALLY required when this is checked GCA approval required before granting CNWDI access to a subcontractor Special briefings and procedures required — note in Item 13
10d. Formerly Restricted Data (FRD)
Access to FRD required
10e(1). Sensitive Compartmented Information (SCI)
National Intelligence — SCI access required
List specific SCI caveats in Item 13 or 14 (DD Form 254 may need to be classified) GCA must incorporate applicable DNI/DCI Directive requirements Item 15 MUST identify the Senior Intelligence Officer with exclusive security responsibility DCSA CSO does NOT conduct security reviews for SCI GCA prior approval required before subcontracting SCI accessCoordinate applicable SCI contractual and administrative requirements with the cognizant SCI authority. Do not infer a clause solely from this Item 10 selection.
10e(2). Non-SCI Intelligence Information
National Intelligence — non-SCI access required
Cite protection requirements in Item 13 or 14 GCA prior approval required before subcontracting
10f. Special Access Program (SAP) Information
SAP access required — triggers Item 14 YES and Item 15
Item 14 MUST be YES Item 15 MUST be completed — identify the inspecting CSO for the SAP GCA approval required before subcontracting GCA SAP office provides additional security requirements (reference in Item 14) If DCSA retains SAP cognizance → note in Item 13. If carve-out → Item 15 identifies SAP CSO Coordinate applicable SAP contractual requirements with the PSM/PSO. DFARS 252.204-7005 is reserved and is not a SAP clause. SAP addendum required — must list all PIDs and period of performance. Addendum is classified and transmitted separately from this DD Form 254 via PSM/PSO-approved channels. (DoDM 5205.07 §10.1.c) Coordinate routing with your PSM or PSO prior to release. (DoDM 5205.07 §10.1) Collateral classified information incorporated into this SAP contract must be listed on this form or approved by PSM/PSO before entry. (DoDM 5205.07 §4.4.d) If this SAP is acknowledged: the DD Form 254 may be unclassified or CUI. If unacknowledged: the form itself may be CUI and the addendum will be classified — consult your PSO on handling. (DoDM 5205.07 §10.1.c) HVSACO: If any non-SAP contract information carries the HVSACO marking, it must be stored in an accredited SAPF or SCIF and handled via SAP-approved channels only. HVSACO is a control marking, not a classification level. Include HVSACO training in contractor indoctrination. (DoDM 5205.07 §4.1) At SAP closeout, coordinate disposition and the termination plan. A final DD Form 254 addresses continued SAP security requirements. Contractor shall not retain SAP information without specific written GCA authorization. (DoDM 5205.07 §10.5)
10g. NATO Information
Access to NATO classified documents/information required
List specific NATO levels required in Item 13 or 14 Item 13 must note that special NATO access briefing/debriefing is required GCA prior approval required before subcontracting NATO access SIPRNET access ONLY (no actual NATO info) → do NOT check this box. Instead annotate Item 13 that NATO info is not required but NATO awareness briefing IS required due to SIPRNET access
10h. Foreign Government Information (FGI)
FGI (excluding NATO) required for performance
GCA prior approval required before subcontracting Requires final U.S. Government clearance at appropriate level
10i. ACCM Information
Alternative Compensatory Control Measures information required
GCA provides classification guidance separately — do NOT disclose ACCM security plan details in form Checking this does NOT make the DD Form 254 classified by itself
10j. Controlled Unclassified Information (CUI)
Only if this classified contract ALSO requires CUI protection
Do NOT check for CUI-only contracts. Only valid when this classified contract also requires CUI. NISPOM does NOT cover CUI — GCA MUST provide CUI protection guidance in Item 13 DoD Components: refer to DoDI 5200.48. Non-DoD: consult Component policy office Review the current DFARS 204.73 provision/clause set, including DFARS 252.204-7012. Its subcontract flow-down applies when performance involves covered defense information or operationally critical support.
10k. Other (specify in Item 13)
Any other required access not covered by 10a–10j
Specify type of information in Item 13. Also determine if 11m should be checked. Check 10k for handling caveats or dissemination controls not covered above (e.g., LIMDIS) If contract involves sensitive conventional arms, ammunition, or explosives (AA&E): DFARS 252.223-7007 Safeguarding Sensitive Conventional Arms, Ammunition, and Explosives applies — specify in Item 13
🔴 AUTO-REQUIRED: 10c (CNWDI) forces 10b (Restricted Data) — both are now marked.
🔴 REQUIRED (10f SAP): Item 14 must be YES and Item 15 must be completed with the inspecting SAP security office.
🔴 REQUIRED (10e1 SCI): Item 15 must identify the Senior Intelligence Officer with exclusive security responsibility for SCI material.
Access Eligibility Advisor ADVISORY — NONBLOCKING
This advisor compares Items 1a, 1b, 10, and 11 with a verification snapshot. Its findings are informational only: they do not add validation errors, change draft status, block issuance, or alter the exported DD Form 254. Verify actual eligibility and safeguarding in NISS and retain the supporting record.
Cross-checked authorities and guidance: 32 CFR Part 117 (NISPOM Rule); DD Form 254 Instructions; DoDM 5105.21, Volume 3 (SCI); DoDM 5205.07 (SAP); DoDI 5200.48 (CUI); and DoDM 5200.01, Volume 3 (protection and ACCM).
Item 11 — Performance Requirements
11In Performing This Contract, the Contractor Will: (X all that apply) *
⚠️ Critical Overview — Read Before Selecting (Many Prohibited Combinations)

