When Your Firm Wins a Municipal Contract: The IT Requirements Buried in the RFP

When an architecture or engineering firm wins a municipal contract, the IT requirements usually arrive disguised as insurance, records retention, accessibility, and public-records terms, and the firm is bound by every one of them the day it signs.

None of them say IT in the heading. That’s the problem.

A lot of what gets written about government work and technology is about federal defense contracts and CMMC compliance, and it doesn’t transfer cleanly to a village, a town, or a county. A municipal contract doesn’t impose CMMC on its own. Federal grant money sitting inside the project doesn’t drag it in either, because a grant runs under a different rulebook than a federal purchase. What a municipal contract brings instead is quieter. It also weighs more on a twelve-person firm than on a twelve-hundred-person one, because the small firm has nobody whose job it is to read it.

Here’s how it usually goes. The scope of work, the fee schedule, and the milestone dates get read by three people, twice. The insurance exhibit gets forwarded to the broker. The general conditions get initialed on every page by whoever is holding the pen. Nobody reads them twice. Somewhere in those last two documents are promises about how your firm will store, protect, keep, and hand over electronic files, made by people who weren’t thinking about your network when they made them.

I earned an electrical engineering degree before I moved into IT full time, and VJNetworks has been supporting businesses across Rockland, Westchester, and Bergen for over 20 years. Design firms are their own kind of client. The work product is the files. When a contract makes a promise about files, it’s making a promise about the business.

What Counts as an IT Requirement in a Municipal Contract

An IT requirement in a municipal contract is any term that controls how your firm creates, stores, protects, keeps, or delivers electronic information for the project. Very few of them sit in the scope of work. They live in the insurance exhibit, the general conditions, the records clause, the deliverables clause, the grant attachments, and in state public-records law, which isn’t in the contract at all.

Seven places to look.

The Insurance Exhibit Is Where Cyber Shows Up, When It Does

Start with the honest version. Of the municipal architecture and engineering agreements we pulled while writing this, most asked for professional liability, general liability, and auto, and said nothing about cyber at all. Not a word. Suffolk County’s consultant template doesn’t mention it. Neither does a June 2026 RFP from the Village of Mamaroneck.

Then there’s the other kind. The Port Authority’s insurance requirements for consultants on design work include cyber liability “if applicable” at $2 million per occurrence or claim, and they spell out what it has to cover, from information theft and extortion to network security, breach response costs, “regulatory fines and penalties,” and credit monitoring. Real coverage. Real premium. Rockland’s county government publishes a vendor insurance guide with a $2 million data breach and privacy line, and a note recommending higher limits when personal identifying information is part of the contract. That line sits on the page for technology consultants and cloud storage vendors. The page for architects and engineers doesn’t have one.

For now.

Why care, if your contract is silent? Because the line between a design firm and a technology consultant gets thin fast. Host a public-comment website for a corridor study, hold a utility’s customer records for a rate analysis, or keep a police department’s floor plans on a file share, and you look a lot more like the vendor on that other page. And when a cyber requirement does appear, you can’t satisfy it by signing a certificate. The carrier sends an application first, and it asks whether multi-factor authentication is enforced, whether endpoint protection is running on every machine, and whether your backups can actually be restored. Firms find out what they really have at that moment, usually on a deadline, which is why our cyber insurance readiness work starts with the evidence instead of the form.

The Confidentiality Clause Has a Clock in It

Almost every set of general conditions has a confidentiality paragraph. Battery Park City Authority’s on-call A/E agreement is a clean example. Data, reports, and other materials developed in the work are “strictly confidential,” and the consultant can’t disclose them without written approval. Nobody argues with that.

Suffolk County, out on Long Island, goes a lot further. Its consultant template has the firm certify that “it has policies and procedures in place for the effective management of any cyber security breach, event or attack,” and then requires notice to the county’s Chief Information Security Officer within 48 hours. Two days. Would anyone at your firm know within two days that a laptop full of county drawings had been compromised? Who would they call? Be honest. And if there’s no written incident plan, that certification is inaccurate the moment somebody signs it.

Closer to home, Westchester’s county IT policy on sensitive personal information covers “consultants, interns, temporaries and vendors, who have access to County technology facilities, computers or networks.” Contractors need a nondisclosure agreement on file before they handle sensitive personal data, and the policy says plainly that “Sensitive PII in electronic form must be encrypted.” A separate county policy has vendors who connect to the county network submit an access request every year and meet the county’s security requirements. Every year.

