Item 1a of a DD Form 254 holds exactly one of three words: Confidential, Secret, or Top Secret. That single box sets the clearance level of every requisition you write against the contract. Name a higher level than the work needs and you commit your company to an investigation that costs about thirteen times more than the job requires. The DD-254, formally the DoD Contract Security Classification Specification, is an 18-item form the government attaches to a classified contract to tell the contractor precisely what it may see, store, and produce. For a recruiter or FSO, it is the source document behind every cleared posting, and reading it well means knowing which four or five boxes turn into posting language.

What is a DD-254, and who has to read it?

The DD Form 254 is the DoD Contract Security Classification Specification, the government’s authorized way to tell a contractor what classified information a contract involves. It runs 18 items, is generated in a system called NCCS, and lands on the facility security officer, who turns it into cleared work.

The instructions call a completed DD-254 “the principal authorized means for providing security classification guidance and the requirements to the contractor” for a contract requiring access to classified information. It is not advisory. It “contains 18 items,” each with one or more boxes that need a response, and it is generated in the National Industrial Security Program Contract Classification System, the NCCS, whose use is “required as applicable per FAR 4.402(d)(1).” It carries OMB Control Number 0704-0567. The rulebook behind it is the NISPOM, now also a federal regulation at 32 CFR part 117.

One point trips up new recruiters: the DD-254 governs a contractor, not a federal employee. The person who reads the form first and hardest is the facility security officer. If you recruit for cleared roles, the FSO can tell you what a given block on a live DD-254 actually permits.

How do Items 1a and 1b set the clearance level?

Item 1a lists the highest facility clearance the contract requires, and it can only read Confidential, Secret, or Top Secret. Item 1b is the level the contractor may store on site, or “None” if all access happens elsewhere. Together they define the clearance a posting has to ask for.

Start with 1a, because it is the spine. The instructions are strict: “Only one of three classification levels should be listed in this box: Confidential, Secret, or Top Secret.” They add what does not belong: “Do not cite special categories” such as Restricted Data, COMSEC, SCI, or SAP. A req that says “must hold TS/SCI” mixes two fields: the Top Secret piece comes from 1a, the SCI piece from Item 10. Put a special category on the clearance line and you have described a job the DD-254 does not.

Item 1b decides your logistics. It names the highest level of classified material the contractor may store at its own facility, and it cannot exceed 1a. When the entry reads “None,” the instructions explain that “the contractor will have access elsewhere to classified information or classified material,” at a government location or another cleared contractor. For a posting, that is a job at your secure site versus one badged into a customer SCIF across town. Check that your job has the correct clearance designation before it goes live.

What do Items 10 and 11 add that Item 1a doesn’t?

Item 1a gives the level. Items 10 and 11 give the shape. Item 10 lists special access the contractor needs, such as COMSEC, SCI, SAP, NATO, or foreign government information. Item 11 states what the contractor physically does with classified material, from access-only to generating it, plus flags like TEMPEST and CUI.

The header on Item 10 reads “Contractor Will Require Access To,” and its boxes carry the real specialization: Communications Security (COMSEC) information, Restricted Data, Critical Nuclear Weapon Design Information, Formerly Restricted Data, National Intelligence Information including Sensitive Compartmented Information, Special Access Program information, NATO information, and Foreign Government Information. A checked box is a second eligibility on top of the base clearance. When 10c for nuclear weapon design information is checked, 10b for Restricted Data comes with it. A recruiter who sees SCI checked in Item 10 knows the role needs a read-in, not just a Top Secret.

Item 11 answers a different question: what will the contractor do? Its header reads “Requirements Needed for Performance of the Contract,” and the boxes run from “access to classified information only at another location” (11a), to “receive and store classified documents only” (11b), to “receive, store and generate classified information or material” (11c). Others flag classified hardware (11d), services only (11e), access to U.S. classified information outside the country (11f), a COMSEC account (11h), a TEMPEST requirement (11i), and Controlled Unclassified Information (11l). Box 11f turns a stateside listing into an OCONUS role.

Why does over-stating the clearance cost real money?

The DD-254 instructions warn that naming a higher clearance than the work needs wastes money on investigations. A Secret-tier investigation ran $415 in FY2025; the Top Secret and SCI tier ran roughly 13 times more, at $5,355.

The instructions say it plainly: correct identification of the required clearance “minimizes unnecessary FCL upgrades or unnecessary costs associated with requests for personnel security clearance investigations at a level higher than required for contract performance.” Confidential and Secret eligibility rests on a Tier 3 investigation; Top Secret and SCI eligibility rests on a Tier 5. In FY2025, DCSA billed a standard Tier 3 at $415 and a standard Tier 5 at $5,355. A single needless jump swaps a $415 investigation for a $5,355 one, and FY2026 rates carry a further 10 percent increase.

A caveat: DCSA publishes the Secret-to-Tier-3 and Top-Secret-to-Tier-5 mapping as a standard Federal Investigative Standards structure, not one quotable rule, so treat it as settled convention. Public trust is separate. Tiers 1, 2, and 4 cover non-sensitive and public trust positions, which are not national security clearances, so a DD-254 clearance line never points at them. A Tier 5 reinvestigation, the cost behind a posting that demands a “current” Top Secret, ran $2,935 in FY2025. And the interim eligibility that starts a hire before the investigation closes is capped: a “temporary eligibility determination shall not exceed one year,” and “non-U.S. citizens are not eligible for access to classified information on a temporary basis,” under 32 CFR 117.10.

