You’re partway through a solicitation, or reading a contract that’s already been sent over, and you hit a section about data handling and information security. It asks how you protect the information you’ll be given. Whether you use multi-factor authentication. How quickly you’d report an incident. Whether your subcontractors are held to the same terms.
Nobody in your company can answer it. Not honestly, anyway.
This is one of the most common situations we see with Sacramento-area businesses, and it usually arrives at the worst time: close to a deadline, after the work of putting a proposal together has already been done.
Before going further, one thing to be clear about. Security requirements are not uniform across public contracting. They vary by agency, by contract, by the type of data involved, and by whether federal funding or federal data is in scope. Nothing in this article tells you what applies to your opportunity. Your solicitation and contract documents are the authority, and your contracting officer is who to ask when the language is unclear. What this article does is explain what those requirements are asking for in technical terms, and what it takes to be able to say yes truthfully.
Why Sacramento Businesses Run Into This More Than Most
Geography matters here. Sacramento is the seat of California state government, which means a concentration of agencies, departments and public institutions that no other city in the state comes close to. Add Sacramento County, the City of Sacramento, regional districts, and the universities, and the volume of public contracting activity in this region is unusual.
The result is that a large share of businesses in Downtown Sacramento, Midtown, Natomas, Rancho Cordova and West Sacramento either hold a public contract, want one, or work for someone who does.
That third category catches people off guard. You can be pulled into security obligations without ever bidding on anything, simply by subcontracting to a prime who holds a public contract. The prime is responsible for the terms they agreed to, and they generally pass those terms down to everyone touching the work.
What Agencies Are Actually Trying to Establish
Strip away the acronyms and the questionnaire formatting, and there are four questions underneath all of it.
Can you protect the data we give you? Not in principle. Specifically, with controls that exist right now.
Can you prove it? This is where most small firms fall down, and we’ll come back to it.
What happens when something goes wrong? Because they assume it eventually will. They want to know you have a plan and that you’ll tell them within whatever window the contract specifies.
Who else touches it? Your staff, your subs, your cloud providers, your IT company. Anyone with access is part of the risk they’re taking on.
Read your questionnaire with those four questions in mind and most of it stops looking like bureaucracy.
The Categories of Requirement You’re Likely to See
What follows are the areas that commonly appear in public-sector security terms. Whether any specific item applies to you, and in what depth, depends entirely on your contract.
| Requirement area | What it means in practice | What proves it |
| Access and identity | Named accounts, role-based access, MFA on anything reaching contract data | User list, access review records, MFA coverage report |
| Encryption | Data protected at rest and in transit, including email and remote sessions | Configuration records and device encryption status |
| Logging and monitoring | A record of who accessed what, retained long enough to be useful | Log samples, retention settings, monitoring reports |
| Backup and recovery | Isolated backups with tested restores and defined recovery times | Restore test records with dates and outcomes |
| Incident response | A written plan and the ability to meet contract notification timelines | The plan itself, plus evidence it has been reviewed |
| Vendor oversight | Knowing which third parties touch the data, including your IT provider | Vendor list, agreements, security terms in place |
| Staff training | Security awareness delivered regularly, not once at onboarding | Completion records by person and date |
| Disposal and return | Data returned or destroyed at contract end, provably | Certificates of destruction or return confirmations |
Access Control and Identity
Named accounts for every person, permissions matched to role, and multi-factor authentication on anything that reaches contract data. Shared logins are the most common failure we find, and they break more than one requirement at once, because if four people use the same account, no log can establish who did anything. Fixing this is usually quick and sits inside standard managed IT services.
Encryption
Data protected at rest on servers and devices, and in transit when it moves. That includes email carrying contract information and remote connections from home offices. Device-level encryption is often already available on hardware you own and simply hasn’t been turned on or documented.
Logging, Monitoring and Evidence
A record of access that’s actually retained. Plenty of systems log by default and then discard the logs within days, which is not much use when someone asks what happened three weeks ago. Continuous network monitoring and management produces both the security benefit and the reporting you’ll be asked for.
Backup, Recovery and Continuity
Contracts often speak to continuity of service rather than backup mechanics. The practical translation: isolated, encrypted backups, defined recovery times, and evidence that restores have been tested. Untested backups fail this on the evidence point even when the technology is sound, which is why backup and disaster recovery should include a documented test schedule.
Incident Response and Notification
Two parts. A written plan describing what your firm does when something happens, and the operational ability to notify within whatever timeline your contract sets. Notification windows in public contracts can be short. Read yours, because this is one term people agree to without checking whether they could actually meet it.
Vendor and Subcontractor Oversight
You’re expected to know who else touches the data and to hold them to comparable terms. Your IT provider is squarely in that group. If they have administrative access to your systems, they’re part of your compliance picture whether anyone has thought about it or not.
Personnel Security and Training
Security awareness training delivered on a schedule, with records showing who completed what and when. Some contracts also address background screening for staff working on the engagement. The training records are the part firms forget until they’re asked for them.
