DD-254 · Item guide
The DD Form 254, item by item
The DD Form 254, Contract Security Classification Specification, gives a contractor the security requirements and classification guidance for a classified contract. This guide follows DoD’s instructions for completing it, item by item, and the rules that tie one item to another.
Before you start
Items 1–9: the contract and the contractor
Who the contractor is, what clearance and storage it needs, and where it will work.
| 1a · Facility clearance required | The highest level of classified information the contractor’s employees need to perform: Confidential, Secret or Top Secret only. Never a special category such as Restricted Data, COMSEC, SCI or SAP. Set it no higher than performance needs; an inflated level means unnecessary upgrades and investigations. If the company has no facility clearance, or a lower one, the GCA (or the prime, for a subcontract) sponsors it with DCSA. Verify a facility clearance in NISS. |
|---|---|
| 1b · Safeguarding required | The highest level the contractor will store or generate at its own facility. It cannot be higher than 1a. Enter “None” when all access will be elsewhere, at a Government site or another cleared contractor. No special categories here either. |
| 2 · This specification is for | 2a, the prime contract number, entered by the GCA (and repeated by the prime on every subcontract’s form). 2b, the subcontract number, entered by the prime. 2c, a solicitation number and the date bids are due, for an RFP, RFQ or IFB that will lead to classified work, even if the bid itself needs no classified access. Other contract numbers, such as task orders or ordering agreements, go in item 13. A prime issuing a services-only subcontract that is not tied to one contract (guard services, maintenance) may enter “Multiple Contracts” in 2a and explain in item 13. |
| 3 · This specification is | 3a, Original: the certifying official’s signature date, which never changes on later revisions. 3b, Revised: a sequential revision number and date, issued when classification guidance, security requirements or the performance location change. 3c, Final: issued only to authorize keeping classified material after the contract ends (see the end of the contract); always complete item 5 with it. |
| 4 · Follow-on contract | “Yes” and the preceding contract number when the same contractor receives a follow-on contract for the same item or service. This authorizes moving material from the old contract to the new one; item 13 says whether that is all of it or a listed part. |
| 5 · Final DD Form 254 | “Yes” only when the contract is complete and the GCA, on the contractor’s formal request, has found a continuing need to keep classified material past the automatic two years. Enter the date of the request and the retention period the GCA authorized; item 13 gives final disposition instructions. |
| 6 · Contractor | The prime contractor’s name and street address (for a cleared company, its authorized classified mailing address as shown in NISS), its CAGE code, and its cognizant security office: the DCSA field office for its area. Not every company with a CAGE code is cleared; verify the facility clearance. |
| 7 · Subcontractor | Completed by the prime for a subcontract: the subcontractor’s name, address, CAGE code and DCSA field office. A subcontractor authorized to receive classified mail at a post office box has that address in item 13. |
| 8 · Actual performance | Every location where classified information will be accessed or stored, including contractor staff embedded at a Government site. Listing a location limits classified performance to the places listed. For a Government site, complete only 8a; add the CAGE code (8b) and DCSA field office (8c) only when the location is another cleared contractor. If it is the contractor’s own address, “Same as item 6a” (or 7a). |
| 9 · Description of the procurement | A short, unclassified description with enough detail to picture the work: research, development, production, study, services. No classified project names. Only if the GCA finds no unclassified description possible does a classified one go in a separate attachment. |
Item 10: what the contractor needs access to
Check every category the GCA has determined the contractor’s people need, wherever the access happens. Item 10 is about access, not storage; storage is items 1b and 11.