Some combinations are PROHIBITED (hard rules). Others are not recommended (soft rules requiring Item 13 explanation if overridden).

11a excludes ALL of: 11b, 11c, 11d, 11h, 11i, 11k
11b excludes ALL of: 11a, 11c, 11d, 11h, 11i, 11k
11c excludes: 11a and 11b
11d excludes: 11a and 11b
11e NOT recommended with: 11b, 11c, or 11d. Use 11m "Other" instead when contractor also provides services. If both checked, explain in Item 13.
If the GCA/prime chooses NOT to follow a recommendation, the reason MUST be explained in Item 13.

11c or 11d only together: Check 11d in addition to 11c ONLY if classified hardware cannot be stored in a GSA-approved security container.

11a. Have access to classified information ONLY at another contractor's facility or a government activity
"ONLY" is the key word — applicable ONLY if there is NO access or storage required at contractor's own facility.
Item 1b MUST be "None" or "N/A" — contractor stores nothing classified at their facility Item 8a MUST be completed — identify where contractor WILL have access If performance location is a cleared contractor site → Items 8b AND 8c must also be completed CANNOT check with: 11b, 11c, 11d, 11h, 11i, or 11k If also checking 11e → explain why in Item 13 11g (DTIC) may still be checked if DTIC access is needed DFARS 252.204-7003 is prescribed in all DoD solicitations and contracts and preserves Government personnel control of their work products.
11b. Receive and store classified documents ONLY
"ONLY" is the key word — contractor receives classified documents for reference only. NO generation or derivative classification at contractor facility.
Item 1b MUST be completed at the appropriate classification level CANNOT check with: 11a, 11c, 11d, 11h, 11i, or 11k Do NOT check 11e with 11b. If both are needed, explain in Item 13 why both are necessary. If volume/configuration requires specialized storage → contact DCSA CSO to verify capacity
11c. Receive, store, AND generate classified information or material
Contractor will receive and/or derivatively classify information. Requires security classification guidance from GCA/prime.
Item 1b MUST be completed at the appropriate classification level CANNOT check with: 11a or 11b Check 11d in ADDITION to 11c ONLY IF classified hardware cannot be stored in a GSA-approved security container Do NOT check 11e with 11c — use 11m "Other" instead if services are also needed. If both checked, explain in Item 13. Item 13 must reference the security classification guide(s) to be used If SIPRNET/JWICS/cloud access required → document in Item 13 including the approval authority If volume/configuration requires specialized storage → contact DCSA CSO to verify capacity Justifies use of classified information systems (requires appropriate govt approval authority) Review FAR 52.227-10 if classified patent applications may arise. Item 11c does not by itself establish export-control clause applicability.
11d. Fabricate, modify, or store classified hardware
Contractor will fabricate or use hardware containing classified material at their own cleared facility.
Item 1b MUST be completed at the appropriate classification level CANNOT check with: 11a or 11b Check this in ADDITION to 11c only if hardware cannot be stored in a GSA-approved security container Do NOT check 11e with 11d — use 11m "Other" instead if services are also needed. If both checked, explain in Item 13. Contact DCSA CSO to verify approved storage capacity and correct mailing/shipping address for classified hardware Item 13 should describe nature/extent of storage: Will Restricted or Closed Areas be required? Hardware dimensions? Open storage needed? If SIPRNET/JWICS access required → document in Item 13 including the approval authority
11e. Perform services ONLY
Contractor performs a service only — not expected to produce a deliverable (e.g., guard services, maintenance, janitorial in classified areas).
If services don't apply to a specific contract (e.g., guard/maintenance across multiple contracts) → enter "Multiple Contracts" in Item 2a and explain in Item 13 Do NOT check with 11c — use 11m "Other" instead. Must explain in Item 13 if both are checked. Do NOT check with 11d — use 11m "Other" instead. Must explain in Item 13 if both are checked. Not recommended with 11b — must explain in Item 13 if both are checked. Item 13 must describe the services and provide appropriate security classification guidance. Examples: guard services, equipment maintenance, janitorial in classified areas, graphic arts/reproduction If actual knowledge of classified info is not required but aural/visual access cannot be precluded → note this in Item 13 Review clause: DFARS 252.239-7001 Information Assurance Contractor Training and Certification — if IA functions are performed
11f. Have access to U.S. classified information OUTSIDE the U.S., Puerto Rico, U.S. Possessions, and Trust Territories
Item 13 MUST identify the U.S. activity, city, and country where overseas performance occurs Item 18d (distribution to U.S. Activity Responsible for Overseas Security Administration) must be checked Item 14 may also be required depending on program. Item 15 should be completed as appropriate since DCSA CSO cannot inspect overseas. Provide copy of DD Form 254 to the appropriate DCSA field office (find at dcsa.mil/mc/ctp/locations/) Review clauses: FAR 52.225-19 Contractor Personnel in Designated Operational Area  DFARS 252.225-7040 Contractor Personnel Authorized to Accompany U.S. Armed Forces