Disposal and Data Return
At contract end, data typically must be returned or destroyed, and you may need to evidence it. This includes copies sitting on old workstations and decommissioned drives. Proper endpoint and workstation protection and asset tracking make this straightforward rather than an archaeology project.
Where Frameworks Come Into It
Solicitations sometimes reference an established framework rather than listing controls. You may see NIST publications, CJIS requirements where criminal justice information is involved, StateRAMP or FedRAMP for cloud services, CMMC on federally connected defense work, or a request for a SOC 2 report.
These are not equivalent, and the gap between them is large. Some describe a set of practices you implement and document. Others involve formal assessment by an external party, with meaningful cost and lead time. Confusing one for another is expensive in both directions.
Assume the heaviest framework applies when it doesn’t, and you’ll spend money and months you didn’t need to spend. Assume none applies when one does, and you lose the contract or, worse, win it and can’t meet the terms.
So don’t assume either way. Find the specific language in your solicitation, and if it’s ambiguous, ask the contracting officer during the question period. That’s what the question period is for. An IT provider can tell you what a requirement means technically and what it would take to satisfy it. Whether it applies to your opportunity is a procurement question, and it belongs with the agency and your own counsel.
Most Firms Fail on Evidence, Not on Security
This is the part worth slowing down for.
A fair number of the businesses we assess have reasonable security. Decent firewall, current antivirus, backups running, sensible people who don’t click obvious nonsense. What they don’t have is any way to demonstrate it to a third party.
A questionnaire doesn’t ask whether you feel secure. It asks whether you have a written information security policy, when your last risk assessment was, whether staff completed training and when, whether you have an incident response plan, and whether you can produce access logs. Those are documents. You either have them or you don’t.
And here’s why it matters for timing: controls can often be deployed quickly. MFA, encryption, endpoint protection, filtering. Documentation cannot be conjured the week a bid is due, because much of it describes activity over time. Training records need training to have happened. Restore test records need restores to have been tested. Access review records need reviews to have occurred.
Firms that treat this as a paperwork exercise at bid time usually end up either missing the deadline or answering optimistically, which is its own risk. RJ PRO Tech Group builds the evidence trail as part of ongoing IT support in Sacramento, so the records exist before anyone asks for them.
| Have a Security Questionnaire You Can’t Answer? We’ll review what’s being asked, tell you plainly where your gaps are, and what it takes to close them. Fifteen minutes, no obligation. ▶ REQUEST A FREE CONSULTATION Or call us directly: (916) 345-3451 Valley Springs: (209) 920-4077 | help@rj-pro.net |
Being a Subcontractor Doesn’t Lower the Bar
A recurring assumption among smaller firms is that flow-down terms are a formality. They aren’t.
When a prime accepts security obligations, they carry the exposure for everyone working under them. That gives them a direct interest in what your environment looks like, and increasingly they ask. Some run their own questionnaires on subs. Some require specific controls before they’ll add you to a team.
Two practical consequences. Being unable to answer can cost you a place on a bid team before the proposal is even submitted. And a security failure at your firm can create problems for the prime’s contract, which tends to end the relationship regardless of contract language.
The flip side is worth noticing. If you can answer a security questionnaire cleanly and quickly, you become easier to work with than the sub who can’t. That’s a competitive advantage that has nothing to do with your price.
Signs You’re Not Ready to Answer Honestly
Count how many apply to your firm.
- You have no written information security policy
- Multi-factor authentication is enabled for some accounts and you’re not sure which
- Nobody can name the date of the last successful backup restore
- Staff share a login for at least one system
- You have no incident response plan in writing
- There’s no current inventory of devices and who has them
- Security awareness training has happened, but there are no completion records
- A former employee might still have access to something
- Your IT provider has admin access and no security terms in your agreement
- You’d have to guess at several answers on a questionnaire
Three or four is common. Six or more means the next security questionnaire is going to be a problem, and it’s better to find that out now than the week before a submission.
What It Costs and How Long It Takes
Two separate things, and firms often conflate them.
Ongoing managed IT is priced per user or per device, monthly. What moves that number: headcount and device count, whether you run an on-premise server or work in cloud services, hardware age, how much monitoring and reporting you need, and your onsite response expectations.
Initial remediation is a separate project, quoted after an assessment. A firm with no MFA, untested backups and two end-of-life machines has real work to do first. A firm that’s mostly in decent shape and needs documentation has a much smaller project.
Documentation is its own effort, and it’s the one people underestimate.
On timing, be skeptical of anyone who quotes you a duration before seeing your environment. Technical controls often move in days or weeks. Building an evidence trail that reflects real activity takes longer, because some of it accumulates rather than being written. Starting several months before you need it is the difference between a clean answer and an awkward one.
RJ PRO Tech Group works on flat-rate monthly pricing, so ongoing costs stay predictable and can be built into your overhead rather than appearing as surprise invoices. You can see how we approach managed cybersecurity and what’s included.
