The IT requirements on a government construction job arrive in the contract, not from a regulator, and on federal work they start with the fifteen safeguarding controls in FAR 52.204-21.
State and local jobs add their own. New York changed its rules on January 1, 2026, and most contractors I talk to have not caught up to what that one actually did.
Nobody writes to tell you about any of this. There is no inspector, no annual filing, no agency that sends a notice saying your network is now in scope. It shows up as a clause somewhere past page forty of a bid package, and the deadline attached to it is the bid deadline.
VJNetworks has worked with construction firms across Rockland, Westchester, and Bergen for over 20 years, and the pattern holds. Prevailing wage, bonding, certificates of insurance, all handled. The IT clauses get skimmed, because they read like boilerplate.
They are not boilerplate.
Our managed IT for construction companies work covers the day to day. What follows is narrower. It is the compliance side of chasing public work, and specifically what a firm has to be able to say yes to before it submits.
The Requirement Comes From the Contract, Not a Regulator
Here is the mechanic that trips people up. Federal IT obligations attach to information, not to your headcount or your revenue. So who is in scope? Anybody the clause lands on. There is no small-business carve-out.
Federal contract information is information, not intended for public release, that a federal agency gives you or that you generate for the agency under a contract to deliver a product or service. That is close to the wording in FAR 52.204-21 itself, and for a contractor it covers the drawings, the schedule, the RFIs, the submittals, the punch list.
Not the award announcement. That is public. Not the invoice either, since simple transactional information needed to process payment is carved out by name.
Everything else in that project folder is in scope from the day you win.
And it does not stop with you. Paragraph (c) of the clause tells the contractor to put the substance of it into subcontracts wherever a sub will have that information sitting on or moving through their systems, with commercially available off-the-shelf items as the only exception. Hand plans to a framing sub and their laptop is in scope. You are the one who put it there.
Fifteen Things, and You Are Signing That You Do Them
The clause lists the basic safeguarding controls it expects. Fifteen exactly. They are written in federal English, so here they are in the version a project manager can actually use.
- Access is limited to authorized people, processes, and devices, and then limited again to the specific transactions each one is allowed to run.
- Connections to outside systems get verified and controlled. That includes the personal phone syncing project files from a trailer.
- Whatever your systems publish publicly stays controlled.
- Every user, process, and device is identified and then authenticated before it gets access. In practice this is where multi-factor authentication lives.
- Media holding that information is sanitized or destroyed before disposal or reuse. Old laptops. Retired drives. The copier nobody thinks about.
- Physical access is limited to the people who should have it, visitors are escorted and logged, and keys and badges are managed.
- Traffic is monitored and protected at the boundaries of the network, and anything publicly reachable sits on its own subnet.
- System flaws get found, reported, and fixed in a timely manner, which is patching, described the long way.
- Protection against malicious code is in place, kept current as new releases ship, with periodic scans and real-time scanning of anything downloaded or opened.
None of that is exotic. A firm with a decent setup already does most of it. The gap is almost never the technology. It is that nobody can produce evidence of the boring half, and the boring half is what gets asked about.
Defense Work Raises the Bar, and the CMMC News Is Confusing Right Now
If a job touches the Department of Defense, and for a contractor that usually means an Army Corps of Engineers project, work on a base or a Reserve center, or a sub position under a prime doing that work, the clause changes. DFARS 252.204-7012 pulls in NIST Special Publication 800-171 and its 110 security requirements, and it gives you 72 hours to report a cyber incident to the Department after discovering one.
Then there is CMMC, where most of what you will find online is now out of date. Check publication dates.
On July 13, 2026, the Department of War suspended Phase II of the program. Phase II was the part requiring an independent third-party assessment before award, and it had been scheduled to begin November 10, 2026. That date is off. A reform task force reviewed the program, industry responses to its request for information closed on August 14, 2026, and its recommendations went to the department’s chief information officer in September. The department has not yet said publicly what it will change.
What did not change is the part that reaches smaller firms. Phase I is still in effect. Program managers can still write a CMMC Level 1 or Level 2 self-assessment requirement into a solicitation, and Level 1 is those same fifteen controls, assessed by you, once a year, with a senior company official affirming it in the Supplier Performance Risk System.
Read that last part again. A named person at your company signs it. Who, at your firm? If you want that work scoped properly before you commit to a bid, that is what our CMMC compliance services exist for.
The Same Standard, Three Different Editions
This is the part I have never seen a contractor be told plainly. NIST 800-171 is not one fixed target. It has editions. Which version you owe depends on which federal customer you are working for.
| Who the work is for | What applies | Requirements | Reporting window |
|---|---|---|---|
| Any federal agency, federal contract information only | FAR 52.204-21 | 15 | No reporting clause |
| Department of Defense, controlled unclassified information | NIST SP 800-171 Rev 2, via DFARS 252.204-7012 | 110 | 72 hours |
| GSA, controlled unclassified information | NIST SP 800-171 Rev 3 | 97 | 1 hour |
GSA moved first. Its internal IT security procedural guide CIO-IT Security-21-112, Revision 1, issued January 5, 2026, requires Revision 3 of 800-171 on contractor systems holding controlled unclassified information, and it asks for suspected and confirmed incidents to be reported within one hour of identification. Not one business day. That is sixty minutes, and you are told not to wait while you gather details.
