Government Contracts: What’s Needed to Protect the Data?
This past week, I served as the moderator for a breakout session at the Michigan Cyber Summit 2026. The session’s title was “Buying Securely: Funding, Contracts, and the Questions That Matter.” The panelists included:
- Simon Baldwin, Category Director IT, Central Procurement Enterprise Sourcing, Department of Technology, Management and Budget (DTMB), state of Michigan.
- Kara Ortiz, Director Identity and Architecture, Department of Technology, Management and Budget (DTMB), Cybersecurity and Infrastructure Protection, State Police Headquarters, state of Michigan.
- Alexander Root, Assistant Attorney General, Office of the Attorney General, state of Michigan.
It was a great discussion, and I will share several of the top takeaways with you in this blog. Nevertheless, I want to start with some of the questions that we covered with the panel prior to taking questions from the audience. Note: I share these questions, since I encourage state and local government leaders in technology and cybersecurity across the country to ask some of these same questions of the contracting professionals (including legal counsel) in your particular government.
Here are the questions:
- What security requirements and contractual structure should be established before a procurement ever goes out the door?
- What contract terms do you consider non-negotiable when purchasing a cybersecurity product or service?
- How can schedules help organizations move faster while still ensuring they’re making sound security decisions?
- When does it make sense to take a modular approach to IT purchases instead of trying to solve everything with a single procurement?
- How can procurement, legal and security teams work together earlier in the process to avoid contract issues later?
- For organizations that may not have large procurement teams or deep purchasing expertise, what resources or programs can help them make smarter and faster cybersecurity purchasing decisions?
- What’s the biggest challenge or red flag you see in a contract that immediately gets your attention when trying to ensure a secure purchase?
- What practices or processes would help in validating a vendor’s security posture?
- How can you effectively work with your cybersecurity partners?
- What is the most important thing that leaders should focus on to enhance security in their procurement practices?
MAJOR THEMES ON CONTRACT WORDING
While I won’t go through the entire conversation here, I want to highlight some overall themes from the panel, rather than addressing each question individually.First, data was front and center throughout the discussion. Do you know all the user data that will be used and stored? What are the legal and compliance requirements for that data? For example, criminal justice (CJIS requirements), health information (HIPAA security requirements), payment card industry (PCI requirements), Internal Revenue Service (IRS requirements) and much more. Note that these laws and most regulations must be clearly articulated and cannot be negotiated out of contracts after award.
Second, collaboration is essential both internally and externally. Getting input from a multitude of stakeholders is key for successful procurements. Procurement officials must collaborate with IT security teams, chief information security officers, the government business areas that manage the data, and legal counsel to ensure contracts contain accurate cybersecurity requirements.
Most governments point directly to the National Institute of Standards and Technology (NIST) frameworks to dictate technical specifications:
- NIST Cybersecurity Framework (CSF) 2.0: A high-level, outcomes-based guide organized around six pillars (Govern, Identify, Protect, Detect, Respond, Recover) to help organizations manage overall enterprise risk.
- NIST SP 800-161 Rev. 1 (C-SCRM): Specifically targets Cybersecurity Supply Chain Risk Management. Procurement officials use this guide to ensure that products or services do not inject malicious, counterfeit or vulnerable components into their ecosystem.
Third, there was a lot of discussion around cooperative agreements. In public procurement, cooperative purchasing agreements allow different government entities to pool their buying power to lower costs, eliminate redundant bidding processes and save administrative time.
In Michigan, this is done in two distinct ways: externally (piggybacking on national or other states’ contracts) and internally (allowing local entities to piggyback on Michigan’s state contracts).
State of Michigan procurement officials frequently buy goods and services through massive national cooperative purchasing organizations (such as NASPO ValuePoint) or through joint agreements with other states. MiDEAL is Michigan’s premier internal program designed for this exact purpose. The state acts as the lead agency, and local Michigan public entities piggyback on the contracts the state has already negotiated.
Fourth, the need for and importance of continuous monitoring was also emphasized. Michigan participates in GovRAMP, which defines continuous monitoring this way: “Continuous monitoring means continuous assurance.
“Continuous monitoring helps ensure a service provider’s solution continues to meet its security requirements and maintain a secure state. It provides ongoing visibility into a solution’s vulnerabilities and security posture, allowing service providers to address findings, resolve outstanding items and remain aligned with GovRAMP requirements.
“Continuous monitoring also helps identify areas of risk so service providers can take timely action to protect their systems. When vulnerabilities or other security concerns arise, government agencies can use this information to make informed, risk-based decisions.”
Fifth, one question came from the audience regarding regular “sticking points” or roadblocks encountered. The answer given was on contract clauses that cannot be negotiated, such as “24-hour notice of a data breach.”
There were also questions around using AI, and several examples were given of problems with AI being used for RFPs and proposals. Bottom line, ensure that a human is always reviewing and accountable for everything that is included in the solicitations and in vendor responses.
ESSENTIAL CYBERSECURITY CONTRACT CLAUSES
I want to close with a few samples from around the country that can help. The panelists did say that they collaborate with peers nationwide to constantly improve their contract wording.
While I am not a lawyer and you should always seek legal advice before deciding on any particular words for your contracts, here are some sample clauses to consider with approximate wording (which did not come from Michigan panelists but are listed to provide some general guidance):
- Breach Notification Clause: Dictates how and when a vendor must report an incident.
Example wording: “The Contractor shall notify the Organization within 24 hours of discovering any suspected or confirmed data breach or unauthorized access to systems hosting or processing organizational data. The Contractor shall provide a full forensic report within 7 days and bear all costs associated with remediation.”
- Right to Audit and Security Assessments: Grants permission to evaluate the vendor’s digital infrastructure.
Example wording: “The Organization reserves the right to conduct an annual cybersecurity audit or independent vulnerability penetration testing of the Contractor’s systems with a 30-day notice. In lieu of an active audit, the Contractor may submit an independent, third-party audited SOC 2 Type II report.”
- Data Protection and Encryption Standards: Locks down data access and visibility parameters.
Example wording: “The Contractor must ensure all data handled on behalf of the Organization is encrypted at rest and in transit utilizing a minimum of AES 256-bit encryption. Multi-Factor Authentication (MFA) must be enforced for all remote and administrative access.”
NOTE: Other cyber summit sessions discussed future wording that may be coming to ensure PQC readiness.
- Subcontractor Flow-Down Clause: Ensures security extends beyond the primary contractor.
Example wording: “The Contractor shall flow down all cybersecurity and data privacy obligations contained in this agreement to all subcontractors, vendors, and third-party affiliates involved in the execution of this contract.”
FINAL THOUGHTS
Contract wording often seems boring or a minor part of cybersecurity readiness for inexperienced government leaders, but smart CISOs and other savvy technology leaders understand the importance of getting procurements and contracts right.
While I have not covered this topic in several years within the Lohrmann on Cybersecurity blog, the session this week at the Michigan Cyber Summit reminded me of just how essential it is to get contracts right. This starts with the procurement strategy and ensuring full life cycle updates and continuous monitoring of systems and data to ensure ongoing compliance.
About Author
