Contractors and Builders
Security for construction firms and government contractors
Federal projects bring contract cybersecurity clauses, and every firm moves large payments by email. We help contractors meet contract requirements, protect job sites and field devices, and answer owner and insurer questionnaires.
- Federal work
- FAR 52.204-21 basic safeguarding
- DoD projects
- DFARS 252.204-7012 and CMMC
- Main threat
- Payment and invoice fraud by email
- Reference model
- NIST Cybersecurity Framework 2.0
At a glance
Construction firms working on federal contracts must apply the basic safeguarding controls in FAR 52.204-21, and those handling controlled defense information also face DFARS and CMMC requirements. CyberAccord helps contractors meet those clauses, protect email and payments against fraud, manage field devices and answer owner and insurer security questionnaires.
FAR 52.204-21, Basic Safeguarding
The obligations you face
Each point below rests on a primary source. Follow the link to read the rule itself.
Federal contracts require basic safeguarding
FAR 52.204-21 applies when a contractor's information systems hold Federal Contract Information. It requires basic controls such as limiting access to authorized users, authenticating users, sanitizing media, controlling physical access, and keeping malware protection current. CMMC Level 1 assesses the same requirements on DoD work.
Defense projects can bring NIST SP 800-171
Military construction and other DoD projects can involve Controlled Unclassified Information, such as facility drawings. When they do, DFARS 252.204-7012 requires NIST SP 800-171 and reporting cyber incidents to DoD within 72 hours of discovery.
Owners and insurers expect a recognizable program
NIST Cybersecurity Framework 2.0 is voluntary, but it gives owners, insurers and lenders a common language: govern, identify, protect, detect, respond and recover. Organizing your program around it makes questionnaires easier to answer consistently.
Sources last reviewed . This page explains obligations in general terms and is not legal advice.
Recommended services
What we recommend
Three services, most relevant first, chosen for the obligations above.
- 1 · Managed Security ServicesManaged SecurityManaged endpoint, email, and cloud security, with a team that monitors alerts and responds to incidents for you.
- 2 · Security QuestionnairesSecurity QuestionnairesHelp completing SIG, CAIQ, HECVAT, VSA, and custom vendor security questionnaires accurately, plus a reusable answer library.
- 3 · Virtual CISOvCISOA part-time, U.S.-based security executive who leads your security program, manages risk, and reports to leadership.
Frameworks that apply
FAQ
Sector questions, answered
How do we stop fraudulent payment change requests?
Protect every mailbox with multi-factor authentication and managed email security, and adopt a rule that any change to bank details for a subcontractor, supplier or owner is confirmed by phone using a number already on file.
How do we secure tablets and laptops on job sites?
Enroll them in device management, encrypt them, require a screen lock, apply managed endpoint protection and keep the ability to wipe them remotely. Shared site devices should use individual sign-ins rather than one common account.
Do we need CMMC for a DoD construction contract?
Only if the contract includes the CMMC clause. The required level depends on whether you handle Federal Contract Information or Controlled Unclassified Information. CyberAccord helps you prepare; certification assessments are performed by an authorized C3PAO.
Talk to a security practitioner
Tell us what is driving the need: an audit, a client questionnaire, a contract clause or an insurance renewal. We'll recommend a scoped next step with a fixed quote.