11g. Be authorized to use DTIC or other secondary distribution center
Contractor authorized to obtain classified documents from Defense Technical Information Center.
Sponsoring GCA must submit DD Form 1540 to DTIC on contractor's behalf. For subs, prime submits with GCA certifying need-to-know. May be checked even when 11a is selected (access elsewhere only)
11h. Require a COMSEC account
Contractor must store accountable COMSEC material at their cleared facility.
If checked → Item 10a (COMSEC) MUST also be checked CANNOT check with 11a (access elsewhere only) — COMSEC accounts are at the contractor facility CANNOT check with 11b (receive/store only) Do NOT check for non-accountable COMSEC material only (non-accountable = not tracked in CMCS) Accountable COMSEC includes: COMSEC key, CCI, STE, in-process items describing cryptographic logic Review clause: DFARS 252.239-7016 Telecommunications Security Equipment, Devices, Techniques, and Services
11i. Have a TEMPEST requirement
GCA-specified TEMPEST requirements for contractor within the U.S.
Item 14 MUST be YES — TEMPEST is above NISPOM baseline GCA must have identified TEMPEST requirements in writing by contract BEFORE imposing them on the contractor GCA must separately advise DCSA of contract TEMPEST requirements CANNOT check with 11a (access elsewhere only) Prime contractors may NOT impose TEMPEST requirements on subcontractors without GCA approval TEMPEST can be very expensive — not generally required inside the U.S. without proper justification Checking this does not by itself classify the DD Form 254 Contract clause required: DFARS 252.239-7000 Protection Against Compromising Emanations
11j. Have Operations Security (OPSEC) requirements
Additional OPSEC protection/countermeasures beyond NISPOM baseline required.
Item 14 MUST be YES Contractor must be provided with a copy of the system/command/unit OPSEC requirements or plan — include in Item 13 or as attachment Item 13 must identify pertinent contract clauses and provide OPSEC guidance Prime contractors may NOT impose OPSEC requirements on subcontractors without GCA approval OPSEC clauses are cited in Item 14 — see DoDD 5205.02E
11k. Be authorized to use Defense Courier Service
GCA must have ALREADY obtained written approval from USTRANSCOM Defense Courier Division (TCJ3-C), Scott AFB, IL before checking this box CANNOT check with 11a (access elsewhere only) CANNOT check with 11b (receive/store only) Prime cannot authorize subcontractor to use Defense Couriers without GCA prior approval Only certain classified material qualifies — GCA must comply with DoD and TCJ3-C policy
11l. Receive, store, or generate CUI
Controlled Unclassified Information in context of a classified contract
Do NOT check for contracts that ONLY require CUI (no classified). Only valid when Item 10j is also checked AND 11a/b/c/d is also checked establishing classified access. NISPOM does NOT cover CUI — GCA MUST provide CUI protection guidance in Item 13
11m. Other (specify in Item 13)
Additional performance requirements not covered by 11a–11l. Commonly used when contractor performs services AND generates classified (instead of checking both 11c and 11e).
Item 13 must describe the additional requirements Also determine if 10k (Other) should be marked
🔴 PROHIBITED COMBINATION — 11a: "Access Elsewhere ONLY" cannot be combined with . Deselect conflicting items or remove 11a.
🔴 PROHIBITED COMBINATION — 11b: "Receive/Store ONLY" cannot be combined with . Deselect conflicting items or remove 11b.
🔴 PROHIBITED COMBINATION — 11c: Cannot be combined with 11a or 11b.
🔴 PROHIBITED COMBINATION — 11d: Cannot be combined with 11a or 11b.
🟡 RECOMMENDATION: 11e (services only) and 11c are both checked. Instructions recommend using 11m (Other) instead of 11e when contractor also generates classified. If you keep both, you MUST explain in Item 13.
🟡 RECOMMENDATION: 11e (services only) and 11d are both checked. Instructions recommend using 11m (Other) instead of 11e when contractor also handles classified hardware. If you keep both, you MUST explain in Item 13.
🟡 RECOMMENDATION: 11e (services) and 11b are both checked. Instructions recommend NOT combining these. If both are necessary, you MUST explain in Item 13.
🔴 REQUIRED (11h): 11h (COMSEC Account) requires Item 10a (COMSEC) to also be checked.
🔴 REQUIRED (11i TEMPEST): Item 14 must be YES.
🔴 REQUIRED (11j OPSEC): Item 14 must be YES.
🟡 REQUIRED (11f Overseas): Item 13 must identify the U.S. activity, city, and country of overseas performance. Item 18d distribution must be checked.
🟡 Check 11l validity: 11l should only be checked when Item 10j is also checked AND one of 11a/b/c/d establishes classified access.
Item 11 Performance Advisor ADVISORY — NONBLOCKING
Checks every selected Item 11 block against Items 1b, 10, 13, 14, and 18, plus the evidence questions below. Findings never enter Live Validation, change draft status, or block issuance.
✔ Boxes marked in Item 10 (Access) & Item 11 (Performance)
None marked yet in Items 10 or 11.
12Public Release Authority (optional — not required)
Instructions for Item 12
This item MUST be completed — it is required on every DD Form 254.

