Reading a Solicitation for Security Requirements Before You Bid

Most small contractors read a solicitation the way they read a car lease: the price, the term, the part about what they’re actually getting, and then a skim of everything else. The security requirements live in the everything else. By the time they surface, usually during onboarding or the first time a prime sends a questionnaire, you’ve already bid, and maybe already won.

I wrote about the business side of the go/no-go decision in my post on bid/no-bid decisions. This post is narrower. It’s a method for finding every security obligation in a solicitation before you decide to bid, so the decision is based on what you’d actually be signing.

Know where the requirements hide

Negotiated federal solicitations follow the Uniform Contract Format in FAR 15.204-1. Smaller simplified acquisitions and RFQs are shorter and looser, but they still carry a clause list, and the same clauses show up in it. Once you know the layout, you know where to look. Security requirements can show up in almost any section, but these are the ones that matter.

Section C, the statement of work. This is where the government describes the job. Look for anything about handling technical data, access to government systems, working on site, or hosting data. A requirement here can pull in a lot of security obligations even if the clauses are thin.

Section H, special contract requirements. This is the agency’s catch-all for things that don’t fit elsewhere. Security language that isn’t a standard clause often lands here: personnel security, specific data handling rules, program-unique requirements.

Section I, contract clauses. The heart of it. Most clauses are listed by number and title only and “incorporated by reference,” which means the full text isn’t printed. They’re just as binding as if they were. You have to look each one up.

Section J, attachments. This is where the DD Form 254 lives for classified work, along with the SOW, CDRLs and any security attachments. Don’t stop at the main document.

Section K, representations and certifications. Things you’re attesting to by submitting an offer, including the Section 889 telecommunications representations.

Sections L and M, instructions and evaluation. Section L tells you what to put in your proposal, which sometimes includes a security narrative or proof of your SPRS score. Section M tells you how you’ll be scored. If security is an evaluation factor, it’s here.

The clauses to search for

Download every document in the package, including all attachments and amendments, and search for these. I’ve grouped them by what they trigger.

Cybersecurity and CUI

• FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems. Fifteen basic requirements for any system that handles Federal Contract Information. It’s in a huge number of contracts.
• DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. All 110 NIST SP 800-171 requirements, 72-hour incident reporting, and mandatory flowdown to subcontractors handling covered defense information. I covered it in DFARS 252.204-7012 in Plain English.
• DFARS 252.204-7008, the provision where you represent that you’ll implement NIST SP 800-171.
• DFARS 252.204-7019 and 252.204-7020, the NIST SP 800-171 assessment requirements tied to your SPRS score. Since February 2026, DoD’s Revolutionary FAR Overhaul class deviation has prescribed a new clause, DFARS 252.240-7997, NIST SP 800-171 DoD Assessment Requirements, so you may see that number in newer DoD solicitations.
• DFARS 252.204-7021 and 252.204-7025, the CMMC clause and its notice provision. Since September’s class deviation, contracting officers have been directed to remove third-party CMMC assessment requirements. Check the amendments, because a solicitation issued before the change may still carry the old language until it’s amended.
• DFARS 252.239-7010, Cloud Computing Services. If you’d be providing cloud services to DoD, this brings in the DoD Cloud Computing Security Requirements Guide and requires government data to stay in the United States unless the contracting officer says otherwise.

Supply chain prohibitions

• FAR 52.204-23, the Kaspersky prohibition.
• FAR 52.204-25, the Section 889 prohibition on certain telecommunications and video surveillance equipment, with its companion representations in Section K.
• FAR 52.204-27, the prohibition on TikTok (the clause calls it a ByteDance covered application) on devices used for the contract, including your employees’ devices if they use them for the work.
• FAR 52.240-1, the prohibition on drones from covered foreign entities, which took full effect for operating or buying them on 22 December 2025. If your work involves aerial photography, surveying or inspection, read this one.

Export control and classified work

• DFARS 252.225-7048, Export-Controlled Items. A signal that ITAR or EAR data is involved, which changes who in your company can touch it.
• FAR 52.204-2, Security Requirements, plus a DD Form 254. This is classified work, which needs a facility clearance. If you don’t have one, you need a sponsor, and that’s a months-long process, not a proposal task.

The reporting clocks most people miss

One detail is easy to overlook and very hard to fix later: several of these clauses come with reporting deadlines, and they’re short.

