Regarding requirements for the DD Form 254, FAR 4.402 tells us that the DD Form 254 is required when contractors require access to information classified as  "Confidential", "Secret", or "Top Secret". This form shall be completed electronically in PIEE. This FAR reference does not address where the DD Form 254 must be attached to the basic IDIQ or at the order level. DFARS PGI 204.403 says that solicitations shall include the draft DD Form 254, clause 52.204-2 and instructions to request access to classified information (an example is provided for these instructions). You will need to check your corresponding agency regulation and/or instructions to see what your agency requirements are. If all of these references are silent regarding if the DD Form 254 is attached to the basic IDIQ or order level, then it is the contracting officer who will work with their security POCs to determine which one makes the most sense. 

As to performance of a contractor under a basic IDIQ, the contractor has to adhere to the requirements in the basic IDIQ but funding and delivery will happen at the order level. An example of one of these requirements is FAR clause 52.204-2 and any applicable agency clauses would be incorporated at the basic IDIQ level and the contractor would be required to follow those clauses for all orders issued under that basic IDIQ. The prime contractor must flow down the requirements from the basic IDIQ to their subcontracts where applicable, and then the prime must ensure the sub is performing against the flow down requirements. 

The following link may be of help for more info on single award IDIQs at https://aaf.dau.edu/aaf/contracting-cone/idiq/single-award/