Security

Selling to government agencies: the document security questions you will be asked.

Winning public sector work means answering questions that private customers rarely ask in such detail. A city procurement office, a state department or a federal contracting officer will want to know how you protect the information they give you, who on your team can see it, and what happens to it when the contract ends.

This article walks through the kinds of questions suppliers commonly meet, how to prepare answers you can stand behind, and where a data room helps with the document side of the work. Contract requirements vary widely, so treat it as orientation, and read your solicitation and contract with an attorney or contracts advisor.

Start with what the contract actually says

Government security expectations are written into specific documents, and the details differ from one agency and one contract to the next. Before you build a policy, find the clauses that apply to you. In federal work, look at the solicitation, the contract clauses incorporated from the Federal Acquisition Regulation, any agency supplements, and the statement of work. State and local agencies often attach their own security exhibits or questionnaires to an RFP.

Defense contractors who handle Controlled Unclassified Information generally meet DFARS clause 252.204-7012 and the security requirements in NIST Special Publication 800-171, and the Department of Defense's Cybersecurity Maturity Model Certification program adds assessment requirements for many contracts. Those obligations are detailed and technical. If your work touches that kind of information, the contract will tell you which systems and controls are required, and a general-purpose tool may not be the right place for it. Ask the contracting officer before you assume.

Questions suppliers commonly meet

Even outside the defense world, agency questionnaires tend to circle the same themes. Preparing an answer for each in advance saves time on every bid.

Access

Who in your organization can open agency documents, and how is that decided?
How do people sign in, and is two-step verification required?
How quickly can you remove a person's access when they leave the project?

Handling and sharing

Do you share agency information with subcontractors, and how?
Can documents be downloaded, printed or copied, and can you prevent that?
How do you mark or label sensitive material?

Records and incidents

Can you show who accessed a given document and when?
How would you know if something was accessed that should not have been?
Whom would you notify, and how fast, if an incident occurred?
What happens to agency files at the end of the contract?

Location and vendors

Many questionnaires ask where data is held and which third-party services touch it. Answer that precisely for every tool in the chain, including file sharing. If you are unsure of a vendor's answer, ask the vendor in writing rather than guessing. A wrong answer on a government questionnaire is far worse than a careful one.

Preparing answers you can stand behind

The most common mistake is answering aspirationally: describing the controls you plan to have rather than the ones you operate today. Reviewers notice when answers are vague, and inconsistencies between bids can surface later.

Keep one master set of security answers and update it whenever a tool or process changes.
For each answer, note the evidence: a screenshot of a setting, a policy document, an export from a log.
Mark plainly where something does not apply or is not in place.
Have someone who did not write the answers check them against reality.

Your RFP response itself is a sensitive document set. Pricing, staffing and technical approaches are commercially valuable, and teaming partners often need to see parts of it before submission.

Where a data room fits

A data room is useful in two places in government work: assembling a proposal with partners, and exchanging documents with an agency or prime contractor during performance, where the contract permits it.

In ShareAndGo, every recipient confirms their own email address with a six-digit code, so access belongs to a named person rather than to a link. Groups let a teaming partner see only the volumes they are working on. Download, print, copy and watermark controls can be set for the whole room and for each group. For view-only recipients, PDFs, Word, Excel and PowerPoint files are rendered on our side with the viewer's name, email address and the date across the page, and the original is not sent to their browser.

Every upload is scanned for viruses and held back until the scan is clean. The audit log records every view, upload, download, invitation and change, chained so that alterations are detectable, and it exports as CSV, which gives you material to answer the access questions above. Invitations can carry an end date and can be revoked immediately when someone rolls off the project.

If a questionnaire asks where ShareAndGo keeps documents, the accurate answer is this: Your documents are stored in the United States. Some services run elsewhere, and our privacy policy lists them. Some agencies and contracts require information to be kept in particular places or particular systems. Check that requirement before you put agency information anywhere, including in ShareAndGo.

Common questions

Can I use a data room for Controlled Unclassified Information?

That depends on your contract, which will specify the systems and controls required for CUI. Read the clauses with your contracts advisor and ask the contracting officer before choosing any tool.

Can a teaming partner see only part of our proposal?

Yes. Put each volume in its own folder and give the partner a group that can see only the folders they need.

Does the audit log show who downloaded a file?

Yes. Downloads, views, uploads, invitations and changes are all recorded with the person and the time.