So two federal customers, one standard, two editions of it, and reporting windows that differ by a factor of seventy-two. If your security documentation says you follow NIST 800-171 and stops there, it does not tell anybody which one you did.
The Rule That Reaches Every Contractor, Including the Ones Who Never Bid Federal
Most firms I speak with are not chasing federal jobs at all. They bid school districts, villages, town highway departments, a state agency project now and then. That work carries its own IT consequence and it landed recently.
New York now requires electronic certified payroll submission. It started January 1, 2026, for contractors and subcontractors on any project covered by Article 8 of the Labor Law, plus covered private projects under section 224-a and certain renewable energy projects under 224-d. Records go in at least every 30 days from the project start date, and that includes stretches where nobody worked. Run more than 14 days late and the penalty is $100 a day for every day after that. It compounds.
New Jersey got there first. Registered public works contractors have been filing through the New Jersey Wage Hub since August 15, 2024, within 10 days of each payroll, and that submission does not replace the unredacted hard copy you still owe the public body. You do both.
What does any of that have to do with your network? More than it looks like, once you consider what a certified payroll record actually is. Employee names, addresses, job classifications, hours, wage and benefit detail, assembled on a fixed schedule, sitting in your payroll system, leaving through a state portal on somebody’s login. Depending on which identifiers your payroll file carries, some of that meets the definition of private information under the New York SHIELD Act requirements, which already obliged you to protect it with reasonable safeguards. The obligation is not new. The volume and the cadence are.
There is a smaller problem hiding inside the big one. Somebody holds that portal login. The bookkeeper usually, sometimes the owner, occasionally an outside payroll service. When that person moves on, the access does not always move with them, and nobody notices because the filings keep going in.
Go ask who has it. Today, not after the next award.
What You Should Have Ready Before You Submit
- A named person who can sign an affirmation and back it up. Not a title on an org chart. A person who knows what they are attesting to.
- Multi-factor authentication on email and on anything holding project files. It is the first question on nearly every questionnaire, and the most common honest no.
- A written list of where project information actually lives. The server, Microsoft 365, the project management platform, the estimator’s laptop, the phone in the truck.
- Offboarding you can prove happened. A dated record beats a recollection.
- A restore you have run. A backup reporting green is not the same claim.
- Subcontract language that carries the clause downstream, before a prime asks whether you have it.
- Documented answers you can reuse. Most firms rewrite the same questionnaire from scratch every time, badly, under deadline.
If you cannot tell where you stand against that list, a security gap assessment gets you a scored answer and a ranked order to fix things in, which is a better use of a month than guessing.
Where This Usually Goes Wrong
Four patterns. They repeat.
The affirmation gets signed by whoever happened to be in the office that afternoon. It is a legal attestation about the state of your systems, submitted to a federal database, and it frequently gets treated like initialing a delivery ticket.
Subcontractors are the second one. The flowdown obligation is on you, so a sub running a decade-old machine with a shared password becomes your exposure, not just theirs. Most contractors have never asked a sub a single question about their systems. Not one. That is understandable. It is also the gap a prime will find when they audit you.
Third, the cloud answer. Moving project files into Microsoft 365 or a construction platform is genuinely good for most of the fifteen controls. It does nothing for offboarding, nothing for your subcontract language, and nothing for the fact that a departed superintendent still has the shared folder link in their personal account.
The fourth is documentation that describes an intention. Policies written to be filed rather than followed read fine until somebody asks for the log that proves the policy ran. Paper, not practice. Then it falls apart in about four minutes.
We work with firms of 5 to 60 employees, which is exactly the size where this lands hardest. Big enough to be bidding real public work. Small enough that the person handling IT questions is also the person handling everything else.
Before You Sign the Bid Package
We only sub for a general contractor. Does any of this land on us?
Is CMMC certification something we need before the next bid?
Nothing we do is classified. Doesn’t that put us outside all of this?
How much of this can we cover with what we already pay for?
What does the certified payroll change actually cost us in IT terms?
Who at our company should own this?
We are a small shop. Is public work worth the compliance overhead?
The honest summary is that none of this is hard, and most of it is not even expensive. It is unfamiliar, and it arrives on a bid deadline, which is the worst possible time to encounter something unfamiliar. The firms that handle it well did the work once, in a quiet month, and now answer questionnaires from a folder instead of from memory. That work sits inside our broader cybersecurity services practice.
Talk with our team about the IT and cybersecurity questions in your next bid package, before the deadline rather than after it. No cost, no obligation.