# DD-254 Walkthrough How to read the contract security classification specification before you sign anything _A guided read-along of the DD-254 form, block by block. Use this before you sign a subcontract or accept a cleared role so you know what you are agreeing to and what to ask your FSO._ Used in: Lesson cleared/01 — https://vetslearn.com/lessons/cleared/01 Source: https://vetslearn.com/resources/templates/career#t-dd-254-walkthrough --- # DD-254 Walkthrough **Used in:** [cleared/01 — Cleared AI landscape](/lessons/cleared/01) ## How to use The DD-254 is not a form you fill in. It is a form your customer or prime fills in and sends to you. Your job is to read it carefully and know what each block means before you accept the work. This walkthrough goes block by block. Read it once cover to cover. Then keep it next to you when a real DD-254 lands in your inbox. If any block on a real DD-254 does not match what was promised verbally, stop. Talk to your Facility Security Officer (FSO) before you sign anything or start work. --- ## What the DD-254 is The DD Form 254, Contract Security Classification Specification, tells a contractor what classified information they will access on a contract, at what level, and what rules apply. It is the legal handshake that says "this contract is cleared work, and here are the boundaries." No DD-254, no classified work. If a prime asks you to start before a DD-254 is in place, that is a red flag. --- ## Block-by-block ### Block 1 — Clearance and Safeguarding **1a — Facility Clearance Required.** The level of facility clearance (FCL) your company needs. Confidential, Secret, or Top Secret. **1b — Level of Safeguarding Required.** What you must be able to store at your facility. Often lower than 1a. You can have a Secret FCL but not be cleared to store anything ("Secret, no safeguarding"). **Gotcha:** If 1b says "None" you cannot store classified at your site. All work happens at the customer location or an approved facility. ### Block 2 — Type of Contract Prime contract, subcontract, IDIQ, BPA, etc. Tells you where you sit in the contract chain. ### Block 3 — Contract Numbers and Dates The contract number and period of performance. Check the dates against your offer letter or subcontract agreement. Mismatches happen. ### Block 4 — Is This a Follow-On Contract? If yes, the previous contract number is listed. This matters for record retention and continuity of access. ### Block 5 — Final DD-254 Marked when the contract is closing out. Tells you to destroy or return classified material. ### Block 6 — Contractor Information Name, address, and CAGE code of the contractor. Confirm this is your company. ### Block 7 — Subcontractor Information If you are the prime and have cleared subs, they go here. ### Block 8 — Actual Performance Location Where the classified work happens. Customer site, your facility, both, or other. **Gotcha:** Remote cleared work usually requires a SCIF or approved alternate work location. "Work from home" and "Secret" do not mix unless you have a home SCIF. You do not have a home SCIF. ### Block 9 — General Identification of Procurement A short description of the contract. Read it. If it does not match what you were briefed on verbally, ask. ### Block 10 — Contractor Will Require Access To The heart of the form. Check boxes for the types of classified access you will have. Common ones: - 10a — COMSEC - 10b — Restricted Data - 10c — Critical Nuclear Weapon Design Information - 10d — Formerly Restricted Data - 10e — Intelligence Information (SCI, non-SCI) - 10f — Special Access Program (SAP) - 10g — NATO - 10h — Foreign Government Information Each box has its own training, briefings, and reporting requirements. SCI means you need SCI indoctrination. SAP means program-specific read-on. ### Block 11 — In Performing This Contract, the Contractor Will What activities you will actually do. Boxes for: receive classified, generate classified, fabricate hardware, perform services only, have TEMPEST requirements, have OPSEC requirements, and others. **Gotcha:** If 11 says you will generate classified and your team has no derivative classifier trained, you have a training gap before day one. ### Block 12 — Public Release Whether public release of information about the contract requires customer approval. Almost always yes for classified work. Do not post about the contract on LinkedIn. ### Block 13 — Security Guidance Where your classification guidance comes from. Usually a Security Classification Guide (SCG) referenced by number. You need to read that SCG before you can derivatively classify anything. ### Block 14 — Additional Security Requirements Free text. The customer adds anything the form did not cover. Read every word. Custom requirements live here. ### Block 15 — Inspections Which agency inspects your security program. Usually DCSA. Sometimes a different cognizant security agency for SCI or SAP. ### Block 16 — Certification and Signature Government signature block. If this is blank, the DD-254 is not in effect. --- ## Common gotchas - **Block 10 mismatch.** You were told the work was Secret. Block 10 has SCI checked. Stop. The clearance ramp-up just got months longer. - **Block 1b says "None" but you were told to expect to bring work home.** You cannot. Ask where the SCIF is. - **Block 13 references an SCG you do not have access to.** Ask the prime or FSO to provide it before kickoff. - **Block 8 lists a location that is not your office or the customer site.** Find out where it is and whether you have to relocate. - **No signed Block 16.** Not a real DD-254 yet. Do not start work. --- ## What to ask your FSO before you sign 1. Have you reviewed this DD-254? Does it match the FCL we hold? 2. Are all the boxes in Block 10 within what our personnel are cleared for today? 3. Do we have the training in place for Block 11 activities? 4. Where is the SCG referenced in Block 13? Can I get a copy? 5. What is our reporting obligation timeline once I am read on? 6. Are there any conflicting DD-254s on other contracts I support? --- ## What to ask the prime 1. Is this the final DD-254 or a draft? 2. Who is the customer Contracting Officer's Representative (COR) for security questions? 3. What is the read-on process and timeline? 4. Where is the performance location physically? Address, building, room. 5. Is there a separate SAP or SCI brief I will need beyond this DD-254? --- ## When to escalate to your security officer Escalate immediately if: - The DD-254 lists access you do not hold and no plan to upgrade exists. - The performance location is not approved for the safeguarding level. - You are asked to do classified work before the DD-254 is signed in Block 16. - The Block 14 text contains requirements your facility cannot meet (TEMPEST, two-person integrity, specific safe types). - The prime asks you to ignore or work around any block. A bad DD-254 is a security violation waiting to happen. A 30-minute conversation with your FSO is cheaper than a security incident report.