# Security for construction firms and government contractors

> Construction firms working on federal contracts must apply the basic safeguarding controls in FAR 52.204-21, and those handling controlled defense information also face DFARS and CMMC requirements. CyberAccord helps contractors meet those clauses, protect email and payments against fraud, manage field devices and answer owner and insurer security questionnaires.

Source: https://www.cyberaccord.com/industries/construction · Last reviewed: 2026-10-22

Federal projects bring contract cybersecurity clauses, and every firm moves large payments by email. We help contractors meet contract requirements, protect job sites and field devices, and answer owner and insurer questionnaires.

## Key facts

- **Federal work:** FAR 52.204-21 basic safeguarding
- **DoD projects:** DFARS 252.204-7012 and CMMC
- **Main threat:** Payment and invoice fraud by email
- **Reference model:** NIST Cybersecurity Framework 2.0

## The obligations and risks you face

### Federal contracts require basic safeguarding

FAR 52.204-21 applies when a contractor's information systems hold Federal Contract Information. It requires basic controls such as limiting access to authorized users, authenticating users, sanitizing media, controlling physical access, and keeping malware protection current. CMMC Level 1 assesses the same requirements on DoD work.

Source: [FAR 52.204-21](https://www.acquisition.gov/far/52.204-21)

### Defense projects can bring NIST SP 800-171

Military construction and other DoD projects can involve Controlled Unclassified Information, such as facility drawings. When they do, DFARS 252.204-7012 requires NIST SP 800-171 and reporting cyber incidents to DoD within 72 hours of discovery.

Source: [DFARS 252.204-7012 (May 2024)](https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting.)

### Owners and insurers expect a recognizable program

NIST Cybersecurity Framework 2.0 is voluntary, but it gives owners, insurers and lenders a common language: govern, identify, protect, detect, respond and recover. Organizing your program around it makes questionnaires easier to answer consistently.

Source: [NIST Cybersecurity Framework 2.0](https://www.nist.gov/cyberframework)

## What we recommend

- [Managed Security](https://www.cyberaccord.com/services/managed-security)
- [Security Questionnaires](https://www.cyberaccord.com/services/advisory/security-questionnaires)
- [vCISO](https://www.cyberaccord.com/services/advisory/vciso)

## Applicable frameworks

- [NIST](https://www.cyberaccord.com/compliance/nist)

## Frequently asked questions

### How do we stop fraudulent payment change requests?

Protect every mailbox with multi-factor authentication and managed email security, and adopt a rule that any change to bank details for a subcontractor, supplier or owner is confirmed by phone using a number already on file.

### How do we secure tablets and laptops on job sites?

Enroll them in device management, encrypt them, require a screen lock, apply managed endpoint protection and keep the ability to wipe them remotely. Shared site devices should use individual sign-ins rather than one common account.

### Do we need CMMC for a DoD construction contract?

Only if the contract includes the CMMC clause. The required level depends on whether you handle Federal Contract Information or Controlled Unclassified Information. CyberAccord helps you prepare; certification assessments are performed by an authorized C3PAO.

## Contact CyberAccord

- Book a free consultation: https://www.cyberaccord.com/contact
- Phone: +1 (832) 429-5665
- Email: info@cyberaccord.com