A DD254 is the form the government uses to give a contractor the security rules for a classified contract: the classification level, what the contractor may access, and where the classified work will happen. If your contract or subcontract involves Confidential, Secret or Top Secret information, it comes with one.
What is a DD254?
DD Form 254, the Department of Defense Contract Security Classification Specification, is how DoD, and agencies with DoD industrial security agreements, give security classification guidance to contractors and subcontractors (FAR 4.402(d)). When the details are unclassified, the form is completed electronically in the NISP Contract Classification System (NCCS).
The rules behind it come from the FAR, the DFARS and the National Industrial Security Program Operating Manual (NISPOM), 32 CFR Part 117.
What the form covers
- The highest classification level the contract requires
- The scope of the classified work and why it needs access to classified information
- The specific security requirements the contractor must meet
- Where the classified work will be performed
- Each cleared contractor and performance location, identified by a CAGE code
When a contract needs one
A contract needs a DD254 when performing it requires access to classified information. That access has to be real: DCSA discontinues facility clearance (FCL) processing when it finds the contract only needs IT-level access, suitability checks or base access. In those cases no FCL is required (DCSA, Facility Clearances).
The DD254 also anchors your FCL sponsorship. A sponsor submits it with the sponsorship request, and DCSA lists an incomplete DD254, or one without a clear justification for access, among the most frequent reasons sponsorships get rejected. For the full sponsorship process, see how FCL sponsorship works.
Where your cleared work happens
Every location on a DD254 is tied to a CAGE code. Each place of performance needs its own CAGE code, and work at a government facility uses the agency's location code instead (FAR 52.204-16). That raises a practical question for a lot of small companies: what if you won the work but have no office, let alone a secure one?
You do not have to lease and build your own space first. A Nooks classified workspace can be listed as the place of performance on your DD254. Your company still needs its own FCL, and each person still needs their own clearance.
Mistakes that slow things down
- Leaving the access justification vague. DCSA wants a clear reason the contract needs classified information.
- Missing details or details that disagree with the sponsorship request. DCSA rejects incomplete or inconsistent packages.
- Starting without a CAGE code. DCSA warns that a company without one before the FCL process starts can face significant delays or a discontinued case.
- Listing a performance location you have not lined up yet.
How we help
Our industrial security team reviews DD254s with contractors, helps sponsors draft the form and its contract language, and carries the FCL work that follows. Your FSO stays on your staff; we take on the day-to-day work behind them.
Talk to our team about your DD254.