State law sits underneath all of it. New York’s SHIELD Act requires any business holding New Yorkers’ private information to maintain reasonable safeguards, scaled down for a small business, which the law defines as fewer than fifty employees, under $3 million in annual revenue, or under $5 million in assets. Our SHIELD Act guide for small businesses covers what reasonable looks like. The part that matters on a municipal job is the notification rule for data you hold but don’t own. If a breach exposes private information, as the statute defines it, in data that belongs to someone else, the statute says you notify the owner “immediately,” and within thirty days of discovery at the outside. On a municipal job, the owner is the town. You make that call.

The Accessibility Clause Now Reaches Your PDFs

This is the one almost nobody on the design side has heard about yet, and the one most likely to cost you rework.

In 2024 the Justice Department finished a rule under Title II of the Americans with Disabilities Act that requires state and local governments to make their websites, and the documents on them, conform to WCAG 2.1 Level AA. It covers content a public entity provides “directly or through contractual, licensing, or other arrangements.” Read that clause the way an engineer would. The traffic study, the feasibility report, the slide deck for the public hearing, the PDF of the concept plan posted for comment. If the town posts it, the town owns the obligation, and the town will push it back to you through the contract. That’s a lot of PDFs.

The dates moved. A lot of what you’ll find online still says April 2026, and that’s out of date. An interim final rule published April 20, 2026, pushed compliance to April 26, 2027, for governments serving 50,000 people or more, and to April 26, 2028, for smaller ones and for special districts. Disability advocates sued in May to undo the delay, and the Justice Department has said it may revisit the substance of the rule. So the dates could shift again. The direction won’t.

Municipalities aren’t all waiting. A 2026 comprehensive plan RFP from the City of Wayzata, in Minnesota, says “Any public facing documents including PDFs, websites, and mobile applications created for the City of Wayzata must conform to Web Content Accessibility Guidelines (WCAG) 2.1 Level AA guidelines.” One sentence in a deliverables list, easy to skim past. New Jersey townships get there by a different road. Engineering RFQs like South Brunswick’s make Title II of the ADA, and “the rules and regulations promulgated pursuant thereunto,” part of the contract, with an indemnity attached. The web rule is one of those regulations. Nobody has to type the letters WCAG for it to be in there.

What does compliance look like on an ordinary Tuesday? A report exported from Word with real headings, alt text on the figures, and a tagged PDF that a screen reader can follow in order. A scanned document isn’t that. Neither is a file sent through a print-to-PDF driver, which throws the structure away. Full drawing sets are genuinely hard to make accessible, and the rule’s exceptions may or may not fit your situation, so that’s a conversation to have with the municipality before you promise anything in a proposal. Reports, memos, and presentations are the realistic target, and they’re most of what gets posted anyway.

Some of this is software. More of it is habit.

Your Drawings Are Public Records, Unless Someone Says Otherwise

New York’s Freedom of Information Law defines a record as information held by or for an agency “in any physical form whatsoever,” names “designs, drawings, maps” specifically, and counts “any state or municipal department” as an agency. New Jersey’s Open Public Records Act lists any “drawing, map, plan” in the same way. Once your drawings are in the town’s hands, they’re the town’s records, and anybody can ask for them. Anybody means anybody.

Both states carve out exceptions. New York lets an agency withhold records that “if disclosed could endanger the life or safety of any person,” and records that would jeopardize the security of its information technology assets. New Jersey’s exemption covers “emergency or security information or procedures for any buildings or facility which, if disclosed, would jeopardize security of the building or facility or persons therein,” along with security measures and surveillance techniques. For a design firm, that means things like the camera layout in a police station, the control room at a water plant, and the access-control riser for a courthouse.

The exemptions protect the town’s records. They don’t protect your copy.

That’s the IT half. If a municipality treats a drawing set as security information, it’s going to expect you to as well, and plenty of firms still move full sets around as email attachments, or through a personal file-sharing account somebody set up years ago and never closed. Water is the sharpest example. Under America’s Water Infrastructure Act, every community water system serving more than 3,300 people has to assess its risks, including its “electronic, computer, or other automated systems,” and keep an emergency response plan. Systems are told not to send the actual assessment to EPA, and EPA’s own FAQ says the emergency response plan “has no special exemption” under that law from a state or local public-records request. When an engineering firm helps prepare one of those, the firm’s project folder may hold one of the most complete copies anywhere outside the utility.

So mark what’s sensitive, in writing, with the reason, when you hand it over. Keep a list of who received which set. Share through links that expire instead of attachments that live forever in somebody’s inbox. New York does have a formal procedure for asking, at submission, that trade-secret material be withheld, but as written it’s aimed at state agencies. With a town or a village you’re relying on the exemptions themselves, which is one more argument for putting it on paper.