Identify the GCA office with public release authority and the process for contractor release requests. Include at minimum: office name, phone number, and email if available.

No information (classified or unclassified) may be released publicly without GCA approval, except as authorized by NISPOM.
Subcontractors must route public release requests through the prime contractor. Prime is responsible for submitting to the GCA public release authority.

Clause review: DFARS 252.204-7000 Disclosure of Information is prescribed when the contractor will access or generate unclassified information that may be sensitive and inappropriate for public release. Item 12 alone does not decide applicability.

Q1 · Release routing (mark one — required on the form):
13Security Guidance
Instructions for Item 13
Always identify which item you are referencing (e.g., "Ref. 10a:", "Ref. 11c:") when expanding on other items.
Do NOT extract NISPOM requirements verbatim into Item 13. NISPOM provides general procedural guidance, not classification guidance. Item 13 is for contract-specific classification guidance.
Avoid references to internal GCA directives. If such documents are needed, extract pertinent portions as attachments.
All documents cited in Item 13 must be provided to the contractor — either as attachments or forwarded separately.
Write in plain language. Be as specific as possible. Include only information that pertains to this contract.

Use this for: security classification guides, reasons for classification, SCG titles and identifiers, additional guidance on any item, OPSEC plans, COMSEC guidance, overseas performance details, final disposition instructions, transfer authority from follow-on contracts.

Up to 6 internal reviewers may digitally sign here (contracting officer's representative, program manager, GCA security officer, contractor security officer).

Bold/underline show in the tool only — the exported form stays plain text.
The right panel shows a dynamic list of items that currently require Item 13 entries based on your selections.
Internal reviewing officials — each gets a digital signature block on the exported PDF (up to 6 on the fillable official form):
14Additional Security Requirements *
Instructions for Item 14

Requirements in addition to NISPOM for this contract. Additional requirements = additional costs — only impose what is necessary.