Questions to Ask an IT Provider Before You Hire One
These separate providers who can support this work from those who’ll be learning on your contract.
- Will you accept security terms flowed down from our contracts into our agreement with you?
- Can you produce documentation and evidence packages for security questionnaires?
- What reporting will we receive, and would it stand up if a client asked to see it?
- How do you test our backups, and how often will we see proof?
- Will you support us during an audit or a client security review?
- What’s your guaranteed response time, and is it in the contract?
- How do you handle offboarding, so departed staff lose access immediately?
- What’s your onsite response time to our address specifically?
- Who owns our documentation, passwords and licenses if we part ways?
- Can we speak to a client of similar size?
The last one tells you most. A provider comfortable with it will offer references and client case studies without hesitating, and you can read what our clients say beforehand.
Why a Local Provider Helps Here
Most of this work happens remotely. Some of it can’t. Hardware failures, device collection when someone leaves, a site visit for an assessment, or simply being reachable on the afternoon a submission is due.
RJ PRO Tech Group has offices in El Dorado Hills and Valley Springs, with technicians covering Downtown Sacramento, Midtown, Natomas, Rancho Cordova, West Sacramento, Elk Grove, Citrus Heights, Roseville and Folsom. We’ve supported Northern California businesses since 2010 and provide 24/7 helpdesk support alongside server management and monitoring. Check the areas we service for your location.
Same timezone matters more than it sounds. When a prime sends a questionnaire with a two-day turnaround, you need someone who answers, not a ticket queue three timezones west. More on IT support in Sacramento and how we work with businesses in the region.
Frequently Asked Questions
How do I find out what security requirements apply to a specific solicitation?
Read the solicitation and any attached terms, exhibits or data-handling addenda, since requirements usually sit there rather than in the main scope. If the language is unclear, submit a question during the official question period. That’s the reliable route. An IT provider can explain what a requirement means technically, but whether it applies to your opportunity is a question for the agency and your own counsel.
We’re only a subcontractor. Do these requirements apply to us?
Often yes, through flow-down terms in your agreement with the prime. Primes carry the obligations they accepted and generally pass them to anyone touching the work. Read your subcontract rather than assuming the prime absorbs everything. Many primes now run their own security questionnaires on subs before adding them to a team.
Do we need a specific certification to win state work?
It depends entirely on the agency, the contract and the data involved. Some opportunities reference a formal framework or third-party assessment, many don’t and simply set out required controls and terms. Don’t assume you need a costly certification before confirming it’s actually being asked for, and don’t assume you need nothing.
What’s the difference between having good security and being able to prove it?
Security is what your systems do. Evidence is what you can show a third party. Questionnaires and audits test the second one. Written policies, access logs, training completion records, restore test results and an incident response plan are all documents, and a firm with solid technical controls can still fail on the paperwork.
How long does it take to get ready if we’ve done nothing?
Technical controls like MFA, encryption and endpoint protection often deploy within days or weeks. Documentation takes longer, partly because some records reflect activity over time rather than a single writing exercise. Starting several months before you need to answer a questionnaire is realistic. Starting the week of a deadline generally isn’t.
What does this cost for a small business?
Ongoing managed IT is priced per user or per device monthly, shaped by headcount, whether you have an on-premise server, hardware age and reporting needs. Remediation and documentation work are quoted separately after an assessment. Compare proposals on scope rather than monthly total, since the cheaper one often excludes the evidence work you specifically need.
Can our IT provider be held to these requirements too?
Frequently yes. Security terms often extend to anyone with access to the data, and an IT provider with administrative access clearly qualifies. Check whether your current agreement includes security obligations at all. If it doesn’t, that’s a gap worth closing before a client asks about your vendor oversight.
What happens if we say yes on a questionnaire and it isn’t accurate?
Answers on security questionnaires are typically treated as representations, and inaccurate ones can carry contractual consequences. The same issue arises with cyber insurance, where claims can be affected if attested controls weren’t in place. The safer path is answering accurately, noting what’s in progress, and closing gaps on a stated timeline.
Where to Start
Start with a clear picture of where you stand. Which accounts have MFA and which don’t. Whether backups restore. What documentation exists. Who has access that shouldn’t. That assessment costs you nothing but an hour, and it turns a vague worry into a list you can work through in order.
RJ PRO Tech Group provides IT support in Sacramento and across Northern California, with 24/7 monitoring, proactive maintenance rather than break-fix, local technicians who can be onsite, flat-rate monthly pricing, and the reporting and documentation support that security questionnaires ask for.
| Find Out Where Your Firm Actually Stands Book a fifteen-minute call with a local team that has supported Northern California businesses since 2010. We’ll tell you what needs fixing first, and what can wait. ▶ REQUEST A FREE CONSULTATION Or call us directly: (916) 345-3451 Valley Springs: (209) 920-4077 | help@rj-pro.net |