| Box | Check it when | What else it requires |
|---|---|---|
| 10a · COMSEC | The contractor needs access to COMSEC information, accountable or not, including controlled cryptographic items. | Item 11h too if the contractor must hold accountable COMSEC at its own facility. Not 11h when COMSEC is used only at a Government site, or is on loan to the contractor as a local element or hand-receipt holder of a Government account. 11k if accountable material moves by Defense Courier. GCA approval before a prime gives a subcontractor COMSEC access. |
| 10b · Restricted Data | Access to Restricted Data is required. | Always checked when 10c is. |
| 10c · CNWDI | Access to Critical Nuclear Weapon Design Information is required. | Check 10b as well. Special briefings apply, and GCA approval is needed before a subcontractor gets CNWDI access. |
| 10d · Formerly Restricted Data | Access to FRD is required. | — |
| 10e · National intelligence | (1) SCI, only if the contractor needs SCI to perform; (2) non-SCI intelligence information. | List SCI caveats or non-SCI protection requirements in item 13 or 14; the form may then need to be classified. GCA approval before any subcontract involving intelligence information. For SCI, item 15 names the agency with security responsibility for SCI held in the contractor’s SCIF; DCSA does not review SCI. |
| 10f · SAP | Access to Special Access Program information is required. | Item 14 “Yes,” and item 15 as appropriate. If DCSA is relieved of oversight (a carve-out), item 15 names the SAP’s security office; if DCSA keeps it, item 13 says so. GCA approval before subcontracting. |
| 10g · NATO | Access to NATO classified information is required. | NATO briefings, noted in item 13; specific NATO levels in 13 or 14. GCA approval before subcontracting. SIPRNET access alone is not a reason to check 10g: say in item 13 that NATO information is not needed, and require a NATO awareness briefing. |
| 10h · Foreign Government Information | Access to classified FGI other than NATO is required. | GCA approval before subcontracting. |
| 10i · ACCM | Alternative Compensatory Control Measures information applies. | Checking it does not make the form classified; the GCA gives classification guidance separately, and the security plan is identified without disclosing ACCM-protected data. |
| 10j · CUI | The classified contract also requires access to CUI. | Never for a contract that involves only CUI. The NISPOM gives no CUI guidance, so the GCA provides it in item 13 (for DoD, under DoDI 5200.48). |
| 10k · Other | Any other required access or handling caveat not covered by 10a–10j. | Specify it in item 13 or 14, and consider 11m. |
Item 11: how the contractor will perform
The GCA, or the prime for a subcontract, completes item 11. The instructions say which boxes must not be checked together. Where the GCA departs from a recommended combination, item 13 must say why.
| Box | Check it when | What else it requires |
|---|---|---|
| 11a · Access only elsewhere | All classified access is at another cleared contractor or a Government activity. “Only” is the key word. | 1b is “None.” The performance location goes in 8a (and 8b, 8c for a cleared contractor site); item 13 says whether classified material will be generated there. |
| 11b · Receive and store documents only | The contractor will receive classified documents for reference, with no generation or derivative classification on site. | 1b at the appropriate level. If volume or configuration needs special storage, the GCA checks capacity with DCSA. |
| 11c · Receive, store and generate | The contractor’s facility will receive classified information or derivatively classify it. | 1b at the appropriate level, and classification guidance in item 13 or a security classification guide. It covers access at other cleared sites too; list required performance locations in item 8. Classified information systems, SIPRNET, JWICS or cloud connections are detailed in item 13 with their approval authority. |
| 11d · Fabricate, modify or store hardware | The contractor will fabricate or use classified hardware at its own cleared facility, or must store material that will not fit a GSA-approved container. | 1b at the appropriate level. Describe the storage in item 13: Restricted or Closed Areas, how much hardware and how large, any open storage. Confirm shipping address and storage capacity with DCSA. |
| 11e · Services only | The contractor performs a service with no deliverable item. Also when knowledge of classified information is not needed but aural or visual access cannot be prevented, as with maintenance, guard or janitorial work in classified areas. | Item 13 explains the service and gives the guidance; the instructions provide model statements. If 11c or 11d also applies, the instructions recommend 11m “Other” for the services instead. |
| 11f · Classified access outside the U.S. | Performance, or any travel, requires access to classified information outside the U.S., Puerto Rico, U.S. possessions and trust territories. | Item 13 names the U.S. activity, city and country. Item 15 as appropriate, since another organization will review that work; item 14 if more requirements apply. |
| 11g · DTIC | The contractor may obtain documents from the Defense Technical Information Center or another secondary distribution center. | The GCA submits DD Form 1540 for a prime; the prime submits it for a subcontractor, with the GCA verifying need-to-know. |