What does the DD-254 deliberately leave out?

The form does not carry the contract’s period of performance, so it never tells you how long the job lasts. It flows down to subcontractors, so a subcontract posting inherits the prime’s requirements. Item 13 holds the free-text guidance that resolves what the checkboxes cannot.

The DD-254 “is an attachment to the contract and does not include the contract expiration date,” so a recruiter who reads it for job duration finds nothing. What it does contain in prose is Item 13, Security Guidance, the free-text block the instructions set aside to “explain anything that might be unclear, confusing, or particularly important” and to expand on information referenced in another section of the form. When a checkbox and a hiring manager seem to disagree, Item 13 usually holds the reconciliation.

The form also travels. Under 32 CFR 117.17, a prime that puts classified work on a subcontract must incorporate both a “security requirements clause” and a “Contract Security Classification Specification” into the solicitation and the subcontract. That is why a staffing firm on a subcontract sees the prime’s clearance and access requirements: the DD-254 flowed down. When a candidate moves between contracts, their existing eligibility becomes the question, which is where clearance reciprocity and what a recruiter needs upfront to verify a clearance save a week.

What compliance still attaches to a cleared posting in 2026?

The affirmative-action order OFCCP long enforced, EO 11246, was revoked in 2025, and OFCCP was directed to stop enforcing it. Two obligations survive because they are statutory: VEVRAA for protected veterans and Section 503 for individuals with disabilities. CMMC cybersecurity levels now ride alongside the DD-254.

Executive Order 11246, the order behind race and sex affirmative action, was revoked by Executive Order 14173, signed January 21, 2025 and published January 31 at 90 FR 8633, with a 90-day wind-down. The same order told the Office of Federal Contract Compliance Programs to “immediately cease” holding contractors responsible for “affirmative action.” The old machinery, the equal-opportunity clause above $10,000 and the written program required at 50 employees and a $50,000 contract, still sits in 41 CFR part 60-1 but is no longer enforced. Do not tell a 2026 employer they owe an EO 11246 plan.

Two obligations did not go away, because Congress created them. VEVRAA, at 41 CFR part 60-300, still applies to sizeable contracts (the applicability text reads $100,000, the 2003 base figure, while the operative jurisdictional threshold is $150,000 after statutory inflation adjustment) and still requires an annual veteran hiring benchmark tied to the national percentage of veterans in the civilian labor force. Section 503 of the Rehabilitation Act, at 41 CFR part 60-741, still carries a 7 percent utilization goal for qualified individuals with disabilities and covers contracts in excess of $10,000 in the regulatory text.

The newer layer is cybersecurity. A modern DD-254 increasingly pairs with a CMMC requirement, defined by counts in the rule: Level 1 is 15 requirements, Level 2 is 110 requirements from NIST SP 800-171, and Level 3 adds 24 more from NIST SP 800-172, per 32 CFR part 170. The program rule took effect December 16, 2024, and the acquisition rule that writes CMMC into DoD contracts took effect November 10, 2025 at 90 FR 43560. One last translation for finance: a clearance requirement becomes a bill rate through the contractor’s wrap rate, direct labor plus allocated indirect costs under FAR 31.203 plus profit under FAR 15.404-4. No regulation sets a single multiplier; DCAA audits the actual rates, so any fixed multiple you see quoted is a guess.

Frequently Asked Questions

What clearance level does a DD-254 require?

Read Item 1a. It holds the highest facility clearance the contract requires, and it can only be Confidential, Secret, or Top Secret. That entry is the clearance level your job posting should ask for. If you see anything else there, such as SCI or a program name, the form is being read wrong: special categories belong in Item 10, not the clearance line.

Does the DD-254 tell me how long the contract lasts?

No. The form is an attachment to the contract and does not include the contract expiration date, so the period of performance is absent by design. If a candidate or a posting needs the job’s duration, get it from the program manager or the contract itself, not from the DD-254.

Can I list “TS/SCI” or a polygraph as the clearance level?

Not in Item 1a. That box takes only Confidential, Secret, or Top Secret and forbids special categories. The SCI half of “TS/SCI” comes from Item 10, where National Intelligence Information including SCI is checked. Treat the base clearance and the special access as two separate fields, because the form does.

Do cleared contractors still owe an affirmative action plan?

The EO 11246 affirmative action program for race and sex was revoked by Executive Order 14173 in January 2025, and OFCCP was directed to stop enforcing it. Two statutory obligations remain: VEVRAA for protected veterans, with an annual hiring benchmark, and Section 503 for individuals with disabilities, with a 7 percent utilization goal.

Who fills out and signs the DD-254?

The government contracting activity issues the original, or the prime contractor issues one for a subcontract, and it is certified by signature in Item 17. The form is generated in the NISP Contract Classification System, NCCS, whose use is required under FAR 4.402(d)(1). On the contractor side, the facility security officer reads it and turns it into cleared work.

With the CMMC acquisition rule live since November 2025, expect the DD-254s crossing your desk through 2026 to name a cybersecurity level beside the clearance level. The recruiter who reads Item 1a as a budget line rather than a checkbox is the one who stops posting Top Secret when Secret would do, keeping the $5,355 investigation for the jobs that truly need it instead of the $415 one. Read the form, not the rumor about the form. It is the only document on the contract that tells you exactly what the job is allowed to be.