Overview
FAR Subpart 4.4 prescribes policies and procedures to ensure that "Confidential," "Secret," or "Top Secret" information released to industry is properly safeguarded. It primarily implements the National Industrial Security Program (NISP), establishing a uniform system for contractors, licensees, and grantees to protect classified information.
Key Rules
- Regulatory Framework: The National Industrial Security Program Operating Manual (NISPOM) (32 CFR part 117) is the primary authority for industrial security requirements.
- DD Form 254: This form (Contract Security Classification Specification) is the mandatory vehicle for providing security classification guidance to contractors. It must be completed electronically in the NISP Contract Classification System (NCCS) unless the agency uses an approved internal system.
- CAGE Code Requirements: Every contractor and subcontractor location listed on a DD Form 254 must have a unique Commercial and Government Entity (CAGE) code. While these locations do not need separate SAM.gov registrations solely for the DD Form 254, the CAGE code is mandatory for identification and clearance verification.
- Mandatory Clauses: The clause at FAR 52.204-2, Security Requirements, must be included in any solicitation or contract that may require access to classified information.
- International Handling: Specific procedures under 32 CFR 117.19 govern the protection of foreign classified information provided to U.S. industry and vice-versa.
Responsibilities
- Contracting Officers (COs):
- Presolicitation: Review requirements to determine if offerors or contractors will need access to classified information.
- Solicitation: Ensure the appropriate security clauses are included and determine if additional safeguards beyond the standard clause are necessary.
- Award: Act as the approving official for the DD Form 254; ensure it is properly coordinated with security personnel and distributed to the contractor.
- Secretary of Defense: Responsible for the issuance and maintenance of the NISPOM, in consultation with the DOE, NRC, DNI, and DHS.
- Contractors & Subcontractors: Must maintain the security clearances required by the NISP and ensure that all performance locations are properly identified with CAGE codes.
Practical Implications
- Facility Clearances (FCL): Before a contract involving classified information can be performed, the contractor must obtain a Facility Security Clearance. This subpart ensures that the CO triggers the clearance process early in the acquisition lifecycle.
- Subcontractor Management: Prime contractors have a heavy burden of "flow-down" responsibility. If a subcontractor requires access to classified data, the prime must ensure a DD Form 254 is issued for that subcontractor, and the sub's specific work location must have its own CAGE code.
- Administrative Precision: Errors in the DD Form 254 or missing CAGE codes for specific performance sites can lead to significant delays in contract start dates or the inability to "onboard" personnel into classified systems.
- Specialized Clauses: COs must be careful to use Alternate I for R&D contracts with educational institutions and Alternate II for construction or architect-engineer contracts where employee ID for security is the primary concern.