FAR CLAUSE - 52.204-2  Security Requirements “CLAUSE”  

The Industrial Security Program prescribes requirements, restrictions, and other safeguards that are necessary to prevent unauthorized disclosure of classified information and to control authorized disclosure of information released by the US Government Executive Branch Departments and Agencies to their contractors. The proscribed Federal guidance is the National Industrial Security Program Manual (NISPOM).  

The Federal Acquisition Regulation (FAR) defines a “Classified Contract” as “Any contract that requires, or will require, access to classified information (Confidential, Secret, or Top Secret) by the contractor or its employees in the performance of the contract. A contract may be a classified contract even though the contract document itself is not classified.”  

All “Classified Contracts” must have, at a minimum, the Clause 52.204-2, Security Requirements, incorporated into the contract. This clause binds the contractor to meet the security requirements identified in the National Industrial Security Program Manual (NISPOM).  

The FAR states we “shall” use a DD Form 254 (Contract Security Classification Specifications) for classified contracts. This form must be part of the contract package and is used to identify other security requirements that HQDA would impose on a contractor. The DD Form 254 informs the contractor of the level of information they will be required to access, the level of security clearance the contractors will need, and how they will process, store, transmit, and destroy the classified information when the contract is complete.

If the contractor then subcontracts the work, they are obligated, under the National Industrial Security Program, to pass those requirements on to the subcontract.  

Contracts requiring work that is unclassified but sensitive should also be evaluated to ensure that contractors have undergone an appropriate level of background investigation to perform the required duties, and contractors must be made aware of any procedures or requirements regarding proper protection of unclassified but sensitive information.