Under 52.204-25, if you find covered telecommunications equipment in use during contract performance, you have to report it within one business day, with a fuller report within ten. Under 52.204-23, it’s three business days for Kaspersky products. Under 252.204-7012, a cyber incident has to be reported within 72 hours, and doing that requires a DoD-approved medium assurance certificate that takes weeks to obtain.

Nobody reads those deadlines during a proposal crunch. Everybody wishes they had when one comes due. If the clause is in the solicitation, the clock is part of the job you’re bidding on, so make sure someone in your company owns each one before you submit.

What about civilian agencies?

The government-wide FAR rule for CUI still isn’t final. It was proposed in January 2025, and its content was folded into a FAR overhaul proposed rule published in June 2026. Until something is final, civilian agency contracts mostly won’t carry a standard FAR CUI clause, so read Section C and Section H carefully for agency-specific data handling requirements instead.

Where to find everything on SAM.gov

FAR 5.102 requires solicitations to be posted on SAM.gov, including attachments and specifications. Two habits will save you.

Get every attachment. Some technical data packages are posted with access controls because they’re export controlled, and you have to request access. If the drawings are controlled, that’s a signal in itself: you’ll be handling CUI if you win.

Read every amendment. Under FAR 15.206, changes to a solicitation go out as amendments. Clauses get added and removed this way, and this year that’s happening a lot. The final version of the solicitation is the one you’re bidding on.

Use the question period

Most solicitations give you a window to submit questions, and the answers usually come back as an amendment that every offeror can read. Small contractors underuse this, especially on security.

If the security requirements are unclear, ask. Some questions that are almost always worth submitting when the answer isn’t obvious:

• Will contract performance involve Controlled Unclassified Information, and if so, which categories?
• Will the government furnish any CUI, or will CUI be generated only during performance?
• Is a current NIST SP 800-171 assessment score in SPRS required at the time of proposal submission, or at award?
• Does the government anticipate any cloud-hosted deliverables or data, and is FedRAMP authorization expected?
• Will a DD Form 254 be issued, and at what level?

Phrase them neutrally and keep them specific. You’re not admitting a weakness by asking. Every other offeror wants the same answers, and the contracting officer would rather clarify now than deal with a protest later. The answers also become part of the record, which helps you if the requirement changes after award.

There’s a quieter benefit too. The answer to “will this involve CUI?” tells you how much of your company has to be in scope. A “no” can save you a lot of money. A “yes, but only in the technical data package” tells you exactly how small your enclave can be.

A worked example

Here’s how this plays out on a typical small-business solicitation for machined parts. The package has a short base document, a clause list, and a drawing package posted as a controlled attachment.

The clause list includes 52.204-21, 252.204-7012, 252.225-7048 and 52.204-25. That alone tells you most of what you need. The drawings are controlled and likely export controlled, so you’ll be handling CUI. 7012 means all 110 NIST SP 800-171 requirements apply to whatever system touches those drawings, and the export control clause means you have to know who in your shop is a U.S. person before anyone opens them. The Section 889 clause means you need to know what’s on your network, including the cameras and the phone system.

None of that is in the statement of work, which only describes the parts. A shop that read the SOW and the price sheet would have missed every one of those obligations.

A one-hour method

Before you commit proposal hours, block one hour and do this.

• Download the full package: base solicitation, all attachments, all amendments.
• Search everything for “52.204”, “252.204”, “252.239”, “252.225-7048”, “252.240”, “52.240”, “DD 254”, “800-171”, “CUI”, “FedRAMP” and “export”.
• Write down every clause you find and what it requires of you.
• Check Section L for any security material you have to submit with the proposal.
• Check Section M for whether security is evaluated.
• Read Sections C and H for non-clause security requirements.
• Compare the list to what you can actually do today, and what it’d cost to close the gap.

That last step is where the bid decision happens. If the solicitation carries 7012 and you’ve never done a NIST SP 800-171 assessment, you aren’t one proposal away from this contract. You’re months away. Better to know that before you write the proposal than after you win it. If you’re not sure whether the work would put you at Level 1 or Level 2, start with Level 1 vs Level 2.

---

Where to go next

• Found 7012 in the clause list and not sure you’re ready? The CMMC readiness quiz takes about five minutes.
• Our CMMC guide for small contractors walks through the levels from the beginning.
• Need documentation in place before you bid? Start with our CMMC packets.