YES is REQUIRED when Items 10f (SAP), 11i (TEMPEST), or 11j (OPSEC) are checked.
YES may also be required when Item 11f (overseas access) is checked, depending on programs involved.
If YES → incorporate additional requirements in the contract itself OR reference them in Item 13.
Provide a copy of additional requirements to the CSO.
Prime contractors may NOT impose additional security requirements on subcontractors without GCA approval.

Costs due to additional requirements are subject to negotiation between contractor and GCA.

🔴 REQUIRED: One or more selections (10f SAP / 11i TEMPEST / 11j OPSEC) require Item 14 = YES.
A copy of these requirements must be provided to the CSO.
15Inspections *
Instructions for Item 15

Complete this item if ANY inspections will be conducted by an organization other than the DCSA CSO.

Required if: 10e(1) SCI is checked, 10f SAP is checked (especially carve-outs), or contractor is on a military installation where the installation commander has formally elected to retain security cognizance.
Selecting YES does NOT change DCSA CSO designation for oversight of the baseline FCL. DCSA still oversees the baseline FCL even with a carve-out SAP.
Selecting YES does NOT relieve the GCA from providing a copy of the DD Form 254 to the DCSA CSO.

SCI (10e1): Add: "[Agency/Military Dept Senior Intelligence Officer] has exclusive security responsibility for SCI classified material released or developed under this contract and held within the contractor's SCIF."

SAP carve-out (10f): Identify the SAP CSO responsible for inspection. Not all SAPs are carve-outs — some allow DCSA CSO to retain inspection responsibility.

Military installation: When installation commander has formally elected to retain security cognizance.

If YES → GCA determines whether this requires classifying the DD Form 254 and coordinates with DCSA to route it through appropriate channels.
🔴 REQUIRED: One or more selections (10e1 SCI / 10f SAP) require Item 15 to be completed.
Always provide a copy of this DD Form 254 to the DCSA CSO even when YES is checked here.
GCA, Certification & Signatures
16Government Contracting Activity (GCA) and POC *
Instructions for Item 16
Do NOT revise the DD Form 254 solely to update POC information (16d or 16f). POC changes alone are not a valid reason for revision.

16b AAC: 6-position alpha/numeric code. Find at dla.mil/…/DoDAAD/

For multiple GCAs on a subcontract DD Form 254: prime contractors ONLY may annotate 16a with "Multiple Contracts" and leave 16b–f blank. Be prepared to provide specific GCA info to DCSA if requested.
POC changes alone ≠ valid reason to revise DD Form 254
17Certification and Signatures *
Instructions for Item 17

Contracting Officer or authorized representative certifies that security requirements are complete and adequate.

17e (CAGE of prime) — complete ONLY for subcontract DD Forms 254. Leave blank for prime contractor forms.
SAP subcontract forms: A subcontract DD Form 254 for a SAP contract is not complete until the subcontractor's authorized representative signs it. The DD Form 254 instructions ask for no subcontractor signature on other forms; Item 17 is the certifying official's. Ref: DoDM 5205.07 §10.1.d.
Do NOT revise solely for changes to 17a, 17g POC information.

Items 17h Signature and 17i Date Signed are completed in the generated dynamic PDF. A digital signature in 17h locks the PDF — no further changes can be made once digitally signed.

Item 18 — Required Distribution
18Required Distribution by Certifying Official *
Instructions for Item 18
At minimum, distribute to: DCSA, contractor FSO, subcontractor FSO (if applicable), GCA POCs, and all checked offices.
18d (Overseas) must be checked if Item 11f is checked.

Use Item 13 if additional address information is needed for distribution.

18a. Contractor (FSO)
18b. Subcontractor (FSO) — if applicable
18c. Cognizant Security Office (DCSA) for Prime and Subcontractor
18d. U.S. Activity Responsible for Overseas Security Administration — required if Item 11f is checked
18e. Administrative Contracting Officer (ACO)
18f. Other as necessary (specify in Item 13)
CUI Designation Block (optional)
Not a box on the DD Form 254. Filling any field writes the designation block at the very bottom of Item 13, below the classified mailing addresses and separated from them by five blank rows. Every label is written even where the value is blank, so a missing element is visible on the form rather than silently absent. Clearing every field removes the block.
Hover a control for its full description. Multiple controls are alphabetised and separated by a single forward slash, per CUI marking guidance.
🟡 REQUIRED (11f Overseas): Item 18d (U.S. Activity Responsible for Overseas Security Administration) should be checked.
DD FORM 254, APR 2018 · Interactive Guided Edition · FAR 4.402(d)(1) NISPOM: 32 CFR Part 117