| 11h · COMSEC account | The contractor must store accountable COMSEC at its cleared facility. | Check 10a. Not for non-accountable COMSEC. |
| 11i · TEMPEST | The GCA requires TEMPEST in the U.S. by contract. | Item 14 “Yes,” with clauses or clarification in item 13. The GCA must identify the requirement in writing first and tell DCSA. A prime may not impose TEMPEST on a subcontractor without GCA approval. |
| 11j · OPSEC | The contract requires operations security measures beyond the NISPOM. | Item 14 “Yes,” and the OPSEC requirements or plan in item 13 or an attachment. A prime may not impose OPSEC on a subcontractor without GCA approval. |
| 11k · Defense Couriers | The GCA has written approval from USTRANSCOM’s Defense Courier Division. | GCA approval before a prime lets a subcontractor use Defense Couriers. |
| 11l · CUI | 10j is checked and so is one of 11a–11d. | Never for a CUI-only contract. Guidance in item 13. |
| 11m · Other | Any performance requirement not covered by items 10 or 11. | Explain in item 13, and consider 10k. |
Items 12–18: guidance, oversight and signature
| 12 · Public release | Always completed: the GCA office with public release authority and how to submit a request, with at least a phone number. Nothing about the contract, classified or not, is released publicly without that approval, except as the NISPOM allows. Subcontractors submit through the prime. |
|---|---|
| 13 · Security guidance | The heart of the form: the classification guidance and anything that explains another item, labelled with that item’s number. Give reasons for classification, write in plain language and keep to this contract. List the security classification guides and manuals that apply, and attach or send every document cited; extract the relevant parts of internal GCA directives rather than citing them. Do not copy NISPOM requirements in: the NISPOM is not classification guidance. Item 13 can also hold up to six reviewers’ digital signatures. Contractors may be invited to help develop the guidance. |
| 14 · Additional security requirements | “Yes” whenever the contract imposes requirements beyond the NISPOM, which then appear in the contract or in item 13. Required with 10f, 11i and 11j. Added requirements add cost, negotiated between the contractor and the GCA, so only necessary ones belong here. A prime needs GCA approval to impose them on a subcontractor; the cognizant security office gets a copy. |
| 15 · Inspections | Completed when an organization other than DCSA will inspect some of the work: the SCI security office for SCI in a contractor SCIF, a SAP carve-out, or a military installation commander who keeps security cognizance. DCSA still oversees the baseline facility clearance and still receives the form. |
| 16 · Government Contracting Activity | The GCA’s name, its contracting office’s Activity Address Code, address and point of contact, even on a subcontract’s form. A prime with several contracts and GCAs behind one subcontract may enter “Multiple Contracts” and keep the details ready for DCSA. A change of point of contact alone is not a reason to revise. |
| 17 · Certification | The contracting officer or authorized representative (the Government’s, or the prime’s for a subcontract) signs and dates it. A prime’s form also carries the prime’s CAGE code in 17e; under 32 CFR §117.17(b) a designated official of the prime certifies it. |
| 18 · Required distribution | The certifying official sends the signed form at least to DCSA, the contractor’s FSO, any subcontractor’s FSO, the GCA points of contact and every office marked. |
Which boxes go together?
The instructions’ required pairings. A form that breaks one gives the contractor contradictory guidance and leaves DCSA unsure what to oversee.
| If you check | Then | And do not check |
|---|---|---|
| 11a, access only elsewhere | 1b “None”; location in 8a | 11b, 11c, 11d, 11h, 11i, 11k. 11g only for DTIC’s unclassified services. |
| 11b, documents only | 1b at the appropriate level | 11a, 11c, 11d, 11h, 11i, 11k; 11e is not recommended. |
| 11c, receive, store and generate | 1b at the appropriate level | 11a, 11b. 11d only for hardware or material beyond a GSA container. 11e is not recommended. |
| 11d, hardware | 1b at the appropriate level | 11a, 11b. 11e is not recommended. |
| 11h, COMSEC account | 10a | — |
| 10c, CNWDI | 10b | — |
| 10f SAP, 11i TEMPEST or 11j OPSEC | Item 14 “Yes” | — |
| 11l, CUI | 10j, and one of 11a–11d | Never on a CUI-only contract. |
| 3c, final | Item 5 “Yes,” with the request date and retention period; the original date stays in 3a | — |
Any recommended combination the GCA does not follow needs an explanation in item 13.
When is a revised or final DD Form 254 issued?
Drafting one
Check a draft for conflicts
DD-254 Interactive is an open-source drafting aid that runs in your browser and flags internal inconsistencies. It does not make classification determinations; the GCA does.
Sources
- Instructions for completing DD Form 254 (DoD; April 2018, updated July 11, 2025): every item and pairing above. Blank DD Form 254.
- 32 CFR §117.13(d): the GCA’s classification guidance, a contract without one, two-year retention and the final specification.
- 32 CFR §117.17(b)–(c): subcontract specifications, certification by the prime and retention through the prime.
- FAR 4.402(d): who must use the DD Form 254, and CAGE codes.
Checked . A guide to the instructions, not a substitute for them, your contract or your GCA.