What this form is
Official title: Department of Defense Contract Security Classification Specification
Current edition: DD Form 254 (APR 2018) — 18 items (the long-retired DEC 1999 edition had 17; if a checklist you're following says 17 items, it's outdated)
Prescribed by: FAR 53.204-1 / FAR subpart 4.4 and the clause at FAR 52.204-2; governed by the NISPOM rule at 32 CFR part 117
Official download: https://www.esd.whs.mil/Portals/54/Documents/DD/forms/dd/dd0254.pdf
Every classified DoD contract carries a DD 254: it tells the contractor what level of clearance and safeguarding the work needs and what the contractor will be allowed to access, generate, or store. Primes issue their own tailored DD 254s to cleared subcontractors.
The items, one by one
| Block | Label on the form | Who fills it in, and with what |
|---|---|---|
| 1 | CLEARANCE AND SAFEGUARDING — a. facility security clearance (FCL) level required; b. level of safeguarding for classified information/material required at contractor facility | Government — 1a is what your facility must be cleared TO; 1b is what you may physically hold on site (often lower, or None) |
| 2 | THIS SPECIFICATION IS FOR: a. PRIME CONTRACT NUMBER; b. SUBCONTRACT NUMBER; c. SOLICITATION OR OTHER NUMBER + due date | Government (the prime fills 2b when issuing a DD 254 to a subcontractor) |
| 3 | THIS SPECIFICATION IS: a. ORIGINAL + date; b. REVISED (supersedes all previous) + revision number/date; c. FINAL (complete Item 5) + date | Government — the revision machinery: guidance changes require a REVISED form |
| 4 | IS THIS A FOLLOW-ON CONTRACT? — classified material from the preceding contract number transfers to this follow-on | Government |
| 5 | IS THIS A FINAL DD FORM 254? — retention of classified material authorized for a stated period, in response to the contractor's request | Government |
| 6 | CONTRACTOR — name/address, CAGE CODE, cognizant security office (CSO) | Government — identifies the cleared contractor |
| 7 | SUBCONTRACTOR(S) — name/address, CAGE code, CSO | Prime — when issuing a subcontract DD 254 |
| 8 | ACTUAL PERFORMANCE — location(s), CAGE code, CSO | Government/prime — where classified work is actually performed |
| 9 | GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT | Government |
| 10 | CONTRACTOR WILL REQUIRE ACCESS TO: COMSEC / RESTRICTED DATA / CNWDI (if marked, RESTRICTED DATA must also be marked) / FORMERLY RESTRICTED DATA / national intelligence (SCI and non-SCI) / SAP / NATO / foreign government information / ACCM / CUI / other | Government — what categories of information the work touches |
| 11 | IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: access classified only at other facilities; receive/store documents only; receive/store/generate; fabricate/modify/store classified hardware; services only; access outside the U.S.; use DTIC; require a COMSEC account; TEMPEST; OPSEC; Defense Courier Service; receive/store/generate CUI; other | Government — what the contractor will actually DO; 11a means no safeguarding at your own facility |
| 12 | PUBLIC RELEASE — nothing released publicly except per NISPOM or with approval of the named authority | Government — the release channel |
| 13 | SECURITY GUIDANCE — the security classification guides (SCGs) for the effort; contractors are "authorized and encouraged" to recommend changes if the guidance is unworkable; reviewing-official signature rows | Government — the actual classification instructions live here (or attached) |
| 14 | ADDITIONAL SECURITY REQUIREMENTS (beyond NISPOM) — Yes/No + identify the clauses or statement | Government |
| 15 | INSPECTIONS — elements outside the CSO's inspection responsibility — Yes/No + who inspects what | Government |
| 16 | GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT — GCA name, activity address code, address, POC name/telephone/email | Government |
| 17 | CERTIFICATION AND SIGNATURES — certifying official's name, title, address, AAC, prime's CAGE, telephone, email, signature, date; upon digital signature the form locks | Certifying official (the prime's official on subcontract DD 254s) |
| 18 | REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL — contractor; subcontractor; CSO for prime and sub; U.S. activity for overseas security administration; administrative contracting officer; other | Certifying official — who must receive copies |
Common mistakes
- Internal inconsistencies the form itself forbids: marking item 10c (CNWDI) without 10b (Restricted Data) — the form's parenthetical requires both. Similarly incoherent: a safeguarding level in 1b while 11a says access only at other facilities.
- Never revising. Security guidance changes require a REVISED DD 254 (item 3b), and closeout needs a FINAL one with the retention decision (items 3c/5) — stale DD 254s leave contractors holding classified material without current authority.
- Prime-to-sub gaps: not issuing a tailored DD 254 to cleared subcontractors (items 2b/7) or skipping the item 18 distribution to the CSO — recurring security-review findings. (Practice-based, per DCSA guidance.)
FAQ
How many items does the current DD Form 254 have?
Eighteen. The APR 2018 edition added item 18 (required distribution); guides describing 17 items are based on the retired DEC 1999 edition.
Who issues a DD 254 to a subcontractor?
The prime contractor prepares and certifies a tailored DD 254 for each cleared subcontractor (items 2b and 7), flowing down the security specification.
What is the difference between items 1a and 1b on the DD 254?
1a is the facility clearance level the contractor must hold; 1b is the level of classified material that may actually be safeguarded (stored) at the contractor's facility — often lower, or None.