When Federal Money Is Inside the Project

A lot of municipal design work is paid for, at least partly, with federal grants. FEMA money, EPA revolving funds, highway money, community development money. Owners hear “federal” and assume the whole federal contractor rulebook came with it.

It didn’t.

Federal procurement rules, the ones behind the fifteen basic safeguarding controls and CMMC, apply when the federal government buys something for its own use. A grant is a transfer of money to the town, and it runs under the Uniform Guidance in 2 CFR Part 200 instead. A municipality can still write its own security terms into your contract, and some do. Nothing in the grant forces the defense-contractor version onto you.

What the grant does bring is less famous and more practical, and for a design firm it comes in two pieces.

The first is an equipment ban. 2 CFR 200.216 bars recipients and subrecipients from spending grant or loan funds on telecommunications equipment made by Huawei or ZTE. It also bars video surveillance and telecommunications equipment made by Hytera, Hikvision, or Dahua when it’s used for public safety, the security of government facilities, or surveillance of critical infrastructure, and it reaches any system that uses covered gear “as a substantial or essential component.” Contracts under the grant have to carry the provision. Yours included. Notice where it bites. It doesn’t care what’s in your own server closet. It cares what’s in your specifications, and an engineer who writes a Hikvision camera line or a Hytera radio into the security section of a grant-funded public safety building has just handed the town a compliance problem.

The second is records. The Uniform Guidance requires grant records to be kept for three years from the date the final financial report is submitted, longer if there’s litigation or an open audit finding, and it gives the federal agency, the pass-through entity, the inspectors general, and the Comptroller General of the United States a right of access to them. The clock starts when the town closes out the grant, not when you finish your phase. Nobody tells you it started.

The Records Clause Outlives the Project

Numbers first. The standard municipal consultant agreement from the New York State Department of Transportation, the form used when a village or town hires an engineer on a locally administered highway project, says records “must be kept for a minimum of six (6) years or three (3) years after final payment is received, whichever is later,” with access for the municipality, the state, and the Federal Highway Administration. Suffolk’s template says seven years after final payment. New Jersey went further and made it a regulation. N.J.A.C. 19:70-1.6, renumbered from its older citation in 2025, requires the public entities it covers to put a five-year retention clause in their contracts, with the records available to the Office of the State Comptroller on request. It shows up in Bergen bid documents, Wyckoff’s among them.

Six or seven years is longer than most firms keep a file server. It’s longer than most backup plans keep anything. A backup exists to put last Tuesday back. An archive exists to hand an auditor a complete project file in 2032, from hardware you haven’t bought yet. Different jobs. They often get treated as one. Project storage at design firms also grows fast, which we covered in our look at BIM and CAD files on a firm’s network, so the archive that fit on one drive five years ago doesn’t anymore.

Then there’s the format question. Deliverables clauses are getting specific. The Village of Mamaroneck’s June 2026 RFP for its Beaver Swamp Brook project wants designs, drawings, and plans “in the original software that they were created (such as CAD format or other similar product acceptable to the Village), as well as in JPG format,” with GIS data in ArcGIS format, and it makes all of it the village’s property as work made for hire. The Village of Ossining asked for “all digital files (AutoCAD, MS Word, MS Excel, etc.)” on a 2023 transportation project. Everything, in other words. Native files are version-sensitive. A model saved in a newer release of the software generally won’t open in an older one, and some of your staff will be on a different release by the time anybody asks. Export a full PDF set at closeout, record which software version produced the native files, and keep both in the archive, not just on the project server. Our backup and disaster recovery work is built around restores that have actually been tested, and an archive deserves the same test.

Before You Sign the Next One

• Send the insurance exhibit to your broker and to whoever runs your IT on the same day. The broker prices it. IT tells you whether you can truthfully answer the application.
• Find the breach-notification clock in the general conditions and write it on your incident plan. No incident plan? That’s the finding.
• Records. How long, starting when, and open to whom?
• Ask the client which deliverables will be posted publicly before you price the job, since accessible reports take more hours than inaccessible ones.
• On a grant-funded project, check the security and communications sections of your specifications for the manufacturers named in 200.216.
• Decide which drawings are security-sensitive and say so in writing when you hand them over.
• Close the personal file-sharing accounts. All of them.

If you can’t answer most of that list with evidence instead of a shrug, a NIST CSF gap assessment is a sensible way to find the holes, and it leaves you with written answers you can reuse the next time an insurer or a county IT department asks.

What Principals Want to Know Before Signing

None of this is legal advice. Your attorney reads the contract. What we can do is read the parts about files, tell you which promises your setup can already keep, and fix the ones it can’t before a town finds out for you. VJNetworks provides IT for professional services firms of 5 to 60 people across the Tri-State area, which is exactly the size where one principal ends up holding all of this at once.